Merge tag 'asoc-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v4.13

The big news with this release is the of-graph card, this provides a
replacement for simple-card that is much more flexibile and scalable,
allowing many more systems to use a generic sound card than was possible
before:

 - The of-graph card, finally merged after a long and dedicated effort
   by Morimoto-san.
 - New widget types intended mainly for use with DSPs.
 - New drivers for Allwinner V3s SoCs, Ensonic ES8316, several classes
   of x86 machine, Rockchip PDM controllers, STM32 I2S and S/PDIF
   controllers and ZTE AUD96P22 CODECs.

1501 files changed, 24726 insertions, 9790 deletions

diff --git a/Documentation/acpi/acpi-lid.txt b/Documentation/acpi/acpi-lid.txt
index 22cb3091f297..effe7af3a5af 100644
--- a/Documentation/acpi/acpi-lid.txt
+++ b/Documentation/acpi/acpi-lid.txt
@@ -59,20 +59,28 @@ button driver uses the following 3 modes in order not to trigger issues.
 If the userspace hasn't been prepared to ignore the unreliable "opened"
 events and the unreliable initial state notification, Linux users can use
 the following kernel parameters to handle the possible issues:
-A. button.lid_init_state=open:
+A. button.lid_init_state=method:
+   When this option is specified, the ACPI button driver reports the
+   initial lid state using the returning value of the _LID control method
+   and whether the "opened"/"closed" events are paired fully relies on the
+   firmware implementation.
+   This option can be used to fix some platforms where the returning value
+   of the _LID control method is reliable but the initial lid state
+   notification is missing.
+   This option is the default behavior during the period the userspace
+   isn't ready to handle the buggy AML tables.
+B. button.lid_init_state=open:
    When this option is specified, the ACPI button driver always reports the
    initial lid state as "opened" and whether the "opened"/"closed" events
    are paired fully relies on the firmware implementation.
    This may fix some platforms where the returning value of the _LID
    control method is not reliable and the initial lid state notification is
    missing.
-   This option is the default behavior during the period the userspace
-   isn't ready to handle the buggy AML tables.
 
 If the userspace has been prepared to ignore the unreliable "opened" events
 and the unreliable initial state notification, Linux users should always
 use the following kernel parameter:
-B. button.lid_init_state=ignore:
+C. button.lid_init_state=ignore:
    When this option is specified, the ACPI button driver never reports the
    initial lid state and there is a compensation mechanism implemented to
    ensure that the reliable "closed" notifications can always be delievered
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 15f79c27748d..7737ab5d04b2 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -866,6 +866,15 @@
 
         dscc4.setup=    [NET]
 
+        dt_cpu_ftrs=    [PPC]
+                        Format: {"off" | "known"}
+                        Control how the dt_cpu_ftrs device-tree binding is
+                        used for CPU feature discovery and setup (if it
+                        exists).
+                        off: Do not use it, fall back to legacy cpu table.
+                        known: Do not pass through unknown features to guests
+                        or userspace, only those that the kernel is aware of.
+
         dump_apple_properties   [X86]
                         Dump name and content of EFI device properties on
                         x86 Macs.  Useful for driver authors to determine
@@ -3802,6 +3811,13 @@
                         expediting.  Set to zero to disable automatic
                         expediting.
 
+        stack_guard_gap=        [MM]
+                        override the default stack gap protection. The value
+                        is in page units and it defines how many pages prior
+                        to (for stacks growing down) resp. after (for stacks
+                        growing up) the main stack are reserved for no other
+                        mapping. Default value is 256 pages.
+
         stacktrace      [FTRACE]
                         Enabled the stack tracer on boot up.
 
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 289c80f7760e..09aa2e949787 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -1,4 +1,5 @@
 .. |struct cpufreq_policy| replace:: :c:type:`struct cpufreq_policy <cpufreq_policy>`
+.. |intel_pstate| replace:: :doc:`intel_pstate <intel_pstate>`
 
 =======================
 CPU Performance Scaling
@@ -75,7 +76,7 @@ feedback registers, as that information is typically specific to the hardware
 interface it comes from and may not be easily represented in an abstract,
 platform-independent way.  For this reason, ``CPUFreq`` allows scaling drivers
 to bypass the governor layer and implement their own performance scaling
-algorithms.  That is done by the ``intel_pstate`` scaling driver.
+algorithms.  That is done by the |intel_pstate| scaling driver.
 
 
 ``CPUFreq`` Policy Objects
@@ -174,13 +175,13 @@ necessary to restart the scaling governor so that it can take the new online CPU
 into account.  That is achieved by invoking the governor's ``->stop`` and
 ``->start()`` callbacks, in this order, for the entire policy.
 
-As mentioned before, the ``intel_pstate`` scaling driver bypasses the scaling
+As mentioned before, the |intel_pstate| scaling driver bypasses the scaling
 governor layer of ``CPUFreq`` and provides its own P-state selection algorithms.
-Consequently, if ``intel_pstate`` is used, scaling governors are not attached to
+Consequently, if |intel_pstate| is used, scaling governors are not attached to
 new policy objects.  Instead, the driver's ``->setpolicy()`` callback is invoked
 to register per-CPU utilization update callbacks for each policy.  These
 callbacks are invoked by the CPU scheduler in the same way as for scaling
-governors, but in the ``intel_pstate`` case they both determine the P-state to
+governors, but in the |intel_pstate| case they both determine the P-state to
 use and change the hardware configuration accordingly in one go from scheduler
 context.
 
@@ -257,7 +258,7 @@ are the following:
 
 ``scaling_available_governors``
         List of ``CPUFreq`` scaling governors present in the kernel that can
-        be attached to this policy or (if the ``intel_pstate`` scaling driver is
+        be attached to this policy or (if the |intel_pstate| scaling driver is
         in use) list of scaling algorithms provided by the driver that can be
         applied to this policy.
 
@@ -274,7 +275,7 @@ are the following:
         the CPU is actually running at (due to hardware design and other
         limitations).
 
-        Some scaling drivers (e.g. ``intel_pstate``) attempt to provide
+        Some scaling drivers (e.g. |intel_pstate|) attempt to provide
         information more precisely reflecting the current CPU frequency through
         this attribute, but that still may not be the exact current CPU
         frequency as seen by the hardware at the moment.
@@ -284,13 +285,13 @@ are the following:
 
 ``scaling_governor``
         The scaling governor currently attached to this policy or (if the
-        ``intel_pstate`` scaling driver is in use) the scaling algorithm
+        |intel_pstate| scaling driver is in use) the scaling algorithm
         provided by the driver that is currently applied to this policy.
 
         This attribute is read-write and writing to it will cause a new scaling
         governor to be attached to this policy or a new scaling algorithm
         provided by the scaling driver to be applied to it (in the
-        ``intel_pstate`` case), as indicated by the string written to this
+        |intel_pstate| case), as indicated by the string written to this
         attribute (which must be one of the names listed by the
         ``scaling_available_governors`` attribute described above).
 
@@ -619,7 +620,7 @@ This file is located under :file:`/sys/devices/system/cpu/cpufreq/` and controls
 the "boost" setting for the whole system.  It is not present if the underlying
 scaling driver does not support the frequency boost mechanism (or supports it,
 but provides a driver-specific interface for controlling it, like
-``intel_pstate``).
+|intel_pstate|).
 
 If the value in this file is 1, the frequency boost mechanism is enabled.  This
 means that either the hardware can be put into states in which it is able to
diff --git a/Documentation/admin-guide/pm/index.rst b/Documentation/admin-guide/pm/index.rst
index c80f087321fc..7f148f76f432 100644
--- a/Documentation/admin-guide/pm/index.rst
+++ b/Documentation/admin-guide/pm/index.rst
@@ -6,6 +6,7 @@ Power Management
    :maxdepth: 2
 
    cpufreq
+   intel_pstate
 
 .. only::  subproject and html
 
diff --git a/Documentation/admin-guide/pm/intel_pstate.rst b/Documentation/admin-guide/pm/intel_pstate.rst
new file mode 100644
index 000000000000..33d703989ea8
--- /dev/null
+++ b/Documentation/admin-guide/pm/intel_pstate.rst
@@ -0,0 +1,755 @@
+===============================================
+``intel_pstate`` CPU Performance Scaling Driver
+===============================================
+
+::
+
+ Copyright (c) 2017 Intel Corp., Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+
+General Information
+===================
+
+``intel_pstate`` is a part of the
+:doc:`CPU performance scaling subsystem <cpufreq>` in the Linux kernel
+(``CPUFreq``).  It is a scaling driver for the Sandy Bridge and later
+generations of Intel processors.  Note, however, that some of those processors
+may not be supported.  [To understand ``intel_pstate`` it is necessary to know
+how ``CPUFreq`` works in general, so this is the time to read :doc:`cpufreq` if
+you have not done that yet.]
+
+For the processors supported by ``intel_pstate``, the P-state concept is broader
+than just an operating frequency or an operating performance point (see the
+`LinuxCon Europe 2015 presentation by Kristen Accardi <LCEU2015_>`_ for more
+information about that).  For this reason, the representation of P-states used
+by ``intel_pstate`` internally follows the hardware specification (for details
+refer to `Intel® 64 and IA-32 Architectures Software Developer’s Manual
+Volume 3: System Programming Guide <SDM_>`_).  However, the ``CPUFreq`` core
+uses frequencies for identifying operating performance points of CPUs and
+frequencies are involved in the user space interface exposed by it, so
+``intel_pstate`` maps its internal representation of P-states to frequencies too
+(fortunately, that mapping is unambiguous).  At the same time, it would not be
+practical for ``intel_pstate`` to supply the ``CPUFreq`` core with a table of
+available frequencies due to the possible size of it, so the driver does not do
+that.  Some functionality of the core is limited by that.
+
+Since the hardware P-state selection interface used by ``intel_pstate`` is
+available at the logical CPU level, the driver always works with individual
+CPUs.  Consequently, if ``intel_pstate`` is in use, every ``CPUFreq`` policy
+object corresponds to one logical CPU and ``CPUFreq`` policies are effectively
+equivalent to CPUs.  In particular, this means that they become "inactive" every
+time the corresponding CPU is taken offline and need to be re-initialized when
+it goes back online.
+
+``intel_pstate`` is not modular, so it cannot be unloaded, which means that the
+only way to pass early-configuration-time parameters to it is via the kernel
+command line.  However, its configuration can be adjusted via ``sysfs`` to a
+great extent.  In some configurations it even is possible to unregister it via
+``sysfs`` which allows another ``CPUFreq`` scaling driver to be loaded and
+registered (see `below <status_attr_>`_).
+
+
+Operation Modes
+===============
+
+``intel_pstate`` can operate in three different modes: in the active mode with
+or without hardware-managed P-states support and in the passive mode.  Which of
+them will be in effect depends on what kernel command line options are used and
+on the capabilities of the processor.
+
+Active Mode
+-----------
+
+This is the default operation mode of ``intel_pstate``.  If it works in this
+mode, the ``scaling_driver`` policy attribute in ``sysfs`` for all ``CPUFreq``
+policies contains the string "intel_pstate".
+
+In this mode the driver bypasses the scaling governors layer of ``CPUFreq`` and
+provides its own scaling algorithms for P-state selection.  Those algorithms
+can be applied to ``CPUFreq`` policies in the same way as generic scaling
+governors (that is, through the ``scaling_governor`` policy attribute in
+``sysfs``).  [Note that different P-state selection algorithms may be chosen for
+different policies, but that is not recommended.]
+
+They are not generic scaling governors, but their names are the same as the
+names of some of those governors.  Moreover, confusingly enough, they generally
+do not work in the same way as the generic governors they share the names with.
+For example, the ``powersave`` P-state selection algorithm provided by
+``intel_pstate`` is not a counterpart of the generic ``powersave`` governor
+(roughly, it corresponds to the ``schedutil`` and ``ondemand`` governors).
+
+There are two P-state selection algorithms provided by ``intel_pstate`` in the
+active mode: ``powersave`` and ``performance``.  The way they both operate
+depends on whether or not the hardware-managed P-states (HWP) feature has been
+enabled in the processor and possibly on the processor model.
+
+Which of the P-state selection algorithms is used by default depends on the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option.
+Namely, if that option is set, the ``performance`` algorithm will be used by
+default, and the other one will be used by default if it is not set.
+
+Active Mode With HWP
+~~~~~~~~~~~~~~~~~~~~
+
+If the processor supports the HWP feature, it will be enabled during the
+processor initialization and cannot be disabled after that.  It is possible
+to avoid enabling it by passing the ``intel_pstate=no_hwp`` argument to the
+kernel in the command line.
+
+If the HWP feature has been enabled, ``intel_pstate`` relies on the processor to
+select P-states by itself, but still it can give hints to the processor's
+internal P-state selection logic.  What those hints are depends on which P-state
+selection algorithm has been applied to the given policy (or to the CPU it
+corresponds to).
+
+Even though the P-state selection is carried out by the processor automatically,
+``intel_pstate`` registers utilization update callbacks with the CPU scheduler
+in this mode.  However, they are not used for running a P-state selection
+algorithm, but for periodic updates of the current CPU frequency information to
+be made available from the ``scaling_cur_freq`` policy attribute in ``sysfs``.
+
+HWP + ``performance``
+.....................
+
+In this configuration ``intel_pstate`` will write 0 to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise), which means that the processor's
+internal P-state selection logic is expected to focus entirely on performance.
+
+This will override the EPP/EPB setting coming from the ``sysfs`` interface
+(see `Energy vs Performance Hints`_ below).
+
+Also, in this configuration the range of P-states available to the processor's
+internal P-state selection logic is always restricted to the upper boundary
+(that is, the maximum P-state that the driver is allowed to use).
+
+HWP + ``powersave``
+...................
+
+In this configuration ``intel_pstate`` will set the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise) to whatever value it was
+previously set to via ``sysfs`` (or whatever default value it was
+set to by the platform firmware).  This usually causes the processor's
+internal P-state selection logic to be less performance-focused.
+
+Active Mode Without HWP
+~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default operation mode for processors that do not support the HWP
+feature.  It also is used by default with the ``intel_pstate=no_hwp`` argument
+in the kernel command line.  However, in this mode ``intel_pstate`` may refuse
+to work with the given processor if it does not recognize it.  [Note that
+``intel_pstate`` will never refuse to work with any processor with the HWP
+feature enabled.]
+
+In this mode ``intel_pstate`` registers utilization update callbacks with the
+CPU scheduler in order to run a P-state selection algorithm, either
+``powersave`` or ``performance``, depending on the ``scaling_cur_freq`` policy
+setting in ``sysfs``.  The current CPU frequency information to be made
+available from the ``scaling_cur_freq`` policy attribute in ``sysfs`` is
+periodically updated by those utilization update callbacks too.
+
+``performance``
+...............
+
+Without HWP, this P-state selection algorithm is always the same regardless of
+the processor model and platform configuration.
+
+It selects the maximum P-state it is allowed to use, subject to limits set via
+``sysfs``, every time the P-state selection computations are carried out by the
+driver's utilization update callback for the given CPU (that does not happen
+more often than every 10 ms), but the hardware configuration will not be changed
+if the new P-state is the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is set.
+
+``powersave``
+.............
+
+Without HWP, this P-state selection algorithm generally depends on the
+processor model and/or the system profile setting in the ACPI tables and there
+are two variants of it.
+
+One of them is used with processors from the Atom line and (regardless of the
+processor model) on platforms with the system profile in the ACPI tables set to
+"mobile" (laptops mostly), "tablet", "appliance PC", "desktop", or
+"workstation".  It is also used with processors supporting the HWP feature if
+that feature has not been enabled (that is, with the ``intel_pstate=no_hwp``
+argument in the kernel command line).  It is similar to the algorithm
+implemented by the generic ``schedutil`` scaling governor except that the
+utilization metric used by it is based on numbers coming from feedback
+registers of the CPU.  It generally selects P-states proportional to the
+current CPU utilization, so it is referred to as the "proportional" algorithm.
+
+The second variant of the ``powersave`` P-state selection algorithm, used in all
+of the other cases (generally, on processors from the Core line, so it is
+referred to as the "Core" algorithm), is based on the values read from the APERF
+and MPERF feedback registers and the previously requested target P-state.
+It does not really take CPU utilization into account explicitly, but as a rule
+it causes the CPU P-state to ramp up very quickly in response to increased
+utilization which is generally desirable in server environments.
+
+Regardless of the variant, this algorithm is run by the driver's utilization
+update callback for the given CPU when it is invoked by the CPU scheduler, but
+not more often than every 10 ms (that can be tweaked via ``debugfs`` in `this
+particular case <Tuning Interface in debugfs_>`_).  Like in the ``performance``
+case, the hardware configuration is not touched if the new P-state turns out to
+be the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is not set.
+
+Passive Mode
+------------
+
+This mode is used if the ``intel_pstate=passive`` argument is passed to the
+kernel in the command line (it implies the ``intel_pstate=no_hwp`` setting too).
+Like in the active mode without HWP support, in this mode ``intel_pstate`` may
+refuse to work with the given processor if it does not recognize it.
+
+If the driver works in this mode, the ``scaling_driver`` policy attribute in
+``sysfs`` for all ``CPUFreq`` policies contains the string "intel_cpufreq".
+Then, the driver behaves like a regular ``CPUFreq`` scaling driver.  That is,
+it is invoked by generic scaling governors when necessary to talk to the
+hardware in order to change the P-state of a CPU (in particular, the
+``schedutil`` governor can invoke it directly from scheduler context).
+
+While in this mode, ``intel_pstate`` can be used with all of the (generic)
+scaling governors listed by the ``scaling_available_governors`` policy attribute
+in ``sysfs`` (and the P-state selection algorithms described above are not
+used).  Then, it is responsible for the configuration of policy objects
+corresponding to CPUs and provides the ``CPUFreq`` core (and the scaling
+governors attached to the policy objects) with accurate information on the
+maximum and minimum operating frequencies supported by the hardware (including
+the so-called "turbo" frequency ranges).  In other words, in the passive mode
+the entire range of available P-states is exposed by ``intel_pstate`` to the
+``CPUFreq`` core.  However, in this mode the driver does not register
+utilization update callbacks with the CPU scheduler and the ``scaling_cur_freq``
+information comes from the ``CPUFreq`` core (and is the last frequency selected
+by the current scaling governor for the given policy).
+
+
+.. _turbo:
+
+Turbo P-states Support
+======================
+
+In the majority of cases, the entire range of P-states available to
+``intel_pstate`` can be divided into two sub-ranges that correspond to
+different types of processor behavior, above and below a boundary that
+will be referred to as the "turbo threshold" in what follows.
+
+The P-states above the turbo threshold are referred to as "turbo P-states" and
+the whole sub-range of P-states they belong to is referred to as the "turbo
+range".  These names are related to the Turbo Boost technology allowing a
+multicore processor to opportunistically increase the P-state of one or more
+cores if there is enough power to do that and if that is not going to cause the
+thermal envelope of the processor package to be exceeded.
+
+Specifically, if software sets the P-state of a CPU core within the turbo range
+(that is, above the turbo threshold), the processor is permitted to take over
+performance scaling control for that core and put it into turbo P-states of its
+choice going forward.  However, that permission is interpreted differently by
+different processor generations.  Namely, the Sandy Bridge generation of
+processors will never use any P-states above the last one set by software for
+the given core, even if it is within the turbo range, whereas all of the later
+processor generations will take it as a license to use any P-states from the
+turbo range, even above the one set by software.  In other words, on those
+processors setting any P-state from the turbo range will enable the processor
+to put the given core into all turbo P-states up to and including the maximum
+supported one as it sees fit.
+
+One important property of turbo P-states is that they are not sustainable.  More
+precisely, there is no guarantee that any CPUs will be able to stay in any of
+those states indefinitely, because the power distribution within the processor
+package may change over time  or the thermal envelope it was designed for might
+be exceeded if a turbo P-state was used for too long.
+
+In turn, the P-states below the turbo threshold generally are sustainable.  In
+fact, if one of them is set by software, the processor is not expected to change
+it to a lower one unless in a thermal stress or a power limit violation
+situation (a higher P-state may still be used if it is set for another CPU in
+the same package at the same time, for example).
+
+Some processors allow multiple cores to be in turbo P-states at the same time,
+but the maximum P-state that can be set for them generally depends on the number
+of cores running concurrently.  The maximum turbo P-state that can be set for 3
+cores at the same time usually is lower than the analogous maximum P-state for
+2 cores, which in turn usually is lower than the maximum turbo P-state that can
+be set for 1 core.  The one-core maximum turbo P-state is thus the maximum
+supported one overall.
+
+The maximum supported turbo P-state, the turbo threshold (the maximum supported
+non-turbo P-state) and the minimum supported P-state are specific to the
+processor model and can be determined by reading the processor's model-specific
+registers (MSRs).  Moreover, some processors support the Configurable TDP
+(Thermal Design Power) feature and, when that feature is enabled, the turbo
+threshold effectively becomes a configurable value that can be set by the
+platform firmware.
+
+Unlike ``_PSS`` objects in the ACPI tables, ``intel_pstate`` always exposes
+the entire range of available P-states, including the whole turbo range, to the
+``CPUFreq`` core and (in the passive mode) to generic scaling governors.  This
+generally causes turbo P-states to be set more often when ``intel_pstate`` is
+used relative to ACPI-based CPU performance scaling (see `below <acpi-cpufreq_>`_
+for more information).
+
+Moreover, since ``intel_pstate`` always knows what the real turbo threshold is
+(even if the Configurable TDP feature is enabled in the processor), its
+``no_turbo`` attribute in ``sysfs`` (described `below <no_turbo_attr_>`_) should
+work as expected in all cases (that is, if set to disable turbo P-states, it
+always should prevent ``intel_pstate`` from using them).
+
+
+Processor Support
+=================
+
+To handle a given processor ``intel_pstate`` requires a number of different
+pieces of information on it to be known, including:
+
+ * The minimum supported P-state.
+
+ * The maximum supported `non-turbo P-state <turbo_>`_.
+
+ * Whether or not turbo P-states are supported at all.
+
+ * The maximum supported `one-core turbo P-state <turbo_>`_ (if turbo P-states
+   are supported).
+
+ * The scaling formula to translate the driver's internal representation
+   of P-states into frequencies and the other way around.
+
+Generally, ways to obtain that information are specific to the processor model
+or family.  Although it often is possible to obtain all of it from the processor
+itself (using model-specific registers), there are cases in which hardware
+manuals need to be consulted to get to it too.
+
+For this reason, there is a list of supported processors in ``intel_pstate`` and
+the driver initialization will fail if the detected processor is not in that
+list, unless it supports the `HWP feature <Active Mode_>`_.  [The interface to
+obtain all of the information listed above is the same for all of the processors
+supporting the HWP feature, which is why they all are supported by
+``intel_pstate``.]
+
+
+User Space Interface in ``sysfs``
+=================================
+
+Global Attributes
+-----------------
+
+``intel_pstate`` exposes several global attributes (files) in ``sysfs`` to
+control its functionality at the system level.  They are located in the
+``/sys/devices/system/cpu/cpufreq/intel_pstate/`` directory and affect all
+CPUs.
+
+Some of them are not present if the ``intel_pstate=per_cpu_perf_limits``
+argument is passed to the kernel in the command line.
+
+``max_perf_pct``
+        Maximum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``min_perf_pct``
+        Minimum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``num_pstates``
+        Number of P-states supported by the processor (between 0 and 255
+        inclusive) including both turbo and non-turbo P-states (see
+        `Turbo P-states Support`_).
+
+        The value of this attribute is not affected by the ``no_turbo``
+        setting described `below <no_turbo_attr_>`_.
+
+        This attribute is read-only.
+
+``turbo_pct``
+        Ratio of the `turbo range <turbo_>`_ size to the size of the entire
+        range of supported P-states, in percent.
+
+        This attribute is read-only.
+
+.. _no_turbo_attr:
+
+``no_turbo``
+        If set (equal to 1), the driver is not allowed to set any turbo P-states
+        (see `Turbo P-states Support`_).  If unset (equalt to 0, which is the
+        default), turbo P-states can be set by the driver.
+        [Note that ``intel_pstate`` does not support the general ``boost``
+        attribute (supported by some other scaling drivers) which is replaced
+        by this one.]
+
+        This attrubute does not affect the maximum supported frequency value
+        supplied to the ``CPUFreq`` core and exposed via the policy interface,
+        but it affects the maximum possible value of per-policy P-state limits
+        (see `Interpretation of Policy Attributes`_ below for details).
+
+.. _status_attr:
+
+``status``
+        Operation mode of the driver: "active", "passive" or "off".
+
+        "active"
+                The driver is functional and in the `active mode
+                <Active Mode_>`_.
+
+        "passive"
+                The driver is functional and in the `passive mode
+                <Passive Mode_>`_.
+
+        "off"
+                The driver is not functional (it is not registered as a scaling
+                driver with the ``CPUFreq`` core).
+
+        This attribute can be written to in order to change the driver's
+        operation mode or to unregister it.  The string written to it must be
+        one of the possible values of it and, if successful, the write will
+        cause the driver to switch over to the operation mode represented by
+        that string - or to be unregistered in the "off" case.  [Actually,
+        switching over from the active mode to the passive mode or the other
+        way around causes the driver to be unregistered and registered again
+        with a different set of callbacks, so all of its settings (the global
+        as well as the per-policy ones) are then reset to their default
+        values, possibly depending on the target operation mode.]
+
+        That only is supported in some configurations, though (for example, if
+        the `HWP feature is enabled in the processor <Active Mode With HWP_>`_,
+        the operation mode of the driver cannot be changed), and if it is not
+        supported in the current configuration, writes to this attribute with
+        fail with an appropriate error.
+
+Interpretation of Policy Attributes
+-----------------------------------
+
+The interpretation of some ``CPUFreq`` policy attributes described in
+:doc:`cpufreq` is special with ``intel_pstate`` as the current scaling driver
+and it generally depends on the driver's `operation mode <Operation Modes_>`_.
+
+First of all, the values of the ``cpuinfo_max_freq``, ``cpuinfo_min_freq`` and
+``scaling_cur_freq`` attributes are produced by applying a processor-specific
+multiplier to the internal P-state representation used by ``intel_pstate``.
+Also, the values of the ``scaling_max_freq`` and ``scaling_min_freq``
+attributes are capped by the frequency corresponding to the maximum P-state that
+the driver is allowed to set.
+
+If the ``no_turbo`` `global attribute <no_turbo_attr_>`_ is set, the driver is
+not allowed to use turbo P-states, so the maximum value of ``scaling_max_freq``
+and ``scaling_min_freq`` is limited to the maximum non-turbo P-state frequency.
+Accordingly, setting ``no_turbo`` causes ``scaling_max_freq`` and
+``scaling_min_freq`` to go down to that value if they were above it before.
+However, the old values of ``scaling_max_freq`` and ``scaling_min_freq`` will be
+restored after unsetting ``no_turbo``, unless these attributes have been written
+to after ``no_turbo`` was set.
+
+If ``no_turbo`` is not set, the maximum possible value of ``scaling_max_freq``
+and ``scaling_min_freq`` corresponds to the maximum supported turbo P-state,
+which also is the value of ``cpuinfo_max_freq`` in either case.
+
+Next, the following policy attributes have special meaning if
+``intel_pstate`` works in the `active mode <Active Mode_>`_:
+
+``scaling_available_governors``
+        List of P-state selection algorithms provided by ``intel_pstate``.
+
+``scaling_governor``
+        P-state selection algorithm provided by ``intel_pstate`` currently in
+        use with the given policy.
+
+``scaling_cur_freq``
+        Frequency of the average P-state of the CPU represented by the given
+        policy for the time interval between the last two invocations of the
+        driver's utilization update callback by the CPU scheduler for that CPU.
+
+The meaning of these attributes in the `passive mode <Passive Mode_>`_ is the
+same as for other scaling drivers.
+
+Additionally, the value of the ``scaling_driver`` attribute for ``intel_pstate``
+depends on the operation mode of the driver.  Namely, it is either
+"intel_pstate" (in the `active mode <Active Mode_>`_) or "intel_cpufreq" (in the
+`passive mode <Passive Mode_>`_).
+
+Coordination of P-State Limits
+------------------------------
+
+``intel_pstate`` allows P-state limits to be set in two ways: with the help of
+the ``max_perf_pct`` and ``min_perf_pct`` `global attributes
+<Global Attributes_>`_ or via the ``scaling_max_freq`` and ``scaling_min_freq``
+``CPUFreq`` policy attributes.  The coordination between those limits is based
+on the following rules, regardless of the current operation mode of the driver:
+
+ 1. All CPUs are affected by the global limits (that is, none of them can be
+    requested to run faster than the global maximum and none of them can be
+    requested to run slower than the global minimum).
+
+ 2. Each individual CPU is affected by its own per-policy limits (that is, it
+    cannot be requested to run faster than its own per-policy maximum and it
+    cannot be requested to run slower than its own per-policy minimum).
+
+ 3. The global and per-policy limits can be set independently.
+
+If the `HWP feature is enabled in the processor <Active Mode With HWP_>`_, the
+resulting effective values are written into its registers whenever the limits
+change in order to request its internal P-state selection logic to always set
+P-states within these limits.  Otherwise, the limits are taken into account by
+scaling governors (in the `passive mode <Passive Mode_>`_) and by the driver
+every time before setting a new P-state for a CPU.
+
+Additionally, if the ``intel_pstate=per_cpu_perf_limits`` command line argument
+is passed to the kernel, ``max_perf_pct`` and ``min_perf_pct`` are not exposed
+at all and the only way to set the limits is by using the policy attributes.
+
+
+Energy vs Performance Hints
+---------------------------
+
+If ``intel_pstate`` works in the `active mode with the HWP feature enabled
+<Active Mode With HWP_>`_ in the processor, additional attributes are present
+in every ``CPUFreq`` policy directory in ``sysfs``.  They are intended to allow
+user space to help ``intel_pstate`` to adjust the processor's internal P-state
+selection logic by focusing it on performance or on energy-efficiency, or
+somewhere between the two extremes:
+
+``energy_performance_preference``
+        Current value of the energy vs performance hint for the given policy
+        (or the CPU represented by it).
+
+        The hint can be changed by writing to this attribute.
+
+``energy_performance_available_preferences``
+        List of strings that can be written to the
+        ``energy_performance_preference`` attribute.
+
+        They represent different energy vs performance hints and should be
+        self-explanatory, except that ``default`` represents whatever hint
+        value was set by the platform firmware.
+
+Strings written to the ``energy_performance_preference`` attribute are
+internally translated to integer values written to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob.
+
+[Note that tasks may by migrated from one CPU to another by the scheduler's
+load-balancing algorithm and if different energy vs performance hints are
+set for those CPUs, that may lead to undesirable outcomes.  To avoid such
+issues it is better to set the same energy vs performance hint for all CPUs
+or to pin every task potentially sensitive to them to a specific CPU.]
+
+.. _acpi-cpufreq:
+
+``intel_pstate`` vs ``acpi-cpufreq``
+====================================
+
+On the majority of systems supported by ``intel_pstate``, the ACPI tables
+provided by the platform firmware contain ``_PSS`` objects returning information
+that can be used for CPU performance scaling (refer to the `ACPI specification`_
+for details on the ``_PSS`` objects and the format of the information returned
+by them).
+
+The information returned by the ACPI ``_PSS`` objects is used by the
+``acpi-cpufreq`` scaling driver.  On systems supported by ``intel_pstate``
+the ``acpi-cpufreq`` driver uses the same hardware CPU performance scaling
+interface, but the set of P-states it can use is limited by the ``_PSS``
+output.
+
+On those systems each ``_PSS`` object returns a list of P-states supported by
+the corresponding CPU which basically is a subset of the P-states range that can
+be used by ``intel_pstate`` on the same system, with one exception: the whole
+`turbo range <turbo_>`_ is represented by one item in it (the topmost one).  By
+convention, the frequency returned by ``_PSS`` for that item is greater by 1 MHz
+than the frequency of the highest non-turbo P-state listed by it, but the
+corresponding P-state representation (following the hardware specification)
+returned for it matches the maximum supported turbo P-state (or is the
+special value 255 meaning essentially "go as high as you can get").
+
+The list of P-states returned by ``_PSS`` is reflected by the table of
+available frequencies supplied by ``acpi-cpufreq`` to the ``CPUFreq`` core and
+scaling governors and the minimum and maximum supported frequencies reported by
+it come from that list as well.  In particular, given the special representation
+of the turbo range described above, this means that the maximum supported
+frequency reported by ``acpi-cpufreq`` is higher by 1 MHz than the frequency
+of the highest supported non-turbo P-state listed by ``_PSS`` which, of course,
+affects decisions made by the scaling governors, except for ``powersave`` and
+``performance``.
+
+For example, if a given governor attempts to select a frequency proportional to
+estimated CPU load and maps the load of 100% to the maximum supported frequency
+(possibly multiplied by a constant), then it will tend to choose P-states below
+the turbo threshold if ``acpi-cpufreq`` is used as the scaling driver, because
+in that case the turbo range corresponds to a small fraction of the frequency
+band it can use (1 MHz vs 1 GHz or more).  In consequence, it will only go to
+the turbo range for the highest loads and the other loads above 50% that might
+benefit from running at turbo frequencies will be given non-turbo P-states
+instead.
+
+One more issue related to that may appear on systems supporting the
+`Configurable TDP feature <turbo_>`_ allowing the platform firmware to set the
+turbo threshold.  Namely, if that is not coordinated with the lists of P-states
+returned by ``_PSS`` properly, there may be more than one item corresponding to
+a turbo P-state in those lists and there may be a problem with avoiding the
+turbo range (if desirable or necessary).  Usually, to avoid using turbo
+P-states overall, ``acpi-cpufreq`` simply avoids using the topmost state listed
+by ``_PSS``, but that is not sufficient when there are other turbo P-states in
+the list returned by it.
+
+Apart from the above, ``acpi-cpufreq`` works like ``intel_pstate`` in the
+`passive mode <Passive Mode_>`_, except that the number of P-states it can set
+is limited to the ones listed by the ACPI ``_PSS`` objects.
+
+
+Kernel Command Line Options for ``intel_pstate``
+================================================
+
+Several kernel command line options can be used to pass early-configuration-time
+parameters to ``intel_pstate`` in order to enforce specific behavior of it.  All
+of them have to be prepended with the ``intel_pstate=`` prefix.
+
+``disable``
+        Do not register ``intel_pstate`` as the scaling driver even if the
+        processor is supported by it.
+
+``passive``
+        Register ``intel_pstate`` in the `passive mode <Passive Mode_>`_ to
+        start with.
+
+        This option implies the ``no_hwp`` one described below.
+
+``force``
+        Register ``intel_pstate`` as the scaling driver instead of
+        ``acpi-cpufreq`` even if the latter is preferred on the given system.
+
+        This may prevent some platform features (such as thermal controls and
+        power capping) that rely on the availability of ACPI P-states
+        information from functioning as expected, so it should be used with
+        caution.
+
+        This option does not work with processors that are not supported by
+        ``intel_pstate`` and on platforms where the ``pcc-cpufreq`` scaling
+        driver is used instead of ``acpi-cpufreq``.
+
+``no_hwp``
+        Do not enable the `hardware-managed P-states (HWP) feature
+        <Active Mode With HWP_>`_ even if it is supported by the processor.
+
+``hwp_only``
+        Register ``intel_pstate`` as the scaling driver only if the
+        `hardware-managed P-states (HWP) feature <Active Mode With HWP_>`_ is
+        supported by the processor.
+
+``support_acpi_ppc``
+        Take ACPI ``_PPC`` performance limits into account.
+
+        If the preferred power management profile in the FADT (Fixed ACPI
+        Description Table) is set to "Enterprise Server" or "Performance
+        Server", the ACPI ``_PPC`` limits are taken into account by default
+        and this option has no effect.
+
+``per_cpu_perf_limits``
+        Use per-logical-CPU P-State limits (see `Coordination of P-state
+        Limits`_ for details).
+
+
+Diagnostics and Tuning
+======================
+
+Trace Events
+------------
+
+There are two static trace events that can be used for ``intel_pstate``
+diagnostics.  One of them is the ``cpu_frequency`` trace event generally used
+by ``CPUFreq``, and the other one is the ``pstate_sample`` trace event specific
+to ``intel_pstate``.  Both of them are triggered by ``intel_pstate`` only if
+it works in the `active mode <Active Mode_>`_.
+
+The following sequence of shell commands can be used to enable them and see
+their output (if the kernel is generally configured to support event tracing)::
+
+ # cd /sys/kernel/debug/tracing/
+ # echo 1 > events/power/pstate_sample/enable
+ # echo 1 > events/power/cpu_frequency/enable
+ # cat trace
+ gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107 scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618 freq=2474476
+ cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
+
+If ``intel_pstate`` works in the `passive mode <Passive Mode_>`_, the
+``cpu_frequency`` trace event will be triggered either by the ``schedutil``
+scaling governor (for the policies it is attached to), or by the ``CPUFreq``
+core (for the policies with other scaling governors).
+
+``ftrace``
+----------
+
+The ``ftrace`` interface can be used for low-level diagnostics of
+``intel_pstate``.  For example, to check how often the function to set a
+P-state is called, the ``ftrace`` filter can be set to to
+:c:func:`intel_pstate_set_pstate`::
+
+ # cd /sys/kernel/debug/tracing/
+ # cat available_filter_functions | grep -i pstate
+ intel_pstate_set_pstate
+ intel_pstate_cpu_init
+ ...
+ # echo intel_pstate_set_pstate > set_ftrace_filter
+ # echo function > current_tracer
+ # cat trace | head -15
+ # tracer: function
+ #
+ # entries-in-buffer/entries-written: 80/80   #P:4
+ #
+ #                              _-----=> irqs-off
+ #                             / _----=> need-resched
+ #                            | / _---=> hardirq/softirq
+ #                            || / _--=> preempt-depth
+ #                            ||| /     delay
+ #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
+ #              | |       |   ||||       |         |
+             Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
+  gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
+      gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
+           <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
+
+Tuning Interface in ``debugfs``
+-------------------------------
+
+The ``powersave`` algorithm provided by ``intel_pstate`` for `the Core line of
+processors in the active mode <powersave_>`_ is based on a `PID controller`_
+whose parameters were chosen to address a number of different use cases at the
+same time.  However, it still is possible to fine-tune it to a specific workload
+and the ``debugfs`` interface under ``/sys/kernel/debug/pstate_snb/`` is
+provided for this purpose.  [Note that the ``pstate_snb`` directory will be
+present only if the specific P-state selection algorithm matching the interface
+in it actually is in use.]
+
+The following files present in that directory can be used to modify the PID
+controller parameters at run time:
+
+| ``deadband``
+| ``d_gain_pct``
+| ``i_gain_pct``
+| ``p_gain_pct``
+| ``sample_rate_ms``
+| ``setpoint``
+
+Note, however, that achieving desirable results this way generally requires
+expert-level understanding of the power vs performance tradeoff, so extra care
+is recommended when attempting to do that.
+
+
+.. _LCEU2015: http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
+.. _SDM: http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-system-programming-manual-325384.html
+.. _ACPI specification: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+.. _PID controller: https://en.wikipedia.org/wiki/PID_controller
diff --git a/Documentation/cpu-freq/intel-pstate.txt b/Documentation/cpu-freq/intel-pstate.txt
deleted file mode 100644
index 3fdcdfd968ba..000000000000
--- a/Documentation/cpu-freq/intel-pstate.txt
+++ /dev/null
@@ -1,281 +0,0 @@
-Intel P-State driver
---------------------
-
-This driver provides an interface to control the P-State selection for the
-SandyBridge+ Intel processors.
-
-The following document explains P-States:
-http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
-As stated in the document, P-State doesn’t exactly mean a frequency. However, for
-the sake of the relationship with cpufreq, P-State and frequency are used
-interchangeably.
-
-Understanding the cpufreq core governors and policies are important before
-discussing more details about the Intel P-State driver. Based on what callbacks
-a cpufreq driver provides to the cpufreq core, it can support two types of
-drivers:
-- with target_index() callback: In this mode, the drivers using cpufreq core
-simply provide the minimum and maximum frequency limits and an additional
-interface target_index() to set the current frequency. The cpufreq subsystem
-has a number of scaling governors ("performance", "powersave", "ondemand",
-etc.). Depending on which governor is in use, cpufreq core will call for
-transitions to a specific frequency using target_index() callback.
-- setpolicy() callback: In this mode, drivers do not provide target_index()
-callback, so cpufreq core can't request a transition to a specific frequency.
-The driver provides minimum and maximum frequency limits and callbacks to set a
-policy. The policy in cpufreq sysfs is referred to as the "scaling governor".
-The cpufreq core can request the driver to operate in any of the two policies:
-"performance" and "powersave". The driver decides which frequency to use based
-on the above policy selection considering minimum and maximum frequency limits.
-
-The Intel P-State driver falls under the latter category, which implements the
-setpolicy() callback. This driver decides what P-State to use based on the
-requested policy from the cpufreq core. If the processor is capable of
-selecting its next P-State internally, then the driver will offload this
-responsibility to the processor (aka HWP: Hardware P-States). If not, the
-driver implements algorithms to select the next P-State.
-
-Since these policies are implemented in the driver, they are not same as the
-cpufreq scaling governors implementation, even if they have the same name in
-the cpufreq sysfs (scaling_governors). For example the "performance" policy is
-similar to cpufreq’s "performance" governor, but "powersave" is completely
-different than the cpufreq "powersave" governor. The strategy here is similar
-to cpufreq "ondemand", where the requested P-State is related to the system load.
-
-Sysfs Interface
-
-In addition to the frequency-controlling interfaces provided by the cpufreq
-core, the driver provides its own sysfs files to control the P-State selection.
-These files have been added to /sys/devices/system/cpu/intel_pstate/.
-Any changes made to these files are applicable to all CPUs (even in a
-multi-package system, Refer to later section on placing "Per-CPU limits").
-
-      max_perf_pct: Limits the maximum P-State that will be requested by
-      the driver. It states it as a percentage of the available performance. The
-      available (P-State) performance may be reduced by the no_turbo
-      setting described below.
-
-      min_perf_pct: Limits the minimum P-State that will be requested by
-      the driver. It states it as a percentage of the max (non-turbo)
-      performance level.
-
-      no_turbo: Limits the driver to selecting P-State below the turbo
-      frequency range.
-
-      turbo_pct: Displays the percentage of the total performance that
-      is supported by hardware that is in the turbo range. This number
-      is independent of whether turbo has been disabled or not.
-
-      num_pstates: Displays the number of P-States that are supported
-      by hardware. This number is independent of whether turbo has
-      been disabled or not.
-
-For example, if a system has these parameters:
-        Max 1 core turbo ratio: 0x21 (Max 1 core ratio is the maximum P-State)
-        Max non turbo ratio: 0x17
-        Minimum ratio : 0x08 (Here the ratio is called max efficiency ratio)
-
-Sysfs will show :
-        max_perf_pct:100, which corresponds to 1 core ratio
-        min_perf_pct:24, max_efficiency_ratio / max 1 Core ratio
-        no_turbo:0, turbo is not disabled
-        num_pstates:26 = (max 1 Core ratio - Max Efficiency Ratio + 1)
-        turbo_pct:39 = (max 1 core ratio - max non turbo ratio) / num_pstates
-
-Refer to "Intel® 64 and IA-32 Architectures Software Developer’s Manual
-Volume 3: System Programming Guide" to understand ratios.
-
-There is one more sysfs attribute in /sys/devices/system/cpu/intel_pstate/
-that can be used for controlling the operation mode of the driver:
-
-      status: Three settings are possible:
-      "off"     - The driver is not in use at this time.
-      "active"  - The driver works as a P-state governor (default).
-      "passive" - The driver works as a regular cpufreq one and collaborates
-                  with the generic cpufreq governors (it sets P-states as
-                  requested by those governors).
-      The current setting is returned by reads from this attribute.  Writing one
-      of the above strings to it changes the operation mode as indicated by that
-      string, if possible.  If HW-managed P-states (HWP) are enabled, it is not
-      possible to change the driver's operation mode and attempts to write to
-      this attribute will fail.
-
-cpufreq sysfs for Intel P-State
-
-Since this driver registers with cpufreq, cpufreq sysfs is also presented.
-There are some important differences, which need to be considered.
-
-scaling_cur_freq: This displays the real frequency which was used during
-the last sample period instead of what is requested. Some other cpufreq driver,
-like acpi-cpufreq, displays what is requested (Some changes are on the
-way to fix this for acpi-cpufreq driver). The same is true for frequencies
-displayed at /proc/cpuinfo.
-
-scaling_governor: This displays current active policy. Since each CPU has a
-cpufreq sysfs, it is possible to set a scaling governor to each CPU. But this
-is not possible with Intel P-States, as there is one common policy for all
-CPUs. Here, the last requested policy will be applicable to all CPUs. It is
-suggested that one use the cpupower utility to change policy to all CPUs at the
-same time.
-
-scaling_setspeed: This attribute can never be used with Intel P-State.
-
-scaling_max_freq/scaling_min_freq: This interface can be used similarly to
-the max_perf_pct/min_perf_pct of Intel P-State sysfs. However since frequencies
-are converted to nearest possible P-State, this is prone to rounding errors.
-This method is not preferred to limit performance.
-
-affected_cpus: Not used
-related_cpus: Not used
-
-For contemporary Intel processors, the frequency is controlled by the
-processor itself and the P-State exposed to software is related to
-performance levels.  The idea that frequency can be set to a single
-frequency is fictional for Intel Core processors. Even if the scaling
-driver selects a single P-State, the actual frequency the processor
-will run at is selected by the processor itself.
-
-Per-CPU limits
-
-The kernel command line option "intel_pstate=per_cpu_perf_limits" forces
-the intel_pstate driver to use per-CPU performance limits.  When it is set,
-the sysfs control interface described above is subject to limitations.
-- The following controls are not available for both read and write
-        /sys/devices/system/cpu/intel_pstate/max_perf_pct
-        /sys/devices/system/cpu/intel_pstate/min_perf_pct
-- The following controls can be used to set performance limits, as far as the
-architecture of the processor permits:
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_max_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_min_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-- User can still observe turbo percent and number of P-States from
-        /sys/devices/system/cpu/intel_pstate/turbo_pct
-        /sys/devices/system/cpu/intel_pstate/num_pstates
-- User can read write system wide turbo status
-        /sys/devices/system/cpu/no_turbo
-
-Support of energy performance hints
-It is possible to provide hints to the HWP algorithms in the processor
-to be more performance centric to more energy centric. When the driver
-is using HWP, two additional cpufreq sysfs attributes are presented for
-each logical CPU.
-These attributes are:
-        - energy_performance_available_preferences
-        - energy_performance_preference
-
-To get list of supported hints:
-$ cat energy_performance_available_preferences
-    default performance balance_performance balance_power power
-
-The current preference can be read or changed via cpufreq sysfs
-attribute "energy_performance_preference". Reading from this attribute
-will display current effective setting. User can write any of the valid
-preference string to this attribute. User can always restore to power-on
-default by writing "default".
-
-Since threads can migrate to different CPUs, this is possible that the
-new CPU may have different energy performance preference than the previous
-one. To avoid such issues, either threads can be pinned to specific CPUs
-or set the same energy performance preference value to all CPUs.
-
-Tuning Intel P-State driver
-
-When the performance can be tuned using PID (Proportional Integral
-Derivative) controller, debugfs files are provided for adjusting performance.
-They are presented under:
-/sys/kernel/debug/pstate_snb/
-
-The PID tunable parameters are:
-      deadband
-      d_gain_pct
-      i_gain_pct
-      p_gain_pct
-      sample_rate_ms
-      setpoint
-
-To adjust these parameters, some understanding of driver implementation is
-necessary. There are some tweeks described here, but be very careful. Adjusting
-them requires expert level understanding of power and performance relationship.
-These limits are only useful when the "powersave" policy is active.
-
--To make the system more responsive to load changes, sample_rate_ms can
-be adjusted  (current default is 10ms).
--To make the system use higher performance, even if the load is lower, setpoint
-can be adjusted to a lower number. This will also lead to faster ramp up time
-to reach the maximum P-State.
-If there are no derivative and integral coefficients, The next P-State will be
-equal to:
-        current P-State - ((setpoint - current cpu load) * p_gain_pct)
-
-For example, if the current PID parameters are (Which are defaults for the core
-processors like SandyBridge):
-      deadband = 0
-      d_gain_pct = 0
-      i_gain_pct = 0
-      p_gain_pct = 20
-      sample_rate_ms = 10
-      setpoint = 97
-
-If the current P-State = 0x08 and current load = 100, this will result in the
-next P-State = 0x08 - ((97 - 100) * 0.2) = 8.6 (rounded to 9). Here the P-State
-goes up by only 1. If during next sample interval the current load doesn't
-change and still 100, then P-State goes up by one again. This process will
-continue as long as the load is more than the setpoint until the maximum P-State
-is reached.
-
-For the same load at setpoint = 60, this will result in the next P-State
-= 0x08 - ((60 - 100) * 0.2) = 16
-So by changing the setpoint from 97 to 60, there is an increase of the
-next P-State from 9 to 16. So this will make processor execute at higher
-P-State for the same CPU load. If the load continues to be more than the
-setpoint during next sample intervals, then P-State will go up again till the
-maximum P-State is reached. But the ramp up time to reach the maximum P-State
-will be much faster when the setpoint is 60 compared to 97.
-
-Debugging Intel P-State driver
-
-Event tracing
-To debug P-State transition, the Linux event tracing interface can be used.
-There are two specific events, which can be enabled (Provided the kernel
-configs related to event tracing are enabled).
-
-# cd /sys/kernel/debug/tracing/
-# echo 1 > events/power/pstate_sample/enable
-# echo 1 > events/power/cpu_frequency/enable
-# cat trace
-gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107
-        scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618
-                freq=2474476
-cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
-
-
-Using ftrace
-
-If function level tracing is required, the Linux ftrace interface can be used.
-For example if we want to check how often a function to set a P-State is
-called, we can set ftrace filter to intel_pstate_set_pstate.
-
-# cd /sys/kernel/debug/tracing/
-# cat available_filter_functions | grep -i pstate
-intel_pstate_set_pstate
-intel_pstate_cpu_init
-...
-
-# echo intel_pstate_set_pstate > set_ftrace_filter
-# echo function > current_tracer
-# cat trace | head -15
-# tracer: function
-#
-# entries-in-buffer/entries-written: 80/80   #P:4
-#
-#                              _-----=> irqs-off
-#                             / _----=> need-resched
-#                            | / _---=> hardirq/softirq
-#                            || / _--=> preempt-depth
-#                            ||| /     delay
-#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
-#              | |       |   ||||       |         |
-            Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
- gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
-     gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
-          <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
diff --git a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
index e9c5a1d9834a..f465647a4dd2 100644
--- a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
+++ b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
@@ -22,7 +22,8 @@ Required properties :
 - #clock-cells : must contain 1
 - #reset-cells : must contain 1
 
-For the PRCM CCUs on H3/A64, one more clock is needed:
+For the PRCM CCUs on H3/A64, two more clocks are needed:
+- "pll-periph": the SoC's peripheral PLL from the main CCU
 - "iosc": the SoC's internal frequency oscillator
 
 Example for generic CCU:
@@ -39,8 +40,8 @@ Example for PRCM CCU:
 r_ccu: clock@01f01400 {
         compatible = "allwinner,sun50i-a64-r-ccu";
         reg = <0x01f01400 0x100>;
-        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-        clock-names = "hosc", "losc", "iosc";
+        clocks = <&osc24M>, <&osc32k>, <&iosc>, <&ccu CLK_PLL_PERIPH0>;
+        clock-names = "hosc", "losc", "iosc", "pll-periph";
         #clock-cells = <1>;
         #reset-cells = <1>;
 };
diff --git a/Documentation/devicetree/bindings/display/bridge/adi,adv7511.txt b/Documentation/devicetree/bindings/display/bridge/adi,adv7511.txt
index 00ea670b8c4d..06668bca7ffc 100644
--- a/Documentation/devicetree/bindings/display/bridge/adi,adv7511.txt
+++ b/Documentation/devicetree/bindings/display/bridge/adi,adv7511.txt
@@ -78,6 +78,7 @@ graph bindings specified in Documentation/devicetree/bindings/graph.txt.
   remote endpoint phandle should be a reference to a valid mipi_dsi_host device
   node.
 - Video port 1 for the HDMI output
+- Audio port 2 for the HDMI audio input
 
 
 Example
@@ -112,5 +113,12 @@ Example
                                         remote-endpoint = <&hdmi_connector_in>;
                                 };
                         };
+
+                        port@2 {
+                                reg = <2>;
+                                codec_endpoint: endpoint {
+                                        remote-endpoint = <&i2s0_cpu_endpoint>;
+                                };
+                        };
                 };
         };
diff --git a/Documentation/devicetree/bindings/display/bridge/renesas,dw-hdmi.txt b/Documentation/devicetree/bindings/display/bridge/renesas,dw-hdmi.txt
index f6b3f36d422b..81b68580e199 100644
--- a/Documentation/devicetree/bindings/display/bridge/renesas,dw-hdmi.txt
+++ b/Documentation/devicetree/bindings/display/bridge/renesas,dw-hdmi.txt
@@ -25,7 +25,8 @@ Required properties:
 - clock-names: Shall contain "iahb" and "isfr" as defined in dw_hdmi.txt.
 - ports: See dw_hdmi.txt. The DWC HDMI shall have one port numbered 0
   corresponding to the video input of the controller and one port numbered 1
-  corresponding to its HDMI output. Each port shall have a single endpoint.
+  corresponding to its HDMI output, and one port numbered 2 corresponding to
+  sound input of the controller. Each port shall have a single endpoint.
 
 Optional properties:
 
@@ -59,6 +60,12 @@ Example:
                                         remote-endpoint = <&hdmi0_con>;
                                 };
                         };
+                        port@2 {
+                                reg = <2>;
+                                rcar_dw_hdmi0_sound_in: endpoint {
+                                        remote-endpoint = <&hdmi_sound_out>;
+                                };
+                        };
                 };
         };
 
diff --git a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
index 42c3bb2d53e8..01e331a5f3e7 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
@@ -41,9 +41,9 @@ Required properties:
 Optional properties:
 
 In order to use the GPIO lines in PWM mode, some additional optional
-properties are required. Only Armada 370 and XP support these properties.
+properties are required.
 
-- compatible: Must contain "marvell,armada-370-xp-gpio"
+- compatible: Must contain "marvell,armada-370-gpio"
 
 - reg: an additional register set is needed, for the GPIO Blink
   Counter on/off registers.
@@ -71,7 +71,7 @@ Example:
                 };
 
                 gpio1: gpio@18140 {
-                        compatible = "marvell,armada-370-xp-gpio";
+                        compatible = "marvell,armada-370-gpio";
                         reg = <0x18140 0x40>, <0x181c8 0x08>;
                         reg-names = "gpio", "pwm";
                         ngpios = <17>;
diff --git a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
index 6db22103e2dd..025cf8c9324a 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
@@ -36,7 +36,7 @@ Optional properties:
                 control gpios
 
  - threshold:   allows setting the "click"-threshold in the range
-                from 20 to 80.
+                from 0 to 80.
 
  - gain:        allows setting the sensitivity in the range from 0 to
                 31. Note that lower values indicate higher
diff --git a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
index 05485699d70e..9630ac0e4b56 100644
--- a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
+++ b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
@@ -16,6 +16,11 @@ Required properties:
 - reg:                  Base address of PMIC on Hi6220 SoC.
 - interrupt-controller: Hi655x has internal IRQs (has own IRQ domain).
 - pmic-gpios:           The GPIO used by PMIC IRQ.
+- #clock-cells:         From common clock binding; shall be set to 0
+
+Optional properties:
+- clock-output-names: From common clock binding to override the
+  default output clock name
 
 Example:
         pmic: pmic@f8000000 {
@@ -24,4 +29,5 @@ Example:
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+                #clock-cells = <0>;
         }
diff --git a/Documentation/devicetree/bindings/mfd/stm32-timers.txt b/Documentation/devicetree/bindings/mfd/stm32-timers.txt
index bbd083f5600a..1db6e0057a63 100644
--- a/Documentation/devicetree/bindings/mfd/stm32-timers.txt
+++ b/Documentation/devicetree/bindings/mfd/stm32-timers.txt
@@ -31,7 +31,7 @@ Example:
                 compatible = "st,stm32-timers";
                 reg = <0x40010000 0x400>;
                 clocks = <&rcc 0 160>;
-                clock-names = "clk_int";
+                clock-names = "int";
 
                 pwm {
                         compatible = "st,stm32-pwm";
diff --git a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
index e25436861867..9029b45b8a22 100644
--- a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
+++ b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
@@ -18,6 +18,8 @@ Optional properties:
   "ext_clock" (External clock provided to the card).
 - post-power-on-delay-ms : Delay in ms after powering the card and
         de-asserting the reset-gpios (if any)
+- power-off-delay-us : Delay in us after asserting the reset-gpios (if any)
+        during power off of the card.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/net/dsa/b53.txt b/Documentation/devicetree/bindings/net/dsa/b53.txt
index d6c6e41648d4..8ec2ca21adeb 100644
--- a/Documentation/devicetree/bindings/net/dsa/b53.txt
+++ b/Documentation/devicetree/bindings/net/dsa/b53.txt
@@ -34,7 +34,7 @@ Required properties:
       "brcm,bcm6328-switch"
       "brcm,bcm6368-switch" and the mandatory "brcm,bcm63xx-switch"
 
-See Documentation/devicetree/bindings/dsa/dsa.txt for a list of additional
+See Documentation/devicetree/bindings/net/dsa/dsa.txt for a list of additional
 required and optional properties.
 
 Examples:
diff --git a/Documentation/devicetree/bindings/net/dsa/marvell.txt b/Documentation/devicetree/bindings/net/dsa/marvell.txt
index 7ef9dbb08957..1d4d0f49c9d0 100644
--- a/Documentation/devicetree/bindings/net/dsa/marvell.txt
+++ b/Documentation/devicetree/bindings/net/dsa/marvell.txt
@@ -26,6 +26,10 @@ Optional properties:
 - interrupt-controller  : Indicates the switch is itself an interrupt
                           controller. This is used for the PHY interrupts.
 #interrupt-cells = <2>  : Controller uses two cells, number and flag
+- eeprom-length         : Set to the length of an EEPROM connected to the
+                          switch. Must be set if the switch can not detect
+                          the presence and/or size of a connected EEPROM,
+                          otherwise optional.
 - mdio                  : Container of PHY and devices on the switches MDIO
                           bus.
 - mdio?         : Container of PHYs and devices on the external MDIO
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index a1e3693cca16..6f55bdd52f8a 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -15,6 +15,10 @@ Optional properties:
 - phy-reset-active-high : If present then the reset sequence using the GPIO
   specified in the "phy-reset-gpios" property is reversed (H=reset state,
   L=operation state).
+- phy-reset-post-delay : Post reset delay in milliseconds. If present then
+  a delay of phy-reset-post-delay milliseconds will be observed after the
+  phy-reset-gpios has been toggled. Can be omitted thus no delay is
+  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 - phy-supply : regulator that powers the Ethernet PHY.
 - phy-handle : phandle to the PHY device connected to this device.
 - fixed-link : Assume a fixed link. See fixed-link.txt in the same directory.
diff --git a/Documentation/devicetree/bindings/net/smsc911x.txt b/Documentation/devicetree/bindings/net/smsc911x.txt
index 16c3a9501f5d..acfafc8e143c 100644
--- a/Documentation/devicetree/bindings/net/smsc911x.txt
+++ b/Documentation/devicetree/bindings/net/smsc911x.txt
@@ -27,6 +27,7 @@ Optional properties:
   of the device. On many systems this is wired high so the device goes
   out of reset at power-on, but if it is under program control, this
   optional GPIO can wake up in response to it.
+- vdd33a-supply, vddvario-supply : 3.3V analog and IO logic power supplies
 
 Examples:
 
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
index 71a3c134af1b..f01d154090da 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
@@ -247,7 +247,6 @@ bias-bus-hold		- latch weakly
 bias-pull-up            - pull up the pin
 bias-pull-down          - pull down the pin
 bias-pull-pin-default   - use pin-default pull state
-bi-directional          - pin supports simultaneous input/output operations
 drive-push-pull         - drive actively high and low
 drive-open-drain        - drive with open drain
 drive-open-source       - drive with open source
@@ -260,7 +259,6 @@ input-debounce		- debounce mode with debound time X
 power-source            - select between different power supplies
 low-power-enable        - enable low power mode
 low-power-disable       - disable low power mode
-output-enable           - enable output on pin regardless of output value
 output-low              - set the pin to output mode with low level
 output-high             - set the pin to output mode with high level
 slew-rate               - set the slew rate
diff --git a/Documentation/devicetree/bindings/sound/audio-graph-card.txt b/Documentation/devicetree/bindings/sound/audio-graph-card.txt
new file mode 100644
index 000000000000..6e6720aa33f1
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/audio-graph-card.txt
@@ -0,0 +1,129 @@
+Audio Graph Card:
+
+Audio Graph Card specifies audio DAI connections of SoC <-> codec.
+It is based on common bindings for device graphs.
+see ${LINUX}/Documentation/devicetree/bindings/graph.txt
+
+Basically, Audio Graph Card property is same as Simple Card.
+see ${LINUX}/Documentation/devicetree/bindings/sound/simple-card.txt
+
+Below are same as Simple-Card.
+
+- label
+- widgets
+- routing
+- dai-format
+- frame-master
+- bitclock-master
+- bitclock-inversion
+- frame-inversion
+- dai-tdm-slot-num
+- dai-tdm-slot-width
+- clocks / system-clock-frequency
+
+Required properties:
+
+- compatible                            : "audio-graph-card";
+- dais                                  : list of CPU DAI port{s}
+
+Optional properties:
+- pa-gpios: GPIO used to control external amplifier.
+
+Example: Single DAI case
+
+        sound_card {
+                compatible = "audio-graph-card";
+
+                dais = <&cpu_port>;
+        };
+
+        dai-controller {
+                ...
+                cpu_port: port {
+                        cpu_endpoint: endpoint {
+                                remote-endpoint = <&codec_endpoint>;
+
+                                dai-format = "left_j";
+                                ...
+                        };
+                };
+        };
+
+        audio-codec {
+                ...
+                port {
+                        codec_endpoint: endpoint {
+                                remote-endpoint = <&cpu_endpoint>;
+                        };
+                };
+        };
+
+Example: Multi DAI case
+
+        sound-card {
+                compatible = "audio-graph-card";
+
+                label = "sound-card";
+
+                dais = <&cpu_port0
+                        &cpu_port1
+                        &cpu_port2>;
+        };
+
+        audio-codec@0 {
+                ...
+                port {
+                        codec0_endpoint: endpoint {
+                                remote-endpoint = <&cpu_endpoint0>;
+                        };
+                };
+        };
+
+        audio-codec@1 {
+                ...
+                port {
+                        codec1_endpoint: endpoint {
+                                remote-endpoint = <&cpu_endpoint1>;
+                        };
+                };
+        };
+
+        audio-codec@2 {
+                ...
+                port {
+                        codec2_endpoint: endpoint {
+                                remote-endpoint = <&cpu_endpoint2>;
+                        };
+                };
+        };
+
+        dai-controller {
+                ...
+                ports {
+                        cpu_port0: port@0 {
+                                cpu_endpoint0: endpoint {
+                                        remote-endpoint = <&codec0_endpoint>;
+
+                                        dai-format = "left_j";
+                                        ...
+                                };
+                        };
+                        cpu_port1: port@1 {
+                                cpu_endpoint1: endpoint {
+                                        remote-endpoint = <&codec1_endpoint>;
+
+                                        dai-format = "i2s";
+                                        ...
+                                };
+                        };
+                        cpu_port2: port@2 {
+                                cpu_endpoint2: endpoint {
+                                        remote-endpoint = <&codec2_endpoint>;
+
+                                        dai-format = "i2s";
+                                        ...
+                                };
+                        };
+                };
+        };
+
diff --git a/Documentation/devicetree/bindings/sound/audio-graph-scu-card.txt b/Documentation/devicetree/bindings/sound/audio-graph-scu-card.txt
new file mode 100644
index 000000000000..8b8afe9fcb31
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/audio-graph-scu-card.txt
@@ -0,0 +1,122 @@
+Audio-Graph-SCU-Card:
+
+Audio-Graph-SCU-Card is "Audio-Graph-Card" + "ALSA DPCM".
+
+It is based on common bindings for device graphs.
+see ${LINUX}/Documentation/devicetree/bindings/graph.txt
+
+Basically, Audio-Graph-SCU-Card property is same as
+Simple-Card / Simple-SCU-Card / Audio-Graph-Card.
+see ${LINUX}/Documentation/devicetree/bindings/sound/simple-card.txt
+    ${LINUX}/Documentation/devicetree/bindings/sound/simple-scu-card.txt
+    ${LINUX}/Documentation/devicetree/bindings/sound/audio-graph-card.txt
+
+Below are same as Simple-Card / Audio-Graph-Card.
+
+- label
+- dai-format
+- frame-master
+- bitclock-master
+- bitclock-inversion
+- frame-inversion
+- dai-tdm-slot-num
+- dai-tdm-slot-width
+- clocks / system-clock-frequency
+
+Below are same as Simple-SCU-Card.
+
+- convert-rate
+- convert-channels
+- prefix
+- routing
+
+Required properties:
+
+- compatible                            : "audio-graph-scu-card";
+- dais                                  : list of CPU DAI port{s}
+
+Example 1. Sampling Rate Conversion
+
+        sound_card {
+                compatible = "audio-graph-scu-card";
+
+                label = "sound-card";
+                prefix = "codec";
+                routing = "codec Playback", "DAI0 Playback",
+                        "codec Playback", "DAI1 Playback";
+                convert-rate = <48000>;
+
+                dais = <&cpu_port>;
+        };
+
+        audio-codec {
+                ...
+
+                port {
+                        codec_endpoint: endpoint {
+                                remote-endpoint = <&cpu_endpoint>;
+                        };
+                };
+        };
+
+        dai-controller {
+                ...
+                cpu_port: port {
+                        cpu_endpoint: endpoint {
+                                remote-endpoint = <&codec_endpoint>;
+
+                                dai-format = "left_j";
+                                ...
+                        };
+                };
+        };
+
+Example 2. 2 CPU 1 Codec (Mixing)
+
+        sound_card {
+                compatible = "audio-graph-scu-card";
+
+                label = "sound-card";
+                prefix = "codec";
+                routing = "codec Playback", "DAI0 Playback",
+                        "codec Playback", "DAI1 Playback";
+                convert-rate = <48000>;
+
+                dais = <&cpu_port0
+                        &cpu_port1>;
+        };
+
+        audio-codec {
+                ...
+
+                port {
+                        codec_endpoint0: endpoint {
+                                remote-endpoint = <&cpu_endpoint0>;
+                        };
+                        codec_endpoint1: endpoint {
+                                remote-endpoint = <&cpu_endpoint1>;
+                        };
+                };
+        };
+
+        dai-controller {
+                ...
+                ports {
+                        cpu_port0: port {
+                                cpu_endpoint0: endpoint {
+                                        remote-endpoint = <&codec_endpoint0>;
+
+                                        dai-format = "left_j";
+                                        ...
+                                };
+                        };
+                        cpu_port1: port {
+                                cpu_endpoint1: endpoint {
+                                        remote-endpoint = <&codec_endpoint1>;
+
+                                        dai-format = "left_j";
+                                        ...
+                                };
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/sound/cs35l35.txt b/Documentation/devicetree/bindings/sound/cs35l35.txt
index 016b768bc722..77ee75c39233 100644
--- a/Documentation/devicetree/bindings/sound/cs35l35.txt
+++ b/Documentation/devicetree/bindings/sound/cs35l35.txt
@@ -16,6 +16,9 @@ Required properties:
     (See Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
     for further information relating to interrupt properties)
 
+ - cirrus,boost-ind-nanohenry: Inductor value for boost converter. The value is
+    in nH and they can be values of 1000nH, 1200nH, 1500nH, and 2200nH.
+
 Optional properties:
   - reset-gpios : gpio used to reset the amplifier
 
diff --git a/Documentation/devicetree/bindings/sound/nau8825.txt b/Documentation/devicetree/bindings/sound/nau8825.txt
index d3374231c871..2f5e973285a6 100644
--- a/Documentation/devicetree/bindings/sound/nau8825.txt
+++ b/Documentation/devicetree/bindings/sound/nau8825.txt
@@ -69,6 +69,8 @@ Optional properties:
   - nuvoton,jack-insert-debounce: number from 0 to 7 that sets debounce time to 2^(n+2) ms
   - nuvoton,jack-eject-debounce: number from 0 to 7 that sets debounce time to 2^(n+2) ms
 
+  - nuvoton,crosstalk-bypass: make crosstalk function bypass if set.
+
   - clocks: list of phandle and clock specifier pairs according to common clock bindings for the
       clocks described in clock-names
   - clock-names: should include "mclk" for the MCLK master clock
@@ -96,6 +98,7 @@ Example:
       nuvoton,short-key-debounce = <2>;
       nuvoton,jack-insert-debounce = <7>;
       nuvoton,jack-eject-debounce = <7>;
+      nuvoton,crosstalk-bypass;
 
       clock-names = "mclk";
       clocks = <&tegra_car TEGRA210_CLK_CLK_OUT_2>;
diff --git a/Documentation/devicetree/bindings/sound/renesas,rsnd.txt b/Documentation/devicetree/bindings/sound/renesas,rsnd.txt
index 15a7316e4c91..7246bb268bf9 100644
--- a/Documentation/devicetree/bindings/sound/renesas,rsnd.txt
+++ b/Documentation/devicetree/bindings/sound/renesas,rsnd.txt
@@ -83,11 +83,11 @@ SRC can convert [xx]Hz to [yy]Hz. Then, it has below 2 modes
 **     Asynchronous mode
 ------------------
 
-You need to use "renesas,rsrc-card" sound card for it.
+You need to use "simple-scu-audio-card" sound card for it.
 example)
 
         sound {
-                compatible = "renesas,rsrc-card";
+                compatible = "simple-scu-audio-card";
                 ...
                 /*
                  * SRC Asynchronous mode setting
@@ -97,12 +97,12 @@ example)
                  * Inputed 48kHz data will be converted to
                  * system specified Hz
                  */
-                convert-rate = <48000>;
+                simple-audio-card,convert-rate = <48000>;
                 ...
-                cpu {
+                simple-audio-card,cpu {
                         sound-dai = <&rcar_sound>;
                 };
-                codec {
+                simple-audio-card,codec {
                         ...
                 };
         };
@@ -141,23 +141,23 @@ For more detail information, see below
         ${LINUX}/sound/soc/sh/rcar/ctu.c
          - comment of header
 
-You need to use "renesas,rsrc-card" sound card for it.
+You need to use "simple-scu-audio-card" sound card for it.
 example)
 
         sound {
-                compatible = "renesas,rsrc-card";
+                compatible = "simple-scu-audio-card";
                 ...
                 /*
                  * CTU setting
                  * All input data will be converted to 2ch
                  * as output data
                  */
-                convert-channels = <2>;
+                simple-audio-card,convert-channels = <2>;
                 ...
-                cpu {
+                simple-audio-card,cpu {
                         sound-dai = <&rcar_sound>;
                 };
-                codec {
+                simple-audio-card,codec {
                         ...
                 };
         };
@@ -190,22 +190,22 @@ and these sounds will be merged by MIX.
         aplay -D plughw:0,0 xxxx.wav &
         aplay -D plughw:0,1 yyyy.wav
 
-You need to use "renesas,rsrc-card" sound card for it.
+You need to use "simple-scu-audio-card" sound card for it.
 Ex)
         [MEM] -> [SRC1] -> [CTU02] -+-> [MIX0] -> [DVC0] -> [SSI0]
                                     |
         [MEM] -> [SRC2] -> [CTU03] -+
 
         sound {
-                compatible = "renesas,rsrc-card";
+                compatible = "simple-scu-audio-card";
                 ...
-                cpu@0 {
+                simple-audio-card,cpu@0 {
                         sound-dai = <&rcar_sound 0>;
                 };
-                cpu@1 {
+                simple-audio-card,cpu@1 {
                         sound-dai = <&rcar_sound 1>;
                 };
-                codec {
+                simple-audio-card,codec {
                         ...
                 };
         };
@@ -368,6 +368,10 @@ Required properties:
                                   see below for detail.
 - #sound-dai-cells              : it must be 0 if your system is using single DAI
                                   it must be 1 if your system is using multi  DAI
+- clocks                        : References to SSI/SRC/MIX/CTU/DVC/AUDIO_CLK clocks.
+- clock-names                   : List of necessary clock names.
+                                  "ssi-all", "ssi.X", "src.X", "mix.X", "ctu.X",
+                                  "dvc.X", "clk_a", "clk_b", "clk_c", "clk_i"
 
 Optional properties:
 - #clock-cells                  : it must be 0 if your system has audio_clkout
@@ -375,6 +379,9 @@ Optional properties:
 - clock-frequency               : for all audio_clkout0/1/2/3
 - clkout-lr-asynchronous        : boolean property. it indicates that audio_clkoutn
                                   is asynchronizes with lr-clock.
+- resets                        : References to SSI resets.
+- reset-names                   : List of valid reset names.
+                                  "ssi-all", "ssi.X"
 
 SSI subnode properties:
 - interrupts                    : Should contain SSI interrupt for PIO transfer
diff --git a/Documentation/devicetree/bindings/sound/rockchip,pdm.txt b/Documentation/devicetree/bindings/sound/rockchip,pdm.txt
new file mode 100644
index 000000000000..921729de7346
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/rockchip,pdm.txt
@@ -0,0 +1,39 @@
+* Rockchip PDM controller
+
+Required properties:
+
+- compatible: "rockchip,pdm"
+- reg: physical base address of the controller and length of memory mapped
+  region.
+- dmas: DMA specifiers for rx dma. See the DMA client binding,
+        Documentation/devicetree/bindings/dma/dma.txt
+- dma-names: should include "rx".
+- clocks: a list of phandle + clock-specifer pairs, one for each entry in clock-names.
+- clock-names: should contain following:
+   - "pdm_hclk": clock for PDM BUS
+   - "pdm_clk" : clock for PDM controller
+- pinctrl-names: Must contain a "default" entry.
+- pinctrl-N: One property must exist for each entry in
+             pinctrl-names. See ../pinctrl/pinctrl-bindings.txt
+             for details of the property values.
+
+Example for rk3328 PDM controller:
+
+pdm: pdm@ff040000 {
+        compatible = "rockchip,pdm";
+        reg = <0x0 0xff040000 0x0 0x1000>;
+        clocks = <&clk_pdm>, <&clk_gates28 0>;
+        clock-names = "pdm_clk", "pdm_hclk";
+        dmas = <&pdma 16>;
+        #dma-cells = <1>;
+        dma-names = "rx";
+        pinctrl-names = "default", "sleep";
+        pinctrl-0 = <&pdmm0_clk
+                     &pdmm0_fsync
+                     &pdmm0_sdi0
+                     &pdmm0_sdi1
+                     &pdmm0_sdi2
+                     &pdmm0_sdi3>;
+        pinctrl-1 = <&pdmm0_sleep>;
+        status = "disabled";
+};
diff --git a/Documentation/devicetree/bindings/sound/rockchip-spdif.txt b/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
index 11046429a118..4706b96d450b 100644
--- a/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
+++ b/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
@@ -9,7 +9,9 @@ Required properties:
 - compatible: should be one of the following:
    - "rockchip,rk3066-spdif"
    - "rockchip,rk3188-spdif"
+   - "rockchip,rk3228-spdif"
    - "rockchip,rk3288-spdif"
+   - "rockchip,rk3328-spdif"
    - "rockchip,rk3366-spdif"
    - "rockchip,rk3368-spdif"
    - "rockchip,rk3399-spdif"
diff --git a/Documentation/devicetree/bindings/sound/samsung,odroid.txt b/Documentation/devicetree/bindings/sound/samsung,odroid.txt
index c1ac70cb0afb..c30934dd975b 100644
--- a/Documentation/devicetree/bindings/sound/samsung,odroid.txt
+++ b/Documentation/devicetree/bindings/sound/samsung,odroid.txt
@@ -5,11 +5,6 @@ Required properties:
  - compatible - "samsung,odroidxu3-audio" - for Odroid XU3 board,
                 "samsung,odroidxu4-audio" - for Odroid XU4 board
  - model - the user-visible name of this sound complex
- - 'cpu' subnode with a 'sound-dai' property containing the phandle of the I2S
-    controller
- - 'codec' subnode with a 'sound-dai' property containing list of phandles
-    to the CODEC nodes, first entry must be corresponding to the MAX98090
-    CODEC and the second entry must be the phandle of the HDMI IP block node
  - clocks - should contain entries matching clock names in the clock-names
     property
  - clock-names - should contain following entries:
@@ -32,12 +27,18 @@ Required properties:
    For Odroid XU4:
      no entries
 
+Required sub-nodes:
+
+ - 'cpu' subnode with a 'sound-dai' property containing the phandle of the I2S
+    controller
+ - 'codec' subnode with a 'sound-dai' property containing list of phandles
+    to the CODEC nodes, first entry must be corresponding to the MAX98090
+    CODEC and the second entry must be the phandle of the HDMI IP block node
+
 Example:
 
 sound {
         compatible = "samsung,odroidxu3-audio";
-        samsung,cpu-dai = <&i2s0>;
-        samsung,codec-dai = <&max98090>;
         model = "Odroid-XU3";
         samsung,audio-routing =
                 "Headphone Jack", "HPL",
diff --git a/Documentation/devicetree/bindings/sound/simple-scu-card.txt b/Documentation/devicetree/bindings/sound/simple-scu-card.txt
index d6fe47ed09af..327d229a51b2 100644
--- a/Documentation/devicetree/bindings/sound/simple-scu-card.txt
+++ b/Documentation/devicetree/bindings/sound/simple-scu-card.txt
@@ -1,35 +1,29 @@
-ASoC simple SCU Sound Card
+ASoC Simple SCU Sound Card
 
-Simple-Card specifies audio DAI connections of SoC <-> codec.
+Simple SCU Sound Card is "Simple Sound Card" + "ALSA DPCM".
+For example, you can use this driver if you want to exchange sampling rate convert,
+Mixing, etc...
 
 Required properties:
 
 - compatible                            : "simple-scu-audio-card"
                                           "renesas,rsrc-card"
-
 Optional properties:
 
-- simple-audio-card,name                : User specified audio sound card name, one string
-                                          property.
-- simple-audio-card,cpu                 : CPU   sub-node
-- simple-audio-card,codec               : CODEC sub-node
+- simple-audio-card,name                : see simple-audio-card.txt
+- simple-audio-card,cpu                 : see simple-audio-card.txt
+- simple-audio-card,codec               : see simple-audio-card.txt
 
 Optional subnode properties:
 
-- simple-audio-card,format              : CPU/CODEC common audio format.
-                                          "i2s", "right_j", "left_j" , "dsp_a"
-                                          "dsp_b", "ac97", "pdm", "msb", "lsb"
-- simple-audio-card,frame-master        : Indicates dai-link frame master.
-                                          phandle to a cpu or codec subnode.
-- simple-audio-card,bitclock-master     : Indicates dai-link bit clock master.
-                                          phandle to a cpu or codec subnode.
-- simple-audio-card,bitclock-inversion  : bool property. Add this if the
-                                          dai-link uses bit clock inversion.
-- simple-audio-card,frame-inversion     : bool property. Add this if the
-                                          dai-link uses frame clock inversion.
+- simple-audio-card,format              : see simple-audio-card.txt
+- simple-audio-card,frame-master        : see simple-audio-card.txt
+- simple-audio-card,bitclock-master     : see simple-audio-card.txt
+- simple-audio-card,bitclock-inversion  : see simple-audio-card.txt
+- simple-audio-card,frame-inversion     : see simple-audio-card.txt
 - simple-audio-card,convert-rate        : platform specified sampling rate convert
 - simple-audio-card,convert-channels    : platform specified converted channel size (2 - 8 ch)
-- simple-audio-card,prefix              : see audio-routing
+- simple-audio-card,prefix              : see routing
 - simple-audio-card,routing             : A list of the connections between audio components.
                                           Each entry is a pair of strings, the first being the connection's sink,
                                           the second being the connection's source. Valid names for sources.
@@ -38,32 +32,23 @@ Optional subnode properties:
 
 Required CPU/CODEC subnodes properties:
 
-- sound-dai                             : phandle and port of CPU/CODEC
+- sound-dai                             : see simple-audio-card.txt
 
 Optional CPU/CODEC subnodes properties:
 
-- clocks / system-clock-frequency       : specify subnode's clock if needed.
-                                          it can be specified via "clocks" if system has
-                                          clock node (= common clock), or "system-clock-frequency"
-                                          (if system doens't support common clock)
-                                          If a clock is specified, it is
-                                          enabled with clk_prepare_enable()
-                                          in dai startup() and disabled with
-                                          clk_disable_unprepare() in dai
-                                          shutdown().
+- clocks / system-clock-frequency       : see simple-audio-card.txt
 
-Example 1. Sampling Rate Covert
+Example 1. Sampling Rate Conversion
 
 sound {
         compatible = "simple-scu-audio-card";
 
         simple-audio-card,name = "rsnd-ak4643";
         simple-audio-card,format = "left_j";
-        simple-audio-card,format = "left_j";
         simple-audio-card,bitclock-master = <&sndcodec>;
         simple-audio-card,frame-master = <&sndcodec>;
 
-        simple-audio-card,convert-rate = <48000>; /* see audio_clk_a */
+        simple-audio-card,convert-rate = <48000>;
 
         simple-audio-card,prefix = "ak4642";
         simple-audio-card,routing = "ak4642 Playback", "DAI0 Playback",
@@ -79,20 +64,18 @@ sound {
         };
 };
 
-Example 2. 2 CPU 1 Codec
+Example 2. 2 CPU 1 Codec (Mixing)
 
 sound {
-        compatible = "renesas,rsrc-card";
-
-        card-name = "rsnd-ak4643";
-        format = "left_j";
-        bitclock-master = <&dpcmcpu>;
-        frame-master = <&dpcmcpu>;
+        compatible = "simple-scu-audio-card";
 
-        convert-rate = <48000>;  /* see audio_clk_a */
+        simple-audio-card,name = "rsnd-ak4643";
+        simple-audio-card,format = "left_j";
+        simple-audio-card,bitclock-master = <&dpcmcpu>;
+        simple-audio-card,frame-master = <&dpcmcpu>;
 
-        audio-prefix = "ak4642";
-        audio-routing = "ak4642 Playback", "DAI0 Playback",
+        simple-audio-card,prefix = "ak4642";
+        simple-audio-card,routing = "ak4642 Playback", "DAI0 Playback",
                         "ak4642 Playback", "DAI1 Playback";
 
         dpcmcpu: cpu@0 {
diff --git a/Documentation/devicetree/bindings/sound/st,stm32-i2s.txt b/Documentation/devicetree/bindings/sound/st,stm32-i2s.txt
new file mode 100644
index 000000000000..4bda52042402
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/st,stm32-i2s.txt
@@ -0,0 +1,62 @@
+STMicroelectronics STM32 SPI/I2S Controller
+
+The SPI/I2S block supports I2S/PCM protocols when configured on I2S mode.
+Only some SPI instances support I2S.
+
+Required properties:
+  - compatible: Must be "st,stm32h7-i2s"
+  - reg: Offset and length of the device's register set.
+  - interrupts: Must contain the interrupt line id.
+  - clocks: Must contain phandle and clock specifier pairs for each entry
+        in clock-names.
+  - clock-names: Must contain "i2sclk", "pclk", "x8k" and "x11k".
+        "i2sclk": clock which feeds the internal clock generator
+        "pclk": clock which feeds the peripheral bus interface
+        "x8k": I2S parent clock for sampling rates multiple of 8kHz.
+        "x11k": I2S parent clock for sampling rates multiple of 11.025kHz.
+  - dmas: DMA specifiers for tx and rx dma.
+    See Documentation/devicetree/bindings/dma/stm32-dma.txt.
+  - dma-names: Identifier for each DMA request line. Must be "tx" and "rx".
+  - pinctrl-names: should contain only value "default"
+  - pinctrl-0: see Documentation/devicetree/bindings/pinctrl/pinctrl-stm32.txt
+
+Optional properties:
+  - resets: Reference to a reset controller asserting the reset controller
+
+The device node should contain one 'port' child node with one child 'endpoint'
+node, according to the bindings defined in Documentation/devicetree/bindings/
+graph.txt.
+
+Example:
+sound_card {
+        compatible = "audio-graph-card";
+        dais = <&i2s2_port>;
+};
+
+i2s2: audio-controller@40003800 {
+        compatible = "st,stm32h7-i2s";
+        reg = <0x40003800 0x400>;
+        interrupts = <36>;
+        clocks = <&rcc PCLK1>, <&rcc SPI2_CK>, <&rcc PLL1_Q>, <&rcc PLL2_P>;
+        clock-names = "pclk", "i2sclk",  "x8k", "x11k";
+        dmas = <&dmamux2 2 39 0x400 0x1>,
+           <&dmamux2 3 40 0x400 0x1>;
+        dma-names = "rx", "tx";
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_i2s2>;
+
+        i2s2_port: port@0 {
+                cpu_endpoint: endpoint {
+                        remote-endpoint = <&codec_endpoint>;
+                        format = "i2s";
+                };
+        };
+};
+
+audio-codec {
+        codec_port: port@0 {
+                codec_endpoint: endpoint {
+                        remote-endpoint = <&cpu_endpoint>;
+                };
+        };
+};
diff --git a/Documentation/devicetree/bindings/sound/st,stm32-sai.txt b/Documentation/devicetree/bindings/sound/st,stm32-sai.txt
index c59a3d779e06..f1c5ae59e7c9 100644
--- a/Documentation/devicetree/bindings/sound/st,stm32-sai.txt
+++ b/Documentation/devicetree/bindings/sound/st,stm32-sai.txt
@@ -6,7 +6,7 @@ The SAI contains two independent audio sub-blocks. Each sub-block has
 its own clock generator and I/O lines controller.
 
 Required properties:
-  - compatible: Should be "st,stm32f4-sai"
+  - compatible: Should be "st,stm32f4-sai" or "st,stm32h7-sai"
   - reg: Base address and size of SAI common register set.
   - clocks: Must contain phandle and clock specifier pairs for each entry
         in clock-names.
@@ -36,6 +36,10 @@ SAI subnodes required properties:
   - pinctrl-names: should contain only value "default"
   - pinctrl-0: see Documentation/devicetree/bindings/pinctrl/pinctrl-stm32.txt
 
+The device node should contain one 'port' child node with one child 'endpoint'
+node, according to the bindings defined in Documentation/devicetree/bindings/
+graph.txt.
+
 Example:
 sound_card {
         compatible = "audio-graph-card";
@@ -43,38 +47,29 @@ sound_card {
 };
 
 sai1: sai1@40015800 {
-        compatible = "st,stm32f4-sai";
+        compatible = "st,stm32h7-sai";
         #address-cells = <1>;
         #size-cells = <1>;
-        ranges;
+        ranges = <0 0x40015800 0x400>;
         reg = <0x40015800 0x4>;
-        clocks = <&rcc 1 CLK_SAIQ_PDIV>, <&rcc 1 CLK_I2SQ_PDIV>;
+        clocks = <&rcc PLL1_Q>, <&rcc PLL2_P>;
         clock-names = "x8k", "x11k";
         interrupts = <87>;
 
-        sai1b: audio-controller@40015824 {
-                #sound-dai-cells = <0>;
-                compatible = "st,stm32-sai-sub-b";
-                reg = <0x40015824 0x1C>;
-                clocks = <&rcc 1 CLK_SAI2>;
+        sai1a: audio-controller@40015804 {
+                compatible = "st,stm32-sai-sub-a";
+                reg = <0x4 0x1C>;
+                clocks = <&rcc SAI1_CK>;
                 clock-names = "sai_ck";
-                dmas = <&dma2 5 0 0x400 0x0>;
+                dmas = <&dmamux1 1 87 0x400 0x0>;
                 dma-names = "tx";
                 pinctrl-names = "default";
-                pinctrl-0 = <&pinctrl_sai1b>;
-
-                ports {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
+                pinctrl-0 = <&pinctrl_sai1a>;
 
-                        sai1b_port: port@0 {
-                                reg = <0>;
-                                cpu_endpoint: endpoint {
-                                        remote-endpoint = <&codec_endpoint>;
-                                        audio-graph-card,format = "i2s";
-                                        audio-graph-card,bitclock-master = <&codec_endpoint>;
-                                        audio-graph-card,frame-master = <&codec_endpoint>;
-                                };
+                sai1b_port: port {
+                        cpu_endpoint: endpoint {
+                                remote-endpoint = <&codec_endpoint>;
+                                format = "i2s";
                         };
                 };
         };
diff --git a/Documentation/devicetree/bindings/sound/st,stm32-spdifrx.txt b/Documentation/devicetree/bindings/sound/st,stm32-spdifrx.txt
new file mode 100644
index 000000000000..33826f2459fa
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/st,stm32-spdifrx.txt
@@ -0,0 +1,56 @@
+STMicroelectronics STM32 S/PDIF receiver (SPDIFRX).
+
+The SPDIFRX peripheral, is designed to receive an S/PDIF flow compliant with
+IEC-60958 and IEC-61937.
+
+Required properties:
+  - compatible: should be "st,stm32h7-spdifrx"
+  - reg: cpu DAI IP base address and size
+  - clocks: must contain an entry for kclk (used as S/PDIF signal reference)
+  - clock-names: must contain "kclk"
+  - interrupts: cpu DAI interrupt line
+  - dmas: DMA specifiers for audio data DMA and iec control flow DMA
+    See STM32 DMA bindings, Documentation/devicetree/bindings/dma/stm32-dma.txt
+  - dma-names: two dmas have to be defined, "rx" and "rx-ctrl"
+
+Optional properties:
+  - resets: Reference to a reset controller asserting the SPDIFRX
+
+The device node should contain one 'port' child node with one child 'endpoint'
+node, according to the bindings defined in Documentation/devicetree/bindings/
+graph.txt.
+
+Example:
+spdifrx: spdifrx@40004000 {
+        compatible = "st,stm32h7-spdifrx";
+        reg = <0x40004000 0x400>;
+        clocks = <&rcc SPDIFRX_CK>;
+        clock-names = "kclk";
+        interrupts = <97>;
+        dmas = <&dmamux1 2 93 0x400 0x0>,
+               <&dmamux1 3 94 0x400 0x0>;
+        dma-names = "rx", "rx-ctrl";
+        pinctrl-0 = <&spdifrx_pins>;
+        pinctrl-names = "default";
+
+        spdifrx_port: port {
+                cpu_endpoint: endpoint {
+                        remote-endpoint = <&codec_endpoint>;
+                };
+        };
+};
+
+spdif_in: spdif-in {
+        compatible = "linux,spdif-dir";
+
+        codec_port: port {
+                codec_endpoint: endpoint {
+                        remote-endpoint = <&cpu_endpoint>;
+                };
+        };
+};
+
+soundcard {
+        compatible = "audio-graph-card";
+        dais = <&spdifrx_port>;
+};
diff --git a/Documentation/devicetree/bindings/sound/sun4i-codec.txt b/Documentation/devicetree/bindings/sound/sun4i-codec.txt
index 3863531d1e6d..2d4e10deb6f4 100644
--- a/Documentation/devicetree/bindings/sound/sun4i-codec.txt
+++ b/Documentation/devicetree/bindings/sound/sun4i-codec.txt
@@ -7,6 +7,7 @@ Required properties:
                 - "allwinner,sun7i-a20-codec"
                 - "allwinner,sun8i-a23-codec"
                 - "allwinner,sun8i-h3-codec"
+                - "allwinner,sun8i-v3s-codec"
 - reg: must contain the registers location and length
 - interrupts: must contain the codec interrupt
 - dmas: DMA channels for tx and rx dma. See the DMA client binding,
@@ -25,6 +26,7 @@ Required properties for the following compatibles:
                 - "allwinner,sun6i-a31-codec"
                 - "allwinner,sun8i-a23-codec"
                 - "allwinner,sun8i-h3-codec"
+                - "allwinner,sun8i-v3s-codec"
 - resets: phandle to the reset control for this device
 - allwinner,audio-routing: A list of the connections between audio components.
                            Each entry is a pair of strings, the first being the
@@ -34,15 +36,15 @@ Required properties for the following compatibles:
                            Audio pins on the SoC:
                            "HP"
                            "HPCOM"
-                           "LINEIN"
-                           "LINEOUT"    (not on sun8i-a23)
+                           "LINEIN"     (not on sun8i-v3s)
+                           "LINEOUT"    (not on sun8i-a23 or sun8i-v3s)
                            "MIC1"
-                           "MIC2"
+                           "MIC2"       (not on sun8i-v3s)
                            "MIC3"       (sun6i-a31 only)
 
                            Microphone biases from the SoC:
                            "HBIAS"
-                           "MBIAS"
+                           "MBIAS"      (not on sun8i-v3s)
 
                            Board connectors:
                            "Headphone"
@@ -55,6 +57,7 @@ Required properties for the following compatibles:
 Required properties for the following compatibles:
                 - "allwinner,sun8i-a23-codec"
                 - "allwinner,sun8i-h3-codec"
+                - "allwinner,sun8i-v3s-codec"
 - allwinner,codec-analog-controls: A phandle to the codec analog controls
                                    block in the PRCM.
 
diff --git a/Documentation/devicetree/bindings/sound/sun8i-codec-analog.txt b/Documentation/devicetree/bindings/sound/sun8i-codec-analog.txt
index 779b735781ba..1b6e7c4e50ab 100644
--- a/Documentation/devicetree/bindings/sound/sun8i-codec-analog.txt
+++ b/Documentation/devicetree/bindings/sound/sun8i-codec-analog.txt
@@ -4,6 +4,7 @@ Required properties:
 - compatible: must be one of the following compatibles:
                 - "allwinner,sun8i-a23-codec-analog"
                 - "allwinner,sun8i-h3-codec-analog"
+                - "allwinner,sun8i-v3s-codec-analog"
 
 Required properties if not a sub-node of the PRCM node:
 - reg: must contain the registers location and length
diff --git a/Documentation/devicetree/bindings/sound/zte,zx-aud96p22.txt b/Documentation/devicetree/bindings/sound/zte,zx-aud96p22.txt
new file mode 100644
index 000000000000..41bb1040eb71
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/zte,zx-aud96p22.txt
@@ -0,0 +1,24 @@
+ZTE ZX AUD96P22 Audio Codec
+
+Required properties:
+ - compatible: Must be "zte,zx-aud96p22"
+ - #sound-dai-cells: Should be 0
+ - reg: I2C bus slave address of AUD96P22
+
+Example:
+
+        i2c0: i2c@1486000 {
+                compatible = "zte,zx296718-i2c";
+                reg = <0x01486000 0x1000>;
+                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+                clocks = <&audiocrm AUDIO_I2C0_WCLK>;
+                clock-frequency = <1600000>;
+
+                aud96p22: codec@22 {
+                        compatible = "zte,zx-aud96p22";
+                        #sound-dai-cells = <0>;
+                        reg = <0x22>;
+                };
+        };
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index 00bea038639e..fcf199b64d3d 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -10,6 +10,7 @@ Required properties:
   - "rockchip,rk3288-usb", "rockchip,rk3066-usb", "snps,dwc2": for rk3288 Soc;
   - "lantiq,arx100-usb": The DWC2 USB controller instance in Lantiq ARX SoCs;
   - "lantiq,xrx200-usb": The DWC2 USB controller instance in Lantiq XRX SoCs;
+  - "amlogic,meson8-usb": The DWC2 USB controller instance in Amlogic Meson8 SoCs;
   - "amlogic,meson8b-usb": The DWC2 USB controller instance in Amlogic Meson8b SoCs;
   - "amlogic,meson-gxbb-usb": The DWC2 USB controller instance in Amlogic S905 SoCs;
   - "amcc,dwc-otg": The DWC2 USB controller instance in AMCC Canyonlands 460EX SoCs;
diff --git a/Documentation/input/devices/edt-ft5x06.rst b/Documentation/input/devices/edt-ft5x06.rst
index 2032f0b7a8fa..1ccc94b192b7 100644
--- a/Documentation/input/devices/edt-ft5x06.rst
+++ b/Documentation/input/devices/edt-ft5x06.rst
@@ -15,7 +15,7 @@ It has been tested with the following devices:
 The driver allows configuration of the touch screen via a set of sysfs files:
 
 /sys/class/input/eventX/device/device/threshold:
-    allows setting the "click"-threshold in the range from 20 to 80.
+    allows setting the "click"-threshold in the range from 0 to 80.
 
 /sys/class/input/eventX/device/device/gain:
     allows setting the sensitivity in the range from 0 to 31. Note that
diff --git a/Documentation/networking/dpaa.txt b/Documentation/networking/dpaa.txt
new file mode 100644
index 000000000000..76e016d4d344
--- /dev/null
+++ b/Documentation/networking/dpaa.txt
@@ -0,0 +1,194 @@
+The QorIQ DPAA Ethernet Driver
+==============================
+
+Authors:
+Madalin Bucur <madalin.bucur@nxp.com>
+Camelia Groza <camelia.groza@nxp.com>
+
+Contents
+========
+
+        - DPAA Ethernet Overview
+        - DPAA Ethernet Supported SoCs
+        - Configuring DPAA Ethernet in your kernel
+        - DPAA Ethernet Frame Processing
+        - DPAA Ethernet Features
+        - Debugging
+
+DPAA Ethernet Overview
+======================
+
+DPAA stands for Data Path Acceleration Architecture and it is a
+set of networking acceleration IPs that are available on several
+generations of SoCs, both on PowerPC and ARM64.
+
+The Freescale DPAA architecture consists of a series of hardware blocks
+that support Ethernet connectivity. The Ethernet driver depends upon the
+following drivers in the Linux kernel:
+
+ - Peripheral Access Memory Unit (PAMU) (* needed only for PPC platforms)
+    drivers/iommu/fsl_*
+ - Frame Manager (FMan)
+    drivers/net/ethernet/freescale/fman
+ - Queue Manager (QMan), Buffer Manager (BMan)
+    drivers/soc/fsl/qbman
+
+A simplified view of the dpaa_eth interfaces mapped to FMan MACs:
+
+  dpaa_eth       /eth0\     ...       /ethN\
+  driver        |      |             |      |
+  -------------   ----   -----------   ----   -------------
+       -Ports  / Tx  Rx \    ...    / Tx  Rx \
+  FMan        |          |         |          |
+       -MACs  |   MAC0   |         |   MACN   |
+             /   dtsec0   \  ...  /   dtsecN   \ (or tgec)
+            /              \     /              \(or memac)
+  ---------  --------------  ---  --------------  ---------
+      FMan, FMan Port, FMan SP, FMan MURAM drivers
+  ---------------------------------------------------------
+      FMan HW blocks: MURAM, MACs, Ports, SP
+  ---------------------------------------------------------
+
+The dpaa_eth relation to the QMan, BMan and FMan:
+              ________________________________
+  dpaa_eth   /            eth0                \
+  driver    /                                  \
+  ---------   -^-   -^-   -^-   ---    ---------
+  QMan driver / \   / \   / \  \   /  | BMan    |
+             |Rx | |Rx | |Tx | |Tx |  | driver  |
+  ---------  |Dfl| |Err| |Cnf| |FQs|  |         |
+  QMan HW    |FQ | |FQ | |FQs| |   |  |         |
+             /   \ /   \ /   \  \ /   |         |
+  ---------   ---   ---   ---   -v-    ---------
+            |        FMan QMI         |         |
+            | FMan HW       FMan BMI  | BMan HW |
+              -----------------------   --------
+
+where the acronyms used above (and in the code) are:
+DPAA = Data Path Acceleration Architecture
+FMan = DPAA Frame Manager
+QMan = DPAA Queue Manager
+BMan = DPAA Buffers Manager
+QMI = QMan interface in FMan
+BMI = BMan interface in FMan
+FMan SP = FMan Storage Profiles
+MURAM = Multi-user RAM in FMan
+FQ = QMan Frame Queue
+Rx Dfl FQ = default reception FQ
+Rx Err FQ = Rx error frames FQ
+Tx Cnf FQ = Tx confirmation FQs
+Tx FQs = transmission frame queues
+dtsec = datapath three speed Ethernet controller (10/100/1000 Mbps)
+tgec = ten gigabit Ethernet controller (10 Gbps)
+memac = multirate Ethernet MAC (10/100/1000/10000)
+
+DPAA Ethernet Supported SoCs
+============================
+
+The DPAA drivers enable the Ethernet controllers present on the following SoCs:
+
+# PPC
+P1023
+P2041
+P3041
+P4080
+P5020
+P5040
+T1023
+T1024
+T1040
+T1042
+T2080
+T4240
+B4860
+
+# ARM
+LS1043A
+LS1046A
+
+Configuring DPAA Ethernet in your kernel
+========================================
+
+To enable the DPAA Ethernet driver, the following Kconfig options are required:
+
+# common for arch/arm64 and arch/powerpc platforms
+CONFIG_FSL_DPAA=y
+CONFIG_FSL_FMAN=y
+CONFIG_FSL_DPAA_ETH=y
+CONFIG_FSL_XGMAC_MDIO=y
+
+# for arch/powerpc only
+CONFIG_FSL_PAMU=y
+
+# common options needed for the PHYs used on the RDBs
+CONFIG_VITESSE_PHY=y
+CONFIG_REALTEK_PHY=y
+CONFIG_AQUANTIA_PHY=y
+
+DPAA Ethernet Frame Processing
+==============================
+
+On Rx, buffers for the incoming frames are retrieved from one of the three
+existing buffers pools. The driver initializes and seeds these, each with
+buffers of different sizes: 1KB, 2KB and 4KB.
+
+On Tx, all transmitted frames are returned to the driver through Tx
+confirmation frame queues. The driver is then responsible for freeing the
+buffers. In order to do this properly, a backpointer is added to the buffer
+before transmission that points to the skb. When the buffer returns to the
+driver on a confirmation FQ, the skb can be correctly consumed.
+
+DPAA Ethernet Features
+======================
+
+Currently the DPAA Ethernet driver enables the basic features required for
+a Linux Ethernet driver. The support for advanced features will be added
+gradually.
+
+The driver has Rx and Tx checksum offloading for UDP and TCP. Currently the Rx
+checksum offload feature is enabled by default and cannot be controlled through
+ethtool.
+
+The driver has support for multiple prioritized Tx traffic classes. Priorities
+range from 0 (lowest) to 3 (highest). These are mapped to HW workqueues with
+strict priority levels. Each traffic class contains NR_CPU TX queues. By
+default, only one traffic class is enabled and the lowest priority Tx queues
+are used. Higher priority traffic classes can be enabled with the mqprio
+qdisc. For example, all four traffic classes are enabled on an interface with
+the following command. Furthermore, skb priority levels are mapped to traffic
+classes as follows:
+
+        * priorities 0 to 3 - traffic class 0 (low priority)
+        * priorities 4 to 7 - traffic class 1 (medium-low priority)
+        * priorities 8 to 11 - traffic class 2 (medium-high priority)
+        * priorities 12 to 15 - traffic class 3 (high priority)
+
+tc qdisc add dev <int> root handle 1: \
+         mqprio num_tc 4 map 0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3 hw 1
+
+Debugging
+=========
+
+The following statistics are exported for each interface through ethtool:
+
+        - interrupt count per CPU
+        - Rx packets count per CPU
+        - Tx packets count per CPU
+        - Tx confirmed packets count per CPU
+        - Tx S/G frames count per CPU
+        - Tx error count per CPU
+        - Rx error count per CPU
+        - Rx error count per type
+        - congestion related statistics:
+                - congestion status
+                - time spent in congestion
+                - number of time the device entered congestion
+                - dropped packets count per cause
+
+The driver also exports the following information in sysfs:
+
+        - the FQ IDs for each FQ type
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/fqids
+
+        - the IDs of the buffer pools in use
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/bpids
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 59f4db2a0c85..f55639d71d35 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -122,7 +122,7 @@ associated flow of the packet. The hash is either provided by hardware
 or will be computed in the stack. Capable hardware can pass the hash in
 the receive descriptor for the packet; this would usually be the same
 hash used for RSS (e.g. computed Toeplitz hash). The hash is saved in
-skb->rx_hash and can be used elsewhere in the stack as a hash of the
+skb->hash and can be used elsewhere in the stack as a hash of the
 packet’s flow.
 
 Each receive hardware queue has an associated list of CPUs to which
diff --git a/Documentation/networking/tcp.txt b/Documentation/networking/tcp.txt
index bdc4c0db51e1..9c7139d57e57 100644
--- a/Documentation/networking/tcp.txt
+++ b/Documentation/networking/tcp.txt
@@ -1,7 +1,7 @@
 TCP protocol
 ============
 
-Last updated: 9 February 2008
+Last updated: 3 June 2017
 
 Contents
 ========
@@ -29,18 +29,19 @@ As of 2.6.13, Linux supports pluggable congestion control algorithms.
 A congestion control mechanism can be registered through functions in
 tcp_cong.c. The functions used by the congestion control mechanism are
 registered via passing a tcp_congestion_ops struct to
-tcp_register_congestion_control. As a minimum name, ssthresh,
-cong_avoid must be valid.
+tcp_register_congestion_control. As a minimum, the congestion control
+mechanism must provide a valid name and must implement either ssthresh,
+cong_avoid and undo_cwnd hooks or the "omnipotent" cong_control hook.
 
 Private data for a congestion control mechanism is stored in tp->ca_priv.
 tcp_ca(tp) returns a pointer to this space.  This is preallocated space - it
 is important to check the size of your private data will fit this space, or
-alternatively space could be allocated elsewhere and a pointer to it could
+alternatively, space could be allocated elsewhere and a pointer to it could
 be stored here.
 
 There are three kinds of congestion control algorithms currently: The
 simplest ones are derived from TCP reno (highspeed, scalable) and just
-provide an alternative the congestion window calculation. More complex
+provide an alternative congestion window calculation. More complex
 ones like BIC try to look at other events to provide better
 heuristics.  There are also round trip time based algorithms like
 Vegas and Westwood+.
@@ -49,21 +50,15 @@ Good TCP congestion control is a complex problem because the algorithm
 needs to maintain fairness and performance. Please review current
 research and RFC's before developing new modules.
 
-The method that is used to determine which congestion control mechanism is
-determined by the setting of the sysctl net.ipv4.tcp_congestion_control.
-The default congestion control will be the last one registered (LIFO);
-so if you built everything as modules, the default will be reno. If you
-build with the defaults from Kconfig, then CUBIC will be builtin (not a
-module) and it will end up the default.
+The default congestion control mechanism is chosen based on the
+DEFAULT_TCP_CONG Kconfig parameter. If you really want a particular default
+value then you can set it using sysctl net.ipv4.tcp_congestion_control. The
+module will be autoloaded if needed and you will get the expected protocol. If
+you ask for an unknown congestion method, then the sysctl attempt will fail.
 
-If you really want a particular default value then you will need
-to set it with the sysctl.  If you use a sysctl, the module will be autoloaded
-if needed and you will get the expected protocol. If you ask for an
-unknown congestion method, then the sysctl attempt will fail.
-
-If you remove a tcp congestion control module, then you will get the next
+If you remove a TCP congestion control module, then you will get the next
 available one. Since reno cannot be built as a module, and cannot be
-deleted, it will always be available.
+removed, it will always be available.
 
 How the new TCP output machine [nyi] works.
 ===========================================
diff --git a/Documentation/sound/soc/dapm.rst b/Documentation/sound/soc/dapm.rst
index a27f42befa4d..8e44107933ab 100644
--- a/Documentation/sound/soc/dapm.rst
+++ b/Documentation/sound/soc/dapm.rst
@@ -105,6 +105,24 @@ Pre
         Special PRE widget (exec before all others)
 Post
         Special POST widget (exec after all others)
+Buffer
+        Inter widget audio data buffer within a DSP.
+Scheduler
+        DSP internal scheduler that schedules component/pipeline processing
+        work.
+Effect
+        Widget that performs an audio processing effect.
+SRC
+        Sample Rate Converter within DSP or CODEC
+ASRC
+        Asynchronous Sample Rate Converter within DSP or CODEC
+Encoder
+        Widget that encodes audio data from one format (usually PCM) to another
+        usually more compressed format.
+Decoder
+        Widget that decodes audio data from a compressed format to an
+        uncompressed format like PCM.
+
 
 (Widgets are defined in include/sound/soc-dapm.h)
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 01dc6a4fb16c..767e9d202adf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1172,7 +1172,7 @@ N:	clps711x
 
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
-M:      Ryan Mallon <rmallon@gmail.com>
+M:      Alexander Sverdlin <alexander.sverdlin@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-ep93xx/
@@ -1489,13 +1489,15 @@ M:	Gregory Clement <gregory.clement@free-electrons.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/rtc-armada38x.c
 F:      arch/arm/boot/dts/armada*
 F:      arch/arm/boot/dts/kirkwood*
+F:      arch/arm/configs/mvebu_*_defconfig
+F:      arch/arm/mach-mvebu/
 F:      arch/arm64/boot/dts/marvell/armada*
 F:      drivers/cpufreq/mvebu-cpufreq.c
-F:      arch/arm/configs/mvebu_*_defconfig
+F:      drivers/irqchip/irq-armada-370-xp.c
+F:      drivers/irqchip/irq-mvebu-*
+F:      drivers/rtc/rtc-armada38x.c
 
 ARM/Marvell Berlin SoC support
 M:      Jisheng Zhang <jszhang@marvell.com>
@@ -1721,7 +1723,6 @@ N:	rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
-R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
@@ -1829,7 +1830,6 @@ F:	drivers/edac/altera_edac.
 ARM/STI ARCHITECTURE
 M:      Patrice Chotard <patrice.chotard@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      kernel@stlinux.com
 W:      http://www.stlinux.com
 S:      Maintained
 F:      arch/arm/mach-sti/
@@ -2964,7 +2964,7 @@ F:	sound/pci/oxygen/
 
 C6X ARCHITECTURE
 M:      Mark Salter <msalter@redhat.com>
-M:      Aurelien Jacquiot <a-jacquiot@ti.com>
+M:      Aurelien Jacquiot <jacquiot.aurelien@gmail.com>
 L:      linux-c6x-dev@linux-c6x.org
 W:      http://www.linux-c6x.org/wiki/index.php/Main_Page
 S:      Maintained
@@ -5622,7 +5622,7 @@ F:	scripts/get_maintainer.pl
 
 GENWQE (IBM Generic Workqueue Card)
 M:      Frank Haverkamp <haver@linux.vnet.ibm.com>
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 S:      Supported
 F:      drivers/misc/genwqe/
 
@@ -5667,7 +5667,6 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
-M:      Alexandre Courbot <gnurou@gmail.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7143,7 +7142,7 @@ S:	Maintained
 F:      drivers/media/platform/rcar_jpu.c
 
 JSM Neo PCI based serial card
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
 F:      drivers/tty/serial/jsm/
@@ -7707,7 +7706,7 @@ F:	drivers/platform/x86/hp_accel.c
 
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Jiri Kosina <jikos@kernel.org>
 M:      Miroslav Benes <mbenes@suse.cz>
 R:      Petr Mladek <pmladek@suse.com>
@@ -8508,7 +8507,7 @@ S:	Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
 
 MELLANOX MLX4 core VPI driver
-M:      Yishai Hadas <yishaih@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 L:      linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
@@ -8516,7 +8515,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx4/
 F:      include/linux/mlx4/
-F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX4 IB driver
 M:      Yishai Hadas <yishaih@mellanox.com>
@@ -8526,6 +8524,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
+F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX5 core VPI driver
 M:      Saeed Mahameed <saeedm@mellanox.com>
@@ -8538,7 +8537,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
-F:      include/uapi/rdma/mlx5-abi.h
 
 MELLANOX MLX5 IB driver
 M:      Matan Barak <matanb@mellanox.com>
@@ -8549,6 +8547,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx5/
 F:      include/linux/mlx5/
+F:      include/uapi/rdma/mlx5-abi.h
 
 MELEXIS MLX90614 DRIVER
 M:      Crt Mori <cmo@melexis.com>
@@ -8588,7 +8587,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/mn88473*
 
 MODULE SUPPORT
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux.git modules-next
 S:      Maintained
@@ -10450,7 +10449,7 @@ S:	Orphan
 
 PXA RTC DRIVER
 M:      Robert Jarzmik <robert.jarzmik@free.fr>
-L:      rtc-linux@googlegroups.com
+L:      linux-rtc@vger.kernel.org
 S:      Maintained
 
 QAT DRIVER
@@ -10757,7 +10756,7 @@ X:	kernel/torture.c
 REAL TIME CLOCK (RTC) SUBSYSTEM
 M:      Alessandro Zummo <a.zummo@towertech.it>
 M:      Alexandre Belloni <alexandre.belloni@free-electrons.com>
-L:      rtc-linux@googlegroups.com
+L:      linux-rtc@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/rtc-linux/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux.git
 S:      Maintained
@@ -11268,7 +11267,6 @@ F:	drivers/media/rc/serial_ir.c
 
 STI CEC DRIVER
 M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
-L:      kernel@stlinux.com
 S:      Maintained
 F:      drivers/staging/media/st-cec/
 F:      Documentation/devicetree/bindings/media/stih-cec.txt
@@ -11778,6 +11776,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
 S:      Supported
 F:      arch/arm/mach-davinci/
 F:      drivers/i2c/busses/i2c-davinci.c
+F:      arch/arm/boot/dts/da850*
 
 TI DAVINCI SERIES MEDIA DRIVER
 M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
diff --git a/Makefile b/Makefile
index 63e10bd4f14a..283c6236438e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION =
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -1437,7 +1437,7 @@ help:
         @echo  '  make V=0|1 [targets] 0 => quiet build (default), 1 => verbose build'
         @echo  '  make V=2   [targets] 2 => give reason for rebuild of target'
         @echo  '  make O=dir [targets] Locate all output files in "dir", including .config'
-        @echo  '  make C=1   [targets] Check all c source with $$CHECK (sparse by default)'
+        @echo  '  make C=1   [targets] Check re-compiled c source with $$CHECK (sparse by default)'
         @echo  '  make C=2   [targets] Force check of all c source with $$CHECK'
         @echo  '  make RECORDMCOUNT_WARN=1 [targets] Warn about ignored mcount sections'
         @echo  '  make W=n   [targets] Enable extra gcc checks, n=1,2,3 where'
diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
index 6e1242da0159..4104a0839214 100644
--- a/arch/arc/include/asm/processor.h
+++ b/arch/arc/include/asm/processor.h
@@ -86,8 +86,6 @@ struct task_struct;
 #define TSK_K_BLINK(tsk)        TSK_K_REG(tsk, 4)
 #define TSK_K_FP(tsk)           TSK_K_REG(tsk, 0)
 
-#define thread_saved_pc(tsk)    TSK_K_BLINK(tsk)
-
 extern void start_thread(struct pt_regs * regs, unsigned long pc,
                          unsigned long usp);
 
diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c
index 3e25e8d6486b..2e13683dfb24 100644
--- a/arch/arc/mm/mmap.c
+++ b/arch/arc/mm/mmap.c
@@ -65,7 +65,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 4c1a35f15838..c0fcab6a5504 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1416,6 +1416,7 @@ choice
         config VMSPLIT_3G
                 bool "3G/1G user/kernel split"
         config VMSPLIT_3G_OPT
+                depends on !ARM_LPAE
                 bool "3G/1G user/kernel split (for full 1G low memory)"
         config VMSPLIT_2G
                 bool "2G/2G user/kernel split"
diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S
index 9d5dc4fda3c1..a17ca8d78656 100644
--- a/arch/arm/boot/compressed/efi-header.S
+++ b/arch/arm/boot/compressed/efi-header.S
@@ -17,14 +17,13 @@
                 @ there.
                 .inst   'M' | ('Z' << 8) | (0x1310 << 16)   @ tstne r0, #0x4d000
 #else
-                mov     r0, r0
+ AR_CLASS(      mov     r0, r0          )
+  M_CLASS(      nop.w                   )
 #endif
                 .endm
 
                 .macro  __EFI_HEADER
 #ifdef CONFIG_EFI_STUB
-                b       __efi_start
-
                 .set    start_offset, __efi_start - start
                 .org    start + 0x3c
                 @
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 7c711ba61417..8a756870c238 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -130,19 +130,22 @@ start:
                 .rept   7
                 __nop
                 .endr
-   ARM(         mov     r0, r0          )
-   ARM(         b       1f              )
- THUMB(         badr    r12, 1f         )
- THUMB(         bx      r12             )
+#ifndef CONFIG_THUMB2_KERNEL
+                mov     r0, r0
+#else
+ AR_CLASS(      sub     pc, pc, #3      )       @ A/R: switch to Thumb2 mode
+  M_CLASS(      nop.w                   )       @ M: already in Thumb2 mode
+                .thumb
+#endif
+                W(b)    1f
 
                 .word   _magic_sig      @ Magic numbers to help the loader
                 .word   _magic_start    @ absolute load/run zImage address
                 .word   _magic_end      @ zImage end address
                 .word   0x04030201      @ endianness flag
 
- THUMB(         .thumb                  )
-1:              __EFI_HEADER
-
+                __EFI_HEADER
+1:
  ARM_BE8(       setend  be              )       @ go BE8 if compiled for BE8
  AR_CLASS(      mrs     r9, cpsr        )
 #ifdef CONFIG_ARM_VIRT_EXT
diff --git a/arch/arm/boot/dts/am335x-sl50.dts b/arch/arm/boot/dts/am335x-sl50.dts
index c5d2589c55fc..fc864a855991 100644
--- a/arch/arm/boot/dts/am335x-sl50.dts
+++ b/arch/arm/boot/dts/am335x-sl50.dts
@@ -220,7 +220,7 @@
 
         mmc1_pins: pinmux_mmc1_pins {
                 pinctrl-single,pins = <
-                        AM33XX_IOPAD(0x960, PIN_INPUT | MUX_MODE7)              /* spi0_cs1.gpio0_6 */
+                        AM33XX_IOPAD(0x96c, PIN_INPUT | MUX_MODE7)              /* uart0_rtsn.gpio1_9 */
                 >;
         };
 
@@ -280,10 +280,6 @@
                         AM33XX_IOPAD(0x834, PIN_INPUT_PULLUP | MUX_MODE7)       /* nKbdReset - gpmc_ad13.gpio1_13 */
                         AM33XX_IOPAD(0x838, PIN_INPUT_PULLUP | MUX_MODE7)       /* nDispReset - gpmc_ad14.gpio1_14 */
                         AM33XX_IOPAD(0x844, PIN_INPUT_PULLUP | MUX_MODE7)       /* USB1_enPower - gpmc_a1.gpio1_17 */
-                        /* AVR Programming - SPI Bus (bit bang) - Screen and Keyboard */
-                        AM33XX_IOPAD(0x954, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattMOSI spi0_d0.gpio0_3 */
-                        AM33XX_IOPAD(0x958, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattMISO spi0_d1.gpio0_4 */
-                        AM33XX_IOPAD(0x950, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattSCLK spi0_clk.gpio0_2 */
                         /* PDI Bus - Battery system */
                         AM33XX_IOPAD(0x840, PIN_INPUT_PULLUP | MUX_MODE7)       /* nBattReset  gpmc_a0.gpio1_16 */
                         AM33XX_IOPAD(0x83c, PIN_INPUT_PULLUP | MUX_MODE7)       /* BattPDIData gpmc_ad15.gpio1_15 */
@@ -384,7 +380,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         bus-width = <4>;
-        cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+        cd-gpios = <&gpio1 9 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&vmmcsd_fixed>;
 };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 561f27d8d922..9444a9a9ba10 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -3,6 +3,11 @@
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
 
+/* firmware-provided startup stubs live here, where the secondary CPUs are
+ * spinning.
+ */
+/memreserve/ 0x00000000 0x00001000;
+
 /* This include file covers the common peripherals and configuration between
  * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
  * bcm2835.dtsi and bcm2836.dtsi.
diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dts b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
index f18e1f1d0ce2..d2be8aa3370b 100644
--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dts
+++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
@@ -120,10 +120,16 @@
 
                 ethphy0: ethernet-phy@2 {
                         reg = <2>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET_REF>;
+                        clock-names = "rmii-ref";
                 };
 
                 ethphy1: ethernet-phy@1 {
                         reg = <1>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET2_REF>;
+                        clock-names = "rmii-ref";
                 };
         };
 };
diff --git a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
index b6f26824e83a..66f615a74118 100644
--- a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
@@ -137,8 +137,8 @@ netcp: netcp@26000000 {
         /* NetCP address range */
         ranges = <0 0x26000000 0x1000000>;
 
-        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>, <&clkosr>;
-        clock-names = "pa_clk", "ethss_clk", "cpts", "osr_clk";
+        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>;
+        clock-names = "pa_clk", "ethss_clk", "cpts";
         dma-coherent;
 
         ti,navigator-dmas = <&dma_gbe 0>,
diff --git a/arch/arm/boot/dts/keystone-k2l.dtsi b/arch/arm/boot/dts/keystone-k2l.dtsi
index b58e7ebc0919..148650406cf7 100644
--- a/arch/arm/boot/dts/keystone-k2l.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l.dtsi
@@ -232,6 +232,14 @@
                         };
                 };
 
+                osr: sram@70000000 {
+                        compatible = "mmio-sram";
+                        reg = <0x70000000 0x10000>;
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        clocks = <&clkosr>;
+                };
+
                 dspgpio0: keystone_dsp_gpio@02620240 {
                         compatible = "ti,keystone-dsp-gpio";
                         gpio-controller;
diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
index 1aeeacb3a884..d4f600dbb7eb 100644
--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
@@ -558,10 +558,11 @@
                 };
 
                 r_ccu: clock@1f01400 {
-                        compatible = "allwinner,sun50i-a64-r-ccu";
+                        compatible = "allwinner,sun8i-h3-r-ccu";
                         reg = <0x01f01400 0x100>;
-                        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-                        clock-names = "hosc", "losc", "iosc";
+                        clocks = <&osc24M>, <&osc32k>, <&iosc>,
+                                 <&ccu 9>;
+                        clock-names = "hosc", "losc", "iosc", "pll-periph";
                         #clock-cells = <1>;
                         #reset-cells = <1>;
                 };
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 33a8eb28374e..06e2331f666d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-#include <versatile-ab.dts>
+#include "versatile-ab.dts"
 
 / {
         model = "ARM Versatile PB";
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index cf062472e07b..2b913f17d50f 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -235,7 +235,7 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster)
         return ret;
 }
 
-typedef void (*phys_reset_t)(unsigned long);
+typedef typeof(cpu_reset) phys_reset_t;
 
 void mcpm_cpu_power_down(void)
 {
@@ -300,7 +300,7 @@ void mcpm_cpu_power_down(void)
          * on the CPU.
          */
         phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
 
         /* should never get here */
         BUG();
@@ -389,7 +389,7 @@ static int __init nocache_trampoline(unsigned long _arg)
         __mcpm_cpu_down(cpu, cluster);
 
         phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
         BUG();
 }
 
diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
index 36ec9c8f6e16..3234fe9bba6e 100644
--- a/arch/arm/include/asm/device.h
+++ b/arch/arm/include/asm/device.h
@@ -19,7 +19,8 @@ struct dev_archdata {
 #ifdef CONFIG_XEN
         const struct dma_map_ops *dev_dma_ops;
 #endif
-        bool dma_coherent;
+        unsigned int dma_coherent:1;
+        unsigned int dma_ops_setup:1;
 };
 
 struct omap_device;
diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h
index 302240c19a5a..a0d726a47c8a 100644
--- a/arch/arm/include/asm/pgtable-nommu.h
+++ b/arch/arm/include/asm/pgtable-nommu.h
@@ -66,6 +66,7 @@ typedef pte_t *pte_addr_t;
 #define pgprot_noncached(prot)  (prot)
 #define pgprot_writecombine(prot) (prot)
 #define pgprot_dmacoherent(prot) (prot)
+#define pgprot_device(prot)     (prot)
 
 
 /*
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 32e1a9513dc7..4e80bf7420d4 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -315,7 +315,7 @@ static void __init cacheid_init(void)
         if (arch >= CPU_ARCH_ARMv6) {
                 unsigned int cachetype = read_cpuid_cachetype();
 
-                if ((arch == CPU_ARCH_ARMv7M) && !cachetype) {
+                if ((arch == CPU_ARCH_ARMv7M) && !(cachetype & 0xf000f)) {
                         cacheid = 0;
                 } else if ((cachetype & (7 << 29)) == 4 << 29) {
                         /* ARMv7 register format */
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 570ed4a9c261..5386528665b5 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -104,7 +104,6 @@ __do_hyp_init:
         @  - Write permission implies XN: disabled
         @  - Instruction cache: enabled
         @  - Data/Unified cache: enabled
-        @  - Memory alignment checks: enabled
         @  - MMU: enabled (this code must be run from an identity mapping)
         mrc     p15, 4, r0, c1, c0, 0   @ HSCR
         ldr     r2, =HSCTLR_MASK
@@ -112,8 +111,8 @@ __do_hyp_init:
         mrc     p15, 0, r1, c1, c0, 0   @ SCTLR
         ldr     r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C)
         and     r1, r1, r2
- ARM(   ldr     r2, =(HSCTLR_M | HSCTLR_A)                      )
- THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE)          )
+ ARM(   ldr     r2, =(HSCTLR_M)                                 )
+ THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_TE)                     )
         orr     r1, r1, r2
         orr     r0, r0, r1
         mcr     p15, 4, r0, c1, c0, 0   @ HSCR
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 841e924143f9..cbd959b73654 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,6 +1,7 @@
 menuconfig ARCH_AT91
         bool "Atmel SoCs"
         depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7
+        select ARM_CPU_SUSPEND if PM
         select COMMON_CLK_AT91
         select GPIOLIB
         select PINCTRL
diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c
index efb80354f303..b5cc05dc2cb2 100644
--- a/arch/arm/mach-davinci/pm.c
+++ b/arch/arm/mach-davinci/pm.c
@@ -153,7 +153,8 @@ int __init davinci_pm_init(void)
         davinci_sram_suspend = sram_alloc(davinci_cpu_suspend_sz, NULL);
         if (!davinci_sram_suspend) {
                 pr_err("PM: cannot allocate SRAM memory\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto no_sram_mem;
         }
 
         davinci_sram_push(davinci_sram_suspend, davinci_cpu_suspend,
@@ -161,6 +162,10 @@ int __init davinci_pm_init(void)
 
         suspend_set_ops(&davinci_pm_ops);
 
+        return 0;
+
+no_sram_mem:
+        iounmap(pm_config.ddrpsc_reg_base);
 no_ddrpsc_mem:
         iounmap(pm_config.ddrpll_reg_base);
 no_ddrpll_mem:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c742dfd2967b..bd83c531828a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2311,7 +2311,14 @@ int arm_iommu_attach_device(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
 
-static void __arm_iommu_detach_device(struct device *dev)
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
 {
         struct dma_iommu_mapping *mapping;
 
@@ -2324,22 +2331,10 @@ static void __arm_iommu_detach_device(struct device *dev)
         iommu_detach_device(mapping->domain, dev);
         kref_put(&mapping->kref, release_iommu_mapping);
         to_dma_iommu_mapping(dev) = NULL;
+        set_dma_ops(dev, NULL);
 
         pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
-
-/**
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- * This voids the dma operations (dma_map_ops pointer)
- */
-void arm_iommu_detach_device(struct device *dev)
-{
-        __arm_iommu_detach_device(dev);
-        set_dma_ops(dev, NULL);
-}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 
 static const struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2379,7 +2374,7 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
         if (!mapping)
                 return;
 
-        __arm_iommu_detach_device(dev);
+        arm_iommu_detach_device(dev);
         arm_iommu_release_mapping(mapping);
 }
 
@@ -2430,9 +2425,13 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                 dev->dma_ops = xen_dma_ops;
         }
 #endif
+        dev->archdata.dma_ops_setup = true;
 }
 
 void arch_teardown_dma_ops(struct device *dev)
 {
+        if (!dev->archdata.dma_ops_setup)
+                return;
+
         arm_teardown_iommu_dma_ops(dev);
 }
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 2239fde10b80..f0701d8d24df 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -90,7 +90,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -141,7 +141,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 31af3cb59a60..e46a6a446cdd 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1218,15 +1218,15 @@ void __init adjust_lowmem_bounds(void)
 
         high_memory = __va(arm_lowmem_limit - 1) + 1;
 
+        if (!memblock_limit)
+                memblock_limit = arm_lowmem_limit;
+
         /*
          * Round the memblock limit down to a pmd size.  This
          * helps to ensure that we will allocate memory from the
          * last full pmd, which should be mapped.
          */
-        if (memblock_limit)
-                memblock_limit = round_down(memblock_limit, PMD_SIZE);
-        if (!memblock_limit)
-                memblock_limit = arm_lowmem_limit;
+        memblock_limit = round_down(memblock_limit, PMD_SIZE);
 
         if (!IS_ENABLED(CONFIG_HIGHMEM) || cache_is_vipt_aliasing()) {
                 if (memblock_end_of_DRAM() > arm_lowmem_limit) {
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 3dcd7ec69bca..b2024db225a9 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1084,10 +1084,6 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y
-        depends on COMPAT && KEYS
-
 endmenu
 
 menu "Power management options"
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index c7f669f5884f..166c9ef884dc 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -406,8 +406,9 @@
                 r_ccu: clock@1f01400 {
                         compatible = "allwinner,sun50i-a64-r-ccu";
                         reg = <0x01f01400 0x100>;
-                        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-                        clock-names = "hosc", "losc", "iosc";
+                        clocks = <&osc24M>, <&osc32k>, <&iosc>,
+                                 <&ccu 11>;
+                        clock-names = "hosc", "losc", "iosc", "pll-periph";
                         #clock-cells = <1>;
                         #reset-cells = <1>;
                 };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 4d314a253fd9..732e2e06f503 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -40,7 +40,7 @@
  *     OTHER DEALINGS IN THE SOFTWARE.
  */
 
-#include "sunxi-h3-h5.dtsi"
+#include <arm/sunxi-h3-h5.dtsi>
 
 / {
         cpus {
diff --git a/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi b/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi
deleted file mode 120000
index 036f01dc2b9b..000000000000
--- a/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm/boot/dts/sunxi-h3-h5.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index 75bce2d0b1a8..49f6a6242cf9 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -81,6 +81,45 @@
                 };
         };
 
+        reg_sys_5v: regulator@0 {
+                compatible = "regulator-fixed";
+                regulator-name = "SYS_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                regulator-always-on;
+        };
+
+        reg_vdd_3v3: regulator@1 {
+                compatible = "regulator-fixed";
+                regulator-name = "VDD_3V3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                regulator-boot-on;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        reg_5v_hub: regulator@2 {
+                compatible = "regulator-fixed";
+                regulator-name = "5V_HUB";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                gpio = <&gpio0 7 0>;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        wl1835_pwrseq: wl1835-pwrseq {
+                compatible = "mmc-pwrseq-simple";
+                /* WLAN_EN GPIO */
+                reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+                clocks = <&pmic>;
+                clock-names = "ext_clock";
+                power-off-delay-us = <10>;
+        };
+
         soc {
                 spi0: spi@f7106000 {
                         status = "ok";
@@ -256,11 +295,31 @@
 
                 /* GPIO blocks 16 thru 19 do not appear to be routed to pins */
 
+                dwmmc_0: dwmmc0@f723d000 {
+                        cap-mmc-highspeed;
+                        non-removable;
+                        bus-width = <0x8>;
+                        vmmc-supply = <&ldo19>;
+                };
+
+                dwmmc_1: dwmmc1@f723e000 {
+                        card-detect-delay = <200>;
+                        cap-sd-highspeed;
+                        sd-uhs-sdr12;
+                        sd-uhs-sdr25;
+                        sd-uhs-sdr50;
+                        vqmmc-supply = <&ldo7>;
+                        vmmc-supply = <&ldo10>;
+                        bus-width = <0x4>;
+                        disable-wp;
+                        cd-gpios = <&gpio1 0 1>;
+                };
+
                 dwmmc_2: dwmmc2@f723f000 {
-                        ti,non-removable;
+                        bus-width = <0x4>;
                         non-removable;
-                        /* WL_EN */
-                        vmmc-supply = <&wlan_en_reg>;
+                        vmmc-supply = <&reg_vdd_3v3>;
+                        mmc-pwrseq = <&wl1835_pwrseq>;
 
                         #address-cells = <0x1>;
                         #size-cells = <0x0>;
@@ -272,18 +331,6 @@
                                 interrupts = <3 IRQ_TYPE_EDGE_RISING>;
                         };
                 };
-
-                wlan_en_reg: regulator@1 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "wlan-en-regulator";
-                        regulator-min-microvolt = <1800000>;
-                        regulator-max-microvolt = <1800000>;
-                        /* WLAN_EN GPIO */
-                        gpio = <&gpio0 5 0>;
-                        /* WLAN card specific delay */
-                        startup-delay-us = <70000>;
-                        enable-active-high;
-                };
         };
 
         leds {
@@ -330,6 +377,7 @@
         pmic: pmic@f8000000 {
                 compatible = "hisilicon,hi655x-pmic";
                 reg = <0x0 0xf8000000 0x0 0x1000>;
+                #clock-cells = <0>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
index 1e5129b19280..5013e4b2ea71 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
@@ -725,20 +725,10 @@
                         status = "disabled";
                 };
 
-                fixed_5v_hub: regulator@0 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "fixed_5v_hub";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        regulator-boot-on;
-                        gpio = <&gpio0 7 0>;
-                        regulator-always-on;
-                };
-
                 usb_phy: usbphy {
                         compatible = "hisilicon,hi6220-usb-phy";
                         #phy-cells = <0>;
-                        phy-supply = <&fixed_5v_hub>;
+                        phy-supply = <&reg_5v_hub>;
                         hisilicon,peripheral-syscon = <&sys_ctrl>;
                 };
 
@@ -766,17 +756,12 @@
 
                 dwmmc_0: dwmmc0@f723d000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        cap-mmc-highspeed;
-                        non-removable;
                         reg = <0x0 0xf723d000 0x0 0x1000>;
                         interrupts = <0x0 0x48 0x4>;
                         clocks = <&sys_ctrl 2>, <&sys_ctrl 1>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC0>;
                         reset-names = "reset";
-                        bus-width = <0x8>;
-                        vmmc-supply = <&ldo19>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&emmc_pmx_func &emmc_clk_cfg_func
                                      &emmc_cfg_func &emmc_rst_cfg_func>;
@@ -784,13 +769,7 @@
 
                 dwmmc_1: dwmmc1@f723e000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        card-detect-delay = <200>;
                         hisilicon,peripheral-syscon = <&ao_ctrl>;
-                        cap-sd-highspeed;
-                        sd-uhs-sdr12;
-                        sd-uhs-sdr25;
-                        sd-uhs-sdr50;
                         reg = <0x0 0xf723e000 0x0 0x1000>;
                         interrupts = <0x0 0x49 0x4>;
                         #address-cells = <0x1>;
@@ -799,11 +778,6 @@
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC1>;
                         reset-names = "reset";
-                        vqmmc-supply = <&ldo7>;
-                        vmmc-supply = <&ldo10>;
-                        bus-width = <0x4>;
-                        disable-wp;
-                        cd-gpios = <&gpio1 0 1>;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sd_pmx_func &sd_clk_cfg_func &sd_cfg_func>;
                         pinctrl-1 = <&sd_pmx_idle &sd_clk_cfg_idle &sd_cfg_idle>;
@@ -811,15 +785,12 @@
 
                 dwmmc_2: dwmmc2@f723f000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
                         reg = <0x0 0xf723f000 0x0 0x1000>;
                         interrupts = <0x0 0x4a 0x4>;
                         clocks = <&sys_ctrl HI6220_MMC2_CIUCLK>, <&sys_ctrl HI6220_MMC2_CLK>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC2>;
                         reset-names = "reset";
-                        bus-width = <0x4>;
-                        broken-cd;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sdio_pmx_func &sdio_clk_cfg_func &sdio_cfg_func>;
                         pinctrl-1 = <&sdio_pmx_idle &sdio_clk_cfg_idle &sdio_cfg_idle>;
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index ac8df5201cd6..b4bc42ece754 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -231,8 +231,7 @@
                         cpm_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index 7740a75a8230..6e2058847ddc 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -221,8 +221,7 @@
                         cps_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 278 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 65cdd878cfbd..97c123e09e45 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -68,6 +68,7 @@ CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
 CONFIG_PCI_AARDVARK=y
 CONFIG_PCIE_RCAR=y
+CONFIG_PCIE_ROCKCHIP=m
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
@@ -208,6 +209,8 @@ CONFIG_BRCMFMAC=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SDIO=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_PM8941_PWRKEY=y
@@ -263,6 +266,7 @@ CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
+CONFIG_SPI_ROCKCHIP=y
 CONFIG_SPI_S3C64XX=y
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
@@ -292,6 +296,7 @@ CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
+CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
@@ -300,12 +305,14 @@ CONFIG_RENESAS_WDT=y
 CONFIG_BCM2835_WDT=y
 CONFIG_MFD_CROS_EC=y
 CONFIG_MFD_CROS_EC_I2C=y
+CONFIG_MFD_CROS_EC_SPI=y
 CONFIG_MFD_EXYNOS_LPASS=m
 CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
+CONFIG_REGULATOR_FAN53555=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -473,8 +480,10 @@ CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_EXYNOS_ADC=y
+CONFIG_ROCKCHIP_SARADC=m
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_CROS_EC=m
 CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_PWM_SAMSUNG=y
@@ -484,6 +493,7 @@ CONFIG_PHY_HI6220_USB=y
 CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_PCIE=m
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
index 0e99978da3f0..59cca1d6ec54 100644
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -23,9 +23,9 @@
 #define ACPI_MADT_GICC_LENGTH   \
         (acpi_gbl_FADT.header.revision < 6 ? 76 : 80)
 
-#define BAD_MADT_GICC_ENTRY(entry, end)                                         \
-        (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) ||       \
-         (entry)->header.length != ACPI_MADT_GICC_LENGTH)
+#define BAD_MADT_GICC_ENTRY(entry, end)                                 \
+        (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \
+        (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end))
 
 /* Basic configuration for ACPI */
 #ifdef  CONFIG_ACPI
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 15c142ce991c..b4d13d9267ff 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -286,6 +286,10 @@
 #define SCTLR_ELx_A     (1 << 1)
 #define SCTLR_ELx_M     1
 
+#define SCTLR_EL2_RES1  ((1 << 4)  | (1 << 5)  | (1 << 11) | (1 << 16) | \
+                         (1 << 16) | (1 << 18) | (1 << 22) | (1 << 23) | \
+                         (1 << 28) | (1 << 29))
+
 #define SCTLR_ELx_FLAGS (SCTLR_ELx_M | SCTLR_ELx_A | SCTLR_ELx_C | \
                          SCTLR_ELx_SA | SCTLR_ELx_I)
 
diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
index 4f0e3ebfea4b..c7e3e6387a49 100644
--- a/arch/arm64/kernel/pci.c
+++ b/arch/arm64/kernel/pci.c
@@ -191,8 +191,10 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
                 return NULL;
 
         root_ops = kzalloc_node(sizeof(*root_ops), GFP_KERNEL, node);
-        if (!root_ops)
+        if (!root_ops) {
+                kfree(ri);
                 return NULL;
+        }
 
         ri->cfg = pci_acpi_setup_ecam_mapping(root);
         if (!ri->cfg) {
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 41b6e31f8f55..d0cb007fa482 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -221,10 +221,11 @@ void update_vsyscall(struct timekeeper *tk)
                 /* tkr_mono.cycle_last == tkr_raw.cycle_last */
                 vdso_data->cs_cycle_last        = tk->tkr_mono.cycle_last;
                 vdso_data->raw_time_sec         = tk->raw_time.tv_sec;
-                vdso_data->raw_time_nsec        = tk->raw_time.tv_nsec;
+                vdso_data->raw_time_nsec        = (tk->raw_time.tv_nsec <<
+                                                   tk->tkr_raw.shift) +
+                                                  tk->tkr_raw.xtime_nsec;
                 vdso_data->xtime_clock_sec      = tk->xtime_sec;
                 vdso_data->xtime_clock_nsec     = tk->tkr_mono.xtime_nsec;
-                /* tkr_raw.xtime_nsec == 0 */
                 vdso_data->cs_mono_mult         = tk->tkr_mono.mult;
                 vdso_data->cs_raw_mult          = tk->tkr_raw.mult;
                 /* tkr_mono.shift == tkr_raw.shift */
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index e00b4671bd7c..76320e920965 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -256,7 +256,6 @@ monotonic_raw:
         seqcnt_check fail=monotonic_raw
 
         /* All computations are done with left-shifted nsecs. */
-        lsl     x14, x14, x12
         get_nsec_per_sec res=x9
         lsl     x9, x9, x12
 
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index 839425c24b1c..3f9615582377 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -106,10 +106,13 @@ __do_hyp_init:
         tlbi    alle2
         dsb     sy
 
-        mrs     x4, sctlr_el2
-        and     x4, x4, #SCTLR_ELx_EE   // preserve endianness of EL2
-        ldr     x5, =SCTLR_ELx_FLAGS
-        orr     x4, x4, x5
+        /*
+         * Preserve all the RES1 bits while setting the default flags,
+         * as well as the EE bit on BE. Drop the A flag since the compiler
+         * is allowed to generate unaligned accesses.
+         */
+        ldr     x4, =(SCTLR_EL2_RES1 | (SCTLR_ELx_FLAGS & ~SCTLR_ELx_A))
+CPU_BE( orr     x4, x4, #SCTLR_ELx_EE)
         msr     sctlr_el2, x4
         isb
 
diff --git a/arch/arm64/kvm/vgic-sys-reg-v3.c b/arch/arm64/kvm/vgic-sys-reg-v3.c
index 79f37e37d367..6260b69e5622 100644
--- a/arch/arm64/kvm/vgic-sys-reg-v3.c
+++ b/arch/arm64/kvm/vgic-sys-reg-v3.c
@@ -65,8 +65,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * Here set VMCR.CTLR in ICC_CTLR_EL1 layout.
                  * The vgic_set_vmcr() will convert to ICH_VMCR layout.
                  */
-                vmcr.ctlr = val & ICC_CTLR_EL1_CBPR_MASK;
-                vmcr.ctlr |= val & ICC_CTLR_EL1_EOImode_MASK;
+                vmcr.cbpr = (val & ICC_CTLR_EL1_CBPR_MASK) >> ICC_CTLR_EL1_CBPR_SHIFT;
+                vmcr.eoim = (val & ICC_CTLR_EL1_EOImode_MASK) >> ICC_CTLR_EL1_EOImode_SHIFT;
                 vgic_set_vmcr(vcpu, &vmcr);
         } else {
                 val = 0;
@@ -83,8 +83,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * The VMCR.CTLR value is in ICC_CTLR_EL1 layout.
                  * Extract it directly using ICC_CTLR_EL1 reg definitions.
                  */
-                val |= vmcr.ctlr & ICC_CTLR_EL1_CBPR_MASK;
-                val |= vmcr.ctlr & ICC_CTLR_EL1_EOImode_MASK;
+                val |= (vmcr.cbpr << ICC_CTLR_EL1_CBPR_SHIFT) & ICC_CTLR_EL1_CBPR_MASK;
+                val |= (vmcr.eoim << ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
 
                 p->regval = val;
         }
@@ -135,7 +135,7 @@ static bool access_gic_bpr1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                 p->regval = 0;
 
         vgic_get_vmcr(vcpu, &vmcr);
-        if (!((vmcr.ctlr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT)) {
+        if (!vmcr.cbpr) {
                 if (p->is_write) {
                         vmcr.abpr = (p->regval & ICC_BPR1_EL1_MASK) >>
                                      ICC_BPR1_EL1_SHIFT;
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 71f930501ade..c870d6f01ac2 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -36,6 +36,7 @@ int bpf_jit_enable __read_mostly;
 #define TMP_REG_1 (MAX_BPF_JIT_REG + 0)
 #define TMP_REG_2 (MAX_BPF_JIT_REG + 1)
 #define TCALL_CNT (MAX_BPF_JIT_REG + 2)
+#define TMP_REG_3 (MAX_BPF_JIT_REG + 3)
 
 /* Map BPF registers to A64 registers */
 static const int bpf2a64[] = {
@@ -57,6 +58,7 @@ static const int bpf2a64[] = {
         /* temporary registers for internal BPF JIT */
         [TMP_REG_1] = A64_R(10),
         [TMP_REG_2] = A64_R(11),
+        [TMP_REG_3] = A64_R(12),
         /* tail_call_cnt */
         [TCALL_CNT] = A64_R(26),
         /* temporary register for blinding constants */
@@ -319,6 +321,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
         const u8 src = bpf2a64[insn->src_reg];
         const u8 tmp = bpf2a64[TMP_REG_1];
         const u8 tmp2 = bpf2a64[TMP_REG_2];
+        const u8 tmp3 = bpf2a64[TMP_REG_3];
         const s16 off = insn->off;
         const s32 imm = insn->imm;
         const int i = insn - ctx->prog->insnsi;
@@ -689,10 +692,10 @@ emit_cond_jmp:
                 emit(A64_PRFM(tmp, PST, L1, STRM), ctx);
                 emit(A64_LDXR(isdw, tmp2, tmp), ctx);
                 emit(A64_ADD(isdw, tmp2, tmp2, src), ctx);
-                emit(A64_STXR(isdw, tmp2, tmp, tmp2), ctx);
+                emit(A64_STXR(isdw, tmp2, tmp, tmp3), ctx);
                 jmp_offset = -3;
                 check_imm19(jmp_offset);
-                emit(A64_CBNZ(0, tmp2, jmp_offset), ctx);
+                emit(A64_CBNZ(0, tmp3, jmp_offset), ctx);
                 break;
 
         /* R0 = ntohx(*(size *)(((struct sk_buff *)R6)->data + imm)) */
diff --git a/arch/blackfin/include/asm/processor.h b/arch/blackfin/include/asm/processor.h
index 85d4af97c986..dbdbb8a558df 100644
--- a/arch/blackfin/include/asm/processor.h
+++ b/arch/blackfin/include/asm/processor.h
@@ -75,11 +75,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-/*
- * Return saved PC of a blocked thread.
- */
-#define thread_saved_pc(tsk)    (tsk->thread.pc)
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)                                                   \
diff --git a/arch/c6x/include/asm/processor.h b/arch/c6x/include/asm/processor.h
index b9eb3da7f278..7c87b5be53b5 100644
--- a/arch/c6x/include/asm/processor.h
+++ b/arch/c6x/include/asm/processor.h
@@ -96,11 +96,6 @@ static inline void release_thread(struct task_struct *dead_task)
 #define release_segments(mm)            do { } while (0)
 
 /*
- * saved PC of a blocked thread.
- */
-#define thread_saved_pc(tsk) (task_pt_regs(tsk)->pc)
-
-/*
  * saved kernel SP and DP of a blocked thread.
  */
 #ifdef _BIG_ENDIAN
diff --git a/arch/cris/arch-v10/kernel/process.c b/arch/cris/arch-v10/kernel/process.c
index e299d30105b5..a2cdb1521aca 100644
--- a/arch/cris/arch-v10/kernel/process.c
+++ b/arch/cris/arch-v10/kernel/process.c
@@ -69,14 +69,6 @@ void hard_reset_now (void)
         while(1) /* waiting for RETRIBUTION! */ ;
 }
 
-/*
- * Return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        return task_pt_regs(t)->irp;
-}
-
 /* setup the child's kernel stack with a pt_regs and switch_stack on it.
  * it will be un-nested during _resume and _ret_from_sys_call when the
  * new thread is scheduled.
diff --git a/arch/cris/arch-v32/kernel/process.c b/arch/cris/arch-v32/kernel/process.c
index c530a8fa87ce..fe87b383fbf3 100644
--- a/arch/cris/arch-v32/kernel/process.c
+++ b/arch/cris/arch-v32/kernel/process.c
@@ -85,14 +85,6 @@ hard_reset_now(void)
 }
 
 /*
- * Return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        return task_pt_regs(t)->erp;
-}
-
-/*
  * Setup the child's kernel stack with a pt_regs and call switch_stack() on it.
  * It will be unnested during _resume and _ret_from_sys_call when the new thread
  * is scheduled.
diff --git a/arch/cris/include/asm/processor.h b/arch/cris/include/asm/processor.h
index 15b815df29c1..bc2729e4b2c9 100644
--- a/arch/cris/include/asm/processor.h
+++ b/arch/cris/include/asm/processor.h
@@ -52,8 +52,6 @@ unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_ESP(tsk)   ((tsk) == current ? rdusp() : (tsk)->thread.usp)
 
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 /* Free all resources held by a thread. */
 static inline void release_thread(struct task_struct *dead_task)
 {
diff --git a/arch/frv/include/asm/processor.h b/arch/frv/include/asm/processor.h
index ddaeb9cc9143..e4d08d74ed9f 100644
--- a/arch/frv/include/asm/processor.h
+++ b/arch/frv/include/asm/processor.h
@@ -96,11 +96,6 @@ extern asmlinkage void *restore_user_regs(const struct user_context *target, ...
 #define release_segments(mm)            do { } while (0)
 #define forget_segments()               do { } while (0)
 
-/*
- * Return saved PC of a blocked thread.
- */
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)   ((tsk)->thread.frame0->pc)
diff --git a/arch/frv/include/asm/timex.h b/arch/frv/include/asm/timex.h
index a89bddefdacf..139093fab326 100644
--- a/arch/frv/include/asm/timex.h
+++ b/arch/frv/include/asm/timex.h
@@ -16,5 +16,11 @@ static inline cycles_t get_cycles(void)
 #define vxtime_lock()           do {} while (0)
 #define vxtime_unlock()         do {} while (0)
 
+/* This attribute is used in include/linux/jiffies.h alongside with
+ * __cacheline_aligned_in_smp. It is assumed that __cacheline_aligned_in_smp
+ * for frv does not contain another section specification.
+ */
+#define __jiffy_arch_data       __attribute__((__section__(".data")))
+
 #endif
 
diff --git a/arch/frv/kernel/process.c b/arch/frv/kernel/process.c
index 5a4c92abc99e..a957b374e3a6 100644
--- a/arch/frv/kernel/process.c
+++ b/arch/frv/kernel/process.c
@@ -198,15 +198,6 @@ unsigned long get_wchan(struct task_struct *p)
         return 0;
 }
 
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        /* Check whether the thread is blocked in resume() */
-        if (in_sched_functions(tsk->thread.pc))
-                return ((unsigned long *)tsk->thread.fp)[2];
-        else
-                return tsk->thread.pc;
-}
-
 int elf_check_arch(const struct elf32_hdr *hdr)
 {
         unsigned long hsr0 = __get_HSR(0);
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
index da82c25301e7..46aa289c5102 100644
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(current->mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         goto success;
         }
 
diff --git a/arch/h8300/include/asm/processor.h b/arch/h8300/include/asm/processor.h
index 65132d7ae9e5..afa53147e66a 100644
--- a/arch/h8300/include/asm/processor.h
+++ b/arch/h8300/include/asm/processor.h
@@ -110,10 +110,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-/*
- * Return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk);
 unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)   \
diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c
index 0f5db5bb561b..d1ddcabbbe83 100644
--- a/arch/h8300/kernel/process.c
+++ b/arch/h8300/kernel/process.c
@@ -129,11 +129,6 @@ int copy_thread(unsigned long clone_flags,
         return 0;
 }
 
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return ((struct pt_regs *)tsk->thread.esp0)->pc;
-}
-
 unsigned long get_wchan(struct task_struct *p)
 {
         unsigned long fp, pc;
diff --git a/arch/hexagon/include/asm/processor.h b/arch/hexagon/include/asm/processor.h
index 45a825402f63..ce67940860a5 100644
--- a/arch/hexagon/include/asm/processor.h
+++ b/arch/hexagon/include/asm/processor.h
@@ -33,9 +33,6 @@
 /*  task_struct, defined elsewhere, is the "process descriptor" */
 struct task_struct;
 
-/*  this is defined in arch/process.c  */
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 extern void start_thread(struct pt_regs *, unsigned long, unsigned long);
 
 /*
diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
index de715bab7956..656050c2e6a0 100644
--- a/arch/hexagon/kernel/process.c
+++ b/arch/hexagon/kernel/process.c
@@ -61,14 +61,6 @@ void arch_cpu_idle(void)
 }
 
 /*
- *  Return saved PC of a blocked thread
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return 0;
-}
-
-/*
  * Copy architecture-specific thread state
  */
 int copy_thread(unsigned long clone_flags, unsigned long usp,
diff --git a/arch/hexagon/mm/uaccess.c b/arch/hexagon/mm/uaccess.c
index ec90afdb3ad0..c599eb126c9e 100644
--- a/arch/hexagon/mm/uaccess.c
+++ b/arch/hexagon/mm/uaccess.c
@@ -37,15 +37,14 @@ __kernel_size_t __clear_user_hexagon(void __user *dest, unsigned long count)
         long uncleared;
 
         while (count > PAGE_SIZE) {
-                uncleared = __copy_to_user_hexagon(dest, &empty_zero_page,
-                                                PAGE_SIZE);
+                uncleared = raw_copy_to_user(dest, &empty_zero_page, PAGE_SIZE);
                 if (uncleared)
                         return count - (PAGE_SIZE - uncleared);
                 count -= PAGE_SIZE;
                 dest += PAGE_SIZE;
         }
         if (count)
-                count = __copy_to_user_hexagon(dest, &empty_zero_page, count);
+                count = raw_copy_to_user(dest, &empty_zero_page, count);
 
         return count;
 }
diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
index 26a63d69c599..ab982f07ea68 100644
--- a/arch/ia64/include/asm/processor.h
+++ b/arch/ia64/include/asm/processor.h
@@ -602,23 +602,6 @@ ia64_set_unat (__u64 *unat, void *spill_addr, unsigned long nat)
 }
 
 /*
- * Return saved PC of a blocked thread.
- * Note that the only way T can block is through a call to schedule() -> switch_to().
- */
-static inline unsigned long
-thread_saved_pc (struct task_struct *t)
-{
-        struct unw_frame_info info;
-        unsigned long ip;
-
-        unw_init_from_blocked_task(&info, t);
-        if (unw_unwind(&info) < 0)
-                return 0;
-        unw_get_ip(&info, &ip);
-        return ip;
-}
-
-/*
  * Get the current instruction/program counter value.
  */
 #define current_text_addr() \
diff --git a/arch/m32r/include/asm/processor.h b/arch/m32r/include/asm/processor.h
index 5767367550c6..657874eeeccc 100644
--- a/arch/m32r/include/asm/processor.h
+++ b/arch/m32r/include/asm/processor.h
@@ -122,8 +122,6 @@ extern void release_thread(struct task_struct *);
 extern void copy_segments(struct task_struct *p, struct mm_struct * mm);
 extern void release_segments(struct mm_struct * mm);
 
-extern unsigned long thread_saved_pc(struct task_struct *);
-
 /* Copy and release all segment info associated with a VM */
 #define copy_segments(p, mm)  do { } while (0)
 #define release_segments(mm)  do { } while (0)
diff --git a/arch/m32r/kernel/process.c b/arch/m32r/kernel/process.c
index d8ffcfec599c..8cd7e03f4370 100644
--- a/arch/m32r/kernel/process.c
+++ b/arch/m32r/kernel/process.c
@@ -39,14 +39,6 @@
 
 #include <linux/err.h>
 
-/*
- * Return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return tsk->thread.lr;
-}
-
 void (*pm_power_off)(void) = NULL;
 EXPORT_SYMBOL(pm_power_off);
 
diff --git a/arch/m68k/include/asm/processor.h b/arch/m68k/include/asm/processor.h
index 77239e81379b..94c36030440c 100644
--- a/arch/m68k/include/asm/processor.h
+++ b/arch/m68k/include/asm/processor.h
@@ -130,8 +130,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)   \
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index e475c945c8b2..7df92f8b0781 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -40,20 +40,6 @@
 asmlinkage void ret_from_fork(void);
 asmlinkage void ret_from_kernel_thread(void);
 
-
-/*
- * Return saved PC from a blocked thread
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        struct switch_stack *sw = (struct switch_stack *)tsk->thread.ksp;
-        /* Check whether the thread is blocked in resume() */
-        if (in_sched_functions(sw->retpc))
-                return ((unsigned long *)sw->a6)[1];
-        else
-                return sw->retpc;
-}
-
 void arch_cpu_idle(void)
 {
 #if defined(MACH_ATARI_ONLY)
diff --git a/arch/microblaze/include/asm/processor.h b/arch/microblaze/include/asm/processor.h
index 37ef196e4519..330d556860ba 100644
--- a/arch/microblaze/include/asm/processor.h
+++ b/arch/microblaze/include/asm/processor.h
@@ -69,8 +69,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-extern unsigned long thread_saved_pc(struct task_struct *t);
-
 extern unsigned long get_wchan(struct task_struct *p);
 
 # define KSTK_EIP(tsk)  (0)
@@ -121,10 +119,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-/* Return saved (kernel) PC of a blocked thread.  */
-#  define thread_saved_pc(tsk)  \
-        ((tsk)->thread.regs ? (tsk)->thread.regs->r15 : 0)
-
 unsigned long get_wchan(struct task_struct *p);
 
 /* The size allocated for kernel stacks. This _must_ be a power of two! */
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index e92a817e645f..6527ec22f158 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -119,23 +119,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
         return 0;
 }
 
-#ifndef CONFIG_MMU
-/*
- * Return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        struct cpu_context *ctx =
-                &(((struct thread_info *)(tsk->stack))->cpu_context);
-
-        /* Check whether the thread is blocked in resume() */
-        if (in_sched_functions(ctx->r15))
-                return (unsigned long)ctx->r15;
-        else
-                return ctx->r14;
-}
-#endif
-
 unsigned long get_wchan(struct task_struct *p)
 {
 /* TBD (used by procfs) */
diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
index 2728a9a9c7c5..145b5ce8eb7e 100644
--- a/arch/mips/boot/Makefile
+++ b/arch/mips/boot/Makefile
@@ -128,19 +128,19 @@ quiet_cmd_cpp_its_S = ITS     $@
                         -DADDR_BITS=$(ADDR_BITS) \
                         -DADDR_CELLS=$(itb_addr_cells)
 
-$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,none,vmlinux.bin)
 
-$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,gzip,vmlinux.bin.gz)
 
-$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX)  FORCE
         $(call if_changed_dep,cpp_its_S,bzip2,vmlinux.bin.bz2)
 
-$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,lzma,vmlinux.bin.lzma)
 
-$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,lzo,vmlinux.bin.lzo)
 
 quiet_cmd_itb-image = ITB     $@
diff --git a/arch/mips/include/asm/highmem.h b/arch/mips/include/asm/highmem.h
index d34536e7653f..279b6d14ffeb 100644
--- a/arch/mips/include/asm/highmem.h
+++ b/arch/mips/include/asm/highmem.h
@@ -35,7 +35,12 @@ extern pte_t *pkmap_page_table;
  * easily, subsequent pte tables have to be allocated in one physical
  * chunk of RAM.
  */
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define LAST_PKMAP 512
+#else
 #define LAST_PKMAP 1024
+#endif
+
 #define LAST_PKMAP_MASK (LAST_PKMAP-1)
 #define PKMAP_NR(virt)  ((virt-PKMAP_BASE) >> PAGE_SHIFT)
 #define PKMAP_ADDR(nr)  (PKMAP_BASE + ((nr) << PAGE_SHIFT))
diff --git a/arch/mips/include/asm/kprobes.h b/arch/mips/include/asm/kprobes.h
index 291846d9ba83..ad1a99948f27 100644
--- a/arch/mips/include/asm/kprobes.h
+++ b/arch/mips/include/asm/kprobes.h
@@ -43,7 +43,8 @@ typedef union mips_instruction kprobe_opcode_t;
 
 #define flush_insn_slot(p)                                              \
 do {                                                                    \
-        flush_icache_range((unsigned long)p->addr,                      \
+        if (p->addr)                                                    \
+                flush_icache_range((unsigned long)p->addr,              \
                            (unsigned long)p->addr +                     \
                            (MAX_INSN_SIZE * sizeof(kprobe_opcode_t)));  \
 } while (0)
diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
index 6f94bed571c4..74afe8c76bdd 100644
--- a/arch/mips/include/asm/pgtable-32.h
+++ b/arch/mips/include/asm/pgtable-32.h
@@ -19,6 +19,10 @@
 #define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
+#ifdef CONFIG_HIGHMEM
+#include <asm/highmem.h>
+#endif
+
 extern int temp_tlb_entry;
 
 /*
@@ -62,7 +66,8 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 
 #define VMALLOC_START     MAP_BASE
 
-#define PKMAP_BASE              (0xfe000000UL)
+#define PKMAP_END       ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1))
+#define PKMAP_BASE      (PKMAP_END - PAGE_SIZE * LAST_PKMAP)
 
 #ifdef CONFIG_HIGHMEM
 # define VMALLOC_END    (PKMAP_BASE-2*PAGE_SIZE)
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index b11facd11c9d..f702a459a830 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -804,8 +804,10 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                         break;
                 }
                 /* Compact branch: BNEZC || JIALC */
-                if (insn.i_format.rs)
+                if (!insn.i_format.rs) {
+                        /* JIALC: set $31/ra */
                         regs->regs[31] = epc + 4;
+                }
                 regs->cp0_epc += 8;
                 break;
 #endif
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 8d83fc2a96b7..38a302919e6b 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -11,6 +11,7 @@
 #include <asm/asm.h>
 #include <asm/asmmacro.h>
 #include <asm/compiler.h>
+#include <asm/irqflags.h>
 #include <asm/regdef.h>
 #include <asm/mipsregs.h>
 #include <asm/stackframe.h>
@@ -119,6 +120,7 @@ work_pending:
         andi    t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS
         beqz    t0, work_notifysig
 work_resched:
+        TRACE_IRQS_OFF
         jal     schedule
 
         local_irq_disable               # make sure need_resched and
@@ -155,6 +157,7 @@ syscall_exit_work:
         beqz    t0, work_pending        # trace bit set?
         local_irq_enable                # could let syscall_trace_leave()
                                         # call schedule() instead
+        TRACE_IRQS_ON
         move    a0, sp
         jal     syscall_trace_leave
         b       resume_userspace
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 30a3b75e88eb..9d9b8fbae202 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -38,20 +38,6 @@ void arch_ftrace_update_code(int command)
 
 #endif
 
-/*
- * Check if the address is in kernel space
- *
- * Clone core_kernel_text() from kernel/extable.c, but doesn't call
- * init_kernel_text() for Ftrace doesn't trace functions in init sections.
- */
-static inline int in_kernel_space(unsigned long ip)
-{
-        if (ip >= (unsigned long)_stext &&
-            ip <= (unsigned long)_etext)
-                return 1;
-        return 0;
-}
-
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
@@ -198,7 +184,7 @@ int ftrace_make_nop(struct module *mod,
          * If ip is in kernel space, no long call, otherwise, long call is
          * needed.
          */
-        new = in_kernel_space(ip) ? INSN_NOP : INSN_B_1F;
+        new = core_kernel_text(ip) ? INSN_NOP : INSN_B_1F;
 #ifdef CONFIG_64BIT
         return ftrace_modify_code(ip, new);
 #else
@@ -218,12 +204,12 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
         unsigned int new;
         unsigned long ip = rec->ip;
 
-        new = in_kernel_space(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
+        new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
 
 #ifdef CONFIG_64BIT
         return ftrace_modify_code(ip, new);
 #else
-        return ftrace_modify_code_2r(ip, new, in_kernel_space(ip) ?
+        return ftrace_modify_code_2r(ip, new, core_kernel_text(ip) ?
                                                 INSN_NOP : insn_la_mcount[1]);
 #endif
 }
@@ -289,7 +275,7 @@ unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
          * instruction "lui v1, hi_16bit_of_mcount"(offset is 24), but for
          * kernel, move after the instruction "move ra, at"(offset is 16)
          */
-        ip = self_ra - (in_kernel_space(self_ra) ? 16 : 24);
+        ip = self_ra - (core_kernel_text(self_ra) ? 16 : 24);
 
         /*
          * search the text until finding the non-store instruction or "s{d,w}
@@ -394,7 +380,7 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
          * entries configured through the tracing/set_graph_function interface.
          */
 
-        insns = in_kernel_space(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
+        insns = core_kernel_text(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
         trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
 
         /* Only trace if the calling function expects to */
diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index cf052204eb0a..d1bb506adc10 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -106,8 +106,8 @@ NESTED(kernel_entry, 16, sp)			# kernel entry point
         beq             t0, t1, dtb_found
 #endif
         li              t1, -2
-        beq             a0, t1, dtb_found
         move            t2, a1
+        beq             a0, t1, dtb_found
 
         li              t2, 0
 dtb_found:
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 313a88b2973f..f3e301f95aef 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -1597,7 +1597,6 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config)
                 break;
         case CPU_P5600:
         case CPU_P6600:
-        case CPU_I6400:
                 /* 8-bit event numbers */
                 raw_id = config & 0x1ff;
                 base_id = raw_id & 0xff;
@@ -1610,6 +1609,11 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config)
                 raw_event.range = P;
 #endif
                 break;
+        case CPU_I6400:
+                /* 8-bit event numbers */
+                base_id = config & 0xff;
+                raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
+                break;
         case CPU_1004K:
                 if (IS_BOTH_COUNTERS_1004K_EVENT(base_id))
                         raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
index 5f928c34c148..d99416094ba9 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -56,7 +56,6 @@ DECLARE_BITMAP(state_support, CPS_PM_STATE_COUNT);
  * state. Actually per-core rather than per-CPU.
  */
 static DEFINE_PER_CPU_ALIGNED(u32*, ready_count);
-static DEFINE_PER_CPU_ALIGNED(void*, ready_count_alloc);
 
 /* Indicates online CPUs coupled with the current CPU */
 static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled);
@@ -642,7 +641,6 @@ static int cps_pm_online_cpu(unsigned int cpu)
 {
         enum cps_pm_state state;
         unsigned core = cpu_data[cpu].core;
-        unsigned dlinesz = cpu_data[cpu].dcache.linesz;
         void *entry_fn, *core_rc;
 
         for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) {
@@ -662,16 +660,11 @@ static int cps_pm_online_cpu(unsigned int cpu)
         }
 
         if (!per_cpu(ready_count, core)) {
-                core_rc = kmalloc(dlinesz * 2, GFP_KERNEL);
+                core_rc = kmalloc(sizeof(u32), GFP_KERNEL);
                 if (!core_rc) {
                         pr_err("Failed allocate core %u ready_count\n", core);
                         return -ENOMEM;
                 }
-                per_cpu(ready_count_alloc, core) = core_rc;
-
-                /* Ensure ready_count is aligned to a cacheline boundary */
-                core_rc += dlinesz - 1;
-                core_rc = (void *)((unsigned long)core_rc & ~(dlinesz - 1));
                 per_cpu(ready_count, core) = core_rc;
         }
 
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 918d4c73e951..5351e1f3950d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -120,7 +120,6 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
         struct thread_info *ti = task_thread_info(p);
         struct pt_regs *childregs, *regs = current_pt_regs();
         unsigned long childksp;
-        p->set_child_tid = p->clear_child_tid = NULL;
 
         childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
 
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 9681b5877140..38dfa27730ff 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -201,6 +201,8 @@ void show_stack(struct task_struct *task, unsigned long *sp)
 {
         struct pt_regs regs;
         mm_segment_t old_fs = get_fs();
+
+        regs.cp0_status = KSU_KERNEL;
         if (sp) {
                 regs.regs[29] = (unsigned long)sp;
                 regs.regs[31] = 0;
diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
index 7c6336dd2638..7cd92166a0b9 100644
--- a/arch/mips/kvm/tlb.c
+++ b/arch/mips/kvm/tlb.c
@@ -166,7 +166,11 @@ static int _kvm_mips_host_tlb_inv(unsigned long entryhi)
 int kvm_mips_host_tlb_inv(struct kvm_vcpu *vcpu, unsigned long va,
                           bool user, bool kernel)
 {
-        int idx_user, idx_kernel;
+        /*
+         * Initialize idx_user and idx_kernel to workaround bogus
+         * maybe-initialized warning when using GCC 6.
+         */
+        int idx_user = 0, idx_kernel = 0;
         unsigned long flags, old_entryhi;
 
         local_irq_save(flags);
diff --git a/arch/mips/math-emu/dp_maddf.c b/arch/mips/math-emu/dp_maddf.c
index 4a2d03c72959..caa62f20a888 100644
--- a/arch/mips/math-emu/dp_maddf.c
+++ b/arch/mips/math-emu/dp_maddf.c
@@ -54,7 +54,7 @@ static union ieee754dp _dp_maddf(union ieee754dp z, union ieee754dp x,
                 return ieee754dp_nanxcpt(z);
         case IEEE754_CLASS_DNORM:
                 DPDNORMZ;
-        /* QNAN is handled separately below */
+        /* QNAN and ZERO cases are handled separately below */
         }
 
         switch (CLPAIR(xc, yc)) {
@@ -210,6 +210,9 @@ static union ieee754dp _dp_maddf(union ieee754dp z, union ieee754dp x,
         }
         assert(rm & (DP_HIDDEN_BIT << 3));
 
+        if (zc == IEEE754_CLASS_ZERO)
+                return ieee754dp_format(rs, re, rm);
+
         /* And now the addition */
         assert(zm & DP_HIDDEN_BIT);
 
diff --git a/arch/mips/math-emu/sp_maddf.c b/arch/mips/math-emu/sp_maddf.c
index a8cd8b4f235e..c91d5e5d9b5f 100644
--- a/arch/mips/math-emu/sp_maddf.c
+++ b/arch/mips/math-emu/sp_maddf.c
@@ -54,7 +54,7 @@ static union ieee754sp _sp_maddf(union ieee754sp z, union ieee754sp x,
                 return ieee754sp_nanxcpt(z);
         case IEEE754_CLASS_DNORM:
                 SPDNORMZ;
-        /* QNAN is handled separately below */
+        /* QNAN and ZERO cases are handled separately below */
         }
 
         switch (CLPAIR(xc, yc)) {
@@ -203,6 +203,9 @@ static union ieee754sp _sp_maddf(union ieee754sp z, union ieee754sp x,
         }
         assert(rm & (SP_HIDDEN_BIT << 3));
 
+        if (zc == IEEE754_CLASS_ZERO)
+                return ieee754sp_format(rs, re, rm);
+
         /* And now the addition */
 
         assert(zm & SP_HIDDEN_BIT);
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index fe8df14b6169..e08598c70b3e 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -68,12 +68,25 @@ static inline struct page *dma_addr_to_page(struct device *dev,
  * systems and only the R10000 and R12000 are used in such systems, the
  * SGI IP28 Indigo² rsp. SGI IP32 aka O2.
  */
-static inline int cpu_needs_post_dma_flush(struct device *dev)
+static inline bool cpu_needs_post_dma_flush(struct device *dev)
 {
-        return !plat_device_is_coherent(dev) &&
-               (boot_cpu_type() == CPU_R10000 ||
-                boot_cpu_type() == CPU_R12000 ||
-                boot_cpu_type() == CPU_BMIPS5000);
+        if (plat_device_is_coherent(dev))
+                return false;
+
+        switch (boot_cpu_type()) {
+        case CPU_R10000:
+        case CPU_R12000:
+        case CPU_BMIPS5000:
+                return true;
+
+        default:
+                /*
+                 * Presence of MAARs suggests that the CPU supports
+                 * speculatively prefetching data, and therefore requires
+                 * the post-DMA flush/invalidate.
+                 */
+                return cpu_has_maar;
+        }
 }
 
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 64dd8bdd92c3..28adeabe851f 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -93,7 +93,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/mips/mm/pgtable-32.c b/arch/mips/mm/pgtable-32.c
index adc6911ba748..b19a3c506b1e 100644
--- a/arch/mips/mm/pgtable-32.c
+++ b/arch/mips/mm/pgtable-32.c
@@ -51,15 +51,15 @@ void __init pagetable_init(void)
         /*
          * Fixed mappings:
          */
-        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
-        fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base);
+        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1);
+        fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base);
 
 #ifdef CONFIG_HIGHMEM
         /*
          * Permanent kmaps:
          */
         vaddr = PKMAP_BASE;
-        fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
+        fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
 
         pgd = swapper_pg_dir + __pgd_offset(vaddr);
         pud = pud_offset(pgd, vaddr);
diff --git a/arch/mn10300/include/asm/processor.h b/arch/mn10300/include/asm/processor.h
index 18e17abf7664..3ae479117b42 100644
--- a/arch/mn10300/include/asm/processor.h
+++ b/arch/mn10300/include/asm/processor.h
@@ -132,11 +132,6 @@ static inline void start_thread(struct pt_regs *regs,
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 
-/*
- * Return saved PC of a blocked thread.
- */
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define task_pt_regs(task) ((task)->thread.uregs)
diff --git a/arch/mn10300/kernel/process.c b/arch/mn10300/kernel/process.c
index c9fa42619c6a..89e8027e07fb 100644
--- a/arch/mn10300/kernel/process.c
+++ b/arch/mn10300/kernel/process.c
@@ -40,14 +40,6 @@
 #include "internal.h"
 
 /*
- * return saved PC of a blocked thread.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return ((unsigned long *) tsk->thread.sp)[3];
-}
-
-/*
  * power off function, if any
  */
 void (*pm_power_off)(void);
diff --git a/arch/nios2/include/asm/processor.h b/arch/nios2/include/asm/processor.h
index 3bbbc3d798e5..4944e2e1d8b0 100644
--- a/arch/nios2/include/asm/processor.h
+++ b/arch/nios2/include/asm/processor.h
@@ -75,9 +75,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-/* Return saved PC of a blocked thread. */
-#define thread_saved_pc(tsk)    ((tsk)->thread.kregs->ea)
-
 extern unsigned long get_wchan(struct task_struct *p);
 
 #define task_pt_regs(p) \
diff --git a/arch/openrisc/include/asm/processor.h b/arch/openrisc/include/asm/processor.h
index a908e6c30a00..396d8f306c21 100644
--- a/arch/openrisc/include/asm/processor.h
+++ b/arch/openrisc/include/asm/processor.h
@@ -84,11 +84,6 @@ void start_thread(struct pt_regs *regs, unsigned long nip, unsigned long sp);
 void release_thread(struct task_struct *);
 unsigned long get_wchan(struct task_struct *p);
 
-/*
- * Return saved PC of a blocked thread. For now, this is the "user" PC
- */
-extern unsigned long thread_saved_pc(struct task_struct *t);
-
 #define init_stack      (init_thread_union.stack)
 
 #define cpu_relax()     barrier()
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index f8da545854f9..f9b77003f113 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -110,11 +110,6 @@ void show_regs(struct pt_regs *regs)
         show_registers(regs);
 }
 
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        return (unsigned long)user_regs(t->stack)->pc;
-}
-
 void release_thread(struct task_struct *dead_task)
 {
 }
@@ -167,8 +162,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
 
         top_of_kernel_stack = sp;
 
-        p->set_child_tid = p->clear_child_tid = NULL;
-
         /* Locate userspace context on stack... */
         sp -= STACK_FRAME_OVERHEAD;     /* redzone */
         sp -= sizeof(struct pt_regs);
diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
index a3661ee6b060..4c6694b4e77e 100644
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -163,12 +163,7 @@ struct thread_struct {
         .flags          = 0 \
         }
 
-/*
- * Return saved PC of a blocked thread.  This is used by ps mostly.
- */
-
 struct task_struct;
-unsigned long thread_saved_pc(struct task_struct *t);
 void show_trace(struct task_struct *task, unsigned long *stack);
 
 /*
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 4516a5b53f38..b64d7d21646e 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -239,11 +239,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
         return 0;
 }
 
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        return t->thread.regs.kpc;
-}
-
 unsigned long
 get_wchan(struct task_struct *p)
 {
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index e5288638a1d9..378a754ca186 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -90,7 +90,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         unsigned long task_size = TASK_SIZE;
         int do_color_align, last_mmap;
         struct vm_unmapped_area_info info;
@@ -117,9 +117,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 else
                         addr = PAGE_ALIGN(addr);
 
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
@@ -143,7 +144,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                           const unsigned long len, const unsigned long pgoff,
                           const unsigned long flags)
 {
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         int do_color_align, last_mmap;
@@ -177,9 +178,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = COLOR_ALIGN(addr, last_mmap, pgoff);
                 else
                         addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index f7c8f9972f61..bf4391d18923 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -380,22 +380,6 @@ source "arch/powerpc/platforms/Kconfig"
 
 menu "Kernel options"
 
-config PPC_DT_CPU_FTRS
-        bool "Device-tree based CPU feature discovery & setup"
-        depends on PPC_BOOK3S_64
-        default n
-        help
-          This enables code to use a new device tree binding for describing CPU
-          compatibility and features. Saying Y here will attempt to use the new
-          binding if the firmware provides it. Currently only the skiboot
-          firmware provides this binding.
-          If you're not sure say Y.
-
-config PPC_CPUFEATURES_ENABLE_UNKNOWN
-        bool "cpufeatures pass through unknown features to guest/userspace"
-        depends on PPC_DT_CPU_FTRS
-        default y
-
 config HIGHMEM
         bool "High memory support"
         depends on PPC32
@@ -1215,11 +1199,6 @@ source "arch/powerpc/Kconfig.debug"
 
 source "security/Kconfig"
 
-config KEYS_COMPAT
-        bool
-        depends on COMPAT && KEYS
-        default y
-
 source "crypto/Kconfig"
 
 config PPC_LIB_RHEAP
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index b4b5e6b671ca..0c4e470571ca 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -8,7 +8,7 @@
 #define H_PTE_INDEX_SIZE  9
 #define H_PMD_INDEX_SIZE  7
 #define H_PUD_INDEX_SIZE  9
-#define H_PGD_INDEX_SIZE  12
+#define H_PGD_INDEX_SIZE  9
 
 #ifndef __ASSEMBLY__
 #define H_PTE_TABLE_SIZE        (sizeof(pte_t) << H_PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/bug.h b/arch/powerpc/include/asm/bug.h
index f2c562a0a427..0151af6c2a50 100644
--- a/arch/powerpc/include/asm/bug.h
+++ b/arch/powerpc/include/asm/bug.h
@@ -104,7 +104,7 @@
                 "1:     "PPC_TLNEI"     %4,0\n"                 \
                 _EMIT_BUG_ENTRY                                 \
                 : : "i" (__FILE__), "i" (__LINE__),             \
-                  "i" (BUGFLAG_TAINT(TAINT_WARN)),              \
+                  "i" (BUGFLAG_WARNING|BUGFLAG_TAINT(TAINT_WARN)),\
                   "i" (sizeof(struct bug_entry)),               \
                   "r" (__ret_warn_on));                         \
         }                                                       \
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index c2d509584a98..d02ad93bf708 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -214,7 +214,6 @@ enum {
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
-#define CPU_FTR_SUBCORE                 LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 
 #ifndef __ASSEMBLY__
@@ -463,7 +462,7 @@ enum {
             CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
             CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
             CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
-            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_SUBCORE)
+            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP)
 #define CPU_FTRS_POWER8E (CPU_FTRS_POWER8 | CPU_FTR_PMAO_BUG)
 #define CPU_FTRS_POWER8_DD1 (CPU_FTRS_POWER8 & ~CPU_FTR_DBELL)
 #define CPU_FTRS_POWER9 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
diff --git a/arch/powerpc/include/asm/kprobes.h b/arch/powerpc/include/asm/kprobes.h
index a83821f33ea3..8814a7249ceb 100644
--- a/arch/powerpc/include/asm/kprobes.h
+++ b/arch/powerpc/include/asm/kprobes.h
@@ -103,6 +103,7 @@ extern int kprobe_exceptions_notify(struct notifier_block *self,
 extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 extern int kprobe_handler(struct pt_regs *regs);
 extern int kprobe_post_handler(struct pt_regs *regs);
+extern int is_current_kprobe_addr(unsigned long addr);
 #ifdef CONFIG_KPROBES_ON_FTRACE
 extern int skip_singlestep(struct kprobe *p, struct pt_regs *regs,
                            struct kprobe_ctlblk *kcb);
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index a2123f291ab0..1189d04f3bd1 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -110,13 +110,18 @@ void release_thread(struct task_struct *);
 #define TASK_SIZE_128TB (0x0000800000000000UL)
 #define TASK_SIZE_512TB (0x0002000000000000UL)
 
-#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * For now 512TB is only supported with book3s and 64K linux page size.
+ */
+#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_PPC_64K_PAGES)
 /*
  * Max value currently used:
  */
-#define TASK_SIZE_USER64        TASK_SIZE_512TB
+#define TASK_SIZE_USER64                TASK_SIZE_512TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_128TB
 #else
-#define TASK_SIZE_USER64        TASK_SIZE_64TB
+#define TASK_SIZE_USER64                TASK_SIZE_64TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_64TB
 #endif
 
 /*
@@ -132,7 +137,7 @@ void release_thread(struct task_struct *);
  * space during mmap's.
  */
 #define TASK_UNMAPPED_BASE_USER32 (PAGE_ALIGN(TASK_SIZE_USER32 / 4))
-#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(TASK_SIZE_128TB / 4))
+#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(DEFAULT_MAP_WINDOW_USER64 / 4))
 
 #define TASK_UNMAPPED_BASE ((is_32bit_task()) ? \
                 TASK_UNMAPPED_BASE_USER32 : TASK_UNMAPPED_BASE_USER64 )
@@ -143,21 +148,15 @@ void release_thread(struct task_struct *);
  * with 128TB and conditionally enable upto 512TB
  */
 #ifdef CONFIG_PPC_BOOK3S_64
-#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ? \
-                                 TASK_SIZE_USER32 : TASK_SIZE_128TB)
+#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ?                    \
+                                 TASK_SIZE_USER32 : DEFAULT_MAP_WINDOW_USER64)
 #else
 #define DEFAULT_MAP_WINDOW      TASK_SIZE
 #endif
 
 #ifdef __powerpc64__
 
-#ifdef CONFIG_PPC_BOOK3S_64
-/* Limit stack to 128TB */
-#define STACK_TOP_USER64 TASK_SIZE_128TB
-#else
-#define STACK_TOP_USER64 TASK_SIZE_USER64
-#endif
-
+#define STACK_TOP_USER64 DEFAULT_MAP_WINDOW_USER64
 #define STACK_TOP_USER32 TASK_SIZE_USER32
 
 #define STACK_TOP (is_32bit_task() ? \
@@ -379,12 +378,6 @@ struct thread_struct {
 }
 #endif
 
-/*
- * Return saved PC of a blocked thread. For now, this is the "user" PC
- */
-#define thread_saved_pc(tsk)    \
-        ((tsk)->thread.regs? (tsk)->thread.regs->nip: 0)
-
 #define task_pt_regs(tsk)       ((struct pt_regs *)(tsk)->thread.regs)
 
 unsigned long get_wchan(struct task_struct *p);
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 8b3b46b7b0f2..329771559cbb 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void);
 extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 
+static inline int early_cpu_to_node(int cpu)
+{
+        int nid;
+
+        nid = numa_cpu_lookup_table[cpu];
+
+        /*
+         * Fall back to node 0 if nid is unset (it should be, except bugs).
+         * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+         */
+        return (nid < 0) ? 0 : nid;
+}
 #else
 
+static inline int early_cpu_to_node(int cpu) { return 0; }
+
 static inline void dump_numa_cpu_topology(void) {}
 
 static inline int sysfs_add_device_to_node(struct device *dev, int nid)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 5c0d8a8cdae5..41e88d3ce36b 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -267,13 +267,7 @@ do {								\
 extern unsigned long __copy_tofrom_user(void __user *to,
                 const void __user *from, unsigned long size);
 
-#ifndef __powerpc64__
-
-#define INLINE_COPY_FROM_USER
-#define INLINE_COPY_TO_USER
-
-#else /* __powerpc64__ */
-
+#ifdef __powerpc64__
 static inline unsigned long
 raw_copy_in_user(void __user *to, const void __user *from, unsigned long n)
 {
diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h
index c8a822acf962..c23ff4389ca2 100644
--- a/arch/powerpc/include/asm/xive.h
+++ b/arch/powerpc/include/asm/xive.h
@@ -94,11 +94,13 @@ struct xive_q {
  * store at 0 and some ESBs support doing a trigger via a
  * separate trigger page.
  */
-#define XIVE_ESB_GET            0x800
-#define XIVE_ESB_SET_PQ_00      0xc00
-#define XIVE_ESB_SET_PQ_01      0xd00
-#define XIVE_ESB_SET_PQ_10      0xe00
-#define XIVE_ESB_SET_PQ_11      0xf00
+#define XIVE_ESB_STORE_EOI      0x400 /* Store */
+#define XIVE_ESB_LOAD_EOI       0x000 /* Load */
+#define XIVE_ESB_GET            0x800 /* Load */
+#define XIVE_ESB_SET_PQ_00      0xc00 /* Load */
+#define XIVE_ESB_SET_PQ_01      0xd00 /* Load */
+#define XIVE_ESB_SET_PQ_10      0xe00 /* Load */
+#define XIVE_ESB_SET_PQ_11      0xf00 /* Load */
 
 #define XIVE_ESB_VAL_P          0x2
 #define XIVE_ESB_VAL_Q          0x1
diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
index 3e7ce86d5c13..4d877144f377 100644
--- a/arch/powerpc/include/uapi/asm/cputable.h
+++ b/arch/powerpc/include/uapi/asm/cputable.h
@@ -46,6 +46,8 @@
 #define PPC_FEATURE2_HTM_NOSC           0x01000000
 #define PPC_FEATURE2_ARCH_3_00          0x00800000 /* ISA 3.00 */
 #define PPC_FEATURE2_HAS_IEEE128        0x00400000 /* VSX IEEE Binary Float 128-bit */
+#define PPC_FEATURE2_DARN               0x00200000 /* darn random number insn */
+#define PPC_FEATURE2_SCV                0x00100000 /* scv syscall */
 
 /*
  * IMPORTANT!
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 9b3e88b1a9c8..6f849832a669 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -124,7 +124,8 @@ extern void __restore_cpu_e6500(void);
 #define COMMON_USER_POWER9      COMMON_USER_POWER8
 #define COMMON_USER2_POWER9     (COMMON_USER2_POWER8 | \
                                  PPC_FEATURE2_ARCH_3_00 | \
-                                 PPC_FEATURE2_HAS_IEEE128)
+                                 PPC_FEATURE2_HAS_IEEE128 | \
+                                 PPC_FEATURE2_DARN )
 
 #ifdef CONFIG_PPC_BOOK3E_64
 #define COMMON_USER_BOOKE       (COMMON_USER_PPC64 | PPC_FEATURE_BOOKE)
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index fcc7588a96d6..4c7656dc4e04 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -8,6 +8,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/jump_label.h>
+#include <linux/libfdt.h>
 #include <linux/memblock.h>
 #include <linux/printk.h>
 #include <linux/sched.h>
@@ -642,7 +643,6 @@ static struct dt_cpu_feature_match __initdata
         {"processor-control-facility", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-control-facility-v3", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-utilization-of-resources-register", feat_enable_purr, 0},
-        {"subcore", feat_enable, CPU_FTR_SUBCORE},
         {"no-execute", feat_enable, 0},
         {"strong-access-ordering", feat_enable, CPU_FTR_SAO},
         {"cache-inhibited-large-page", feat_enable_large_ci, 0},
@@ -671,12 +671,24 @@ static struct dt_cpu_feature_match __initdata
         {"wait-v3", feat_enable, 0},
 };
 
-/* XXX: how to configure this? Default + boot time? */
-#ifdef CONFIG_PPC_CPUFEATURES_ENABLE_UNKNOWN
-#define CPU_FEATURE_ENABLE_UNKNOWN 1
-#else
-#define CPU_FEATURE_ENABLE_UNKNOWN 0
-#endif
+static bool __initdata using_dt_cpu_ftrs;
+static bool __initdata enable_unknown = true;
+
+static int __init dt_cpu_ftrs_parse(char *str)
+{
+        if (!str)
+                return 0;
+
+        if (!strcmp(str, "off"))
+                using_dt_cpu_ftrs = false;
+        else if (!strcmp(str, "known"))
+                enable_unknown = false;
+        else
+                return 1;
+
+        return 0;
+}
+early_param("dt_cpu_ftrs", dt_cpu_ftrs_parse);
 
 static void __init cpufeatures_setup_start(u32 isa)
 {
@@ -707,7 +719,7 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
                 }
         }
 
-        if (!known && CPU_FEATURE_ENABLE_UNKNOWN) {
+        if (!known && enable_unknown) {
                 if (!feat_try_enable_unknown(f)) {
                         pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
                                 f->name);
@@ -756,6 +768,26 @@ static void __init cpufeatures_setup_finished(void)
                 cur_cpu_spec->cpu_features, cur_cpu_spec->mmu_features);
 }
 
+static int __init disabled_on_cmdline(void)
+{
+        unsigned long root, chosen;
+        const char *p;
+
+        root = of_get_flat_dt_root();
+        chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
+        if (chosen == -FDT_ERR_NOTFOUND)
+                return false;
+
+        p = of_get_flat_dt_prop(chosen, "bootargs", NULL);
+        if (!p)
+                return false;
+
+        if (strstr(p, "dt_cpu_ftrs=off"))
+                return true;
+
+        return false;
+}
+
 static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
                                         int depth, void *data)
 {
@@ -766,8 +798,6 @@ static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
         return 0;
 }
 
-static bool __initdata using_dt_cpu_ftrs = false;
-
 bool __init dt_cpu_ftrs_in_use(void)
 {
         return using_dt_cpu_ftrs;
@@ -775,6 +805,8 @@ bool __init dt_cpu_ftrs_in_use(void)
 
 bool __init dt_cpu_ftrs_init(void *fdt)
 {
+        using_dt_cpu_ftrs = false;
+
         /* Setup and verify the FDT, if it fails we just bail */
         if (!early_init_dt_verify(fdt))
                 return false;
@@ -782,6 +814,9 @@ bool __init dt_cpu_ftrs_init(void *fdt)
         if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
                 return false;
 
+        if (disabled_on_cmdline())
+                return false;
+
         cpufeatures_setup_cpu();
 
         using_dt_cpu_ftrs = true;
@@ -1027,5 +1062,8 @@ static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char
 
 void __init dt_cpu_ftrs_scan(void)
 {
+        if (!using_dt_cpu_ftrs)
+                return;
+
         of_scan_flat_dt(dt_cpu_ftrs_scan_callback, NULL);
 }
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index ae418b85c17c..b886795060fd 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1411,10 +1411,8 @@ USE_TEXT_SECTION()
         .balign IFETCH_ALIGN_BYTES
 do_hash_page:
 #ifdef CONFIG_PPC_STD_MMU_64
-        andis.  r0,r4,0xa410            /* weird error? */
+        andis.  r0,r4,0xa450            /* weird error? */
         bne-    handle_page_fault       /* if not, try to insert a HPTE */
-        andis.  r0,r4,DSISR_DABRMATCH@h
-        bne-    handle_dabr_fault
         CURRENT_THREAD_INFO(r11, r1)
         lwz     r0,TI_PREEMPT(r11)      /* If we're in an "NMI" */
         andis.  r0,r0,NMI_MASK@h        /* (i.e. an irq when soft-disabled) */
@@ -1438,11 +1436,16 @@ do_hash_page:
 
         /* Error */
         blt-    13f
+
+        /* Reload DSISR into r4 for the DABR check below */
+        ld      r4,_DSISR(r1)
 #endif /* CONFIG_PPC_STD_MMU_64 */
 
 /* Here we have a page fault that hash_page can't handle. */
 handle_page_fault:
-11:     ld      r4,_DAR(r1)
+11:     andis.  r0,r4,DSISR_DABRMATCH@h
+        bne-    handle_dabr_fault
+        ld      r4,_DAR(r1)
         ld      r5,_DSISR(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      do_page_fault
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index fc4343514bed..01addfb0ed0a 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -43,6 +43,12 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
 
 struct kretprobe_blackpoint kretprobe_blacklist[] = {{NULL, NULL}};
 
+int is_current_kprobe_addr(unsigned long addr)
+{
+        struct kprobe *p = kprobe_running();
+        return (p && (unsigned long)p->addr == addr) ? 1 : 0;
+}
+
 bool arch_within_kprobe_blacklist(unsigned long addr)
 {
         return  (addr >= (unsigned long)__kprobes_text_start &&
@@ -617,6 +623,15 @@ int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
         regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
 #endif
 
+        /*
+         * jprobes use jprobe_return() which skips the normal return
+         * path of the function, and this messes up the accounting of the
+         * function graph tracer.
+         *
+         * Pause function graph tracing while performing the jprobe function.
+         */
+        pause_graph_tracing();
+
         return 1;
 }
 NOKPROBE_SYMBOL(setjmp_pre_handler);
@@ -642,6 +657,8 @@ int longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
          * saved regs...
          */
         memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
+        /* It's OK to start function graph tracing again */
+        unpause_graph_tracing();
         preempt_enable_no_resched();
         return 1;
 }
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index baae104b16c7..2ad725ef4368 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1666,6 +1666,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
 #ifdef CONFIG_VSX
         current->thread.used_vsr = 0;
 #endif
+        current->thread.load_fp = 0;
         memset(&current->thread.fp_state, 0, sizeof(current->thread.fp_state));
         current->thread.fp_save_area = NULL;
 #ifdef CONFIG_ALTIVEC
@@ -1674,6 +1675,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.vr_save_area = NULL;
         current->thread.vrsave = 0;
         current->thread.used_vr = 0;
+        current->thread.load_vec = 0;
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_SPE
         memset(current->thread.evr, 0, sizeof(current->thread.evr));
@@ -1685,6 +1687,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.tm_tfhar = 0;
         current->thread.tm_texasr = 0;
         current->thread.tm_tfiar = 0;
+        current->thread.load_tm = 0;
 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
 }
 EXPORT_SYMBOL(start_thread);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 40c4887c27b6..f83056297441 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -161,7 +161,9 @@ static struct ibm_pa_feature {
         { .pabyte = 0,  .pabit = 3, .cpu_features  = CPU_FTR_CTRL },
         { .pabyte = 0,  .pabit = 6, .cpu_features  = CPU_FTR_NOEXECUTE },
         { .pabyte = 1,  .pabit = 2, .mmu_features  = MMU_FTR_CI_LARGE_PAGE },
+#ifdef CONFIG_PPC_RADIX_MMU
         { .pabyte = 40, .pabit = 0, .mmu_features  = MMU_FTR_TYPE_RADIX },
+#endif
         { .pabyte = 1,  .pabit = 1, .invert = 1, .cpu_features = CPU_FTR_NODSISRALIGN },
         { .pabyte = 5,  .pabit = 0, .cpu_features  = CPU_FTR_REAL_LE,
                                     .cpu_user_ftrs = PPC_FEATURE_TRUE_LE },
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 71dcda91755d..857129acf960 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -928,7 +928,7 @@ void __init setup_arch(char **cmdline_p)
 
 #ifdef CONFIG_PPC_MM_SLICES
 #ifdef CONFIG_PPC64
-        init_mm.context.addr_limit = TASK_SIZE_128TB;
+        init_mm.context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 #else
 #error  "context.addr_limit not initialized."
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index f35ff9dea4fb..4640f6d64f8b 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -616,6 +616,24 @@ void __init exc_lvl_early_init(void)
 #endif
 
 /*
+ * Emergency stacks are used for a range of things, from asynchronous
+ * NMIs (system reset, machine check) to synchronous, process context.
+ * We set preempt_count to zero, even though that isn't necessarily correct. To
+ * get the right value we'd need to copy it from the previous thread_info, but
+ * doing that might fault causing more problems.
+ * TODO: what to do with accounting?
+ */
+static void emerg_stack_init_thread_info(struct thread_info *ti, int cpu)
+{
+        ti->task = NULL;
+        ti->cpu = cpu;
+        ti->preempt_count = 0;
+        ti->local_flags = 0;
+        ti->flags = 0;
+        klp_init_thread_info(ti);
+}
+
+/*
  * Stack space used when we detect a bad kernel stack pointer, and
  * early in SMP boots before relocation is enabled. Exclusive emergency
  * stack for machine checks.
@@ -633,24 +651,31 @@ void __init emergency_stack_init(void)
          * Since we use these as temporary stacks during secondary CPU
          * bringup, we need to get at them in real mode. This means they
          * must also be within the RMO region.
+         *
+         * The IRQ stacks allocated elsewhere in this file are zeroed and
+         * initialized in kernel/irq.c. These are initialized here in order
+         * to have emergency stacks available as early as possible.
          */
         limit = min(safe_stack_limit(), ppc64_rma_size);
 
         for_each_possible_cpu(i) {
                 struct thread_info *ti;
                 ti = __va(memblock_alloc_base(THREAD_SIZE, THREAD_SIZE, limit));
-                klp_init_thread_info(ti);
+                memset(ti, 0, THREAD_SIZE);
+                emerg_stack_init_thread_info(ti, i);
                 paca[i].emergency_sp = (void *)ti + THREAD_SIZE;
 
 #ifdef CONFIG_PPC_BOOK3S_64
                 /* emergency stack for NMI exception handling. */
                 ti = __va(memblock_alloc_base(THREAD_SIZE, THREAD_SIZE, limit));
-                klp_init_thread_info(ti);
+                memset(ti, 0, THREAD_SIZE);
+                emerg_stack_init_thread_info(ti, i);
                 paca[i].nmi_emergency_sp = (void *)ti + THREAD_SIZE;
 
                 /* emergency stack for machine check exception handling. */
                 ti = __va(memblock_alloc_base(THREAD_SIZE, THREAD_SIZE, limit));
-                klp_init_thread_info(ti);
+                memset(ti, 0, THREAD_SIZE);
+                emerg_stack_init_thread_info(ti, i);
                 paca[i].mc_emergency_sp = (void *)ti + THREAD_SIZE;
 #endif
         }
@@ -661,7 +686,7 @@ void __init emergency_stack_init(void)
 
 static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
 {
-        return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+        return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
                                     __pa(MAX_DMA_ADDRESS));
 }
 
@@ -672,7 +697,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size)
 
 static int pcpu_cpu_distance(unsigned int from, unsigned int to)
 {
-        if (cpu_to_node(from) == cpu_to_node(to))
+        if (early_cpu_to_node(from) == early_cpu_to_node(to))
                 return LOCAL_DISTANCE;
         else
                 return REMOTE_DISTANCE;
diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index 7c933a99f5d5..c98e90b4ea7b 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -45,10 +45,14 @@ _GLOBAL(ftrace_caller)
         stdu    r1,-SWITCH_FRAME_SIZE(r1)
 
         /* Save all gprs to pt_regs */
-        SAVE_8GPRS(0,r1)
-        SAVE_8GPRS(8,r1)
-        SAVE_8GPRS(16,r1)
-        SAVE_8GPRS(24,r1)
+        SAVE_GPR(0, r1)
+        SAVE_10GPRS(2, r1)
+        SAVE_10GPRS(12, r1)
+        SAVE_10GPRS(22, r1)
+
+        /* Save previous stack pointer (r1) */
+        addi    r8, r1, SWITCH_FRAME_SIZE
+        std     r8, GPR1(r1)
 
         /* Load special regs for save below */
         mfmsr   r8
@@ -95,18 +99,44 @@ ftrace_call:
         bl      ftrace_stub
         nop
 
-        /* Load ctr with the possibly modified NIP */
-        ld      r3, _NIP(r1)
-        mtctr   r3
+        /* Load the possibly modified NIP */
+        ld      r15, _NIP(r1)
+
 #ifdef CONFIG_LIVEPATCH
-        cmpd    r14,r3          /* has NIP been altered? */
+        cmpd    r14, r15        /* has NIP been altered? */
+#endif
+
+#if defined(CONFIG_LIVEPATCH) && defined(CONFIG_KPROBES_ON_FTRACE)
+        /* NIP has not been altered, skip over further checks */
+        beq     1f
+
+        /* Check if there is an active kprobe on us */
+        subi    r3, r14, 4
+        bl      is_current_kprobe_addr
+        nop
+
+        /*
+         * If r3 == 1, then this is a kprobe/jprobe.
+         * else, this is livepatched function.
+         *
+         * The conditional branch for livepatch_handler below will use the
+         * result of this comparison. For kprobe/jprobe, we just need to branch to
+         * the new NIP, not call livepatch_handler. The branch below is bne, so we
+         * want CR0[EQ] to be true if this is a kprobe/jprobe. Which means we want
+         * CR0[EQ] = (r3 == 1).
+         */
+        cmpdi   r3, 1
+1:
 #endif
 
+        /* Load CTR with the possibly modified NIP */
+        mtctr   r15
+
         /* Restore gprs */
-        REST_8GPRS(0,r1)
-        REST_8GPRS(8,r1)
-        REST_8GPRS(16,r1)
-        REST_8GPRS(24,r1)
+        REST_GPR(0,r1)
+        REST_10GPRS(2,r1)
+        REST_10GPRS(12,r1)
+        REST_10GPRS(22,r1)
 
         /* Restore possibly modified LR */
         ld      r0, _LINK(r1)
@@ -119,7 +149,10 @@ ftrace_call:
         addi r1, r1, SWITCH_FRAME_SIZE
 
 #ifdef CONFIG_LIVEPATCH
-        /* Based on the cmpd above, if the NIP was altered handle livepatch */
+        /*
+         * Based on the cmpd or cmpdi above, if the NIP was altered and we're
+         * not on a kprobe/jprobe, then handle livepatch.
+         */
         bne-    livepatch_handler
 #endif
 
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 42b7a4fd57d9..8d1a365b8edc 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1486,6 +1486,14 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
                 r = set_vpa(vcpu, &vcpu->arch.dtl, addr, len);
                 break;
         case KVM_REG_PPC_TB_OFFSET:
+                /*
+                 * POWER9 DD1 has an erratum where writing TBU40 causes
+                 * the timebase to lose ticks.  So we don't let the
+                 * timebase offset be changed on P9 DD1.  (It is
+                 * initialized to zero.)
+                 */
+                if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        break;
                 /* round up to multiple of 2^24 */
                 vcpu->arch.vcore->tb_offset =
                         ALIGN(set_reg_val(id, *val), 1UL << 24);
@@ -2907,12 +2915,36 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
 {
         int r;
         int srcu_idx;
+        unsigned long ebb_regs[3] = {}; /* shut up GCC */
+        unsigned long user_tar = 0;
+        unsigned int user_vrsave;
 
         if (!vcpu->arch.sane) {
                 run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
                 return -EINVAL;
         }
 
+        /*
+         * Don't allow entry with a suspended transaction, because
+         * the guest entry/exit code will lose it.
+         * If the guest has TM enabled, save away their TM-related SPRs
+         * (they will get restored by the TM unavailable interrupt).
+         */
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
+            (current->thread.regs->msr & MSR_TM)) {
+                if (MSR_TM_ACTIVE(current->thread.regs->msr)) {
+                        run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+                        run->fail_entry.hardware_entry_failure_reason = 0;
+                        return -EINVAL;
+                }
+                current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
+                current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
+                current->thread.tm_texasr = mfspr(SPRN_TEXASR);
+                current->thread.regs->msr &= ~MSR_TM;
+        }
+#endif
+
         kvmppc_core_prepare_to_enter(vcpu);
 
         /* No need to go into the guest when all we'll do is come back out */
@@ -2934,6 +2966,15 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
 
         flush_all_to_thread(current);
 
+        /* Save userspace EBB and other register values */
+        if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+                ebb_regs[0] = mfspr(SPRN_EBBHR);
+                ebb_regs[1] = mfspr(SPRN_EBBRR);
+                ebb_regs[2] = mfspr(SPRN_BESCR);
+                user_tar = mfspr(SPRN_TAR);
+        }
+        user_vrsave = mfspr(SPRN_VRSAVE);
+
         vcpu->arch.wqp = &vcpu->arch.vcore->wq;
         vcpu->arch.pgdir = current->mm->pgd;
         vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
@@ -2960,6 +3001,16 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
                 }
         } while (is_kvmppc_resume_guest(r));
 
+        /* Restore userspace EBB and other register values */
+        if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+                mtspr(SPRN_EBBHR, ebb_regs[0]);
+                mtspr(SPRN_EBBRR, ebb_regs[1]);
+                mtspr(SPRN_BESCR, ebb_regs[2]);
+                mtspr(SPRN_TAR, user_tar);
+                mtspr(SPRN_FSCR, current->thread.fscr);
+        }
+        mtspr(SPRN_VRSAVE, user_vrsave);
+
  out:
         vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
         atomic_dec(&vcpu->kvm->arch.vcpus_running);
diff --git a/arch/powerpc/kvm/book3s_hv_interrupts.S b/arch/powerpc/kvm/book3s_hv_interrupts.S
index 0fdc4a28970b..404deb512844 100644
--- a/arch/powerpc/kvm/book3s_hv_interrupts.S
+++ b/arch/powerpc/kvm/book3s_hv_interrupts.S
@@ -121,10 +121,20 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
          * Put whatever is in the decrementer into the
          * hypervisor decrementer.
          */
+BEGIN_FTR_SECTION
+        ld      r5, HSTATE_KVM_VCORE(r13)
+        ld      r6, VCORE_KVM(r5)
+        ld      r9, KVM_HOST_LPCR(r6)
+        andis.  r9, r9, LPCR_LD@h
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         mfspr   r8,SPRN_DEC
         mftb    r7
-        mtspr   SPRN_HDEC,r8
+BEGIN_FTR_SECTION
+        /* On POWER9, don't sign-extend if host LPCR[LD] bit is set */
+        bne     32f
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         extsw   r8,r8
+32:     mtspr   SPRN_HDEC,r8
         add     r8,r8,r7
         std     r8,HSTATE_DECEXP(r13)
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bdb3f76ceb6b..4888dd494604 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -32,12 +32,29 @@
 #include <asm/opal.h>
 #include <asm/xive-regs.h>
 
+/* Sign-extend HDEC if not on POWER9 */
+#define EXTEND_HDEC(reg)                        \
+BEGIN_FTR_SECTION;                              \
+        extsw   reg, reg;                       \
+END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
+
 #define VCPU_GPRS_TM(reg) (((reg) * ULONG_SIZE) + VCPU_GPR_TM)
 
 /* Values in HSTATE_NAPPING(r13) */
 #define NAPPING_CEDE    1
 #define NAPPING_NOVCPU  2
 
+/* Stack frame offsets for kvmppc_hv_entry */
+#define SFS                     144
+#define STACK_SLOT_TRAP         (SFS-4)
+#define STACK_SLOT_TID          (SFS-16)
+#define STACK_SLOT_PSSCR        (SFS-24)
+#define STACK_SLOT_PID          (SFS-32)
+#define STACK_SLOT_IAMR         (SFS-40)
+#define STACK_SLOT_CIABR        (SFS-48)
+#define STACK_SLOT_DAWR         (SFS-56)
+#define STACK_SLOT_DAWRX        (SFS-64)
+
 /*
  * Call kvmppc_hv_entry in real mode.
  * Must be called with interrupts hard-disabled.
@@ -214,6 +231,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 kvmppc_primary_no_guest:
         /* We handle this much like a ceded vcpu */
         /* put the HDEC into the DEC, since HDEC interrupts don't wake us */
+        /* HDEC may be larger than DEC for arch >= v3.00, but since the */
+        /* HDEC value came from DEC in the first place, it will fit */
         mfspr   r3, SPRN_HDEC
         mtspr   SPRN_DEC, r3
         /*
@@ -295,8 +314,9 @@ kvm_novcpu_wakeup:
 
         /* See if our timeslice has expired (HDEC is negative) */
         mfspr   r0, SPRN_HDEC
+        EXTEND_HDEC(r0)
         li      r12, BOOK3S_INTERRUPT_HV_DECREMENTER
-        cmpwi   r0, 0
+        cmpdi   r0, 0
         blt     kvm_novcpu_exit
 
         /* Got an IPI but other vcpus aren't yet exiting, must be a latecomer */
@@ -319,10 +339,10 @@ kvm_novcpu_exit:
         bl      kvmhv_accumulate_time
 #endif
 13:     mr      r3, r12
-        stw     r12, 112-4(r1)
+        stw     r12, STACK_SLOT_TRAP(r1)
         bl      kvmhv_commence_exit
         nop
-        lwz     r12, 112-4(r1)
+        lwz     r12, STACK_SLOT_TRAP(r1)
         b       kvmhv_switch_to_host
 
 /*
@@ -390,8 +410,8 @@ kvm_secondary_got_guest:
         lbz     r4, HSTATE_PTID(r13)
         cmpwi   r4, 0
         bne     63f
-        lis     r6, 0x7fff
-        ori     r6, r6, 0xffff
+        LOAD_REG_ADDR(r6, decrementer_max)
+        ld      r6, 0(r6)
         mtspr   SPRN_HDEC, r6
         /* and set per-LPAR registers, if doing dynamic micro-threading */
         ld      r6, HSTATE_SPLIT_MODE(r13)
@@ -545,11 +565,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
  *                                                                            *
  *****************************************************************************/
 
-/* Stack frame offsets */
-#define STACK_SLOT_TID          (112-16)
-#define STACK_SLOT_PSSCR        (112-24)
-#define STACK_SLOT_PID          (112-32)
-
 .global kvmppc_hv_entry
 kvmppc_hv_entry:
 
@@ -565,7 +580,7 @@ kvmppc_hv_entry:
          */
         mflr    r0
         std     r0, PPC_LR_STKOFF(r1)
-        stdu    r1, -112(r1)
+        stdu    r1, -SFS(r1)
 
         /* Save R1 in the PACA */
         std     r1, HSTATE_HOST_R1(r13)
@@ -749,10 +764,20 @@ BEGIN_FTR_SECTION
         mfspr   r5, SPRN_TIDR
         mfspr   r6, SPRN_PSSCR
         mfspr   r7, SPRN_PID
+        mfspr   r8, SPRN_IAMR
         std     r5, STACK_SLOT_TID(r1)
         std     r6, STACK_SLOT_PSSCR(r1)
         std     r7, STACK_SLOT_PID(r1)
+        std     r8, STACK_SLOT_IAMR(r1)
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+BEGIN_FTR_SECTION
+        mfspr   r5, SPRN_CIABR
+        mfspr   r6, SPRN_DAWR
+        mfspr   r7, SPRN_DAWRX
+        std     r5, STACK_SLOT_CIABR(r1)
+        std     r6, STACK_SLOT_DAWR(r1)
+        std     r7, STACK_SLOT_DAWRX(r1)
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 
 BEGIN_FTR_SECTION
         /* Set partition DABR */
@@ -968,7 +993,8 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
 
         /* Check if HDEC expires soon */
         mfspr   r3, SPRN_HDEC
-        cmpwi   r3, 512         /* 1 microsecond */
+        EXTEND_HDEC(r3)
+        cmpdi   r3, 512         /* 1 microsecond */
         blt     hdec_soon
 
 #ifdef CONFIG_KVM_XICS
@@ -1505,11 +1531,10 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
          * set by the guest could disrupt the host.
          */
         li      r0, 0
-        mtspr   SPRN_IAMR, r0
-        mtspr   SPRN_CIABR, r0
-        mtspr   SPRN_DAWRX, r0
+        mtspr   SPRN_PSPB, r0
         mtspr   SPRN_WORT, r0
 BEGIN_FTR_SECTION
+        mtspr   SPRN_IAMR, r0
         mtspr   SPRN_TCSCR, r0
         /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
         li      r0, 1
@@ -1525,6 +1550,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
         std     r6,VCPU_UAMOR(r9)
         li      r6,0
         mtspr   SPRN_AMR,r6
+        mtspr   SPRN_UAMOR, r6
 
         /* Switch DSCR back to host value */
         mfspr   r8, SPRN_DSCR
@@ -1670,12 +1696,22 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 
         /* Restore host values of some registers */
 BEGIN_FTR_SECTION
+        ld      r5, STACK_SLOT_CIABR(r1)
+        ld      r6, STACK_SLOT_DAWR(r1)
+        ld      r7, STACK_SLOT_DAWRX(r1)
+        mtspr   SPRN_CIABR, r5
+        mtspr   SPRN_DAWR, r6
+        mtspr   SPRN_DAWRX, r7
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+BEGIN_FTR_SECTION
         ld      r5, STACK_SLOT_TID(r1)
         ld      r6, STACK_SLOT_PSSCR(r1)
         ld      r7, STACK_SLOT_PID(r1)
+        ld      r8, STACK_SLOT_IAMR(r1)
         mtspr   SPRN_TIDR, r5
         mtspr   SPRN_PSSCR, r6
         mtspr   SPRN_PID, r7
+        mtspr   SPRN_IAMR, r8
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 BEGIN_FTR_SECTION
         PPC_INVALIDATE_ERAT
@@ -1819,8 +1855,8 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
         li      r0, KVM_GUEST_MODE_NONE
         stb     r0, HSTATE_IN_GUEST(r13)
 
-        ld      r0, 112+PPC_LR_STKOFF(r1)
-        addi    r1, r1, 112
+        ld      r0, SFS+PPC_LR_STKOFF(r1)
+        addi    r1, r1, SFS
         mtlr    r0
         blr
 
@@ -2366,12 +2402,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_TM)
         mfspr   r3, SPRN_DEC
         mfspr   r4, SPRN_HDEC
         mftb    r5
-        cmpw    r3, r4
+        extsw   r3, r3
+        EXTEND_HDEC(r4)
+        cmpd    r3, r4
         ble     67f
         mtspr   SPRN_DEC, r4
 67:
         /* save expiry time of guest decrementer */
-        extsw   r3, r3
         add     r3, r3, r5
         ld      r4, HSTATE_KVM_VCPU(r13)
         ld      r5, HSTATE_KVM_VCORE(r13)
diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c
index 023a31133c37..4636ca6e7d38 100644
--- a/arch/powerpc/kvm/book3s_xive_template.c
+++ b/arch/powerpc/kvm/book3s_xive_template.c
@@ -69,7 +69,7 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd)
 {
         /* If the XIVE supports the new "store EOI facility, use it */
         if (xd->flags & XIVE_IRQ_FLAG_STORE_EOI)
-                __x_writeq(0, __x_eoi_page(xd));
+                __x_writeq(0, __x_eoi_page(xd) + XIVE_ESB_STORE_EOI);
         else if (hw_irq && xd->flags & XIVE_IRQ_FLAG_EOI_FW) {
                 opal_int_eoi(hw_irq);
         } else {
@@ -89,7 +89,7 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd)
                  * properly.
                  */
                 if (xd->flags & XIVE_IRQ_FLAG_LSI)
-                        __x_readq(__x_eoi_page(xd));
+                        __x_readq(__x_eoi_page(xd) + XIVE_ESB_LOAD_EOI);
                 else {
                         eoi_val = GLUE(X_PFX,esb_load)(xd, XIVE_ESB_SET_PQ_00);
 
diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
index 6575b9aabef4..a12e86395025 100644
--- a/arch/powerpc/mm/hugetlbpage-radix.c
+++ b/arch/powerpc/mm/hugetlbpage-radix.c
@@ -68,7 +68,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         /*
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 9dbd2a733d6b..0ee6be4f1ba4 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -112,7 +112,7 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -157,7 +157,7 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index c6dca2ae78ef..a3edf813d455 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -99,7 +99,7 @@ static int hash__init_new_context(struct mm_struct *mm)
          * mm->context.addr_limit. Default to max task size so that we copy the
          * default values to paca which will help us to handle slb miss early.
          */
-        mm->context.addr_limit = TASK_SIZE_128TB;
+        mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 
         /*
          * The old code would re-promote on fork, we don't do that when using
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 966b9fccfa66..45f6740dd407 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -99,7 +99,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
         if ((mm->task_size - len) < addr)
                 return 0;
         vma = find_vma(mm, addr);
-        return (!vma || (addr + len) <= vma->vm_start);
+        return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c
index cbd82fde5770..09ceea6175ba 100644
--- a/arch/powerpc/perf/perf_regs.c
+++ b/arch/powerpc/perf/perf_regs.c
@@ -101,5 +101,6 @@ void perf_get_regs_user(struct perf_regs *regs_user,
                         struct pt_regs *regs_user_copy)
 {
         regs_user->regs = task_pt_regs(current);
-        regs_user->abi  = perf_reg_abi(current);
+        regs_user->abi = (regs_user->regs) ? perf_reg_abi(current) :
+                         PERF_SAMPLE_REGS_ABI_NONE;
 }
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 018f8e90ac35..bb28e1a41257 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -402,7 +402,7 @@ static struct power_pmu power9_isa207_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = ISA207_TEST_ADDER,
+        .test_adder             = P9_DD1_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
@@ -421,7 +421,7 @@ static struct power_pmu power9_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = P9_DD1_TEST_ADDER,
+        .test_adder             = ISA207_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index 33244e3d9375..4fd64d3f5c44 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -59,6 +59,17 @@ config PPC_OF_BOOT_TRAMPOLINE
 
           In case of doubt, say Y
 
+config PPC_DT_CPU_FTRS
+        bool "Device-tree based CPU feature discovery & setup"
+        depends on PPC_BOOK3S_64
+        default y
+        help
+          This enables code to use a new device tree binding for describing CPU
+          compatibility and features. Saying Y here will attempt to use the new
+          binding if the firmware provides it. Currently only the skiboot
+          firmware provides this binding.
+          If you're not sure say Y.
+
 config UDBG_RTAS_CONSOLE
         bool "RTAS based debug console"
         depends on PPC_RTAS
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index 96c2b8a40630..0c45cdbac4cf 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -197,7 +197,9 @@ static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
             (REGION_ID(ea) != USER_REGION_ID)) {
 
                 spin_unlock(&spu->register_lock);
-                ret = hash_page(ea, _PAGE_PRESENT | _PAGE_READ, 0x300, dsisr);
+                ret = hash_page(ea,
+                                _PAGE_PRESENT | _PAGE_READ | _PAGE_PRIVILEGED,
+                                0x300, dsisr);
                 spin_lock(&spu->register_lock);
 
                 if (!ret) {
diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index e5a891ae80ee..84b7ac926ce6 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -175,6 +175,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
         skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
         if (!dump_skip(cprm, skip))
                 goto Eio;
+
+        rc = 0;
 out:
         free_page((unsigned long)buf);
         return rc;
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 067defeea691..b5d960d6db3d 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -75,7 +75,8 @@ struct pci_dev *pnv_pci_get_npu_dev(struct pci_dev *gpdev, int index)
         if (WARN_ON(!gpdev))
                 return NULL;
 
-        if (WARN_ON(!gpdev->dev.of_node))
+        /* Not all PCI devices have device-tree nodes */
+        if (!gpdev->dev.of_node)
                 return NULL;
 
         /* Get assoicated PCI device */
@@ -448,7 +449,7 @@ static int mmio_launch_invalidate(struct npu *npu, unsigned long launch,
         return mmio_atsd_reg;
 }
 
-static int mmio_invalidate_pid(struct npu *npu, unsigned long pid)
+static int mmio_invalidate_pid(struct npu *npu, unsigned long pid, bool flush)
 {
         unsigned long launch;
 
@@ -464,12 +465,15 @@ static int mmio_invalidate_pid(struct npu *npu, unsigned long pid)
         /* PID */
         launch |= pid << PPC_BITLSHIFT(38);
 
+        /* No flush */
+        launch |= !flush << PPC_BITLSHIFT(39);
+
         /* Invalidating the entire process doesn't use a va */
         return mmio_launch_invalidate(npu, launch, 0);
 }
 
 static int mmio_invalidate_va(struct npu *npu, unsigned long va,
-                        unsigned long pid)
+                        unsigned long pid, bool flush)
 {
         unsigned long launch;
 
@@ -485,26 +489,60 @@ static int mmio_invalidate_va(struct npu *npu, unsigned long va,
         /* PID */
         launch |= pid << PPC_BITLSHIFT(38);
 
+        /* No flush */
+        launch |= !flush << PPC_BITLSHIFT(39);
+
         return mmio_launch_invalidate(npu, launch, va);
 }
 
 #define mn_to_npu_context(x) container_of(x, struct npu_context, mn)
 
+struct mmio_atsd_reg {
+        struct npu *npu;
+        int reg;
+};
+
+static void mmio_invalidate_wait(
+        struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS], bool flush)
+{
+        struct npu *npu;
+        int i, reg;
+
+        /* Wait for all invalidations to complete */
+        for (i = 0; i <= max_npu2_index; i++) {
+                if (mmio_atsd_reg[i].reg < 0)
+                        continue;
+
+                /* Wait for completion */
+                npu = mmio_atsd_reg[i].npu;
+                reg = mmio_atsd_reg[i].reg;
+                while (__raw_readq(npu->mmio_atsd_regs[reg] + XTS_ATSD_STAT))
+                        cpu_relax();
+
+                put_mmio_atsd_reg(npu, reg);
+
+                /*
+                 * The GPU requires two flush ATSDs to ensure all entries have
+                 * been flushed. We use PID 0 as it will never be used for a
+                 * process on the GPU.
+                 */
+                if (flush)
+                        mmio_invalidate_pid(npu, 0, true);
+        }
+}
+
 /*
  * Invalidate either a single address or an entire PID depending on
  * the value of va.
  */
 static void mmio_invalidate(struct npu_context *npu_context, int va,
-                        unsigned long address)
+                        unsigned long address, bool flush)
 {
-        int i, j, reg;
+        int i, j;
         struct npu *npu;
         struct pnv_phb *nphb;
         struct pci_dev *npdev;
-        struct {
-                struct npu *npu;
-                int reg;
-        } mmio_atsd_reg[NV_MAX_NPUS];
+        struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS];
         unsigned long pid = npu_context->mm->context.id;
 
         /*
@@ -524,10 +562,11 @@ static void mmio_invalidate(struct npu_context *npu_context, int va,
 
                         if (va)
                                 mmio_atsd_reg[i].reg =
-                                        mmio_invalidate_va(npu, address, pid);
+                                        mmio_invalidate_va(npu, address, pid,
+                                                        flush);
                         else
                                 mmio_atsd_reg[i].reg =
-                                        mmio_invalidate_pid(npu, pid);
+                                        mmio_invalidate_pid(npu, pid, flush);
 
                         /*
                          * The NPU hardware forwards the shootdown to all GPUs
@@ -543,18 +582,10 @@ static void mmio_invalidate(struct npu_context *npu_context, int va,
          */
         flush_tlb_mm(npu_context->mm);
 
-        /* Wait for all invalidations to complete */
-        for (i = 0; i <= max_npu2_index; i++) {
-                if (mmio_atsd_reg[i].reg < 0)
-                        continue;
-
-                /* Wait for completion */
-                npu = mmio_atsd_reg[i].npu;
-                reg = mmio_atsd_reg[i].reg;
-                while (__raw_readq(npu->mmio_atsd_regs[reg] + XTS_ATSD_STAT))
-                        cpu_relax();
-                put_mmio_atsd_reg(npu, reg);
-        }
+        mmio_invalidate_wait(mmio_atsd_reg, flush);
+        if (flush)
+                /* Wait for the flush to complete */
+                mmio_invalidate_wait(mmio_atsd_reg, false);
 }
 
 static void pnv_npu2_mn_release(struct mmu_notifier *mn,
@@ -570,7 +601,7 @@ static void pnv_npu2_mn_release(struct mmu_notifier *mn,
          * There should be no more translation requests for this PID, but we
          * need to ensure any entries for it are removed from the TLB.
          */
-        mmio_invalidate(npu_context, 0, 0);
+        mmio_invalidate(npu_context, 0, 0, true);
 }
 
 static void pnv_npu2_mn_change_pte(struct mmu_notifier *mn,
@@ -580,7 +611,7 @@ static void pnv_npu2_mn_change_pte(struct mmu_notifier *mn,
 {
         struct npu_context *npu_context = mn_to_npu_context(mn);
 
-        mmio_invalidate(npu_context, 1, address);
+        mmio_invalidate(npu_context, 1, address, true);
 }
 
 static void pnv_npu2_mn_invalidate_page(struct mmu_notifier *mn,
@@ -589,7 +620,7 @@ static void pnv_npu2_mn_invalidate_page(struct mmu_notifier *mn,
 {
         struct npu_context *npu_context = mn_to_npu_context(mn);
 
-        mmio_invalidate(npu_context, 1, address);
+        mmio_invalidate(npu_context, 1, address, true);
 }
 
 static void pnv_npu2_mn_invalidate_range(struct mmu_notifier *mn,
@@ -599,8 +630,11 @@ static void pnv_npu2_mn_invalidate_range(struct mmu_notifier *mn,
         struct npu_context *npu_context = mn_to_npu_context(mn);
         unsigned long address;
 
-        for (address = start; address <= end; address += PAGE_SIZE)
-                mmio_invalidate(npu_context, 1, address);
+        for (address = start; address < end; address += PAGE_SIZE)
+                mmio_invalidate(npu_context, 1, address, false);
+
+        /* Do the flush only on the final addess == end */
+        mmio_invalidate(npu_context, 1, address, true);
 }
 
 static const struct mmu_notifier_ops nv_nmmu_notifier_ops = {
@@ -650,8 +684,11 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                 /* No nvlink associated with this GPU device */
                 return ERR_PTR(-ENODEV);
 
-        if (!mm) {
-                /* kernel thread contexts are not supported */
+        if (!mm || mm->context.id == 0) {
+                /*
+                 * Kernel thread contexts are not supported and context id 0 is
+                 * reserved on the GPU.
+                 */
                 return ERR_PTR(-EINVAL);
         }
 
@@ -714,7 +751,7 @@ static void pnv_npu2_release_context(struct kref *kref)
 void pnv_npu2_destroy_context(struct npu_context *npu_context,
                         struct pci_dev *gpdev)
 {
-        struct pnv_phb *nphb, *phb;
+        struct pnv_phb *nphb;
         struct npu *npu;
         struct pci_dev *npdev = pnv_pci_get_npu_dev(gpdev, 0);
         struct device_node *nvlink_dn;
@@ -728,13 +765,12 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context,
 
         nphb = pci_bus_to_host(npdev->bus)->private_data;
         npu = &nphb->npu;
-        phb = pci_bus_to_host(gpdev->bus)->private_data;
         nvlink_dn = of_parse_phandle(npdev->dev.of_node, "ibm,nvlink", 0);
         if (WARN_ON(of_property_read_u32(nvlink_dn, "ibm,npu-link-index",
                                                         &nvlink_index)))
                 return;
         npu_context->npdev[npu->index][nvlink_index] = NULL;
-        opal_npu_destroy_context(phb->opal_id, npu_context->mm->context.id,
+        opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
         kref_put(&npu_context->kref, pnv_npu2_release_context);
 }
diff --git a/arch/powerpc/platforms/powernv/subcore.c b/arch/powerpc/platforms/powernv/subcore.c
index 0babef11136f..8c6119280c13 100644
--- a/arch/powerpc/platforms/powernv/subcore.c
+++ b/arch/powerpc/platforms/powernv/subcore.c
@@ -407,7 +407,13 @@ static DEVICE_ATTR(subcores_per_core, 0644,
 
 static int subcore_init(void)
 {
-        if (!cpu_has_feature(CPU_FTR_SUBCORE))
+        unsigned pvr_ver;
+
+        pvr_ver = PVR_VER(mfspr(SPRN_PVR));
+
+        if (pvr_ver != PVR_POWER8 &&
+            pvr_ver != PVR_POWER8E &&
+            pvr_ver != PVR_POWER8NVL)
                 return 0;
 
         /*
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e104c71ea44a..1fb162ba9d1c 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -124,6 +124,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn)
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr);
                 lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index);
+                lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index);
                 lmbs[i].flags = be32_to_cpu(lmbs[i].flags);
         }
 
@@ -147,6 +148,7 @@ static void dlpar_update_drconf_property(struct device_node *dn,
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr);
                 lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index);
+                lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index);
                 lmbs[i].flags = cpu_to_be32(lmbs[i].flags);
         }
 
diff --git a/arch/powerpc/sysdev/simple_gpio.c b/arch/powerpc/sysdev/simple_gpio.c
index ef470b470b04..6afddae2fb47 100644
--- a/arch/powerpc/sysdev/simple_gpio.c
+++ b/arch/powerpc/sysdev/simple_gpio.c
@@ -75,7 +75,8 @@ static int u8_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 
 static void u8_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct u8_gpio_chip *u8_gc = gpiochip_get_data(&mm_gc->gc);
+        struct u8_gpio_chip *u8_gc =
+                container_of(mm_gc, struct u8_gpio_chip, mm_gc);
 
         u8_gc->data = in_8(mm_gc->regs);
 }
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 913825086b8d..8f5e3035483b 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -297,7 +297,7 @@ void xive_do_source_eoi(u32 hw_irq, struct xive_irq_data *xd)
 {
         /* If the XIVE supports the new "store EOI facility, use it */
         if (xd->flags & XIVE_IRQ_FLAG_STORE_EOI)
-                out_be64(xd->eoi_mmio, 0);
+                out_be64(xd->eoi_mmio + XIVE_ESB_STORE_EOI, 0);
         else if (hw_irq && xd->flags & XIVE_IRQ_FLAG_EOI_FW) {
                 /*
                  * The FW told us to call it. This happens for some
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e161fafb495b..6967addc6a89 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -363,9 +363,6 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 config SMP
         def_bool y
         prompt "Symmetric multi-processing support"
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index a5039fa89314..282072206df7 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -30,6 +30,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -90,6 +94,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -359,6 +365,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -367,16 +374,19 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -442,6 +452,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -452,7 +464,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -471,6 +482,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -487,12 +499,18 @@ CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_XFS_DEBUG=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BTRFS_DEBUG=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_DEBUG=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
 CONFIG_AUTOFS4_FS=m
@@ -558,6 +576,7 @@ CONFIG_HEADERS_CHECK=y
 CONFIG_DEBUG_SECTION_MISMATCH=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_OBJECTS=y
 CONFIG_DEBUG_OBJECTS_SELFTEST=y
 CONFIG_DEBUG_OBJECTS_FREE=y
@@ -580,7 +599,6 @@ CONFIG_DETECT_HUNG_TASK=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_DEBUG_TIMEKEEPING=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
 CONFIG_PROVE_LOCKING=y
@@ -595,6 +613,7 @@ CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
+CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
 CONFIG_FAIL_PAGE_ALLOC=y
@@ -616,13 +635,12 @@ CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
+CONFIG_TEST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_RBTREE_TEST=y
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_STRING_HELPERS=y
-CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
 CONFIG_BUG_ON_DATA_CORRUPTION=y
@@ -630,6 +648,7 @@ CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -640,7 +659,9 @@ CONFIG_CRYPTO_RSA=m
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
@@ -648,6 +669,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -657,8 +679,10 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -674,6 +698,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -685,6 +710,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
@@ -692,6 +718,7 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
+CONFIG_RANDOM32_SELFTEST=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 83970b5afb2b..3c6b78189fbc 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -46,7 +47,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -88,6 +92,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -356,6 +362,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -364,16 +371,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -439,6 +448,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -449,7 +460,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -468,6 +478,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -483,11 +494,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -553,7 +568,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -576,6 +590,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -599,6 +614,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -611,6 +627,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -626,16 +643,19 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
+CONFIG_PKEY=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index fbc6542aaf59..653d72bcc007 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -86,6 +90,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -354,6 +360,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -362,16 +369,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -437,6 +446,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -447,7 +458,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -466,6 +476,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -481,11 +492,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -551,7 +566,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -574,6 +588,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -597,6 +612,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -609,6 +625,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -624,6 +641,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -635,6 +653,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index e23d97c13735..afa46a7406ea 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -12,8 +12,10 @@ CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=2
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_HZ_100=y
+# CONFIG_ARCH_RANDOM is not set
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
+# CONFIG_BOUNCE is not set
 # CONFIG_CHECK_STACK is not set
 # CONFIG_CHSC_SCH is not set
 # CONFIG_SCM_BUS is not set
@@ -36,11 +38,11 @@ CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_ZFCP=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_HVC_IUCV is not set
+# CONFIG_HW_RANDOM_S390 is not set
 CONFIG_RAW_DRIVER=y
 # CONFIG_SCLP_ASYNC is not set
 # CONFIG_HMC_DRV is not set
@@ -54,9 +56,9 @@ CONFIG_RAW_DRIVER=y
 # CONFIG_INOTIFY_USER is not set
 CONFIG_CONFIGFS_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
+# CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 97189dbaf34b..20244a38c886 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -28,6 +28,7 @@ CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -108,7 +109,6 @@ CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=m
@@ -131,6 +131,7 @@ CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 CONFIG_DEVKMEM=y
@@ -162,7 +163,6 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_LOCK_STAT=y
@@ -172,14 +172,12 @@ CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -190,7 +188,6 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
-CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XTS=m
@@ -230,6 +227,7 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_ZCRYPT=m
 CONFIG_PKEY=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 426614a882a9..65d07ac34647 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -541,7 +541,6 @@ struct kvm_s390_float_interrupt {
         struct mutex ais_lock;
         u8 simm;
         u8 nimm;
-        int ais_enabled;
 };
 
 struct kvm_hw_wp_info_arch {
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 60d395fdc864..aeac013968f2 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -221,11 +221,6 @@ extern void release_thread(struct task_struct *);
 /* Free guarded storage control block for current */
 void exit_thread_gs(void);
 
-/*
- * Return saved PC of a blocked thread.
- */
-extern unsigned long thread_saved_pc(struct task_struct *t);
-
 unsigned long get_wchan(struct task_struct *p);
 #define task_pt_regs(tsk) ((struct pt_regs *) \
         (task_stack_page(tsk) + THREAD_SIZE) - 1)
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index e408d9cc5b96..6315037335ba 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -231,12 +231,17 @@ ENTRY(sie64a)
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 .Lsie_done:
 # some program checks are suppressing. C code (e.g. do_protection_exception)
-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and .Lsie_done should not cause program
-# interrupts. So lets use a nop (47 00 00 00) as a landing pad.
+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There
+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable.
+# Other instructions between sie64a and .Lsie_done should not cause program
+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds.
 # See also .Lcleanup_sie
-.Lrewind_pad:
-        nop     0
+.Lrewind_pad6:
+        nopr    7
+.Lrewind_pad4:
+        nopr    7
+.Lrewind_pad2:
+        nopr    7
         .globl sie_exit
 sie_exit:
         lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
@@ -249,7 +254,9 @@ sie_exit:
         stg     %r14,__SF_EMPTY+16(%r15)        # set exit reason code
         j       sie_exit
 
-        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad6,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad4,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad2,.Lsie_fault)
         EX_TABLE(sie_exit,.Lsie_fault)
 EXPORT_SYMBOL(sie64a)
 EXPORT_SYMBOL(sie_exit)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index e545ffe5155a..8e622bb52f7a 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -564,8 +564,6 @@ static struct kset *ipl_kset;
 
 static void __ipl_run(void *unused)
 {
-        if (MACHINE_IS_LPAR && ipl_info.type == IPL_TYPE_CCW)
-                diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
         diag308(DIAG308_LOAD_CLEAR, NULL);
         if (MACHINE_IS_VM)
                 __cpcmd("IPL", NULL, 0, NULL);
@@ -1088,10 +1086,7 @@ static void __reipl_run(void *unused)
                 break;
         case REIPL_METHOD_CCW_DIAG:
                 diag308(DIAG308_SET, reipl_block_ccw);
-                if (MACHINE_IS_LPAR)
-                        diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
-                else
-                        diag308(DIAG308_LOAD_CLEAR, NULL);
+                diag308(DIAG308_LOAD_CLEAR, NULL);
                 break;
         case REIPL_METHOD_FCP_RW_DIAG:
                 diag308(DIAG308_SET, reipl_block_fcp);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 999d7154bbdc..bb32b8618bf6 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -41,31 +41,6 @@
 
 asmlinkage void ret_from_fork(void) asm ("ret_from_fork");
 
-/*
- * Return saved PC of a blocked thread. used in kernel/sched.
- * resume in entry.S does not create a new stack frame, it
- * just stores the registers %r6-%r15 to the frame given by
- * schedule. We want to return the address of the caller of
- * schedule, so we have to walk the backchain one time to
- * find the frame schedule() store its return address.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        struct stack_frame *sf, *low, *high;
-
-        if (!tsk || !task_stack_page(tsk))
-                return 0;
-        low = task_stack_page(tsk);
-        high = (struct stack_frame *) task_pt_regs(tsk);
-        sf = (struct stack_frame *) tsk->thread.ksp;
-        if (sf <= low || sf > high)
-                return 0;
-        sf = (struct stack_frame *) sf->back_chain;
-        if (sf <= low || sf > high)
-                return 0;
-        return sf->gprs[8];
-}
-
 extern void kernel_thread_starter(void);
 
 /*
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 9da243d94cc3..3b297fa3aa67 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -977,11 +977,12 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
         ptr = asce.origin * 4096;
         if (asce.r) {
                 *fake = 1;
+                ptr = 0;
                 asce.dt = ASCE_TYPE_REGION1;
         }
         switch (asce.dt) {
         case ASCE_TYPE_REGION1:
-                if (vaddr.rfx01 > asce.tl && !asce.r)
+                if (vaddr.rfx01 > asce.tl && !*fake)
                         return PGM_REGION_FIRST_TRANS;
                 break;
         case ASCE_TYPE_REGION2:
@@ -1009,8 +1010,7 @@ static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr,
                 union region1_table_entry rfte;
 
                 if (*fake) {
-                        /* offset in 16EB guest memory block */
-                        ptr = ptr + ((unsigned long) vaddr.rsx << 53UL);
+                        ptr += (unsigned long) vaddr.rfx << 53;
                         rfte.val = ptr;
                         goto shadow_r2t;
                 }
@@ -1036,8 +1036,7 @@ shadow_r2t:
                 union region2_table_entry rste;
 
                 if (*fake) {
-                        /* offset in 8PB guest memory block */
-                        ptr = ptr + ((unsigned long) vaddr.rtx << 42UL);
+                        ptr += (unsigned long) vaddr.rsx << 42;
                         rste.val = ptr;
                         goto shadow_r3t;
                 }
@@ -1064,8 +1063,7 @@ shadow_r3t:
                 union region3_table_entry rtte;
 
                 if (*fake) {
-                        /* offset in 4TB guest memory block */
-                        ptr = ptr + ((unsigned long) vaddr.sx << 31UL);
+                        ptr += (unsigned long) vaddr.rtx << 31;
                         rtte.val = ptr;
                         goto shadow_sgt;
                 }
@@ -1101,8 +1099,7 @@ shadow_sgt:
                 union segment_table_entry ste;
 
                 if (*fake) {
-                        /* offset in 2G guest memory block */
-                        ptr = ptr + ((unsigned long) vaddr.sx << 20UL);
+                        ptr += (unsigned long) vaddr.sx << 20;
                         ste.val = ptr;
                         goto shadow_pgt;
                 }
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index caf15c8a8948..2d120fef7d90 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2160,7 +2160,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
         struct kvm_s390_ais_req req;
         int ret = 0;
 
-        if (!fi->ais_enabled)
+        if (!test_kvm_facility(kvm, 72))
                 return -ENOTSUPP;
 
         if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
@@ -2204,7 +2204,7 @@ static int kvm_s390_inject_airq(struct kvm *kvm,
         };
         int ret = 0;
 
-        if (!fi->ais_enabled || !adapter->suppressible)
+        if (!test_kvm_facility(kvm, 72) || !adapter->suppressible)
                 return kvm_s390_inject_vm(kvm, &s390int);
 
         mutex_lock(&fi->ais_lock);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 689ac48361c6..f28e2e776931 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -558,7 +558,6 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 } else {
                         set_kvm_facility(kvm->arch.model.fac_mask, 72);
                         set_kvm_facility(kvm->arch.model.fac_list, 72);
-                        kvm->arch.float_int.ais_enabled = 1;
                         r = 0;
                 }
                 mutex_unlock(&kvm->lock);
@@ -1533,7 +1532,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         mutex_init(&kvm->arch.float_int.ais_lock);
         kvm->arch.float_int.simm = 0;
         kvm->arch.float_int.nimm = 0;
-        kvm->arch.float_int.ais_enabled = 0;
         spin_lock_init(&kvm->arch.float_int.lock);
         for (i = 0; i < FIRQ_LIST_COUNT; i++)
                 INIT_LIST_HEAD(&kvm->arch.float_int.lists[i]);
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index b017daed6887..b854b1da281a 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -101,7 +101,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         goto check_asce_limit;
         }
 
@@ -151,7 +151,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         goto check_asce_limit;
         }
 
diff --git a/arch/score/include/asm/processor.h b/arch/score/include/asm/processor.h
index d9a922d8711b..299274581968 100644
--- a/arch/score/include/asm/processor.h
+++ b/arch/score/include/asm/processor.h
@@ -13,7 +13,6 @@ struct task_struct;
  */
 extern void (*cpu_wait)(void);
 
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
 extern void start_thread(struct pt_regs *regs,
                         unsigned long pc, unsigned long sp);
 extern unsigned long get_wchan(struct task_struct *p);
diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
index eb64d7a677cb..6e20241a1ed4 100644
--- a/arch/score/kernel/process.c
+++ b/arch/score/kernel/process.c
@@ -101,11 +101,6 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *r)
         return 1;
 }
 
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return task_pt_regs(tsk)->cp0_epc;
-}
-
 unsigned long get_wchan(struct task_struct *task)
 {
         if (!task || task == current || task->state == TASK_RUNNING)
diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
index 08e7af0be4a7..6a1a1297baae 100644
--- a/arch/sh/mm/mmap.c
+++ b/arch/sh/mm/mmap.c
@@ -64,7 +64,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -114,7 +114,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 58243b0d21c0..5639c9fe5b55 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -192,9 +192,9 @@ config NR_CPUS
         int "Maximum number of CPUs"
         depends on SMP
         range 2 32 if SPARC32
-        range 2 1024 if SPARC64
+        range 2 4096 if SPARC64
         default 32 if SPARC32
-        default 64 if SPARC64
+        default 4096 if SPARC64
 
 source kernel/Kconfig.hz
 
@@ -295,9 +295,13 @@ config NUMA
         depends on SPARC64 && SMP
 
 config NODES_SHIFT
-        int
-        default "4"
+        int "Maximum NUMA Nodes (as a power of 2)"
+        range 4 5 if SPARC64
+        default "5"
         depends on NEED_MULTIPLE_NODES
+        help
+          Specify the maximum number of NUMA Nodes available on the target
+          system.  Increases memory reserved to accommodate various tables.
 
 # Some NUMA nodes have memory ranges that span
 # other nodes.  Even though a pfn is valid and
@@ -573,9 +577,6 @@ config SYSVIPC_COMPAT
         depends on COMPAT && SYSVIPC
         default y
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 endmenu
 
 source "net/Kconfig"
diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h
index f7de0dbc38af..83b36a5371ff 100644
--- a/arch/sparc/include/asm/mmu_64.h
+++ b/arch/sparc/include/asm/mmu_64.h
@@ -52,7 +52,7 @@
 #define CTX_NR_MASK             TAG_CONTEXT_BITS
 #define CTX_HW_MASK             (CTX_NR_MASK | CTX_PGSZ_MASK)
 
-#define CTX_FIRST_VERSION       ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL))
+#define CTX_FIRST_VERSION       BIT(CTX_VERSION_SHIFT)
 #define CTX_VALID(__ctx)        \
          (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK))
 #define CTX_HWBITS(__ctx)       ((__ctx.sparc64_ctx_val) & CTX_HW_MASK)
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index 22fede6eba11..2cddcda4f85f 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -19,13 +19,8 @@ extern spinlock_t ctx_alloc_lock;
 extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
 
+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm);
 void get_new_mmu_context(struct mm_struct *mm);
-#ifdef CONFIG_SMP
-void smp_new_mmu_context_version(void);
-#else
-#define smp_new_mmu_context_version() do { } while (0)
-#endif
-
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
 
@@ -76,8 +71,9 @@ void __flush_tlb_mm(unsigned long, unsigned long);
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
         unsigned long ctx_valid, flags;
-        int cpu;
+        int cpu = smp_processor_id();
 
+        per_cpu(per_cpu_secondary_mm, cpu) = mm;
         if (unlikely(mm == &init_mm))
                 return;
 
@@ -123,7 +119,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
          * for the first time, we must flush that context out of the
          * local TLB.
          */
-        cpu = smp_processor_id();
         if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) {
                 cpumask_set_cpu(cpu, mm_cpumask(mm));
                 __flush_tlb_mm(CTX_HWBITS(mm->context),
@@ -133,26 +128,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
-
-/* Activate a new MM instance for the current task. */
-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
-{
-        unsigned long flags;
-        int cpu;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (!CTX_VALID(mm->context))
-                get_new_mmu_context(mm);
-        cpu = smp_processor_id();
-        if (!cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_set_cpu(cpu, mm_cpumask(mm));
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        tsb_context_switch(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-}
-
+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL)
 #endif /* !(__ASSEMBLY__) */
 
 #endif /* !(__SPARC64_MMU_CONTEXT_H) */
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index 266937030546..522b43db2ed3 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -20,7 +20,6 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
-#define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
 #define PIL_DEFERRED_PCR_WORK   7
diff --git a/arch/sparc/include/asm/processor_32.h b/arch/sparc/include/asm/processor_32.h
index dd27159819eb..b395e5620c0b 100644
--- a/arch/sparc/include/asm/processor_32.h
+++ b/arch/sparc/include/asm/processor_32.h
@@ -67,9 +67,6 @@ struct thread_struct {
         .current_ds = KERNEL_DS, \
 }
 
-/* Return saved PC of a blocked thread. */
-unsigned long thread_saved_pc(struct task_struct *t);
-
 /* Do necessary setup to start up a newly executed thread. */
 static inline void start_thread(struct pt_regs * regs, unsigned long pc,
                                     unsigned long sp)
diff --git a/arch/sparc/include/asm/processor_64.h b/arch/sparc/include/asm/processor_64.h
index b58ee9018433..f04dc5a43062 100644
--- a/arch/sparc/include/asm/processor_64.h
+++ b/arch/sparc/include/asm/processor_64.h
@@ -89,9 +89,7 @@ struct thread_struct {
 #include <linux/types.h>
 #include <asm/fpumacro.h>
 
-/* Return saved PC of a blocked thread. */
 struct task_struct;
-unsigned long thread_saved_pc(struct task_struct *);
 
 /* On Uniprocessor, even in RMO processes see TSO semantics */
 #ifdef CONFIG_SMP
diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index 8174f6cdbbbb..9dca7a892978 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -327,6 +327,7 @@ struct vio_dev {
         int                     compat_len;
 
         u64                     dev_no;
+        u64                     id;
 
         unsigned long           channel_id;
 
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index b542cc7c8d94..f87265afb175 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -909,7 +909,7 @@ static int register_services(struct ds_info *dp)
                 pbuf.req.handle = cp->handle;
                 pbuf.req.major = 1;
                 pbuf.req.minor = 0;
-                strcpy(pbuf.req.svc_id, cp->service_id);
+                strcpy(pbuf.id_buf, cp->service_id);
 
                 err = __ds_send(lp, &pbuf, msg_len);
                 if (err > 0)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 4d0248aa0928..99dd133a029f 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb)
 {
 #ifdef CONFIG_SMP
         unsigned long page;
+        void *mondo, *p;
 
-        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64));
+        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE);
+
+        /* Make sure mondo block is 64byte aligned */
+        p = kzalloc(127, GFP_KERNEL);
+        if (!p) {
+                prom_printf("SUN4V: Error, cannot allocate mondo block.\n");
+                prom_halt();
+        }
+        mondo = (void *)(((unsigned long)p + 63) & ~0x3f);
+        tb->cpu_mondo_block_pa = __pa(mondo);
 
         page = get_zeroed_page(GFP_KERNEL);
         if (!page) {
-                prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n");
+                prom_printf("SUN4V: Error, cannot allocate cpu list page.\n");
                 prom_halt();
         }
 
-        tb->cpu_mondo_block_pa = __pa(page);
-        tb->cpu_list_pa = __pa(page + 64);
+        tb->cpu_list_pa = __pa(page);
 #endif
 }
 
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index c9804551262c..6ae1e77be0bf 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 /* smp_64.c */
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs);
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs);
 void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs);
 
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index b6dac8e980f0..9245f93398c7 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -177,14 +177,6 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
 }
 
 /*
- * Note: sparc64 has a pretty intricated thread_saved_pc, check it out.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        return task_thread_info(tsk)->kpc;
-}
-
-/*
  * Free current thread data structures etc..
  */
 void exit_thread(struct task_struct *tsk)
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 1badc493e62e..b96104da5bd6 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -400,25 +400,6 @@ core_initcall(sparc_sysrq_init);
 
 #endif
 
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        struct thread_info *ti = task_thread_info(tsk);
-        unsigned long ret = 0xdeadbeefUL;
-        
-        if (ti && ti->ksp) {
-                unsigned long *sp;
-                sp = (unsigned long *)(ti->ksp + STACK_BIAS);
-                if (((unsigned long)sp & (sizeof(long) - 1)) == 0UL &&
-                    sp[14]) {
-                        unsigned long *fp;
-                        fp = (unsigned long *)(sp[14] + STACK_BIAS);
-                        if (((unsigned long)fp & (sizeof(long) - 1)) == 0UL)
-                                ret = fp[15];
-                }
-        }
-        return ret;
-}
-
 /* Free current thread data structures etc.. */
 void exit_thread(struct task_struct *tsk)
 {
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index b3bc0ac757cc..fdf31040a7dc 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -964,37 +964,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
         preempt_enable();
 }
 
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
-{
-        struct mm_struct *mm;
-        unsigned long flags;
-
-        clear_softint(1 << irq);
-
-        /* See if we need to allocate a new TLB context because
-         * the version of the one we are using is now out of date.
-         */
-        mm = current->active_mm;
-        if (unlikely(!mm || (mm == &init_mm)))
-                return;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-
-        if (unlikely(!CTX_VALID(mm->context)))
-                get_new_mmu_context(mm);
-
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context),
-                       SECONDARY_CONTEXT);
-}
-
-void smp_new_mmu_context_version(void)
-{
-        smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0);
-}
-
 #ifdef CONFIG_KGDB
 void kgdb_roundup_cpus(unsigned long flags)
 {
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index ef4520efc813..043544d0cda3 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -120,7 +120,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 10689cfd0ad4..07c0df924960 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -455,13 +455,16 @@ __tsb_context_switch:
         .type   copy_tsb,#function
 copy_tsb:               /* %o0=old_tsb_base, %o1=old_tsb_size
                          * %o2=new_tsb_base, %o3=new_tsb_size
+                         * %o4=page_size_shift
                          */
         sethi           %uhi(TSB_PASS_BITS), %g7
         srlx            %o3, 4, %o3
-        add             %o0, %o1, %g1   /* end of old tsb */
+        add             %o0, %o1, %o1   /* end of old tsb */
         sllx            %g7, 32, %g7
         sub             %o3, 1, %o3     /* %o3 == new tsb hash mask */
 
+        mov             %o4, %g1        /* page_size_shift */
+
 661:    prefetcha       [%o0] ASI_N, #one_read
         .section        .tsb_phys_patch, "ax"
         .word           661b
@@ -486,9 +489,9 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         /* This can definitely be computed faster... */
         srlx            %o0, 4, %o5     /* Build index */
         and             %o5, 511, %o5   /* Mask index */
-        sllx            %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */
+        sllx            %o5, %g1, %o5   /* Put into vaddr position */
         or              %o4, %o5, %o4   /* Full VADDR. */
-        srlx            %o4, PAGE_SHIFT, %o4 /* Shift down to create index */
+        srlx            %o4, %g1, %o4   /* Shift down to create index */
         and             %o4, %o3, %o4   /* Mask with new_tsb_nents-1 */
         sllx            %o4, 4, %o4     /* Shift back up into tsb ent offset */
         TSB_STORE(%o2 + %o4, %g2)       /* Store TAG */
@@ -496,7 +499,7 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         TSB_STORE(%o2 + %o4, %g3)       /* Store TTE */
 
 80:     add             %o0, 16, %o0
-        cmp             %o0, %g1
+        cmp             %o0, %o1
         bne,pt          %xcc, 90b
          nop
 
diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S
index 7bd8f6556352..efe93ab4a9c0 100644
--- a/arch/sparc/kernel/ttable_64.S
+++ b/arch/sparc/kernel/ttable_64.S
@@ -50,7 +50,7 @@ tl0_resv03e:	BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40)
 tl0_irq1:       TRAP_IRQ(smp_call_function_client, 1)
 tl0_irq2:       TRAP_IRQ(smp_receive_signal_client, 2)
 tl0_irq3:       TRAP_IRQ(smp_penguin_jailcell, 3)
-tl0_irq4:       TRAP_IRQ(smp_new_mmu_context_version_client, 4)
+tl0_irq4:       BTRAP(0x44)
 #else
 tl0_irq1:       BTRAP(0x41)
 tl0_irq2:       BTRAP(0x42)
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index f6bb857254fc..075d38980dee 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -302,13 +302,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (!id) {
                 dev_set_name(&vdev->dev, "%s", bus_id_name);
                 vdev->dev_no = ~(u64)0;
+                vdev->id = ~(u64)0;
         } else if (!cfg_handle) {
                 dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id);
                 vdev->dev_no = *id;
+                vdev->id = ~(u64)0;
         } else {
                 dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name,
                              *cfg_handle, *id);
                 vdev->dev_no = *cfg_handle;
+                vdev->id = *id;
         }
 
         vdev->dev.parent = parent;
@@ -351,27 +354,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node)
         (void) vio_create_one(hp, node, &root_vdev->dev);
 }
 
+struct vio_md_node_query {
+        const char *type;
+        u64 dev_no;
+        u64 id;
+};
+
 static int vio_md_node_match(struct device *dev, void *arg)
 {
+        struct vio_md_node_query *query = (struct vio_md_node_query *) arg;
         struct vio_dev *vdev = to_vio_dev(dev);
 
-        if (vdev->mp == (u64) arg)
-                return 1;
+        if (vdev->dev_no != query->dev_no)
+                return 0;
+        if (vdev->id != query->id)
+                return 0;
+        if (strcmp(vdev->type, query->type))
+                return 0;
 
-        return 0;
+        return 1;
 }
 
 static void vio_remove(struct mdesc_handle *hp, u64 node)
 {
+        const char *type;
+        const u64 *id, *cfg_handle;
+        u64 a;
+        struct vio_md_node_query query;
         struct device *dev;
 
-        dev = device_find_child(&root_vdev->dev, (void *) node,
+        type = mdesc_get_property(hp, node, "device-type", NULL);
+        if (!type) {
+                type = mdesc_get_property(hp, node, "name", NULL);
+                if (!type)
+                        type = mdesc_node_name(hp, node);
+        }
+
+        query.type = type;
+
+        id = mdesc_get_property(hp, node, "id", NULL);
+        cfg_handle = NULL;
+        mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) {
+                u64 target;
+
+                target = mdesc_arc_target(hp, a);
+                cfg_handle = mdesc_get_property(hp, target,
+                                                "cfg-handle", NULL);
+                if (cfg_handle)
+                        break;
+        }
+
+        if (!id) {
+                query.dev_no = ~(u64)0;
+                query.id = ~(u64)0;
+        } else if (!cfg_handle) {
+                query.dev_no = *id;
+                query.id = ~(u64)0;
+        } else {
+                query.dev_no = *cfg_handle;
+                query.id = *id;
+        }
+
+        dev = device_find_child(&root_vdev->dev, &query,
                                 vio_md_node_match);
         if (dev) {
                 printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev));
 
                 device_unregister(dev);
                 put_device(dev);
+        } else {
+                if (!id)
+                        printk(KERN_ERR "VIO: Removed unknown %s node.\n",
+                               type);
+                else if (!cfg_handle)
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n",
+                               type, *id);
+                else
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n",
+                               type, *cfg_handle, *id);
         }
 }
 
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 69912d2f8b54..07c03e72d812 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -15,6 +15,7 @@ lib-$(CONFIG_SPARC32) += copy_user.o locks.o
 lib-$(CONFIG_SPARC64) += atomic_64.o
 lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
 lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
+lib-$(CONFIG_SPARC64) += multi3.o
 
 lib-$(CONFIG_SPARC64) += copy_page.o clear_page.o bzero.o
 lib-$(CONFIG_SPARC64) += csum_copy.o csum_copy_from_user.o csum_copy_to_user.o
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
new file mode 100644
index 000000000000..d6b6c97fe3c7
--- /dev/null
+++ b/arch/sparc/lib/multi3.S
@@ -0,0 +1,35 @@
+#include <linux/linkage.h>
+#include <asm/export.h>
+
+        .text
+        .align  4
+ENTRY(__multi3) /* %o0 = u, %o1 = v */
+        mov     %o1, %g1
+        srl     %o3, 0, %g4
+        mulx    %g4, %g1, %o1
+        srlx    %g1, 0x20, %g3
+        mulx    %g3, %g4, %g5
+        sllx    %g5, 0x20, %o5
+        srl     %g1, 0, %g4
+        sub     %o1, %o5, %o5
+        srlx    %o5, 0x20, %o5
+        addcc   %g5, %o5, %g5
+        srlx    %o3, 0x20, %o5
+        mulx    %g4, %o5, %g4
+        mulx    %g3, %o5, %o5
+        sethi   %hi(0x80000000), %g3
+        addcc   %g5, %g4, %g5
+        srlx    %g5, 0x20, %g5
+        add     %g3, %g3, %g3
+        movcc   %xcc, %g0, %g3
+        addcc   %o5, %g5, %o5
+        sllx    %g4, 0x20, %g4
+        add     %o1, %g4, %o1
+        add     %o5, %g3, %g2
+        mulx    %g1, %o2, %g1
+        add     %g1, %g2, %g1
+        mulx    %o0, %o3, %o0
+        retl
+         add    %g1, %o0, %o0
+ENDPROC(__multi3)
+EXPORT_SYMBOL(__multi3)
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 7c29d38e6b99..88855e383b34 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -120,7 +120,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 0cda653ae007..3c40ebd50f92 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -358,7 +358,8 @@ static int __init setup_hugepagesz(char *string)
         }
 
         if ((hv_pgsz_mask & cpu_pgsz_mask) == 0U) {
-                pr_warn("hugepagesz=%llu not supported by MMU.\n",
+                hugetlb_bad_size();
+                pr_err("hugepagesz=%llu not supported by MMU.\n",
                         hugepage_size);
                 goto out;
         }
@@ -706,10 +707,58 @@ EXPORT_SYMBOL(__flush_dcache_range);
 
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1;
+unsigned long tlb_context_cache = CTX_FIRST_VERSION;
 #define MAX_CTX_NR      (1UL << CTX_NR_BITS)
 #define CTX_BMAP_SLOTS  BITS_TO_LONGS(MAX_CTX_NR)
 DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR);
+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0};
+
+static void mmu_context_wrap(void)
+{
+        unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK;
+        unsigned long new_ver, new_ctx, old_ctx;
+        struct mm_struct *mm;
+        int cpu;
+
+        bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS);
+
+        /* Reserve kernel context */
+        set_bit(0, mmu_context_bmap);
+
+        new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION;
+        if (unlikely(new_ver == 0))
+                new_ver = CTX_FIRST_VERSION;
+        tlb_context_cache = new_ver;
+
+        /*
+         * Make sure that any new mm that are added into per_cpu_secondary_mm,
+         * are going to go through get_new_mmu_context() path.
+         */
+        mb();
+
+        /*
+         * Updated versions to current on those CPUs that had valid secondary
+         * contexts
+         */
+        for_each_online_cpu(cpu) {
+                /*
+                 * If a new mm is stored after we took this mm from the array,
+                 * it will go into get_new_mmu_context() path, because we
+                 * already bumped the version in tlb_context_cache.
+                 */
+                mm = per_cpu(per_cpu_secondary_mm, cpu);
+
+                if (unlikely(!mm || mm == &init_mm))
+                        continue;
+
+                old_ctx = mm->context.sparc64_ctx_val;
+                if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) {
+                        new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver;
+                        set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap);
+                        mm->context.sparc64_ctx_val = new_ctx;
+                }
+        }
+}
 
 /* Caller does TLB context flushing on local CPU if necessary.
  * The caller also ensures that CTX_VALID(mm->context) is false.
@@ -725,48 +774,30 @@ void get_new_mmu_context(struct mm_struct *mm)
 {
         unsigned long ctx, new_ctx;
         unsigned long orig_pgsz_bits;
-        int new_version;
 
         spin_lock(&ctx_alloc_lock);
+retry:
+        /* wrap might have happened, test again if our context became valid */
+        if (unlikely(CTX_VALID(mm->context)))
+                goto out;
         orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK);
         ctx = (tlb_context_cache + 1) & CTX_NR_MASK;
         new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx);
-        new_version = 0;
         if (new_ctx >= (1 << CTX_NR_BITS)) {
                 new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1);
                 if (new_ctx >= ctx) {
-                        int i;
-                        new_ctx = (tlb_context_cache & CTX_VERSION_MASK) +
-                                CTX_FIRST_VERSION;
-                        if (new_ctx == 1)
-                                new_ctx = CTX_FIRST_VERSION;
-
-                        /* Don't call memset, for 16 entries that's just
-                         * plain silly...
-                         */
-                        mmu_context_bmap[0] = 3;
-                        mmu_context_bmap[1] = 0;
-                        mmu_context_bmap[2] = 0;
-                        mmu_context_bmap[3] = 0;
-                        for (i = 4; i < CTX_BMAP_SLOTS; i += 4) {
-                                mmu_context_bmap[i + 0] = 0;
-                                mmu_context_bmap[i + 1] = 0;
-                                mmu_context_bmap[i + 2] = 0;
-                                mmu_context_bmap[i + 3] = 0;
-                        }
-                        new_version = 1;
-                        goto out;
+                        mmu_context_wrap();
+                        goto retry;
                 }
         }
+        if (mm->context.sparc64_ctx_val)
+                cpumask_clear(mm_cpumask(mm));
         mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63));
         new_ctx |= (tlb_context_cache & CTX_VERSION_MASK);
-out:
         tlb_context_cache = new_ctx;
         mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits;
+out:
         spin_unlock(&ctx_alloc_lock);
-
-        if (unlikely(new_version))
-                smp_new_mmu_context_version();
 }
 
 static int numa_enabled = 1;
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index bedf08b22a47..0d4b998c7d7b 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -496,7 +496,8 @@ retry_tsb_alloc:
                 extern void copy_tsb(unsigned long old_tsb_base,
                                      unsigned long old_tsb_size,
                                      unsigned long new_tsb_base,
-                                     unsigned long new_tsb_size);
+                                     unsigned long new_tsb_size,
+                                     unsigned long page_size_shift);
                 unsigned long old_tsb_base = (unsigned long) old_tsb;
                 unsigned long new_tsb_base = (unsigned long) new_tsb;
 
@@ -504,7 +505,9 @@ retry_tsb_alloc:
                         old_tsb_base = __pa(old_tsb_base);
                         new_tsb_base = __pa(new_tsb_base);
                 }
-                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size);
+                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size,
+                        tsb_index == MM_TSB_BASE ?
+                        PAGE_SHIFT : REAL_HPAGE_SHIFT);
         }
 
         mm->context.tsb_block[tsb_index].tsb = new_tsb;
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 5d2fd6cd3189..fcf4d27a38fb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -971,11 +971,6 @@ xcall_capture:
         wr              %g0, (1 << PIL_SMP_CAPTURE), %set_softint
         retry
 
-        .globl          xcall_new_mmu_context_version
-xcall_new_mmu_context_version:
-        wr              %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint
-        retry
-
 #ifdef CONFIG_KGDB
         .globl          xcall_kgdb_capture
 xcall_kgdb_capture:
diff --git a/arch/tile/include/asm/processor.h b/arch/tile/include/asm/processor.h
index 0bc9968b97a1..f71e5206650b 100644
--- a/arch/tile/include/asm/processor.h
+++ b/arch/tile/include/asm/processor.h
@@ -214,13 +214,6 @@ static inline void release_thread(struct task_struct *dead_task)
 
 extern void prepare_exit_to_usermode(struct pt_regs *regs, u32 flags);
 
-
-/*
- * Return saved (kernel) PC of a blocked thread.
- * Only used in a printk() in kernel/sched/core.c, so don't work too hard.
- */
-#define thread_saved_pc(t)   ((t)->thread.pc)
-
 unsigned long get_wchan(struct task_struct *p);
 
 /* Return initial ksp value for given task. */
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index cb10153b5c9f..03e5cc4e76e4 100644
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -233,7 +233,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (current->mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h
index 2d1e0dd5bb0b..f6d1a3f747a9 100644
--- a/arch/um/include/asm/processor-generic.h
+++ b/arch/um/include/asm/processor-generic.h
@@ -58,8 +58,6 @@ static inline void release_thread(struct task_struct *task)
 {
 }
 
-extern unsigned long thread_saved_pc(struct task_struct *t);
-
 static inline void mm_copy_segments(struct mm_struct *from_mm,
                                     struct mm_struct *new_mm)
 {
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index 64a1fd06f3fd..7b5640117325 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -56,12 +56,6 @@ union thread_union cpu0_irqstack
         __attribute__((__section__(".data..init_irqstack"))) =
                 { INIT_THREAD_INFO(init_task) };
 
-unsigned long thread_saved_pc(struct task_struct *task)
-{
-        /* FIXME: Need to look up userspace_pid by cpu */
-        return os_process_pc(userspace_pid[0]);
-}
-
 /* Changed in setup_arch, which is called in early boot */
 static char host_info[(__NEW_UTS_LEN + 1) * 5];
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cd18994a9555..0efb4c9497bc 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -360,7 +360,7 @@ config SMP
           Management" code will be disabled if you say Y here.
 
           See also <file:Documentation/x86/i386/IO-APIC.txt>,
-          <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
+          <file:Documentation/lockup-watchdogs.txt> and the SMP-HOWTO available at
           <http://www.tldp.org/docs.html#howto>.
 
           If you don't know what to do here, say N.
@@ -2776,10 +2776,6 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
         def_bool y
         depends on SYSVIPC
-
-config KEYS_COMPAT
-        def_bool y
-        depends on KEYS
 endif
 
 endmenu
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 5851411e60fb..bf240b920473 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -159,7 +159,7 @@ ifdef CONFIG_FUNCTION_GRAPH_TRACER
         # If '-Os' is enabled, disable it and print a warning.
         ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
           undefine CONFIG_CC_OPTIMIZE_FOR_SIZE
-          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
+          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
         endif
 
     endif
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 44163e8c3868..2c860ad4fe06 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -94,7 +94,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
 quiet_cmd_check_data_rel = DATAREL $@
 define cmd_check_data_rel
         for obj in $(filter %.o,$^); do \
-                readelf -S $$obj | grep -qF .rel.local && { \
+                ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \
                         echo "error: $$obj has data relocations!" >&2; \
                         exit 1; \
                 } || true; \
diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 54c24f0a43d3..56a7e9201741 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -564,9 +564,6 @@ void choose_random_location(unsigned long input,
 {
         unsigned long random_addr, min_addr;
 
-        /* By default, keep output position unchanged. */
-        *virt_addr = *output;
-
         if (cmdline_find_option_bool("nokaslr")) {
                 warn("KASLR disabled: 'nokaslr' on cmdline.");
                 return;
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index b3c5a5f030ce..00241c815524 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -338,7 +338,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
                                   unsigned long output_len)
 {
         const unsigned long kernel_total_size = VO__end - VO__text;
-        unsigned long virt_addr = (unsigned long)output;
+        unsigned long virt_addr = LOAD_PHYSICAL_ADDR;
 
         /* Retain x86 boot parameters pointer passed from startup_32/64. */
         boot_params = rmode;
@@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifdef CONFIG_X86_64
         if (heap > 0x3fffffffffffUL)
                 error("Destination address too large");
+        if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE)
+                error("Destination virtual address is beyond the kernel mapping area");
 #else
         if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff))
                 error("Destination address too large");
@@ -397,7 +399,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifndef CONFIG_RELOCATABLE
         if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
                 error("Destination address does not match LOAD_PHYSICAL_ADDR");
-        if ((unsigned long)output != virt_addr)
+        if (virt_addr != LOAD_PHYSICAL_ADDR)
                 error("Destination virtual address changed when not relocatable");
 #endif
 
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index 1c8355eadbd1..766a5211f827 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -81,8 +81,6 @@ static inline void choose_random_location(unsigned long input,
                                           unsigned long output_size,
                                           unsigned long *virt_addr)
 {
-        /* No change from existing output location. */
-        *virt_addr = *output;
 }
 #endif
 
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 50bc26949e9e..48ef7bb32c42 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -252,6 +252,23 @@ ENTRY(__switch_to_asm)
 END(__switch_to_asm)
 
 /*
+ * The unwinder expects the last frame on the stack to always be at the same
+ * offset from the end of the page, which allows it to validate the stack.
+ * Calling schedule_tail() directly would break that convention because its an
+ * asmlinkage function so its argument has to be pushed on the stack.  This
+ * wrapper creates a proper "end of stack" frame header before the call.
+ */
+ENTRY(schedule_tail_wrapper)
+        FRAME_BEGIN
+
+        pushl   %eax
+        call    schedule_tail
+        popl    %eax
+
+        FRAME_END
+        ret
+ENDPROC(schedule_tail_wrapper)
+/*
  * A newly forked process directly context switches into this address.
  *
  * eax: prev task we switched from
@@ -259,24 +276,15 @@ END(__switch_to_asm)
  * edi: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN             /* help unwinder find end of stack */
-
-        /*
-         * schedule_tail() is asmlinkage so we have to put its 'prev' argument
-         * on the stack.
-         */
-        pushl   %eax
-        call    schedule_tail
-        popl    %eax
+        call    schedule_tail_wrapper
 
         testl   %ebx, %ebx
         jnz     1f              /* kernel threads are uncommon */
 
 2:
         /* When we fork, we trace the syscall return in the child, too. */
-        leal    FRAME_OFFSET(%esp), %eax
+        movl    %esp, %eax
         call    syscall_return_slowpath
-        FRAME_END
         jmp     restore_all
 
         /* kernel thread */
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 607d72c4a485..4a4c0834f965 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -36,7 +36,6 @@
 #include <asm/smap.h>
 #include <asm/pgtable_types.h>
 #include <asm/export.h>
-#include <asm/frame.h>
 #include <linux/err.h>
 
 .code64
@@ -406,19 +405,17 @@ END(__switch_to_asm)
  * r12: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN                     /* help unwinder find end of stack */
         movq    %rax, %rdi
-        call    schedule_tail           /* rdi: 'prev' task parameter */
+        call    schedule_tail                   /* rdi: 'prev' task parameter */
 
-        testq   %rbx, %rbx              /* from kernel_thread? */
-        jnz     1f                      /* kernel threads are uncommon */
+        testq   %rbx, %rbx                      /* from kernel_thread? */
+        jnz     1f                              /* kernel threads are uncommon */
 
 2:
-        leaq    FRAME_OFFSET(%rsp),%rdi /* pt_regs pointer */
+        movq    %rsp, %rdi
         call    syscall_return_slowpath /* returns with IRQs disabled */
         TRACE_IRQS_ON                   /* user mode is traced as IRQS on */
         SWAPGS
-        FRAME_END
         jmp     restore_regs_and_iret
 
 1:
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index a6d91d4e37a1..110ce8238466 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -431,11 +431,11 @@ static __initconst const u64 skl_hw_cache_event_ids
  [ C(DTLB) ] = {
         [ C(OP_READ) ] = {
                 [ C(RESULT_ACCESS) ] = 0x81d0,  /* MEM_INST_RETIRED.ALL_LOADS */
-                [ C(RESULT_MISS)   ] = 0x608,   /* DTLB_LOAD_MISSES.WALK_COMPLETED */
+                [ C(RESULT_MISS)   ] = 0xe08,   /* DTLB_LOAD_MISSES.WALK_COMPLETED */
         },
         [ C(OP_WRITE) ] = {
                 [ C(RESULT_ACCESS) ] = 0x82d0,  /* MEM_INST_RETIRED.ALL_STORES */
-                [ C(RESULT_MISS)   ] = 0x649,   /* DTLB_STORE_MISSES.WALK_COMPLETED */
+                [ C(RESULT_MISS)   ] = 0xe49,   /* DTLB_STORE_MISSES.WALK_COMPLETED */
         },
         [ C(OP_PREFETCH) ] = {
                 [ C(RESULT_ACCESS) ] = 0x0,
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 758c1aa5009d..44ec523287f6 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -1170,7 +1170,7 @@ static int uncore_event_cpu_online(unsigned int cpu)
                 pmu = type->pmus;
                 for (i = 0; i < type->num_boxes; i++, pmu++) {
                         box = pmu->boxes[pkg];
-                        if (!box && atomic_inc_return(&box->refcnt) == 1)
+                        if (box && atomic_inc_return(&box->refcnt) == 1)
                                 uncore_box_init(box);
                 }
         }
diff --git a/arch/x86/include/asm/extable.h b/arch/x86/include/asm/extable.h
index b8ad261d11dc..c66d19e3c23e 100644
--- a/arch/x86/include/asm/extable.h
+++ b/arch/x86/include/asm/extable.h
@@ -29,6 +29,7 @@ struct pt_regs;
         } while (0)
 
 extern int fixup_exception(struct pt_regs *regs, int trapnr);
+extern int fixup_bug(struct pt_regs *regs, int trapnr);
 extern bool ex_has_fault_handler(unsigned long ip);
 extern void early_fixup_exception(struct pt_regs *regs, int trapnr);
 
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 055962615779..722d0e568863 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -296,6 +296,7 @@ struct x86_emulate_ctxt {
 
         bool perm_ok; /* do not check permissions if true */
         bool ud;        /* inject an #UD if host doesn't support insn */
+        bool tf;        /* TF value before instruction (after for syscall/sysret) */
 
         bool have_exception;
         struct x86_exception exception;
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 4fd5195deed0..3f9a3d2a5209 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -266,6 +266,7 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s
 #endif
 
 int mce_available(struct cpuinfo_x86 *c);
+bool mce_is_memory_error(struct mce *m);
 
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index fba100713924..d5acc27ed1cc 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -2,8 +2,7 @@
 #define _ASM_X86_MSHYPER_H
 
 #include <linux/types.h>
-#include <linux/interrupt.h>
-#include <linux/clocksource.h>
+#include <linux/atomic.h>
 #include <asm/hyperv.h>
 
 /*
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 3cada998a402..a28b671f1549 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -860,8 +860,6 @@ extern unsigned long KSTK_ESP(struct task_struct *task);
 
 #endif /* CONFIG_X86_64 */
 
-extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
 extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
                                                unsigned long new_sp);
 
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index c5b8f760473c..32e14d137416 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -409,8 +409,13 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                 memcpy(insnbuf, replacement, a->replacementlen);
                 insnbuf_sz = a->replacementlen;
 
-                /* 0xe8 is a relative jump; fix the offset. */
-                if (*insnbuf == 0xe8 && a->replacementlen == 5) {
+                /*
+                 * 0xe8 is a relative jump; fix the offset.
+                 *
+                 * Instruction length is checked before the opcode to avoid
+                 * accessing uninitialized bytes for zero-length replacements.
+                 */
+                if (a->replacementlen == 5 && *insnbuf == 0xe8) {
                         *(s32 *)(insnbuf + 1) += replacement - instr;
                         DPRINTK("Fix CALL offset: 0x%x, CALL 0x%lx",
                                 *(s32 *)(insnbuf + 1),
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index a70fd61095f8..6f077445647a 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -255,6 +255,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                 break;
 
         case 4: /* MediaGX/GXm or Geode GXM/GXLV/GX1 */
+        case 11: /* GX1 with inverted Device ID */
 #ifdef CONFIG_PCI
         {
                 u32 vendor, device;
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index f5af0cc7eb0d..9257bd9dc664 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -856,11 +856,13 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
         dentry = kernfs_mount(fs_type, flags, rdt_root,
                               RDTGROUP_SUPER_MAGIC, NULL);
         if (IS_ERR(dentry))
-                goto out_cdp;
+                goto out_destroy;
 
         static_branch_enable(&rdt_enable_key);
         goto out;
 
+out_destroy:
+        kernfs_remove(kn_info);
 out_cdp:
         cdp_disable();
 out:
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5abd4bf73d6e..5cfbaeb6529a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -499,16 +499,14 @@ static int mce_usable_address(struct mce *m)
         return 1;
 }
 
-static bool memory_error(struct mce *m)
+bool mce_is_memory_error(struct mce *m)
 {
-        struct cpuinfo_x86 *c = &boot_cpu_data;
-
-        if (c->x86_vendor == X86_VENDOR_AMD) {
+        if (m->cpuvendor == X86_VENDOR_AMD) {
                 /* ErrCodeExt[20:16] */
                 u8 xec = (m->status >> 16) & 0x1f;
 
                 return (xec == 0x0 || xec == 0x8);
-        } else if (c->x86_vendor == X86_VENDOR_INTEL) {
+        } else if (m->cpuvendor == X86_VENDOR_INTEL) {
                 /*
                  * Intel SDM Volume 3B - 15.9.2 Compound Error Codes
                  *
@@ -529,6 +527,7 @@ static bool memory_error(struct mce *m)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(mce_is_memory_error);
 
 static bool cec_add_mce(struct mce *m)
 {
@@ -536,7 +535,7 @@ static bool cec_add_mce(struct mce *m)
                 return false;
 
         /* We eat only correctable DRAM errors with usable addresses. */
-        if (memory_error(m) &&
+        if (mce_is_memory_error(m) &&
             !(m->status & MCI_STATUS_UC) &&
             mce_usable_address(m))
                 if (!cec_add_elem(m->addr >> PAGE_SHIFT))
@@ -713,7 +712,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
 
                 severity = mce_severity(&m, mca_cfg.tolerant, NULL, false);
 
-                if (severity == MCE_DEFERRED_SEVERITY && memory_error(&m))
+                if (severity == MCE_DEFERRED_SEVERITY && mce_is_memory_error(&m))
                         if (m.status & MCI_STATUS_ADDRV)
                                 m.severity = severity;
 
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 45db4d2ebd01..e9f4d762aa5b 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -320,7 +320,7 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax)
 }
 
 static enum ucode_state
-load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size);
+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size);
 
 int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
 {
@@ -338,8 +338,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
         if (!desc.mc)
                 return -EINVAL;
 
-        ret = load_microcode_amd(smp_processor_id(), x86_family(cpuid_1_eax),
-                                 desc.data, desc.size);
+        ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
         if (ret != UCODE_OK)
                 return -EINVAL;
 
@@ -675,7 +674,7 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
 }
 
 static enum ucode_state
-load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 {
         enum ucode_state ret;
 
@@ -689,8 +688,8 @@ load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
 
 #ifdef CONFIG_X86_32
         /* save BSP's matching patch for early load */
-        if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) {
-                struct ucode_patch *p = find_patch(cpu);
+        if (save) {
+                struct ucode_patch *p = find_patch(0);
                 if (p) {
                         memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
                         memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
@@ -722,11 +721,12 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
 {
         char fw_name[36] = "amd-ucode/microcode_amd.bin";
         struct cpuinfo_x86 *c = &cpu_data(cpu);
+        bool bsp = c->cpu_index == boot_cpu_data.cpu_index;
         enum ucode_state ret = UCODE_NFOUND;
         const struct firmware *fw;
 
         /* reload ucode container only on the boot cpu */
-        if (!refresh_fw || c->cpu_index != boot_cpu_data.cpu_index)
+        if (!refresh_fw || !bsp)
                 return UCODE_OK;
 
         if (c->x86 >= 0x15)
@@ -743,7 +743,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
                 goto fw_release;
         }
 
-        ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size);
+        ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size);
 
  fw_release:
         release_firmware(fw);
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index afdfd237b59f..f522415bf9e5 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -619,6 +619,9 @@ int __init save_microcode_in_initrd_intel(void)
 
         show_saved_mc();
 
+        /* initrd is going away, clear patch ptr. */
+        intel_ucode_patch = NULL;
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 0651e974dcb3..9bef1bbeba63 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -689,8 +689,12 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return module_alloc(size);
 }
-static inline void tramp_free(void *tramp)
+static inline void tramp_free(void *tramp, int size)
 {
+        int npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+
+        set_memory_nx((unsigned long)tramp, npages);
+        set_memory_rw((unsigned long)tramp, npages);
         module_memfree(tramp);
 }
 #else
@@ -699,7 +703,7 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return NULL;
 }
-static inline void tramp_free(void *tramp) { }
+static inline void tramp_free(void *tramp, int size) { }
 #endif
 
 /* Defined as markers to the end of the ftrace default trampolines */
@@ -771,7 +775,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
         /* Copy ftrace_caller onto the trampoline memory */
         ret = probe_kernel_read(trampoline, (void *)start_offset, size);
         if (WARN_ON(ret < 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -797,7 +801,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 
         /* Are we pointing to the reference? */
         if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -839,7 +843,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         unsigned long offset;
         unsigned long ip;
         unsigned int size;
-        int ret;
+        int ret, npages;
 
         if (ops->trampoline) {
                 /*
@@ -848,11 +852,14 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
                  */
                 if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                         return;
+                npages = PAGE_ALIGN(ops->trampoline_size) >> PAGE_SHIFT;
+                set_memory_rw(ops->trampoline, npages);
         } else {
                 ops->trampoline = create_trampoline(ops, &size);
                 if (!ops->trampoline)
                         return;
                 ops->trampoline_size = size;
+                npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
         }
 
         offset = calc_trampoline_call_offset(ops->flags & FTRACE_OPS_FL_SAVE_REGS);
@@ -863,6 +870,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         /* Do a safe modify in case the trampoline is executing */
         new = ftrace_call_replace(ip, (unsigned long)func);
         ret = update_ftrace_func(ip, new);
+        set_memory_ro(ops->trampoline, npages);
 
         /* The update should never fail */
         WARN_ON(ret);
@@ -939,7 +947,7 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops)
         if (!ops || !(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                 return;
 
-        tramp_free((void *)ops->trampoline);
+        tramp_free((void *)ops->trampoline, ops->trampoline_size);
         ops->trampoline = 0;
 }
 
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 5b2bbfbb3712..6b877807598b 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -52,6 +52,7 @@
 #include <linux/ftrace.h>
 #include <linux/frame.h>
 #include <linux/kasan.h>
+#include <linux/moduleloader.h>
 
 #include <asm/text-patching.h>
 #include <asm/cacheflush.h>
@@ -417,6 +418,14 @@ static void prepare_boost(struct kprobe *p, struct insn *insn)
         }
 }
 
+/* Recover page to RW mode before releasing it */
+void free_insn_page(void *page)
+{
+        set_memory_nx((unsigned long)page & PAGE_MASK, 1);
+        set_memory_rw((unsigned long)page & PAGE_MASK, 1);
+        module_memfree(page);
+}
+
 static int arch_copy_kprobe(struct kprobe *p)
 {
         struct insn insn;
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index da5c09789984..43e10d6fdbed 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -161,8 +161,8 @@ void kvm_async_pf_task_wait(u32 token)
                          */
                         rcu_irq_exit();
                         native_safe_halt();
-                        rcu_irq_enter();
                         local_irq_disable();
+                        rcu_irq_enter();
                 }
         }
         if (!n.halted)
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 0bb88428cbf2..3ca198080ea9 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -545,17 +545,6 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 }
 
 /*
- * Return saved PC of a blocked thread.
- * What is this good for? it will be always the scheduler or ret_from_fork.
- */
-unsigned long thread_saved_pc(struct task_struct *tsk)
-{
-        struct inactive_task_frame *frame =
-                (struct inactive_task_frame *) READ_ONCE(tsk->thread.sp);
-        return READ_ONCE_NOCHECK(frame->ret_addr);
-}
-
-/*
  * Called from fs/proc with a reference on @p to find the function
  * which called into schedule(). This needs to be done carefully
  * because the task might wake up and we might look at a stack
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index ff40e74c9181..ffeae818aa7a 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -78,7 +78,7 @@ void __show_regs(struct pt_regs *regs, int all)
 
         printk(KERN_DEFAULT "EIP: %pS\n", (void *)regs->ip);
         printk(KERN_DEFAULT "EFLAGS: %08lx CPU: %d\n", regs->flags,
-                smp_processor_id());
+                raw_smp_processor_id());
 
         printk(KERN_DEFAULT "EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
                 regs->ax, regs->bx, regs->cx, regs->dx);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 0b4d3c686b1e..f81823695014 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -980,8 +980,6 @@ void __init setup_arch(char **cmdline_p)
          */
         x86_configure_nx();
 
-        simple_udelay_calibration();
-
         parse_early_param();
 
 #ifdef CONFIG_MEMORY_HOTPLUG
@@ -1041,6 +1039,8 @@ void __init setup_arch(char **cmdline_p)
          */
         init_hypervisor_platform();
 
+        simple_udelay_calibration();
+
         x86_init.resources.probe_roms();
 
         /* after parse_early_param, so could debug it */
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 207b8f2582c7..213ddf3e937d 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -144,7 +144,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (end - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -187,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index 4b1724059909..a4eb27918ceb 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -514,7 +514,7 @@ int tboot_force_iommu(void)
         if (!tboot_enabled())
                 return 0;
 
-        if (!intel_iommu_tboot_noforce)
+        if (intel_iommu_tboot_noforce)
                 return 1;
 
         if (no_iommu || swiotlb || dmar_disabled)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 3995d3a777d4..bf54309b85da 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -182,7 +182,7 @@ int is_valid_bugaddr(unsigned long addr)
         return ud == INSN_UD0 || ud == INSN_UD2;
 }
 
-static int fixup_bug(struct pt_regs *regs, int trapnr)
+int fixup_bug(struct pt_regs *regs, int trapnr)
 {
         if (trapnr != X86_TRAP_UD)
                 return 0;
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 82c6d7f1fd73..b9389d72b2f7 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -104,6 +104,11 @@ static inline unsigned long *last_frame(struct unwind_state *state)
         return (unsigned long *)task_pt_regs(state->task) - 2;
 }
 
+static bool is_last_frame(struct unwind_state *state)
+{
+        return state->bp == last_frame(state);
+}
+
 #ifdef CONFIG_X86_32
 #define GCC_REALIGN_WORDS 3
 #else
@@ -115,16 +120,15 @@ static inline unsigned long *last_aligned_frame(struct unwind_state *state)
         return last_frame(state) - GCC_REALIGN_WORDS;
 }
 
-static bool is_last_task_frame(struct unwind_state *state)
+static bool is_last_aligned_frame(struct unwind_state *state)
 {
         unsigned long *last_bp = last_frame(state);
         unsigned long *aligned_bp = last_aligned_frame(state);
 
         /*
-         * We have to check for the last task frame at two different locations
-         * because gcc can occasionally decide to realign the stack pointer and
-         * change the offset of the stack frame in the prologue of a function
-         * called by head/entry code.  Examples:
+         * GCC can occasionally decide to realign the stack pointer and change
+         * the offset of the stack frame in the prologue of a function called
+         * by head/entry code.  Examples:
          *
          * <start_secondary>:
          *      push   %edi
@@ -141,11 +145,38 @@ static bool is_last_task_frame(struct unwind_state *state)
          *      push   %rbp
          *      mov    %rsp,%rbp
          *
-         * Note that after aligning the stack, it pushes a duplicate copy of
-         * the return address before pushing the frame pointer.
+         * After aligning the stack, it pushes a duplicate copy of the return
+         * address before pushing the frame pointer.
+         */
+        return (state->bp == aligned_bp && *(aligned_bp + 1) == *(last_bp + 1));
+}
+
+static bool is_last_ftrace_frame(struct unwind_state *state)
+{
+        unsigned long *last_bp = last_frame(state);
+        unsigned long *last_ftrace_bp = last_bp - 3;
+
+        /*
+         * When unwinding from an ftrace handler of a function called by entry
+         * code, the stack layout of the last frame is:
+         *
+         *   bp
+         *   parent ret addr
+         *   bp
+         *   function ret addr
+         *   parent ret addr
+         *   pt_regs
+         *   -----------------
          */
-        return (state->bp == last_bp ||
-                (state->bp == aligned_bp && *(aligned_bp+1) == *(last_bp+1)));
+        return (state->bp == last_ftrace_bp &&
+                *state->bp == *(state->bp + 2) &&
+                *(state->bp + 1) == *(state->bp + 4));
+}
+
+static bool is_last_task_frame(struct unwind_state *state)
+{
+        return is_last_frame(state) || is_last_aligned_frame(state) ||
+               is_last_ftrace_frame(state);
 }
 
 /*
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index a181ae76c71c..59ca2eea522c 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -780,18 +780,20 @@ out:
 static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i)
 {
         struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i];
-        int j, nent = vcpu->arch.cpuid_nent;
+        struct kvm_cpuid_entry2 *ej;
+        int j = i;
+        int nent = vcpu->arch.cpuid_nent;
 
         e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
         /* when no next entry is found, the current entry[i] is reselected */
-        for (j = i + 1; ; j = (j + 1) % nent) {
-                struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
-                if (ej->function == e->function) {
-                        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
-                        return j;
-                }
-        }
-        return 0; /* silence gcc, even though control never reaches here */
+        do {
+                j = (j + 1) % nent;
+                ej = &vcpu->arch.cpuid_entries[j];
+        } while (ej->function != e->function);
+
+        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+
+        return j;
 }
 
 /* find an entry with matching function, matching index (if needed), and that
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 0816ab2e8adc..80890dee66ce 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2742,6 +2742,7 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt)
                 ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF);
         }
 
+        ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
         return X86EMUL_CONTINUE;
 }
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index c329d2894905..d24c8742d9b0 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1495,8 +1495,10 @@ EXPORT_SYMBOL_GPL(kvm_lapic_hv_timer_in_use);
 
 static void cancel_hv_timer(struct kvm_lapic *apic)
 {
+        preempt_disable();
         kvm_x86_ops->cancel_hv_timer(apic->vcpu);
         apic->lapic_timer.hv_timer_in_use = false;
+        preempt_enable();
 }
 
 static bool start_hv_timer(struct kvm_lapic *apic)
@@ -1934,7 +1936,8 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
         for (i = 0; i < KVM_APIC_LVT_NUM; i++)
                 kvm_lapic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
         apic_update_lvtt(apic);
-        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
+        if (kvm_vcpu_is_reset_bsp(vcpu) &&
+            kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
                 kvm_lapic_set_reg(apic, APIC_LVT0,
                              SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
         apic_manage_nmi_watchdog(apic, kvm_lapic_get_reg(apic, APIC_LVT0));
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 5d3376f67794..cb8225969255 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3698,12 +3698,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
         return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
 }
 
-static bool can_do_async_pf(struct kvm_vcpu *vcpu)
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
 {
         if (unlikely(!lapic_in_kernel(vcpu) ||
                      kvm_event_needs_reinjection(vcpu)))
                 return false;
 
+        if (is_guest_mode(vcpu))
+                return false;
+
         return kvm_x86_ops->interrupt_allowed(vcpu);
 }
 
@@ -3719,7 +3722,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
         if (!async)
                 return false; /* *pfn has correct page already */
 
-        if (!prefault && can_do_async_pf(vcpu)) {
+        if (!prefault && kvm_can_do_async_pf(vcpu)) {
                 trace_kvm_try_async_get_page(gva, gfn);
                 if (kvm_find_async_pf_gfn(vcpu, gfn)) {
                         trace_kvm_async_pf_doublefault(gva, gfn);
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 27975807cc64..330bf3a811fb 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -76,6 +76,7 @@ int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu);
 void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
                              bool accessed_dirty);
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 183ddb235fb4..ba9891ac5c56 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1807,7 +1807,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
          * AMD's VMCB does not have an explicit unusable field, so emulate it
          * for cross vendor migration purposes by "not present"
          */
-        var->unusable = !var->present || (var->type == 0);
+        var->unusable = !var->present;
 
         switch (seg) {
         case VCPU_SREG_TR:
@@ -1840,6 +1840,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
                  */
                 if (var->unusable)
                         var->db = 0;
+                /* This is symmetric with svm_set_segment() */
                 var->dpl = to_svm(vcpu)->vmcb->save.cpl;
                 break;
         }
@@ -1980,18 +1981,14 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
         s->base = var->base;
         s->limit = var->limit;
         s->selector = var->selector;
-        if (var->unusable)
-                s->attrib = 0;
-        else {
-                s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
-                s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
-                s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
-                s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
-                s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
-                s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
-                s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
-                s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
-        }
+        s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
+        s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
+        s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
+        s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT;
+        s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
+        s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
+        s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
+        s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
 
         /*
          * This is always accurate, except if SYSRET returned to a segment
@@ -2000,7 +1997,8 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
          * would entail passing the CPL to userspace and back.
          */
         if (seg == VCPU_SREG_SS)
-                svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
+                /* This is symmetric with svm_get_segment() */
+                svm->vmcb->save.cpl = (var->dpl & 3);
 
         mark_dirty(svm->vmcb, VMCB_SEG);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 72f78396bc09..ca5d2b93385c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2425,7 +2425,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr)
         if (!(vmcs12->exception_bitmap & (1u << nr)))
                 return 0;
 
-        nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason,
+        nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                           vmcs_read32(VM_EXIT_INTR_INFO),
                           vmcs_readl(EXIT_QUALIFICATION));
         return 1;
@@ -6914,97 +6914,21 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
         return 0;
 }
 
-/*
- * This function performs the various checks including
- * - if it's 4KB aligned
- * - No bits beyond the physical address width are set
- * - Returns 0 on success or else 1
- * (Intel SDM Section 30.3)
- */
-static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
-                                  gpa_t *vmpointer)
+static int nested_vmx_get_vmptr(struct kvm_vcpu *vcpu, gpa_t *vmpointer)
 {
         gva_t gva;
-        gpa_t vmptr;
         struct x86_exception e;
-        struct page *page;
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
-        int maxphyaddr = cpuid_maxphyaddr(vcpu);
 
         if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
                         vmcs_read32(VMX_INSTRUCTION_INFO), false, &gva))
                 return 1;
 
-        if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, &vmptr,
-                                sizeof(vmptr), &e)) {
+        if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, vmpointer,
+                                sizeof(*vmpointer), &e)) {
                 kvm_inject_page_fault(vcpu, &e);
                 return 1;
         }
 
-        switch (exit_reason) {
-        case EXIT_REASON_VMON:
-                /*
-                 * SDM 3: 24.11.5
-                 * The first 4 bytes of VMXON region contain the supported
-                 * VMCS revision identifier
-                 *
-                 * Note - IA32_VMX_BASIC[48] will never be 1
-                 * for the nested case;
-                 * which replaces physical address width with 32
-                 *
-                 */
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                page = nested_get_page(vcpu, vmptr);
-                if (page == NULL) {
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                if (*(u32 *)kmap(page) != VMCS12_REVISION) {
-                        kunmap(page);
-                        nested_release_page_clean(page);
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                kunmap(page);
-                nested_release_page_clean(page);
-                vmx->nested.vmxon_ptr = vmptr;
-                break;
-        case EXIT_REASON_VMCLEAR:
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMCLEAR_INVALID_ADDRESS);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                if (vmptr == vmx->nested.vmxon_ptr) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMCLEAR_VMXON_POINTER);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                break;
-        case EXIT_REASON_VMPTRLD:
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMPTRLD_INVALID_ADDRESS);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                if (vmptr == vmx->nested.vmxon_ptr) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMPTRLD_VMXON_POINTER);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                break;
-        default:
-                return 1; /* shouldn't happen */
-        }
-
-        if (vmpointer)
-                *vmpointer = vmptr;
         return 0;
 }
 
@@ -7066,6 +6990,8 @@ out_msr_bitmap:
 static int handle_vmon(struct kvm_vcpu *vcpu)
 {
         int ret;
+        gpa_t vmptr;
+        struct page *page;
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED
                 | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
@@ -7095,9 +7021,37 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 return 1;
         }
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMON, NULL))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
- 
+
+        /*
+         * SDM 3: 24.11.5
+         * The first 4 bytes of VMXON region contain the supported
+         * VMCS revision identifier
+         *
+         * Note - IA32_VMX_BASIC[48] will never be 1 for the nested case;
+         * which replaces physical address width with 32
+         */
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        page = nested_get_page(vcpu, vmptr);
+        if (page == NULL) {
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+        if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+                kunmap(page);
+                nested_release_page_clean(page);
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+        kunmap(page);
+        nested_release_page_clean(page);
+
+        vmx->nested.vmxon_ptr = vmptr;
         ret = enter_vmx_operation(vcpu);
         if (ret)
                 return ret;
@@ -7213,9 +7167,19 @@ static int handle_vmclear(struct kvm_vcpu *vcpu)
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMCLEAR, &vmptr))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
 
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_INVALID_ADDRESS);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        if (vmptr == vmx->nested.vmxon_ptr) {
+                nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_VMXON_POINTER);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
         if (vmptr == vmx->nested.current_vmptr)
                 nested_release_vmcs12(vmx);
 
@@ -7545,9 +7509,19 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMPTRLD, &vmptr))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
 
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_INVALID_ADDRESS);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        if (vmptr == vmx->nested.vmxon_ptr) {
+                nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
         if (vmx->nested.current_vmptr != vmptr) {
                 struct vmcs12 *new_vmcs12;
                 struct page *page;
@@ -7913,11 +7887,13 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
 {
         unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         int cr = exit_qualification & 15;
-        int reg = (exit_qualification >> 8) & 15;
-        unsigned long val = kvm_register_readl(vcpu, reg);
+        int reg;
+        unsigned long val;
 
         switch ((exit_qualification >> 4) & 3) {
         case 0: /* mov to cr */
+                reg = (exit_qualification >> 8) & 15;
+                val = kvm_register_readl(vcpu, reg);
                 switch (cr) {
                 case 0:
                         if (vmcs12->cr0_guest_host_mask &
@@ -7972,6 +7948,7 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
                  * lmsw can change bits 1..3 of cr0, and only set bit 0 of
                  * cr0. Other attempted changes are ignored, with no exit.
                  */
+                val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
                 if (vmcs12->cr0_guest_host_mask & 0xe &
                     (val ^ vmcs12->cr0_read_shadow))
                         return true;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02363e37d4a6..0e846f0cb83b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5313,6 +5313,8 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu)
         kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
 
         ctxt->eflags = kvm_get_rflags(vcpu);
+        ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
+
         ctxt->eip = kvm_rip_read(vcpu);
         ctxt->mode = (!is_protmode(vcpu))               ? X86EMUL_MODE_REAL :
                      (ctxt->eflags & X86_EFLAGS_VM)     ? X86EMUL_MODE_VM86 :
@@ -5528,36 +5530,25 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
         return dr6;
 }
 
-static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r)
+static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r)
 {
         struct kvm_run *kvm_run = vcpu->run;
 
-        /*
-         * rflags is the old, "raw" value of the flags.  The new value has
-         * not been saved yet.
-         *
-         * This is correct even for TF set by the guest, because "the
-         * processor will not generate this exception after the instruction
-         * that sets the TF flag".
-         */
-        if (unlikely(rflags & X86_EFLAGS_TF)) {
-                if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
-                        kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 |
-                                                  DR6_RTM;
-                        kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
-                        kvm_run->debug.arch.exception = DB_VECTOR;
-                        kvm_run->exit_reason = KVM_EXIT_DEBUG;
-                        *r = EMULATE_USER_EXIT;
-                } else {
-                        /*
-                         * "Certain debug exceptions may clear bit 0-3.  The
-                         * remaining contents of the DR6 register are never
-                         * cleared by the processor".
-                         */
-                        vcpu->arch.dr6 &= ~15;
-                        vcpu->arch.dr6 |= DR6_BS | DR6_RTM;
-                        kvm_queue_exception(vcpu, DB_VECTOR);
-                }
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+                kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM;
+                kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
+                kvm_run->debug.arch.exception = DB_VECTOR;
+                kvm_run->exit_reason = KVM_EXIT_DEBUG;
+                *r = EMULATE_USER_EXIT;
+        } else {
+                /*
+                 * "Certain debug exceptions may clear bit 0-3.  The
+                 * remaining contents of the DR6 register are never
+                 * cleared by the processor".
+                 */
+                vcpu->arch.dr6 &= ~15;
+                vcpu->arch.dr6 |= DR6_BS | DR6_RTM;
+                kvm_queue_exception(vcpu, DB_VECTOR);
         }
 }
 
@@ -5567,7 +5558,17 @@ int kvm_skip_emulated_instruction(struct kvm_vcpu *vcpu)
         int r = EMULATE_DONE;
 
         kvm_x86_ops->skip_emulated_instruction(vcpu);
-        kvm_vcpu_check_singlestep(vcpu, rflags, &r);
+
+        /*
+         * rflags is the old, "raw" value of the flags.  The new value has
+         * not been saved yet.
+         *
+         * This is correct even for TF set by the guest, because "the
+         * processor will not generate this exception after the instruction
+         * that sets the TF flag".
+         */
+        if (unlikely(rflags & X86_EFLAGS_TF))
+                kvm_vcpu_do_singlestep(vcpu, &r);
         return r == EMULATE_DONE;
 }
 EXPORT_SYMBOL_GPL(kvm_skip_emulated_instruction);
@@ -5726,8 +5727,9 @@ restart:
                 toggle_interruptibility(vcpu, ctxt->interruptibility);
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                 kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE)
-                        kvm_vcpu_check_singlestep(vcpu, rflags, &r);
+                if (r == EMULATE_DONE &&
+                    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
+                        kvm_vcpu_do_singlestep(vcpu, &r);
                 if (!ctxt->have_exception ||
                     exception_type(ctxt->exception.vector) == EXCPT_TRAP)
                         __kvm_set_rflags(vcpu, ctxt->eflags);
@@ -8394,10 +8396,13 @@ static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu)
         if (vcpu->arch.pv.pv_unhalted)
                 return true;
 
-        if (atomic_read(&vcpu->arch.nmi_queued))
+        if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
+            (vcpu->arch.nmi_pending &&
+             kvm_x86_ops->nmi_allowed(vcpu)))
                 return true;
 
-        if (kvm_test_request(KVM_REQ_SMI, vcpu))
+        if (kvm_test_request(KVM_REQ_SMI, vcpu) ||
+            (vcpu->arch.smi_pending && !is_smm(vcpu)))
                 return true;
 
         if (kvm_arch_interrupt_allowed(vcpu) &&
@@ -8604,8 +8609,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
         if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED))
                 return true;
         else
-                return !kvm_event_needs_reinjection(vcpu) &&
-                        kvm_x86_ops->interrupt_allowed(vcpu);
+                return kvm_can_do_async_pf(vcpu);
 }
 
 void kvm_arch_start_assignment(struct kvm *kvm)
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 35ea061010a1..0ea8afcb929c 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -162,6 +162,9 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
         if (fixup_exception(regs, trapnr))
                 return;
 
+        if (fixup_bug(regs, trapnr))
+                return;
+
 fail:
         early_printk("PANIC: early exception 0x%02x IP %lx:%lx error %lx cr2 0x%lx\n",
                      (unsigned)trapnr, (unsigned long)regs->cs, regs->ip,
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 302f43fd9c28..adad702b39cd 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -148,7 +148,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index cbc87ea98751..9b3f9fa5b283 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -161,16 +161,16 @@ static int page_size_mask;
 
 static void __init probe_page_size_mask(void)
 {
-#if !defined(CONFIG_KMEMCHECK)
         /*
          * For CONFIG_KMEMCHECK or pagealloc debugging, identity mapping will
          * use small pages.
          * This will simplify cpa(), which otherwise needs to support splitting
          * large pages into small in interrupt context, etc.
          */
-        if (boot_cpu_has(X86_FEATURE_PSE) && !debug_pagealloc_enabled())
+        if (boot_cpu_has(X86_FEATURE_PSE) && !debug_pagealloc_enabled() && !IS_ENABLED(CONFIG_KMEMCHECK))
                 page_size_mask |= 1 << PG_LEVEL_2M;
-#endif
+        else
+                direct_gbpages = 0;
 
         /* Enable PSE if available */
         if (boot_cpu_has(X86_FEATURE_PSE))
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 95651dc58e09..0a59daf799f8 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -990,7 +990,13 @@ remove_p4d_table(p4d_t *p4d_start, unsigned long addr, unsigned long end,
 
                 pud_base = pud_offset(p4d, 0);
                 remove_pud_table(pud_base, addr, next, direct);
-                free_pud_table(pud_base, p4d);
+                /*
+                 * For 4-level page tables we do not want to free PUDs, but in the
+                 * 5-level case we should free them. This code will have to change
+                 * to adapt for boot-time switching between 4 and 5 level page tables.
+                 */
+                if (CONFIG_PGTABLE_LEVELS == 5)
+                        free_pud_table(pud_base, p4d);
         }
 
         if (direct)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 1dcd2be4cce4..c8520b2c62d2 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -186,7 +186,7 @@ static void cpa_flush_range(unsigned long start, int numpages, int cache)
         unsigned int i, level;
         unsigned long addr;
 
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
         WARN_ON(PAGE_ALIGN(start) != start);
 
         on_each_cpu(__cpa_flush_range, NULL, 1);
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 7e76a4d8304b..43b96f5f78ba 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -828,9 +828,11 @@ static void __init kexec_enter_virtual_mode(void)
 
         /*
          * We don't do virtual mode, since we don't do runtime services, on
-         * non-native EFI
+         * non-native EFI. With efi=old_map, we don't do runtime services in
+         * kexec kernel because in the initial boot something else might
+         * have been mapped at these virtual addresses.
          */
-        if (!efi_is_native()) {
+        if (!efi_is_native() || efi_enabled(EFI_OLD_MEMMAP)) {
                 efi_memmap_unmap();
                 clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
                 return;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index c488625c9712..eb8dff15a7f6 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -71,11 +71,13 @@ static void __init early_code_mapping_set_exec(int executable)
 
 pgd_t * __init efi_call_phys_prolog(void)
 {
-        unsigned long vaddress;
-        pgd_t *save_pgd;
+        unsigned long vaddr, addr_pgd, addr_p4d, addr_pud;
+        pgd_t *save_pgd, *pgd_k, *pgd_efi;
+        p4d_t *p4d, *p4d_k, *p4d_efi;
+        pud_t *pud;
 
         int pgd;
-        int n_pgds;
+        int n_pgds, i, j;
 
         if (!efi_enabled(EFI_OLD_MEMMAP)) {
                 save_pgd = (pgd_t *)read_cr3();
@@ -88,10 +90,49 @@ pgd_t * __init efi_call_phys_prolog(void)
         n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
         save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
 
+        /*
+         * Build 1:1 identity mapping for efi=old_map usage. Note that
+         * PAGE_OFFSET is PGDIR_SIZE aligned when KASLR is disabled, while
+         * it is PUD_SIZE ALIGNED with KASLR enabled. So for a given physical
+         * address X, the pud_index(X) != pud_index(__va(X)), we can only copy
+         * PUD entry of __va(X) to fill in pud entry of X to build 1:1 mapping.
+         * This means here we can only reuse the PMD tables of the direct mapping.
+         */
         for (pgd = 0; pgd < n_pgds; pgd++) {
-                save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE);
-                vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
-                set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
+                addr_pgd = (unsigned long)(pgd * PGDIR_SIZE);
+                vaddr = (unsigned long)__va(pgd * PGDIR_SIZE);
+                pgd_efi = pgd_offset_k(addr_pgd);
+                save_pgd[pgd] = *pgd_efi;
+
+                p4d = p4d_alloc(&init_mm, pgd_efi, addr_pgd);
+                if (!p4d) {
+                        pr_err("Failed to allocate p4d table!\n");
+                        goto out;
+                }
+
+                for (i = 0; i < PTRS_PER_P4D; i++) {
+                        addr_p4d = addr_pgd + i * P4D_SIZE;
+                        p4d_efi = p4d + p4d_index(addr_p4d);
+
+                        pud = pud_alloc(&init_mm, p4d_efi, addr_p4d);
+                        if (!pud) {
+                                pr_err("Failed to allocate pud table!\n");
+                                goto out;
+                        }
+
+                        for (j = 0; j < PTRS_PER_PUD; j++) {
+                                addr_pud = addr_p4d + j * PUD_SIZE;
+
+                                if (addr_pud > (max_pfn << PAGE_SHIFT))
+                                        break;
+
+                                vaddr = (unsigned long)__va(addr_pud);
+
+                                pgd_k = pgd_offset_k(vaddr);
+                                p4d_k = p4d_offset(pgd_k, vaddr);
+                                pud[j] = *pud_offset(p4d_k, vaddr);
+                        }
+                }
         }
 out:
         __flush_tlb_all();
@@ -104,8 +145,11 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
         /*
          * After the lock is released, the original page table is restored.
          */
-        int pgd_idx;
+        int pgd_idx, i;
         int nr_pgds;
+        pgd_t *pgd;
+        p4d_t *p4d;
+        pud_t *pud;
 
         if (!efi_enabled(EFI_OLD_MEMMAP)) {
                 write_cr3((unsigned long)save_pgd);
@@ -115,9 +159,28 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
 
         nr_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
 
-        for (pgd_idx = 0; pgd_idx < nr_pgds; pgd_idx++)
+        for (pgd_idx = 0; pgd_idx < nr_pgds; pgd_idx++) {
+                pgd = pgd_offset_k(pgd_idx * PGDIR_SIZE);
                 set_pgd(pgd_offset_k(pgd_idx * PGDIR_SIZE), save_pgd[pgd_idx]);
 
+                if (!(pgd_val(*pgd) & _PAGE_PRESENT))
+                        continue;
+
+                for (i = 0; i < PTRS_PER_P4D; i++) {
+                        p4d = p4d_offset(pgd,
+                                         pgd_idx * PGDIR_SIZE + i * P4D_SIZE);
+
+                        if (!(p4d_val(*p4d) & _PAGE_PRESENT))
+                                continue;
+
+                        pud = (pud_t *)p4d_page_vaddr(*p4d);
+                        pud_free(&init_mm, pud);
+                }
+
+                p4d = (p4d_t *)pgd_page_vaddr(*pgd);
+                p4d_free(&init_mm, p4d);
+        }
+
         kfree(save_pgd);
 
         __flush_tlb_all();
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 26615991d69c..e0cf95a83f3f 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -360,6 +360,9 @@ void __init efi_free_boot_services(void)
                 free_bootmem_late(start, size);
         }
 
+        if (!num_entries)
+                return;
+
         new_size = efi.memmap.desc_size * num_entries;
         new_phys = efi_memmap_alloc(num_entries);
         if (!new_phys) {
diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h
index f71f88ea7646..19707db966f1 100644
--- a/arch/xtensa/include/asm/irq.h
+++ b/arch/xtensa/include/asm/irq.h
@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { }
 # define PLATFORM_NR_IRQS 0
 #endif
 #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS
-#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS)
+#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1)
+#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1)
 
 #if VARIANT_NR_IRQS == 0
 static inline void variant_init_irq(void) { }
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index 003eeee3fbc6..30ee8c608853 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -213,8 +213,6 @@ struct mm_struct;
 #define release_segments(mm)    do { } while(0)
 #define forget_segments()       do { } while (0)
 
-#define thread_saved_pc(tsk)    (task_pt_regs(tsk)->pc)
-
 extern unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)           (task_pt_regs(tsk)->pc)
diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index a265edd6ac37..99341028cc77 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs)
 {
         int irq = irq_find_mapping(NULL, hwirq);
 
-        if (hwirq >= NR_IRQS) {
-                printk(KERN_EMERG "%s: cannot handle IRQ %d\n",
-                                __func__, hwirq);
-        }
-
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* Debugging check for stack overflow: is there less than 1KB free? */
         {
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 394ef08300b6..33bfa5270d95 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -593,8 +593,7 @@ c_show(struct seq_file *f, void *slot)
                       (ccount_freq/10000) % 100,
                       loops_per_jiffy/(500000/HZ),
                       (loops_per_jiffy/(5000/HZ)) % 100);
-
-        seq_printf(f,"flags\t\t: "
+        seq_puts(f, "flags\t\t: "
 #if XCHAL_HAVE_NMI
                      "nmi "
 #endif
diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c
index 06937928cb72..74afbf02d07e 100644
--- a/arch/xtensa/kernel/syscall.c
+++ b/arch/xtensa/kernel/syscall.c
@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 /* At this point:  (!vmm || addr < vmm->vm_end). */
                 if (TASK_SIZE - len < addr)
                         return -ENOMEM;
-                if (!vmm || addr + len <= vmm->vm_start)
+                if (!vmm || addr + len <= vm_start_gap(vmm))
                         return addr;
                 addr = vmm->vm_end;
                 if (flags & MAP_SHARED)
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index 30d9fc21e076..162c77e53ca8 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -118,7 +118,7 @@ SECTIONS
   SECTION_VECTOR (.KernelExceptionVector.text, KERNEL_VECTOR_VADDR)
   SECTION_VECTOR (.UserExceptionVector.literal, USER_VECTOR_VADDR - 4)
   SECTION_VECTOR (.UserExceptionVector.text, USER_VECTOR_VADDR)
-  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 48)
+  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 20)
   SECTION_VECTOR (.DoubleExceptionVector.text, DOUBLEEXC_VECTOR_VADDR)
 #endif
 
@@ -306,13 +306,13 @@ SECTIONS
                   .UserExceptionVector.literal)
   SECTION_VECTOR (_DoubleExceptionVector_literal,
                   .DoubleExceptionVector.literal,
-                  DOUBLEEXC_VECTOR_VADDR - 48,
+                  DOUBLEEXC_VECTOR_VADDR - 20,
                   SIZEOF(.UserExceptionVector.text),
                   .UserExceptionVector.text)
   SECTION_VECTOR (_DoubleExceptionVector_text,
                   .DoubleExceptionVector.text,
                   DOUBLEEXC_VECTOR_VADDR,
-                  48,
+                  20,
                   .DoubleExceptionVector.literal)
 
   . = (LOADADDR( .DoubleExceptionVector.text ) + SIZEOF( .DoubleExceptionVector.text ) + 3) & ~ 3;
diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c
index 02e94bb3ad3e..c45b90bb9339 100644
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -317,8 +317,7 @@ static int __init simdisk_init(void)
         if (simdisk_count > MAX_SIMDISK_COUNT)
                 simdisk_count = MAX_SIMDISK_COUNT;
 
-        sddev = kmalloc(simdisk_count * sizeof(struct simdisk),
-                        GFP_KERNEL);
+        sddev = kmalloc_array(simdisk_count, sizeof(*sddev), GFP_KERNEL);
         if (sddev == NULL)
                 goto out_unregister;
 
diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
index dbeea2b440a1..1fda7e20dfcb 100644
--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
@@ -24,16 +24,18 @@
 
 /* Interrupt configuration. */
 
-#define PLATFORM_NR_IRQS        10
+#define PLATFORM_NR_IRQS        0
 
 /* Default assignment of LX60 devices to external interrupts. */
 
 #ifdef CONFIG_XTENSA_MX
 #define DUART16552_INTNUM       XCHAL_EXTINT3_NUM
 #define OETH_IRQ                XCHAL_EXTINT4_NUM
+#define C67X00_IRQ              XCHAL_EXTINT8_NUM
 #else
 #define DUART16552_INTNUM       XCHAL_EXTINT0_NUM
 #define OETH_IRQ                XCHAL_EXTINT1_NUM
+#define C67X00_IRQ              XCHAL_EXTINT5_NUM
 #endif
 
 /*
@@ -63,5 +65,5 @@
 
 #define C67X00_PADDR            (XCHAL_KIO_PADDR + 0x0D0D0000)
 #define C67X00_SIZE             0x10
-#define C67X00_IRQ              5
+
 #endif /* __XTENSA_XTAVNET_HARDWARE_H */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 779be723eb2b..42285f35d313 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -175,8 +175,8 @@ static struct resource ethoc_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [2] = { /* IRQ number */
-                .start = OETH_IRQ,
-                .end   = OETH_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -213,8 +213,8 @@ static struct resource c67x00_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = { /* IRQ number */
-                .start = C67X00_IRQ,
-                .end   = C67X00_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -247,7 +247,7 @@ static struct resource serial_resource = {
 static struct plat_serial8250_port serial_platform_data[] = {
         [0] = {
                 .mapbase        = DUART16552_PADDR,
-                .irq            = DUART16552_INTNUM,
+                .irq            = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM),
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST |
                                   UPF_IOREMAP,
                 .iotype         = XCHAL_HAVE_BE ? UPIO_MEM32BE : UPIO_MEM32,
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index c8a32fb345cf..78b2e0db4fb2 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -52,7 +52,7 @@ BFQG_FLAG_FNS(idling)
 BFQG_FLAG_FNS(empty)
 #undef BFQG_FLAG_FNS
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -67,7 +67,7 @@ static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
         bfqg_stats_clear_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
                                                  struct bfq_group *curr_bfqg)
 {
@@ -81,7 +81,7 @@ static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
         bfqg_stats_mark_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_end_empty_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -203,12 +203,30 @@ struct bfq_group *bfqq_group(struct bfq_queue *bfqq)
 
 static void bfqg_get(struct bfq_group *bfqg)
 {
-        return blkg_get(bfqg_to_blkg(bfqg));
+        bfqg->ref++;
 }
 
 void bfqg_put(struct bfq_group *bfqg)
 {
-        return blkg_put(bfqg_to_blkg(bfqg));
+        bfqg->ref--;
+
+        if (bfqg->ref == 0)
+                kfree(bfqg);
+}
+
+static void bfqg_and_blkg_get(struct bfq_group *bfqg)
+{
+        /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */
+        bfqg_get(bfqg);
+
+        blkg_get(bfqg_to_blkg(bfqg));
+}
+
+void bfqg_and_blkg_put(struct bfq_group *bfqg)
+{
+        bfqg_put(bfqg);
+
+        blkg_put(bfqg_to_blkg(bfqg));
 }
 
 void bfqg_stats_update_io_add(struct bfq_group *bfqg, struct bfq_queue *bfqq,
@@ -312,7 +330,11 @@ void bfq_init_entity(struct bfq_entity *entity, struct bfq_group *bfqg)
         if (bfqq) {
                 bfqq->ioprio = bfqq->new_ioprio;
                 bfqq->ioprio_class = bfqq->new_ioprio_class;
-                bfqg_get(bfqg);
+                /*
+                 * Make sure that bfqg and its associated blkg do not
+                 * disappear before entity.
+                 */
+                bfqg_and_blkg_get(bfqg);
         }
         entity->parent = bfqg->my_entity; /* NULL for root group */
         entity->sched_data = &bfqg->sched_data;
@@ -399,6 +421,8 @@ struct blkg_policy_data *bfq_pd_alloc(gfp_t gfp, int node)
                 return NULL;
         }
 
+        /* see comments in bfq_bic_update_cgroup for why refcounting */
+        bfqg_get(bfqg);
         return &bfqg->pd;
 }
 
@@ -426,7 +450,7 @@ void bfq_pd_free(struct blkg_policy_data *pd)
         struct bfq_group *bfqg = pd_to_bfqg(pd);
 
         bfqg_stats_exit(&bfqg->stats);
-        return kfree(bfqg);
+        bfqg_put(bfqg);
 }
 
 void bfq_pd_reset_stats(struct blkg_policy_data *pd)
@@ -496,9 +520,10 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
  * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
  * it on the new one.  Avoid putting the entity on the old group idle tree.
  *
- * Must be called under the queue lock; the cgroup owning @bfqg must
- * not disappear (by now this just means that we are called under
- * rcu_read_lock()).
+ * Must be called under the scheduler lock, to make sure that the blkg
+ * owning @bfqg does not disappear (see comments in
+ * bfq_bic_update_cgroup on guaranteeing the consistency of blkg
+ * objects).
  */
 void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                    struct bfq_group *bfqg)
@@ -519,16 +544,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                 bfq_deactivate_bfqq(bfqd, bfqq, false, false);
         else if (entity->on_st)
                 bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
-        bfqg_put(bfqq_group(bfqq));
+        bfqg_and_blkg_put(bfqq_group(bfqq));
 
-        /*
-         * Here we use a reference to bfqg.  We don't need a refcounter
-         * as the cgroup reference will not be dropped, so that its
-         * destroy() callback will not be invoked.
-         */
         entity->parent = bfqg->my_entity;
         entity->sched_data = &bfqg->sched_data;
-        bfqg_get(bfqg);
+        /* pin down bfqg and its associated blkg  */
+        bfqg_and_blkg_get(bfqg);
 
         if (bfq_bfqq_busy(bfqq)) {
                 bfq_pos_tree_add_move(bfqd, bfqq);
@@ -545,8 +566,9 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
  * @bic: the bic to move.
  * @blkcg: the blk-cgroup to move to.
  *
- * Move bic to blkcg, assuming that bfqd->queue is locked; the caller
- * has to make sure that the reference to cgroup is valid across the call.
+ * Move bic to blkcg, assuming that bfqd->lock is held; which makes
+ * sure that the reference to cgroup is valid across the call (see
+ * comments in bfq_bic_update_cgroup on this issue)
  *
  * NOTE: an alternative approach might have been to store the current
  * cgroup in bfqq and getting a reference to it, reducing the lookup
@@ -604,6 +626,57 @@ void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)
                 goto out;
 
         bfqg = __bfq_bic_change_cgroup(bfqd, bic, bio_blkcg(bio));
+        /*
+         * Update blkg_path for bfq_log_* functions. We cache this
+         * path, and update it here, for the following
+         * reasons. Operations on blkg objects in blk-cgroup are
+         * protected with the request_queue lock, and not with the
+         * lock that protects the instances of this scheduler
+         * (bfqd->lock). This exposes BFQ to the following sort of
+         * race.
+         *
+         * The blkg_lookup performed in bfq_get_queue, protected
+         * through rcu, may happen to return the address of a copy of
+         * the original blkg. If this is the case, then the
+         * bfqg_and_blkg_get performed in bfq_get_queue, to pin down
+         * the blkg, is useless: it does not prevent blk-cgroup code
+         * from destroying both the original blkg and all objects
+         * directly or indirectly referred by the copy of the
+         * blkg.
+         *
+         * On the bright side, destroy operations on a blkg invoke, as
+         * a first step, hooks of the scheduler associated with the
+         * blkg. And these hooks are executed with bfqd->lock held for
+         * BFQ. As a consequence, for any blkg associated with the
+         * request queue this instance of the scheduler is attached
+         * to, we are guaranteed that such a blkg is not destroyed, and
+         * that all the pointers it contains are consistent, while we
+         * are holding bfqd->lock. A blkg_lookup performed with
+         * bfqd->lock held then returns a fully consistent blkg, which
+         * remains consistent until this lock is held.
+         *
+         * Thanks to the last fact, and to the fact that: (1) bfqg has
+         * been obtained through a blkg_lookup in the above
+         * assignment, and (2) bfqd->lock is being held, here we can
+         * safely use the policy data for the involved blkg (i.e., the
+         * field bfqg->pd) to get to the blkg associated with bfqg,
+         * and then we can safely use any field of blkg. After we
+         * release bfqd->lock, even just getting blkg through this
+         * bfqg may cause dangling references to be traversed, as
+         * bfqg->pd may not exist any more.
+         *
+         * In view of the above facts, here we cache, in the bfqg, any
+         * blkg data we may need for this bic, and for its associated
+         * bfq_queue. As of now, we need to cache only the path of the
+         * blkg, which is used in the bfq_log_* functions.
+         *
+         * Finally, note that bfqg itself needs to be protected from
+         * destruction on the blkg_free of the original blkg (which
+         * invokes bfq_pd_free). We use an additional private
+         * refcounter for bfqg, to let it disappear only after no
+         * bfq_queue refers to it any longer.
+         */
+        blkg_path(bfqg_to_blkg(bfqg), bfqg->blkg_path, sizeof(bfqg->blkg_path));
         bic->blkcg_serial_nr = serial_nr;
 out:
         rcu_read_unlock();
@@ -640,8 +713,6 @@ static void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
  * @bfqd: the device data structure with the root group.
  * @bfqg: the group to move from.
  * @st: the service tree with the entities.
- *
- * Needs queue_lock to be taken and reference to be valid over the call.
  */
 static void bfq_reparent_active_entities(struct bfq_data *bfqd,
                                          struct bfq_group *bfqg,
@@ -692,8 +763,7 @@ void bfq_pd_offline(struct blkg_policy_data *pd)
                 /*
                  * The idle tree may still contain bfq_queues belonging
                  * to exited task because they never migrated to a different
-                 * cgroup from the one being destroyed now.  No one else
-                 * can access them so it's safe to act without any lock.
+                 * cgroup from the one being destroyed now.
                  */
                 bfq_flush_idle_tree(st);
 
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 08ce45096350..ed93da2462ab 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -3665,7 +3665,7 @@ void bfq_put_queue(struct bfq_queue *bfqq)
 
         kmem_cache_free(bfq_pool, bfqq);
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-        bfqg_put(bfqg);
+        bfqg_and_blkg_put(bfqg);
 #endif
 }
 
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index ae783c06dfd9..5c3bf9861492 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -759,6 +759,12 @@ struct bfq_group {
         /* must be the first member */
         struct blkg_policy_data pd;
 
+        /* cached path for this blkg (see comments in bfq_bic_update_cgroup) */
+        char blkg_path[128];
+
+        /* reference counter (see comments in bfq_bic_update_cgroup) */
+        int ref;
+
         struct bfq_entity entity;
         struct bfq_sched_data sched_data;
 
@@ -838,7 +844,7 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
 struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node);
-void bfqg_put(struct bfq_group *bfqg);
+void bfqg_and_blkg_put(struct bfq_group *bfqg);
 
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
 extern struct cftype bfq_blkcg_legacy_files[];
@@ -910,20 +916,13 @@ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 
 #define bfq_log_bfqq(bfqd, bfqq, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqq_group(bfqq)), __pbuf, sizeof(__pbuf)); \
-        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid, \
+        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid,\
                         bfq_bfqq_sync((bfqq)) ? 'S' : 'A',              \
-                          __pbuf, ##args);                              \
+                        bfqq_group(bfqq)->blkg_path, ##args);           \
 } while (0)
 
-#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqg), __pbuf, sizeof(__pbuf));          \
-        blk_add_trace_msg((bfqd)->queue, "%s " fmt, __pbuf, ##args);    \
-} while (0)
+#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  \
+        blk_add_trace_msg((bfqd)->queue, "%s " fmt, (bfqg)->blkg_path, ##args)
 
 #else /* CONFIG_BFQ_GROUP_IOSCHED */
 
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 5384713d48bc..b5009a896a7f 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio)
         if (bio_op(bio) != REQ_OP_READ && bio_op(bio) != REQ_OP_WRITE)
                 return false;
 
+        if (!bio_sectors(bio))
+                return false;
+
         /* Already protected? */
         if (bio_integrity(bio))
                 return false;
diff --git a/block/bio.c b/block/bio.c
index 888e7801c638..26b0810fb8ea 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -240,20 +240,21 @@ fallback:
         return bvl;
 }
 
-static void __bio_free(struct bio *bio)
+void bio_uninit(struct bio *bio)
 {
         bio_disassociate_task(bio);
 
         if (bio_integrity(bio))
                 bio_integrity_free(bio);
 }
+EXPORT_SYMBOL(bio_uninit);
 
 static void bio_free(struct bio *bio)
 {
         struct bio_set *bs = bio->bi_pool;
         void *p;
 
-        __bio_free(bio);
+        bio_uninit(bio);
 
         if (bs) {
                 bvec_free(bs->bvec_pool, bio->bi_io_vec, BVEC_POOL_IDX(bio));
@@ -271,6 +272,11 @@ static void bio_free(struct bio *bio)
         }
 }
 
+/*
+ * Users of this function have their own bio allocation. Subsequently,
+ * they must remember to pair any call to bio_init() with bio_uninit()
+ * when IO has completed, or when the bio is released.
+ */
 void bio_init(struct bio *bio, struct bio_vec *table,
               unsigned short max_vecs)
 {
@@ -297,7 +303,7 @@ void bio_reset(struct bio *bio)
 {
         unsigned long flags = bio->bi_flags & (~0UL << BIO_RESET_BITS);
 
-        __bio_free(bio);
+        bio_uninit(bio);
 
         memset(bio, 0, BIO_RESET_BYTES);
         bio->bi_flags = flags;
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 7c2947128f58..0480892e97e5 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -74,7 +74,7 @@ static void blkg_free(struct blkcg_gq *blkg)
                         blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
 
         if (blkg->blkcg != &blkcg_root)
-                blk_exit_rl(&blkg->rl);
+                blk_exit_rl(blkg->q, &blkg->rl);
 
         blkg_rwstat_exit(&blkg->stat_ios);
         blkg_rwstat_exit(&blkg->stat_bytes);
diff --git a/block/blk-core.c b/block/blk-core.c
index c7068520794b..a7421b772d0e 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -648,13 +648,19 @@ int blk_init_rl(struct request_list *rl, struct request_queue *q,
         if (!rl->rq_pool)
                 return -ENOMEM;
 
+        if (rl != &q->root_rl)
+                WARN_ON_ONCE(!blk_get_queue(q));
+
         return 0;
 }
 
-void blk_exit_rl(struct request_list *rl)
+void blk_exit_rl(struct request_queue *q, struct request_list *rl)
 {
-        if (rl->rq_pool)
+        if (rl->rq_pool) {
                 mempool_destroy(rl->rq_pool);
+                if (rl != &q->root_rl)
+                        blk_put_queue(q);
+        }
 }
 
 struct request_queue *blk_alloc_queue(gfp_t gfp_mask)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 1f5b692526ae..0ded5e846335 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -68,6 +68,45 @@ static void blk_mq_sched_assign_ioc(struct request_queue *q,
                 __blk_mq_sched_assign_ioc(q, rq, bio, ioc);
 }
 
+/*
+ * Mark a hardware queue as needing a restart. For shared queues, maintain
+ * a count of how many hardware queues are marked for restart.
+ */
+static void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
+{
+        if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                return;
+
+        if (hctx->flags & BLK_MQ_F_TAG_SHARED) {
+                struct request_queue *q = hctx->queue;
+
+                if (!test_and_set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                        atomic_inc(&q->shared_hctx_restart);
+        } else
+                set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+}
+
+static bool blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
+{
+        if (!test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                return false;
+
+        if (hctx->flags & BLK_MQ_F_TAG_SHARED) {
+                struct request_queue *q = hctx->queue;
+
+                if (test_and_clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                        atomic_dec(&q->shared_hctx_restart);
+        } else
+                clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+
+        if (blk_mq_hctx_has_pending(hctx)) {
+                blk_mq_run_hw_queue(hctx, true);
+                return true;
+        }
+
+        return false;
+}
+
 struct request *blk_mq_sched_get_request(struct request_queue *q,
                                          struct bio *bio,
                                          unsigned int op,
@@ -266,18 +305,6 @@ static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx,
         return true;
 }
 
-static bool blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
-{
-        if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state)) {
-                clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-                if (blk_mq_hctx_has_pending(hctx)) {
-                        blk_mq_run_hw_queue(hctx, true);
-                        return true;
-                }
-        }
-        return false;
-}
-
 /**
  * list_for_each_entry_rcu_rr - iterate in a round-robin fashion over rcu list
  * @pos:    loop cursor.
@@ -309,6 +336,13 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *const hctx)
         unsigned int i, j;
 
         if (set->flags & BLK_MQ_F_TAG_SHARED) {
+                /*
+                 * If this is 0, then we know that no hardware queues
+                 * have RESTART marked. We're done.
+                 */
+                if (!atomic_read(&queue->shared_hctx_restart))
+                        return;
+
                 rcu_read_lock();
                 list_for_each_entry_rcu_rr(q, queue, &set->tag_list,
                                            tag_set_list) {
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index edafb5383b7b..5007edece51a 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -115,15 +115,6 @@ static inline bool blk_mq_sched_has_work(struct blk_mq_hw_ctx *hctx)
         return false;
 }
 
-/*
- * Mark a hardware queue as needing a restart.
- */
-static inline void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
-{
-        if (!test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
-                set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-}
-
 static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
 {
         return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a69ad122ed66..958cedaff8b8 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -628,25 +628,6 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q,
 }
 EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
 
-void blk_mq_abort_requeue_list(struct request_queue *q)
-{
-        unsigned long flags;
-        LIST_HEAD(rq_list);
-
-        spin_lock_irqsave(&q->requeue_lock, flags);
-        list_splice_init(&q->requeue_list, &rq_list);
-        spin_unlock_irqrestore(&q->requeue_lock, flags);
-
-        while (!list_empty(&rq_list)) {
-                struct request *rq;
-
-                rq = list_first_entry(&rq_list, struct request, queuelist);
-                list_del_init(&rq->queuelist);
-                blk_mq_end_request(rq, -EIO);
-        }
-}
-EXPORT_SYMBOL(blk_mq_abort_requeue_list);
-
 struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
 {
         if (tag < tags->nr_tags) {
@@ -1480,22 +1461,28 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
         return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
 
-static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
-                                      bool may_sleep)
+static void __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+                                        struct request *rq,
+                                        blk_qc_t *cookie, bool may_sleep)
 {
         struct request_queue *q = rq->q;
         struct blk_mq_queue_data bd = {
                 .rq = rq,
                 .last = true,
         };
-        struct blk_mq_hw_ctx *hctx;
         blk_qc_t new_cookie;
         int ret;
+        bool run_queue = true;
+
+        if (blk_mq_hctx_stopped(hctx)) {
+                run_queue = false;
+                goto insert;
+        }
 
         if (q->elevator)
                 goto insert;
 
-        if (!blk_mq_get_driver_tag(rq, &hctx, false))
+        if (!blk_mq_get_driver_tag(rq, NULL, false))
                 goto insert;
 
         new_cookie = request_to_qc_t(hctx, rq);
@@ -1519,7 +1506,7 @@ static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
 
         __blk_mq_requeue_request(rq);
 insert:
-        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
+        blk_mq_sched_insert_request(rq, false, run_queue, false, may_sleep);
 }
 
 static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
@@ -1527,7 +1514,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
 {
         if (!(hctx->flags & BLK_MQ_F_BLOCKING)) {
                 rcu_read_lock();
-                __blk_mq_try_issue_directly(rq, cookie, false);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, false);
                 rcu_read_unlock();
         } else {
                 unsigned int srcu_idx;
@@ -1535,7 +1522,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                 might_sleep();
 
                 srcu_idx = srcu_read_lock(&hctx->queue_rq_srcu);
-                __blk_mq_try_issue_directly(rq, cookie, true);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, true);
                 srcu_read_unlock(&hctx->queue_rq_srcu, srcu_idx);
         }
 }
@@ -1638,9 +1625,12 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
                 blk_mq_put_ctx(data.ctx);
 
-                if (same_queue_rq)
+                if (same_queue_rq) {
+                        data.hctx = blk_mq_map_queue(q,
+                                        same_queue_rq->mq_ctx->cpu);
                         blk_mq_try_issue_directly(data.hctx, same_queue_rq,
                                         &cookie);
+                }
         } else if (q->nr_hw_queues > 1 && is_sync) {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
@@ -2113,20 +2103,30 @@ static void blk_mq_map_swqueue(struct request_queue *q,
         }
 }
 
+/*
+ * Caller needs to ensure that we're either frozen/quiesced, or that
+ * the queue isn't live yet.
+ */
 static void queue_set_hctx_shared(struct request_queue *q, bool shared)
 {
         struct blk_mq_hw_ctx *hctx;
         int i;
 
         queue_for_each_hw_ctx(q, hctx, i) {
-                if (shared)
+                if (shared) {
+                        if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                                atomic_inc(&q->shared_hctx_restart);
                         hctx->flags |= BLK_MQ_F_TAG_SHARED;
-                else
+                } else {
+                        if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+                                atomic_dec(&q->shared_hctx_restart);
                         hctx->flags &= ~BLK_MQ_F_TAG_SHARED;
+                }
         }
 }
 
-static void blk_mq_update_tag_set_depth(struct blk_mq_tag_set *set, bool shared)
+static void blk_mq_update_tag_set_depth(struct blk_mq_tag_set *set,
+                                        bool shared)
 {
         struct request_queue *q;
 
@@ -2660,7 +2660,8 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
         return ret;
 }
 
-void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
+static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
+                                                        int nr_hw_queues)
 {
         struct request_queue *q;
 
@@ -2684,6 +2685,13 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
         list_for_each_entry(q, &set->tag_list, tag_set_list)
                 blk_mq_unfreeze_queue(q);
 }
+
+void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
+{
+        mutex_lock(&set->tag_list_lock);
+        __blk_mq_update_nr_hw_queues(set, nr_hw_queues);
+        mutex_unlock(&set->tag_list_lock);
+}
 EXPORT_SYMBOL_GPL(blk_mq_update_nr_hw_queues);
 
 /* Enable polling stats and return whether they were already enabled. */
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 504fee940052..27aceab1cc31 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -777,24 +777,25 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
 }
 
 /**
- * blk_release_queue: - release a &struct request_queue when it is no longer needed
- * @kobj:    the kobj belonging to the request queue to be released
+ * __blk_release_queue - release a request queue when it is no longer needed
+ * @work: pointer to the release_work member of the request queue to be released
  *
  * Description:
- *     blk_release_queue is the pair to blk_init_queue() or
- *     blk_queue_make_request().  It should be called when a request queue is
- *     being released; typically when a block device is being de-registered.
- *     Currently, its primary task it to free all the &struct request
- *     structures that were allocated to the queue and the queue itself.
+ *     blk_release_queue is the counterpart of blk_init_queue(). It should be
+ *     called when a request queue is being released; typically when a block
+ *     device is being de-registered. Its primary task it to free the queue
+ *     itself.
  *
- * Note:
+ * Notes:
  *     The low level driver must have finished any outstanding requests first
  *     via blk_cleanup_queue().
- **/
-static void blk_release_queue(struct kobject *kobj)
+ *
+ *     Although blk_release_queue() may be called with preemption disabled,
+ *     __blk_release_queue() may sleep.
+ */
+static void __blk_release_queue(struct work_struct *work)
 {
-        struct request_queue *q =
-                container_of(kobj, struct request_queue, kobj);
+        struct request_queue *q = container_of(work, typeof(*q), release_work);
 
         if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags))
                 blk_stat_remove_callback(q, q->poll_cb);
@@ -809,7 +810,7 @@ static void blk_release_queue(struct kobject *kobj)
 
         blk_free_queue_stats(q->stats);
 
-        blk_exit_rl(&q->root_rl);
+        blk_exit_rl(q, &q->root_rl);
 
         if (q->queue_tags)
                 __blk_queue_free_tags(q);
@@ -834,6 +835,15 @@ static void blk_release_queue(struct kobject *kobj)
         call_rcu(&q->rcu_head, blk_free_queue_rcu);
 }
 
+static void blk_release_queue(struct kobject *kobj)
+{
+        struct request_queue *q =
+                container_of(kobj, struct request_queue, kobj);
+
+        INIT_WORK(&q->release_work, __blk_release_queue);
+        schedule_work(&q->release_work);
+}
+
 static const struct sysfs_ops queue_sysfs_ops = {
         .show   = queue_attr_show,
         .store  = queue_attr_store,
@@ -887,10 +897,10 @@ int blk_register_queue(struct gendisk *disk)
                 goto unlock;
         }
 
-        if (q->mq_ops)
+        if (q->mq_ops) {
                 __blk_mq_register_dev(dev, q);
-
-        blk_mq_debugfs_register(q);
+                blk_mq_debugfs_register(q);
+        }
 
         kobject_uevent(&q->kobj, KOBJ_ADD);
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index b78db2e5fdff..a7285bf2831c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -22,11 +22,18 @@ static int throtl_quantum = 32;
 #define DFL_THROTL_SLICE_HD (HZ / 10)
 #define DFL_THROTL_SLICE_SSD (HZ / 50)
 #define MAX_THROTL_SLICE (HZ)
-#define DFL_IDLE_THRESHOLD_SSD (1000L) /* 1 ms */
-#define DFL_IDLE_THRESHOLD_HD (100L * 1000) /* 100 ms */
 #define MAX_IDLE_TIME (5L * 1000 * 1000) /* 5 s */
-/* default latency target is 0, eg, guarantee IO latency by default */
-#define DFL_LATENCY_TARGET (0)
+#define MIN_THROTL_BPS (320 * 1024)
+#define MIN_THROTL_IOPS (10)
+#define DFL_LATENCY_TARGET (-1L)
+#define DFL_IDLE_THRESHOLD (0)
+#define DFL_HD_BASELINE_LATENCY (4000L) /* 4ms */
+#define LATENCY_FILTERED_SSD (0)
+/*
+ * For HD, very small latency comes from sequential IO. Such IO is helpless to
+ * help determine if its IO is impacted by others, hence we ignore the IO
+ */
+#define LATENCY_FILTERED_HD (1000L) /* 1ms */
 
 #define SKIP_LATENCY (((u64)1) << BLK_STAT_RES_SHIFT)
 
@@ -157,6 +164,7 @@ struct throtl_grp {
         unsigned long last_check_time;
 
         unsigned long latency_target; /* us */
+        unsigned long latency_target_conf; /* us */
         /* When did we start a new slice */
         unsigned long slice_start[2];
         unsigned long slice_end[2];
@@ -165,6 +173,7 @@ struct throtl_grp {
         unsigned long checked_last_finish_time; /* ns / 1024 */
         unsigned long avg_idletime; /* ns / 1024 */
         unsigned long idletime_threshold; /* us */
+        unsigned long idletime_threshold_conf; /* us */
 
         unsigned int bio_cnt; /* total bios */
         unsigned int bad_bio_cnt; /* bios exceeding latency threshold */
@@ -201,8 +210,6 @@ struct throtl_data
         unsigned int limit_index;
         bool limit_valid[LIMIT_CNT];
 
-        unsigned long dft_idletime_threshold; /* us */
-
         unsigned long low_upgrade_time;
         unsigned long low_downgrade_time;
 
@@ -212,6 +219,7 @@ struct throtl_data
         struct avg_latency_bucket avg_buckets[LATENCY_BUCKET_SIZE];
         struct latency_bucket __percpu *latency_buckets;
         unsigned long last_calculate_time;
+        unsigned long filtered_latency;
 
         bool track_bio_latency;
 };
@@ -294,8 +302,14 @@ static uint64_t tg_bps_limit(struct throtl_grp *tg, int rw)
 
         td = tg->td;
         ret = tg->bps[rw][td->limit_index];
-        if (ret == 0 && td->limit_index == LIMIT_LOW)
-                return tg->bps[rw][LIMIT_MAX];
+        if (ret == 0 && td->limit_index == LIMIT_LOW) {
+                /* intermediate node or iops isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->iops[rw][td->limit_index])
+                        return U64_MAX;
+                else
+                        return MIN_THROTL_BPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->bps[rw][LIMIT_LOW] &&
             tg->bps[rw][LIMIT_LOW] != tg->bps[rw][LIMIT_MAX]) {
@@ -315,10 +329,17 @@ static unsigned int tg_iops_limit(struct throtl_grp *tg, int rw)
 
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && !blkg->parent)
                 return UINT_MAX;
+
         td = tg->td;
         ret = tg->iops[rw][td->limit_index];
-        if (ret == 0 && tg->td->limit_index == LIMIT_LOW)
-                return tg->iops[rw][LIMIT_MAX];
+        if (ret == 0 && tg->td->limit_index == LIMIT_LOW) {
+                /* intermediate node or bps isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->bps[rw][td->limit_index])
+                        return UINT_MAX;
+                else
+                        return MIN_THROTL_IOPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->iops[rw][LIMIT_LOW] &&
             tg->iops[rw][LIMIT_LOW] != tg->iops[rw][LIMIT_MAX]) {
@@ -482,6 +503,9 @@ static struct blkg_policy_data *throtl_pd_alloc(gfp_t gfp, int node)
         /* LIMIT_LOW will have default value 0 */
 
         tg->latency_target = DFL_LATENCY_TARGET;
+        tg->latency_target_conf = DFL_LATENCY_TARGET;
+        tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+        tg->idletime_threshold_conf = DFL_IDLE_THRESHOLD;
 
         return &tg->pd;
 }
@@ -510,8 +534,6 @@ static void throtl_pd_init(struct blkg_policy_data *pd)
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent)
                 sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue;
         tg->td = td;
-
-        tg->idletime_threshold = td->dft_idletime_threshold;
 }
 
 /*
@@ -684,7 +706,7 @@ static void throtl_dequeue_tg(struct throtl_grp *tg)
 static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
                                           unsigned long expires)
 {
-        unsigned long max_expire = jiffies + 8 * sq_to_tg(sq)->td->throtl_slice;
+        unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;
 
         /*
          * Since we are adjusting the throttle limit dynamically, the sleep
@@ -1349,7 +1371,7 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v)
         return 0;
 }
 
-static void tg_conf_updated(struct throtl_grp *tg)
+static void tg_conf_updated(struct throtl_grp *tg, bool global)
 {
         struct throtl_service_queue *sq = &tg->service_queue;
         struct cgroup_subsys_state *pos_css;
@@ -1367,8 +1389,26 @@ static void tg_conf_updated(struct throtl_grp *tg)
          * restrictions in the whole hierarchy and allows them to bypass
          * blk-throttle.
          */
-        blkg_for_each_descendant_pre(blkg, pos_css, tg_to_blkg(tg))
-                tg_update_has_rules(blkg_to_tg(blkg));
+        blkg_for_each_descendant_pre(blkg, pos_css,
+                        global ? tg->td->queue->root_blkg : tg_to_blkg(tg)) {
+                struct throtl_grp *this_tg = blkg_to_tg(blkg);
+                struct throtl_grp *parent_tg;
+
+                tg_update_has_rules(this_tg);
+                /* ignore root/second level */
+                if (!cgroup_subsys_on_dfl(io_cgrp_subsys) || !blkg->parent ||
+                    !blkg->parent->parent)
+                        continue;
+                parent_tg = blkg_to_tg(blkg->parent);
+                /*
+                 * make sure all children has lower idle time threshold and
+                 * higher latency target
+                 */
+                this_tg->idletime_threshold = min(this_tg->idletime_threshold,
+                                parent_tg->idletime_threshold);
+                this_tg->latency_target = max(this_tg->latency_target,
+                                parent_tg->latency_target);
+        }
 
         /*
          * We're already holding queue_lock and know @tg is valid.  Let's
@@ -1413,7 +1453,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of,
         else
                 *(unsigned int *)((void *)tg + of_cft(of)->private) = v;
 
-        tg_conf_updated(tg);
+        tg_conf_updated(tg, false);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1497,34 +1537,34 @@ static u64 tg_prfill_limit(struct seq_file *sf, struct blkg_policy_data *pd,
             tg->iops_conf[READ][off] == iops_dft &&
             tg->iops_conf[WRITE][off] == iops_dft &&
             (off != LIMIT_LOW ||
-             (tg->idletime_threshold == tg->td->dft_idletime_threshold &&
-              tg->latency_target == DFL_LATENCY_TARGET)))
+             (tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD &&
+              tg->latency_target_conf == DFL_LATENCY_TARGET)))
                 return 0;
 
-        if (tg->bps_conf[READ][off] != bps_dft)
+        if (tg->bps_conf[READ][off] != U64_MAX)
                 snprintf(bufs[0], sizeof(bufs[0]), "%llu",
                         tg->bps_conf[READ][off]);
-        if (tg->bps_conf[WRITE][off] != bps_dft)
+        if (tg->bps_conf[WRITE][off] != U64_MAX)
                 snprintf(bufs[1], sizeof(bufs[1]), "%llu",
                         tg->bps_conf[WRITE][off]);
-        if (tg->iops_conf[READ][off] != iops_dft)
+        if (tg->iops_conf[READ][off] != UINT_MAX)
                 snprintf(bufs[2], sizeof(bufs[2]), "%u",
                         tg->iops_conf[READ][off]);
-        if (tg->iops_conf[WRITE][off] != iops_dft)
+        if (tg->iops_conf[WRITE][off] != UINT_MAX)
                 snprintf(bufs[3], sizeof(bufs[3]), "%u",
                         tg->iops_conf[WRITE][off]);
         if (off == LIMIT_LOW) {
-                if (tg->idletime_threshold == ULONG_MAX)
+                if (tg->idletime_threshold_conf == ULONG_MAX)
                         strcpy(idle_time, " idle=max");
                 else
                         snprintf(idle_time, sizeof(idle_time), " idle=%lu",
-                                tg->idletime_threshold);
+                                tg->idletime_threshold_conf);
 
-                if (tg->latency_target == ULONG_MAX)
+                if (tg->latency_target_conf == ULONG_MAX)
                         strcpy(latency_time, " latency=max");
                 else
                         snprintf(latency_time, sizeof(latency_time),
-                                " latency=%lu", tg->latency_target);
+                                " latency=%lu", tg->latency_target_conf);
         }
 
         seq_printf(sf, "%s rbps=%s wbps=%s riops=%s wiops=%s%s%s\n",
@@ -1563,8 +1603,8 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
         v[2] = tg->iops_conf[READ][index];
         v[3] = tg->iops_conf[WRITE][index];
 
-        idle_time = tg->idletime_threshold;
-        latency_time = tg->latency_target;
+        idle_time = tg->idletime_threshold_conf;
+        latency_time = tg->latency_target_conf;
         while (true) {
                 char tok[27];   /* wiops=18446744073709551616 */
                 char *p;
@@ -1623,17 +1663,33 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
                 tg->iops_conf[READ][LIMIT_MAX]);
         tg->iops[WRITE][LIMIT_LOW] = min(tg->iops_conf[WRITE][LIMIT_LOW],
                 tg->iops_conf[WRITE][LIMIT_MAX]);
+        tg->idletime_threshold_conf = idle_time;
+        tg->latency_target_conf = latency_time;
+
+        /* force user to configure all settings for low limit  */
+        if (!(tg->bps[READ][LIMIT_LOW] || tg->iops[READ][LIMIT_LOW] ||
+              tg->bps[WRITE][LIMIT_LOW] || tg->iops[WRITE][LIMIT_LOW]) ||
+            tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD ||
+            tg->latency_target_conf == DFL_LATENCY_TARGET) {
+                tg->bps[READ][LIMIT_LOW] = 0;
+                tg->bps[WRITE][LIMIT_LOW] = 0;
+                tg->iops[READ][LIMIT_LOW] = 0;
+                tg->iops[WRITE][LIMIT_LOW] = 0;
+                tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+                tg->latency_target = DFL_LATENCY_TARGET;
+        } else if (index == LIMIT_LOW) {
+                tg->idletime_threshold = tg->idletime_threshold_conf;
+                tg->latency_target = tg->latency_target_conf;
+        }
 
-        if (index == LIMIT_LOW) {
-                blk_throtl_update_limit_valid(tg->td);
-                if (tg->td->limit_valid[LIMIT_LOW])
+        blk_throtl_update_limit_valid(tg->td);
+        if (tg->td->limit_valid[LIMIT_LOW]) {
+                if (index == LIMIT_LOW)
                         tg->td->limit_index = LIMIT_LOW;
-                tg->idletime_threshold = (idle_time == ULONG_MAX) ?
-                        ULONG_MAX : idle_time;
-                tg->latency_target = (latency_time == ULONG_MAX) ?
-                        ULONG_MAX : latency_time;
-        }
-        tg_conf_updated(tg);
+        } else
+                tg->td->limit_index = LIMIT_MAX;
+        tg_conf_updated(tg, index == LIMIT_LOW &&
+                tg->td->limit_valid[LIMIT_LOW]);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1722,17 +1778,25 @@ static bool throtl_tg_is_idle(struct throtl_grp *tg)
         /*
          * cgroup is idle if:
          * - single idle is too long, longer than a fixed value (in case user
-         *   configure a too big threshold) or 4 times of slice
+         *   configure a too big threshold) or 4 times of idletime threshold
          * - average think time is more than threshold
          * - IO latency is largely below threshold
          */
-        unsigned long time = jiffies_to_usecs(4 * tg->td->throtl_slice);
-
-        time = min_t(unsigned long, MAX_IDLE_TIME, time);
-        return (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
-               tg->avg_idletime > tg->idletime_threshold ||
-               (tg->latency_target && tg->bio_cnt &&
+        unsigned long time;
+        bool ret;
+
+        time = min_t(unsigned long, MAX_IDLE_TIME, 4 * tg->idletime_threshold);
+        ret = tg->latency_target == DFL_LATENCY_TARGET ||
+              tg->idletime_threshold == DFL_IDLE_THRESHOLD ||
+              (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
+              tg->avg_idletime > tg->idletime_threshold ||
+              (tg->latency_target && tg->bio_cnt &&
                 tg->bad_bio_cnt * 5 < tg->bio_cnt);
+        throtl_log(&tg->service_queue,
+                "avg_idle=%ld, idle_threshold=%ld, bad_bio=%d, total_bio=%d, is_idle=%d, scale=%d",
+                tg->avg_idletime, tg->idletime_threshold, tg->bad_bio_cnt,
+                tg->bio_cnt, ret, tg->td->scale);
+        return ret;
 }
 
 static bool throtl_tg_can_upgrade(struct throtl_grp *tg)
@@ -1828,6 +1892,7 @@ static void throtl_upgrade_state(struct throtl_data *td)
         struct cgroup_subsys_state *pos_css;
         struct blkcg_gq *blkg;
 
+        throtl_log(&td->service_queue, "upgrade to max");
         td->limit_index = LIMIT_MAX;
         td->low_upgrade_time = jiffies;
         td->scale = 0;
@@ -1850,6 +1915,7 @@ static void throtl_downgrade_state(struct throtl_data *td, int new)
 {
         td->scale /= 2;
 
+        throtl_log(&td->service_queue, "downgrade, scale %d", td->scale);
         if (td->scale) {
                 td->low_upgrade_time = jiffies - td->scale * td->throtl_slice;
                 return;
@@ -2023,6 +2089,11 @@ static void throtl_update_latency_buckets(struct throtl_data *td)
                 td->avg_buckets[i].valid = true;
                 last_latency = td->avg_buckets[i].latency;
         }
+
+        for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                throtl_log(&td->service_queue,
+                        "Latency bucket %d: latency=%ld, valid=%d", i,
+                        td->avg_buckets[i].latency, td->avg_buckets[i].valid);
 }
 #else
 static inline void throtl_update_latency_buckets(struct throtl_data *td)
@@ -2218,7 +2289,7 @@ void blk_throtl_bio_endio(struct bio *bio)
                 throtl_track_latency(tg->td, blk_stat_size(&bio->bi_issue_stat),
                         bio_op(bio), lat);
 
-        if (tg->latency_target) {
+        if (tg->latency_target && lat >= tg->td->filtered_latency) {
                 int bucket;
                 unsigned int threshold;
 
@@ -2354,18 +2425,19 @@ void blk_throtl_exit(struct request_queue *q)
 void blk_throtl_register_queue(struct request_queue *q)
 {
         struct throtl_data *td;
-        struct cgroup_subsys_state *pos_css;
-        struct blkcg_gq *blkg;
+        int i;
 
         td = q->td;
         BUG_ON(!td);
 
         if (blk_queue_nonrot(q)) {
                 td->throtl_slice = DFL_THROTL_SLICE_SSD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_SSD;
+                td->filtered_latency = LATENCY_FILTERED_SSD;
         } else {
                 td->throtl_slice = DFL_THROTL_SLICE_HD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_HD;
+                td->filtered_latency = LATENCY_FILTERED_HD;
+                for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                        td->avg_buckets[i].latency = DFL_HD_BASELINE_LATENCY;
         }
 #ifndef CONFIG_BLK_DEV_THROTTLING_LOW
         /* if no low limit, use previous default */
@@ -2375,18 +2447,6 @@ void blk_throtl_register_queue(struct request_queue *q)
         td->track_bio_latency = !q->mq_ops && !q->request_fn;
         if (!td->track_bio_latency)
                 blk_stat_enable_accounting(q);
-
-        /*
-         * some tg are created before queue is fully initialized, eg, nonrot
-         * isn't initialized yet
-         */
-        rcu_read_lock();
-        blkg_for_each_descendant_post(blkg, pos_css, q->root_blkg) {
-                struct throtl_grp *tg = blkg_to_tg(blkg);
-
-                tg->idletime_threshold = td->dft_idletime_threshold;
-        }
-        rcu_read_unlock();
 }
 
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
diff --git a/block/blk.h b/block/blk.h
index 2ed70228e44f..83c8e1100525 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -59,7 +59,7 @@ void blk_free_flush_queue(struct blk_flush_queue *q);
 
 int blk_init_rl(struct request_list *rl, struct request_queue *q,
                 gfp_t gfp_mask);
-void blk_exit_rl(struct request_list *rl);
+void blk_exit_rl(struct request_queue *q, struct request_list *rl);
 void blk_rq_bio_prep(struct request_queue *q, struct request *rq,
                         struct bio *bio);
 void blk_queue_bypass_start(struct request_queue *q);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index da69b079725f..b7e9c7feeab2 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -38,9 +38,13 @@ static const u64 cfq_target_latency = (u64)NSEC_PER_SEC * 3/10; /* 300 ms */
 static const int cfq_hist_divisor = 4;
 
 /*
- * offset from end of service tree
+ * offset from end of queue service tree for idle class
  */
 #define CFQ_IDLE_DELAY          (NSEC_PER_SEC / 5)
+/* offset from end of group service tree under time slice mode */
+#define CFQ_SLICE_MODE_GROUP_DELAY (NSEC_PER_SEC / 5)
+/* offset from end of group service under IOPS mode */
+#define CFQ_IOPS_MODE_GROUP_DELAY (HZ / 5)
 
 /*
  * below this threshold, we consider thinktime immediate
@@ -1362,6 +1366,14 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         cfqg->vfraction = max_t(unsigned, vfr, 1);
 }
 
+static inline u64 cfq_get_cfqg_vdisktime_delay(struct cfq_data *cfqd)
+{
+        if (!iops_mode(cfqd))
+                return CFQ_SLICE_MODE_GROUP_DELAY;
+        else
+                return CFQ_IOPS_MODE_GROUP_DELAY;
+}
+
 static void
 cfq_group_notify_queue_add(struct cfq_data *cfqd, struct cfq_group *cfqg)
 {
@@ -1381,7 +1393,8 @@ cfq_group_notify_queue_add(struct cfq_data *cfqd, struct cfq_group *cfqg)
         n = rb_last(&st->rb);
         if (n) {
                 __cfqg = rb_entry_cfqg(n);
-                cfqg->vdisktime = __cfqg->vdisktime + CFQ_IDLE_DELAY;
+                cfqg->vdisktime = __cfqg->vdisktime +
+                        cfq_get_cfqg_vdisktime_delay(cfqd);
         } else
                 cfqg->vdisktime = st->min_vdisktime;
         cfq_group_service_tree_add(st, cfqg);
diff --git a/block/partition-generic.c b/block/partition-generic.c
index ff07b9143ca4..c5ec8246e25e 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -320,8 +320,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
 
         if (info) {
                 struct partition_meta_info *pinfo = alloc_part_info(disk);
-                if (!pinfo)
+                if (!pinfo) {
+                        err = -ENOMEM;
                         goto out_free_stats;
+                }
                 memcpy(pinfo, info, sizeof(*info));
                 p->info = pinfo;
         }
diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
index 93e7c1b32edd..5610cd537da7 100644
--- a/block/partitions/msdos.c
+++ b/block/partitions/msdos.c
@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_partitions *state,
                         continue;
                 bsd_start = le32_to_cpu(p->p_offset);
                 bsd_size = le32_to_cpu(p->p_size);
+                if (memcmp(flavour, "bsd\0", 4) == 0)
+                        bsd_start += offset;
                 if (offset == bsd_start && size == bsd_size)
                         /* full parent partition, we have it already */
                         continue;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index d3a989e718f5..3cd6e12cfc46 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -141,7 +141,7 @@ int public_key_verify_signature(const struct public_key *pkey,
          * signature and returns that to us.
          */
         ret = crypto_akcipher_verify(req);
-        if (ret == -EINPROGRESS) {
+        if ((ret == -EINPROGRESS) || (ret == -EBUSY)) {
                 wait_for_completion(&compl.completion);
                 ret = compl.err;
         }
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 672a94c2c3ff..d178650fd524 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -381,7 +381,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
         }
 
 error:
-        kfree(desc);
+        kzfree(desc);
 error_no_desc:
         crypto_free_shash(tfm);
         kleave(" = %d", ret);
@@ -450,6 +450,6 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
         ret = pefile_digest_pe(pebuf, pelen, &ctx);
 
 error:
-        kfree(ctx.digest);
+        kzfree(ctx.digest);
         return ret;
 }
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index c80765b211cf..dd03fead1ca3 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -102,6 +102,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
                 }
         }
 
+        ret = -ENOMEM;
         cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
         if (!cert->pub->key)
                 goto error_decode;
diff --git a/crypto/drbg.c b/crypto/drbg.c
index fa749f470135..cdb27ac4b226 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1767,9 +1767,8 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                         break;
                 case -EINPROGRESS:
                 case -EBUSY:
-                        ret = wait_for_completion_interruptible(
-                                &drbg->ctr_completion);
-                        if (!ret && !drbg->ctr_async_err) {
+                        wait_for_completion(&drbg->ctr_completion);
+                        if (!drbg->ctr_async_err) {
                                 reinit_completion(&drbg->ctr_completion);
                                 break;
                         }
diff --git a/crypto/gcm.c b/crypto/gcm.c
index b7ad808be3d4..3841b5eafa7e 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
 
         err = crypto_skcipher_encrypt(&data->req);
         if (err == -EINPROGRESS || err == -EBUSY) {
-                err = wait_for_completion_interruptible(
-                        &data->result.completion);
-                if (!err)
-                        err = data->result.err;
+                wait_for_completion(&data->result.completion);
+                err = data->result.err;
         }
 
         if (err)
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 014af741fc6a..4faa0fd53b0c 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -764,6 +764,44 @@ static int crypto_init_skcipher_ops_ablkcipher(struct crypto_tfm *tfm)
         return 0;
 }
 
+static int skcipher_setkey_unaligned(struct crypto_skcipher *tfm,
+                                     const u8 *key, unsigned int keylen)
+{
+        unsigned long alignmask = crypto_skcipher_alignmask(tfm);
+        struct skcipher_alg *cipher = crypto_skcipher_alg(tfm);
+        u8 *buffer, *alignbuffer;
+        unsigned long absize;
+        int ret;
+
+        absize = keylen + alignmask;
+        buffer = kmalloc(absize, GFP_ATOMIC);
+        if (!buffer)
+                return -ENOMEM;
+
+        alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
+        memcpy(alignbuffer, key, keylen);
+        ret = cipher->setkey(tfm, alignbuffer, keylen);
+        kzfree(buffer);
+        return ret;
+}
+
+static int skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                           unsigned int keylen)
+{
+        struct skcipher_alg *cipher = crypto_skcipher_alg(tfm);
+        unsigned long alignmask = crypto_skcipher_alignmask(tfm);
+
+        if (keylen < cipher->min_keysize || keylen > cipher->max_keysize) {
+                crypto_skcipher_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+                return -EINVAL;
+        }
+
+        if ((unsigned long)key & alignmask)
+                return skcipher_setkey_unaligned(tfm, key, keylen);
+
+        return cipher->setkey(tfm, key, keylen);
+}
+
 static void crypto_skcipher_exit_tfm(struct crypto_tfm *tfm)
 {
         struct crypto_skcipher *skcipher = __crypto_skcipher_cast(tfm);
@@ -784,7 +822,7 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm)
             tfm->__crt_alg->cra_type == &crypto_givcipher_type)
                 return crypto_init_skcipher_ops_ablkcipher(tfm);
 
-        skcipher->setkey = alg->setkey;
+        skcipher->setkey = skcipher_setkey;
         skcipher->encrypt = alg->encrypt;
         skcipher->decrypt = alg->decrypt;
         skcipher->ivsize = alg->ivsize;
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 5a968a78652b..0d2e98920069 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -416,13 +416,18 @@ acpi_tb_get_table(struct acpi_table_desc *table_desc,
                 }
         }
 
-        table_desc->validation_count++;
-        if (table_desc->validation_count == 0) {
-                ACPI_ERROR((AE_INFO,
-                            "Table %p, Validation count is zero after increment\n",
-                            table_desc));
-                table_desc->validation_count--;
-                return_ACPI_STATUS(AE_LIMIT);
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count++;
+
+                /*
+                 * Detect validation_count overflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count overflows\n",
+                                      table_desc));
+                }
         }
 
         *out_table = table_desc->pointer;
@@ -449,13 +454,20 @@ void acpi_tb_put_table(struct acpi_table_desc *table_desc)
 
         ACPI_FUNCTION_TRACE(acpi_tb_put_table);
 
-        if (table_desc->validation_count == 0) {
-                ACPI_WARNING((AE_INFO,
-                              "Table %p, Validation count is zero before decrement\n",
-                              table_desc));
-                return_VOID;
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count--;
+
+                /*
+                 * Detect validation_count underflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count underflows\n",
+                                      table_desc));
+                        return_VOID;
+                }
         }
-        table_desc->validation_count--;
 
         if (table_desc->validation_count == 0) {
 
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index e0587c85bafd..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -474,15 +474,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
                         }
 
-                        /*
-                         * The end_tag opcode must be followed by a zero byte.
-                         * Although this byte is technically defined to be a checksum,
-                         * in practice, all ASL compilers set this byte to zero.
-                         */
-                        if (*(aml + 1) != 0) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Return the pointer to the end_tag if requested */
 
                         if (!user_function) {
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index c5fecf97ee2f..797b28dc7b34 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -666,14 +666,6 @@ static const struct iommu_ops *iort_iommu_xlate(struct device *dev,
         int ret = -ENODEV;
         struct fwnode_handle *iort_fwnode;
 
-        /*
-         * If we already translated the fwspec there
-         * is nothing left to do, return the iommu_ops.
-         */
-        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
-        if (ops)
-                return ops;
-
         if (node) {
                 iort_fwnode = iort_get_fwnode(node);
                 if (!iort_fwnode)
@@ -735,6 +727,14 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         u32 streamid = 0;
         int err;
 
+        /*
+         * If we already translated the fwspec there
+         * is nothing left to do, return the iommu_ops.
+         */
+        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
+        if (ops)
+                return ops;
+
         if (dev_is_pci(dev)) {
                 struct pci_bus *bus = to_pci_dev(dev)->bus;
                 u32 rid;
@@ -782,6 +782,12 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         if (err)
                 ops = ERR_PTR(err);
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a9a9ab3399d4..d42eeef9d928 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -782,7 +782,7 @@ static int acpi_battery_update(struct acpi_battery *battery, bool resume)
         if ((battery->state & ACPI_BATTERY_STATE_CRITICAL) ||
             (test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags) &&
             (battery->capacity_now <= battery->alarm)))
-                pm_wakeup_hard_event(&battery->device->dev);
+                pm_wakeup_event(&battery->device->dev, 0);
 
         return result;
 }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index b7c2a06963d6..e19f530f1083 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -57,6 +57,7 @@
 
 #define ACPI_BUTTON_LID_INIT_IGNORE     0x00
 #define ACPI_BUTTON_LID_INIT_OPEN       0x01
+#define ACPI_BUTTON_LID_INIT_METHOD     0x02
 
 #define _COMPONENT              ACPI_BUTTON_COMPONENT
 ACPI_MODULE_NAME("button");
@@ -112,7 +113,7 @@ struct acpi_button {
 
 static BLOCKING_NOTIFIER_HEAD(acpi_lid_notifier);
 static struct acpi_device *lid_device;
-static u8 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
+static u8 lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
 
 static unsigned long lid_report_interval __read_mostly = 500;
 module_param(lid_report_interval, ulong, 0644);
@@ -216,7 +217,7 @@ static int acpi_lid_notify_state(struct acpi_device *device, int state)
         }
 
         if (state)
-                pm_wakeup_hard_event(&device->dev);
+                pm_wakeup_event(&device->dev, 0);
 
         ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
         if (ret == NOTIFY_DONE)
@@ -376,6 +377,9 @@ static void acpi_lid_initialize_state(struct acpi_device *device)
         case ACPI_BUTTON_LID_INIT_OPEN:
                 (void)acpi_lid_notify_state(device, 1);
                 break;
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                (void)acpi_lid_update_state(device);
+                break;
         case ACPI_BUTTON_LID_INIT_IGNORE:
         default:
                 break;
@@ -398,7 +402,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
                 } else {
                         int keycode;
 
-                        pm_wakeup_hard_event(&device->dev);
+                        pm_wakeup_event(&device->dev, 0);
                         if (button->suspended)
                                 break;
 
@@ -530,7 +534,6 @@ static int acpi_button_add(struct acpi_device *device)
                 lid_device = device;
         }
 
-        device_init_wakeup(&device->dev, true);
         printk(KERN_INFO PREFIX "%s [%s]\n", name, acpi_device_bid(device));
         return 0;
 
@@ -560,6 +563,9 @@ static int param_set_lid_init_state(const char *val, struct kernel_param *kp)
         if (!strncmp(val, "open", sizeof("open") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
                 pr_info("Notify initial lid state as open\n");
+        } else if (!strncmp(val, "method", sizeof("method") - 1)) {
+                lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
+                pr_info("Notify initial lid state with _LID return value\n");
         } else if (!strncmp(val, "ignore", sizeof("ignore") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_IGNORE;
                 pr_info("Do not notify initial lid state\n");
@@ -573,6 +579,8 @@ static int param_get_lid_init_state(char *buffer, struct kernel_param *kp)
         switch (lid_init_state) {
         case ACPI_BUTTON_LID_INIT_OPEN:
                 return sprintf(buffer, "open");
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                return sprintf(buffer, "method");
         case ACPI_BUTTON_LID_INIT_IGNORE:
                 return sprintf(buffer, "ignore");
         default:
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 798d5003a039..993fd31394c8 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -24,7 +24,6 @@
 #include <linux/pm_qos.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
-#include <linux/suspend.h>
 
 #include "internal.h"
 
@@ -400,7 +399,7 @@ static void acpi_pm_notify_handler(acpi_handle handle, u32 val, void *not_used)
         mutex_lock(&acpi_pm_notifier_lock);
 
         if (adev->wakeup.flags.notifier_present) {
-                pm_wakeup_ws_event(adev->wakeup.ws, 0, true);
+                __pm_wakeup_event(adev->wakeup.ws, 0);
                 if (adev->wakeup.context.work.func)
                         queue_pm_work(&adev->wakeup.context.work);
         }
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 3ba1c3472cf9..fd86bec98dea 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -26,7 +26,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
         struct nfit_spa *nfit_spa;
 
         /* We only care about memory errors */
-        if (!(mce->status & MCACOD))
+        if (!mce_is_memory_error(mce))
                 return NOTIFY_DONE;
 
         /*
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e39ec7b7cb67..d53162997f32 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1371,8 +1371,8 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
         iort_set_dma_mask(dev);
 
         iommu = iort_iommu_configure(dev);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
         /*
@@ -1428,6 +1428,37 @@ static void acpi_init_coherency(struct acpi_device *adev)
         adev->flags.coherent_dma = cca;
 }
 
+static int acpi_check_spi_i2c_slave(struct acpi_resource *ares, void *data)
+{
+        bool *is_spi_i2c_slave_p = data;
+
+        if (ares->type != ACPI_RESOURCE_TYPE_SERIAL_BUS)
+                return 1;
+
+        /*
+         * devices that are connected to UART still need to be enumerated to
+         * platform bus
+         */
+        if (ares->data.common_serial_bus.type != ACPI_RESOURCE_SERIAL_TYPE_UART)
+                *is_spi_i2c_slave_p = true;
+
+         /* no need to do more checking */
+        return -1;
+}
+
+static bool acpi_is_spi_i2c_slave(struct acpi_device *device)
+{
+        struct list_head resource_list;
+        bool is_spi_i2c_slave = false;
+
+        INIT_LIST_HEAD(&resource_list);
+        acpi_dev_get_resources(device, &resource_list, acpi_check_spi_i2c_slave,
+                               &is_spi_i2c_slave);
+        acpi_dev_free_resource_list(&resource_list);
+
+        return is_spi_i2c_slave;
+}
+
 void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
                              int type, unsigned long long sta)
 {
@@ -1443,6 +1474,7 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
         acpi_bus_get_flags(device);
         device->flags.match_driver = false;
         device->flags.initialized = true;
+        device->flags.spi_i2c_slave = acpi_is_spi_i2c_slave(device);
         acpi_device_clear_enumerated(device);
         device_initialize(&device->dev);
         dev_set_uevent_suppress(&device->dev, true);
@@ -1727,38 +1759,13 @@ static acpi_status acpi_bus_check_add(acpi_handle handle, u32 lvl_not_used,
         return AE_OK;
 }
 
-static int acpi_check_spi_i2c_slave(struct acpi_resource *ares, void *data)
-{
-        bool *is_spi_i2c_slave_p = data;
-
-        if (ares->type != ACPI_RESOURCE_TYPE_SERIAL_BUS)
-                return 1;
-
-        /*
-         * devices that are connected to UART still need to be enumerated to
-         * platform bus
-         */
-        if (ares->data.common_serial_bus.type != ACPI_RESOURCE_SERIAL_TYPE_UART)
-                *is_spi_i2c_slave_p = true;
-
-         /* no need to do more checking */
-        return -1;
-}
-
 static void acpi_default_enumeration(struct acpi_device *device)
 {
-        struct list_head resource_list;
-        bool is_spi_i2c_slave = false;
-
         /*
          * Do not enumerate SPI/I2C slaves as they will be enumerated by their
          * respective parents.
          */
-        INIT_LIST_HEAD(&resource_list);
-        acpi_dev_get_resources(device, &resource_list, acpi_check_spi_i2c_slave,
-                               &is_spi_i2c_slave);
-        acpi_dev_free_resource_list(&resource_list);
-        if (!is_spi_i2c_slave) {
+        if (!device->flags.spi_i2c_slave) {
                 acpi_create_platform_device(device, NULL);
                 acpi_device_set_enumerated(device);
         } else {
@@ -1854,7 +1861,7 @@ static void acpi_bus_attach(struct acpi_device *device)
                 return;
 
         device->flags.match_driver = true;
-        if (ret > 0) {
+        if (ret > 0 && !device->flags.spi_i2c_slave) {
                 acpi_device_set_enumerated(device);
                 goto ok;
         }
@@ -1863,10 +1870,10 @@ static void acpi_bus_attach(struct acpi_device *device)
         if (ret < 0)
                 return;
 
-        if (device->pnp.type.platform_id)
-                acpi_default_enumeration(device);
-        else
+        if (!device->pnp.type.platform_id && !device->flags.spi_i2c_slave)
                 acpi_device_set_enumerated(device);
+        else
+                acpi_default_enumeration(device);
 
  ok:
         list_for_each_entry(child, &device->children, node)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index a6574d626340..097d630ab886 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -663,40 +663,14 @@ static int acpi_freeze_prepare(void)
         acpi_os_wait_events_complete();
         if (acpi_sci_irq_valid())
                 enable_irq_wake(acpi_sci_irq);
-
         return 0;
 }
 
-static void acpi_freeze_wake(void)
-{
-        /*
-         * If IRQD_WAKEUP_ARMED is not set for the SCI at this point, it means
-         * that the SCI has triggered while suspended, so cancel the wakeup in
-         * case it has not been a wakeup event (the GPEs will be checked later).
-         */
-        if (acpi_sci_irq_valid() &&
-            !irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
-                pm_system_cancel_wakeup();
-}
-
-static void acpi_freeze_sync(void)
-{
-        /*
-         * Process all pending events in case there are any wakeup ones.
-         *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
-         */
-        acpi_os_wait_events_complete();
-        flush_scheduled_work();
-}
-
 static void acpi_freeze_restore(void)
 {
         acpi_disable_wakeup_devices(ACPI_STATE_S0);
         if (acpi_sci_irq_valid())
                 disable_irq_wake(acpi_sci_irq);
-
         acpi_enable_all_runtime_gpes();
 }
 
@@ -708,8 +682,6 @@ static void acpi_freeze_end(void)
 static const struct platform_freeze_ops acpi_freeze_ops = {
         .begin = acpi_freeze_begin,
         .prepare = acpi_freeze_prepare,
-        .wake = acpi_freeze_wake,
-        .sync = acpi_freeze_sync,
         .restore = acpi_freeze_restore,
         .end = acpi_freeze_end,
 };
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 1b5ee1e0e5a3..e414fabf7315 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -333,14 +333,17 @@ static ssize_t acpi_table_show(struct file *filp, struct kobject *kobj,
             container_of(bin_attr, struct acpi_table_attr, attr);
         struct acpi_table_header *table_header = NULL;
         acpi_status status;
+        ssize_t rc;
 
         status = acpi_get_table(table_attr->name, table_attr->instance,
                                 &table_header);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        return memory_read_from_buffer(buf, count, &offset,
-                                       table_header, table_header->length);
+        rc = memory_read_from_buffer(buf, count, &offset, table_header,
+                        table_header->length);
+        acpi_put_table(table_header);
+        return rc;
 }
 
 static int acpi_table_attr_init(struct kobject *tables_obj,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 2fc52407306c..c69954023c2e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1364,6 +1364,40 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
 
+/*
+ * On the Acer Aspire Switch Alpha 12, sometimes all SATA ports are detected
+ * as DUMMY, or detected but eventually get a "link down" and never get up
+ * again. When this happens, CAP.NP may hold a value of 0x00 or 0x01, and the
+ * port_map may hold a value of 0x00.
+ *
+ * Overriding CAP.NP to 0x02 and the port_map to 0x7 will reveal all 3 ports
+ * and can significantly reduce the occurrence of the problem.
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=189471
+ */
+static void acer_sa5_271_workaround(struct ahci_host_priv *hpriv,
+                                    struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                {
+                        .ident = "Acer Switch Alpha 12",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271")
+                        },
+                },
+                { }
+        };
+
+        if (dmi_check_system(sysids)) {
+                dev_info(&pdev->dev, "enabling Acer Switch Alpha 12 workaround\n");
+                if ((hpriv->saved_cap & 0xC734FF00) == 0xC734FF00) {
+                        hpriv->port_map = 0x7;
+                        hpriv->cap = 0xC734FF02;
+                }
+        }
+}
+
 #ifdef CONFIG_ARM64
 /*
  * Due to ERRATA#22536, ThunderX needs to handle HOST_IRQ_STAT differently.
@@ -1636,6 +1670,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                          "online status unreliable, applying workaround\n");
         }
 
+
+        /* Acer SA5-271 workaround modifies private_data */
+        acer_sa5_271_workaround(hpriv, pdev);
+
         /* CAP.NP sometimes indicate the index of the last enabled
          * port, at other times, that of the last possible port, so
          * determining the maximum port number requires looking at
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index aaa761b9081c..cd2eab6aa92e 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev,
 
         irq = platform_get_irq(pdev, 0);
         if (irq <= 0) {
-                dev_err(dev, "no irq\n");
-                return -EINVAL;
+                if (irq != -EPROBE_DEFER)
+                        dev_err(dev, "no irq\n");
+                return irq;
         }
 
         hpriv->irq = irq;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d83b8c75965..e157a0e44419 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6800,7 +6800,7 @@ static int __init ata_parse_force_one(char **cur,
         }
 
         force_ent->port = simple_strtoul(id, &endp, 10);
-        if (p == endp || *endp != '\0') {
+        if (id == endp || *endp != '\0') {
                 *reason = "invalid port/link";
                 return -EINVAL;
         }
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index b66bcda88320..3b2246dded74 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4067,7 +4067,6 @@ static int mv_platform_probe(struct platform_device *pdev)
         struct ata_host *host;
         struct mv_host_priv *hpriv;
         struct resource *res;
-        void __iomem *mmio;
         int n_ports = 0, irq = 0;
         int rc;
         int port;
@@ -4086,9 +4085,8 @@ static int mv_platform_probe(struct platform_device *pdev)
          * Get the register base first
          */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mmio = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mmio))
-                return PTR_ERR(mmio);
+        if (res == NULL)
+                return -EINVAL;
 
         /* allocate host */
         if (pdev->dev.of_node) {
@@ -4132,7 +4130,12 @@ static int mv_platform_probe(struct platform_device *pdev)
         hpriv->board_idx = chip_soc;
 
         host->iomap = NULL;
-        hpriv->base = mmio - SATAHC0_REG_BASE;
+        hpriv->base = devm_ioremap(&pdev->dev, res->start,
+                                   resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+
+        hpriv->base -= SATAHC0_REG_BASE;
 
         hpriv->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(hpriv->clk))
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 5d38245a7a73..b7939a2c1fab 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -890,7 +890,10 @@ static int sata_rcar_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "failed to get access to sata clock\n");
                 return PTR_ERR(priv->clk);
         }
-        clk_prepare_enable(priv->clk);
+
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         host = ata_host_alloc(&pdev->dev, 1);
         if (!host) {
@@ -970,8 +973,11 @@ static int sata_rcar_resume(struct device *dev)
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
         void __iomem *base = priv->base;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         /* ack and mask */
         iowrite32(0, base + SATAINTSTAT_REG);
@@ -988,8 +994,11 @@ static int sata_rcar_restore(struct device *dev)
 {
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         sata_rcar_setup_port(host);
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e987a6f55d36..9faee1c893e5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1091,6 +1091,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         if (async_error)
                 goto Complete;
 
+        if (pm_wakeup_pending()) {
+                async_error = -EBUSY;
+                goto Complete;
+        }
+
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index f62082fdd670..c313b600d356 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -28,8 +28,8 @@ bool events_check_enabled __read_mostly;
 /* First wakeup IRQ seen by the kernel in the last cycle. */
 unsigned int pm_wakeup_irq __read_mostly;
 
-/* If greater than 0 and the system is suspending, terminate the suspend. */
-static atomic_t pm_abort_suspend __read_mostly;
+/* If set and the system is suspending, terminate the suspend. */
+static bool pm_abort_suspend __read_mostly;
 
 /*
  * Combined counters of registered wakeup events and wakeup events in progress.
@@ -512,13 +512,12 @@ static bool wakeup_source_not_registered(struct wakeup_source *ws)
 /**
  * wakup_source_activate - Mark given wakeup source as active.
  * @ws: Wakeup source to handle.
- * @hard: If set, abort suspends in progress and wake up from suspend-to-idle.
  *
  * Update the @ws' statistics and, if @ws has just been activated, notify the PM
  * core of the event by incrementing the counter of of wakeup events being
  * processed.
  */
-static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
+static void wakeup_source_activate(struct wakeup_source *ws)
 {
         unsigned int cec;
 
@@ -526,9 +525,6 @@ static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
                         "unregistered wakeup source\n"))
                 return;
 
-        if (hard)
-                pm_system_wakeup();
-
         ws->active = true;
         ws->active_count++;
         ws->last_time = ktime_get();
@@ -554,7 +550,10 @@ static void wakeup_source_report_event(struct wakeup_source *ws, bool hard)
                 ws->wakeup_count++;
 
         if (!ws->active)
-                wakeup_source_activate(ws, hard);
+                wakeup_source_activate(ws);
+
+        if (hard)
+                pm_system_wakeup();
 }
 
 /**
@@ -856,26 +855,20 @@ bool pm_wakeup_pending(void)
                 pm_print_active_wakeup_sources();
         }
 
-        return ret || atomic_read(&pm_abort_suspend) > 0;
+        return ret || pm_abort_suspend;
 }
 
 void pm_system_wakeup(void)
 {
-        atomic_inc(&pm_abort_suspend);
+        pm_abort_suspend = true;
         freeze_wake();
 }
 EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
-void pm_system_cancel_wakeup(void)
-{
-        atomic_dec(&pm_abort_suspend);
-}
-
-void pm_wakeup_clear(bool reset)
+void pm_wakeup_clear(void)
 {
+        pm_abort_suspend = false;
         pm_wakeup_irq = 0;
-        if (reset)
-                atomic_set(&pm_abort_suspend, 0);
 }
 
 void pm_system_irq_wakeup(unsigned int irq_number)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 28d932906f24..ebbd0c3fe0ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -608,6 +608,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
  */
 static int loop_flush(struct loop_device *lo)
 {
+        /* loop not yet configured, no running thread, nothing to flush */
+        if (lo->lo_state != Lo_bound)
+                return 0;
         return loop_switch(lo, NULL);
 }
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9a7bb2c29447..f3f191ba8ca4 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -937,14 +937,6 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
         return -ENOSPC;
 }
 
-/* Reset all properties of an NBD device */
-static void nbd_reset(struct nbd_device *nbd)
-{
-        nbd->config = NULL;
-        nbd->tag_set.timeout = 0;
-        queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
-}
-
 static void nbd_bdev_reset(struct block_device *bdev)
 {
         if (bdev->bd_openers > 1)
@@ -1029,7 +1021,11 @@ static void nbd_config_put(struct nbd_device *nbd)
                         }
                         kfree(config->socks);
                 }
-                nbd_reset(nbd);
+                kfree(nbd->config);
+                nbd->config = NULL;
+
+                nbd->tag_set.timeout = 0;
+                queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
 
                 mutex_unlock(&nbd->config_lock);
                 nbd_put(nbd);
@@ -1483,7 +1479,6 @@ static int nbd_dev_add(int index)
         disk->fops = &nbd_fops;
         disk->private_data = nbd;
         sprintf(disk->disk_name, "nbd%d", index);
-        nbd_reset(nbd);
         add_disk(disk);
         nbd_total_devices++;
         return index;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 454bf9c34882..c16f74547804 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4023,6 +4023,7 @@ static void rbd_queue_workfn(struct work_struct *work)
 
         switch (req_op(rq)) {
         case REQ_OP_DISCARD:
+        case REQ_OP_WRITE_ZEROES:
                 op_type = OBJ_OP_DISCARD;
                 break;
         case REQ_OP_WRITE:
@@ -4420,6 +4421,7 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
         q->limits.discard_granularity = segment_size;
         q->limits.discard_alignment = segment_size;
         blk_queue_max_discard_sectors(q, segment_size / SECTOR_SIZE);
+        blk_queue_max_write_zeroes_sectors(q, segment_size / SECTOR_SIZE);
 
         if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
                 q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 726c32e35db9..0e824091a12f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -609,8 +609,6 @@ int xen_blkif_schedule(void *arg)
         unsigned long timeout;
         int ret;
 
-        xen_blkif_get(blkif);
-
         set_freezable();
         while (!kthread_should_stop()) {
                 if (try_to_freeze())
@@ -665,7 +663,6 @@ purge_gnt_list:
                 print_stats(ring);
 
         ring->xenblkd = NULL;
-        xen_blkif_put(blkif);
 
         return 0;
 }
@@ -1436,34 +1433,35 @@ static int dispatch_rw_block_io(struct xen_blkif_ring *ring,
 static void make_response(struct xen_blkif_ring *ring, u64 id,
                           unsigned short op, int st)
 {
-        struct blkif_response  resp;
+        struct blkif_response *resp;
         unsigned long     flags;
         union blkif_back_rings *blk_rings;
         int notify;
 
-        resp.id        = id;
-        resp.operation = op;
-        resp.status    = st;
-
         spin_lock_irqsave(&ring->blk_ring_lock, flags);
         blk_rings = &ring->blk_rings;
         /* Place on the response ring for the relevant domain. */
         switch (ring->blkif->blk_protocol) {
         case BLKIF_PROTOCOL_NATIVE:
-                memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->native,
+                                         blk_rings->native.rsp_prod_pvt);
                 break;
         case BLKIF_PROTOCOL_X86_32:
-                memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->x86_32,
+                                         blk_rings->x86_32.rsp_prod_pvt);
                 break;
         case BLKIF_PROTOCOL_X86_64:
-                memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt),
-                       &resp, sizeof(resp));
+                resp = RING_GET_RESPONSE(&blk_rings->x86_64,
+                                         blk_rings->x86_64.rsp_prod_pvt);
                 break;
         default:
                 BUG();
         }
+
+        resp->id        = id;
+        resp->operation = op;
+        resp->status    = st;
+
         blk_rings->common.rsp_prod_pvt++;
         RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify);
         spin_unlock_irqrestore(&ring->blk_ring_lock, flags);
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index dea61f6ab8cb..ecb35fe8ca8d 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -75,9 +75,8 @@ extern unsigned int xenblk_max_queues;
 struct blkif_common_request {
         char dummy;
 };
-struct blkif_common_response {
-        char dummy;
-};
+
+/* i386 protocol version */
 
 struct blkif_x86_32_request_rw {
         uint8_t        nr_segments;  /* number of segments                   */
@@ -129,14 +128,6 @@ struct blkif_x86_32_request {
         } u;
 } __attribute__((__packed__));
 
-/* i386 protocol version */
-#pragma pack(push, 4)
-struct blkif_x86_32_response {
-        uint64_t        id;              /* copied from request */
-        uint8_t         operation;       /* copied from request */
-        int16_t         status;          /* BLKIF_RSP_???       */
-};
-#pragma pack(pop)
 /* x86_64 protocol version */
 
 struct blkif_x86_64_request_rw {
@@ -193,18 +184,12 @@ struct blkif_x86_64_request {
         } u;
 } __attribute__((__packed__));
 
-struct blkif_x86_64_response {
-        uint64_t       __attribute__((__aligned__(8))) id;
-        uint8_t         operation;       /* copied from request */
-        int16_t         status;          /* BLKIF_RSP_???       */
-};
-
 DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
-                  struct blkif_common_response);
+                  struct blkif_response);
 DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
-                  struct blkif_x86_32_response);
+                  struct blkif_response __packed);
 DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
-                  struct blkif_x86_64_response);
+                  struct blkif_response);
 
 union blkif_back_rings {
         struct blkif_back_ring        native;
@@ -281,6 +266,7 @@ struct xen_blkif_ring {
 
         wait_queue_head_t       wq;
         atomic_t                inflight;
+        bool                    active;
         /* One thread per blkif ring. */
         struct task_struct      *xenblkd;
         unsigned int            waiting_reqs;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 1f3dfaa54d87..792da683e70d 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
                 init_waitqueue_head(&ring->shutdown_wq);
                 ring->blkif = blkif;
                 ring->st_print = jiffies;
-                xen_blkif_get(blkif);
+                ring->active = true;
         }
 
         return 0;
@@ -249,10 +249,12 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 struct xen_blkif_ring *ring = &blkif->rings[r];
                 unsigned int i = 0;
 
+                if (!ring->active)
+                        continue;
+
                 if (ring->xenblkd) {
                         kthread_stop(ring->xenblkd);
                         wake_up(&ring->shutdown_wq);
-                        ring->xenblkd = NULL;
                 }
 
                 /* The above kthread_stop() guarantees that at this point we
@@ -296,7 +298,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
                 BUG_ON(ring->free_pages_num != 0);
                 BUG_ON(ring->persistent_gnt_c != 0);
                 WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
-                xen_blkif_put(blkif);
+                ring->active = false;
         }
         blkif->nr_ring_pages = 0;
         /*
@@ -312,9 +314,10 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 
 static void xen_blkif_free(struct xen_blkif *blkif)
 {
-
-        xen_blkif_disconnect(blkif);
+        WARN_ON(xen_blkif_disconnect(blkif));
         xen_vbd_free(&blkif->vbd);
+        kfree(blkif->be->mode);
+        kfree(blkif->be);
 
         /* Make sure everything is drained before shutting down */
         kmem_cache_free(xen_blkif_cachep, blkif);
@@ -511,8 +514,6 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
                 xen_blkif_put(be->blkif);
         }
 
-        kfree(be->mode);
-        kfree(be);
         return 0;
 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6e0cbe092220..593a8818aca9 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -343,7 +343,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma)
         phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
 
         /* It's illegal to wrap around the end of the physical address space. */
-        if (offset + (phys_addr_t)size < offset)
+        if (offset + (phys_addr_t)size - 1 < offset)
                 return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index d4dbd8d8e524..382c864814d9 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
 
         rc = write_sync_reg(SCR_HOST_TO_READER_START, dev);
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         for (i = 0; i < bytes_to_write; i++) {
                 rc = wait_for_bulk_out_ready(dev);
                 if (rc <= 0) {
-                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n",
+                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n",
                                rc);
                         DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                         if (rc == -ERESTARTSYS)
@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev);
 
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0ab024918907..01a260f67437 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1,6 +1,9 @@
 /*
  * random.c -- A strong random number generator
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
+ * Rights Reserved.
+ *
  * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
  *
  * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999.  All
@@ -762,6 +765,8 @@ static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
 static struct crng_state **crng_node_pool __read_mostly;
 #endif
 
+static void invalidate_batched_entropy(void);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -798,12 +803,13 @@ static int crng_fast_load(const char *cp, size_t len)
                 p[crng_init_cnt % CHACHA20_KEY_SIZE] ^= *cp;
                 cp++; crng_init_cnt++; len--;
         }
+        spin_unlock_irqrestore(&primary_crng.lock, flags);
         if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
+                invalidate_batched_entropy();
                 crng_init = 1;
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: fast init done\n");
         }
-        spin_unlock_irqrestore(&primary_crng.lock, flags);
         return 1;
 }
 
@@ -835,13 +841,14 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         }
         memzero_explicit(&buf, sizeof(buf));
         crng->init_time = jiffies;
+        spin_unlock_irqrestore(&primary_crng.lock, flags);
         if (crng == &primary_crng && crng_init < 2) {
+                invalidate_batched_entropy();
                 crng_init = 2;
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: crng init done\n");
         }
-        spin_unlock_irqrestore(&primary_crng.lock, flags);
 }
 
 static inline void crng_wait_ready(void)
@@ -1097,12 +1104,16 @@ static void add_interrupt_bench(cycles_t start)
 static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
 {
         __u32 *ptr = (__u32 *) regs;
+        unsigned int idx;
 
         if (regs == NULL)
                 return 0;
-        if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
-                f->reg_idx = 0;
-        return *(ptr + f->reg_idx++);
+        idx = READ_ONCE(f->reg_idx);
+        if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
+                idx = 0;
+        ptr += idx++;
+        WRITE_ONCE(f->reg_idx, idx);
+        return *ptr;
 }
 
 void add_interrupt_randomness(int irq, int irq_flags)
@@ -2019,6 +2030,7 @@ struct batched_entropy {
         };
         unsigned int position;
 };
+static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_reset_lock);
 
 /*
  * Get a random word for internal kernel use only. The quality of the random
@@ -2029,6 +2041,8 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
 u64 get_random_u64(void)
 {
         u64 ret;
+        bool use_lock = READ_ONCE(crng_init) < 2;
+        unsigned long flags = 0;
         struct batched_entropy *batch;
 
 #if BITS_PER_LONG == 64
@@ -2041,11 +2055,15 @@ u64 get_random_u64(void)
 #endif
 
         batch = &get_cpu_var(batched_entropy_u64);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
                 extract_crng((u8 *)batch->entropy_u64);
                 batch->position = 0;
         }
         ret = batch->entropy_u64[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u64);
         return ret;
 }
@@ -2055,22 +2073,45 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
 u32 get_random_u32(void)
 {
         u32 ret;
+        bool use_lock = READ_ONCE(crng_init) < 2;
+        unsigned long flags = 0;
         struct batched_entropy *batch;
 
         if (arch_get_random_int(&ret))
                 return ret;
 
         batch = &get_cpu_var(batched_entropy_u32);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
                 extract_crng((u8 *)batch->entropy_u32);
                 batch->position = 0;
         }
         ret = batch->entropy_u32[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u32);
         return ret;
 }
 EXPORT_SYMBOL(get_random_u32);
 
+/* It's important to invalidate all potential batched entropy that might
+ * be stored before the crng is initialized, which we can do lazily by
+ * simply resetting the counter to zero so that it's re-extracted on the
+ * next usage. */
+static void invalidate_batched_entropy(void)
+{
+        int cpu;
+        unsigned long flags;
+
+        write_lock_irqsave(&batched_entropy_reset_lock, flags);
+        for_each_possible_cpu (cpu) {
+                per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
+                per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
+        }
+        write_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+}
+
 /**
  * randomize_page - Generate a random, page aligned address
  * @start:      The smallest acceptable address the caller will take.
diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
index 19480bcc7046..2f29ee1a4d00 100644
--- a/drivers/clk/meson/Kconfig
+++ b/drivers/clk/meson/Kconfig
@@ -14,6 +14,7 @@ config COMMON_CLK_MESON8B
 config COMMON_CLK_GXBB
         bool
         depends on COMMON_CLK_AMLOGIC
+        select RESET_CONTROLLER
         help
           Support for the clock controller on AmLogic S905 devices, aka gxbb.
           Say Y if you want peripherals and CPU frequency scaling to work.
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index b0d551a8efe4..eb89c7801f00 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -156,6 +156,7 @@ config SUN8I_R_CCU
         bool "Support for Allwinner SoCs' PRCM CCUs"
         select SUNXI_CCU_DIV
         select SUNXI_CCU_GATE
+        select SUNXI_CCU_MP
         default MACH_SUN8I || (ARCH_SUNXI && ARM64)
 
 endif
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
index 9b3cd24b78d2..061b6fbb4f95 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
@@ -31,7 +31,9 @@
 #define CLK_PLL_VIDEO0_2X               8
 #define CLK_PLL_VE                      9
 #define CLK_PLL_DDR0                    10
-#define CLK_PLL_PERIPH0                 11
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X              12
 #define CLK_PLL_PERIPH1                 13
 #define CLK_PLL_PERIPH1_2X              14
diff --git a/drivers/clk/sunxi-ng/ccu-sun5i.c b/drivers/clk/sunxi-ng/ccu-sun5i.c
index 5c476f966a72..5372bf8be5e6 100644
--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
+++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
@@ -243,7 +243,7 @@ static SUNXI_CCU_GATE(ahb_ss_clk,	"ahb-ss",	"ahb",
 static SUNXI_CCU_GATE(ahb_dma_clk,      "ahb-dma",      "ahb",
                       0x060, BIT(6), 0);
 static SUNXI_CCU_GATE(ahb_bist_clk,     "ahb-bist",     "ahb",
-                      0x060, BIT(6), 0);
+                      0x060, BIT(7), 0);
 static SUNXI_CCU_GATE(ahb_mmc0_clk,     "ahb-mmc0",     "ahb",
                       0x060, BIT(8), 0);
 static SUNXI_CCU_GATE(ahb_mmc1_clk,     "ahb-mmc1",     "ahb",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 89e68d29bf45..df97e25aec76 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents,
                                  0x12c, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents,
-                                 0x12c, 0, 4, 24, 3, BIT(31),
+                                 0x130, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
 static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
index 85973d1e8165..1b4baea37d81 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
@@ -29,7 +29,9 @@
 #define CLK_PLL_VIDEO           6
 #define CLK_PLL_VE              7
 #define CLK_PLL_DDR             8
-#define CLK_PLL_PERIPH0         9
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X      10
 #define CLK_PLL_GPU             11
 #define CLK_PLL_PERIPH1         12
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index e58706b40ae9..6297add857b5 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -537,7 +537,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
         [RST_BUS_EMAC]          =  { 0x2c0, BIT(17) },
         [RST_BUS_HSTIMER]       =  { 0x2c0, BIT(19) },
         [RST_BUS_SPI0]          =  { 0x2c0, BIT(20) },
-        [RST_BUS_OTG]           =  { 0x2c0, BIT(23) },
+        [RST_BUS_OTG]           =  { 0x2c0, BIT(24) },
         [RST_BUS_EHCI0]         =  { 0x2c0, BIT(26) },
         [RST_BUS_OHCI0]         =  { 0x2c0, BIT(29) },
 
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 4bed671e490e..8b5c30062d99 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1209,9 +1209,9 @@ arch_timer_mem_frame_get_cntfrq(struct arch_timer_mem_frame *frame)
                 return 0;
         }
 
-        rate = readl_relaxed(frame + CNTFRQ);
+        rate = readl_relaxed(base + CNTFRQ);
 
-        iounmap(frame);
+        iounmap(base);
 
         return rate;
 }
diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
index 44e5e951583b..8e64b8460f11 100644
--- a/drivers/clocksource/cadence_ttc_timer.c
+++ b/drivers/clocksource/cadence_ttc_timer.c
@@ -18,6 +18,7 @@
 #include <linux/clk.h>
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
+#include <linux/clocksource.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/slab.h>
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 2e9c830ae1cd..c4656c4d44a6 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -12,6 +12,7 @@
 
 #include <linux/clk.h>
 #include <linux/clockchips.h>
+#include <linux/clocksource.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 74ed7e9a7f27..2011fec2d6ad 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,6 +71,15 @@ config ARM_HIGHBANK_CPUFREQ
 
           If in doubt, say N.
 
+config ARM_DB8500_CPUFREQ
+        tristate "ST-Ericsson DB8500 cpufreq" if COMPILE_TEST && !ARCH_U8500
+        default ARCH_U8500
+        depends on HAS_IOMEM
+        depends on !CPU_THERMAL || THERMAL
+        help
+          This adds the CPUFreq driver for ST-Ericsson Ux500 (DB8500) SoC
+          series.
+
 config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index b7e78f063c4f..ab3a42cd29ef 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -53,7 +53,7 @@ obj-$(CONFIG_ARM_DT_BL_CPUFREQ)		+= arm_big_little_dt.o
 
 obj-$(CONFIG_ARM_BRCMSTB_AVS_CPUFREQ)   += brcmstb-avs-cpufreq.o
 obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
-obj-$(CONFIG_UX500_SOC_DB8500)          += dbx500-cpufreq.o
+obj-$(CONFIG_ARM_DB8500_CPUFREQ)        += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS5440_CPUFREQ)    += exynos5440-cpufreq.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUFREQ)      += highbank-cpufreq.o
 obj-$(CONFIG_ARM_IMX6Q_CPUFREQ)         += imx6q-cpufreq.o
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 0e3f6496524d..26b643d57847 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2468,6 +2468,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         if (!(cpufreq_driver->flags & CPUFREQ_STICKY) &&
             list_empty(&cpufreq_policy_list)) {
                 /* if all ->init() calls failed, unregister */
+                ret = -ENODEV;
                 pr_debug("%s: No CPU initialized for driver %s\n", __func__,
                          driver_data->name);
                 goto err_if_unreg;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 992f7c20760f..88220ff3e1c2 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -185,8 +185,8 @@ static ssize_t store_down_threshold(struct gov_attr_set *attr_set,
         int ret;
         ret = sscanf(buf, "%u", &input);
 
-        /* cannot be lower than 11 otherwise freq will not fall */
-        if (ret != 1 || input < 11 || input > 100 ||
+        /* cannot be lower than 1 otherwise freq will not fall */
+        if (ret != 1 || input < 1 || input > 100 ||
                         input >= dbs_data->up_threshold)
                 return -EINVAL;
 
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7de5bd76a31..eb1158532de3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -571,9 +571,10 @@ static inline void update_turbo_state(void)
 static int min_perf_pct_min(void)
 {
         struct cpudata *cpu = all_cpu_data[0];
+        int turbo_pstate = cpu->pstate.turbo_pstate;
 
-        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
-                            cpu->pstate.turbo_pstate);
+        return turbo_pstate ?
+                DIV_ROUND_UP(cpu->pstate.min_pstate * 100, turbo_pstate) : 0;
 }
 
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
index 1b9bcd76c60e..c2dd43f3f5d8 100644
--- a/drivers/cpufreq/kirkwood-cpufreq.c
+++ b/drivers/cpufreq/kirkwood-cpufreq.c
@@ -127,7 +127,12 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 return PTR_ERR(priv.cpu_clk);
         }
 
-        clk_prepare_enable(priv.cpu_clk);
+        err = clk_prepare_enable(priv.cpu_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare cpuclk\n");
+                return err;
+        }
+
         kirkwood_freq_table[0].frequency = clk_get_rate(priv.cpu_clk) / 1000;
 
         priv.ddr_clk = of_clk_get_by_name(np, "ddrclk");
@@ -137,7 +142,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 goto out_cpu;
         }
 
-        clk_prepare_enable(priv.ddr_clk);
+        err = clk_prepare_enable(priv.ddr_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare ddrclk\n");
+                goto out_cpu;
+        }
         kirkwood_freq_table[1].frequency = clk_get_rate(priv.ddr_clk) / 1000;
 
         priv.powersave_clk = of_clk_get_by_name(np, "powersave");
@@ -146,7 +155,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 err = PTR_ERR(priv.powersave_clk);
                 goto out_ddr;
         }
-        clk_prepare_enable(priv.powersave_clk);
+        err = clk_prepare_enable(priv.powersave_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare powersave clk\n");
+                goto out_ddr;
+        }
 
         of_node_put(np);
         np = NULL;
diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c
index ffca4fc0061d..ae8eb0359889 100644
--- a/drivers/cpuidle/dt_idle_states.c
+++ b/drivers/cpuidle/dt_idle_states.c
@@ -180,8 +180,10 @@ int dt_init_idle_driver(struct cpuidle_driver *drv,
                 if (!state_node)
                         break;
 
-                if (!of_device_is_available(state_node))
+                if (!of_device_is_available(state_node)) {
+                        of_node_put(state_node);
                         continue;
+                }
 
                 if (!idle_state_valid(state_node, i, cpumask)) {
                         pr_warn("%s idle state not valid, bailing out\n",
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 6ed32aac8bbe..922d0823f8ec 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -210,9 +210,12 @@ EXPORT_SYMBOL_GPL(kill_dax);
 static struct inode *dax_alloc_inode(struct super_block *sb)
 {
         struct dax_device *dax_dev;
+        struct inode *inode;
 
         dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
-        return &dax_dev->inode;
+        inode = &dax_dev->inode;
+        inode->i_rdev = 0;
+        return inode;
 }
 
 static struct dax_device *to_dax_dev(struct inode *inode)
@@ -227,7 +230,8 @@ static void dax_i_callback(struct rcu_head *head)
 
         kfree(dax_dev->host);
         dax_dev->host = NULL;
-        ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
+        if (inode->i_rdev)
+                ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
         kmem_cache_free(dax_cache, dax_dev);
 }
 
@@ -423,6 +427,7 @@ static void init_once(void *_dax_dev)
         struct dax_device *dax_dev = _dax_dev;
         struct inode *inode = &dax_dev->inode;
 
+        memset(dax_dev, 0, sizeof(*dax_dev));
         inode_init_once(inode);
 }
 
diff --git a/drivers/devfreq/event/exynos-nocp.c b/drivers/devfreq/event/exynos-nocp.c
index 5c3e7b11e8a6..f6e7956fc91a 100644
--- a/drivers/devfreq/event/exynos-nocp.c
+++ b/drivers/devfreq/event/exynos-nocp.c
@@ -267,7 +267,11 @@ static int exynos_nocp_probe(struct platform_device *pdev)
         }
         platform_set_drvdata(pdev, nocp);
 
-        clk_prepare_enable(nocp->clk);
+        ret = clk_prepare_enable(nocp->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         pr_info("exynos-nocp: new NoC Probe device registered: %s\n",
                         dev_name(dev));
diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
index 9b7350935b73..d96e3dc71cf8 100644
--- a/drivers/devfreq/event/exynos-ppmu.c
+++ b/drivers/devfreq/event/exynos-ppmu.c
@@ -44,7 +44,7 @@ struct exynos_ppmu {
         { "ppmu-event2-"#name, PPMU_PMNCNT2 },  \
         { "ppmu-event3-"#name, PPMU_PMNCNT3 }
 
-struct __exynos_ppmu_events {
+static struct __exynos_ppmu_events {
         char *name;
         int id;
 } ppmu_events[] = {
@@ -648,7 +648,11 @@ static int exynos_ppmu_probe(struct platform_device *pdev)
                         dev_name(&pdev->dev), desc[i].name);
         }
 
-        clk_prepare_enable(info->ppmu.clk);
+        ret = clk_prepare_enable(info->ppmu.clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index d37e8dda8079..ec240592f5c8 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -201,6 +201,7 @@ struct ep93xx_dma_engine {
         struct dma_device       dma_dev;
         bool                    m2m;
         int                     (*hw_setup)(struct ep93xx_dma_chan *);
+        void                    (*hw_synchronize)(struct ep93xx_dma_chan *);
         void                    (*hw_shutdown)(struct ep93xx_dma_chan *);
         void                    (*hw_submit)(struct ep93xx_dma_chan *);
         int                     (*hw_interrupt)(struct ep93xx_dma_chan *);
@@ -323,6 +324,8 @@ static int m2p_hw_setup(struct ep93xx_dma_chan *edmac)
                 | M2P_CONTROL_ENABLE;
         m2p_set_control(edmac, control);
 
+        edmac->buffer = 0;
+
         return 0;
 }
 
@@ -331,21 +334,27 @@ static inline u32 m2p_channel_state(struct ep93xx_dma_chan *edmac)
         return (readl(edmac->regs + M2P_STATUS) >> 4) & 0x3;
 }
 
-static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+static void m2p_hw_synchronize(struct ep93xx_dma_chan *edmac)
 {
+        unsigned long flags;
         u32 control;
 
+        spin_lock_irqsave(&edmac->lock, flags);
         control = readl(edmac->regs + M2P_CONTROL);
         control &= ~(M2P_CONTROL_STALLINT | M2P_CONTROL_NFBINT);
         m2p_set_control(edmac, control);
+        spin_unlock_irqrestore(&edmac->lock, flags);
 
         while (m2p_channel_state(edmac) >= M2P_STATE_ON)
-                cpu_relax();
+                schedule();
+}
 
+static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+{
         m2p_set_control(edmac, 0);
 
-        while (m2p_channel_state(edmac) == M2P_STATE_STALL)
-                cpu_relax();
+        while (m2p_channel_state(edmac) != M2P_STATE_IDLE)
+                dev_warn(chan2dev(edmac), "M2P: Not yet IDLE\n");
 }
 
 static void m2p_fill_desc(struct ep93xx_dma_chan *edmac)
@@ -1161,6 +1170,26 @@ fail:
 }
 
 /**
+ * ep93xx_dma_synchronize - Synchronizes the termination of transfers to the
+ * current context.
+ * @chan: channel
+ *
+ * Synchronizes the DMA channel termination to the current context. When this
+ * function returns it is guaranteed that all transfers for previously issued
+ * descriptors have stopped and and it is safe to free the memory associated
+ * with them. Furthermore it is guaranteed that all complete callback functions
+ * for a previously submitted descriptor have finished running and it is safe to
+ * free resources accessed from within the complete callbacks.
+ */
+static void ep93xx_dma_synchronize(struct dma_chan *chan)
+{
+        struct ep93xx_dma_chan *edmac = to_ep93xx_dma_chan(chan);
+
+        if (edmac->edma->hw_synchronize)
+                edmac->edma->hw_synchronize(edmac);
+}
+
+/**
  * ep93xx_dma_terminate_all - terminate all transactions
  * @chan: channel
  *
@@ -1323,6 +1352,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         dma_dev->device_prep_slave_sg = ep93xx_dma_prep_slave_sg;
         dma_dev->device_prep_dma_cyclic = ep93xx_dma_prep_dma_cyclic;
         dma_dev->device_config = ep93xx_dma_slave_config;
+        dma_dev->device_synchronize = ep93xx_dma_synchronize;
         dma_dev->device_terminate_all = ep93xx_dma_terminate_all;
         dma_dev->device_issue_pending = ep93xx_dma_issue_pending;
         dma_dev->device_tx_status = ep93xx_dma_tx_status;
@@ -1340,6 +1370,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         } else {
                 dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
 
+                edma->hw_synchronize = m2p_hw_synchronize;
                 edma->hw_setup = m2p_hw_setup;
                 edma->hw_shutdown = m2p_hw_shutdown;
                 edma->hw_submit = m2p_hw_submit;
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index a28a01fcba67..f3e211f8f6c5 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -161,6 +161,7 @@ struct mv_xor_v2_device {
         struct mv_xor_v2_sw_desc *sw_desq;
         int desc_size;
         unsigned int npendings;
+        unsigned int hw_queue_idx;
 };
 
 /**
@@ -214,18 +215,6 @@ static void mv_xor_v2_set_data_buffers(struct mv_xor_v2_device *xor_dev,
 }
 
 /*
- * Return the next available index in the DESQ.
- */
-static int mv_xor_v2_get_desq_write_ptr(struct mv_xor_v2_device *xor_dev)
-{
-        /* read the index for the next available descriptor in the DESQ */
-        u32 reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_ALLOC_OFF);
-
-        return ((reg >> MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_SHIFT)
-                & MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_MASK);
-}
-
-/*
  * notify the engine of new descriptors, and update the available index.
  */
 static void mv_xor_v2_add_desc_to_desq(struct mv_xor_v2_device *xor_dev,
@@ -257,22 +246,6 @@ static int mv_xor_v2_set_desc_size(struct mv_xor_v2_device *xor_dev)
         return MV_XOR_V2_EXT_DESC_SIZE;
 }
 
-/*
- * Set the IMSG threshold
- */
-static inline
-void mv_xor_v2_set_imsg_thrd(struct mv_xor_v2_device *xor_dev, int thrd_val)
-{
-        u32 reg;
-
-        reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-
-        reg &= (~MV_XOR_V2_DMA_IMSG_THRD_MASK << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-        reg |= (thrd_val << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-
-        writel(reg, xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-}
-
 static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 {
         struct mv_xor_v2_device *xor_dev = data;
@@ -288,12 +261,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
         if (!ndescs)
                 return IRQ_NONE;
 
-        /*
-         * Update IMSG threshold, to disable new IMSG interrupts until
-         * end of the tasklet
-         */
-        mv_xor_v2_set_imsg_thrd(xor_dev, MV_XOR_V2_DESC_NUM);
-
         /* schedule a tasklet to handle descriptors callbacks */
         tasklet_schedule(&xor_dev->irq_tasklet);
 
@@ -306,7 +273,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 static dma_cookie_t
 mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        int desq_ptr;
         void *dest_hw_desc;
         dma_cookie_t cookie;
         struct mv_xor_v2_sw_desc *sw_desc =
@@ -322,15 +288,15 @@ mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
         spin_lock_bh(&xor_dev->lock);
         cookie = dma_cookie_assign(tx);
 
-        /* get the next available slot in the DESQ */
-        desq_ptr = mv_xor_v2_get_desq_write_ptr(xor_dev);
-
         /* copy the HW descriptor from the SW descriptor to the DESQ */
-        dest_hw_desc = xor_dev->hw_desq_virt + desq_ptr;
+        dest_hw_desc = xor_dev->hw_desq_virt + xor_dev->hw_queue_idx;
 
         memcpy(dest_hw_desc, &sw_desc->hw_desc, xor_dev->desc_size);
 
         xor_dev->npendings++;
+        xor_dev->hw_queue_idx++;
+        if (xor_dev->hw_queue_idx >= MV_XOR_V2_DESC_NUM)
+                xor_dev->hw_queue_idx = 0;
 
         spin_unlock_bh(&xor_dev->lock);
 
@@ -344,6 +310,7 @@ static struct mv_xor_v2_sw_desc	*
 mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
 {
         struct mv_xor_v2_sw_desc *sw_desc;
+        bool found = false;
 
         /* Lock the channel */
         spin_lock_bh(&xor_dev->lock);
@@ -355,19 +322,23 @@ mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
                 return NULL;
         }
 
-        /* get a free SW descriptor from the SW DESQ */
-        sw_desc = list_first_entry(&xor_dev->free_sw_desc,
-                                   struct mv_xor_v2_sw_desc, free_list);
+        list_for_each_entry(sw_desc, &xor_dev->free_sw_desc, free_list) {
+                if (async_tx_test_ack(&sw_desc->async_tx)) {
+                        found = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                spin_unlock_bh(&xor_dev->lock);
+                return NULL;
+        }
+
         list_del(&sw_desc->free_list);
 
         /* Release the channel */
         spin_unlock_bh(&xor_dev->lock);
 
-        /* set the async tx descriptor */
-        dma_async_tx_descriptor_init(&sw_desc->async_tx, &xor_dev->dmachan);
-        sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
-        async_tx_ack(&sw_desc->async_tx);
-
         return sw_desc;
 }
 
@@ -389,6 +360,8 @@ mv_xor_v2_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest,
                 __func__, len, &src, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -443,6 +416,8 @@ mv_xor_v2_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src,
                 __func__, src_cnt, len, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -491,6 +466,8 @@ mv_xor_v2_prep_dma_interrupt(struct dma_chan *chan, unsigned long flags)
                 container_of(chan, struct mv_xor_v2_device, dmachan);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         /* set the HW descriptor */
         hw_descriptor = &sw_desc->hw_desc;
@@ -554,7 +531,6 @@ static void mv_xor_v2_tasklet(unsigned long data)
 {
         struct mv_xor_v2_device *xor_dev = (struct mv_xor_v2_device *) data;
         int pending_ptr, num_of_pending, i;
-        struct mv_xor_v2_descriptor *next_pending_hw_desc = NULL;
         struct mv_xor_v2_sw_desc *next_pending_sw_desc = NULL;
 
         dev_dbg(xor_dev->dmadev.dev, "%s %d\n", __func__, __LINE__);
@@ -562,17 +538,10 @@ static void mv_xor_v2_tasklet(unsigned long data)
         /* get the pending descriptors parameters */
         num_of_pending = mv_xor_v2_get_pending_params(xor_dev, &pending_ptr);
 
-        /* next HW descriptor */
-        next_pending_hw_desc = xor_dev->hw_desq_virt + pending_ptr;
-
         /* loop over free descriptors */
         for (i = 0; i < num_of_pending; i++) {
-
-                if (pending_ptr > MV_XOR_V2_DESC_NUM)
-                        pending_ptr = 0;
-
-                if (next_pending_sw_desc != NULL)
-                        next_pending_hw_desc++;
+                struct mv_xor_v2_descriptor *next_pending_hw_desc =
+                        xor_dev->hw_desq_virt + pending_ptr;
 
                 /* get the SW descriptor related to the HW descriptor */
                 next_pending_sw_desc =
@@ -608,15 +577,14 @@ static void mv_xor_v2_tasklet(unsigned long data)
 
                 /* increment the next descriptor */
                 pending_ptr++;
+                if (pending_ptr >= MV_XOR_V2_DESC_NUM)
+                        pending_ptr = 0;
         }
 
         if (num_of_pending != 0) {
                 /* free the descriptores */
                 mv_xor_v2_free_desc_from_desq(xor_dev, num_of_pending);
         }
-
-        /* Update IMSG threshold, to enable new IMSG interrupts */
-        mv_xor_v2_set_imsg_thrd(xor_dev, 0);
 }
 
 /*
@@ -648,9 +616,6 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         writel((xor_dev->hw_desq & 0xFFFF00000000) >> 32,
                xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_BAHR_OFF);
 
-        /* enable the DMA engine */
-        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
-
         /*
          * This is a temporary solution, until we activate the
          * SMMU. Set the attributes for reading & writing data buffers
@@ -694,6 +659,9 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         reg |= MV_XOR_V2_GLOB_PAUSE_AXI_TIME_DIS_VAL;
         writel(reg, xor_dev->glob_base + MV_XOR_V2_GLOB_PAUSE);
 
+        /* enable the DMA engine */
+        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
+
         return 0;
 }
 
@@ -725,6 +693,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, xor_dev);
 
+        ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
+        if (ret)
+                return ret;
+
         xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
                 return -EPROBE_DEFER;
@@ -785,8 +757,15 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         /* add all SW descriptors to the free list */
         for (i = 0; i < MV_XOR_V2_DESC_NUM; i++) {
-                xor_dev->sw_desq[i].idx = i;
-                list_add(&xor_dev->sw_desq[i].free_list,
+                struct mv_xor_v2_sw_desc *sw_desc =
+                        xor_dev->sw_desq + i;
+                sw_desc->idx = i;
+                dma_async_tx_descriptor_init(&sw_desc->async_tx,
+                                             &xor_dev->dmachan);
+                sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
+                async_tx_ack(&sw_desc->async_tx);
+
+                list_add(&sw_desc->free_list,
                          &xor_dev->free_sw_desc);
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 8b0da7fa520d..e90a7a0d760a 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -3008,7 +3008,8 @@ static int pl330_remove(struct amba_device *adev)
 
         for (i = 0; i < AMBA_NR_IRQS; i++) {
                 irq = adev->irq[i];
-                devm_free_irq(&adev->dev, irq, pl330);
+                if (irq)
+                        devm_free_irq(&adev->dev, irq, pl330);
         }
 
         dma_async_device_unregister(&pl330->ddma);
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index db41795fe42a..bd261c9e9664 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1287,6 +1287,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         if (desc->hwdescs.use) {
                 dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
                         RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
+                if (dptr == 0)
+                        dptr = desc->nchunks;
+                dptr--;
                 WARN_ON(dptr >= desc->nchunks);
         } else {
                 running = desc->running;
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 72c649713ace..31a145154e9f 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -117,7 +117,7 @@ struct usb_dmac {
 #define USB_DMASWR                      0x0008
 #define USB_DMASWR_SWR                  (1 << 0)
 #define USB_DMAOR                       0x0060
-#define USB_DMAOR_AE                    (1 << 2)
+#define USB_DMAOR_AE                    (1 << 1)
 #define USB_DMAOR_DME                   (1 << 0)
 
 #define USB_DMASAR                      0x0000
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 44c01390d035..951b6c79f166 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -47,6 +47,7 @@ DEFINE_DMI_ATTR_WITH_SHOW(product_name,		0444, DMI_PRODUCT_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(product_version,      0444, DMI_PRODUCT_VERSION);
 DEFINE_DMI_ATTR_WITH_SHOW(product_serial,       0400, DMI_PRODUCT_SERIAL);
 DEFINE_DMI_ATTR_WITH_SHOW(product_uuid,         0400, DMI_PRODUCT_UUID);
+DEFINE_DMI_ATTR_WITH_SHOW(product_family,       0444, DMI_PRODUCT_FAMILY);
 DEFINE_DMI_ATTR_WITH_SHOW(board_vendor,         0444, DMI_BOARD_VENDOR);
 DEFINE_DMI_ATTR_WITH_SHOW(board_name,           0444, DMI_BOARD_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(board_version,        0444, DMI_BOARD_VERSION);
@@ -191,6 +192,7 @@ static void __init dmi_id_init_attr_table(void)
         ADD_DMI_ATTR(product_version,   DMI_PRODUCT_VERSION);
         ADD_DMI_ATTR(product_serial,    DMI_PRODUCT_SERIAL);
         ADD_DMI_ATTR(product_uuid,      DMI_PRODUCT_UUID);
+        ADD_DMI_ATTR(product_family,    DMI_PRODUCT_FAMILY);
         ADD_DMI_ATTR(board_vendor,      DMI_BOARD_VENDOR);
         ADD_DMI_ATTR(board_name,        DMI_BOARD_NAME);
         ADD_DMI_ATTR(board_version,     DMI_BOARD_VERSION);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 54be60ead08f..783041964439 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -144,7 +144,7 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
 
         buf = dmi_early_remap(dmi_base, orig_dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, NULL);
 
@@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
         const char *d = (const char *) dm;
         const char *p;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= string)
                 return;
 
         p = dmi_string(dm, d[string]);
@@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
 static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
         int is_ff = 1, is_00 = 1, i;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index + 16)
                 return;
 
+        d = (u8 *) dm + index;
         for (i = 0; i < 16 && (is_ff || is_00); i++) {
                 if (d[i] != 0x00)
                         is_00 = 0;
@@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
 static void __init dmi_save_type(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index)
                 return;
 
         s = dmi_alloc(4);
         if (!s)
                 return;
 
+        d = (u8 *) dm + index;
         sprintf(s, "%u", *d & 0x7F);
         dmi_ident[slot] = s;
 }
@@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_header *dm)
 
 static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)
 {
-        int i, count = *(u8 *)(dm + 1);
+        int i, count;
         struct dmi_device *dev;
 
+        if (dm->length < 0x05)
+                return;
+
+        count = *(u8 *)(dm + 1);
         for (i = 1; i <= count; i++) {
                 const char *devname = dmi_string(dm, i);
 
@@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const struct dmi_header *dm)
         const char *name;
         const u8 *d = (u8 *)dm;
 
+        if (dm->length < 0x0B)
+                return;
+
         /* Skip disabled device */
         if ((d[0x5] & 0x80) == 0)
                 return;
@@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
         const char *d = (const char *)dm;
         static int nr;
 
-        if (dm->type != DMI_ENTRY_MEM_DEVICE)
+        if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
                 return;
         if (nr >= dmi_memdev_nr) {
                 pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
@@ -430,6 +439,7 @@ static void __init dmi_decode(const struct dmi_header *dm, void *dummy)
                 dmi_save_ident(dm, DMI_PRODUCT_VERSION, 6);
                 dmi_save_ident(dm, DMI_PRODUCT_SERIAL, 7);
                 dmi_save_uuid(dm, DMI_PRODUCT_UUID, 8);
+                dmi_save_ident(dm, DMI_PRODUCT_FAMILY, 26);
                 break;
         case 2:         /* Base Board Information */
                 dmi_save_ident(dm, DMI_BOARD_VENDOR, 4);
@@ -649,6 +659,21 @@ void __init dmi_scan_machine(void)
                         goto error;
 
                 /*
+                 * Same logic as above, look for a 64-bit entry point
+                 * first, and if not found, fall back to 32-bit entry point.
+                 */
+                memcpy_fromio(buf, p, 16);
+                for (q = p + 16; q < p + 0x10000; q += 16) {
+                        memcpy_fromio(buf + 16, q, 16);
+                        if (!dmi_smbios3_present(buf)) {
+                                dmi_available = 1;
+                                dmi_early_unmap(p, 0x10000);
+                                goto out;
+                        }
+                        memcpy(buf, buf + 16, 16);
+                }
+
+                /*
                  * Iterate over all possible DMI header addresses q.
                  * Maintain the 32 bytes around q in buf.  On the
                  * first iteration, substitute zero for the
@@ -658,7 +683,7 @@ void __init dmi_scan_machine(void)
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
-                        if (!dmi_smbios3_present(buf) || !dmi_present(buf)) {
+                        if (!dmi_present(buf)) {
                                 dmi_available = 1;
                                 dmi_early_unmap(p, 0x10000);
                                 goto out;
@@ -992,7 +1017,8 @@ EXPORT_SYMBOL(dmi_get_date);
  *      @decode: Callback function
  *      @private_data: Private data to be passed to the callback function
  *
- *      Returns -1 when the DMI table can't be reached, 0 on success.
+ *      Returns 0 on success, -ENXIO if DMI is not selected or not present,
+ *      or a different negative error code if DMI walking fails.
  */
 int dmi_walk(void (*decode)(const struct dmi_header *, void *),
              void *private_data)
@@ -1000,11 +1026,11 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
         u8 *buf;
 
         if (!dmi_available)
-                return -1;
+                return -ENXIO;
 
         buf = dmi_remap(dmi_base, dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, private_data);
 
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 04ca8764f0c0..b58233e4ed71 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
         u32 size;
 } __packed;
 
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+        efi_memory_desc_t *md;
+
+        for_each_efi_memory_desc(md) {
+                u64 size;
+                u64 end;
+
+                if (md->type != EFI_BOOT_SERVICES_DATA)
+                        continue;
+
+                size = md->num_pages << EFI_PAGE_SHIFT;
+                end = md->phys_addr + size;
+                if (addr >= md->phys_addr && addr < end)
+                        return true;
+        }
+
+        return false;
+}
+
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
         void *image;
@@ -36,6 +56,9 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
         if (acpi_disabled)
                 return;
 
+        if (!efi_enabled(EFI_MEMMAP))
+                return;
+
         if (table->length < sizeof(bgrt_tab)) {
                 pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n",
                        table->length, sizeof(bgrt_tab));
@@ -62,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                 goto out;
         }
 
+        if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+                pr_notice("Ignoring BGRT: invalid image address\n");
+                goto out;
+        }
         image = early_memremap(bgrt->image_address, sizeof(bmp_header));
         if (!image) {
                 pr_notice("Ignoring BGRT: failed to map image header memory\n");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index ab3a951a17e6..ef1fafdad400 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -53,6 +53,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    &record->type, &part, &cnt, &time, &data_type) == 5) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -64,6 +65,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    &record->type, &part, &cnt, &time) == 4) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -77,6 +79,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
                  * multiple logs, remains.
                  */
                 record->id = generic_id(time, part, 0);
+                record->part = part;
                 record->count = 0;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -241,9 +244,15 @@ static int efi_pstore_write(struct pstore_record *record)
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         int i, ret = 0;
 
+        record->time.tv_sec = get_seconds();
+        record->time.tv_nsec = 0;
+
+        record->id = generic_id(record->time.tv_sec, record->part,
+                                record->count);
+
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu-%c",
                  record->type, record->part, record->count,
-                 get_seconds(), record->compressed ? 'C' : 'D');
+                 record->time.tv_sec, record->compressed ? 'C' : 'D');
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
@@ -255,7 +264,6 @@ static int efi_pstore_write(struct pstore_record *record)
         if (record->reason == KMSG_DUMP_OOPS)
                 efivar_run_worker();
 
-        record->id = record->part;
         return ret;
 };
 
@@ -287,7 +295,7 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                  * holding multiple logs, remains.
                  */
                 snprintf(name_old, sizeof(name_old), "dump-type%u-%u-%lu",
-                        ed->record->type, (unsigned int)ed->record->id,
+                        ed->record->type, ed->record->part,
                         ed->record->time.tv_sec);
 
                 for (i = 0; i < DUMP_NAME_LEN; i++)
@@ -320,10 +328,7 @@ static int efi_pstore_erase(struct pstore_record *record)
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
-        unsigned int part;
 
-        do_div(record->id, 1000);
-        part = do_div(record->id, 100);
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu",
                  record->type, record->part, record->count,
                  record->time.tv_sec);
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 8c34d50a4d80..959777ec8a77 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -16,10 +16,10 @@
 
 /* BIOS variables */
 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
-static const efi_char16_t const efi_SecureBoot_name[] = {
+static const efi_char16_t efi_SecureBoot_name[] = {
         'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0
 };
-static const efi_char16_t const efi_SetupMode_name[] = {
+static const efi_char16_t efi_SetupMode_name[] = {
         'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
 };
 
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 1e7860f02f4f..31058d400bda 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -136,12 +136,12 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         info->value = value;
 
         INIT_LIST_HEAD(&info->list);
-        list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
         if (ret)
                 goto free_info_key;
 
+        list_add_tail(&info->list, &sec->attribs);
         return 0;
 
 free_info_key:
@@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
         struct vpd_attrib_info *temp;
 
         list_for_each_entry_safe(info, temp, &sec->attribs, list) {
-                kfree(info->key);
                 sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
+                kfree(info->key);
                 kfree(info);
         }
 }
@@ -244,7 +244,7 @@ static int vpd_section_destroy(struct vpd_section *sec)
 {
         if (sec->enabled) {
                 vpd_section_attrib_destroy(sec);
-                kobject_del(sec->kobj);
+                kobject_put(sec->kobj);
                 sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr);
                 kfree(sec->raw_name);
                 iounmap(sec->baseaddr);
@@ -331,7 +331,7 @@ static void __exit vpd_platform_exit(void)
 {
         vpd_section_destroy(&ro_vpd);
         vpd_section_destroy(&rw_vpd);
-        kobject_del(vpd_kobj);
+        kobject_put(vpd_kobj);
 }
 
 module_init(vpd_platform_init);
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index ccea609676ee..4ca436e66bdb 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -646,6 +646,9 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset,
         int rc;
         int i;
 
+        if (!gpio->clk)
+                return -EINVAL;
+
         rc = usecs_to_cycles(gpio, usecs, &requested_cycles);
         if (rc < 0) {
                 dev_warn(chip->parent, "Failed to convert %luus to cycles at %luHz: %d\n",
diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index 2197368cc899..e60156ec0c18 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c
@@ -90,8 +90,18 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)
 {
         int reg;
 
-        if (gpio == 94)
-                return GPIOPANELCTL;
+        if (gpio >= CRYSTALCOVE_GPIO_NUM) {
+                /*
+                 * Virtual GPIO called from ACPI, for now we only support
+                 * the panel ctl.
+                 */
+                switch (gpio) {
+                case 0x5e:
+                        return GPIOPANELCTL;
+                default:
+                        return -EOPNOTSUPP;
+                }
+        }
 
         if (reg_type == CTRL_IN) {
                 if (gpio < 8)
@@ -130,36 +140,36 @@ static void crystalcove_update_irq_ctrl(struct crystalcove_gpio *cg, int gpio)
 static int crystalcove_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_INPUT_SET);
+        return regmap_write(cg->regmap, reg, CTLO_INPUT_SET);
 }
 
 static int crystalcove_gpio_dir_out(struct gpio_chip *chip, unsigned gpio,
                                     int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_OUTPUT_SET | value);
+        return regmap_write(cg->regmap, reg, CTLO_OUTPUT_SET | value);
 }
 
 static int crystalcove_gpio_get(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
-        int ret;
         unsigned int val;
+        int ret, reg = to_reg(gpio, CTRL_IN);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        ret = regmap_read(cg->regmap, to_reg(gpio, CTRL_IN), &val);
+        ret = regmap_read(cg->regmap, reg, &val);
         if (ret)
                 return ret;
 
@@ -170,14 +180,15 @@ static void crystalcove_gpio_set(struct gpio_chip *chip,
                                  unsigned gpio, int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return;
 
         if (value)
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 1);
+                regmap_update_bits(cg->regmap, reg, 1, 1);
         else
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 0);
+                regmap_update_bits(cg->regmap, reg, 1, 0);
 }
 
 static int crystalcove_irq_type(struct irq_data *data, unsigned type)
@@ -185,6 +196,9 @@ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
+        if (data->hwirq >= CRYSTALCOVE_GPIO_NUM)
+                return 0;
+
         switch (type) {
         case IRQ_TYPE_NONE:
                 cg->intcnt_value = CTLI_INTCNT_DIS;
@@ -235,8 +249,10 @@ static void crystalcove_irq_unmask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = false;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = false;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static void crystalcove_irq_mask(struct irq_data *data)
@@ -244,8 +260,10 @@ static void crystalcove_irq_mask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = true;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = true;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static struct irq_chip crystalcove_irqchip = {
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 19a92efabbef..c83ea68be792 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -721,7 +721,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         u32 set;
 
         if (!of_device_is_compatible(mvchip->chip.of_node,
-                                     "marvell,armada-370-xp-gpio"))
+                                     "marvell,armada-370-gpio"))
                 return 0;
 
         if (IS_ERR(mvchip->clk))
@@ -747,7 +747,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
                 set = U32_MAX;
         else
                 return -EINVAL;
-        writel_relaxed(0, mvebu_gpioreg_blink_counter_select(mvchip));
+        writel_relaxed(set, mvebu_gpioreg_blink_counter_select(mvchip));
 
         mvpwm = devm_kzalloc(dev, sizeof(struct mvebu_pwm), GFP_KERNEL);
         if (!mvpwm)
@@ -768,6 +768,13 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         mvpwm->chip.dev = dev;
         mvpwm->chip.ops = &mvebu_pwm_ops;
         mvpwm->chip.npwm = mvchip->chip.ngpio;
+        /*
+         * There may already be some PWM allocated, so we can't force
+         * mvpwm->chip.base to a fixed point like mvchip->chip.base.
+         * So, we let pwmchip_add() do the numbering and take the next free
+         * region.
+         */
+        mvpwm->chip.base = -1;
 
         spin_lock_init(&mvpwm->lock);
 
@@ -845,7 +852,7 @@ static const struct of_device_id mvebu_gpio_of_match[] = {
                 .data       = (void *) MVEBU_GPIO_SOC_VARIANT_ARMADAXP,
         },
         {
-                .compatible = "marvell,armada-370-xp-gpio",
+                .compatible = "marvell,armada-370-gpio",
                 .data       = (void *) MVEBU_GPIO_SOC_VARIANT_ORION,
         },
         {
@@ -1121,7 +1128,7 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                                                  mvchip);
         }
 
-        /* Armada 370/XP has simple PWM support for GPIO lines */
+        /* Some MVEBU SoCs have simple PWM support for GPIO lines */
         if (IS_ENABLED(CONFIG_PWM))
                 return mvebu_pwm_probe(pdev, mvchip, id);
 
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 2185232da823..8fa5fcd00e9a 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -201,7 +201,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
                         handler = acpi_gpio_irq_handler_evt;
         }
         if (!handler)
-                return AE_BAD_PARAMETER;
+                return AE_OK;
 
         pin = acpi_gpiochip_pin_to_gpio_offset(chip->gpiodev, pin);
         if (pin < 0)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 5db44139cef8..a42a1eea5714 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -708,7 +708,8 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
 
         ge.timestamp = ktime_get_real_ns();
 
-        if (le->eflags & GPIOEVENT_REQUEST_BOTH_EDGES) {
+        if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
+            && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
                 int level = gpiod_get_value_cansleep(le->desc);
 
                 if (level)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
index 1cf78f4dd339..1e8e1123ddf4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -693,6 +693,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev)
                         DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
                                  adev->clock.default_dispclk / 100);
                         adev->clock.default_dispclk = 60000;
+                } else if (adev->clock.default_dispclk <= 60000) {
+                        DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n",
+                                 adev->clock.default_dispclk / 100);
+                        adev->clock.default_dispclk = 62500;
                 }
                 adev->clock.dp_extclk =
                         le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index f2d705e6a75a..ab6b0d0febab 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -449,6 +449,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+        {0x1002, 0x6997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         /* Vega 10 */
         {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10|AMD_EXP_HW_SUPPORT},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 236d9950221b..c0d8c6ff6380 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -425,10 +425,15 @@ bool amdgpu_fbdev_robj_is_fb(struct amdgpu_device *adev, struct amdgpu_bo *robj)
 
 void amdgpu_fbdev_restore_mode(struct amdgpu_device *adev)
 {
-        struct amdgpu_fbdev *afbdev = adev->mode_info.rfbdev;
+        struct amdgpu_fbdev *afbdev;
         struct drm_fb_helper *fb_helper;
         int ret;
 
+        if (!adev)
+                return;
+
+        afbdev = adev->mode_info.rfbdev;
+
         if (!afbdev)
                 return;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 07ff3b1514f1..8ecf82c5fe74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -634,7 +634,7 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job)
                 mutex_unlock(&id_mgr->lock);
         }
 
-        if (gds_switch_needed) {
+        if (ring->funcs->emit_gds_switch && gds_switch_needed) {
                 id->gds_base = job->gds_base;
                 id->gds_size = job->gds_size;
                 id->gws_base = job->gws_base;
@@ -672,6 +672,7 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
         struct amdgpu_vm_id_manager *id_mgr = &adev->vm_manager.id_mgr[vmhub];
         struct amdgpu_vm_id *id = &id_mgr->ids[vmid];
 
+        atomic64_set(&id->owner, 0);
         id->gds_base = 0;
         id->gds_size = 0;
         id->gws_base = 0;
@@ -681,6 +682,26 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
 }
 
 /**
+ * amdgpu_vm_reset_all_id - reset VMID to zero
+ *
+ * @adev: amdgpu device structure
+ *
+ * Reset VMID to force flush on next use
+ */
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev)
+{
+        unsigned i, j;
+
+        for (i = 0; i < AMDGPU_MAX_VMHUBS; ++i) {
+                struct amdgpu_vm_id_manager *id_mgr =
+                        &adev->vm_manager.id_mgr[i];
+
+                for (j = 1; j < id_mgr->num_ids; ++j)
+                        amdgpu_vm_reset_id(adev, i, j);
+        }
+}
+
+/**
  * amdgpu_vm_bo_find - find the bo_va for a specific vm & bo
  *
  * @vm: requested vm
@@ -2270,7 +2291,6 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i)
                 adev->vm_manager.seqno[i] = 0;
 
-
         atomic_set(&adev->vm_manager.vm_pte_next_ring, 0);
         atomic64_set(&adev->vm_manager.client_counter, 0);
         spin_lock_init(&adev->vm_manager.prt_lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index d97e28b4bdc4..e1d951ece433 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -204,6 +204,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job);
 void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
                         unsigned vmid);
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev);
 int amdgpu_vm_update_directories(struct amdgpu_device *adev,
                                  struct amdgpu_vm *vm);
 int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
index a4831fe0223b..a2c59a08b2bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -220,9 +220,9 @@ static void amdgpu_vram_mgr_debug(struct ttm_mem_type_manager *man,
 }
 
 const struct ttm_mem_type_manager_func amdgpu_vram_mgr_func = {
-        amdgpu_vram_mgr_init,
-        amdgpu_vram_mgr_fini,
-        amdgpu_vram_mgr_new,
-        amdgpu_vram_mgr_del,
-        amdgpu_vram_mgr_debug
+        .init           = amdgpu_vram_mgr_init,
+        .takedown       = amdgpu_vram_mgr_fini,
+        .get_node       = amdgpu_vram_mgr_new,
+        .put_node       = amdgpu_vram_mgr_del,
+        .debug          = amdgpu_vram_mgr_debug
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
index 8c9bc75a9c2d..8a0818b23ea4 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c
@@ -165,7 +165,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
         struct drm_device *dev = crtc->dev;
         struct amdgpu_device *adev = dev->dev_private;
         int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
-        ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
+        ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
 
         memset(&args, 0, sizeof(args));
 
@@ -178,7 +178,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state)
 void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev)
 {
         int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating);
-        ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args;
+        ENABLE_DISP_POWER_GATING_PS_ALLOCATION args;
 
         memset(&args, 0, sizeof(args));
 
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 6dc1410b380f..ec93714e4524 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -906,6 +906,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev)
         u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
         u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+         * blanking period would allow it
+         */
+        if (amdgpu_dpm_get_vrefresh(adev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 0cdeb6a2e4a0..5dffa27afa45 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 773654a19749..47bbc87f96d2 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index 1f3552967ba3..d8c9a959493e 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks(struct amdgpu_device *adev,
         fixed20_12 a, b, c;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 3c558c170e5e..db30c6ba563a 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index a572979f186c..d860939152df 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -950,10 +950,6 @@ static int gmc_v6_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v6_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v6_0_hw_fini(adev);
 
         return 0;
@@ -968,16 +964,9 @@ static int gmc_v6_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v6_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v6_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index a9083a16a250..2750e5c23813 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1117,10 +1117,6 @@ static int gmc_v7_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v7_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v7_0_hw_fini(adev);
 
         return 0;
@@ -1135,16 +1131,9 @@ static int gmc_v7_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v7_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v7_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4ac99784160a..f56b4089ee9f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1209,10 +1209,6 @@ static int gmc_v8_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v8_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v8_0_hw_fini(adev);
 
         return 0;
@@ -1227,16 +1223,9 @@ static int gmc_v8_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v8_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v8_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index dc1e1c1d6b24..f936332a069d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -791,10 +791,6 @@ static int gmc_v9_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v9_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v9_0_hw_fini(adev);
 
         return 0;
@@ -809,17 +805,9 @@ static int gmc_v9_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v9_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev,
-                                "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v9_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index fb0819359909..90332f55cfba 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -77,13 +77,26 @@ static int vce_v3_0_set_clockgating_state(void *handle,
 static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_RPTR);
+                v = RREG32(mmVCE_RB_RPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_RPTR2);
+                v = RREG32(mmVCE_RB_RPTR2);
         else
-                return RREG32(mmVCE_RB_RPTR3);
+                v = RREG32(mmVCE_RB_RPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -96,13 +109,26 @@ static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 static uint64_t vce_v3_0_ring_get_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_WPTR);
+                v = RREG32(mmVCE_RB_WPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_WPTR2);
+                v = RREG32(mmVCE_RB_WPTR2);
         else
-                return RREG32(mmVCE_RB_WPTR3);
+                v = RREG32(mmVCE_RB_WPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -116,12 +142,22 @@ static void vce_v3_0_ring_set_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
 
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
+
         if (ring == &adev->vce.ring[0])
                 WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
         else if (ring == &adev->vce.ring[1])
                 WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
         else
                 WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
 }
 
 static void vce_v3_0_override_vce_clock_gating(struct amdgpu_device *adev, bool override)
@@ -231,33 +267,38 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
         struct amdgpu_ring *ring;
         int idx, r;
 
-        ring = &adev->vce.ring[0];
-        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[1];
-        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[2];
-        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
-
         mutex_lock(&adev->grbm_idx_mutex);
         for (idx = 0; idx < 2; ++idx) {
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
                 WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
+
+                /* Program instance 0 reg space for two instances or instance 0 case
+                program instance 1 reg space for only instance 1 available case */
+                if (idx != 1 || adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0) {
+                        ring = &adev->vce.ring[0];
+                        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[1];
+                        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[2];
+                        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
+                }
+
                 vce_v3_0_mc_resume(adev, idx);
                 WREG32_FIELD(VCE_STATUS, JOB_BUSY, 1);
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index a74a3db3056c..102eb6d029fa 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2655,6 +2655,28 @@ static int smu7_get_power_state_size(struct pp_hwmgr *hwmgr)
         return sizeof(struct smu7_power_state);
 }
 
+static int smu7_vblank_too_short(struct pp_hwmgr *hwmgr,
+                                 uint32_t vblank_time_us)
+{
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+        uint32_t switch_limit_us;
+
+        switch (hwmgr->chip_id) {
+        case CHIP_POLARIS10:
+        case CHIP_POLARIS11:
+        case CHIP_POLARIS12:
+                switch_limit_us = data->is_memory_gddr5 ? 190 : 150;
+                break;
+        default:
+                switch_limit_us = data->is_memory_gddr5 ? 450 : 150;
+                break;
+        }
+
+        if (vblank_time_us < switch_limit_us)
+                return true;
+        else
+                return false;
+}
 
 static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                 struct pp_power_state *request_ps,
@@ -2669,6 +2691,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         bool disable_mclk_switching;
         bool disable_mclk_switching_for_frame_lock;
         struct cgs_display_info info = {0};
+        struct cgs_mode_info mode_info = {0};
         const struct phm_clock_and_voltage_limits *max_limits;
         uint32_t i;
         struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -2677,6 +2700,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         int32_t count;
         int32_t stable_pstate_sclk = 0, stable_pstate_mclk = 0;
 
+        info.mode_info = &mode_info;
         data->battery_state = (PP_StateUILabel_Battery ==
                         request_ps->classification.ui_label);
 
@@ -2703,8 +2727,6 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
 
         cgs_get_active_displays_info(hwmgr->device, &info);
 
-        /*TO DO result = PHM_CheckVBlankTime(hwmgr, &vblankTooShort);*/
-
         minimum_clocks.engineClock = hwmgr->display_config.min_core_set_clock;
         minimum_clocks.memoryClock = hwmgr->display_config.min_mem_set_clock;
 
@@ -2769,8 +2791,10 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                     PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
 
 
-        disable_mclk_switching = (1 < info.display_count) ||
-                                    disable_mclk_switching_for_frame_lock;
+        disable_mclk_switching = ((1 < info.display_count) ||
+                                  disable_mclk_switching_for_frame_lock ||
+                                  smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+                                  (mode_info.refresh_rate > 120));
 
         sclk = smu7_ps->performance_levels[0].engine_clock;
         mclk = smu7_ps->performance_levels[0].memory_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index ad30f5d3a10d..2614af2f553f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4186,7 +4186,7 @@ static int vega10_force_clock_level(struct pp_hwmgr *hwmgr,
                 enum pp_clock_type type, uint32_t mask)
 {
         struct vega10_hwmgr *data = (struct vega10_hwmgr *)(hwmgr->backend);
-        uint32_t i;
+        int i;
 
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
index d5f53d04fa08..83e40fe51b62 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
@@ -709,17 +709,17 @@ static int tf_vega10_thermal_disable_alert(struct pp_hwmgr *hwmgr,
 
 static struct phm_master_table_item
 vega10_thermal_start_thermal_controller_master_list[] = {
-        {NULL, tf_vega10_thermal_initialize},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
+        { .tableFunction = tf_vega10_thermal_initialize },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
 /* We should restrict performance levels to low before we halt the SMC.
  * On the other hand we are still in boot state when we do this
  * so it would be pointless.
  * If this assumption changes we have to revisit this table.
  */
-        {NULL, tf_vega10_thermal_setup_fan_table},
-        {NULL, tf_vega10_thermal_start_smc_fan_control},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_setup_fan_table },
+        { .tableFunction = tf_vega10_thermal_start_smc_fan_control },
+        { }
 };
 
 static struct phm_master_table_header
@@ -731,10 +731,10 @@ vega10_thermal_start_thermal_controller_master = {
 
 static struct phm_master_table_item
 vega10_thermal_set_temperature_range_master_list[] = {
-        {NULL, tf_vega10_thermal_disable_alert},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_disable_alert },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
+        { }
 };
 
 struct phm_master_table_header
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
index cf92ebfe6ab7..67469c26bae8 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
@@ -11,6 +11,7 @@
 #include <sound/hdmi-codec.h>
 #include <sound/pcm.h>
 #include <sound/soc.h>
+#include <linux/of_graph.h>
 
 #include "adv7511.h"
 
@@ -182,10 +183,31 @@ static void audio_shutdown(struct device *dev, void *data)
 {
 }
 
+static int adv7511_hdmi_i2s_get_dai_id(struct snd_soc_component *component,
+                                        struct device_node *endpoint)
+{
+        struct of_endpoint of_ep;
+        int ret;
+
+        ret = of_graph_parse_endpoint(endpoint, &of_ep);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * HDMI sound should be located as reg = <2>
+         * Then, it is sound port 0
+         */
+        if (of_ep.port == 2)
+                return 0;
+
+        return -EINVAL;
+}
+
 static const struct hdmi_codec_ops adv7511_codec_ops = {
         .hw_params      = adv7511_hdmi_hw_params,
         .audio_shutdown = audio_shutdown,
         .audio_startup  = audio_startup,
+        .get_dai_id     = adv7511_hdmi_i2s_get_dai_id,
 };
 
 static struct hdmi_codec_pdata codec_data = {
diff --git a/drivers/gpu/drm/bridge/synopsys/Kconfig b/drivers/gpu/drm/bridge/synopsys/Kconfig
index 40d2827a6d19..53e78d092d18 100644
--- a/drivers/gpu/drm/bridge/synopsys/Kconfig
+++ b/drivers/gpu/drm/bridge/synopsys/Kconfig
@@ -1,6 +1,7 @@
 config DRM_DW_HDMI
         tristate
         select DRM_KMS_HELPER
+        select REGMAP_MMIO
 
 config DRM_DW_HDMI_AHB_AUDIO
         tristate "Synopsys Designware AHB Audio interface"
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c
index aaf287d2e91d..b2cf59f54c88 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c
@@ -82,9 +82,30 @@ static void dw_hdmi_i2s_audio_shutdown(struct device *dev, void *data)
         hdmi_write(audio, HDMI_AUD_CONF0_SW_RESET, HDMI_AUD_CONF0);
 }
 
+static int dw_hdmi_i2s_get_dai_id(struct snd_soc_component *component,
+                                  struct device_node *endpoint)
+{
+        struct of_endpoint of_ep;
+        int ret;
+
+        ret = of_graph_parse_endpoint(endpoint, &of_ep);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * HDMI sound should be located as reg = <2>
+         * Then, it is sound port 0
+         */
+        if (of_ep.port == 2)
+                return 0;
+
+        return -EINVAL;
+}
+
 static struct hdmi_codec_ops dw_hdmi_i2s_ops = {
         .hw_params      = dw_hdmi_i2s_hw_params,
         .audio_shutdown = dw_hdmi_i2s_audio_shutdown,
+        .get_dai_id     = dw_hdmi_i2s_get_dai_id,
 };
 
 static int snd_dw_hdmi_probe(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 8be9719284b0..aa885a614e27 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -508,6 +508,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
                 bool has_connectors =
                         !!new_crtc_state->connector_mask;
 
+                WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
+
                 if (!drm_mode_equal(&old_crtc_state->mode, &new_crtc_state->mode)) {
                         DRM_DEBUG_ATOMIC("[CRTC:%d:%s] mode changed\n",
                                          crtc->base.id, crtc->name);
@@ -551,6 +553,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
         for_each_oldnew_connector_in_state(state, connector, old_connector_state, new_connector_state, i) {
                 const struct drm_connector_helper_funcs *funcs = connector->helper_private;
 
+                WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
                 /*
                  * This only sets crtc->connectors_changed for routing changes,
                  * drivers must set crtc->connectors_changed themselves when
@@ -650,6 +654,8 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
         for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
+                WARN_ON(!drm_modeset_is_locked(&plane->mutex));
+
                 funcs = plane->helper_private;
 
                 drm_atomic_helper_plane_changed(state, old_plane_state, new_plane_state, plane);
@@ -2663,7 +2669,12 @@ int drm_atomic_helper_resume(struct drm_device *dev,
 
         drm_modeset_acquire_init(&ctx, 0);
         while (1) {
+                err = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (err)
+                        goto out;
+
                 err = drm_atomic_helper_commit_duplicated_state(state, &ctx);
+out:
                 if (err != -EDEADLK)
                         break;
 
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 9f847615ac74..48ca2457df8c 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -1229,21 +1229,6 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         if (!connector)
                 return -ENOENT;
 
-        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
-        encoder = drm_connector_get_encoder(connector);
-        if (encoder)
-                out_resp->encoder_id = encoder->base.id;
-        else
-                out_resp->encoder_id = 0;
-
-        ret = drm_mode_object_get_properties(&connector->base, file_priv->atomic,
-                        (uint32_t __user *)(unsigned long)(out_resp->props_ptr),
-                        (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
-                        &out_resp->count_props);
-        drm_modeset_unlock(&dev->mode_config.connection_mutex);
-        if (ret)
-                goto out_unref;
-
         for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++)
                 if (connector->encoder_ids[i] != 0)
                         encoders_count++;
@@ -1256,7 +1241,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
                                 if (put_user(connector->encoder_ids[i],
                                              encoder_ptr + copied)) {
                                         ret = -EFAULT;
-                                        goto out_unref;
+                                        goto out;
                                 }
                                 copied++;
                         }
@@ -1300,15 +1285,32 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
                         if (copy_to_user(mode_ptr + copied,
                                          &u_mode, sizeof(u_mode))) {
                                 ret = -EFAULT;
+                                mutex_unlock(&dev->mode_config.mutex);
+
                                 goto out;
                         }
                         copied++;
                 }
         }
         out_resp->count_modes = mode_count;
-out:
         mutex_unlock(&dev->mode_config.mutex);
-out_unref:
+
+        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+        encoder = drm_connector_get_encoder(connector);
+        if (encoder)
+                out_resp->encoder_id = encoder->base.id;
+        else
+                out_resp->encoder_id = 0;
+
+        /* Only grab properties after probing, to make sure EDID and other
+         * properties reflect the latest status. */
+        ret = drm_mode_object_get_properties(&connector->base, file_priv->atomic,
+                        (uint32_t __user *)(unsigned long)(out_resp->props_ptr),
+                        (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr),
+                        &out_resp->count_props);
+        drm_modeset_unlock(&dev->mode_config.connection_mutex);
+
+out:
         drm_connector_put(connector);
 
         return ret;
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 3e5f52110ea1..213fb837e1c4 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -1208,3 +1208,86 @@ int drm_dp_stop_crc(struct drm_dp_aux *aux)
         return 0;
 }
 EXPORT_SYMBOL(drm_dp_stop_crc);
+
+struct dpcd_quirk {
+        u8 oui[3];
+        bool is_branch;
+        u32 quirks;
+};
+
+#define OUI(first, second, third) { (first), (second), (third) }
+
+static const struct dpcd_quirk dpcd_quirk_list[] = {
+        /* Analogix 7737 needs reduced M and N at HBR2 link rates */
+        { OUI(0x00, 0x22, 0xb9), true, BIT(DP_DPCD_QUIRK_LIMITED_M_N) },
+};
+
+#undef OUI
+
+/*
+ * Get a bit mask of DPCD quirks for the sink/branch device identified by
+ * ident. The quirk data is shared but it's up to the drivers to act on the
+ * data.
+ *
+ * For now, only the OUI (first three bytes) is used, but this may be extended
+ * to device identification string and hardware/firmware revisions later.
+ */
+static u32
+drm_dp_get_quirks(const struct drm_dp_dpcd_ident *ident, bool is_branch)
+{
+        const struct dpcd_quirk *quirk;
+        u32 quirks = 0;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(dpcd_quirk_list); i++) {
+                quirk = &dpcd_quirk_list[i];
+
+                if (quirk->is_branch != is_branch)
+                        continue;
+
+                if (memcmp(quirk->oui, ident->oui, sizeof(ident->oui)) != 0)
+                        continue;
+
+                quirks |= quirk->quirks;
+        }
+
+        return quirks;
+}
+
+/**
+ * drm_dp_read_desc - read sink/branch descriptor from DPCD
+ * @aux: DisplayPort AUX channel
+ * @desc: Device decriptor to fill from DPCD
+ * @is_branch: true for branch devices, false for sink devices
+ *
+ * Read DPCD 0x400 (sink) or 0x500 (branch) into @desc. Also debug log the
+ * identification.
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_read_desc(struct drm_dp_aux *aux, struct drm_dp_desc *desc,
+                     bool is_branch)
+{
+        struct drm_dp_dpcd_ident *ident = &desc->ident;
+        unsigned int offset = is_branch ? DP_BRANCH_OUI : DP_SINK_OUI;
+        int ret, dev_id_len;
+
+        ret = drm_dp_dpcd_read(aux, offset, ident, sizeof(*ident));
+        if (ret < 0)
+                return ret;
+
+        desc->quirks = drm_dp_get_quirks(ident, is_branch);
+
+        dev_id_len = strnlen(ident->device_id, sizeof(ident->device_id));
+
+        DRM_DEBUG_KMS("DP %s: OUI %*phD dev-ID %*pE HW-rev %d.%d SW-rev %d.%d quirks 0x%04x\n",
+                      is_branch ? "branch" : "sink",
+                      (int)sizeof(ident->oui), ident->oui,
+                      dev_id_len, ident->device_id,
+                      ident->hw_rev >> 4, ident->hw_rev & 0xf,
+                      ident->sw_major_rev, ident->sw_minor_rev,
+                      desc->quirks);
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_read_desc);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b5c6bb46a425..37b8ad3e30d8 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -358,7 +358,12 @@ EXPORT_SYMBOL(drm_put_dev);
 void drm_unplug_dev(struct drm_device *dev)
 {
         /* for a USB device */
-        drm_dev_unregister(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_modeset_unregister_all(dev);
+
+        drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 
         mutex_lock(&drm_global_mutex);
 
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index fedd4d60d9cd..5dc8c4350602 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -948,8 +948,6 @@ retry:
         }
 
 out:
-        if (ret && crtc->funcs->page_flip_target)
-                drm_crtc_vblank_put(crtc);
         if (fb)
                 drm_framebuffer_put(fb);
         if (crtc->primary->old_fb)
@@ -964,5 +962,8 @@ out:
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
+        if (ret && crtc->funcs->page_flip_target)
+                drm_crtc_vblank_put(crtc);
+
         return ret;
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
index c4a091e87426..e437fba1209d 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
@@ -106,9 +106,10 @@ struct etnaviv_gem_submit {
         struct etnaviv_gpu *gpu;
         struct ww_acquire_ctx ticket;
         struct dma_fence *fence;
+        u32 flags;
         unsigned int nr_bos;
         struct etnaviv_gem_submit_bo bos[0];
-        u32 flags;
+        /* No new members here, the previous one is variable-length! */
 };
 
 int etnaviv_gem_wait_bo(struct etnaviv_gpu *gpu, struct drm_gem_object *obj,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index de80ee1b71df..1013765274da 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -172,7 +172,7 @@ static int submit_fence_sync(const struct etnaviv_gem_submit *submit)
         for (i = 0; i < submit->nr_bos; i++) {
                 struct etnaviv_gem_object *etnaviv_obj = submit->bos[i].obj;
                 bool write = submit->bos[i].flags & ETNA_SUBMIT_BO_WRITE;
-                bool explicit = !(submit->flags & ETNA_SUBMIT_NO_IMPLICIT);
+                bool explicit = !!(submit->flags & ETNA_SUBMIT_NO_IMPLICIT);
 
                 ret = etnaviv_gpu_fence_sync_obj(etnaviv_obj, context, write,
                                                  explicit);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 09d3c4c3c858..50294a7bd29d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -82,14 +82,9 @@ err_file_priv_free:
         return ret;
 }
 
-static void exynos_drm_preclose(struct drm_device *dev,
-                                        struct drm_file *file)
-{
-        exynos_drm_subdrv_close(dev, file);
-}
-
 static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
         kfree(file->driver_priv);
         file->driver_priv = NULL;
 }
@@ -145,7 +140,6 @@ static struct drm_driver exynos_drm_driver = {
         .driver_features        = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME
                                   | DRIVER_ATOMIC | DRIVER_RENDER,
         .open                   = exynos_drm_open,
-        .preclose               = exynos_drm_preclose,
         .lastclose              = exynos_drm_lastclose,
         .postclose              = exynos_drm_postclose,
         .gem_free_object_unlocked = exynos_drm_gem_free_object,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cb3176930596..39c740572034 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -160,12 +160,9 @@ struct exynos_drm_clk {
  *      drm framework doesn't support multiple irq yet.
  *      we can refer to the crtc to current hardware interrupt occurred through
  *      this pipe value.
- * @enabled: if the crtc is enabled or not
- * @event: vblank event that is currently queued for flip
- * @wait_update: wait all pending planes updates to finish
- * @pending_update: number of pending plane updates in this crtc
  * @ops: pointer to callbacks for exynos drm specific functionality
  * @ctx: A pointer to the crtc's implementation specific context
+ * @pipe_clk: A pointer to the crtc's pipeline clock.
  */
 struct exynos_drm_crtc {
         struct drm_crtc                 base;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index fc4fda738906..d404de86d5f9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1633,7 +1633,6 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
 {
         struct device *dev = dsi->dev;
         struct device_node *node = dev->of_node;
-        struct device_node *ep;
         int ret;
 
         ret = exynos_dsi_of_read_u32(node, "samsung,pll-clock-frequency",
@@ -1641,32 +1640,21 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
         if (ret < 0)
                 return ret;
 
-        ep = of_graph_get_endpoint_by_regs(node, DSI_PORT_OUT, 0);
-        if (!ep) {
-                dev_err(dev, "no output port with endpoint specified\n");
-                return -EINVAL;
-        }
-
-        ret = exynos_dsi_of_read_u32(ep, "samsung,burst-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,burst-clock-frequency",
                                      &dsi->burst_clk_rate);
         if (ret < 0)
-                goto end;
+                return ret;
 
-        ret = exynos_dsi_of_read_u32(ep, "samsung,esc-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,esc-clock-frequency",
                                      &dsi->esc_clk_rate);
         if (ret < 0)
-                goto end;
-
-        of_node_put(ep);
+                return ret;
 
         dsi->bridge_node = of_graph_get_remote_node(node, DSI_PORT_OUT, 0);
         if (!dsi->bridge_node)
                 return -EINVAL;
 
-end:
-        of_node_put(ep);
-
-        return ret;
+        return 0;
 }
 
 static int exynos_dsi_bind(struct device *dev, struct device *master,
@@ -1817,6 +1805,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
 
 static int exynos_dsi_remove(struct platform_device *pdev)
 {
+        struct exynos_dsi *dsi = platform_get_drvdata(pdev);
+
+        of_node_put(dsi->bridge_node);
+
         pm_runtime_disable(&pdev->dev);
 
         component_del(&pdev->dev, &exynos_dsi_component_ops);
diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c
index 0066fe7e622e..be3eefec5152 100644
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -759,20 +759,23 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (scan->type & DRM_MODE_TYPE_PREFERRED) {
                         mode_dev->panel_fixed_mode =
                             drm_mode_duplicate(dev, scan);
+                        DRM_DEBUG_KMS("Using mode from DDC\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
 
         /* Failed to get EDID, what about VBT? do we need this? */
-        if (mode_dev->vbt_mode)
+        if (dev_priv->lfp_lvds_vbt_mode) {
                 mode_dev->panel_fixed_mode =
-                    drm_mode_duplicate(dev, mode_dev->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
 
-        if (!mode_dev->panel_fixed_mode)
-                if (dev_priv->lfp_lvds_vbt_mode)
-                        mode_dev->panel_fixed_mode =
-                                drm_mode_duplicate(dev,
-                                        dev_priv->lfp_lvds_vbt_mode);
+                if (mode_dev->panel_fixed_mode) {
+                        mode_dev->panel_fixed_mode->type |=
+                                DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using mode from VBT\n");
+                        goto out;
+                }
+        }
 
         /*
          * If we didn't get EDID, try checking if the panel is already turned
@@ -789,6 +792,7 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (mode_dev->panel_fixed_mode) {
                         mode_dev->panel_fixed_mode->type |=
                             DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using pre-programmed mode\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
diff --git a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
index 5abc69c9630f..f77dcfaade6c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
+++ b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
@@ -760,7 +760,7 @@ static int dsi_parse_dt(struct platform_device *pdev, struct dw_dsi *dsi)
          * Get the endpoint node. In our case, dsi has one output port1
          * to which the external HDMI bridge is connected.
          */
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, NULL, &dsi->bridge);
+        ret = drm_of_find_panel_or_bridge(np, 1, 0, NULL, &dsi->bridge);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index dca989eb2d42..24fe04d6307b 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -779,8 +779,26 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine;
+        struct intel_vgpu_workload *pos, *n;
+        unsigned int tmp;
+
+        /* free the unsubmited workloads in the queues. */
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
+                list_for_each_entry_safe(pos, n,
+                        &vgpu->workload_q_head[engine->id], list) {
+                        list_del_init(&pos->list);
+                        free_workload(pos);
+                }
+        }
+}
+
 void intel_vgpu_clean_execlist(struct intel_vgpu *vgpu)
 {
+        clean_workloads(vgpu, ALL_ENGINES);
         kmem_cache_destroy(vgpu->workloads);
 }
 
@@ -811,17 +829,9 @@ void intel_vgpu_reset_execlist(struct intel_vgpu *vgpu,
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
         struct intel_engine_cs *engine;
-        struct intel_vgpu_workload *pos, *n;
         unsigned int tmp;
 
-        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
-                /* free the unsubmited workload in the queue */
-                list_for_each_entry_safe(pos, n,
-                        &vgpu->workload_q_head[engine->id], list) {
-                        list_del_init(&pos->list);
-                        free_workload(pos);
-                }
-
+        clean_workloads(vgpu, engine_mask);
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp)
                 init_vgpu_execlist(vgpu, engine->id);
-        }
 }
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index c995e540ff96..0ffd69654592 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1366,18 +1366,28 @@ static int skl_misc_ctl_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
-        i915_reg_t reg = {.reg = offset};
+        u32 v = *(u32 *)p_data;
+
+        if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
+                return intel_vgpu_default_mmio_write(vgpu,
+                                offset, p_data, bytes);
 
         switch (offset) {
         case 0x4ddc:
-                vgpu_vreg(vgpu, offset) = 0x8000003c;
-                /* WaCompressedResourceSamplerPbeMediaNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 31);
                 break;
         case 0x42080:
-                vgpu_vreg(vgpu, offset) = 0x8000;
-                /* WaCompressedResourceDisplayNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceDisplayNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 15);
+                break;
+        case 0xe194:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 8);
+                break;
+        case 0x7014:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 13);
                 break;
         default:
                 return -EINVAL;
@@ -1634,7 +1644,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
                 NULL, NULL);
-        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2568,7 +2579,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x6e570, D_BDW_PLUS);
         MMIO_D(0x65f10, D_BDW_PLUS);
 
-        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index d689e511744e..4bd1467c17b1 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -292,6 +292,8 @@ static int per_file_stats(int id, void *ptr, void *data)
         struct file_stats *stats = data;
         struct i915_vma *vma;
 
+        lockdep_assert_held(&obj->base.dev->struct_mutex);
+
         stats->count++;
         stats->total += obj->base.size;
         if (!obj->bind_count)
@@ -476,6 +478,8 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                 struct drm_i915_gem_request *request;
                 struct task_struct *task;
 
+                mutex_lock(&dev->struct_mutex);
+
                 memset(&stats, 0, sizeof(stats));
                 stats.file_priv = file->driver_priv;
                 spin_lock(&file->table_lock);
@@ -487,7 +491,6 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                  * still alive (e.g. get_pid(current) => fork() => exit()).
                  * Therefore, we need to protect this ->comm access using RCU.
                  */
-                mutex_lock(&dev->struct_mutex);
                 request = list_first_entry_or_null(&file_priv->mm.request_list,
                                                    struct drm_i915_gem_request,
                                                    client_link);
@@ -497,6 +500,7 @@ static int i915_gem_object_info(struct seq_file *m, void *data)
                                 PIDTYPE_PID);
                 print_file_stats(m, task ? task->comm : "<unknown>", stats);
                 rcu_read_unlock();
+
                 mutex_unlock(&dev->struct_mutex);
         }
         mutex_unlock(&dev->filelist_mutex);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 3036d4835b0f..48428672fc6e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1235,6 +1235,15 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_fini;
 
         pci_set_drvdata(pdev, &dev_priv->drm);
+        /*
+         * Disable the system suspend direct complete optimization, which can
+         * leave the device suspended skipping the driver's suspend handlers
+         * if the device was already runtime suspended. This is needed due to
+         * the difference in our runtime and system suspend sequence and
+         * becaue the HDA driver may require us to enable the audio power
+         * domain during system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         ret = i915_driver_init_early(dev_priv, ent);
         if (ret < 0)
@@ -1272,10 +1281,6 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         dev_priv->ipc_enabled = false;
 
-        /* Everything is in place, we can now relax! */
-        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
-                 driver.name, driver.major, driver.minor, driver.patchlevel,
-                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG))
                 DRM_INFO("DRM_I915_DEBUG enabled\n");
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c9b0949f6c1a..2c453a4e97d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -562,7 +562,8 @@ struct intel_link_m_n {
 
 void intel_link_compute_m_n(int bpp, int nlanes,
                             int pixel_clock, int link_clock,
-                            struct intel_link_m_n *m_n);
+                            struct intel_link_m_n *m_n,
+                            bool reduce_m_n);
 
 /* Interface history:
  *
@@ -2990,6 +2991,16 @@ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
         return false;
 }
 
+static inline bool
+intel_ggtt_update_needs_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        if (IS_BROXTON(dev_priv) && intel_iommu_gfx_mapped)
+                return true;
+#endif
+        return false;
+}
+
 int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                                 int enable_ppgtt);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b6ac3df18b58..615f0a855222 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2285,8 +2285,8 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
         struct page *page;
         unsigned long last_pfn = 0;     /* suppress gcc warning */
         unsigned int max_segment;
+        gfp_t noreclaim;
         int ret;
-        gfp_t gfp;
 
         /* Assert that the object is not currently in any GPU domain. As it
          * wasn't in the GTT, there shouldn't be any way it could have been in
@@ -2315,22 +2315,31 @@ rebuild_st:
          * Fail silently without starting the shrinker
          */
         mapping = obj->base.filp->f_mapping;
-        gfp = mapping_gfp_constraint(mapping, ~(__GFP_IO | __GFP_RECLAIM));
-        gfp |= __GFP_NORETRY | __GFP_NOWARN;
+        noreclaim = mapping_gfp_constraint(mapping,
+                                           ~(__GFP_IO | __GFP_RECLAIM));
+        noreclaim |= __GFP_NORETRY | __GFP_NOWARN;
+
         sg = st->sgl;
         st->nents = 0;
         for (i = 0; i < page_count; i++) {
-                page = shmem_read_mapping_page_gfp(mapping, i, gfp);
-                if (unlikely(IS_ERR(page))) {
-                        i915_gem_shrink(dev_priv,
-                                        page_count,
-                                        I915_SHRINK_BOUND |
-                                        I915_SHRINK_UNBOUND |
-                                        I915_SHRINK_PURGEABLE);
+                const unsigned int shrink[] = {
+                        I915_SHRINK_BOUND | I915_SHRINK_UNBOUND | I915_SHRINK_PURGEABLE,
+                        0,
+                }, *s = shrink;
+                gfp_t gfp = noreclaim;
+
+                do {
                         page = shmem_read_mapping_page_gfp(mapping, i, gfp);
-                }
-                if (unlikely(IS_ERR(page))) {
-                        gfp_t reclaim;
+                        if (likely(!IS_ERR(page)))
+                                break;
+
+                        if (!*s) {
+                                ret = PTR_ERR(page);
+                                goto err_sg;
+                        }
+
+                        i915_gem_shrink(dev_priv, 2 * page_count, *s++);
+                        cond_resched();
 
                         /* We've tried hard to allocate the memory by reaping
                          * our own buffer, now let the real VM do its job and
@@ -2340,15 +2349,26 @@ rebuild_st:
                          * defer the oom here by reporting the ENOMEM back
                          * to userspace.
                          */
-                        reclaim = mapping_gfp_mask(mapping);
-                        reclaim |= __GFP_NORETRY; /* reclaim, but no oom */
-
-                        page = shmem_read_mapping_page_gfp(mapping, i, reclaim);
-                        if (IS_ERR(page)) {
-                                ret = PTR_ERR(page);
-                                goto err_sg;
+                        if (!*s) {
+                                /* reclaim and warn, but no oom */
+                                gfp = mapping_gfp_mask(mapping);
+
+                                /* Our bo are always dirty and so we require
+                                 * kswapd to reclaim our pages (direct reclaim
+                                 * does not effectively begin pageout of our
+                                 * buffers on its own). However, direct reclaim
+                                 * only waits for kswapd when under allocation
+                                 * congestion. So as a result __GFP_RECLAIM is
+                                 * unreliable and fails to actually reclaim our
+                                 * dirty pages -- unless you try over and over
+                                 * again with !__GFP_NORETRY. However, we still
+                                 * want to fail this allocation rather than
+                                 * trigger the out-of-memory killer and for
+                                 * this we want the future __GFP_MAYFAIL.
+                                 */
                         }
-                }
+                } while (1);
+
                 if (!i ||
                     sg->length >= max_segment ||
                     page_to_pfn(page) != last_pfn + 1) {
@@ -3298,6 +3318,10 @@ int i915_gem_wait_for_idle(struct drm_i915_private *i915, unsigned int flags)
 {
         int ret;
 
+        /* If the device is asleep, we have no requests outstanding */
+        if (!READ_ONCE(i915->gt.awake))
+                return 0;
+
         if (flags & I915_WAIT_LOCKED) {
                 struct i915_gem_timeline *tl;
 
@@ -4218,6 +4242,7 @@ i915_gem_object_create(struct drm_i915_private *dev_priv, u64 size)
 
         mapping = obj->base.filp->f_mapping;
         mapping_set_gfp_mask(mapping, mask);
+        GEM_BUG_ON(!(mapping_gfp_mask(mapping) & __GFP_RECLAIM));
 
         i915_gem_object_init(obj, &i915_gem_object_ops);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index a3e59c8ef27b..9ad13eeed904 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -546,11 +546,12 @@ repeat:
 }
 
 static int
-i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
+i915_gem_execbuffer_relocate_entry(struct i915_vma *vma,
                                    struct eb_vmas *eb,
                                    struct drm_i915_gem_relocation_entry *reloc,
                                    struct reloc_cache *cache)
 {
+        struct drm_i915_gem_object *obj = vma->obj;
         struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
         struct drm_gem_object *target_obj;
         struct drm_i915_gem_object *target_i915_obj;
@@ -628,6 +629,16 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
                 return -EINVAL;
         }
 
+        /*
+         * If we write into the object, we need to force the synchronisation
+         * barrier, either with an asynchronous clflush or if we executed the
+         * patching using the GPU (though that should be serialised by the
+         * timeline). To be completely sure, and since we are required to
+         * do relocations we are already stalling, disable the user's opt
+         * of our synchronisation.
+         */
+        vma->exec_entry->flags &= ~EXEC_OBJECT_ASYNC;
+
         ret = relocate_entry(obj, reloc, cache, target_offset);
         if (ret)
                 return ret;
@@ -678,7 +689,7 @@ i915_gem_execbuffer_relocate_vma(struct i915_vma *vma,
                 do {
                         u64 offset = r->presumed_offset;
 
-                        ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, r, &cache);
+                        ret = i915_gem_execbuffer_relocate_entry(vma, eb, r, &cache);
                         if (ret)
                                 goto out;
 
@@ -726,7 +737,7 @@ i915_gem_execbuffer_relocate_vma_slow(struct i915_vma *vma,
 
         reloc_cache_init(&cache, eb->i915);
         for (i = 0; i < entry->relocation_count; i++) {
-                ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, &relocs[i], &cache);
+                ret = i915_gem_execbuffer_relocate_entry(vma, eb, &relocs[i], &cache);
                 if (ret)
                         break;
         }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index a0563e18d753..f1989b8792dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2191,6 +2191,101 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
                 gen8_set_pte(&gtt_base[i], scratch_pte);
 }
 
+static void bxt_vtd_ggtt_wa(struct i915_address_space *vm)
+{
+        struct drm_i915_private *dev_priv = vm->i915;
+
+        /*
+         * Make sure the internal GAM fifo has been cleared of all GTT
+         * writes before exiting stop_machine(). This guarantees that
+         * any aperture accesses waiting to start in another process
+         * cannot back up behind the GTT writes causing a hang.
+         * The register can be any arbitrary GAM register.
+         */
+        POSTING_READ(GFX_FLSH_CNTL_GEN6);
+}
+
+struct insert_page {
+        struct i915_address_space *vm;
+        dma_addr_t addr;
+        u64 offset;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_page__cb(void *_arg)
+{
+        struct insert_page *arg = _arg;
+
+        gen8_ggtt_insert_page(arg->vm, arg->addr, arg->offset, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_page__BKL(struct i915_address_space *vm,
+                                          dma_addr_t addr,
+                                          u64 offset,
+                                          enum i915_cache_level level,
+                                          u32 unused)
+{
+        struct insert_page arg = { vm, addr, offset, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_page__cb, &arg, NULL);
+}
+
+struct insert_entries {
+        struct i915_address_space *vm;
+        struct sg_table *st;
+        u64 start;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_entries__cb(void *_arg)
+{
+        struct insert_entries *arg = _arg;
+
+        gen8_ggtt_insert_entries(arg->vm, arg->st, arg->start, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_entries__BKL(struct i915_address_space *vm,
+                                             struct sg_table *st,
+                                             u64 start,
+                                             enum i915_cache_level level,
+                                             u32 unused)
+{
+        struct insert_entries arg = { vm, st, start, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_entries__cb, &arg, NULL);
+}
+
+struct clear_range {
+        struct i915_address_space *vm;
+        u64 start;
+        u64 length;
+};
+
+static int bxt_vtd_ggtt_clear_range__cb(void *_arg)
+{
+        struct clear_range *arg = _arg;
+
+        gen8_ggtt_clear_range(arg->vm, arg->start, arg->length);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_clear_range__BKL(struct i915_address_space *vm,
+                                          u64 start,
+                                          u64 length)
+{
+        struct clear_range arg = { vm, start, length };
+
+        stop_machine(bxt_vtd_ggtt_clear_range__cb, &arg, NULL);
+}
+
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                   u64 start, u64 length)
 {
@@ -2313,7 +2408,7 @@ static int aliasing_gtt_bind_vma(struct i915_vma *vma,
                     appgtt->base.allocate_va_range) {
                         ret = appgtt->base.allocate_va_range(&appgtt->base,
                                                              vma->node.start,
-                                                             vma->node.size);
+                                                             vma->size);
                         if (ret)
                                 goto err_pages;
                 }
@@ -2785,6 +2880,14 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
 
         ggtt->base.insert_entries = gen8_ggtt_insert_entries;
 
+        /* Serialize GTT updates with aperture access on BXT if VT-d is on. */
+        if (intel_ggtt_update_needs_vtd_wa(dev_priv)) {
+                ggtt->base.insert_entries = bxt_vtd_ggtt_insert_entries__BKL;
+                ggtt->base.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
+                if (ggtt->base.clear_range != nop_clear_range)
+                        ggtt->base.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+        }
+
         ggtt->invalidate = gen6_ggtt_invalidate;
 
         return ggtt_probe_common(ggtt, size);
@@ -2997,7 +3100,8 @@ void i915_ggtt_enable_guc(struct drm_i915_private *i915)
 
 void i915_ggtt_disable_guc(struct drm_i915_private *i915)
 {
-        i915->ggtt.invalidate = gen6_ggtt_invalidate;
+        if (i915->ggtt.invalidate == guc_ggtt_invalidate)
+                i915->ggtt.invalidate = gen6_ggtt_invalidate;
 }
 
 void i915_gem_restore_gtt_mappings(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/i915_gem_request.c b/drivers/gpu/drm/i915/i915_gem_request.c
index 5ddbc9499775..a74d0ac737cb 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.c
+++ b/drivers/gpu/drm/i915/i915_gem_request.c
@@ -623,7 +623,7 @@ i915_gem_request_alloc(struct intel_engine_cs *engine,
          * GPU processing the request, we never over-estimate the
          * position of the head.
          */
-        req->head = req->ring->tail;
+        req->head = req->ring->emit;
 
         /* Check that we didn't interrupt ourselves with a new request */
         GEM_BUG_ON(req->timeline->seqno != req->fence.seqno);
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 129ed303a6c4..57d9f7f4ef15 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
                 return;
 
         mutex_unlock(&dev->struct_mutex);
-
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
 }
 
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
@@ -274,8 +271,6 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_ACTIVE);
         intel_runtime_pm_put(dev_priv);
 
-        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
-
         return freed;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index a0d6d4317a49..fb5231f98c0d 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -278,7 +278,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                         obj->mm.quirked = false;
                 }
                 if (!i915_gem_object_is_tiled(obj)) {
-                        GEM_BUG_ON(!obj->mm.quirked);
+                        GEM_BUG_ON(obj->mm.quirked);
                         __i915_gem_object_pin_pages(obj);
                         obj->mm.quirked = true;
                 }
diff --git a/drivers/gpu/drm/i915/i915_guc_submission.c b/drivers/gpu/drm/i915/i915_guc_submission.c
index 1642fff9cf13..ab5140ba108d 100644
--- a/drivers/gpu/drm/i915/i915_guc_submission.c
+++ b/drivers/gpu/drm/i915/i915_guc_submission.c
@@ -480,9 +480,7 @@ static void guc_wq_item_append(struct i915_guc_client *client,
         GEM_BUG_ON(freespace < wqi_size);
 
         /* The GuC firmware wants the tail index in QWords, not bytes */
-        tail = rq->tail;
-        assert_ring_tail_valid(rq->ring, rq->tail);
-        tail >>= 3;
+        tail = intel_ring_set_tail(rq->ring, rq->tail) >> 3;
         GEM_BUG_ON(tail > WQ_RING_TAIL_MAX);
 
         /* For now workqueue item is 4 DWs; workqueue buffer is 2 pages. So we
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index fd97fe00cd0d..190f6aa5d15e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2953,7 +2953,6 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
         u32 pipestat_mask;
         u32 enable_mask;
         enum pipe pipe;
-        u32 val;
 
         pipestat_mask = PLANE_FLIP_DONE_INT_STATUS_VLV |
                         PIPE_CRC_DONE_INTERRUPT_STATUS;
@@ -2964,18 +2963,16 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
 
         enable_mask = I915_DISPLAY_PORT_INTERRUPT |
                 I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
-                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT;
+                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+                I915_LPE_PIPE_A_INTERRUPT |
+                I915_LPE_PIPE_B_INTERRUPT;
+
         if (IS_CHERRYVIEW(dev_priv))
-                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT;
+                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT |
+                        I915_LPE_PIPE_C_INTERRUPT;
 
         WARN_ON(dev_priv->irq_mask != ~0);
 
-        val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT |
-                I915_LPE_PIPE_C_INTERRUPT);
-
-        enable_mask |= val;
-
         dev_priv->irq_mask = ~enable_mask;
 
         GEN5_IRQ_INIT(VLV_, dev_priv->irq_mask, enable_mask);
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index f87b0c4e564d..1a78363c7f4a 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -208,7 +208,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
         GEN5_FEATURES,
         .platform = INTEL_IRONLAKE,
-        .is_mobile = 1,
+        .is_mobile = 1, .has_fbc = 1,
 };
 
 #define GEN6_FEATURES \
@@ -390,7 +390,6 @@ static const struct intel_device_info intel_skylake_gt3_info = {
         .has_hw_contexts = 1, \
         .has_logical_ring_contexts = 1, \
         .has_guc = 1, \
-        .has_decoupled_mmio = 1, \
         .has_aliasing_ppgtt = 1, \
         .has_full_ppgtt = 1, \
         .has_full_48bit_ppgtt = 1, \
diff --git a/drivers/gpu/drm/i915/i915_pvinfo.h b/drivers/gpu/drm/i915/i915_pvinfo.h
index c0cb2974caac..2cfe96d3e5d1 100644
--- a/drivers/gpu/drm/i915/i915_pvinfo.h
+++ b/drivers/gpu/drm/i915/i915_pvinfo.h
@@ -36,10 +36,6 @@
 #define VGT_VERSION_MAJOR 1
 #define VGT_VERSION_MINOR 0
 
-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor))
-#define INTEL_VGT_IF_VERSION \
-        INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR)
-
 /*
  * notifications from guest to vgpu device model
  */
@@ -55,8 +51,8 @@ enum vgt_g2v_type {
 
 struct vgt_if {
         u64 magic;              /* VGT_MAGIC */
-        uint16_t version_major;
-        uint16_t version_minor;
+        u16 version_major;
+        u16 version_minor;
         u32 vgt_id;             /* ID of vGT instance */
         u32 rsv1[12];           /* pad to offset 0x40 */
         /*
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 5a7c63e64381..65b837e96fe6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -8280,7 +8280,7 @@ enum {
 
 /* MIPI DSI registers */
 
-#define _MIPI_PORT(port, a, c)  ((port) ? c : a)        /* ports A and C only */
+#define _MIPI_PORT(port, a, c)  (((port) == PORT_A) ? a : c)    /* ports A and C only */
 #define _MMIO_MIPI(port, a, c)  _MMIO(_MIPI_PORT(port, a, c))
 
 #define MIPIO_TXESC_CLK_DIV1                    _MMIO(0x160004)
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index 4ab8a973b61f..2e739018fb4c 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -60,8 +60,8 @@
  */
 void i915_check_vgpu(struct drm_i915_private *dev_priv)
 {
-        uint64_t magic;
-        uint32_t version;
+        u64 magic;
+        u16 version_major;
 
         BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 
@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
         if (magic != VGT_MAGIC)
                 return;
 
-        version = INTEL_VGT_IF_VERSION_ENCODE(
-                __raw_i915_read16(dev_priv, vgtif_reg(version_major)),
-                __raw_i915_read16(dev_priv, vgtif_reg(version_minor)));
-        if (version != INTEL_VGT_IF_VERSION) {
+        version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major));
+        if (version_major < VGT_VERSION_MAJOR) {
                 DRM_INFO("VGT interface version mismatch!\n");
                 return;
         }
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 1aba47024656..f066e2d785f5 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -650,6 +650,11 @@ int i915_vma_unbind(struct i915_vma *vma)
                                 break;
                 }
 
+                if (!ret) {
+                        ret = i915_gem_active_retire(&vma->last_fence,
+                                                     &vma->vm->i915->drm.struct_mutex);
+                }
+
                 __i915_vma_unpin(vma);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3617927af269..9106ea32b048 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -120,7 +120,8 @@ static void intel_crtc_init_scalers(struct intel_crtc *crtc,
 static void skylake_pfit_enable(struct intel_crtc *crtc);
 static void ironlake_pfit_disable(struct intel_crtc *crtc, bool force);
 static void ironlake_pfit_enable(struct intel_crtc *crtc);
-static void intel_modeset_setup_hw_state(struct drm_device *dev);
+static void intel_modeset_setup_hw_state(struct drm_device *dev,
+                                         struct drm_modeset_acquire_ctx *ctx);
 static void intel_pre_disable_primary_noatomic(struct drm_crtc *crtc);
 
 struct intel_limit {
@@ -3449,7 +3450,7 @@ __intel_display_resume(struct drm_device *dev,
         struct drm_crtc *crtc;
         int i, ret;
 
-        intel_modeset_setup_hw_state(dev);
+        intel_modeset_setup_hw_state(dev, ctx);
         i915_redisable_vga(to_i915(dev));
 
         if (!state)
@@ -4598,7 +4599,7 @@ static void cpt_verify_modeset(struct drm_device *dev, int pipe)
 
 static int
 skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
-                  unsigned scaler_user, int *scaler_id, unsigned int rotation,
+                  unsigned int scaler_user, int *scaler_id,
                   int src_w, int src_h, int dst_w, int dst_h)
 {
         struct intel_crtc_scaler_state *scaler_state =
@@ -4607,9 +4608,12 @@ skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
                 to_intel_crtc(crtc_state->base.crtc);
         int need_scaling;
 
-        need_scaling = drm_rotation_90_or_270(rotation) ?
-                (src_h != dst_w || src_w != dst_h):
-                (src_w != dst_w || src_h != dst_h);
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
+        need_scaling = src_w != dst_w || src_h != dst_h;
 
         /*
          * if plane is being disabled or scaler is no more required or force detach
@@ -4671,7 +4675,7 @@ int skl_update_scaler_crtc(struct intel_crtc_state *state)
         const struct drm_display_mode *adjusted_mode = &state->base.adjusted_mode;
 
         return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
-                &state->scaler_state.scaler_id, DRM_ROTATE_0,
+                &state->scaler_state.scaler_id,
                 state->pipe_src_w, state->pipe_src_h,
                 adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
 }
@@ -4700,7 +4704,6 @@ static int skl_update_scaler_plane(struct intel_crtc_state *crtc_state,
         ret = skl_update_scaler(crtc_state, force_detach,
                                 drm_plane_index(&intel_plane->base),
                                 &plane_state->scaler_id,
-                                plane_state->base.rotation,
                                 drm_rect_width(&plane_state->base.src) >> 16,
                                 drm_rect_height(&plane_state->base.src) >> 16,
                                 drm_rect_width(&plane_state->base.dst),
@@ -5823,7 +5826,8 @@ static void i9xx_crtc_disable(struct intel_crtc_state *old_crtc_state,
                 intel_update_watermarks(intel_crtc);
 }
 
-static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
+static void intel_crtc_disable_noatomic(struct drm_crtc *crtc,
+                                        struct drm_modeset_acquire_ctx *ctx)
 {
         struct intel_encoder *encoder;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
@@ -5853,7 +5857,7 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc)
                 return;
         }
 
-        state->acquire_ctx = crtc->dev->mode_config.acquire_ctx;
+        state->acquire_ctx = ctx;
 
         /* Everything's already locked, -EDEADLK can't happen. */
         crtc_state = intel_atomic_get_crtc_state(state, intel_crtc);
@@ -6101,7 +6105,7 @@ retry:
         pipe_config->fdi_lanes = lane;
 
         intel_link_compute_m_n(pipe_config->pipe_bpp, lane, fdi_dotclock,
-                               link_bw, &pipe_config->fdi_m_n);
+                               link_bw, &pipe_config->fdi_m_n, false);
 
         ret = ironlake_check_fdi_lanes(dev, intel_crtc->pipe, pipe_config);
         if (ret == -EINVAL && pipe_config->pipe_bpp > 6*3) {
@@ -6277,7 +6281,8 @@ intel_reduce_m_n_ratio(uint32_t *num, uint32_t *den)
 }
 
 static void compute_m_n(unsigned int m, unsigned int n,
-                        uint32_t *ret_m, uint32_t *ret_n)
+                        uint32_t *ret_m, uint32_t *ret_n,
+                        bool reduce_m_n)
 {
         /*
          * Reduce M/N as much as possible without loss in precision. Several DP
@@ -6285,9 +6290,11 @@ static void compute_m_n(unsigned int m, unsigned int n,
          * values. The passed in values are more likely to have the least
          * significant bits zero than M after rounding below, so do this first.
          */
-        while ((m & 1) == 0 && (n & 1) == 0) {
-                m >>= 1;
-                n >>= 1;
+        if (reduce_m_n) {
+                while ((m & 1) == 0 && (n & 1) == 0) {
+                        m >>= 1;
+                        n >>= 1;
+                }
         }
 
         *ret_n = min_t(unsigned int, roundup_pow_of_two(n), DATA_LINK_N_MAX);
@@ -6298,16 +6305,19 @@ static void compute_m_n(unsigned int m, unsigned int n,
 void
 intel_link_compute_m_n(int bits_per_pixel, int nlanes,
                        int pixel_clock, int link_clock,
-                       struct intel_link_m_n *m_n)
+                       struct intel_link_m_n *m_n,
+                       bool reduce_m_n)
 {
         m_n->tu = 64;
 
         compute_m_n(bits_per_pixel * pixel_clock,
                     link_clock * nlanes * 8,
-                    &m_n->gmch_m, &m_n->gmch_n);
+                    &m_n->gmch_m, &m_n->gmch_n,
+                    reduce_m_n);
 
         compute_m_n(pixel_clock, link_clock,
-                    &m_n->link_m, &m_n->link_n);
+                    &m_n->link_m, &m_n->link_n,
+                    reduce_m_n);
 }
 
 static inline bool intel_panel_use_ssc(struct drm_i915_private *dev_priv)
@@ -12197,6 +12207,15 @@ static void update_scanline_offset(struct intel_crtc *crtc)
          * type. For DP ports it behaves like most other platforms, but on HDMI
          * there's an extra 1 line difference. So we need to add two instead of
          * one to the value.
+         *
+         * On VLV/CHV DSI the scanline counter would appear to increment
+         * approx. 1/3 of a scanline before start of vblank. Unfortunately
+         * that means we can't tell whether we're in vblank or not while
+         * we're on that particular line. We must still set scanline_offset
+         * to 1 so that the vblank timestamps come out correct when we query
+         * the scanline counter from within the vblank interrupt handler.
+         * However if queried just before the start of vblank we'll get an
+         * answer that's slightly in the future.
          */
         if (IS_GEN2(dev_priv)) {
                 const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
@@ -15013,7 +15032,7 @@ int intel_modeset_init(struct drm_device *dev)
         intel_setup_outputs(dev_priv);
 
         drm_modeset_lock_all(dev);
-        intel_modeset_setup_hw_state(dev);
+        intel_modeset_setup_hw_state(dev, dev->mode_config.acquire_ctx);
         drm_modeset_unlock_all(dev);
 
         for_each_intel_crtc(dev, crtc) {
@@ -15050,13 +15069,13 @@ int intel_modeset_init(struct drm_device *dev)
         return 0;
 }
 
-static void intel_enable_pipe_a(struct drm_device *dev)
+static void intel_enable_pipe_a(struct drm_device *dev,
+                                struct drm_modeset_acquire_ctx *ctx)
 {
         struct intel_connector *connector;
         struct drm_connector_list_iter conn_iter;
         struct drm_connector *crt = NULL;
         struct intel_load_detect_pipe load_detect_temp;
-        struct drm_modeset_acquire_ctx *ctx = dev->mode_config.acquire_ctx;
         int ret;
 
         /* We can't just switch on the pipe A, we need to set things up with a
@@ -15128,7 +15147,8 @@ static bool has_pch_trancoder(struct drm_i915_private *dev_priv,
                 (HAS_PCH_LPT_H(dev_priv) && pch_transcoder == TRANSCODER_A);
 }
 
-static void intel_sanitize_crtc(struct intel_crtc *crtc)
+static void intel_sanitize_crtc(struct intel_crtc *crtc,
+                                struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -15174,7 +15194,7 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                 plane = crtc->plane;
                 crtc->base.primary->state->visible = true;
                 crtc->plane = !plane;
-                intel_crtc_disable_noatomic(&crtc->base);
+                intel_crtc_disable_noatomic(&crtc->base, ctx);
                 crtc->plane = plane;
         }
 
@@ -15184,13 +15204,13 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                  * resume. Force-enable the pipe to fix this, the update_dpms
                  * call below we restore the pipe to the right state, but leave
                  * the required bits on. */
-                intel_enable_pipe_a(dev);
+                intel_enable_pipe_a(dev, ctx);
         }
 
         /* Adjust the state of the output pipe according to whether we
          * have active connectors/encoders. */
         if (crtc->active && !intel_crtc_has_encoders(crtc))
-                intel_crtc_disable_noatomic(&crtc->base);
+                intel_crtc_disable_noatomic(&crtc->base, ctx);
 
         if (crtc->active || HAS_GMCH_DISPLAY(dev_priv)) {
                 /*
@@ -15488,7 +15508,8 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
  * and sanitizes it to the current state
  */
 static void
-intel_modeset_setup_hw_state(struct drm_device *dev)
+intel_modeset_setup_hw_state(struct drm_device *dev,
+                             struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
         enum pipe pipe;
@@ -15508,7 +15529,7 @@ intel_modeset_setup_hw_state(struct drm_device *dev)
         for_each_pipe(dev_priv, pipe) {
                 crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
 
-                intel_sanitize_crtc(crtc);
+                intel_sanitize_crtc(crtc, ctx);
                 intel_dump_pipe_config(crtc, crtc->config,
                                        "[setup_hw_state]");
         }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ee77b519835c..fc691b8b317c 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1507,37 +1507,6 @@ static void intel_dp_print_rates(struct intel_dp *intel_dp)
         DRM_DEBUG_KMS("common rates: %s\n", str);
 }
 
-bool
-__intel_dp_read_desc(struct intel_dp *intel_dp, struct intel_dp_desc *desc)
-{
-        u32 base = drm_dp_is_branch(intel_dp->dpcd) ? DP_BRANCH_OUI :
-                                                      DP_SINK_OUI;
-
-        return drm_dp_dpcd_read(&intel_dp->aux, base, desc, sizeof(*desc)) ==
-               sizeof(*desc);
-}
-
-bool intel_dp_read_desc(struct intel_dp *intel_dp)
-{
-        struct intel_dp_desc *desc = &intel_dp->desc;
-        bool oui_sup = intel_dp->dpcd[DP_DOWN_STREAM_PORT_COUNT] &
-                       DP_OUI_SUPPORT;
-        int dev_id_len;
-
-        if (!__intel_dp_read_desc(intel_dp, desc))
-                return false;
-
-        dev_id_len = strnlen(desc->device_id, sizeof(desc->device_id));
-        DRM_DEBUG_KMS("DP %s: OUI %*phD%s dev-ID %*pE HW-rev %d.%d SW-rev %d.%d\n",
-                      drm_dp_is_branch(intel_dp->dpcd) ? "branch" : "sink",
-                      (int)sizeof(desc->oui), desc->oui, oui_sup ? "" : "(NS)",
-                      dev_id_len, desc->device_id,
-                      desc->hw_rev >> 4, desc->hw_rev & 0xf,
-                      desc->sw_major_rev, desc->sw_minor_rev);
-
-        return true;
-}
-
 static int rate_to_index(int find, const int *rates)
 {
         int i = 0;
@@ -1624,6 +1593,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
         int common_rates[DP_MAX_SUPPORTED_RATES] = {};
         int common_len;
         uint8_t link_bw, rate_select;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         common_len = intel_dp_common_rates(intel_dp, common_rates);
 
@@ -1753,7 +1724,8 @@ found:
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         if (intel_connector->panel.downclock_mode != NULL &&
                 dev_priv->drrs.type == SEAMLESS_DRRS_SUPPORT) {
@@ -1761,7 +1733,8 @@ found:
                         intel_link_compute_m_n(bpp, lane_count,
                                 intel_connector->panel.downclock_mode->clock,
                                 pipe_config->port_clock,
-                                &pipe_config->dp_m2_n2);
+                                &pipe_config->dp_m2_n2,
+                                reduce_m_n);
         }
 
         /*
@@ -3622,7 +3595,8 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
         if (!intel_dp_read_dpcd(intel_dp))
                 return false;
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11)
                 dev_priv->no_aux_handshake = intel_dp->dpcd[DP_MAX_DOWNSPREAD] &
@@ -4624,7 +4598,8 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
 
         intel_dp_print_rates(intel_dp);
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         intel_dp_configure_mst(intel_dp);
 
diff --git a/drivers/gpu/drm/i915/intel_dp_aux_backlight.c b/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
index 6532e226db29..40ba3134545e 100644
--- a/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
+++ b/drivers/gpu/drm/i915/intel_dp_aux_backlight.c
@@ -119,8 +119,6 @@ static int intel_dp_aux_setup_backlight(struct intel_connector *connector,
         struct intel_dp *intel_dp = enc_to_intel_dp(&connector->encoder->base);
         struct intel_panel *panel = &connector->panel;
 
-        intel_dp_aux_enable_backlight(connector);
-
         if (intel_dp->edp_dpcd[2] & DP_EDP_BACKLIGHT_BRIGHTNESS_BYTE_COUNT)
                 panel->backlight.max = 0xFFFF;
         else
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index c1f62eb07c07..989e25577ac0 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -44,6 +44,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         int lane_count, slots;
         const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
         int mst_pbn;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         pipe_config->has_pch_encoder = false;
         bpp = 24;
@@ -75,7 +77,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         pipe_config->dp_m_n.tu = slots;
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index aaee3949a422..f630c7af5020 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -906,14 +906,6 @@ enum link_m_n_set {
         M2_N2
 };
 
-struct intel_dp_desc {
-        u8 oui[3];
-        u8 device_id[6];
-        u8 hw_rev;
-        u8 sw_major_rev;
-        u8 sw_minor_rev;
-} __packed;
-
 struct intel_dp_compliance_data {
         unsigned long edid;
         uint8_t video_pattern;
@@ -957,7 +949,7 @@ struct intel_dp {
         /* Max link BW for the sink as per DPCD registers */
         int max_sink_link_bw;
         /* sink or branch descriptor */
-        struct intel_dp_desc desc;
+        struct drm_dp_desc desc;
         struct drm_dp_aux aux;
         enum intel_display_power_domain aux_power_domain;
         uint8_t train_set[4];
@@ -1532,9 +1524,6 @@ static inline unsigned int intel_dp_unused_lane_mask(int lane_count)
 }
 
 bool intel_dp_read_dpcd(struct intel_dp *intel_dp);
-bool __intel_dp_read_desc(struct intel_dp *intel_dp,
-                          struct intel_dp_desc *desc);
-bool intel_dp_read_desc(struct intel_dp *intel_dp);
 int intel_dp_link_required(int pixel_clock, int bpp);
 int intel_dp_max_data_rate(int max_link_clock, int max_lanes);
 bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 854e8e0c836b..f94eacff196c 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1075,6 +1075,22 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
         return 0;
 }
 
+static bool ring_is_idle(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->i915;
+        bool idle = true;
+
+        intel_runtime_pm_get(dev_priv);
+
+        /* No bit for gen2, so assume the CS parser is idle */
+        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+                idle = false;
+
+        intel_runtime_pm_put(dev_priv);
+
+        return idle;
+}
+
 /**
  * intel_engine_is_idle() - Report if the engine has finished process all work
  * @engine: the intel_engine_cs
@@ -1084,8 +1100,6 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
  */
 bool intel_engine_is_idle(struct intel_engine_cs *engine)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
-
         /* Any inflight/incomplete requests? */
         if (!i915_seqno_passed(intel_engine_get_seqno(engine),
                                intel_engine_last_submit(engine)))
@@ -1100,7 +1114,7 @@ bool intel_engine_is_idle(struct intel_engine_cs *engine)
                 return false;
 
         /* Ring stopped? */
-        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+        if (!ring_is_idle(engine))
                 return false;
 
         return true;
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index ded2add18b26..d93c58410bff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -82,20 +82,10 @@ static unsigned int get_crtc_fence_y_offset(struct intel_crtc *crtc)
 static void intel_fbc_get_plane_source_size(struct intel_fbc_state_cache *cache,
                                             int *width, int *height)
 {
-        int w, h;
-
-        if (drm_rotation_90_or_270(cache->plane.rotation)) {
-                w = cache->plane.src_h;
-                h = cache->plane.src_w;
-        } else {
-                w = cache->plane.src_w;
-                h = cache->plane.src_h;
-        }
-
         if (width)
-                *width = w;
+                *width = cache->plane.src_w;
         if (height)
-                *height = h;
+                *height = cache->plane.src_h;
 }
 
 static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
@@ -746,6 +736,11 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                 cache->crtc.hsw_bdw_pixel_rate = crtc_state->pixel_rate;
 
         cache->plane.rotation = plane_state->base.rotation;
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         cache->plane.src_w = drm_rect_width(&plane_state->base.src) >> 16;
         cache->plane.src_h = drm_rect_height(&plane_state->base.src) >> 16;
         cache->plane.visible = plane_state->base.visible;
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 668f00480d97..292fedf30b00 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -149,44 +149,10 @@ static void lpe_audio_platdev_destroy(struct drm_i915_private *dev_priv)
 
 static void lpe_audio_irq_unmask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask &= ~val;
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        POSTING_READ(VLV_IMR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static void lpe_audio_irq_mask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask |= val;
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        POSTING_READ(VLV_IIR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static struct irq_chip lpe_audio_irqchip = {
@@ -330,8 +296,6 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
 
         desc = irq_to_desc(dev_priv->lpe_audio.irq);
 
-        lpe_audio_irq_mask(&desc->irq_data);
-
         lpe_audio_platdev_destroy(dev_priv);
 
         irq_free_desc(dev_priv->lpe_audio.irq);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index c8f7c631fc1f..62f44d3e7c43 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -326,8 +326,7 @@ static u64 execlists_update_context(struct drm_i915_gem_request *rq)
                 rq->ctx->ppgtt ?: rq->i915->mm.aliasing_ppgtt;
         u32 *reg_state = ce->lrc_reg_state;
 
-        assert_ring_tail_valid(rq->ring, rq->tail);
-        reg_state[CTX_RING_TAIL+1] = rq->tail;
+        reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
 
         /* True 32b PPGTT with dynamic page allocation: update PDP
          * registers and point the unallocated PDPs to scratch page.
@@ -1989,7 +1988,7 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
 
         ce->ring = ring;
         ce->state = vma;
-        ce->initialised = engine->init_context == NULL;
+        ce->initialised |= engine->init_context == NULL;
 
         return 0;
 
@@ -2036,8 +2035,7 @@ void intel_lr_context_resume(struct drm_i915_private *dev_priv)
                         ce->state->obj->mm.dirty = true;
                         i915_gem_object_unpin_map(ce->state->obj);
 
-                        ce->ring->head = ce->ring->tail = 0;
-                        intel_ring_update_space(ce->ring);
+                        intel_ring_reset(ce->ring, 0);
                 }
         }
 }
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 71cbe9c08932..5abef482eacf 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -240,7 +240,7 @@ bool lspcon_init(struct intel_digital_port *intel_dig_port)
                 return false;
         }
 
-        intel_dp_read_desc(dp);
+        drm_dp_read_desc(&dp->aux, &dp->desc, drm_dp_is_branch(dp->dpcd));
 
         DRM_DEBUG_KMS("Success: LSPCON init\n");
         return true;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 570bd603f401..078fd1bfa5ea 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3373,20 +3373,26 @@ skl_plane_downscale_amount(const struct intel_crtc_state *cstate,
 
         /* n.b., src is 16.16 fixed point, dst is whole integer */
         if (plane->id == PLANE_CURSOR) {
+                /*
+                 * Cursors only support 0/180 degree rotation,
+                 * hence no need to account for rotation here.
+                 */
                 src_w = pstate->base.src_w;
                 src_h = pstate->base.src_h;
                 dst_w = pstate->base.crtc_w;
                 dst_h = pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 src_w = drm_rect_width(&pstate->base.src);
                 src_h = drm_rect_height(&pstate->base.src);
                 dst_w = drm_rect_width(&pstate->base.dst);
                 dst_h = drm_rect_height(&pstate->base.dst);
         }
 
-        if (drm_rotation_90_or_270(pstate->base.rotation))
-                swap(dst_w, dst_h);
-
         downscale_h = max(src_h / dst_h, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
         downscale_w = max(src_w / dst_w, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
 
@@ -3417,12 +3423,14 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
         if (y && format != DRM_FORMAT_NV12)
                 return 0;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         width = drm_rect_width(&intel_pstate->base.src) >> 16;
         height = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         /* for planar format */
         if (format == DRM_FORMAT_NV12) {
                 if (y)  /* y-plane data rate */
@@ -3505,12 +3513,14 @@ skl_ddb_min_alloc(const struct drm_plane_state *pstate,
             fb->modifier != I915_FORMAT_MOD_Yf_TILED)
                 return 8;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         src_w = drm_rect_width(&intel_pstate->base.src) >> 16;
         src_h = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(src_w, src_h);
-
         /* Halve UV plane width and height for NV12 */
         if (fb->format->format == DRM_FORMAT_NV12 && !y) {
                 src_w /= 2;
@@ -3794,13 +3804,15 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
                 width = intel_pstate->base.crtc_w;
                 height = intel_pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 width = drm_rect_width(&intel_pstate->base.src) >> 16;
                 height = drm_rect_height(&intel_pstate->base.src) >> 16;
         }
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         cpp = fb->format->cpp[0];
         plane_pixel_rate = skl_adjusted_plane_pixel_rate(cstate, intel_pstate);
 
@@ -4335,11 +4347,19 @@ skl_compute_wm(struct drm_atomic_state *state)
         struct drm_crtc_state *cstate;
         struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
         struct skl_wm_values *results = &intel_state->wm_results;
+        struct drm_device *dev = state->dev;
         struct skl_pipe_wm *pipe_wm;
         bool changed = false;
         int ret, i;
 
         /*
+         * When we distrust bios wm we always need to recompute to set the
+         * expected DDB allocations for each CRTC.
+         */
+        if (to_i915(dev)->wm.distrust_bios_wm)
+                changed = true;
+
+        /*
          * If this transaction isn't actually touching any CRTC's, don't
          * bother with watermark calculation.  Note that if we pass this
          * test, we're guaranteed to hold at least one CRTC state mutex,
@@ -4349,6 +4369,7 @@ skl_compute_wm(struct drm_atomic_state *state)
          */
         for_each_new_crtc_in_state(state, crtc, cstate, i)
                 changed = true;
+
         if (!changed)
                 return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index c3780d0d2baf..559f1ab42bfc 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -435,8 +435,9 @@ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
         }
 
         /* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-        if (intel_crtc->config->pipe_src_w > 3200 ||
-                                intel_crtc->config->pipe_src_h > 2000) {
+        if (dev_priv->psr.psr2_support &&
+            (intel_crtc->config->pipe_src_w > 3200 ||
+             intel_crtc->config->pipe_src_h > 2000)) {
                 dev_priv->psr.psr2_support = false;
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 66a2b8b83972..513a0f4b469b 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -49,7 +49,7 @@ static int __intel_ring_space(int head, int tail, int size)
 
 void intel_ring_update_space(struct intel_ring *ring)
 {
-        ring->space = __intel_ring_space(ring->head, ring->tail, ring->size);
+        ring->space = __intel_ring_space(ring->head, ring->emit, ring->size);
 }
 
 static int
@@ -774,8 +774,8 @@ static void i9xx_submit_request(struct drm_i915_gem_request *request)
 
         i915_gem_request_submit(request);
 
-        assert_ring_tail_valid(request->ring, request->tail);
-        I915_WRITE_TAIL(request->engine, request->tail);
+        I915_WRITE_TAIL(request->engine,
+                        intel_ring_set_tail(request->ring, request->tail));
 }
 
 static void i9xx_emit_breadcrumb(struct drm_i915_gem_request *req, u32 *cs)
@@ -1316,11 +1316,23 @@ err:
         return PTR_ERR(addr);
 }
 
+void intel_ring_reset(struct intel_ring *ring, u32 tail)
+{
+        GEM_BUG_ON(!list_empty(&ring->request_list));
+        ring->tail = tail;
+        ring->head = tail;
+        ring->emit = tail;
+        intel_ring_update_space(ring);
+}
+
 void intel_ring_unpin(struct intel_ring *ring)
 {
         GEM_BUG_ON(!ring->vma);
         GEM_BUG_ON(!ring->vaddr);
 
+        /* Discard any unused bytes beyond that submitted to hw. */
+        intel_ring_reset(ring, ring->tail);
+
         if (i915_vma_is_map_and_fenceable(ring->vma))
                 i915_vma_unpin_iomap(ring->vma);
         else
@@ -1562,8 +1574,9 @@ void intel_legacy_submission_resume(struct drm_i915_private *dev_priv)
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
 
+        /* Restart from the beginning of the rings for convenience */
         for_each_engine(engine, dev_priv, id)
-                engine->buffer->head = engine->buffer->tail;
+                intel_ring_reset(engine->buffer, 0);
 }
 
 static int ring_request_alloc(struct drm_i915_gem_request *request)
@@ -1616,7 +1629,7 @@ static int wait_for_space(struct drm_i915_gem_request *req, int bytes)
                 unsigned space;
 
                 /* Would completion of this request free enough space? */
-                space = __intel_ring_space(target->postfix, ring->tail,
+                space = __intel_ring_space(target->postfix, ring->emit,
                                            ring->size);
                 if (space >= bytes)
                         break;
@@ -1641,8 +1654,8 @@ static int wait_for_space(struct drm_i915_gem_request *req, int bytes)
 u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 {
         struct intel_ring *ring = req->ring;
-        int remain_actual = ring->size - ring->tail;
-        int remain_usable = ring->effective_size - ring->tail;
+        int remain_actual = ring->size - ring->emit;
+        int remain_usable = ring->effective_size - ring->emit;
         int bytes = num_dwords * sizeof(u32);
         int total_bytes, wait_bytes;
         bool need_wrap = false;
@@ -1678,17 +1691,17 @@ u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 
         if (unlikely(need_wrap)) {
                 GEM_BUG_ON(remain_actual > ring->space);
-                GEM_BUG_ON(ring->tail + remain_actual > ring->size);
+                GEM_BUG_ON(ring->emit + remain_actual > ring->size);
 
                 /* Fill the tail with MI_NOOP */
-                memset(ring->vaddr + ring->tail, 0, remain_actual);
-                ring->tail = 0;
+                memset(ring->vaddr + ring->emit, 0, remain_actual);
+                ring->emit = 0;
                 ring->space -= remain_actual;
         }
 
-        GEM_BUG_ON(ring->tail > ring->size - bytes);
-        cs = ring->vaddr + ring->tail;
-        ring->tail += bytes;
+        GEM_BUG_ON(ring->emit > ring->size - bytes);
+        cs = ring->vaddr + ring->emit;
+        ring->emit += bytes;
         ring->space -= bytes;
         GEM_BUG_ON(ring->space < 0);
 
@@ -1699,7 +1712,7 @@ u32 *intel_ring_begin(struct drm_i915_gem_request *req, int num_dwords)
 int intel_ring_cacheline_align(struct drm_i915_gem_request *req)
 {
         int num_dwords =
-                (req->ring->tail & (CACHELINE_BYTES - 1)) / sizeof(uint32_t);
+                (req->ring->emit & (CACHELINE_BYTES - 1)) / sizeof(uint32_t);
         u32 *cs;
 
         if (num_dwords == 0)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index a82a0807f64d..f7144fe09613 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -145,6 +145,7 @@ struct intel_ring {
 
         u32 head;
         u32 tail;
+        u32 emit;
 
         int space;
         int size;
@@ -488,6 +489,8 @@ intel_write_status_page(struct intel_engine_cs *engine, int reg, u32 value)
 struct intel_ring *
 intel_engine_create_ring(struct intel_engine_cs *engine, int size);
 int intel_ring_pin(struct intel_ring *ring, unsigned int offset_bias);
+void intel_ring_reset(struct intel_ring *ring, u32 tail);
+void intel_ring_update_space(struct intel_ring *ring);
 void intel_ring_unpin(struct intel_ring *ring);
 void intel_ring_free(struct intel_ring *ring);
 
@@ -511,7 +514,7 @@ intel_ring_advance(struct drm_i915_gem_request *req, u32 *cs)
          * reserved for the command packet (i.e. the value passed to
          * intel_ring_begin()).
          */
-        GEM_BUG_ON((req->ring->vaddr + req->ring->tail) != cs);
+        GEM_BUG_ON((req->ring->vaddr + req->ring->emit) != cs);
 }
 
 static inline u32
@@ -540,7 +543,19 @@ assert_ring_tail_valid(const struct intel_ring *ring, unsigned int tail)
         GEM_BUG_ON(tail >= ring->size);
 }
 
-void intel_ring_update_space(struct intel_ring *ring);
+static inline unsigned int
+intel_ring_set_tail(struct intel_ring *ring, unsigned int tail)
+{
+        /* Whilst writes to the tail are strictly order, there is no
+         * serialisation between readers and the writers. The tail may be
+         * read by i915_gem_request_retire() just as it is being updated
+         * by execlists, as although the breadcrumb is complete, the context
+         * switch hasn't been seen.
+         */
+        assert_ring_tail_valid(ring, tail);
+        ring->tail = tail;
+        return tail;
+}
 
 void intel_engine_init_global_seqno(struct intel_engine_cs *engine, u32 seqno);
 
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8c87c717c7cd..e6517edcd16b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -83,10 +83,13 @@ int intel_usecs_to_scanlines(const struct drm_display_mode *adjusted_mode,
  */
 void intel_pipe_update_start(struct intel_crtc *crtc)
 {
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
         const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
         long timeout = msecs_to_jiffies_timeout(1);
         int scanline, min, max, vblank_start;
         wait_queue_head_t *wq = drm_crtc_vblank_waitqueue(&crtc->base);
+        bool need_vlv_dsi_wa = (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+                intel_crtc_has_type(crtc->config, INTEL_OUTPUT_DSI);
         DEFINE_WAIT(wait);
 
         vblank_start = adjusted_mode->crtc_vblank_start;
@@ -139,6 +142,24 @@ void intel_pipe_update_start(struct intel_crtc *crtc)
 
         drm_crtc_vblank_put(&crtc->base);
 
+        /*
+         * On VLV/CHV DSI the scanline counter would appear to
+         * increment approx. 1/3 of a scanline before start of vblank.
+         * The registers still get latched at start of vblank however.
+         * This means we must not write any registers on the first
+         * line of vblank (since not the whole line is actually in
+         * vblank). And unfortunately we can't use the interrupt to
+         * wait here since it will fire too soon. We could use the
+         * frame start interrupt instead since it will fire after the
+         * critical scanline, but that would require more changes
+         * in the interrupt code. So for now we'll just do the nasty
+         * thing and poll for the bad scanline to pass us by.
+         *
+         * FIXME figure out if BXT+ DSI suffers from this as well
+         */
+        while (need_vlv_dsi_wa && scanline == vblank_start)
+                scanline = intel_get_crtc_scanline(crtc);
+
         crtc->debug.scanline_start = scanline;
         crtc->debug.start_vbl_time = ktime_get();
         crtc->debug.start_vbl_count = intel_crtc_get_vblank_counter(crtc);
diff --git a/drivers/gpu/drm/i915/intel_uc.h b/drivers/gpu/drm/i915/intel_uc.h
index 4b7f73aeddac..f84115261ae7 100644
--- a/drivers/gpu/drm/i915/intel_uc.h
+++ b/drivers/gpu/drm/i915/intel_uc.h
@@ -59,8 +59,6 @@ struct drm_i915_gem_request;
  *                available in the work queue (note, the queue is shared,
  *                not per-engine). It is OK for this to be nonzero, but
  *                it should not be huge!
- *   q_fail: failed to enqueue a work item. This should never happen,
- *           because we check for space beforehand.
  *   b_fail: failed to ring the doorbell. This should never happen, unless
  *           somehow the hardware misbehaves, or maybe if the GuC firmware
  *           crashes? We probably need to reset the GPU to recover.
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
index 1afb8b06e3e1..12b85b3278cd 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
@@ -320,7 +320,7 @@ static unsigned long max_dwords(struct drm_i915_gem_object *obj)
 static int igt_ctx_exec(void *arg)
 {
         struct drm_i915_private *i915 = arg;
-        struct drm_i915_gem_object *obj;
+        struct drm_i915_gem_object *obj = NULL;
         struct drm_file *file;
         IGT_TIMEOUT(end_time);
         LIST_HEAD(objects);
@@ -359,7 +359,7 @@ static int igt_ctx_exec(void *arg)
                 }
 
                 for_each_engine(engine, i915, id) {
-                        if (dw == 0) {
+                        if (!obj) {
                                 obj = create_test_object(ctx, file, &objects);
                                 if (IS_ERR(obj)) {
                                         err = PTR_ERR(obj);
@@ -376,8 +376,10 @@ static int igt_ctx_exec(void *arg)
                                 goto out_unlock;
                         }
 
-                        if (++dw == max_dwords(obj))
+                        if (++dw == max_dwords(obj)) {
+                                obj = NULL;
                                 dw = 0;
+                        }
                         ndwords++;
                 }
                 ncontexts++;
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 8fb801fab039..8b05ecb8fdef 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -673,7 +673,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 ret = drm_of_find_panel_or_bridge(child,
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
-                if (ret)
+                if (ret && ret != -ENODEV)
                         return ret;
 
                 /* panel ddc only if there is no bridge */
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 808b995a990f..b5cc6e12334c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -19,6 +19,7 @@
 #include <drm/drm_of.h>
 #include <linux/clk.h>
 #include <linux/component.h>
+#include <linux/iopoll.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -900,16 +901,12 @@ static int mtk_dsi_host_detach(struct mipi_dsi_host *host,
 
 static void mtk_dsi_wait_for_idle(struct mtk_dsi *dsi)
 {
-        u32 timeout_ms = 500000; /* total 1s ~ 2s timeout */
-
-        while (timeout_ms--) {
-                if (!(readl(dsi->regs + DSI_INTSTA) & DSI_BUSY))
-                        break;
-
-                usleep_range(2, 4);
-        }
+        int ret;
+        u32 val;
 
-        if (timeout_ms == 0) {
+        ret = readl_poll_timeout(dsi->regs + DSI_INTSTA, val, !(val & DSI_BUSY),
+                                 4, 2000000);
+        if (ret) {
                 DRM_WARN("polling dsi wait not busy timeout!\n");
 
                 mtk_dsi_enable(dsi);
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 41a1c03b0347..0a4ffd724146 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
         }
 
         err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-        if (err) {
+        if (err < 0) {
                 dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
                         err);
                 return err;
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 75382f5f0fce..10b227d83e9a 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -152,7 +152,7 @@ static struct regmap_config meson_regmap_config = {
         .max_register   = 0x1000,
 };
 
-static int meson_drv_bind(struct device *dev)
+static int meson_drv_bind_master(struct device *dev, bool has_components)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct meson_drm *priv;
@@ -233,10 +233,12 @@ static int meson_drv_bind(struct device *dev)
         if (ret)
                 goto free_drm;
 
-        ret = component_bind_all(drm->dev, drm);
-        if (ret) {
-                dev_err(drm->dev, "Couldn't bind all components\n");
-                goto free_drm;
+        if (has_components) {
+                ret = component_bind_all(drm->dev, drm);
+                if (ret) {
+                        dev_err(drm->dev, "Couldn't bind all components\n");
+                        goto free_drm;
+                }
         }
 
         ret = meson_plane_create(priv);
@@ -276,6 +278,11 @@ free_drm:
         return ret;
 }
 
+static int meson_drv_bind(struct device *dev)
+{
+        return meson_drv_bind_master(dev, true);
+}
+
 static void meson_drv_unbind(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
@@ -357,6 +364,9 @@ static int meson_drv_probe(struct platform_device *pdev)
                 count += meson_probe_remote(pdev, &match, np, remote);
         }
 
+        if (count && !match)
+                return meson_drv_bind_master(&pdev->dev, false);
+
         /* If some endpoints were found, initialize the nodes */
         if (count) {
                 dev_info(&pdev->dev, "Queued %d outputs on vpu\n", count);
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index adb411a078e8..f4b53588e071 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1173,7 +1173,10 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
 
 
         if (IS_G200_SE(mdev)) {
-                if (mdev->unique_rev_id >= 0x02) {
+                if  (mdev->unique_rev_id >= 0x04) {
+                        WREG8(MGAREG_CRTCEXT_INDEX, 0x06);
+                        WREG8(MGAREG_CRTCEXT_DATA, 0);
+                } else if (mdev->unique_rev_id >= 0x02) {
                         u8 hi_pri_lvl;
                         u32 bpp;
                         u32 mb;
@@ -1639,6 +1642,10 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
                         if (mga_vga_calculate_mode_bandwidth(mode, bpp)
                                 > (30100 * 1024))
                                 return MODE_BANDWIDTH;
+                } else {
+                        if (mga_vga_calculate_mode_bandwidth(mode, bpp)
+                                > (55000 * 1024))
+                                return MODE_BANDWIDTH;
                 }
         } else if (mdev->type == G200_WB) {
                 if (mode->hdisplay > 1280)
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index 5b8e23d051f2..0a31cd6d01ce 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -13,6 +13,7 @@ config DRM_MSM
         select QCOM_SCM
         select SND_SOC_HDMI_CODEC if SND_SOC
         select SYNC_FILE
+        select PM_OPP
         default y
         help
           DRM/KMS driver for MSM/snapdragon.
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
index f8f48d014978..9c34d7824988 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
@@ -116,7 +116,7 @@ static int mdss_hw_irqdomain_map(struct irq_domain *d, unsigned int irq,
         return 0;
 }
 
-static struct irq_domain_ops mdss_hw_irqdomain_ops = {
+static const struct irq_domain_ops mdss_hw_irqdomain_ops = {
         .map = mdss_hw_irqdomain_map,
         .xlate = irq_domain_xlate_onecell,
 };
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index a38c5fe6cc19..7d3741215387 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -225,9 +225,10 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
 
         mdp5_state = kmemdup(to_mdp5_plane_state(plane->state),
                         sizeof(*mdp5_state), GFP_KERNEL);
+        if (!mdp5_state)
+                return NULL;
 
-        if (mdp5_state && mdp5_state->base.fb)
-                drm_framebuffer_reference(mdp5_state->base.fb);
+        __drm_atomic_helper_plane_duplicate_state(plane, &mdp5_state->base);
 
         return &mdp5_state->base;
 }
@@ -444,6 +445,10 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
                         mdp5_pipe_release(state->state, old_hwpipe);
                         mdp5_pipe_release(state->state, old_right_hwpipe);
                 }
+        } else {
+                mdp5_pipe_release(state->state, mdp5_state->hwpipe);
+                mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
+                mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 87b5695d4034..9d498eb81906 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -830,6 +830,7 @@ static struct drm_driver msm_driver = {
         .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
         .gem_prime_export   = drm_gem_prime_export,
         .gem_prime_import   = drm_gem_prime_import,
+        .gem_prime_res_obj  = msm_gem_prime_res_obj,
         .gem_prime_pin      = msm_gem_prime_pin,
         .gem_prime_unpin    = msm_gem_prime_unpin,
         .gem_prime_get_sg_table = msm_gem_prime_get_sg_table,
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 28b6f9ba5066..1b26ca626528 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -224,6 +224,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);
 void *msm_gem_prime_vmap(struct drm_gem_object *obj);
 void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj);
 struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
                 struct dma_buf_attachment *attach, struct sg_table *sg);
 int msm_gem_prime_pin(struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
index 3f299c537b77..a2f89bac9c16 100644
--- a/drivers/gpu/drm/msm/msm_fence.c
+++ b/drivers/gpu/drm/msm/msm_fence.c
@@ -99,8 +99,8 @@ void msm_update_fence(struct msm_fence_context *fctx, uint32_t fence)
 }
 
 struct msm_fence {
-        struct msm_fence_context *fctx;
         struct dma_fence base;
+        struct msm_fence_context *fctx;
 };
 
 static inline struct msm_fence *to_msm_fence(struct dma_fence *fence)
@@ -130,19 +130,13 @@ static bool msm_fence_signaled(struct dma_fence *fence)
         return fence_completed(f->fctx, f->base.seqno);
 }
 
-static void msm_fence_release(struct dma_fence *fence)
-{
-        struct msm_fence *f = to_msm_fence(fence);
-        kfree_rcu(f, base.rcu);
-}
-
 static const struct dma_fence_ops msm_fence_ops = {
         .get_driver_name = msm_fence_get_driver_name,
         .get_timeline_name = msm_fence_get_timeline_name,
         .enable_signaling = msm_fence_enable_signaling,
         .signaled = msm_fence_signaled,
         .wait = dma_fence_default_wait,
-        .release = msm_fence_release,
+        .release = dma_fence_free,
 };
 
 struct dma_fence *
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 68e509b3b9e4..50289a23baf8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -758,6 +758,8 @@ static int msm_gem_new_impl(struct drm_device *dev,
         struct msm_gem_object *msm_obj;
         bool use_vram = false;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         switch (flags & MSM_BO_CACHE_MASK) {
         case MSM_BO_UNCACHED:
         case MSM_BO_CACHED:
@@ -853,7 +855,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
 
         size = PAGE_ALIGN(dmabuf->size);
 
+        /* Take mutex so we can modify the inactive list in msm_gem_new_impl */
+        mutex_lock(&dev->struct_mutex);
         ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj);
+        mutex_unlock(&dev->struct_mutex);
+
         if (ret)
                 goto fail;
 
diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index 60bb290700ce..13403c6da6c7 100644
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -70,3 +70,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj)
         if (!obj->import_attach)
                 msm_gem_put_pages(obj);
 }
+
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj)
+{
+        struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+        return msm_obj->resv;
+}
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 1c545ebe6a5a..7832e6421d25 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -410,12 +410,11 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                 if (!in_fence)
                         return -EINVAL;
 
-                /* TODO if we get an array-fence due to userspace merging multiple
-                 * fences, we need a way to determine if all the backing fences
-                 * are from our own context..
+                /*
+                 * Wait if the fence is from a foreign context, or if the fence
+                 * array contains any fence from a foreign context.
                  */
-
-                if (in_fence->context != gpu->fctx->context) {
+                if (!dma_fence_match_context(in_fence, gpu->fctx->context)) {
                         ret = dma_fence_wait(in_fence, true);
                         if (ret)
                                 return ret;
@@ -496,8 +495,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                         goto out;
                 }
 
-                if ((submit_cmd.size + submit_cmd.submit_offset) >=
-                                msm_obj->base.size) {
+                if (!submit_cmd.size ||
+                        ((submit_cmd.size + submit_cmd.submit_offset) >
+                                msm_obj->base.size)) {
                         DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
                         ret = -EINVAL;
                         goto out;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 97b9c38c6b3f..0fdc88d79ca8 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -549,9 +549,9 @@ static int get_clocks(struct platform_device *pdev, struct msm_gpu *gpu)
                 gpu->grp_clks[i] = get_clock(dev, name);
 
                 /* Remember the key clocks that we need to control later */
-                if (!strcmp(name, "core"))
+                if (!strcmp(name, "core") || !strcmp(name, "core_clk"))
                         gpu->core_clk = gpu->grp_clks[i];
-                else if (!strcmp(name, "rbbmtimer"))
+                else if (!strcmp(name, "rbbmtimer") || !strcmp(name, "rbbmtimer_clk"))
                         gpu->rbbmtimer_clk = gpu->grp_clks[i];
 
                 ++i;
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index 1144e0c9e894..0abe77675b76 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -35,6 +35,13 @@
 #include "mxsfb_drv.h"
 #include "mxsfb_regs.h"
 
+#define MXS_SET_ADDR            0x4
+#define MXS_CLR_ADDR            0x8
+#define MODULE_CLKGATE          BIT(30)
+#define MODULE_SFTRST           BIT(31)
+/* 1 second delay should be plenty of time for block reset */
+#define RESET_TIMEOUT           1000000
+
 static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val)
 {
         return (val & mxsfb->devdata->hs_wdth_mask) <<
@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(struct mxsfb_drm_private *mxsfb)
                 clk_disable_unprepare(mxsfb->clk_disp_axi);
 }
 
+/*
+ * Clear the bit and poll it cleared.  This is usually called with
+ * a reset address and mask being either SFTRST(bit 31) or CLKGATE
+ * (bit 30).
+ */
+static int clear_poll_bit(void __iomem *addr, u32 mask)
+{
+        u32 reg;
+
+        writel(mask, addr + MXS_CLR_ADDR);
+        return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT);
+}
+
+static int mxsfb_reset_block(void __iomem *reset_addr)
+{
+        int ret;
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR);
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        return clear_poll_bit(reset_addr, MODULE_CLKGATE);
+}
+
 static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
 {
         struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode;
@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
          */
         mxsfb_enable_axi_clk(mxsfb);
 
+        /* Mandatory eLCDIF reset as per the Reference Manual */
+        err = mxsfb_reset_block(mxsfb->base);
+        if (err)
+                return;
+
         /* Clear the FIFOs */
         writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
 
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 6a567fe347b3..820a4805916f 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 
 struct nvkm_alarm {
         struct list_head head;
+        struct list_head exec;
         u64 timestamp;
         void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 36268e1802b5..15a13d09d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -80,7 +80,7 @@ int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
-int nouveau_runtime_pm = -1;
+static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
 
 static struct drm_driver driver_stub;
@@ -495,7 +495,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         nouveau_fbcon_init(dev);
         nouveau_led_init(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
@@ -527,7 +527,7 @@ nouveau_drm_unload(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_get_sync(dev->dev);
                 pm_runtime_forbid(dev->dev);
         }
@@ -726,6 +726,14 @@ nouveau_pmops_thaw(struct device *dev)
         return nouveau_do_resume(drm_dev, false);
 }
 
+bool
+nouveau_pmops_runtime()
+{
+        if (nouveau_runtime_pm == -1)
+                return nouveau_is_optimus() || nouveau_is_v1_dsm();
+        return nouveau_runtime_pm == 1;
+}
+
 static int
 nouveau_pmops_runtime_suspend(struct device *dev)
 {
@@ -733,14 +741,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
         struct drm_device *drm_dev = pci_get_drvdata(pdev);
         int ret;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
@@ -765,8 +766,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
         struct nvif_device *device = &nouveau_drm(drm_dev)->client.device;
         int ret;
 
-        if (nouveau_runtime_pm == 0)
-                return -EINVAL;
+        if (!nouveau_pmops_runtime()) {
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
@@ -796,14 +799,7 @@ nouveau_pmops_runtime_idle(struct device *dev)
         struct nouveau_drm *drm = nouveau_drm(drm_dev);
         struct drm_crtc *crtc;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index eadec2f49ad3..a11b6aaed325 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -108,8 +108,6 @@ nouveau_cli(struct drm_file *fpriv)
 #include <nvif/object.h>
 #include <nvif/device.h>
 
-extern int nouveau_runtime_pm;
-
 struct nouveau_drm {
         struct nouveau_cli client;
         struct drm_device *dev;
@@ -195,6 +193,7 @@ nouveau_drm(struct drm_device *dev)
 
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
+bool nouveau_pmops_runtime(void);
 
 #include <nvkm/core/tegra.h>
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index a4aacbc0cec8..02fe0efb9e16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -87,7 +87,7 @@ void
 nouveau_vga_init(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         /* only relevant for PCI devices */
         if (!dev->pdev)
@@ -99,10 +99,6 @@ nouveau_vga_init(struct nouveau_drm *drm)
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
         vga_switcheroo_register_client(dev->pdev, &nouveau_switcheroo_ops, runtime);
 
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
@@ -113,18 +109,13 @@ void
 nouveau_vga_fini(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         vga_client_register(dev->pdev, NULL, NULL, NULL);
 
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
-
         vga_switcheroo_unregister_client(dev->pdev);
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
                 vga_switcheroo_fini_domain_pm_ops(drm->dev->dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a7663249b3ba..06e564a9ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -2107,7 +2107,8 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
                                         asyc->set.dither = true;
                         }
                 } else {
-                        asyc->set.mask = ~0;
+                        if (asyc)
+                                asyc->set.mask = ~0;
                         asyh->set.mask = ~0;
                 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index f2a86eae0a0d..2437f7d41ca2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
                 /* Move to completed list.  We'll drop the lock before
                  * executing the callback so it can reschedule itself.
                  */
-                list_move_tail(&alarm->head, &exec);
+                list_del_init(&alarm->head);
+                list_add(&alarm->exec, &exec);
         }
 
         /* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
         spin_unlock_irqrestore(&tmr->lock, flags);
 
         /* Execute completed callbacks. */
-        list_for_each_entry_safe(alarm, atemp, &exec, head) {
-                list_del_init(&alarm->head);
+        list_for_each_entry_safe(alarm, atemp, &exec, exec) {
+                list_del(&alarm->exec);
                 alarm->func(alarm);
         }
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 058340a002c2..4a340efd8ba6 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -575,8 +575,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
         if (ret)
                 return;
 
-        cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
-
         if (fb != old_state->fb) {
                 obj = to_qxl_framebuffer(fb)->obj;
                 user_bo = gem_to_qxl_bo(obj);
@@ -614,6 +612,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 qxl_bo_kunmap(cursor_bo);
                 qxl_bo_kunmap(user_bo);
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->u.set.visible = 1;
                 cmd->u.set.shape = qxl_bo_physical_address(qdev,
                                                            cursor_bo, 0);
@@ -624,6 +623,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 if (ret)
                         goto out_free_release;
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->type = QXL_CURSOR_MOVE;
         }
 
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 7ba450832e6b..ea36dc4dd5d2 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev)
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
         u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+        * blanking period would allow it
+        */
+        if (r600_dpm_get_vrefresh(rdev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index ccebe0f8d2e1..ca44233ceacc 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7401,7 +7401,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -7431,7 +7431,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -9267,8 +9267,11 @@ static void dce8_program_watermarks(struct radeon_device *rdev,
         u32 tmp, wm_mask;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if ((rdev->pm.pm_method == PM_METHOD_DPM) &&
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f130ec41ee4b..534637203e70 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2266,8 +2266,11 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
                 dram_channels = evergreen_get_number_of_dram_channels(rdev);
@@ -4927,7 +4930,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -4958,7 +4961,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0a085176e79b..e06e2d8feab3 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3988,7 +3988,7 @@ static void r600_irq_ack(struct radeon_device *rdev)
                         WREG32(DC_HPD5_INT_CONTROL, tmp);
                 }
                 if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-                        tmp = RREG32(DC_HPD5_INT_CONTROL);
+                        tmp = RREG32(DC_HPD6_INT_CONTROL);
                         tmp |= DC_HPDx_INT_ACK;
                         WREG32(DC_HPD6_INT_CONTROL, tmp);
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 432480ff9d22..3178ba0c537c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3393,6 +3393,13 @@ void radeon_combios_asic_init(struct drm_device *dev)
             rdev->pdev->subsystem_vendor == 0x103c &&
             rdev->pdev->subsystem_device == 0x280a)
                 return;
+        /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS400 &&
+            rdev->pdev->subsystem_vendor == 0x1179 &&
+            rdev->pdev->subsystem_device == 0xff31)
+                return;
 
         /* DYN CLK 1 */
         table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 6ecf42783d4b..0a6444d72000 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -136,6 +136,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = {
          * https://bugzilla.kernel.org/show_bug.cgi?id=51381
          */
         { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
+        /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
+         * https://bugs.freedesktop.org/show_bug.cgi?id=101491
+         */
+        { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
         /* macbook pro 8.2 */
         { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP },
         { 0, 0, 0, 0, 0 },
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index e3e7cb1d10a2..4761f27f2ca2 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -116,7 +116,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         if ((radeon_runtime_pm != 0) &&
             radeon_has_atpx() &&
             ((flags & RADEON_IS_IGP) == 0) &&
-            !pci_is_thunderbolt_attached(rdev->pdev))
+            !pci_is_thunderbolt_attached(dev->pdev))
                 flags |= RADEON_IS_PX;
 
         /* radeon_device_init should report only fatal error
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 7431eb4a11b7..d34d1cf33895 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -621,7 +621,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
         }
 
         /* TODO: is this still necessary on NI+ ? */
-        if ((cmd == 0 || cmd == 1 || cmd == 0x3) &&
+        if ((cmd == 0 || cmd == 0x3) &&
             (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                 DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                           start, end);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ceee87f029d9..5303f25d5280 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2284,8 +2284,11 @@ static void dce6_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
@@ -6317,7 +6320,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -6348,7 +6351,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index d8fa7a9c9240..ce5f2d1f9994 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -245,8 +245,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
                                       struct drm_connector_state *conn_state)
 {
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc_state);
-        struct rockchip_dp_device *dp = to_dp(encoder);
-        int ret;
 
         /*
          * The hardware IC designed that VOP must output the RGB10 video
@@ -258,16 +256,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
 
         s->output_mode = ROCKCHIP_OUT_MODE_AAAA;
         s->output_type = DRM_MODE_CONNECTOR_eDP;
-        if (dp->data->chip_type == RK3399_EDP) {
-                /*
-                 * For RK3399, VOP Lit must code the out mode to RGB888,
-                 * VOP Big must code the out mode to RGB10.
-                 */
-                ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node,
-                                                        encoder);
-                if (ret > 0)
-                        s->output_mode = ROCKCHIP_OUT_MODE_P888;
-        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index a2169dd3d26b..14fa1f8351e8 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -615,7 +615,6 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 {
         struct cdn_dp_device *dp = encoder_to_dp(encoder);
         int ret, val;
-        struct rockchip_crtc_state *state;
 
         ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node, encoder);
         if (ret < 0) {
@@ -625,14 +624,10 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEV_DEBUG_KMS(dp->dev, "vop %s output to cdn-dp\n",
                           (ret) ? "LIT" : "BIG");
-        state = to_rockchip_crtc_state(encoder->crtc->state);
-        if (ret) {
+        if (ret)
                 val = DP_SEL_VOP_LIT | (DP_SEL_VOP_LIT << 16);
-                state->output_mode = ROCKCHIP_OUT_MODE_P888;
-        } else {
+        else
                 val = DP_SEL_VOP_LIT << 16;
-                state->output_mode = ROCKCHIP_OUT_MODE_AAAA;
-        }
 
         ret = cdn_dp_grf_write(dp, GRF_SOC_CON9, val);
         if (ret)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 3f7a82d1e095..45589d6ce65e 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -875,6 +875,7 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 static void vop_crtc_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
+        const struct vop_data *vop_data = vop->data;
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc->state);
         struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
         u16 hsync_len = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
@@ -967,6 +968,13 @@ static void vop_crtc_enable(struct drm_crtc *crtc)
                 DRM_DEV_ERROR(vop->dev, "unsupported connector_type [%d]\n",
                               s->output_type);
         }
+
+        /*
+         * if vop is not support RGB10 output, need force RGB10 to RGB888.
+         */
+        if (s->output_mode == ROCKCHIP_OUT_MODE_AAAA &&
+            !(vop_data->feature & VOP_FEATURE_OUTPUT_RGB10))
+                s->output_mode = ROCKCHIP_OUT_MODE_P888;
         VOP_CTRL_SET(vop, out_mode, s->output_mode);
 
         VOP_CTRL_SET(vop, htotal_pw, (htotal << 16) | hsync_len);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 5a4faa85dbd2..9979fd0c2282 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -142,6 +142,9 @@ struct vop_data {
         const struct vop_intr *intr;
         const struct vop_win_data *win;
         unsigned int win_size;
+
+#define VOP_FEATURE_OUTPUT_RGB10        BIT(0)
+        u64 feature;
 };
 
 /* interrupt define */
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 0da44442aab0..bafd698a28b1 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -275,6 +275,7 @@ static const struct vop_intr rk3288_vop_intr = {
 static const struct vop_data rk3288_vop = {
         .init_table = rk3288_init_reg_table,
         .table_size = ARRAY_SIZE(rk3288_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3288_vop_intr,
         .ctrl = &rk3288_ctrl_data,
         .win = rk3288_vop_win_data,
@@ -343,6 +344,7 @@ static const struct vop_reg_data rk3399_init_reg_table[] = {
 static const struct vop_data rk3399_vop_big = {
         .init_table = rk3399_init_reg_table,
         .table_size = ARRAY_SIZE(rk3399_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3399_vop_intr,
         .ctrl = &rk3399_ctrl_data,
         /*
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 9a1e34e48f64..81f86a67c10d 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -451,18 +451,6 @@ fail:
 
 
 #ifdef CONFIG_DRM_TEGRA_STAGING
-static struct tegra_drm_context *
-tegra_drm_file_get_context(struct tegra_drm_file *file, u32 id)
-{
-        struct tegra_drm_context *context;
-
-        mutex_lock(&file->lock);
-        context = idr_find(&file->contexts, id);
-        mutex_unlock(&file->lock);
-
-        return context;
-}
-
 static int tegra_gem_create(struct drm_device *drm, void *data,
                             struct drm_file *file)
 {
@@ -551,7 +539,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
         if (err < 0)
                 return err;
 
-        err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
+        err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
         if (err < 0) {
                 client->ops->close_channel(context);
                 return err;
@@ -606,7 +594,7 @@ static int tegra_close_channel(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -EINVAL;
                 goto unlock;
@@ -631,7 +619,7 @@ static int tegra_get_syncpt(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -660,7 +648,7 @@ static int tegra_submit(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -685,7 +673,7 @@ static int tegra_get_syncpt_base(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index 13db8a2851ed..1f013d45c9e9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -321,6 +321,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man)
         list_for_each_entry_safe(entry, next, &man->list, head)
                 vmw_cmdbuf_res_free(man, entry);
 
+        drm_ht_remove(&man->resources);
         kfree(man);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 130d51c5ec6a..4b948fba9eec 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -41,9 +41,9 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20170221"
+#define VMWGFX_DRIVER_DATE "20170607"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 12
+#define VMWGFX_DRIVER_MINOR 13
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
                                 return fifo_state->static_buffer;
                         else {
                                 fifo_state->dynamic_buffer = vmalloc(bytes);
+                                if (!fifo_state->dynamic_buffer)
+                                        goto out_err;
                                 return fifo_state->dynamic_buffer;
                         }
                 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ef9f3a2a4030..1d2db5d912b0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -274,108 +274,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 }
 
 
-
-/**
- * vmw_du_cursor_plane_update() - Update cursor image and location
- *
- * @plane: plane object to update
- * @crtc: owning CRTC of @plane
- * @fb: framebuffer to flip onto plane
- * @crtc_x: x offset of plane on crtc
- * @crtc_y: y offset of plane on crtc
- * @crtc_w: width of plane rectangle on crtc
- * @crtc_h: height of plane rectangle on crtc
- * @src_x: Not used
- * @src_y: Not used
- * @src_w: Not used
- * @src_h: Not used
- *
- *
- * RETURNS:
- * Zero on success, error code on failure
- */
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h)
-{
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-        struct vmw_surface *surface = NULL;
-        struct vmw_dma_buffer *dmabuf = NULL;
-        s32 hotspot_x, hotspot_y;
-        int ret;
-
-        hotspot_x = du->hotspot_x + fb->hot_x;
-        hotspot_y = du->hotspot_y + fb->hot_y;
-
-        /* A lot of the code assumes this */
-        if (crtc_w != 64 || crtc_h != 64) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (vmw_framebuffer_to_vfb(fb)->dmabuf)
-                dmabuf = vmw_framebuffer_to_vfbd(fb)->buffer;
-        else
-                surface = vmw_framebuffer_to_vfbs(fb)->surface;
-
-        if (surface && !surface->snooper.image) {
-                DRM_ERROR("surface not suitable for cursor\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* setup new image */
-        ret = 0;
-        if (surface) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_surface = surface;
-
-                du->cursor_age = du->cursor_surface->snooper.age;
-
-                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                              64, 64, hotspot_x, hotspot_y);
-        } else if (dmabuf) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_dmabuf = dmabuf;
-
-                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, crtc_w, crtc_h,
-                                               hotspot_x, hotspot_y);
-        } else {
-                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                goto out;
-        }
-
-        if (!ret) {
-                du->cursor_x = crtc_x + du->set_gui_x;
-                du->cursor_y = crtc_y + du->set_gui_y;
-
-                vmw_cursor_update_position(dev_priv, true,
-                                           du->cursor_x + hotspot_x,
-                                           du->cursor_y + hotspot_y);
-        }
-
-out:
-        return ret;
-}
-
-
-int vmw_du_cursor_plane_disable(struct drm_plane *plane)
-{
-        if (plane->fb) {
-                drm_framebuffer_unreference(plane->fb);
-                plane->fb = NULL;
-        }
-
-        return -EINVAL;
-}
-
-
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane)
 {
         vmw_cursor_update_position(plane->dev->dev_private, false, 0, 0);
@@ -473,18 +371,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 
 
 void
-vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                   struct drm_plane_state *old_state)
-{
-        struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-
-        drm_atomic_set_fb_for_plane(plane->state, NULL);
-        vmw_cursor_update_position(dev_priv, false, 0, 0);
-}
-
-
-void
 vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                   struct drm_plane_state *old_state)
 {
@@ -1498,6 +1384,7 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
          */
         if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
             dmabuf && only_2d &&
+            mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
             dev_priv->active_display_unit == vmw_du_screen_target) {
                 ret = vmw_create_dmabuf_proxy(dev_priv->dev, mode_cmd,
                                               dmabuf, &surface);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 13f2f1d2818a..5f8d678ae675 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -256,10 +256,6 @@ int vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                            u16 *r, u16 *g, u16 *b,
                            uint32_t size,
                            struct drm_modeset_acquire_ctx *ctx);
-int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                            uint32_t handle, uint32_t width, uint32_t height,
-                            int32_t hot_x, int32_t hot_y);
-int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_set_property(struct drm_connector *connector,
                                   struct drm_property *property,
                                   uint64_t val);
@@ -339,15 +335,6 @@ void vmw_kms_create_implicit_placement_property(struct vmw_private *dev_priv,
 /* Universal Plane Helpers */
 void vmw_du_primary_plane_destroy(struct drm_plane *plane);
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane);
-int vmw_du_cursor_plane_disable(struct drm_plane *plane);
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h);
 
 /* Atomic Helpers */
 int vmw_du_primary_plane_atomic_check(struct drm_plane *plane,
@@ -356,8 +343,6 @@ int vmw_du_cursor_plane_atomic_check(struct drm_plane *plane,
                                      struct drm_plane_state *state);
 void vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                        struct drm_plane_state *old_state);
-void vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                        struct drm_plane_state *old_state);
 int vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
                                    struct drm_plane_state *new_state);
 void vmw_du_plane_cleanup_fb(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index bad31bdf09b6..50be1f034f9e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -56,6 +56,8 @@ enum stdu_content_type {
  * @right: Right side of bounding box.
  * @top: Top side of bounding box.
  * @bottom: Bottom side of bounding box.
+ * @fb_left: Left side of the framebuffer/content bounding box
+ * @fb_top: Top of the framebuffer/content bounding box
  * @buf: DMA buffer when DMA-ing between buffer and screen targets.
  * @sid: Surface ID when copying between surface and screen targets.
  */
@@ -63,6 +65,7 @@ struct vmw_stdu_dirty {
         struct vmw_kms_dirty base;
         SVGA3dTransferType  transfer;
         s32 left, right, top, bottom;
+        s32 fb_left, fb_top;
         u32 pitch;
         union {
                 struct vmw_dma_buffer *buf;
@@ -647,7 +650,7 @@ static void vmw_stdu_dmabuf_fifo_commit(struct vmw_kms_dirty *dirty)
  *
  * @dirty: The closure structure.
  *
- * This function calculates the bounding box for all the incoming clips
+ * This function calculates the bounding box for all the incoming clips.
  */
 static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 {
@@ -656,11 +659,19 @@ static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 
         dirty->num_hits = 1;
 
-        /* Calculate bounding box */
+        /* Calculate destination bounding box */
         ddirty->left = min_t(s32, ddirty->left, dirty->unit_x1);
         ddirty->top = min_t(s32, ddirty->top, dirty->unit_y1);
         ddirty->right = max_t(s32, ddirty->right, dirty->unit_x2);
         ddirty->bottom = max_t(s32, ddirty->bottom, dirty->unit_y2);
+
+        /*
+         * Calculate content bounding box.  We only need the top-left
+         * coordinate because width and height will be the same as the
+         * destination bounding box above
+         */
+        ddirty->fb_left = min_t(s32, ddirty->fb_left, dirty->fb_x);
+        ddirty->fb_top  = min_t(s32, ddirty->fb_top, dirty->fb_y);
 }
 
 
@@ -697,11 +708,11 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
         src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
         src = ttm_kmap_obj_virtual(&stdu->host_map, &not_used);
-        src += dirty->unit_y1 * src_pitch + dirty->unit_x1 * stdu->cpp;
+        src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
         dst_pitch = ddirty->pitch;
         dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
-        dst += dirty->fb_y * dst_pitch + dirty->fb_x * stdu->cpp;
+        dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 
         /* Figure out the real direction */
@@ -760,7 +771,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         }
 
 out_cleanup:
-        ddirty->left = ddirty->top = S32_MAX;
+        ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
         ddirty->right = ddirty->bottom = S32_MIN;
 }
 
@@ -812,6 +823,7 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
                 SVGA3D_READ_HOST_VRAM;
         ddirty.left = ddirty.top = S32_MAX;
         ddirty.right = ddirty.bottom = S32_MIN;
+        ddirty.fb_left = ddirty.fb_top = S32_MAX;
         ddirty.pitch = vfb->base.pitches[0];
         ddirty.buf = buf;
         ddirty.base.fifo_commit = vmw_stdu_dmabuf_fifo_commit;
@@ -1355,6 +1367,11 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
                 DRM_ERROR("Failed to bind surface to STDU.\n");
         else
                 crtc->primary->fb = plane->state->fb;
+
+        ret = vmw_stdu_update_st(dev_priv, stdu);
+
+        if (ret)
+                DRM_ERROR("Failed to update STDU.\n");
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 7681341fe32b..6b70bd259953 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1274,11 +1274,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         int ret;
         uint32_t size;
-        uint32_t backup_handle;
+        uint32_t backup_handle = 0;
 
         if (req->multisample_count != 0)
                 return -EINVAL;
 
+        if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+                return -EINVAL;
+
         if (unlikely(vmw_user_surface_size == 0))
                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
                         128;
@@ -1314,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
                                              &res->backup,
                                              &user_srf->backup_base);
-                if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-                    res->backup_size) {
-                        DRM_ERROR("Surface backup buffer is too small.\n");
-                        vmw_dmabuf_unreference(&res->backup);
-                        ret = -EINVAL;
-                        goto out_unlock;
+                if (ret == 0) {
+                        if (res->backup->base.num_pages * PAGE_SIZE <
+                            res->backup_size) {
+                                DRM_ERROR("Surface backup buffer is too small.\n");
+                                vmw_dmabuf_unreference(&res->backup);
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        } else {
+                                backup_handle = req->buffer_handle;
+                        }
                 }
         } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1491,7 +1498,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
                                  dev_priv->stdu_max_height);
 
                 if (size.width > max_width || size.height > max_height) {
-                        DRM_ERROR("%ux%u\n, exeeds max surface size %ux%u",
+                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                   size.width, size.height,
                                   max_width, max_height);
                         return -EINVAL;
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index f05ebb14fa63..ac65f52850a6 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -172,7 +172,7 @@ static int host1x_probe(struct platform_device *pdev)
 
         host->rst = devm_reset_control_get(&pdev->dev, "host1x");
         if (IS_ERR(host->rst)) {
-                err = PTR_ERR(host->clk);
+                err = PTR_ERR(host->rst);
                 dev_err(&pdev->dev, "failed to get reset: %d\n", err);
                 return err;
         }
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 16d556816b5f..2fb5f432a54c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -725,15 +725,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi)
         spin_lock_irqsave(&ipu->lock, flags);
 
         val = ipu_cm_read(ipu, IPU_CONF);
-        if (vdi) {
+        if (vdi)
                 val |= IPU_CONF_IC_INPUT;
-        } else {
+        else
                 val &= ~IPU_CONF_IC_INPUT;
-                if (csi_id == 1)
-                        val |= IPU_CONF_CSI_SEL;
-                else
-                        val &= ~IPU_CONF_CSI_SEL;
-        }
+
+        if (csi_id == 1)
+                val |= IPU_CONF_CSI_SEL;
+        else
+                val &= ~IPU_CONF_CSI_SEL;
+
         ipu_cm_write(ipu, val, IPU_CONF);
 
         spin_unlock_irqrestore(&ipu->lock, flags);
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c55563379e2e..c35f74c83065 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -131,8 +131,6 @@ int ipu_pre_get(struct ipu_pre *pre)
         if (pre->in_use)
                 return -EBUSY;
 
-        clk_prepare_enable(pre->clk_axi);
-
         /* first get the engine out of reset and remove clock gating */
         writel(0, pre->regs + IPU_PRE_CTRL);
 
@@ -149,12 +147,7 @@ int ipu_pre_get(struct ipu_pre *pre)
 
 void ipu_pre_put(struct ipu_pre *pre)
 {
-        u32 val;
-
-        val = IPU_PRE_CTRL_SFTRST | IPU_PRE_CTRL_CLKGATE;
-        writel(val, pre->regs + IPU_PRE_CTRL);
-
-        clk_disable_unprepare(pre->clk_axi);
+        writel(IPU_PRE_CTRL_SFTRST, pre->regs + IPU_PRE_CTRL);
 
         pre->in_use = false;
 }
@@ -249,6 +242,8 @@ static int ipu_pre_probe(struct platform_device *pdev)
         if (!pre->buffer_virt)
                 return -ENOMEM;
 
+        clk_prepare_enable(pre->clk_axi);
+
         pre->dev = dev;
         platform_set_drvdata(pdev, pre);
         mutex_lock(&ipu_pre_list_mutex);
@@ -268,6 +263,8 @@ static int ipu_pre_remove(struct platform_device *pdev)
         available_pres--;
         mutex_unlock(&ipu_pre_list_mutex);
 
+        clk_disable_unprepare(pre->clk_axi);
+
         if (pre->buffer_virt)
                 gen_pool_free(pre->iram, (unsigned long)pre->buffer_virt,
                               IPU_PRE_MAX_WIDTH * IPU_PRE_NUM_SCANLINES * 4);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index fe40e5e499dd..687705c50794 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -275,10 +275,12 @@ config HID_EMS_FF
          - Trio Linker Plus II
 
 config HID_ELECOM
-        tristate "ELECOM BM084 bluetooth mouse"
+        tristate "ELECOM HID devices"
         depends on HID
         ---help---
-        Support for the ELECOM BM084 (bluetooth mouse).
+        Support for ELECOM devices:
+          - BM084 Bluetooth Mouse
+          - DEFT Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 16df6cc90235..a6268f2f7408 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -69,6 +69,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");
 #define QUIRK_IS_MULTITOUCH             BIT(3)
 #define QUIRK_NO_CONSUMER_USAGES        BIT(4)
 #define QUIRK_USE_KBD_BACKLIGHT         BIT(5)
+#define QUIRK_T100_KEYBOARD             BIT(6)
 
 #define I2C_KEYBOARD_QUIRKS                     (QUIRK_FIX_NOTEBOOK_REPORT | \
                                                  QUIRK_NO_INIT_REPORTS | \
@@ -536,6 +537,8 @@ static void asus_remove(struct hid_device *hdev)
                 drvdata->kbd_backlight->removed = true;
                 cancel_work_sync(&drvdata->kbd_backlight->work);
         }
+
+        hid_hw_stop(hdev);
 }
 
 static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -548,6 +551,12 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 hid_info(hdev, "Fixing up Asus notebook report descriptor\n");
                 rdesc[55] = 0xdd;
         }
+        if (drvdata->quirks & QUIRK_T100_KEYBOARD &&
+                 *rsize == 76 && rdesc[73] == 0x81 && rdesc[74] == 0x01) {
+                hid_info(hdev, "Fixing up Asus T100 keyb report descriptor\n");
+                rdesc[74] &= ~HID_MAIN_ITEM_CONSTANT;
+        }
+
         return rdesc;
 }
 
@@ -560,6 +569,9 @@ static const struct hid_device_id asus_devices[] = {
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2), QUIRK_USE_KBD_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+                USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD),
+          QUIRK_T100_KEYBOARD | QUIRK_NO_CONSUMER_USAGES },
         { }
 };
 MODULE_DEVICE_TABLE(hid, asus_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 37084b645785..6e040692f1d8 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -826,11 +826,35 @@ static int hid_scan_report(struct hid_device *hid)
                                  * hid-rmi should take care of them,
                                  * not hid-generic
                                  */
-                                if (IS_ENABLED(CONFIG_HID_RMI))
-                                        hid->group = HID_GROUP_RMI;
+                                hid->group = HID_GROUP_RMI;
                 break;
         }
 
+        /* fall back to generic driver in case specific driver doesn't exist */
+        switch (hid->group) {
+        case HID_GROUP_MULTITOUCH_WIN_8:
+                /* fall-through */
+        case HID_GROUP_MULTITOUCH:
+                if (!IS_ENABLED(CONFIG_HID_MULTITOUCH))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_SENSOR_HUB:
+                if (!IS_ENABLED(CONFIG_HID_SENSOR_HUB))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_RMI:
+                if (!IS_ENABLED(CONFIG_HID_RMI))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_WACOM:
+                if (!IS_ENABLED(CONFIG_HID_WACOM))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_LOGITECH_DJ_DEVICE:
+                if (!IS_ENABLED(CONFIG_HID_LOGITECH_DJ))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        }
         vfree(parser);
         return 0;
 }
@@ -1763,15 +1787,23 @@ EXPORT_SYMBOL_GPL(hid_disconnect);
  * used as a driver. See hid_scan_report().
  */
 static const struct hid_device_id hid_have_special_driver[] = {
+#if IS_ENABLED(CONFIG_HID_A4TECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACCUTOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACRUX)
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ALPS)
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLE)
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ANSI) },
@@ -1792,11 +1824,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS) },
@@ -1851,59 +1878,100 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLEIR)
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ASUS)
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD) },
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_AUREAL)
         { HID_USB_DEVICE(USB_VENDOR_ID_AUREAL, USB_DEVICE_ID_AUREAL_W01RN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BELKIN)
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BETOP_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185BFM, 0x2208) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185PC, 0x5506) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2PC, 0x1850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2BFM, 0x5500) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHERRY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHICONY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CMEDIA)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CORSAIR)
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CP2112)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CYPRESS)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+#endif
+#if IS_ENABLED(CONFIG_HID_DRAGONRISE)
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
-#if IS_ENABLED(CONFIG_HID_MAYFLASH)
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+#if IS_ENABLED(CONFIG_HID_ELECOM)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0030) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EMS_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EZKEY)
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GEMBIRD)
         { HID_USB_DEVICE(USB_VENDOR_ID_GEMBIRD, USB_DEVICE_ID_GEMBIRD_JPD_DUALFORCE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GFRM)
+        { HID_BLUETOOTH_DEVICE(0x58, 0x2000) },
+        { HID_BLUETOOTH_DEVICE(0x471, 0x2210) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GREENASIA)
         { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GT683R)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GYRATION)
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+#endif
+#if IS_ENABLED(CONFIG_HID_HOLTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
@@ -1912,12 +1980,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ICADE)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KENSINGTON)
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KEYTOUCH)
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KYE)
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
@@ -1927,21 +2000,29 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LCPOWER)
         { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
 #if IS_ENABLED(CONFIG_HID_LENOVO)
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#if IS_ENABLED(CONFIG_HID_LOGITECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1954,7 +2035,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G29_WHEEL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_F3D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG ) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FORCE3D_PRO) },
@@ -1966,17 +2046,30 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G27_WHEEL) },
-#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
-#endif
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WII_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_HIDPP)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAGICMOUSE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAYFLASH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MICROSOFT)
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
@@ -1992,9 +2085,22 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MONTEREY)
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MULTITOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WIIMOTE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTI)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTI, USB_DEVICE_ID_USB_SUN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTRIG)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2) },
@@ -2014,13 +2120,41 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ORTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PANTHERLORD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PENMOUNT)
         { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PETALYNX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PICOLCD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PLANTRONICS)
         { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRIMAX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRODIKEYS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_RMI)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
+#endif
 #if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
@@ -2048,9 +2182,21 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
 #endif
+#if IS_ENABLED(CONFIG_HID_SAMSUNG)
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SMARTJOYPLUS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SONY)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
@@ -2069,9 +2215,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SPEEDLINK)
+        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_STEELSERIES)
         { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SUNPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_THRUSTMASTER)
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323) },
@@ -2080,12 +2234,25 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb653) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TIVO)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TOPSEED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TWINHAN)
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UCLOGIC)
+        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_HUION_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
@@ -2093,20 +2260,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_YIYNOVA_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_81) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UDRAW_PS3)
+        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WALTOP)
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_12_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_Q_PAD) },
@@ -2114,19 +2278,18 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_XINMO)
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZEROPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZYDACRON)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
-
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+#endif
         { }
 };
 
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index 6e3848a8d8dd..e2c7465df69f 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -1,10 +1,8 @@
 /*
- *  HID driver for Elecom BM084 (bluetooth mouse).
- *  Removes a non-existing horizontal wheel from
- *  the HID descriptor.
- *  (This module is based on "hid-ortek".)
- *
+ *  HID driver for ELECOM devices.
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+ *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
  */
 
 /*
@@ -23,15 +21,61 @@
 static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
-                hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
-                rdesc[47] = 0x00;
+        switch (hdev->product) {
+        case USB_DEVICE_ID_ELECOM_BM084:
+                /* The BM084 Bluetooth mouse includes a non-existing horizontal
+                 * wheel in the HID descriptor. */
+                if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
+                        hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
+                        rdesc[47] = 0x00;
+                }
+                break;
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
+                /* The DEFT trackball has eight buttons, but its descriptor only
+                 * reports five, disabling the three Fn buttons on the top of
+                 * the mouse.
+                 *
+                 * Apply the following diff to the descriptor:
+                 *
+                 * Collection (Physical),              Collection (Physical),
+                 *     Report ID (1),                      Report ID (1),
+                 *     Report Count (5),           ->      Report Count (8),
+                 *     Report Size (1),                    Report Size (1),
+                 *     Usage Page (Button),                Usage Page (Button),
+                 *     Usage Minimum (01h),                Usage Minimum (01h),
+                 *     Usage Maximum (05h),        ->      Usage Maximum (08h),
+                 *     Logical Minimum (0),                Logical Minimum (0),
+                 *     Logical Maximum (1),                Logical Maximum (1),
+                 *     Input (Variable),                   Input (Variable),
+                 *     Report Count (1),           ->      Report Count (0),
+                 *     Report Size (3),                    Report Size (3),
+                 *     Input (Constant),                   Input (Constant),
+                 *     Report Size (16),                   Report Size (16),
+                 *     Report Count (2),                   Report Count (2),
+                 *     Usage Page (Desktop),               Usage Page (Desktop),
+                 *     Usage (X),                          Usage (X),
+                 *     Usage (Y),                          Usage (Y),
+                 *     Logical Minimum (-32768),           Logical Minimum (-32768),
+                 *     Logical Maximum (32767),            Logical Maximum (32767),
+                 *     Input (Variable, Relative),         Input (Variable, Relative),
+                 * End Collection,                     End Collection,
+                 */
+                if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
+                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        rdesc[13] = 8; /* Button/Variable Report Count */
+                        rdesc[21] = 8; /* Button/Variable Usage Maximum */
+                        rdesc[29] = 0; /* Button/Constant Report Count */
+                }
+                break;
         }
         return rdesc;
 }
 
 static const struct hid_device_id elecom_devices[] = {
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084)},
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 643390ba749d..4f9a3938189a 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -173,6 +173,7 @@
 #define USB_VENDOR_ID_ASUSTEK           0x0b05
 #define USB_DEVICE_ID_ASUSTEK_LCM       0x1726
 #define USB_DEVICE_ID_ASUSTEK_LCM2      0x175b
+#define USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD     0x17e0
 #define USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD      0x8585
 #define USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD      0x0101
 #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1 0x1854
@@ -318,6 +319,9 @@
 #define USB_VENDOR_ID_DELCOM            0x0fc5
 #define USB_DEVICE_ID_DELCOM_VISUAL_IND 0xb080
 
+#define USB_VENDOR_ID_DELL                              0x413c
+#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE     0x301a
+
 #define USB_VENDOR_ID_DELORME           0x1163
 #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100
 #define USB_DEVICE_ID_DELORME_EM_LT20   0x0200
@@ -358,6 +362,8 @@
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 8daa8ce64ebb..fb55fb4c39fc 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -897,6 +897,15 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
         return 0;
 }
 
+static void i2c_hid_acpi_fix_up_power(struct device *dev)
+{
+        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev;
+
+        if (handle && acpi_bus_get_device(handle, &adev) == 0)
+                acpi_device_fix_up_power(adev);
+}
+
 static const struct acpi_device_id i2c_hid_acpi_match[] = {
         {"ACPI0C50", 0 },
         {"PNP0C50", 0 },
@@ -909,6 +918,8 @@ static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
 {
         return -ENODEV;
 }
+
+static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
 #endif
 
 #ifdef CONFIG_OF
@@ -1030,6 +1041,8 @@ static int i2c_hid_probe(struct i2c_client *client,
         if (ret < 0)
                 goto err_regulator;
 
+        i2c_hid_acpi_fix_up_power(&client->dev);
+
         pm_runtime_get_noresume(&client->dev);
         pm_runtime_set_active(&client->dev);
         pm_runtime_enable(&client->dev);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 6316498b7812..a88e7c7bea0a 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -85,6 +85,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4b225fb19a16..e274c9dc32f3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1571,37 +1571,38 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
 
-        if (wacom->pen_input)
+        if (wacom->pen_input) {
                 dev_dbg(wacom->pen_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
-        else if (wacom->touch_input)
+
+                if (len == WACOM_PKGLEN_PENABLED ||
+                    data[0] == WACOM_REPORT_PENABLED)
+                        return wacom_tpc_pen(wacom);
+        }
+        else if (wacom->touch_input) {
                 dev_dbg(wacom->touch_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
 
-        switch (len) {
-        case WACOM_PKGLEN_TPC1FG:
-                return wacom_tpc_single_touch(wacom, len);
+                switch (len) {
+                case WACOM_PKGLEN_TPC1FG:
+                        return wacom_tpc_single_touch(wacom, len);
 
-        case WACOM_PKGLEN_TPC2FG:
-                return wacom_tpc_mt_touch(wacom);
+                case WACOM_PKGLEN_TPC2FG:
+                        return wacom_tpc_mt_touch(wacom);
 
-        case WACOM_PKGLEN_PENABLED:
-                return wacom_tpc_pen(wacom);
+                default:
+                        switch (data[0]) {
+                        case WACOM_REPORT_TPC1FG:
+                        case WACOM_REPORT_TPCHID:
+                        case WACOM_REPORT_TPCST:
+                        case WACOM_REPORT_TPC1FGE:
+                                return wacom_tpc_single_touch(wacom, len);
 
-        default:
-                switch (data[0]) {
-                case WACOM_REPORT_TPC1FG:
-                case WACOM_REPORT_TPCHID:
-                case WACOM_REPORT_TPCST:
-                case WACOM_REPORT_TPC1FGE:
-                        return wacom_tpc_single_touch(wacom, len);
-
-                case WACOM_REPORT_TPCMT:
-                case WACOM_REPORT_TPCMT2:
-                        return wacom_mt_touch(wacom);
+                        case WACOM_REPORT_TPCMT:
+                        case WACOM_REPORT_TPCMT2:
+                                return wacom_mt_touch(wacom);
 
-                case WACOM_REPORT_PENABLED:
-                        return wacom_tpc_pen(wacom);
+                        }
                 }
         }
 
diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c
index 26b05106f0d3..93d28c0ec8bf 100644
--- a/drivers/hsi/clients/ssi_protocol.c
+++ b/drivers/hsi/clients/ssi_protocol.c
@@ -1066,7 +1066,7 @@ static void ssip_pn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = SSIP_TXQUEUE_LEN;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 22d5eafd6815..5ef2814345ef 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -343,6 +343,7 @@ config SENSORS_ASB100
 
 config SENSORS_ASPEED
         tristate "ASPEED AST2400/AST2500 PWM and Fan tach driver"
+        select REGMAP
         help
           This driver provides support for ASPEED AST2400/AST2500 PWM
           and Fan Tacho controllers.
diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index 48403a2115be..9de13d626c68 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/errno.h>
 #include <linux/gpio/consumer.h>
 #include <linux/delay.h>
 #include <linux/hwmon.h>
@@ -494,7 +495,7 @@ static u32 aspeed_get_fan_tach_ch_measure_period(struct aspeed_pwm_tacho_data
         return clk / (clk_unit * div_h * div_l * tacho_div * tacho_unit);
 }
 
-static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
+static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
                                       u8 fan_tach_ch)
 {
         u32 raw_data, tach_div, clk_source, sec, val;
@@ -510,6 +511,9 @@ static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
         msleep(sec);
 
         regmap_read(priv->regmap, ASPEED_PTCR_RESULT, &val);
+        if (!(val & RESULT_STATUS_MASK))
+                return -ETIMEDOUT;
+
         raw_data = val & RESULT_VALUE_MASK;
         tach_div = priv->type_fan_tach_clock_division[type];
         tach_div = 0x4 << (tach_div * 2);
@@ -561,12 +565,14 @@ static ssize_t show_rpm(struct device *dev, struct device_attribute *attr,
 {
         struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
         int index = sensor_attr->index;
-        u32 rpm;
+        int rpm;
         struct aspeed_pwm_tacho_data *priv = dev_get_drvdata(dev);
 
         rpm = aspeed_get_fan_tach_ch_rpm(priv, index);
+        if (rpm < 0)
+                return rpm;
 
-        return sprintf(buf, "%u\n", rpm);
+        return sprintf(buf, "%d\n", rpm);
 }
 
 static umode_t pwm_is_visible(struct kobject *kobj,
@@ -591,24 +597,23 @@ static umode_t fan_dev_is_visible(struct kobject *kobj,
         return a->mode;
 }
 
-static SENSOR_DEVICE_ATTR(pwm0, 0644,
-                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm1, 0644,
-                        show_pwm, set_pwm, 1);
+                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm2, 0644,
-                        show_pwm, set_pwm, 2);
+                        show_pwm, set_pwm, 1);
 static SENSOR_DEVICE_ATTR(pwm3, 0644,
-                        show_pwm, set_pwm, 3);
+                        show_pwm, set_pwm, 2);
 static SENSOR_DEVICE_ATTR(pwm4, 0644,
-                        show_pwm, set_pwm, 4);
+                        show_pwm, set_pwm, 3);
 static SENSOR_DEVICE_ATTR(pwm5, 0644,
-                        show_pwm, set_pwm, 5);
+                        show_pwm, set_pwm, 4);
 static SENSOR_DEVICE_ATTR(pwm6, 0644,
-                        show_pwm, set_pwm, 6);
+                        show_pwm, set_pwm, 5);
 static SENSOR_DEVICE_ATTR(pwm7, 0644,
+                        show_pwm, set_pwm, 6);
+static SENSOR_DEVICE_ATTR(pwm8, 0644,
                         show_pwm, set_pwm, 7);
 static struct attribute *pwm_dev_attrs[] = {
-        &sensor_dev_attr_pwm0.dev_attr.attr,
         &sensor_dev_attr_pwm1.dev_attr.attr,
         &sensor_dev_attr_pwm2.dev_attr.attr,
         &sensor_dev_attr_pwm3.dev_attr.attr,
@@ -616,6 +621,7 @@ static struct attribute *pwm_dev_attrs[] = {
         &sensor_dev_attr_pwm5.dev_attr.attr,
         &sensor_dev_attr_pwm6.dev_attr.attr,
         &sensor_dev_attr_pwm7.dev_attr.attr,
+        &sensor_dev_attr_pwm8.dev_attr.attr,
         NULL,
 };
 
@@ -624,40 +630,39 @@ static const struct attribute_group pwm_dev_group = {
         .is_visible = pwm_is_visible,
 };
 
-static SENSOR_DEVICE_ATTR(fan0_input, 0444,
-                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan1_input, 0444,
-                show_rpm, NULL, 1);
+                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan2_input, 0444,
-                show_rpm, NULL, 2);
+                show_rpm, NULL, 1);
 static SENSOR_DEVICE_ATTR(fan3_input, 0444,
-                show_rpm, NULL, 3);
+                show_rpm, NULL, 2);
 static SENSOR_DEVICE_ATTR(fan4_input, 0444,
-                show_rpm, NULL, 4);
+                show_rpm, NULL, 3);
 static SENSOR_DEVICE_ATTR(fan5_input, 0444,
-                show_rpm, NULL, 5);
+                show_rpm, NULL, 4);
 static SENSOR_DEVICE_ATTR(fan6_input, 0444,
-                show_rpm, NULL, 6);
+                show_rpm, NULL, 5);
 static SENSOR_DEVICE_ATTR(fan7_input, 0444,
-                show_rpm, NULL, 7);
+                show_rpm, NULL, 6);
 static SENSOR_DEVICE_ATTR(fan8_input, 0444,
-                show_rpm, NULL, 8);
+                show_rpm, NULL, 7);
 static SENSOR_DEVICE_ATTR(fan9_input, 0444,
-                show_rpm, NULL, 9);
+                show_rpm, NULL, 8);
 static SENSOR_DEVICE_ATTR(fan10_input, 0444,
-                show_rpm, NULL, 10);
+                show_rpm, NULL, 9);
 static SENSOR_DEVICE_ATTR(fan11_input, 0444,
-                show_rpm, NULL, 11);
+                show_rpm, NULL, 10);
 static SENSOR_DEVICE_ATTR(fan12_input, 0444,
-                show_rpm, NULL, 12);
+                show_rpm, NULL, 11);
 static SENSOR_DEVICE_ATTR(fan13_input, 0444,
-                show_rpm, NULL, 13);
+                show_rpm, NULL, 12);
 static SENSOR_DEVICE_ATTR(fan14_input, 0444,
-                show_rpm, NULL, 14);
+                show_rpm, NULL, 13);
 static SENSOR_DEVICE_ATTR(fan15_input, 0444,
+                show_rpm, NULL, 14);
+static SENSOR_DEVICE_ATTR(fan16_input, 0444,
                 show_rpm, NULL, 15);
 static struct attribute *fan_dev_attrs[] = {
-        &sensor_dev_attr_fan0_input.dev_attr.attr,
         &sensor_dev_attr_fan1_input.dev_attr.attr,
         &sensor_dev_attr_fan2_input.dev_attr.attr,
         &sensor_dev_attr_fan3_input.dev_attr.attr,
@@ -673,6 +678,7 @@ static struct attribute *fan_dev_attrs[] = {
         &sensor_dev_attr_fan13_input.dev_attr.attr,
         &sensor_dev_attr_fan14_input.dev_attr.attr,
         &sensor_dev_attr_fan15_input.dev_attr.attr,
+        &sensor_dev_attr_fan16_input.dev_attr.attr,
         NULL
 };
 
@@ -802,7 +808,6 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev)
                 if (ret)
                         return ret;
         }
-        of_node_put(np);
 
         priv->groups[0] = &pwm_dev_group;
         priv->groups[1] = &fan_dev_group;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 6283b99d2b17..d1263b82d646 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -94,9 +94,9 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        u32 ss_ht = 0, fp_ht = 0, hs_ht = 0, fs_ht = 0;
         acpi_handle handle = ACPI_HANDLE(&pdev->dev);
         const struct acpi_device_id *id;
-        u32 ss_ht, fp_ht, hs_ht, fs_ht;
         struct acpi_device *adev;
         const char *uid;
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 95ed17183e73..54a47b40546f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -734,9 +734,9 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
                  * the first read operation, otherwise the first read cost
                  * one extra clock cycle.
                  */
-                temp = readb(i2c_imx->base + IMX_I2C_I2CR);
+                temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
                 temp |= I2CR_MTX;
-                writeb(temp, i2c_imx->base + IMX_I2C_I2CR);
+                imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
         }
         msgs->buf[msgs->len-1] = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
 
@@ -857,9 +857,9 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
                                  * the first read operation, otherwise the first read cost
                                  * one extra clock cycle.
                                  */
-                                temp = readb(i2c_imx->base + IMX_I2C_I2CR);
+                                temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
                                 temp |= I2CR_MTX;
-                                writeb(temp, i2c_imx->base + IMX_I2C_I2CR);
+                                imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
                         }
                 } else if (i == (msgs->len - 2)) {
                         dev_dbg(&i2c_imx->adapter.dev,
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index f573448d2132..e98e44e584a4 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -584,7 +584,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
 
         /* unmap the data buffer */
         if (dma_size != 0)
-                dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
+                dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
 
         if (unlikely(!time_left)) {
                 dev_err(dev, "completion wait timed out\n");
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 214bf2835d1f..8be3e6cb8fe6 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -319,7 +319,7 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         rcar_i2c_write(priv, ICFBSCR, TCYC06);
 
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
-                         priv->msg->len, priv->dma_direction);
+                         sg_dma_len(&priv->sg), priv->dma_direction);
 
         priv->dma_direction = DMA_NONE;
 }
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 0ed77eeff31e..a2e3dd715380 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
                     int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmalloc(len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
-                               USB_DIR_IN, value, index, data, len, 2000);
+                               USB_DIR_IN, value, index, dmadata, len, 2000);
+
+        memcpy(data, dmadata, len);
+        kfree(dmadata);
+        return ret;
 }
 
 static int usb_write(struct i2c_adapter *adapter, int cmd,
                      int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmemdup(data, len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, index, data, len, 2000);
+                               value, index, dmadata, len, 2000);
+
+        kfree(dmadata);
+        return ret;
 }
 
 static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
diff --git a/drivers/iio/adc/bcm_iproc_adc.c b/drivers/iio/adc/bcm_iproc_adc.c
index 21d38c8af21e..7f4f9c4150e3 100644
--- a/drivers/iio/adc/bcm_iproc_adc.c
+++ b/drivers/iio/adc/bcm_iproc_adc.c
@@ -143,7 +143,7 @@ static void iproc_adc_reg_dump(struct iio_dev *indio_dev)
         iproc_adc_dbg_reg(dev, adc_priv, IPROC_SOFT_BYPASS_DATA);
 }
 
-static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
 {
         u32 channel_intr_status;
         u32 intr_status;
@@ -167,7 +167,7 @@ static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
         return IRQ_NONE;
 }
 
-static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
 {
         irqreturn_t retval = IRQ_NONE;
         struct iproc_adc_priv *adc_priv;
@@ -181,7 +181,7 @@ static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
         adc_priv = iio_priv(indio_dev);
 
         regmap_read(adc_priv->regmap, IPROC_INTERRUPT_STATUS, &intr_status);
-        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_thread(),INTRPT_STS:%x\n",
+        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_handler(),INTRPT_STS:%x\n",
                         intr_status);
 
         intr_channels = (intr_status & IPROC_ADC_INTR_MASK) >> IPROC_ADC_INTR;
@@ -566,8 +566,8 @@ static int iproc_adc_probe(struct platform_device *pdev)
         }
 
         ret = devm_request_threaded_irq(&pdev->dev, adc_priv->irqno,
-                                iproc_adc_interrupt_thread,
                                 iproc_adc_interrupt_handler,
+                                iproc_adc_interrupt_thread,
                                 IRQF_SHARED, "iproc-adc", indio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq error %d\n", ret);
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index ec82106480e1..b0526e4b9530 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -438,10 +438,10 @@ static ssize_t max9611_shunt_resistor_show(struct device *dev,
         struct max9611_dev *max9611 = iio_priv(dev_to_iio_dev(dev));
         unsigned int i, r;
 
-        i = max9611->shunt_resistor_uohm / 1000;
-        r = max9611->shunt_resistor_uohm % 1000;
+        i = max9611->shunt_resistor_uohm / 1000000;
+        r = max9611->shunt_resistor_uohm % 1000000;
 
-        return sprintf(buf, "%u.%03u\n", i, r);
+        return sprintf(buf, "%u.%06u\n", i, r);
 }
 
 static IIO_DEVICE_ATTR(in_power_shunt_resistor, 0444,
@@ -536,8 +536,8 @@ static int max9611_probe(struct i2c_client *client,
         int ret;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*max9611));
-        if (IS_ERR(indio_dev))
-                return PTR_ERR(indio_dev);
+        if (!indio_dev)
+                return -ENOMEM;
 
         i2c_set_clientdata(client, indio_dev);
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index dd4190b50df6..6066bbfc42fe 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -468,13 +468,13 @@ static void meson_sar_adc_unlock(struct iio_dev *indio_dev)
 static void meson_sar_adc_clear_fifo(struct iio_dev *indio_dev)
 {
         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
-        int count;
+        unsigned int count, tmp;
 
         for (count = 0; count < MESON_SAR_ADC_MAX_FIFO_SIZE; count++) {
                 if (!meson_sar_adc_get_fifo_count(indio_dev))
                         break;
 
-                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, 0);
+                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, &tmp);
         }
 }
 
diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
index b0c7d8ee5cb8..6888167ca1e6 100644
--- a/drivers/iio/adc/mxs-lradc-adc.c
+++ b/drivers/iio/adc/mxs-lradc-adc.c
@@ -718,9 +718,12 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev)
         adc->dev = dev;
 
         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!iores)
+                return -EINVAL;
+
         adc->base = devm_ioremap(dev, iores->start, resource_size(iores));
-        if (IS_ERR(adc->base))
-                return PTR_ERR(adc->base);
+        if (!adc->base)
+                return -ENOMEM;
 
         init_completion(&adc->completion);
         spin_lock_init(&adc->lock);
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index b23527309088..81d4c39e414a 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -105,6 +105,8 @@ struct sun4i_gpadc_iio {
         bool                            no_irq;
         /* prevents concurrent reads of temperature and ADC */
         struct mutex                    mutex;
+        struct thermal_zone_device      *tzd;
+        struct device                   *sensor_device;
 };
 
 #define SUN4I_GPADC_ADC_CHANNEL(_channel, _name) {              \
@@ -502,7 +504,6 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
 {
         struct sun4i_gpadc_iio *info = iio_priv(indio_dev);
         const struct of_device_id *of_dev;
-        struct thermal_zone_device *tzd;
         struct resource *mem;
         void __iomem *base;
         int ret;
@@ -532,13 +533,14 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
         if (!IS_ENABLED(CONFIG_THERMAL_OF))
                 return 0;
 
-        tzd = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, info,
-                                                   &sun4i_ts_tz_ops);
-        if (IS_ERR(tzd))
+        info->sensor_device = &pdev->dev;
+        info->tzd = thermal_zone_of_sensor_register(info->sensor_device, 0,
+                                                    info, &sun4i_ts_tz_ops);
+        if (IS_ERR(info->tzd))
                 dev_err(&pdev->dev, "could not register thermal sensor: %ld\n",
-                        PTR_ERR(tzd));
+                        PTR_ERR(info->tzd));
 
-        return PTR_ERR_OR_ZERO(tzd);
+        return PTR_ERR_OR_ZERO(info->tzd);
 }
 
 static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
@@ -584,15 +586,15 @@ static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
                  * of_node, and the device from this driver as third argument to
                  * return the temperature.
                  */
-                struct thermal_zone_device *tzd;
-                tzd = devm_thermal_zone_of_sensor_register(pdev->dev.parent, 0,
-                                                           info,
-                                                           &sun4i_ts_tz_ops);
-                if (IS_ERR(tzd)) {
+                info->sensor_device = pdev->dev.parent;
+                info->tzd = thermal_zone_of_sensor_register(info->sensor_device,
+                                                            0, info,
+                                                            &sun4i_ts_tz_ops);
+                if (IS_ERR(info->tzd)) {
                         dev_err(&pdev->dev,
                                 "could not register thermal sensor: %ld\n",
-                                PTR_ERR(tzd));
-                        return PTR_ERR(tzd);
+                                PTR_ERR(info->tzd));
+                        return PTR_ERR(info->tzd);
                 }
         } else {
                 indio_dev->num_channels =
@@ -688,7 +690,13 @@ static int sun4i_gpadc_remove(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        if (!info->no_irq && IS_ENABLED(CONFIG_THERMAL_OF))
+
+        if (!IS_ENABLED(CONFIG_THERMAL_OF))
+                return 0;
+
+        thermal_zone_of_sensor_unregister(info->sensor_device, info->tzd);
+
+        if (!info->no_irq)
                 iio_map_array_unregister(indio_dev);
 
         return 0;
@@ -700,6 +708,7 @@ static const struct platform_device_id sun4i_gpadc_id[] = {
         { "sun6i-a31-gpadc-iio", (kernel_ulong_t)&sun6i_gpadc_data },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(platform, sun4i_gpadc_id);
 
 static struct platform_driver sun4i_gpadc_driver = {
         .driver = {
@@ -711,6 +720,7 @@ static struct platform_driver sun4i_gpadc_driver = {
         .probe = sun4i_gpadc_probe,
         .remove = sun4i_gpadc_remove,
 };
+MODULE_DEVICE_TABLE(of, sun4i_gpadc_of_id);
 
 module_platform_driver(sun4i_gpadc_driver);
 
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 4282ceca3d8f..6cbed7eb118a 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
+        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
         if (indio_dev == NULL) {
                 dev_err(&pdev->dev, "failed to allocate iio device\n");
                 return -ENOMEM;
diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c
index dd99d273bae9..ff03324dee13 100644
--- a/drivers/iio/buffer/industrialio-buffer-dma.c
+++ b/drivers/iio/buffer/industrialio-buffer-dma.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/dma-mapping.h>
 #include <linux/sizes.h>
diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
index 9fabed47053d..2b5a320f42c5 100644
--- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c
+++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
@@ -14,6 +14,7 @@
 
 #include <linux/iio/iio.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/iio/buffer-dmaengine.h>
 
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 96dabbd2f004..88a7c5d4e4d2 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -41,6 +41,7 @@ static const int accel_scale[] = {598, 1196, 2392, 4785};
 static const struct inv_mpu6050_reg_map reg_set_6500 = {
         .sample_rate_div        = INV_MPU6050_REG_SAMPLE_RATE_DIV,
         .lpf                    = INV_MPU6050_REG_CONFIG,
+        .accel_lpf              = INV_MPU6500_REG_ACCEL_CONFIG_2,
         .user_ctrl              = INV_MPU6050_REG_USER_CTRL,
         .fifo_en                = INV_MPU6050_REG_FIFO_EN,
         .gyro_config            = INV_MPU6050_REG_GYRO_CONFIG,
@@ -211,6 +212,37 @@ int inv_mpu6050_set_power_itg(struct inv_mpu6050_state *st, bool power_on)
 EXPORT_SYMBOL_GPL(inv_mpu6050_set_power_itg);
 
 /**
+ *  inv_mpu6050_set_lpf_regs() - set low pass filter registers, chip dependent
+ *
+ *  MPU60xx/MPU9150 use only 1 register for accelerometer + gyroscope
+ *  MPU6500 and above have a dedicated register for accelerometer
+ */
+static int inv_mpu6050_set_lpf_regs(struct inv_mpu6050_state *st,
+                                    enum inv_mpu6050_filter_e val)
+{
+        int result;
+
+        result = regmap_write(st->map, st->reg->lpf, val);
+        if (result)
+                return result;
+
+        switch (st->chip_type) {
+        case INV_MPU6050:
+        case INV_MPU6000:
+        case INV_MPU9150:
+                /* old chips, nothing to do */
+                result = 0;
+                break;
+        default:
+                /* set accel lpf */
+                result = regmap_write(st->map, st->reg->accel_lpf, val);
+                break;
+        }
+
+        return result;
+}
+
+/**
  *  inv_mpu6050_init_config() - Initialize hardware, disable FIFO.
  *
  *  Initial configuration:
@@ -233,8 +265,7 @@ static int inv_mpu6050_init_config(struct iio_dev *indio_dev)
         if (result)
                 return result;
 
-        d = INV_MPU6050_FILTER_20HZ;
-        result = regmap_write(st->map, st->reg->lpf, d);
+        result = inv_mpu6050_set_lpf_regs(st, INV_MPU6050_FILTER_20HZ);
         if (result)
                 return result;
 
@@ -537,6 +568,8 @@ error_write_raw:
  *                  would be alising. This function basically search for the
  *                  correct low pass parameters based on the fifo rate, e.g,
  *                  sampling frequency.
+ *
+ *  lpf is set automatically when setting sampling rate to avoid any aliases.
  */
 static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
 {
@@ -552,7 +585,7 @@ static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
         while ((h < hz[i]) && (i < ARRAY_SIZE(d) - 1))
                 i++;
         data = d[i];
-        result = regmap_write(st->map, st->reg->lpf, data);
+        result = inv_mpu6050_set_lpf_regs(st, data);
         if (result)
                 return result;
         st->chip_config.lpf = data;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
index ef13de7a2c20..953a0c09d568 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -28,6 +28,7 @@
  *  struct inv_mpu6050_reg_map - Notable registers.
  *  @sample_rate_div:   Divider applied to gyro output rate.
  *  @lpf:               Configures internal low pass filter.
+ *  @accel_lpf:         Configures accelerometer low pass filter.
  *  @user_ctrl:         Enables/resets the FIFO.
  *  @fifo_en:           Determines which data will appear in FIFO.
  *  @gyro_config:       gyro config register.
@@ -47,6 +48,7 @@
 struct inv_mpu6050_reg_map {
         u8 sample_rate_div;
         u8 lpf;
+        u8 accel_lpf;
         u8 user_ctrl;
         u8 fifo_en;
         u8 gyro_config;
@@ -188,6 +190,7 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_FIFO_THRESHOLD           500
 
 /* mpu6500 registers */
+#define INV_MPU6500_REG_ACCEL_CONFIG_2      0x1D
 #define INV_MPU6500_REG_ACCEL_OFFSET        0x77
 
 /* delay time in milliseconds */
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 978e1592c2a3..4061fed93f1f 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -451,7 +451,8 @@ static ssize_t iio_trigger_write_current(struct device *dev,
         return len;
 
 out_trigger_put:
-        iio_trigger_put(trig);
+        if (trig)
+                iio_trigger_put(trig);
         return ret;
 }
 
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index b30e0c1c6cc4..67838edd8b37 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000};
 static const struct reg_field reg_field_it =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4);
 static const struct reg_field reg_field_als_intr =
-                                REG_FIELD(LTR501_INTR, 0, 0);
-static const struct reg_field reg_field_ps_intr =
                                 REG_FIELD(LTR501_INTR, 1, 1);
+static const struct reg_field reg_field_ps_intr =
+                                REG_FIELD(LTR501_INTR, 0, 0);
 static const struct reg_field reg_field_als_rate =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2);
 static const struct reg_field reg_field_ps_rate =
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index ddf9bee89f77..aa4df0dcc8c9 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -40,9 +40,9 @@
 #define AS3935_AFE_PWR_BIT      BIT(0)
 
 #define AS3935_INT              0x03
-#define AS3935_INT_MASK         0x07
+#define AS3935_INT_MASK         0x0f
 #define AS3935_EVENT_INT        BIT(3)
-#define AS3935_NOISE_INT        BIT(1)
+#define AS3935_NOISE_INT        BIT(0)
 
 #define AS3935_DATA             0x07
 #define AS3935_DATA_MASK        0x3F
@@ -215,7 +215,7 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 
         st->buffer[0] = val & AS3935_DATA_MASK;
         iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
-                                           pf->timestamp);
+                                           iio_get_time_ns(indio_dev));
 err_read:
         iio_trigger_notify_done(indio_dev->trig);
 
@@ -244,7 +244,7 @@ static void as3935_event_work(struct work_struct *work)
 
         switch (val) {
         case AS3935_EVENT_INT:
-                iio_trigger_poll(st->trig);
+                iio_trigger_poll_chained(st->trig);
                 break;
         case AS3935_NOISE_INT:
                 dev_warn(&st->spi->dev, "noise level is too high\n");
@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private)
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-        mutex_lock(&st->lock);
-
         /* mask disturber interrupt bit */
         as3935_write(st, AS3935_INT, BIT(5));
 
@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as3935_state *st)
 
         mdelay(2);
         as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
-        mutex_unlock(&st->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -318,6 +314,8 @@ static int as3935_resume(struct device *dev)
         val &= ~AS3935_AFE_PWR_BIT;
         ret = as3935_write(st, AS3935_AFE_GAIN, val);
 
+        calibrate_as3935(st);
+
 err_resume:
         mutex_unlock(&st->lock);
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 02971e239a18..ece6926fa2e6 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -449,12 +449,7 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
                 return ret;
 
         rt = (struct rt6_info *)dst;
-        if (ipv6_addr_any(&fl6.saddr)) {
-                ret = ipv6_dev_get_saddr(addr->net, ip6_dst_idev(dst)->dev,
-                                         &fl6.daddr, 0, &fl6.saddr);
-                if (ret)
-                        goto put;
-
+        if (ipv6_addr_any(&src_in->sin6_addr)) {
                 src_in->sin6_family = AF_INET6;
                 src_in->sin6_addr = fl6.saddr;
         }
@@ -471,9 +466,6 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
 
         *pdst = dst;
         return 0;
-put:
-        dst_release(dst);
-        return ret;
 }
 #else
 static int addr6_resolve(struct sockaddr_in6 *src_in,
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 1844770f3ae8..2b4d613a3474 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1429,7 +1429,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
         primary_path->packet_life_time =
                 cm_req_get_primary_local_ack_timeout(req_msg);
         primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
-        sa_path_set_service_id(primary_path, req_msg->service_id);
+        primary_path->service_id = req_msg->service_id;
 
         if (req_msg->alt_local_lid) {
                 alt_path->dgid = req_msg->alt_local_gid;
@@ -1452,7 +1452,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
                 alt_path->packet_life_time =
                         cm_req_get_alt_local_ack_timeout(req_msg);
                 alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
-                sa_path_set_service_id(alt_path, req_msg->service_id);
+                alt_path->service_id = req_msg->service_id;
         }
 }
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 91b7a2fe5a55..31bb82d8ecd7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1140,7 +1140,7 @@ static void cma_save_ib_info(struct sockaddr *src_addr,
                         ib->sib_pkey = path->pkey;
                         ib->sib_flowinfo = path->flow_label;
                         memcpy(&ib->sib_addr, &path->sgid, 16);
-                        ib->sib_sid = sa_path_get_service_id(path);
+                        ib->sib_sid = path->service_id;
                         ib->sib_scope_id = 0;
                 } else {
                         ib->sib_pkey = listen_ib->sib_pkey;
@@ -1274,8 +1274,7 @@ static int cma_save_req_info(const struct ib_cm_event *ib_event,
                 memcpy(&req->local_gid, &req_param->primary_path->sgid,
                        sizeof(req->local_gid));
                 req->has_gid    = true;
-                req->service_id =
-                        sa_path_get_service_id(req_param->primary_path);
+                req->service_id = req_param->primary_path->service_id;
                 req->pkey       = be16_to_cpu(req_param->primary_path->pkey);
                 if (req->pkey != req_param->bth_pkey)
                         pr_warn_ratelimited("RDMA CMA: got different BTH P_Key (0x%x) and primary path P_Key (0x%x)\n"
@@ -1827,7 +1826,8 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
         struct rdma_route *rt;
         const sa_family_t ss_family = listen_id->route.addr.src_addr.ss_family;
         struct sa_path_rec *path = ib_event->param.req_rcvd.primary_path;
-        const __be64 service_id = sa_path_get_service_id(path);
+        const __be64 service_id =
+                ib_event->param.req_rcvd.primary_path->service_id;
         int ret;
 
         id = rdma_create_id(listen_id->route.addr.dev_addr.net,
@@ -2345,9 +2345,8 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
         path_rec.pkey = cpu_to_be16(ib_addr_get_pkey(dev_addr));
         path_rec.numb_path = 1;
         path_rec.reversible = 1;
-        sa_path_set_service_id(&path_rec,
-                               rdma_get_service_id(&id_priv->id,
-                                                   cma_dst_addr(id_priv)));
+        path_rec.service_id = rdma_get_service_id(&id_priv->id,
+                                                  cma_dst_addr(id_priv));
 
         comp_mask = IB_SA_PATH_REC_DGID | IB_SA_PATH_REC_SGID |
                     IB_SA_PATH_REC_PKEY | IB_SA_PATH_REC_NUMB_PATH |
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index cb7d372e4bdf..d92ab4eaa8f3 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -169,6 +169,16 @@ void ib_mad_cleanup(void);
 int ib_sa_init(void);
 void ib_sa_cleanup(void);
 
+int ibnl_init(void);
+void ibnl_cleanup(void);
+
+/**
+ * Check if there are any listeners to the netlink group
+ * @group: the netlink group ID
+ * Returns 0 on success or a negative for no listeners.
+ */
+int ibnl_chk_listeners(unsigned int group);
+
 int ib_nl_handle_resolve_resp(struct sk_buff *skb,
                               struct netlink_callback *cb);
 int ib_nl_handle_set_timeout(struct sk_buff *skb,
diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
index b784055423c8..94931c474d41 100644
--- a/drivers/infiniband/core/netlink.c
+++ b/drivers/infiniband/core/netlink.c
@@ -37,6 +37,7 @@
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <rdma/rdma_netlink.h>
+#include "core_priv.h"
 
 struct ibnl_client {
         struct list_head                list;
@@ -55,7 +56,6 @@ int ibnl_chk_listeners(unsigned int group)
                 return -1;
         return 0;
 }
-EXPORT_SYMBOL(ibnl_chk_listeners);
 
 int ibnl_add_client(int index, int nops,
                     const struct ibnl_client_cbs cb_table[])
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e335b09c022e..fb7aec4047c8 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -194,7 +194,7 @@ static u32 tid;
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field path_rec_table[] = {
-        { PATH_REC_FIELD(ib.service_id),
+        { PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -296,7 +296,7 @@ static const struct ib_field path_rec_table[] = {
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field opa_path_rec_table[] = {
-        { OPA_PATH_REC_FIELD(opa.service_id),
+        { OPA_PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -774,7 +774,7 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
 
         /* Now build the attributes */
         if (comp_mask & IB_SA_PATH_REC_SERVICE_ID) {
-                val64 = be64_to_cpu(sa_path_get_service_id(sa_rec));
+                val64 = be64_to_cpu(sa_rec->service_id);
                 nla_put(skb, RDMA_NLA_F_MANDATORY | LS_NLA_TYPE_SERVICE_ID,
                         sizeof(val64), &val64);
         }
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 3dbf811d3c51..21e60b1e2ff4 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -58,7 +58,7 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d
         for_each_sg(umem->sg_head.sgl, sg, umem->npages, i) {
 
                 page = sg_page(sg);
-                if (umem->writable && dirty)
+                if (!PageDirty(page) && umem->writable && dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 0780b1afefa9..8c4ec564e495 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -321,11 +321,15 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
                 struct vm_area_struct *vma;
                 struct hstate *h;
 
+                down_read(&mm->mmap_sem);
                 vma = find_vma(mm, ib_umem_start(umem));
-                if (!vma || !is_vm_hugetlb_page(vma))
+                if (!vma || !is_vm_hugetlb_page(vma)) {
+                        up_read(&mm->mmap_sem);
                         return -EINVAL;
+                }
                 h = hstate_vma(vma);
                 umem->page_shift = huge_page_shift(h);
+                up_read(&mm->mmap_sem);
                 umem->hugetlb = 1;
         } else {
                 umem->hugetlb = 0;
diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
index 8b9587fe2303..94fd989c9060 100644
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -96,11 +96,11 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
 
-void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
-                                struct sa_path_rec *src)
+static void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
+                                       struct sa_path_rec *src)
 {
-        memcpy(dst->dgid, src->dgid.raw, sizeof src->dgid);
-        memcpy(dst->sgid, src->sgid.raw, sizeof src->sgid);
+        memcpy(dst->dgid, src->dgid.raw, sizeof(src->dgid));
+        memcpy(dst->sgid, src->sgid.raw, sizeof(src->sgid));
 
         dst->dlid               = htons(ntohl(sa_path_get_dlid(src)));
         dst->slid               = htons(ntohl(sa_path_get_slid(src)));
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index ebf7be8d4139..08772836fded 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -56,6 +56,10 @@
 #define BNXT_RE_MAX_SRQC_COUNT          (64 * 1024)
 #define BNXT_RE_MAX_CQ_COUNT            (64 * 1024)
 
+#define BNXT_RE_UD_QP_HW_STALL          0x400000
+
+#define BNXT_RE_RQ_WQE_THRESHOLD        32
+
 struct bnxt_re_work {
         struct work_struct      work;
         unsigned long           event;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 7ba9e699d7ab..c7bd68311d0c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -61,6 +61,48 @@
 #include "ib_verbs.h"
 #include <rdma/bnxt_re-abi.h>
 
+static int __from_ib_access_flags(int iflags)
+{
+        int qflags = 0;
+
+        if (iflags & IB_ACCESS_LOCAL_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_READ)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
+        if (iflags & IB_ACCESS_REMOTE_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
+        if (iflags & IB_ACCESS_MW_BIND)
+                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
+        if (iflags & IB_ZERO_BASED)
+                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
+        if (iflags & IB_ACCESS_ON_DEMAND)
+                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
+        return qflags;
+};
+
+static enum ib_access_flags __to_ib_access_flags(int qflags)
+{
+        enum ib_access_flags iflags = 0;
+
+        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
+                iflags |= IB_ACCESS_LOCAL_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
+                iflags |= IB_ACCESS_REMOTE_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
+                iflags |= IB_ACCESS_REMOTE_READ;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
+                iflags |= IB_ACCESS_REMOTE_ATOMIC;
+        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
+                iflags |= IB_ACCESS_MW_BIND;
+        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
+                iflags |= IB_ZERO_BASED;
+        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
+                iflags |= IB_ACCESS_ON_DEMAND;
+        return iflags;
+};
+
 static int bnxt_re_build_sgl(struct ib_sge *ib_sg_list,
                              struct bnxt_qplib_sge *sg_list, int num)
 {
@@ -149,8 +191,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
         ib_attr->max_total_mcast_qp_attach = 0;
         ib_attr->max_ah = dev_attr->max_ah;
 
-        ib_attr->max_fmr = dev_attr->max_fmr;
-        ib_attr->max_map_per_fmr = 1;   /* ? */
+        ib_attr->max_fmr = 0;
+        ib_attr->max_map_per_fmr = 0;
 
         ib_attr->max_srq = dev_attr->max_srq;
         ib_attr->max_srq_wr = dev_attr->max_srq_wqes;
@@ -410,6 +452,158 @@ enum rdma_link_layer bnxt_re_get_link_layer(struct ib_device *ibdev,
         return IB_LINK_LAYER_ETHERNET;
 }
 
+#define BNXT_RE_FENCE_PBL_SIZE  DIV_ROUND_UP(BNXT_RE_FENCE_BYTES, PAGE_SIZE)
+
+static void bnxt_re_create_fence_wqe(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct ib_mr *ib_mr = &fence->mr->ib_mr;
+        struct bnxt_qplib_swqe *wqe = &fence->bind_wqe;
+
+        memset(wqe, 0, sizeof(*wqe));
+        wqe->type = BNXT_QPLIB_SWQE_TYPE_BIND_MW;
+        wqe->wr_id = BNXT_QPLIB_FENCE_WRID;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+        wqe->bind.zero_based = false;
+        wqe->bind.parent_l_key = ib_mr->lkey;
+        wqe->bind.va = (u64)(unsigned long)fence->va;
+        wqe->bind.length = fence->size;
+        wqe->bind.access_cntl = __from_ib_access_flags(IB_ACCESS_REMOTE_READ);
+        wqe->bind.mw_type = SQ_BIND_MW_TYPE_TYPE1;
+
+        /* Save the initial rkey in fence structure for now;
+         * wqe->bind.r_key will be set at (re)bind time.
+         */
+        fence->bind_rkey = ib_inc_rkey(fence->mw->rkey);
+}
+
+static int bnxt_re_bind_fence_mw(struct bnxt_qplib_qp *qplib_qp)
+{
+        struct bnxt_re_qp *qp = container_of(qplib_qp, struct bnxt_re_qp,
+                                             qplib_qp);
+        struct ib_pd *ib_pd = qp->ib_qp.pd;
+        struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_qplib_swqe *fence_wqe = &fence->bind_wqe;
+        struct bnxt_qplib_swqe wqe;
+        int rc;
+
+        memcpy(&wqe, fence_wqe, sizeof(wqe));
+        wqe.bind.r_key = fence->bind_rkey;
+        fence->bind_rkey = ib_inc_rkey(fence->bind_rkey);
+
+        dev_dbg(rdev_to_dev(qp->rdev),
+                "Posting bind fence-WQE: rkey: %#x QP: %d PD: %p\n",
+                wqe.bind.r_key, qp->qplib_qp.id, pd);
+        rc = bnxt_qplib_post_send(&qp->qplib_qp, &wqe);
+        if (rc) {
+                dev_err(rdev_to_dev(qp->rdev), "Failed to bind fence-WQE\n");
+                return rc;
+        }
+        bnxt_qplib_post_send_db(&qp->qplib_qp);
+
+        return rc;
+}
+
+static void bnxt_re_destroy_fence_mr(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = fence->mr;
+
+        if (fence->mw) {
+                bnxt_re_dealloc_mw(fence->mw);
+                fence->mw = NULL;
+        }
+        if (mr) {
+                if (mr->ib_mr.rkey)
+                        bnxt_qplib_dereg_mrw(&rdev->qplib_res, &mr->qplib_mr,
+                                             true);
+                if (mr->ib_mr.lkey)
+                        bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+                kfree(mr);
+                fence->mr = NULL;
+        }
+        if (fence->dma_addr) {
+                dma_unmap_single(dev, fence->dma_addr, BNXT_RE_FENCE_BYTES,
+                                 DMA_BIDIRECTIONAL);
+                fence->dma_addr = 0;
+        }
+}
+
+static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
+{
+        int mr_access_flags = IB_ACCESS_LOCAL_WRITE | IB_ACCESS_MW_BIND;
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = NULL;
+        dma_addr_t dma_addr = 0;
+        struct ib_mw *mw;
+        u64 pbl_tbl;
+        int rc;
+
+        dma_addr = dma_map_single(dev, fence->va, BNXT_RE_FENCE_BYTES,
+                                  DMA_BIDIRECTIONAL);
+        rc = dma_mapping_error(dev, dma_addr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to dma-map fence-MR-mem\n");
+                rc = -EIO;
+                fence->dma_addr = 0;
+                goto fail;
+        }
+        fence->dma_addr = dma_addr;
+
+        /* Allocate a MR */
+        mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+        if (!mr) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+        fence->mr = mr;
+        mr->rdev = rdev;
+        mr->qplib_mr.pd = &pd->qplib_pd;
+        mr->qplib_mr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mr->qplib_mr.flags = __from_ib_access_flags(mr_access_flags);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to alloc fence-HW-MR\n");
+                goto fail;
+        }
+
+        /* Register MR */
+        mr->ib_mr.lkey = mr->qplib_mr.lkey;
+        mr->qplib_mr.va = (u64)(unsigned long)fence->va;
+        mr->qplib_mr.total_size = BNXT_RE_FENCE_BYTES;
+        pbl_tbl = dma_addr;
+        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, &pbl_tbl,
+                               BNXT_RE_FENCE_PBL_SIZE, false);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to register fence-MR\n");
+                goto fail;
+        }
+        mr->ib_mr.rkey = mr->qplib_mr.rkey;
+
+        /* Create a fence MW only for kernel consumers */
+        mw = bnxt_re_alloc_mw(&pd->ib_pd, IB_MW_TYPE_1, NULL);
+        if (!mw) {
+                dev_err(rdev_to_dev(rdev),
+                        "Failed to create fence-MW for PD: %p\n", pd);
+                rc = -EINVAL;
+                goto fail;
+        }
+        fence->mw = mw;
+
+        bnxt_re_create_fence_wqe(pd);
+        return 0;
+
+fail:
+        bnxt_re_destroy_fence_mr(pd);
+        return rc;
+}
+
 /* Protection Domains */
 int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
 {
@@ -417,6 +611,7 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
         struct bnxt_re_dev *rdev = pd->rdev;
         int rc;
 
+        bnxt_re_destroy_fence_mr(pd);
         if (ib_pd->uobject && pd->dpi.dbr) {
                 struct ib_ucontext *ib_uctx = ib_pd->uobject->context;
                 struct bnxt_re_ucontext *ucntx;
@@ -498,6 +693,10 @@ struct ib_pd *bnxt_re_alloc_pd(struct ib_device *ibdev,
                 }
         }
 
+        if (!udata)
+                if (bnxt_re_create_fence_mr(pd))
+                        dev_warn(rdev_to_dev(rdev),
+                                 "Failed to create Fence-MR\n");
         return &pd->ib_pd;
 dbfail:
         (void)bnxt_qplib_dealloc_pd(&rdev->qplib_res, &rdev->qplib_res.pd_tbl,
@@ -849,12 +1048,16 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp
         /* Shadow QP SQ depth should be same as QP1 RQ depth */
         qp->qplib_qp.sq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.sq.max_sge = 2;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.sq.q_full_delta = 1;
 
         qp->qplib_qp.scq = qp1_qp->scq;
         qp->qplib_qp.rcq = qp1_qp->rcq;
 
         qp->qplib_qp.rq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.rq.max_sge = qp1_qp->rq.max_sge;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.rq.q_full_delta = 1;
 
         qp->qplib_qp.mtu = qp1_qp->mtu;
 
@@ -917,10 +1120,6 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.sig_type = ((qp_init_attr->sq_sig_type ==
                                   IB_SIGNAL_ALL_WR) ? true : false);
 
-        entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
-        qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
-                                        dev_attr->max_qp_wqes + 1);
-
         qp->qplib_qp.sq.max_sge = qp_init_attr->cap.max_send_sge;
         if (qp->qplib_qp.sq.max_sge > dev_attr->max_qp_sges)
                 qp->qplib_qp.sq.max_sge = dev_attr->max_qp_sges;
@@ -959,6 +1158,9 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 qp->qplib_qp.rq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
 
+                qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                qp_init_attr->cap.max_recv_wr;
+
                 qp->qplib_qp.rq.max_sge = qp_init_attr->cap.max_recv_sge;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -967,6 +1169,12 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.mtu = ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
 
         if (qp_init_attr->qp_type == IB_QPT_GSI) {
+                /* Allocate 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_init_attr->cap.max_send_wr;
                 qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -1006,6 +1214,22 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 }
 
         } else {
+                /* Allocate 128 + 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr +
+                                             BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes +
+                                                BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.q_full_delta = BNXT_QPLIB_RESERVED_QP_WRS + 1;
+
+                /*
+                 * Reserving one slot for Phantom WQE. Application can
+                 * post one extra entry in this case. But allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+
+                qp->qplib_qp.sq.q_full_delta -= 1;
+
                 qp->qplib_qp.max_rd_atomic = dev_attr->max_qp_rd_atom;
                 qp->qplib_qp.max_dest_rd_atomic = dev_attr->max_qp_init_rd_atom;
                 if (udata) {
@@ -1025,6 +1249,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
 
         qp->ib_qp.qp_num = qp->qplib_qp.id;
         spin_lock_init(&qp->sq_lock);
+        spin_lock_init(&qp->rq_lock);
 
         if (udata) {
                 struct bnxt_re_qp_resp resp;
@@ -1129,48 +1354,6 @@ static enum ib_mtu __to_ib_mtu(u32 mtu)
         }
 }
 
-static int __from_ib_access_flags(int iflags)
-{
-        int qflags = 0;
-
-        if (iflags & IB_ACCESS_LOCAL_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_READ)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
-        if (iflags & IB_ACCESS_REMOTE_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
-        if (iflags & IB_ACCESS_MW_BIND)
-                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
-        if (iflags & IB_ZERO_BASED)
-                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
-        if (iflags & IB_ACCESS_ON_DEMAND)
-                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
-        return qflags;
-};
-
-static enum ib_access_flags __to_ib_access_flags(int qflags)
-{
-        enum ib_access_flags iflags = 0;
-
-        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
-                iflags |= IB_ACCESS_LOCAL_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
-                iflags |= IB_ACCESS_REMOTE_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
-                iflags |= IB_ACCESS_REMOTE_READ;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
-                iflags |= IB_ACCESS_REMOTE_ATOMIC;
-        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
-                iflags |= IB_ACCESS_MW_BIND;
-        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
-                iflags |= IB_ZERO_BASED;
-        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
-                iflags |= IB_ACCESS_ON_DEMAND;
-        return iflags;
-};
-
 static int bnxt_re_modify_shadow_qp(struct bnxt_re_dev *rdev,
                                     struct bnxt_re_qp *qp1_qp,
                                     int qp_attr_mask)
@@ -1378,11 +1561,21 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                 entries = roundup_pow_of_two(qp_attr->cap.max_send_wr);
                 qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_attr->cap.max_send_wr;
+                /*
+                 * Reserving one slot for Phantom WQE. Some application can
+                 * post one extra entry in this case. Allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+                qp->qplib_qp.sq.q_full_delta -= 1;
                 qp->qplib_qp.sq.max_sge = qp_attr->cap.max_send_sge;
                 if (qp->qplib_qp.rq.max_wqe) {
                         entries = roundup_pow_of_two(qp_attr->cap.max_recv_wr);
                         qp->qplib_qp.rq.max_wqe =
                                 min_t(u32, entries, dev_attr->max_qp_wqes + 1);
+                        qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                       qp_attr->cap.max_recv_wr;
                         qp->qplib_qp.rq.max_sge = qp_attr->cap.max_recv_sge;
                 } else {
                         /* SRQ was used prior, just ignore the RQ caps */
@@ -1883,6 +2076,22 @@ static int bnxt_re_copy_wr_payload(struct bnxt_re_dev *rdev,
         return payload_sz;
 }
 
+static void bnxt_ud_qp_hw_stall_workaround(struct bnxt_re_qp *qp)
+{
+        if ((qp->ib_qp.qp_type == IB_QPT_UD ||
+             qp->ib_qp.qp_type == IB_QPT_GSI ||
+             qp->ib_qp.qp_type == IB_QPT_RAW_ETHERTYPE) &&
+             qp->qplib_qp.wqe_cnt == BNXT_RE_UD_QP_HW_STALL) {
+                int qp_attr_mask;
+                struct ib_qp_attr qp_attr;
+
+                qp_attr_mask = IB_QP_STATE;
+                qp_attr.qp_state = IB_QPS_RTS;
+                bnxt_re_modify_qp(&qp->ib_qp, &qp_attr, qp_attr_mask, NULL);
+                qp->qplib_qp.wqe_cnt = 0;
+        }
+}
+
 static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev,
                                        struct bnxt_re_qp *qp,
                                 struct ib_send_wr *wr)
@@ -1928,6 +2137,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
         return rc;
 }
@@ -2024,6 +2234,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
 
         return rc;
@@ -2071,7 +2282,10 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_qplib_swqe wqe;
         int rc = 0, payload_sz = 0;
+        unsigned long flags;
+        u32 count = 0;
 
+        spin_lock_irqsave(&qp->rq_lock, flags);
         while (wr) {
                 /* House keeping */
                 memset(&wqe, 0, sizeof(wqe));
@@ -2100,9 +2314,21 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
                         *bad_wr = wr;
                         break;
                 }
+
+                /* Ring DB if the RQEs posted reaches a threshold value */
+                if (++count >= BNXT_RE_RQ_WQE_THRESHOLD) {
+                        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+                        count = 0;
+                }
+
                 wr = wr->next;
         }
-        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        if (count)
+                bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        spin_unlock_irqrestore(&qp->rq_lock, flags);
+
         return rc;
 }
 
@@ -2643,12 +2869,36 @@ static void bnxt_re_process_res_ud_wc(struct ib_wc *wc,
                 wc->opcode = IB_WC_RECV_RDMA_WITH_IMM;
 }
 
+static int send_phantom_wqe(struct bnxt_re_qp *qp)
+{
+        struct bnxt_qplib_qp *lib_qp = &qp->qplib_qp;
+        unsigned long flags;
+        int rc = 0;
+
+        spin_lock_irqsave(&qp->sq_lock, flags);
+
+        rc = bnxt_re_bind_fence_mw(lib_qp);
+        if (!rc) {
+                lib_qp->sq.phantom_wqe_cnt++;
+                dev_dbg(&lib_qp->sq.hwq.pdev->dev,
+                        "qp %#x sq->prod %#x sw_prod %#x phantom_wqe_cnt %d\n",
+                        lib_qp->id, lib_qp->sq.hwq.prod,
+                        HWQ_CMP(lib_qp->sq.hwq.prod, &lib_qp->sq.hwq),
+                        lib_qp->sq.phantom_wqe_cnt);
+        }
+
+        spin_unlock_irqrestore(&qp->sq_lock, flags);
+        return rc;
+}
+
 int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
 {
         struct bnxt_re_cq *cq = container_of(ib_cq, struct bnxt_re_cq, ib_cq);
         struct bnxt_re_qp *qp;
         struct bnxt_qplib_cqe *cqe;
         int i, ncqe, budget;
+        struct bnxt_qplib_q *sq;
+        struct bnxt_qplib_qp *lib_qp;
         u32 tbl_idx;
         struct bnxt_re_sqp_entries *sqp_entry = NULL;
         unsigned long flags;
@@ -2661,7 +2911,21 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
         }
         cqe = &cq->cql[0];
         while (budget) {
-                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget);
+                lib_qp = NULL;
+                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget, &lib_qp);
+                if (lib_qp) {
+                        sq = &lib_qp->sq;
+                        if (sq->send_phantom) {
+                                qp = container_of(lib_qp,
+                                                  struct bnxt_re_qp, qplib_qp);
+                                if (send_phantom_wqe(qp) == -ENOMEM)
+                                        dev_err(rdev_to_dev(cq->rdev),
+                                                "Phantom failed! Scheduled to send again\n");
+                                else
+                                        sq->send_phantom = false;
+                        }
+                }
+
                 if (!ncqe)
                         break;
 
@@ -2822,6 +3086,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
         struct bnxt_re_dev *rdev = mr->rdev;
         int rc;
 
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+                return rc;
+        }
+
         if (mr->npages && mr->pages) {
                 rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                         &mr->qplib_frpl);
@@ -2829,8 +3099,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                 mr->npages = 0;
                 mr->pages = NULL;
         }
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-
         if (!IS_ERR_OR_NULL(mr->ib_umem))
                 ib_umem_release(mr->ib_umem);
 
@@ -2914,97 +3182,52 @@ fail:
         return ERR_PTR(rc);
 }
 
-/* Fast Memory Regions */
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *ib_pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr)
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata)
 {
         struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
         struct bnxt_re_dev *rdev = pd->rdev;
-        struct bnxt_re_fmr *fmr;
+        struct bnxt_re_mw *mw;
         int rc;
 
-        if (fmr_attr->max_pages > MAX_PBL_LVL_2_PGS ||
-            fmr_attr->max_maps > rdev->dev_attr.max_map_per_fmr) {
-                dev_err(rdev_to_dev(rdev), "Allocate FMR exceeded Max limit");
+        mw = kzalloc(sizeof(*mw), GFP_KERNEL);
+        if (!mw)
                 return ERR_PTR(-ENOMEM);
-        }
-        fmr = kzalloc(sizeof(*fmr), GFP_KERNEL);
-        if (!fmr)
-                return ERR_PTR(-ENOMEM);
-
-        fmr->rdev = rdev;
-        fmr->qplib_fmr.pd = &pd->qplib_pd;
-        fmr->qplib_fmr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mw->rdev = rdev;
+        mw->qplib_mw.pd = &pd->qplib_pd;
 
-        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
+        mw->qplib_mw.type = (type == IB_MW_TYPE_1 ?
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1 :
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Allocate MW failed!");
                 goto fail;
+        }
+        mw->ib_mw.rkey = mw->qplib_mw.rkey;
 
-        fmr->qplib_fmr.flags = __from_ib_access_flags(mr_access_flags);
-        fmr->ib_fmr.lkey = fmr->qplib_fmr.lkey;
-        fmr->ib_fmr.rkey = fmr->ib_fmr.lkey;
+        atomic_inc(&rdev->mw_count);
+        return &mw->ib_mw;
 
-        atomic_inc(&rdev->mr_count);
-        return &fmr->ib_fmr;
 fail:
-        kfree(fmr);
+        kfree(mw);
         return ERR_PTR(rc);
 }
 
-int bnxt_re_map_phys_fmr(struct ib_fmr *ib_fmr, u64 *page_list, int list_len,
-                         u64 iova)
+int bnxt_re_dealloc_mw(struct ib_mw *ib_mw)
 {
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                             ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
+        struct bnxt_re_mw *mw = container_of(ib_mw, struct bnxt_re_mw, ib_mw);
+        struct bnxt_re_dev *rdev = mw->rdev;
         int rc;
 
-        fmr->qplib_fmr.va = iova;
-        fmr->qplib_fmr.total_size = list_len * PAGE_SIZE;
-
-        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &fmr->qplib_fmr, page_list,
-                               list_len, true);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to map FMR for lkey = 0x%x!",
-                        fmr->ib_fmr.lkey);
-        return rc;
-}
-
-int bnxt_re_unmap_fmr(struct list_head *fmr_list)
-{
-        struct bnxt_re_dev *rdev;
-        struct bnxt_re_fmr *fmr;
-        struct ib_fmr *ib_fmr;
-        int rc = 0;
-
-        /* Validate each FMRs inside the fmr_list */
-        list_for_each_entry(ib_fmr, fmr_list, list) {
-                fmr = container_of(ib_fmr, struct bnxt_re_fmr, ib_fmr);
-                rdev = fmr->rdev;
-
-                if (rdev) {
-                        rc = bnxt_qplib_dereg_mrw(&rdev->qplib_res,
-                                                  &fmr->qplib_fmr, true);
-                        if (rc)
-                                break;
-                }
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Free MW failed: %#x\n", rc);
+                return rc;
         }
-        return rc;
-}
-
-int bnxt_re_dealloc_fmr(struct ib_fmr *ib_fmr)
-{
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                               ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
-        int rc;
 
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to free FMR");
-
-        kfree(fmr);
-        atomic_dec(&rdev->mr_count);
+        kfree(mw);
+        atomic_dec(&rdev->mw_count);
         return rc;
 }
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 5c3d71765454..6c160f6a5398 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -44,11 +44,23 @@ struct bnxt_re_gid_ctx {
         u32                     refcnt;
 };
 
+#define BNXT_RE_FENCE_BYTES     64
+struct bnxt_re_fence_data {
+        u32 size;
+        u8 va[BNXT_RE_FENCE_BYTES];
+        dma_addr_t dma_addr;
+        struct bnxt_re_mr *mr;
+        struct ib_mw *mw;
+        struct bnxt_qplib_swqe bind_wqe;
+        u32 bind_rkey;
+};
+
 struct bnxt_re_pd {
         struct bnxt_re_dev      *rdev;
         struct ib_pd            ib_pd;
         struct bnxt_qplib_pd    qplib_pd;
         struct bnxt_qplib_dpi   dpi;
+        struct bnxt_re_fence_data fence;
 };
 
 struct bnxt_re_ah {
@@ -62,6 +74,7 @@ struct bnxt_re_qp {
         struct bnxt_re_dev      *rdev;
         struct ib_qp            ib_qp;
         spinlock_t              sq_lock;        /* protect sq */
+        spinlock_t              rq_lock;        /* protect rq */
         struct bnxt_qplib_qp    qplib_qp;
         struct ib_umem          *sumem;
         struct ib_umem          *rumem;
@@ -181,12 +194,9 @@ int bnxt_re_map_mr_sg(struct ib_mr *ib_mr, struct scatterlist *sg, int sg_nents,
 struct ib_mr *bnxt_re_alloc_mr(struct ib_pd *ib_pd, enum ib_mr_type mr_type,
                                u32 max_num_sg);
 int bnxt_re_dereg_mr(struct ib_mr *mr);
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr);
-int bnxt_re_map_phys_fmr(struct ib_fmr *fmr, u64 *page_list, int list_len,
-                         u64 iova);
-int bnxt_re_unmap_fmr(struct list_head *fmr_list);
-int bnxt_re_dealloc_fmr(struct ib_fmr *fmr);
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata);
+int bnxt_re_dealloc_mw(struct ib_mw *mw);
 struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                   u64 virt_addr, int mr_access_flags,
                                   struct ib_udata *udata);
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 5d355401179b..1fce5e73216b 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -507,10 +507,6 @@ static int bnxt_re_register_ib(struct bnxt_re_dev *rdev)
         ibdev->dereg_mr                 = bnxt_re_dereg_mr;
         ibdev->alloc_mr                 = bnxt_re_alloc_mr;
         ibdev->map_mr_sg                = bnxt_re_map_mr_sg;
-        ibdev->alloc_fmr                = bnxt_re_alloc_fmr;
-        ibdev->map_phys_fmr             = bnxt_re_map_phys_fmr;
-        ibdev->unmap_fmr                = bnxt_re_unmap_fmr;
-        ibdev->dealloc_fmr              = bnxt_re_dealloc_fmr;
 
         ibdev->reg_user_mr              = bnxt_re_reg_user_mr;
         ibdev->alloc_ucontext           = bnxt_re_alloc_ucontext;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 43d08b5e9085..f05500bcdcf1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -284,7 +284,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_qp1 req;
-        struct creq_create_qp1_resp *resp;
+        struct creq_create_qp1_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct bnxt_qplib_q *sq = &qp->sq;
         struct bnxt_qplib_q *rq = &qp->rq;
@@ -394,31 +394,12 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp1_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: FP: CREATE_QP1 send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -442,7 +423,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct sq_send *hw_sq_send_hdr, **hw_sq_send_ptr;
         struct cmdq_create_qp req;
-        struct creq_create_qp_resp *resp;
+        struct creq_create_qp_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct sq_psn_search **psn_search_ptr;
         unsigned long int psn_search, poff = 0;
@@ -627,31 +608,12 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         }
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -769,10 +731,11 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_modify_qp req;
-        struct creq_modify_qp_resp *resp;
+        struct creq_modify_qp_resp resp;
         u16 cmd_flags = 0, pkey;
         u32 temp32[4];
         u32 bmask;
+        int rc;
 
         RCFW_CMD_PREP(req, MODIFY_QP, cmd_flags);
 
@@ -862,27 +825,10 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.vlan_pcp_vlan_dei_vlan_id = cpu_to_le16(qp->vlan_id);
 
-        resp = (struct creq_modify_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         qp->cur_qp_state = qp->state;
         return 0;
 }
@@ -891,37 +837,26 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_query_qp req;
-        struct creq_query_qp_resp *resp;
+        struct creq_query_qp_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_qp_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp32[4];
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_QP, cmd_flags);
 
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf)
+                return -ENOMEM;
+        sb = sbuf->sb;
+
         req.qp_cid = cpu_to_le32(qp->id);
         req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     (void **)&sb, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
         /* Extract the context from the side buffer */
         qp->state = sb->en_sqd_async_notify_state &
                         CREQ_QUERY_QP_RESP_SB_STATE_MASK;
@@ -976,7 +911,9 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         qp->dest_qpn = le32_to_cpu(sb->dest_qp_id);
         memcpy(qp->smac, sb->src_mac, 6);
         qp->vlan_id = le16_to_cpu(sb->vlan_pcp_vlan_dei_vlan_id);
-        return 0;
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp)
@@ -1021,34 +958,18 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_qp req;
-        struct creq_destroy_qp_resp *resp;
+        struct creq_destroy_qp_resp resp;
         unsigned long flags;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags);
 
         req.qp_cid = cpu_to_le32(qp->id);
-        resp = (struct creq_destroy_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
 
         /* Must walk the associated CQs to nullified the QP ptr */
         spin_lock_irqsave(&qp->scq->hwq.lock, flags);
@@ -1162,8 +1083,12 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((sq->hwq.prod + 1), &sq->hwq) ==
-            HWQ_CMP(sq->hwq.cons, &sq->hwq)) {
+
+        if (bnxt_qplib_queue_full(sq)) {
+                dev_err(&sq->hwq.pdev->dev,
+                        "QPLIB: prod = %#x cons = %#x qdepth = %#x delta = %#x",
+                        sq->hwq.prod, sq->hwq.cons, sq->hwq.max_elements,
+                        sq->q_full_delta);
                 rc = -ENOMEM;
                 goto done;
         }
@@ -1373,6 +1298,9 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
         }
 
         sq->hwq.prod++;
+
+        qp->wqe_cnt++;
+
 done:
         return rc;
 }
@@ -1411,8 +1339,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((rq->hwq.prod + 1), &rq->hwq) ==
-            HWQ_CMP(rq->hwq.cons, &rq->hwq)) {
+        if (bnxt_qplib_queue_full(rq)) {
                 dev_err(&rq->hwq.pdev->dev,
                         "QPLIB: FP: QP (0x%x) RQ is full!", qp->id);
                 rc = -EINVAL;
@@ -1483,7 +1410,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_cq req;
-        struct creq_create_cq_resp *resp;
+        struct creq_create_cq_resp resp;
         struct bnxt_qplib_pbl *pbl;
         u16 cmd_flags = 0;
         int rc;
@@ -1525,30 +1452,12 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
                         (cq->cnq_hw_ring_id & CMDQ_CREATE_CQ_CNQ_ID_MASK) <<
                          CMDQ_CREATE_CQ_CNQ_ID_SFT);
 
-        resp = (struct creq_create_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        cq->id = le32_to_cpu(resp->xid);
+
+        cq->id = le32_to_cpu(resp.xid);
         cq->dbr_base = res->dpi_tbl.dbr_bar_reg_iomem;
         cq->period = BNXT_QPLIB_QUEUE_START_PERIOD;
         init_waitqueue_head(&cq->waitq);
@@ -1566,33 +1475,17 @@ int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_cq req;
-        struct creq_destroy_cq_resp *resp;
+        struct creq_destroy_cq_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_CQ, cmd_flags);
 
         req.cq_cid = cpu_to_le32(cq->id);
-        resp = (struct creq_destroy_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         bnxt_qplib_free_hwq(res->pdev, &cq->hwq);
         return 0;
 }
@@ -1664,14 +1557,113 @@ static int __flush_rq(struct bnxt_qplib_q *rq, struct bnxt_qplib_qp *qp,
         return rc;
 }
 
+/* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
+ *       CQE is track from sw_cq_cons to max_element but valid only if VALID=1
+ */
+static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq,
+                     u32 cq_cons, u32 sw_sq_cons, u32 cqe_sq_cons)
+{
+        struct bnxt_qplib_q *sq = &qp->sq;
+        struct bnxt_qplib_swq *swq;
+        u32 peek_sw_cq_cons, peek_raw_cq_cons, peek_sq_cons_idx;
+        struct cq_base *peek_hwcqe, **peek_hw_cqe_ptr;
+        struct cq_req *peek_req_hwcqe;
+        struct bnxt_qplib_qp *peek_qp;
+        struct bnxt_qplib_q *peek_sq;
+        int i, rc = 0;
+
+        /* Normal mode */
+        /* Check for the psn_search marking before completing */
+        swq = &sq->swq[sw_sq_cons];
+        if (swq->psn_search &&
+            le32_to_cpu(swq->psn_search->flags_next_psn) & 0x80000000) {
+                /* Unmark */
+                swq->psn_search->flags_next_psn = cpu_to_le32
+                        (le32_to_cpu(swq->psn_search->flags_next_psn)
+                                     & ~0x80000000);
+                dev_dbg(&cq->hwq.pdev->dev,
+                        "FP: Process Req cq_cons=0x%x qp=0x%x sq cons sw=0x%x cqe=0x%x marked!\n",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                sq->condition = true;
+                sq->send_phantom = true;
+
+                /* TODO: Only ARM if the previous SQE is ARMALL */
+                bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ_ARMALL);
+
+                rc = -EAGAIN;
+                goto out;
+        }
+        if (sq->condition) {
+                /* Peek at the completions */
+                peek_raw_cq_cons = cq->hwq.cons;
+                peek_sw_cq_cons = cq_cons;
+                i = cq->hwq.max_elements;
+                while (i--) {
+                        peek_sw_cq_cons = HWQ_CMP((peek_sw_cq_cons), &cq->hwq);
+                        peek_hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
+                        peek_hwcqe = &peek_hw_cqe_ptr[CQE_PG(peek_sw_cq_cons)]
+                                                     [CQE_IDX(peek_sw_cq_cons)];
+                        /* If the next hwcqe is VALID */
+                        if (CQE_CMP_VALID(peek_hwcqe, peek_raw_cq_cons,
+                                          cq->hwq.max_elements)) {
+                                /* If the next hwcqe is a REQ */
+                                if ((peek_hwcqe->cqe_type_toggle &
+                                    CQ_BASE_CQE_TYPE_MASK) ==
+                                    CQ_BASE_CQE_TYPE_REQ) {
+                                        peek_req_hwcqe = (struct cq_req *)
+                                                         peek_hwcqe;
+                                        peek_qp = (struct bnxt_qplib_qp *)
+                                                ((unsigned long)
+                                                 le64_to_cpu
+                                                 (peek_req_hwcqe->qp_handle));
+                                        peek_sq = &peek_qp->sq;
+                                        peek_sq_cons_idx = HWQ_CMP(le16_to_cpu(
+                                                peek_req_hwcqe->sq_cons_idx) - 1
+                                                , &sq->hwq);
+                                        /* If the hwcqe's sq's wr_id matches */
+                                        if (peek_sq == sq &&
+                                            sq->swq[peek_sq_cons_idx].wr_id ==
+                                            BNXT_QPLIB_FENCE_WRID) {
+                                                /*
+                                                 *  Unbreak only if the phantom
+                                                 *  comes back
+                                                 */
+                                                dev_dbg(&cq->hwq.pdev->dev,
+                                                        "FP:Got Phantom CQE");
+                                                sq->condition = false;
+                                                sq->single = true;
+                                                rc = 0;
+                                                goto out;
+                                        }
+                                }
+                                /* Valid but not the phantom, so keep looping */
+                        } else {
+                                /* Not valid yet, just exit and wait */
+                                rc = -EINVAL;
+                                goto out;
+                        }
+                        peek_sw_cq_cons++;
+                        peek_raw_cq_cons++;
+                }
+                dev_err(&cq->hwq.pdev->dev,
+                        "Should not have come here! cq_cons=0x%x qp=0x%x sq cons sw=0x%x hw=0x%x",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                rc = -EINVAL;
+        }
+out:
+        return rc;
+}
+
 static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
                                      struct cq_req *hwcqe,
-                                     struct bnxt_qplib_cqe **pcqe, int *budget)
+                                     struct bnxt_qplib_cqe **pcqe, int *budget,
+                                     u32 cq_cons, struct bnxt_qplib_qp **lib_qp)
 {
         struct bnxt_qplib_qp *qp;
         struct bnxt_qplib_q *sq;
         struct bnxt_qplib_cqe *cqe;
-        u32 sw_cons, cqe_cons;
+        u32 sw_sq_cons, cqe_sq_cons;
+        struct bnxt_qplib_swq *swq;
         int rc = 0;
 
         qp = (struct bnxt_qplib_qp *)((unsigned long)
@@ -1683,13 +1675,13 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
         }
         sq = &qp->sq;
 
-        cqe_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
-        if (cqe_cons > sq->hwq.max_elements) {
+        cqe_sq_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
+        if (cqe_sq_cons > sq->hwq.max_elements) {
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: FP: CQ Process req reported ");
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: sq_cons_idx 0x%x which exceeded max 0x%x",
-                        cqe_cons, sq->hwq.max_elements);
+                        cqe_sq_cons, sq->hwq.max_elements);
                 return -EINVAL;
         }
         /* If we were in the middle of flushing the SQ, continue */
@@ -1698,53 +1690,74 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
 
         /* Require to walk the sq's swq to fabricate CQEs for all previously
          * signaled SWQEs due to CQE aggregation from the current sq cons
-         * to the cqe_cons
+         * to the cqe_sq_cons
          */
         cqe = *pcqe;
         while (*budget) {
-                sw_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
-                if (sw_cons == cqe_cons)
+                sw_sq_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
+                if (sw_sq_cons == cqe_sq_cons)
+                        /* Done */
                         break;
+
+                swq = &sq->swq[sw_sq_cons];
                 memset(cqe, 0, sizeof(*cqe));
                 cqe->opcode = CQ_BASE_CQE_TYPE_REQ;
                 cqe->qp_handle = (u64)(unsigned long)qp;
                 cqe->src_qp = qp->id;
-                cqe->wr_id = sq->swq[sw_cons].wr_id;
-                cqe->type = sq->swq[sw_cons].type;
+                cqe->wr_id = swq->wr_id;
+                if (cqe->wr_id == BNXT_QPLIB_FENCE_WRID)
+                        goto skip;
+                cqe->type = swq->type;
 
                 /* For the last CQE, check for status.  For errors, regardless
                  * of the request being signaled or not, it must complete with
                  * the hwcqe error status
                  */
-                if (HWQ_CMP((sw_cons + 1), &sq->hwq) == cqe_cons &&
+                if (HWQ_CMP((sw_sq_cons + 1), &sq->hwq) == cqe_sq_cons &&
                     hwcqe->status != CQ_REQ_STATUS_OK) {
                         cqe->status = hwcqe->status;
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: FP: CQ Processed Req ");
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: wr_id[%d] = 0x%llx with status 0x%x",
-                                sw_cons, cqe->wr_id, cqe->status);
+                                sw_sq_cons, cqe->wr_id, cqe->status);
                         cqe++;
                         (*budget)--;
                         sq->flush_in_progress = true;
                         /* Must block new posting of SQ and RQ */
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
+                        sq->condition = false;
+                        sq->single = false;
                 } else {
-                        if (sq->swq[sw_cons].flags &
-                            SQ_SEND_FLAGS_SIGNAL_COMP) {
+                        if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+                                /* Before we complete, do WA 9060 */
+                                if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+                                              cqe_sq_cons)) {
+                                        *lib_qp = qp;
+                                        goto out;
+                                }
                                 cqe->status = CQ_REQ_STATUS_OK;
                                 cqe++;
                                 (*budget)--;
                         }
                 }
+skip:
                 sq->hwq.cons++;
+                if (sq->single)
+                        break;
         }
+out:
         *pcqe = cqe;
-        if (!*budget && HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_cons) {
+        if (HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_sq_cons) {
                 /* Out of budget */
                 rc = -EAGAIN;
                 goto done;
         }
+        /*
+         * Back to normal completion mode only after it has completed all of
+         * the WC for this CQE
+         */
+        sq->single = false;
         if (!sq->flush_in_progress)
                 goto done;
 flush:
@@ -2074,7 +2087,7 @@ static int bnxt_qplib_cq_process_cutoff(struct bnxt_qplib_cq *cq,
 }
 
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num_cqes)
+                       int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
         struct cq_base *hw_cqe, **hw_cqe_ptr;
         unsigned long flags;
@@ -2099,7 +2112,8 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                 case CQ_BASE_CQE_TYPE_REQ:
                         rc = bnxt_qplib_cq_process_req(cq,
                                                        (struct cq_req *)hw_cqe,
-                                                       &cqe, &budget);
+                                                       &cqe, &budget,
+                                                       sw_cons, lib_qp);
                         break;
                 case CQ_BASE_CQE_TYPE_RES_RC:
                         rc = bnxt_qplib_cq_process_res_rc(cq,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index f0150f8da1e3..36b7b7db0e3f 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -88,6 +88,7 @@ struct bnxt_qplib_swq {
 
 struct bnxt_qplib_swqe {
         /* General */
+#define BNXT_QPLIB_FENCE_WRID   0x46454E43      /* "FENC" */
         u64                             wr_id;
         u8                              reqs_type;
         u8                              type;
@@ -216,9 +217,16 @@ struct bnxt_qplib_q {
         struct scatterlist              *sglist;
         u32                             nmap;
         u32                             max_wqe;
+        u16                             q_full_delta;
         u16                             max_sge;
         u32                             psn;
         bool                            flush_in_progress;
+        bool                            condition;
+        bool                            single;
+        bool                            send_phantom;
+        u32                             phantom_wqe_cnt;
+        u32                             phantom_cqe_cnt;
+        u32                             next_cq_cons;
 };
 
 struct bnxt_qplib_qp {
@@ -242,6 +250,7 @@ struct bnxt_qplib_qp {
         u8                              timeout;
         u8                              retry_cnt;
         u8                              rnr_retry;
+        u64                             wqe_cnt;
         u32                             min_rnr_timer;
         u32                             max_rd_atomic;
         u32                             max_dest_rd_atomic;
@@ -301,6 +310,13 @@ struct bnxt_qplib_qp {
         (!!((hdr)->cqe_type_toggle & CQ_BASE_TOGGLE) ==         \
            !((raw_cons) & (cp_bit)))
 
+static inline bool bnxt_qplib_queue_full(struct bnxt_qplib_q *qplib_q)
+{
+        return HWQ_CMP((qplib_q->hwq.prod + qplib_q->q_full_delta),
+                       &qplib_q->hwq) == HWQ_CMP(qplib_q->hwq.cons,
+                                                 &qplib_q->hwq);
+}
+
 struct bnxt_qplib_cqe {
         u8                              status;
         u8                              type;
@@ -432,7 +448,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
 int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num);
+                       int num, struct bnxt_qplib_qp **qp);
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 23fb7260662b..16e42754dbec 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -39,72 +39,55 @@
 #include <linux/spinlock.h>
 #include <linux/pci.h>
 #include <linux/prefetch.h>
+#include <linux/delay.h>
+
 #include "roce_hsi.h"
 #include "qplib_res.h"
 #include "qplib_rcfw.h"
 static void bnxt_qplib_service_creq(unsigned long data);
 
 /* Hardware communication channel */
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
         u16 cbit;
         int rc;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
-        if (!test_bit(cbit, rcfw->cmdq_bitmap))
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: CMD bit %d for cookie 0x%x is not set?",
-                         cbit, cookie);
-
         rc = wait_event_timeout(rcfw->waitq,
                                 !test_bit(cbit, rcfw->cmdq_bitmap),
                                 msecs_to_jiffies(RCFW_CMD_WAIT_TIME_MS));
-        if (!rc) {
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: Bono Error: timeout %d msec, msg {0x%x}\n",
-                         RCFW_CMD_WAIT_TIME_MS, cookie);
-        }
-
-        return rc;
+        return rc ? 0 : -ETIMEDOUT;
 };
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
-        u32 count = -1;
+        u32 count = RCFW_BLOCKED_CMD_WAIT_COUNT;
         u16 cbit;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (!test_bit(cbit, rcfw->cmdq_bitmap))
                 goto done;
         do {
+                mdelay(1); /* 1m sec */
                 bnxt_qplib_service_creq((unsigned long)rcfw);
         } while (test_bit(cbit, rcfw->cmdq_bitmap) && --count);
 done:
-        return count;
+        return count ? 0 : -ETIMEDOUT;
 };
 
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block)
+static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
+                          struct creq_base *resp, void *sb, u8 is_block)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_cmdqe *cmdqe, **cmdq_ptr;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_hwq *crsb = &rcfw->crsb;
-        struct bnxt_qplib_crsqe *crsqe = NULL;
-        struct bnxt_qplib_crsbe **crsb_ptr;
+        struct bnxt_qplib_crsq *crsqe;
         u32 sw_prod, cmdq_prod;
-        u8 retry_cnt = 0xFF;
-        dma_addr_t dma_addr;
         unsigned long flags;
         u32 size, opcode;
         u16 cookie, cbit;
         int pg, idx;
         u8 *preq;
 
-retry:
         opcode = req->opcode;
         if (!test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             (opcode != CMDQ_BASE_OPCODE_QUERY_FUNC &&
@@ -112,63 +95,50 @@ retry:
                 dev_err(&rcfw->pdev->dev,
                         "QPLIB: RCFW not initialized, reject opcode 0x%x",
                         opcode);
-                return NULL;
+                return -EINVAL;
         }
 
         if (test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             opcode == CMDQ_BASE_OPCODE_INITIALIZE_FW) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW already initialized!");
-                return NULL;
+                return -EINVAL;
         }
 
         /* Cmdq are in 16-byte units, each request can consume 1 or more
          * cmdqe
          */
         spin_lock_irqsave(&cmdq->lock, flags);
-        if (req->cmd_size > cmdq->max_elements -
-            ((HWQ_CMP(cmdq->prod, cmdq) - HWQ_CMP(cmdq->cons, cmdq)) &
-             (cmdq->max_elements - 1))) {
+        if (req->cmd_size >= HWQ_FREE_SLOTS(cmdq)) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW: CMDQ is full!");
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EAGAIN;
         }
 
-        retry_cnt = 0xFF;
 
-        cookie = atomic_inc_return(&rcfw->seq_num) & RCFW_MAX_COOKIE_VALUE;
+        cookie = rcfw->seq_num & RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (is_block)
                 cookie |= RCFW_CMD_IS_BLOCKING;
+
+        set_bit(cbit, rcfw->cmdq_bitmap);
         req->cookie = cpu_to_le16(cookie);
-        if (test_and_set_bit(cbit, rcfw->cmdq_bitmap)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW MAX outstanding cmd reached!");
-                atomic_dec(&rcfw->seq_num);
+        crsqe = &rcfw->crsqe_tbl[cbit];
+        if (crsqe->resp) {
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EBUSY;
         }
-        /* Reserve a resp buffer slot if requested */
-        if (req->resp_size && crsbe) {
-                spin_lock(&crsb->lock);
-                sw_prod = HWQ_CMP(crsb->prod, crsb);
-                crsb_ptr = (struct bnxt_qplib_crsbe **)crsb->pbl_ptr;
-                *crsbe = (void *)&crsb_ptr[get_crsb_pg(sw_prod)]
-                                          [get_crsb_idx(sw_prod)];
-                bnxt_qplib_crsb_dma_next(crsb->pbl_dma_ptr, sw_prod, &dma_addr);
-                req->resp_addr = cpu_to_le64(dma_addr);
-                crsb->prod++;
-                spin_unlock(&crsb->lock);
-
-                req->resp_size = (sizeof(struct bnxt_qplib_crsbe) +
-                                  BNXT_QPLIB_CMDQE_UNITS - 1) /
-                                 BNXT_QPLIB_CMDQE_UNITS;
+        memset(resp, 0, sizeof(*resp));
+        crsqe->resp = (struct creq_qp_event *)resp;
+        crsqe->resp->cookie = req->cookie;
+        crsqe->req_size = req->cmd_size;
+        if (req->resp_size && sb) {
+                struct bnxt_qplib_rcfw_sbuf *sbuf = sb;
+
+                req->resp_addr = cpu_to_le64(sbuf->dma_addr);
+                req->resp_size = (sbuf->size + BNXT_QPLIB_CMDQE_UNITS - 1) /
+                                  BNXT_QPLIB_CMDQE_UNITS;
         }
+
         cmdq_ptr = (struct bnxt_qplib_cmdqe **)cmdq->pbl_ptr;
         preq = (u8 *)req;
         size = req->cmd_size * BNXT_QPLIB_CMDQE_UNITS;
@@ -190,23 +160,24 @@ retry:
                 preq += min_t(u32, size, sizeof(*cmdqe));
                 size -= min_t(u32, size, sizeof(*cmdqe));
                 cmdq->prod++;
+                rcfw->seq_num++;
         } while (size > 0);
 
+        rcfw->seq_num++;
+
         cmdq_prod = cmdq->prod;
         if (rcfw->flags & FIRMWARE_FIRST_FLAG) {
-                /* The very first doorbell write is required to set this flag
-                 * which prompts the FW to reset its internal pointers
+                /* The very first doorbell write
+                 * is required to set this flag
+                 * which prompts the FW to reset
+                 * its internal pointers
                  */
                 cmdq_prod |= FIRMWARE_FIRST_FLAG;
                 rcfw->flags &= ~FIRMWARE_FIRST_FLAG;
         }
-        sw_prod = HWQ_CMP(crsq->prod, crsq);
-        crsqe = &crsq->crsq[sw_prod];
-        memset(crsqe, 0, sizeof(*crsqe));
-        crsq->prod++;
-        crsqe->req_size = req->cmd_size;
 
         /* ring CMDQ DB */
+        wmb();
         writel(cmdq_prod, rcfw->cmdq_bar_reg_iomem +
                rcfw->cmdq_bar_reg_prod_off);
         writel(RCFW_CMDQ_TRIG_VAL, rcfw->cmdq_bar_reg_iomem +
@@ -214,9 +185,56 @@ retry:
 done:
         spin_unlock_irqrestore(&cmdq->lock, flags);
         /* Return the CREQ response pointer */
-        return crsqe ? &crsqe->qp_event : NULL;
+        return 0;
 }
 
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req,
+                                 struct creq_base *resp,
+                                 void *sb, u8 is_block)
+{
+        struct creq_qp_event *evnt = (struct creq_qp_event *)resp;
+        u16 cookie;
+        u8 opcode, retry_cnt = 0xFF;
+        int rc = 0;
+
+        do {
+                opcode = req->opcode;
+                rc = __send_message(rcfw, req, resp, sb, is_block);
+                cookie = le16_to_cpu(req->cookie) & RCFW_MAX_COOKIE_VALUE;
+                if (!rc)
+                        break;
+
+                if (!retry_cnt || (rc != -EAGAIN && rc != -EBUSY)) {
+                        /* send failed */
+                        dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x send failed",
+                                cookie, opcode);
+                        return rc;
+                }
+                is_block ? mdelay(1) : usleep_range(500, 1000);
+
+        } while (retry_cnt--);
+
+        if (is_block)
+                rc = __block_for_resp(rcfw, cookie);
+        else
+                rc = __wait_for_resp(rcfw, cookie);
+        if (rc) {
+                /* timed out */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x timedout (%d)msec",
+                        cookie, opcode, RCFW_CMD_WAIT_TIME_MS);
+                return rc;
+        }
+
+        if (evnt->status) {
+                /* failed with status */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x status %#x",
+                        cookie, opcode, evnt->status);
+                rc = -EFAULT;
+        }
+
+        return rc;
+}
 /* Completions */
 static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
                                          struct creq_func_event *func_event)
@@ -260,12 +278,12 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
 static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
                                        struct creq_qp_event *qp_event)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_crsqe *crsqe;
-        u16 cbit, cookie, blocked = 0;
+        struct bnxt_qplib_crsq *crsqe;
         unsigned long flags;
-        u32 sw_cons;
+        u16 cbit, blocked = 0;
+        u16 cookie;
+        __le16  mcookie;
 
         switch (qp_event->event) {
         case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
@@ -275,24 +293,31 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
         default:
                 /* Command Response */
                 spin_lock_irqsave(&cmdq->lock, flags);
-                sw_cons = HWQ_CMP(crsq->cons, crsq);
-                crsqe = &crsq->crsq[sw_cons];
-                crsq->cons++;
-                memcpy(&crsqe->qp_event, qp_event, sizeof(crsqe->qp_event));
-
-                cookie = le16_to_cpu(crsqe->qp_event.cookie);
+                cookie = le16_to_cpu(qp_event->cookie);
+                mcookie = qp_event->cookie;
                 blocked = cookie & RCFW_CMD_IS_BLOCKING;
                 cookie &= RCFW_MAX_COOKIE_VALUE;
                 cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
+                crsqe = &rcfw->crsqe_tbl[cbit];
+                if (crsqe->resp &&
+                    crsqe->resp->cookie  == mcookie) {
+                        memcpy(crsqe->resp, qp_event, sizeof(*qp_event));
+                        crsqe->resp = NULL;
+                } else {
+                        dev_err(&rcfw->pdev->dev,
+                                "QPLIB: CMD %s resp->cookie = %#x, evnt->cookie = %#x",
+                                crsqe->resp ? "mismatch" : "collision",
+                                crsqe->resp ? crsqe->resp->cookie : 0, mcookie);
+                }
                 if (!test_and_clear_bit(cbit, rcfw->cmdq_bitmap))
                         dev_warn(&rcfw->pdev->dev,
                                  "QPLIB: CMD bit %d was not requested", cbit);
-
                 cmdq->cons += crsqe->req_size;
-                spin_unlock_irqrestore(&cmdq->lock, flags);
+                crsqe->req_size = 0;
+
                 if (!blocked)
                         wake_up(&rcfw->waitq);
-                break;
+                spin_unlock_irqrestore(&cmdq->lock, flags);
         }
         return 0;
 }
@@ -305,12 +330,12 @@ static void bnxt_qplib_service_creq(unsigned long data)
         struct creq_base *creqe, **creq_ptr;
         u32 sw_cons, raw_cons;
         unsigned long flags;
-        u32 type;
+        u32 type, budget = CREQ_ENTRY_POLL_BUDGET;
 
-        /* Service the CREQ until empty */
+        /* Service the CREQ until budget is over */
         spin_lock_irqsave(&creq->lock, flags);
         raw_cons = creq->cons;
-        while (1) {
+        while (budget > 0) {
                 sw_cons = HWQ_CMP(raw_cons, creq);
                 creq_ptr = (struct creq_base **)creq->pbl_ptr;
                 creqe = &creq_ptr[get_creq_pg(sw_cons)][get_creq_idx(sw_cons)];
@@ -320,15 +345,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                 type = creqe->type & CREQ_BASE_TYPE_MASK;
                 switch (type) {
                 case CREQ_BASE_TYPE_QP_EVENT:
-                        if (!bnxt_qplib_process_qp_event
-                            (rcfw, (struct creq_qp_event *)creqe))
-                                rcfw->creq_qp_event_processed++;
-                        else {
-                                dev_warn(&rcfw->pdev->dev, "QPLIB: crsqe with");
-                                dev_warn(&rcfw->pdev->dev,
-                                         "QPLIB: type = 0x%x not handled",
-                                         type);
-                        }
+                        bnxt_qplib_process_qp_event
+                                (rcfw, (struct creq_qp_event *)creqe);
+                        rcfw->creq_qp_event_processed++;
                         break;
                 case CREQ_BASE_TYPE_FUNC_EVENT:
                         if (!bnxt_qplib_process_func_event
@@ -346,7 +365,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                         break;
                 }
                 raw_cons++;
+                budget--;
         }
+
         if (creq->cons != raw_cons) {
                 creq->cons = raw_cons;
                 CREQ_DB_REARM(rcfw->creq_bar_reg_iomem, raw_cons,
@@ -375,23 +396,16 @@ static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance)
 /* RCFW */
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw)
 {
-        struct creq_deinitialize_fw_resp *resp;
         struct cmdq_deinitialize_fw req;
+        struct creq_deinitialize_fw_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DEINITIALIZE_FW, cmd_flags);
-        resp = (struct creq_deinitialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp)
-                return -EINVAL;
-
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie)))
-                return -ETIMEDOUT;
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie))
-                return -EFAULT;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
 
         clear_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
@@ -417,9 +431,10 @@ static int __get_pbl_pg_idx(struct bnxt_qplib_pbl *pbl)
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
                          struct bnxt_qplib_ctx *ctx, int is_virtfn)
 {
-        struct creq_initialize_fw_resp *resp;
         struct cmdq_initialize_fw req;
+        struct creq_initialize_fw_resp resp;
         u16 cmd_flags = 0, level;
+        int rc;
 
         RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
 
@@ -482,37 +497,19 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
 
 skip_ctx_setup:
         req.stat_ctx_id = cpu_to_le32(ctx->stats.fw_id);
-        resp = (struct creq_initialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW failed");
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
         set_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
 }
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
 {
-        bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->crsb);
-        kfree(rcfw->crsq.crsq);
+        kfree(rcfw->crsqe_tbl);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->cmdq);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->creq);
-
         rcfw->pdev = NULL;
 }
 
@@ -539,21 +536,11 @@ int bnxt_qplib_alloc_rcfw_channel(struct pci_dev *pdev,
                 goto fail;
         }
 
-        rcfw->crsq.max_elements = rcfw->cmdq.max_elements;
-        rcfw->crsq.crsq = kcalloc(rcfw->crsq.max_elements,
-                                  sizeof(*rcfw->crsq.crsq), GFP_KERNEL);
-        if (!rcfw->crsq.crsq)
+        rcfw->crsqe_tbl = kcalloc(rcfw->cmdq.max_elements,
+                                  sizeof(*rcfw->crsqe_tbl), GFP_KERNEL);
+        if (!rcfw->crsqe_tbl)
                 goto fail;
 
-        rcfw->crsb.max_elements = BNXT_QPLIB_CRSBE_MAX_CNT;
-        if (bnxt_qplib_alloc_init_hwq(rcfw->pdev, &rcfw->crsb, NULL, 0,
-                                      &rcfw->crsb.max_elements,
-                                      BNXT_QPLIB_CRSBE_UNITS, 0, PAGE_SIZE,
-                                      HWQ_TYPE_CTX)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: HW channel CRSB allocation failed");
-                goto fail;
-        }
         return 0;
 
 fail:
@@ -606,7 +593,7 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         int rc;
 
         /* General */
-        atomic_set(&rcfw->seq_num, 0);
+        rcfw->seq_num = 0;
         rcfw->flags = FIRMWARE_FIRST_FLAG;
         bmap_size = BITS_TO_LONGS(RCFW_MAX_OUTSTANDING_CMD *
                                   sizeof(unsigned long));
@@ -636,10 +623,6 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
 
         rcfw->cmdq_bar_reg_trig_off = RCFW_COMM_TRIG_OFFSET;
 
-        /* CRSQ */
-        rcfw->crsq.prod = 0;
-        rcfw->crsq.cons = 0;
-
         /* CREQ */
         rcfw->creq_bar_reg = RCFW_COMM_CONS_PCI_BAR_REGION;
         res_base = pci_resource_start(pdev, rcfw->creq_bar_reg);
@@ -692,3 +675,34 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         __iowrite32_copy(rcfw->cmdq_bar_reg_iomem, &init, sizeof(init) / 4);
         return 0;
 }
+
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                struct bnxt_qplib_rcfw *rcfw,
+                u32 size)
+{
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
+
+        sbuf = kzalloc(sizeof(*sbuf), GFP_ATOMIC);
+        if (!sbuf)
+                return NULL;
+
+        sbuf->size = size;
+        sbuf->sb = dma_zalloc_coherent(&rcfw->pdev->dev, sbuf->size,
+                                       &sbuf->dma_addr, GFP_ATOMIC);
+        if (!sbuf->sb)
+                goto bail;
+
+        return sbuf;
+bail:
+        kfree(sbuf);
+        return NULL;
+}
+
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf)
+{
+        if (sbuf->sb)
+                dma_free_coherent(&rcfw->pdev->dev, sbuf->size,
+                                  sbuf->sb, sbuf->dma_addr);
+        kfree(sbuf);
+}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index d3567d75bf58..09ce121770cd 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -73,6 +73,7 @@
 #define RCFW_MAX_OUTSTANDING_CMD        BNXT_QPLIB_CMDQE_MAX_CNT
 #define RCFW_MAX_COOKIE_VALUE           0x7FFF
 #define RCFW_CMD_IS_BLOCKING            0x8000
+#define RCFW_BLOCKED_CMD_WAIT_COUNT     0x4E20
 
 /* Cmdq contains a fix number of a 16-Byte slots */
 struct bnxt_qplib_cmdqe {
@@ -94,32 +95,6 @@ struct bnxt_qplib_crsbe {
         u8                      data[1024];
 };
 
-/* CRSQ SB */
-#define BNXT_QPLIB_CRSBE_MAX_CNT        4
-#define BNXT_QPLIB_CRSBE_UNITS          sizeof(struct bnxt_qplib_crsbe)
-#define BNXT_QPLIB_CRSBE_CNT_PER_PG     (PAGE_SIZE / BNXT_QPLIB_CRSBE_UNITS)
-
-#define MAX_CRSB_IDX                    (BNXT_QPLIB_CRSBE_MAX_CNT - 1)
-#define MAX_CRSB_IDX_PER_PG             (BNXT_QPLIB_CRSBE_CNT_PER_PG - 1)
-
-static inline u32 get_crsb_pg(u32 val)
-{
-        return (val & ~MAX_CRSB_IDX_PER_PG) / BNXT_QPLIB_CRSBE_CNT_PER_PG;
-}
-
-static inline u32 get_crsb_idx(u32 val)
-{
-        return val & MAX_CRSB_IDX_PER_PG;
-}
-
-static inline void bnxt_qplib_crsb_dma_next(dma_addr_t *pg_map_arr,
-                                            u32 prod, dma_addr_t *dma_addr)
-{
-                *dma_addr = pg_map_arr[(prod) / BNXT_QPLIB_CRSBE_CNT_PER_PG];
-                *dma_addr += ((prod) % BNXT_QPLIB_CRSBE_CNT_PER_PG) *
-                              BNXT_QPLIB_CRSBE_UNITS;
-}
-
 /* CREQ */
 /* Allocate 1 per QP for async error notification for now */
 #define BNXT_QPLIB_CREQE_MAX_CNT        (64 * 1024)
@@ -158,17 +133,19 @@ static inline u32 get_creq_idx(u32 val)
 #define CREQ_DB(db, raw_cons, cp_bit)                           \
         writel(CREQ_DB_CP_FLAGS | ((raw_cons) & ((cp_bit) - 1)), db)
 
+#define CREQ_ENTRY_POLL_BUDGET          0x100
+
 /* HWQ */
-struct bnxt_qplib_crsqe {
-        struct creq_qp_event    qp_event;
+
+struct bnxt_qplib_crsq {
+        struct creq_qp_event    *resp;
         u32                     req_size;
 };
 
-struct bnxt_qplib_crsq {
-        struct bnxt_qplib_crsqe *crsq;
-        u32                     prod;
-        u32                     cons;
-        u32                     max_elements;
+struct bnxt_qplib_rcfw_sbuf {
+        void *sb;
+        dma_addr_t dma_addr;
+        u32 size;
 };
 
 /* RCFW Communication Channels */
@@ -185,7 +162,7 @@ struct bnxt_qplib_rcfw {
         wait_queue_head_t       waitq;
         int                     (*aeq_handler)(struct bnxt_qplib_rcfw *,
                                                struct creq_func_event *);
-        atomic_t                seq_num;
+        u32                     seq_num;
 
         /* Bar region info */
         void __iomem            *cmdq_bar_reg_iomem;
@@ -203,8 +180,7 @@ struct bnxt_qplib_rcfw {
 
         /* Actual Cmd and Resp Queues */
         struct bnxt_qplib_hwq   cmdq;
-        struct bnxt_qplib_crsq  crsq;
-        struct bnxt_qplib_hwq   crsb;
+        struct bnxt_qplib_crsq  *crsqe_tbl;
 };
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw);
@@ -219,11 +195,14 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
                                         (struct bnxt_qplib_rcfw *,
                                          struct creq_func_event *));
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block);
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                                struct bnxt_qplib_rcfw *rcfw,
+                                u32 size);
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf);
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req, struct creq_base *resp,
+                                 void *sbuf, u8 is_block);
 
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
index 6277d802ca4b..2e4855509719 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
@@ -48,6 +48,10 @@ extern const struct bnxt_qplib_gid bnxt_qplib_gid_zero;
 
 #define HWQ_CMP(idx, hwq)       ((idx) & ((hwq)->max_elements - 1))
 
+#define HWQ_FREE_SLOTS(hwq)     (hwq->max_elements - \
+                                ((HWQ_CMP(hwq->prod, hwq)\
+                                - HWQ_CMP(hwq->cons, hwq))\
+                                & (hwq->max_elements - 1)))
 enum bnxt_qplib_hwq_type {
         HWQ_TYPE_CTX,
         HWQ_TYPE_QUEUE,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 7b31eccedf11..fde18cf0e406 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -55,37 +55,30 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                             struct bnxt_qplib_dev_attr *attr)
 {
         struct cmdq_query_func req;
-        struct creq_query_func_resp *resp;
+        struct creq_query_func_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_func_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp;
         u8 *tqm_alloc;
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_FUNC, cmd_flags);
 
-        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_func_resp *)
-                bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void **)&sb,
-                                             0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC failed ");
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf) {
                 dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
+                        "QPLIB: SP: QUERY_FUNC alloc side buffer failed");
+                return -ENOMEM;
         }
+
+        sb = sbuf->sb;
+        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
+
         /* Extract the context from the side buffer */
         attr->max_qp = le32_to_cpu(sb->max_qp);
         attr->max_qp_rd_atom =
@@ -95,6 +88,11 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ?
                 BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom;
         attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr);
+        /*
+         * 128 WQEs needs to be reserved for the HW (8916). Prevent
+         * reporting the max number
+         */
+        attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS;
         attr->max_qp_sges = sb->max_sge;
         attr->max_cq = le32_to_cpu(sb->max_cq);
         attr->max_cq_wqes = le32_to_cpu(sb->max_cqe);
@@ -130,7 +128,10 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 attr->tqm_alloc_reqs[i * 4 + 2] = *(++tqm_alloc);
                 attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
         }
-        return 0;
+
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 /* SGID */
@@ -178,8 +179,9 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         /* Remove GID from the SGID table */
         if (update) {
                 struct cmdq_delete_gid req;
-                struct creq_delete_gid_resp *resp;
+                struct creq_delete_gid_resp resp;
                 u16 cmd_flags = 0;
+                int rc;
 
                 RCFW_CMD_PREP(req, DELETE_GID, cmd_flags);
                 if (sgid_tbl->hw_id[index] == 0xFFFF) {
@@ -188,31 +190,10 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                         return -EINVAL;
                 }
                 req.gid_index = cpu_to_le16(sgid_tbl->hw_id[index]);
-                resp = (struct creq_delete_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL,
-                                                     0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
         }
         memcpy(&sgid_tbl->tbl[index], &bnxt_qplib_gid_zero,
                sizeof(bnxt_qplib_gid_zero));
@@ -234,7 +215,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                                                    struct bnxt_qplib_res,
                                                    sgid_tbl);
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
-        int i, free_idx, rc = 0;
+        int i, free_idx;
 
         if (!sgid_tbl) {
                 dev_err(&res->pdev->dev, "QPLIB: SGID table not allocated");
@@ -266,10 +247,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         }
         if (update) {
                 struct cmdq_add_gid req;
-                struct creq_add_gid_resp *resp;
+                struct creq_add_gid_resp resp;
                 u16 cmd_flags = 0;
                 u32 temp32[4];
                 u16 temp16[3];
+                int rc;
 
                 RCFW_CMD_PREP(req, ADD_GID, cmd_flags);
 
@@ -290,31 +272,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                 req.src_mac[1] = cpu_to_be16(temp16[1]);
                 req.src_mac[2] = cpu_to_be16(temp16[2]);
 
-                resp = (struct creq_add_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: ADD_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPIB: SP: ADD_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev, "QPLIB: SP: ADD_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
-                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp->xid);
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
+                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp.xid);
         }
         /* Add GID to the sgid_tbl */
         memcpy(&sgid_tbl->tbl[free_idx], gid, sizeof(*gid));
@@ -325,7 +287,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
 
         *index = free_idx;
         /* unlock */
-        return rc;
+        return 0;
 }
 
 /* pkeys */
@@ -422,10 +384,11 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_ah req;
-        struct creq_create_ah_resp *resp;
+        struct creq_create_ah_resp resp;
         u16 cmd_flags = 0;
         u32 temp32[4];
         u16 temp16[3];
+        int rc;
 
         RCFW_CMD_PREP(req, CREATE_AH, cmd_flags);
 
@@ -450,28 +413,12 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
         req.dest_mac[1] = cpu_to_le16(temp16[1]);
         req.dest_mac[2] = cpu_to_le16(temp16[2]);
 
-        resp = (struct creq_create_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-        ah->id = le32_to_cpu(resp->xid);
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
+
+        ah->id = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -479,35 +426,19 @@ int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_ah req;
-        struct creq_destroy_ah_resp *resp;
+        struct creq_destroy_ah_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         /* Clean up the AH table in the device */
         RCFW_CMD_PREP(req, DESTROY_AH, cmd_flags);
 
         req.ah_cid = cpu_to_le32(ah->id);
 
-        resp = (struct creq_destroy_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
         return 0;
 }
 
@@ -516,8 +447,9 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deallocate_key req;
-        struct creq_deallocate_key_resp *resp;
+        struct creq_deallocate_key_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         if (mrw->lkey == 0xFFFFFFFF) {
                 dev_info(&res->pdev->dev,
@@ -536,27 +468,11 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         else
                 req.key = cpu_to_le32(mrw->lkey);
 
-        resp = (struct creq_deallocate_key_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
+
         /* Free the qplib's MRW memory */
         if (mrw->hwq.max_elements)
                 bnxt_qplib_free_hwq(res->pdev, &mrw->hwq);
@@ -568,9 +484,10 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_allocate_mrw req;
-        struct creq_allocate_mrw_resp *resp;
+        struct creq_allocate_mrw_resp resp;
         u16 cmd_flags = 0;
         unsigned long tmp;
+        int rc;
 
         RCFW_CMD_PREP(req, ALLOCATE_MRW, cmd_flags);
 
@@ -584,33 +501,17 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         tmp = (unsigned long)mrw;
         req.mrw_handle = cpu_to_le64(tmp);
 
-        resp = (struct creq_allocate_mrw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
+
         if ((mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1)  ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2A) ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B))
-                mrw->rkey = le32_to_cpu(resp->xid);
+                mrw->rkey = le32_to_cpu(resp.xid);
         else
-                mrw->lkey = le32_to_cpu(resp->xid);
+                mrw->lkey = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -619,40 +520,17 @@ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deregister_mr req;
-        struct creq_deregister_mr_resp *resp;
+        struct creq_deregister_mr_resp resp;
         u16 cmd_flags = 0;
         int rc;
 
         RCFW_CMD_PREP(req, DEREGISTER_MR, cmd_flags);
 
         req.lkey = cpu_to_le32(mrw->lkey);
-        resp = (struct creq_deregister_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR send failed");
-                return -EINVAL;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: DEREG_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
+                return rc;
 
         /* Free the qplib's MR memory */
         if (mrw->hwq.max_elements) {
@@ -669,7 +547,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_register_mr req;
-        struct creq_register_mr_resp *resp;
+        struct creq_register_mr_resp resp;
         u16 cmd_flags = 0, level;
         int pg_ptrs, pages, i, rc;
         dma_addr_t **pbl_ptr;
@@ -730,36 +608,11 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
         req.key = cpu_to_le32(mr->lkey);
         req.mr_size = cpu_to_le64(mr->total_size);
 
-        resp = (struct creq_register_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "SP: REG_MR send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "SP: REG_MR timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: REG_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: SP: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
                 goto fail;
-        }
+
         return 0;
 
 fail:
@@ -804,35 +657,15 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_map_tc_to_cos req;
-        struct creq_map_tc_to_cos_resp *resp;
+        struct creq_map_tc_to_cos_resp resp;
         u16 cmd_flags = 0;
-        int tleft;
+        int rc = 0;
 
         RCFW_CMD_PREP(req, MAP_TC_TO_COS, cmd_flags);
         req.cos0 = cpu_to_le16(cids[0]);
         req.cos1 = cpu_to_le16(cids[1]);
 
-        resp = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS send failed");
-                return -EINVAL;
-        }
-
-        tleft = bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie));
-        if (!tleft) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS timed out");
-                return -ETIMEDOUT;
-        }
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
         return 0;
 }
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index 1442a617e968..a543f959098b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -40,6 +40,8 @@
 #ifndef __BNXT_QPLIB_SP_H__
 #define __BNXT_QPLIB_SP_H__
 
+#define BNXT_QPLIB_RESERVED_QP_WRS      128
+
 struct bnxt_qplib_dev_attr {
         char                            fw_ver[32];
         u16                             max_sgid;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b6fe45924c6e..0910faf3587b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -488,6 +488,7 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
 
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -498,6 +499,7 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         c4iw_put_ep(&ep->parent_ep->com);
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -569,11 +571,13 @@ static void abort_arp_failure(void *handle, struct sk_buff *skb)
 
         pr_debug("%s rdev %p\n", __func__, rdev);
         req->cmd = CPL_ABORT_NO_RST;
+        skb_get(skb);
         ret = c4iw_ofld_send(rdev, skb);
         if (ret) {
                 __state_set(&ep->com, DEAD);
                 queue_arp_failure_cpl(ep, skb, FAKE_CPL_PUT_EP_SAFE);
-        }
+        } else
+                kfree_skb(skb);
 }
 
 static int send_flowc(struct c4iw_ep *ep)
@@ -2517,7 +2521,8 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                 goto reject;
         }
 
-        hdrs = sizeof(struct iphdr) + sizeof(struct tcphdr) +
+        hdrs = ((iptype == 4) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr)) +
+               sizeof(struct tcphdr) +
                ((enable_tcp_timestamps && req->tcpopt.tstamp) ? 12 : 0);
         if (peer_mss && child_ep->mtu > (peer_mss + hdrs))
                 child_ep->mtu = peer_mss + hdrs;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 329fb65e8fb0..ae0b79aeea2e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -767,7 +767,7 @@ void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                 kfree(entry);
         }
 
-        list_for_each_safe(pos, nxt, &uctx->qpids) {
+        list_for_each_safe(pos, nxt, &uctx->cqids) {
                 entry = list_entry(pos, struct c4iw_qid_list, entry);
                 list_del_init(&entry->entry);
                 kfree(entry);
@@ -880,13 +880,15 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         rdev->free_workq = create_singlethread_workqueue("iw_cxgb4_free");
         if (!rdev->free_workq) {
                 err = -ENOMEM;
-                goto err_free_status_page;
+                goto err_free_status_page_and_wr_log;
         }
 
         rdev->status_page->db_off = 0;
 
         return 0;
-err_free_status_page:
+err_free_status_page_and_wr_log:
+        if (c4iw_wr_log && rdev->wr_log)
+                kfree(rdev->wr_log);
         free_page((unsigned long)rdev->status_page);
 destroy_ocqp_pool:
         c4iw_ocqp_pool_destroy(rdev);
@@ -903,9 +905,11 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
         destroy_workqueue(rdev->free_workq);
         kfree(rdev->wr_log);
+        c4iw_release_dev_ucontext(rdev, &rdev->uctx);
         free_page((unsigned long)rdev->status_page);
         c4iw_pblpool_destroy(rdev);
         c4iw_rqtpool_destroy(rdev);
+        c4iw_ocqp_pool_destroy(rdev);
         c4iw_destroy_resource(&rdev->resource);
 }
 
@@ -971,7 +975,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                  devp->rdev.lldi.sge_egrstatuspagesize);
 
         devp->rdev.hw_queue.t4_eq_status_entries =
-                devp->rdev.lldi.sge_ingpadboundary > 64 ? 2 : 1;
+                devp->rdev.lldi.sge_egrstatuspagesize / 64;
         devp->rdev.hw_queue.t4_max_eq_size = 65520;
         devp->rdev.hw_queue.t4_max_iq_size = 65520;
         devp->rdev.hw_queue.t4_max_rq_size = 8192 -
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 5d6b1eeaa9a0..2ba00b89df6a 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6312,25 +6312,38 @@ static void handle_8051_request(struct hfi1_pportdata *ppd)
         }
 }
 
-static void write_global_credit(struct hfi1_devdata *dd,
-                                u8 vau, u16 total, u16 shared)
+/*
+ * Set up allocation unit vaulue.
+ */
+void set_up_vau(struct hfi1_devdata *dd, u8 vau)
 {
-        write_csr(dd, SEND_CM_GLOBAL_CREDIT,
-                  ((u64)total <<
-                   SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT) |
-                  ((u64)shared <<
-                   SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT) |
-                  ((u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT));
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* do not modify other values in the register */
+        reg &= ~SEND_CM_GLOBAL_CREDIT_AU_SMASK;
+        reg |= (u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 }
 
 /*
  * Set up initial VL15 credits of the remote.  Assumes the rest of
- * the CM credit registers are zero from a previous global or credit reset .
+ * the CM credit registers are zero from a previous global or credit reset.
+ * Shared limit for VL15 will always be 0.
  */
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf)
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf)
 {
-        /* leave shared count at zero for both global and VL15 */
-        write_global_credit(dd, vau, vl15buf, 0);
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* set initial values for total and shared credit limit */
+        reg &= ~(SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SMASK |
+                 SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SMASK);
+
+        /*
+         * Set total limit to be equal to VL15 credits.
+         * Leave shared limit at 0.
+         */
+        reg |= (u64)vl15buf << SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 
         write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
                   << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
@@ -6348,9 +6361,11 @@ void reset_link_credits(struct hfi1_devdata *dd)
         for (i = 0; i < TXE_NUM_DATA_VL; i++)
                 write_csr(dd, SEND_CM_CREDIT_VL + (8 * i), 0);
         write_csr(dd, SEND_CM_CREDIT_VL15, 0);
-        write_global_credit(dd, 0, 0, 0);
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, 0);
         /* reset the CM block */
         pio_send_control(dd, PSC_CM_RESET);
+        /* reset cached value */
+        dd->vl15buf_cached = 0;
 }
 
 /* convert a vCU to a CU */
@@ -6839,24 +6854,35 @@ void handle_link_up(struct work_struct *work)
 {
         struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
                                                   link_up_work);
+        struct hfi1_devdata *dd = ppd->dd;
+
         set_link_state(ppd, HLS_UP_INIT);
 
         /* cache the read of DC_LCB_STS_ROUND_TRIP_LTP_CNT */
-        read_ltp_rtt(ppd->dd);
+        read_ltp_rtt(dd);
         /*
          * OPA specifies that certain counters are cleared on a transition
          * to link up, so do that.
          */
-        clear_linkup_counters(ppd->dd);
+        clear_linkup_counters(dd);
         /*
          * And (re)set link up default values.
          */
         set_linkup_defaults(ppd);
 
+        /*
+         * Set VL15 credits. Use cached value from verify cap interrupt.
+         * In case of quick linkup or simulator, vl15 value will be set by
+         * handle_linkup_change. VerifyCap interrupt handler will not be
+         * called in those scenarios.
+         */
+        if (!(quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR))
+                set_up_vl15(dd, dd->vl15buf_cached);
+
         /* enforce link speed enabled */
         if ((ppd->link_speed_active & ppd->link_speed_enabled) == 0) {
                 /* oops - current speed is not enabled, bounce */
-                dd_dev_err(ppd->dd,
+                dd_dev_err(dd,
                            "Link speed active 0x%x is outside enabled 0x%x, downing link\n",
                            ppd->link_speed_active, ppd->link_speed_enabled);
                 set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SPEED_POLICY, 0,
@@ -7357,7 +7383,14 @@ void handle_verify_cap(struct work_struct *work)
          */
         if (vau == 0)
                 vau = 1;
-        set_up_vl15(dd, vau, vl15buf);
+        set_up_vau(dd, vau);
+
+        /*
+         * Set VL15 credits to 0 in global credit register. Cache remote VL15
+         * credits value and wait for link-up interrupt ot set it.
+         */
+        set_up_vl15(dd, 0);
+        dd->vl15buf_cached = vl15buf;
 
         /* set up the LCB CRC mode */
         crc_mask = ppd->port_crc_mode_enabled & partner_supported_crc;
diff --git a/drivers/infiniband/hw/hfi1/chip_registers.h b/drivers/infiniband/hw/hfi1/chip_registers.h
index 5bfa839d1c48..793514f1d15f 100644
--- a/drivers/infiniband/hw/hfi1/chip_registers.h
+++ b/drivers/infiniband/hw/hfi1/chip_registers.h
@@ -839,7 +839,9 @@
 #define SEND_CM_CTRL_FORCE_CREDIT_MODE_SMASK 0x8ull
 #define SEND_CM_CTRL_RESETCSR 0x0000000000000020ull
 #define SEND_CM_GLOBAL_CREDIT (TXE + 0x000000000508)
+#define SEND_CM_GLOBAL_CREDIT_AU_MASK 0x7ull
 #define SEND_CM_GLOBAL_CREDIT_AU_SHIFT 16
+#define SEND_CM_GLOBAL_CREDIT_AU_SMASK 0x70000ull
 #define SEND_CM_GLOBAL_CREDIT_RESETCSR 0x0000094000030000ull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_MASK 0xFFFFull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT 0
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index da322e6668cc..414a04a481c2 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1045,6 +1045,14 @@ struct hfi1_devdata {
         /* initial vl15 credits to use */
         u16 vl15_init;
 
+        /*
+         * Cached value for vl15buf, read during verify cap interrupt. VL15
+         * credits are to be kept at 0 and set when handling the link-up
+         * interrupt. This removes the possibility of receiving VL15 MAD
+         * packets before this HFI is ready.
+         */
+        u16 vl15buf_cached;
+
         /* Misc small ints */
         u8 n_krcv_queues;
         u8 qos_shift;
@@ -1598,7 +1606,8 @@ int hfi1_rcvbuf_validate(u32 size, u8 type, u16 *encode);
 int fm_get_table(struct hfi1_pportdata *ppd, int which, void *t);
 int fm_set_table(struct hfi1_pportdata *ppd, int which, void *t);
 
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf);
+void set_up_vau(struct hfi1_devdata *dd, u8 vau);
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf);
 void reset_link_credits(struct hfi1_devdata *dd);
 void assign_remote_cm_au_table(struct hfi1_devdata *dd, u8 vcu);
 
diff --git a/drivers/infiniband/hw/hfi1/intr.c b/drivers/infiniband/hw/hfi1/intr.c
index ba265d0ae93b..04a5082d5ac5 100644
--- a/drivers/infiniband/hw/hfi1/intr.c
+++ b/drivers/infiniband/hw/hfi1/intr.c
@@ -130,7 +130,8 @@ void handle_linkup_change(struct hfi1_devdata *dd, u32 linkup)
                  * the remote values.  Both sides must be using the values.
                  */
                 if (quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR) {
-                        set_up_vl15(dd, dd->vau, dd->vl15_init);
+                        set_up_vau(dd, dd->vau);
+                        set_up_vl15(dd, dd->vl15_init);
                         assign_remote_cm_au_table(dd, dd->vcu);
                 }
 
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 93faf86d54b6..6a9f6f9819e1 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -207,8 +207,8 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
         /*
          * Save BARs and command to rewrite after device reset.
          */
-        dd->pcibar0 = addr;
-        dd->pcibar1 = addr >> 32;
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_0, &dd->pcibar0);
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_1, &dd->pcibar1);
         pci_read_config_dword(dd->pcidev, PCI_ROM_ADDRESS, &dd->pci_rom);
         pci_read_config_word(dd->pcidev, PCI_COMMAND, &dd->pci_command);
         pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &dd->pcie_devctl);
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 069bdaf061ab..1080778a1f7c 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -2159,8 +2159,11 @@ send_last:
                 ret = hfi1_rvt_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        /* peer will send again */
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
                 goto send_last;
diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
index 50d140d25e38..2f3bbcac1e34 100644
--- a/drivers/infiniband/hw/hfi1/sysfs.c
+++ b/drivers/infiniband/hw/hfi1/sysfs.c
@@ -196,7 +196,8 @@ static const struct sysfs_ops port_cc_sysfs_ops = {
 };
 
 static struct attribute *port_cc_default_attributes[] = {
-        &cc_prescan_attr.attr
+        &cc_prescan_attr.attr,
+        NULL
 };
 
 static struct kobj_type port_cc_ktype = {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index f3bc01bce483..6ae98aa7f74e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -784,7 +784,6 @@ static void i40iw_build_mpa_v2(struct i40iw_cm_node *cm_node,
         }
 
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -2446,8 +2445,8 @@ static void i40iw_handle_rcv_mpa(struct i40iw_cm_node *cm_node,
                 } else {
                         type = I40IW_CM_EVENT_CONNECTED;
                         cm_node->state = I40IW_CM_STATE_OFFLOADED;
-                        i40iw_send_ack(cm_node);
                 }
+                i40iw_send_ack(cm_node);
                 break;
         default:
                 pr_err("%s wrong cm_node state =%d\n", __func__, cm_node->state);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index f82483b3d1e7..a027e2072477 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -285,28 +285,20 @@ void i40iw_change_l2params(struct i40iw_sc_vsi *vsi, struct i40iw_l2params *l2pa
         struct i40iw_sc_dev *dev = vsi->dev;
         struct i40iw_sc_qp *qp = NULL;
         bool qs_handle_change = false;
-        bool mss_change = false;
         unsigned long flags;
         u16 qs_handle;
         int i;
 
-        if (vsi->mss != l2params->mss) {
-                mss_change = true;
-                vsi->mss = l2params->mss;
-        }
+        vsi->mss = l2params->mss;
 
         i40iw_fill_qos_list(l2params->qs_handle_list);
         for (i = 0; i < I40IW_MAX_USER_PRIORITY; i++) {
                 qs_handle = l2params->qs_handle_list[i];
                 if (vsi->qos[i].qs_handle != qs_handle)
                         qs_handle_change = true;
-                else if (!mss_change)
-                        continue;       /* no MSS nor qs handle change */
                 spin_lock_irqsave(&vsi->qos[i].lock, flags);
                 qp = i40iw_get_qp(&vsi->qos[i].qplist, qp);
                 while (qp) {
-                        if (mss_change)
-                                i40iw_qp_mss_modify(dev, qp);
                         if (qs_handle_change) {
                                 qp->qs_handle = qs_handle;
                                 /* issue cqp suspend command */
@@ -2395,7 +2387,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
 
         set_64bit_val(wqe,
                       8,
-                      LS_64(info->new_mss, I40IW_CQPSQ_QP_NEWMSS) |
                       LS_64(term_len, I40IW_CQPSQ_QP_TERMLEN));
 
         set_64bit_val(wqe, 16, qp->hw_host_ctx_pa);
@@ -2410,7 +2401,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
                  LS_64(info->cq_num_valid, I40IW_CQPSQ_QP_CQNUMVALID) |
                  LS_64(info->force_loopback, I40IW_CQPSQ_QP_FORCELOOPBACK) |
                  LS_64(qp->qp_type, I40IW_CQPSQ_QP_QPTYPE) |
-                 LS_64(info->mss_change, I40IW_CQPSQ_QP_MSSCHANGE) |
                  LS_64(info->static_rsrc, I40IW_CQPSQ_QP_STATRSRC) |
                  LS_64(info->remove_hash_idx, I40IW_CQPSQ_QP_REMOVEHASHENTRY) |
                  LS_64(term_actions, I40IW_CQPSQ_QP_TERMACT) |
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 2728af3103ce..a3f18a22f5ed 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -1319,13 +1319,13 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_QUERY_FPM_BUF_SIZE,
                                        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_query_buf_pa = mem.pa;
         info.fpm_query_buf = mem.va;
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_COMMIT_FPM_BUF_SIZE,
                                        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_commit_buf_pa = mem.pa;
         info.fpm_commit_buf = mem.va;
         info.hmc_fn_id = ldev->fid;
@@ -1347,11 +1347,9 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         info.exception_lan_queue = 1;
         info.vchnl_send = i40iw_virtchnl_send;
         status = i40iw_device_init(&iwdev->sc_dev, &info);
-exit:
-        if (status) {
-                kfree(iwdev->hmc_info_mem);
-                iwdev->hmc_info_mem = NULL;
-        }
+
+        if (status)
+                goto error;
         memset(&vsi_info, 0, sizeof(vsi_info));
         vsi_info.dev = &iwdev->sc_dev;
         vsi_info.back_vsi = (void *)iwdev;
@@ -1362,11 +1360,19 @@ exit:
                 memset(&stats_info, 0, sizeof(stats_info));
                 stats_info.fcn_id = ldev->fid;
                 stats_info.pestat = kzalloc(sizeof(*stats_info.pestat), GFP_KERNEL);
+                if (!stats_info.pestat) {
+                        status = I40IW_ERR_NO_MEMORY;
+                        goto error;
+                }
                 stats_info.stats_initialize = true;
                 if (stats_info.pestat)
                         i40iw_vsi_stats_init(&iwdev->vsi, &stats_info);
         }
         return status;
+error:
+        kfree(iwdev->hmc_info_mem);
+        iwdev->hmc_info_mem = NULL;
+        return status;
 }
 
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_osdep.h b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
index aa66c1c63dfa..f27be3e7830b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_osdep.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
@@ -199,7 +199,6 @@ void i40iw_cqp_spawn_worker(struct i40iw_sc_dev *dev,
                             struct i40iw_virtchnl_work_info *work_info, u32 iw_vf_idx);
 void *i40iw_remove_head(struct list_head *list);
 void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, bool suspend);
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp);
 
 void i40iw_term_modify_qp(struct i40iw_sc_qp *qp, u8 next_state, u8 term, u8 term_len);
 void i40iw_terminate_done(struct i40iw_sc_qp *qp, int timeout_occurred);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h
index 7b76259752b0..959ec81fba99 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_type.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_type.h
@@ -541,7 +541,6 @@ struct i40iw_create_qp_info {
 struct i40iw_modify_qp_info {
         u64 rx_win0;
         u64 rx_win1;
-        u16 new_mss;
         u8 next_iwarp_state;
         u8 termlen;
         bool ord_valid;
@@ -554,7 +553,6 @@ struct i40iw_modify_qp_info {
         bool dont_send_term;
         bool dont_send_fin;
         bool cached_var_valid;
-        bool mss_change;
         bool force_loopback;
 };
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 409a3781e735..56d986924a4c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -757,23 +757,6 @@ void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, b
 }
 
 /**
- * i40iw_qp_mss_modify - modify mss for qp
- * @dev: hardware control device structure
- * @qp: hardware control qp
- */
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp)
-{
-        struct i40iw_device *iwdev = (struct i40iw_device *)dev->back_dev;
-        struct i40iw_qp *iwqp = (struct i40iw_qp *)qp->back_qp;
-        struct i40iw_modify_qp_info info;
-
-        memset(&info, 0, sizeof(info));
-        info.mss_change = true;
-        info.new_mss = qp->vsi->mss;
-        i40iw_hw_modify_qp(iwdev, iwqp, &info, false);
-}
-
-/**
  * i40iw_term_modify_qp - modify qp for term message
  * @qp: hardware control qp
  * @next_state: qp's next state
diff --git a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
index f4d13683a403..48fd327f876b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
@@ -443,10 +443,7 @@ enum i40iw_status_code i40iw_vchnl_recv_pf(struct i40iw_sc_dev *dev,
         if (!dev->vchnl_up)
                 return I40IW_ERR_NOT_READY;
         if (vchnl_msg->iw_op_code == I40IW_VCHNL_OP_GET_VER) {
-                if (vchnl_msg->iw_op_ver != I40IW_VCHNL_OP_GET_VER_V0)
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
-                else
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
+                vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
                 return I40IW_SUCCESS;
         }
         for (iw_vf_idx = 0; iw_vf_idx < I40IW_MAX_PE_ENABLED_VF_COUNT; iw_vf_idx++) {
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index b4694717f6f3..21d31cb1325f 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1578,6 +1578,7 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc
         if (port < 0)
                 return;
         ah.av.ib.port_pd = cpu_to_be32(port << 24 | (be32_to_cpu(ah.av.ib.port_pd) & 0xffffff));
+        ah.ibah.type = rdma_ah_find_type(&dev->ib_dev, port);
 
         mlx4_ib_query_ah(&ah.ibah, &ah_attr);
         if (rdma_ah_get_ah_flags(&ah_attr) & IB_AH_GRH)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d45772da0963..9ecc089d4529 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2979,6 +2979,18 @@ error_0:
         return ret;
 }
 
+static u8 mlx5_get_umr_fence(u8 umr_fence_cap)
+{
+        switch (umr_fence_cap) {
+        case MLX5_CAP_UMR_FENCE_NONE:
+                return MLX5_FENCE_MODE_NONE;
+        case MLX5_CAP_UMR_FENCE_SMALL:
+                return MLX5_FENCE_MODE_INITIATOR_SMALL;
+        default:
+                return MLX5_FENCE_MODE_STRONG_ORDERING;
+        }
+}
+
 static int create_dev_resources(struct mlx5_ib_resources *devr)
 {
         struct ib_srq_init_attr attr;
@@ -3680,8 +3692,10 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         dev->ib_dev.check_mr_status     = mlx5_ib_check_mr_status;
         dev->ib_dev.get_port_immutable  = mlx5_port_immutable;
         dev->ib_dev.get_dev_fw_str      = get_dev_fw_str;
-        dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
-        dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        if (MLX5_CAP_GEN(mdev, ipoib_enhanced_offloads)) {
+                dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
+                dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        }
         if (mlx5_core_is_pf(mdev)) {
                 dev->ib_dev.get_vf_config       = mlx5_ib_get_vf_config;
                 dev->ib_dev.set_vf_link_state   = mlx5_ib_set_vf_link_state;
@@ -3693,6 +3707,8 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
 
         mlx5_ib_internal_fill_odp_caps(dev);
 
+        dev->umr_fence = mlx5_get_umr_fence(MLX5_CAP_GEN(mdev, umr_fence));
+
         if (MLX5_CAP_GEN(mdev, imaicl)) {
                 dev->ib_dev.alloc_mw            = mlx5_ib_alloc_mw;
                 dev->ib_dev.dealloc_mw          = mlx5_ib_dealloc_mw;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 38c877bc45e5..bdcf25410c99 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -349,7 +349,7 @@ struct mlx5_ib_qp {
         struct mlx5_ib_wq       rq;
 
         u8                      sq_signal_bits;
-        u8                      fm_cache;
+        u8                      next_fence;
         struct mlx5_ib_wq       sq;
 
         /* serialize qp state modifications
@@ -654,6 +654,7 @@ struct mlx5_ib_dev {
         struct mlx5_ib_port     *port;
         struct mlx5_sq_bfreg     bfreg;
         struct mlx5_sq_bfreg     fp_bfreg;
+        u8                              umr_fence;
 };
 
 static inline struct mlx5_ib_cq *to_mibcq(struct mlx5_core_cq *mcq)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 93959e1e43a3..ebb6768684de 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3738,24 +3738,6 @@ static void dump_wqe(struct mlx5_ib_qp *qp, int idx, int size_16)
         }
 }
 
-static u8 get_fence(u8 fence, struct ib_send_wr *wr)
-{
-        if (unlikely(wr->opcode == IB_WR_LOCAL_INV &&
-                     wr->send_flags & IB_SEND_FENCE))
-                return MLX5_FENCE_MODE_STRONG_ORDERING;
-
-        if (unlikely(fence)) {
-                if (wr->send_flags & IB_SEND_FENCE)
-                        return MLX5_FENCE_MODE_SMALL_AND_FENCE;
-                else
-                        return fence;
-        } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
-                return MLX5_FENCE_MODE_FENCE;
-        }
-
-        return 0;
-}
-
 static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct mlx5_wqe_ctrl_seg **ctrl,
                      struct ib_send_wr *wr, unsigned *idx,
@@ -3784,8 +3766,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
 static void finish_wqe(struct mlx5_ib_qp *qp,
                        struct mlx5_wqe_ctrl_seg *ctrl,
                        u8 size, unsigned idx, u64 wr_id,
-                       int nreq, u8 fence, u8 next_fence,
-                       u32 mlx5_opcode)
+                       int nreq, u8 fence, u32 mlx5_opcode)
 {
         u8 opmod = 0;
 
@@ -3793,7 +3774,6 @@ static void finish_wqe(struct mlx5_ib_qp *qp,
                                              mlx5_opcode | ((u32)opmod << 24));
         ctrl->qpn_ds = cpu_to_be32(size | (qp->trans_qp.base.mqp.qpn << 8));
         ctrl->fm_ce_se |= fence;
-        qp->fm_cache = next_fence;
         if (unlikely(qp->wq_sig))
                 ctrl->signature = wq_sig(ctrl);
 
@@ -3853,7 +3833,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                fence = qp->fm_cache;
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
@@ -3870,6 +3849,19 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
+                if (wr->opcode == IB_WR_LOCAL_INV ||
+                    wr->opcode == IB_WR_REG_MR) {
+                        fence = dev->umr_fence;
+                        next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
+                } else if (wr->send_flags & IB_SEND_FENCE) {
+                        if (qp->next_fence)
+                                fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+                        else
+                                fence = MLX5_FENCE_MODE_FENCE;
+                } else {
+                        fence = qp->next_fence;
+                }
+
                 switch (ibqp->qp_type) {
                 case IB_QPT_XRC_INI:
                         xrc = seg;
@@ -3896,7 +3888,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 goto out;
 
                         case IB_WR_LOCAL_INV:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_LOCAL_INV;
                                 ctrl->imm = cpu_to_be32(wr->ex.invalidate_rkey);
                                 set_linv_wr(qp, &seg, &size);
@@ -3904,7 +3895,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 break;
 
                         case IB_WR_REG_MR:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_REG_MR;
                                 ctrl->imm = cpu_to_be32(reg_wr(wr)->key);
                                 err = set_reg_wr(qp, reg_wr(wr), &seg, &size);
@@ -3927,9 +3917,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_UMR);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_UMR);
                                 /*
                                  * SET_PSV WQEs are not signaled and solicited
                                  * on error
@@ -3954,9 +3943,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
                                 err = begin_wqe(qp, &seg, &ctrl, wr,
                                                 &idx, &size, nreq);
                                 if (err) {
@@ -3966,7 +3954,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 err = set_psv_wr(&sig_handover_wr(wr)->sig_attrs->wire,
                                                  mr->sig->psv_wire.psv_idx, &seg,
                                                  &size);
@@ -3976,9 +3963,9 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
+                                qp->next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 num_sge = 0;
                                 goto skip_psv;
 
@@ -4089,8 +4076,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
-                           get_fence(fence, wr), next_fence,
+                qp->next_fence = next_fence;
+                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq, fence,
                            mlx5_ib_opcode[wr->opcode]);
 skip_psv:
                 if (0)
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index fb983df7c157..30b256a2c54e 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -610,7 +610,6 @@ static void build_mpa_v2(struct nes_cm_node *cm_node,
                 ctrl_ord = cm_node->ord_size & IETF_NO_IRD_ORD;
         }
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -1826,7 +1825,7 @@ static void handle_rcv_mpa(struct nes_cm_node *cm_node, struct sk_buff *skb)
                         type = NES_CM_EVENT_CONNECTED;
                         cm_node->state = NES_CM_STATE_TSA;
                 }
-
+                send_ack(cm_node, NULL);
                 break;
         default:
                 WARN_ON(1);
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index aa08c76a4245..d961f79b317c 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -58,7 +58,10 @@
 #define QEDR_MSG_QP   "  QP"
 #define QEDR_MSG_GSI  " GSI"
 
-#define QEDR_CQ_MAGIC_NUMBER   (0x11223344)
+#define QEDR_CQ_MAGIC_NUMBER    (0x11223344)
+
+#define FW_PAGE_SIZE            (RDMA_RING_PAGE_SIZE)
+#define FW_PAGE_SHIFT           (12)
 
 struct qedr_dev;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 3d7705cec770..d86dbe814d98 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -270,11 +270,13 @@ static inline int qedr_gsi_build_header(struct qedr_dev *dev,
                 return rc;
         }
 
-        vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
-        if (vlan_id < VLAN_CFI_MASK)
-                has_vlan = true;
-        if (sgid_attr.ndev)
+        if (sgid_attr.ndev) {
+                vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
+                if (vlan_id < VLAN_CFI_MASK)
+                        has_vlan = true;
+
                 dev_put(sgid_attr.ndev);
+        }
 
         if (!memcmp(&sgid, &zgid, sizeof(sgid))) {
                 DP_ERR(dev, "gsi post send: GID not found GID index %d\n",
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 17685cfea6a2..d6723c365c7f 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -653,14 +653,15 @@ static int qedr_prepare_pbl_tbl(struct qedr_dev *dev,
 
 static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
                                struct qedr_pbl *pbl,
-                               struct qedr_pbl_info *pbl_info)
+                               struct qedr_pbl_info *pbl_info, u32 pg_shift)
 {
         int shift, pg_cnt, pages, pbe_cnt, total_num_pbes = 0;
+        u32 fw_pg_cnt, fw_pg_per_umem_pg;
         struct qedr_pbl *pbl_tbl;
         struct scatterlist *sg;
         struct regpair *pbe;
+        u64 pg_addr;
         int entry;
-        u32 addr;
 
         if (!pbl_info->num_pbes)
                 return;
@@ -683,29 +684,35 @@ static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
 
         shift = umem->page_shift;
 
+        fw_pg_per_umem_pg = BIT(umem->page_shift - pg_shift);
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 pages = sg_dma_len(sg) >> shift;
+                pg_addr = sg_dma_address(sg);
                 for (pg_cnt = 0; pg_cnt < pages; pg_cnt++) {
-                        /* store the page address in pbe */
-                        pbe->lo = cpu_to_le32(sg_dma_address(sg) +
-                                              (pg_cnt << shift));
-                        addr = upper_32_bits(sg_dma_address(sg) +
-                                             (pg_cnt << shift));
-                        pbe->hi = cpu_to_le32(addr);
-                        pbe_cnt++;
-                        total_num_pbes++;
-                        pbe++;
-
-                        if (total_num_pbes == pbl_info->num_pbes)
-                                return;
-
-                        /* If the given pbl is full storing the pbes,
-                         * move to next pbl.
-                         */
-                        if (pbe_cnt == (pbl_info->pbl_size / sizeof(u64))) {
-                                pbl_tbl++;
-                                pbe = (struct regpair *)pbl_tbl->va;
-                                pbe_cnt = 0;
+                        for (fw_pg_cnt = 0; fw_pg_cnt < fw_pg_per_umem_pg;) {
+                                pbe->lo = cpu_to_le32(pg_addr);
+                                pbe->hi = cpu_to_le32(upper_32_bits(pg_addr));
+
+                                pg_addr += BIT(pg_shift);
+                                pbe_cnt++;
+                                total_num_pbes++;
+                                pbe++;
+
+                                if (total_num_pbes == pbl_info->num_pbes)
+                                        return;
+
+                                /* If the given pbl is full storing the pbes,
+                                 * move to next pbl.
+                                 */
+                                if (pbe_cnt ==
+                                    (pbl_info->pbl_size / sizeof(u64))) {
+                                        pbl_tbl++;
+                                        pbe = (struct regpair *)pbl_tbl->va;
+                                        pbe_cnt = 0;
+                                }
+
+                                fw_pg_cnt++;
                         }
                 }
         }
@@ -754,7 +761,7 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                                        u64 buf_addr, size_t buf_len,
                                        int access, int dmasync)
 {
-        int page_cnt;
+        u32 fw_pages;
         int rc;
 
         q->buf_addr = buf_addr;
@@ -766,8 +773,10 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 return PTR_ERR(q->umem);
         }
 
-        page_cnt = ib_umem_page_count(q->umem);
-        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, page_cnt, 0);
+        fw_pages = ib_umem_page_count(q->umem) <<
+            (q->umem->page_shift - FW_PAGE_SHIFT);
+
+        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, fw_pages, 0);
         if (rc)
                 goto err0;
 
@@ -777,7 +786,8 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 goto err0;
         }
 
-        qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info);
+                qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info,
+                                   FW_PAGE_SHIFT);
 
         return 0;
 
@@ -2226,7 +2236,7 @@ struct ib_mr *qedr_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
                 goto err1;
 
         qedr_populate_pbls(dev, mr->umem, mr->info.pbl_table,
-                           &mr->info.pbl_info);
+                           &mr->info.pbl_info, mr->umem->page_shift);
 
         rc = dev->ops->rdma_alloc_tid(dev->rdma_ctx, &mr->hw_mr.itid);
         if (rc) {
@@ -3209,6 +3219,10 @@ static int process_req(struct qedr_dev *dev, struct qedr_qp *qp,
                 case IB_WC_REG_MR:
                         qp->wqe_wr_id[qp->sq.cons].mr->info.completed++;
                         break;
+                case IB_WC_RDMA_READ:
+                case IB_WC_SEND:
+                        wc->byte_len = qp->wqe_wr_id[qp->sq.cons].bytes_len;
+                        break;
                 default:
                         break;
                 }
diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c
index fc8b88514da5..4ddbcac5eabe 100644
--- a/drivers/infiniband/hw/qib/qib_rc.c
+++ b/drivers/infiniband/hw/qib/qib_rc.c
@@ -1956,8 +1956,10 @@ send_last:
                 ret = qib_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
index ecdba2fce083..1ac5b8551a4d 100644
--- a/drivers/infiniband/sw/rxe/rxe.h
+++ b/drivers/infiniband/sw/rxe/rxe.h
@@ -68,6 +68,7 @@
 static inline u32 rxe_crc32(struct rxe_dev *rxe,
                             u32 crc, void *next, size_t len)
 {
+        u32 retval;
         int err;
 
         SHASH_DESC_ON_STACK(shash, rxe->tfm);
@@ -81,7 +82,9 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe,
                 return crc32_le(crc, next, len);
         }
 
-        return *(u32 *)shash_desc_ctx(shash);
+        retval = *(u32 *)shash_desc_ctx(shash);
+        barrier_data(shash_desc_ctx(shash));
+        return retval;
 }
 
 int rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 83d709e74dfb..073e66783f1d 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -740,13 +740,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr,
 
                 sge = ibwr->sg_list;
                 for (i = 0; i < num_sge; i++, sge++) {
-                        if (qp->is_user && copy_from_user(p, (__user void *)
-                                            (uintptr_t)sge->addr, sge->length))
-                                return -EFAULT;
-
-                        else if (!qp->is_user)
-                                memcpy(p, (void *)(uintptr_t)sge->addr,
-                                       sge->length);
+                        memcpy(p, (void *)(uintptr_t)sge->addr,
+                                        sge->length);
 
                         p += sge->length;
                 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 874b24366e4d..7871379342f4 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -178,7 +178,7 @@ static inline int ib_speed_enum_to_int(int speed)
 static int ipoib_get_link_ksettings(struct net_device *netdev,
                                     struct ethtool_link_ksettings *cmd)
 {
-        struct ipoib_dev_priv *priv = netdev_priv(netdev);
+        struct ipoib_dev_priv *priv = ipoib_priv(netdev);
         struct ib_port_attr attr;
         int ret, speed, width;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 0060b2f9f659..efe7402f4885 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -863,7 +863,6 @@ dev_stop:
         set_bit(IPOIB_STOP_REAPER, &priv->flags);
         cancel_delayed_work(&priv->ah_reap_task);
         set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
-        napi_enable(&priv->napi);
         ipoib_ib_dev_stop(dev);
         return -1;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2869d1adb1de..1015a63de6ae 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1590,12 +1590,14 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         wait_for_completion(&priv->ntbl.deleted);
 }
 
-void ipoib_dev_uninit_default(struct net_device *dev)
+static void ipoib_dev_uninit_default(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
 
         ipoib_transport_dev_cleanup(dev);
 
+        netif_napi_del(&priv->napi);
+
         ipoib_cm_dev_cleanup(dev);
 
         kfree(priv->rx_ring);
@@ -1649,6 +1651,7 @@ out_rx_ring_cleanup:
         kfree(priv->rx_ring);
 
 out:
+        netif_napi_del(&priv->napi);
         return -ENOMEM;
 }
 
@@ -2237,6 +2240,7 @@ event_failed:
 
 device_init_failed:
         free_netdev(priv->dev);
+        kfree(priv);
 
 alloc_mem_failed:
         return ERR_PTR(result);
@@ -2277,7 +2281,7 @@ static void ipoib_add_one(struct ib_device *device)
 
 static void ipoib_remove_one(struct ib_device *device, void *client_data)
 {
-        struct ipoib_dev_priv *priv, *tmp;
+        struct ipoib_dev_priv *priv, *tmp, *cpriv, *tcpriv;
         struct list_head *dev_list = client_data;
 
         if (!dev_list)
@@ -2300,7 +2304,14 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 flush_workqueue(priv->wq);
 
                 unregister_netdev(priv->dev);
-                free_netdev(priv->dev);
+                if (device->free_rdma_netdev)
+                        device->free_rdma_netdev(priv->dev);
+                else
+                        free_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        kfree(cpriv);
+
                 kfree(priv);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 36dc4fcaa3cd..081b33deff1b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -133,13 +133,13 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
         snprintf(intf_name, sizeof intf_name, "%s.%04x",
                  ppriv->dev->name, pkey);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
+
         priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
         if (!priv)
                 return -ENOMEM;
 
-        if (!rtnl_trylock())
-                return restart_syscall();
-
         down_write(&ppriv->vlan_rwsem);
 
         /*
@@ -167,8 +167,10 @@ out:
 
         rtnl_unlock();
 
-        if (result)
+        if (result) {
                 free_netdev(priv->dev);
+                kfree(priv);
+        }
 
         return result;
 }
@@ -209,6 +211,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
 
         if (dev) {
                 free_netdev(dev);
+                kfree(priv);
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index def723a5df29..2354c742caa1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -320,7 +320,7 @@ static int srp_new_cm_id(struct srp_rdma_ch *ch)
         ch->path.sgid = target->sgid;
         ch->path.dgid = target->orig_dgid;
         ch->path.pkey = target->pkey;
-        sa_path_set_service_id(&ch->path, target->service_id);
+        ch->path.service_id = target->service_id;
 
         return 0;
 }
@@ -575,7 +575,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
         return 0;
 
 err_qp:
-        srp_destroy_qp(ch, qp);
+        ib_destroy_qp(qp);
 
 err_send_cq:
         ib_free_cq(send_cq);
diff --git a/drivers/input/keyboard/tm2-touchkey.c b/drivers/input/keyboard/tm2-touchkey.c
index 485900f953e0..abc266e40e17 100644
--- a/drivers/input/keyboard/tm2-touchkey.c
+++ b/drivers/input/keyboard/tm2-touchkey.c
@@ -213,7 +213,7 @@ static int tm2_touchkey_probe(struct i2c_client *client,
         /* led device */
         touchkey->led_dev.name = TM2_TOUCHKEY_DEV_NAME;
         touchkey->led_dev.brightness = LED_FULL;
-        touchkey->led_dev.max_brightness = LED_FULL;
+        touchkey->led_dev.max_brightness = LED_ON;
         touchkey->led_dev.brightness_set = tm2_touchkey_led_brightness_set;
 
         error = devm_led_classdev_register(&client->dev, &touchkey->led_dev);
diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
index f11807db6979..400869e61a06 100644
--- a/drivers/input/misc/axp20x-pek.c
+++ b/drivers/input/misc/axp20x-pek.c
@@ -256,6 +256,42 @@ static int axp20x_pek_probe_input_device(struct axp20x_pek *axp20x_pek,
         return 0;
 }
 
+#ifdef CONFIG_ACPI
+static bool axp20x_pek_should_register_input(struct axp20x_pek *axp20x_pek,
+                                             struct platform_device *pdev)
+{
+        unsigned long long hrv = 0;
+        acpi_status status;
+
+        if (IS_ENABLED(CONFIG_INPUT_SOC_BUTTON_ARRAY) &&
+            axp20x_pek->axp20x->variant == AXP288_ID) {
+                status = acpi_evaluate_integer(ACPI_HANDLE(pdev->dev.parent),
+                                               "_HRV", NULL, &hrv);
+                if (ACPI_FAILURE(status))
+                        dev_err(&pdev->dev, "Failed to get PMIC hardware revision\n");
+
+                /*
+                 * On Cherry Trail platforms (hrv == 3), do not register the
+                 * input device if there is an "INTCFD9" or "ACPI0011" gpio
+                 * button ACPI device, as that handles the power button too,
+                 * and otherwise we end up reporting all presses twice.
+                 */
+                if (hrv == 3 && (acpi_dev_present("INTCFD9", NULL, -1) ||
+                                 acpi_dev_present("ACPI0011", NULL, -1)))
+                        return false;
+
+        }
+
+        return true;
+}
+#else
+static bool axp20x_pek_should_register_input(struct axp20x_pek *axp20x_pek,
+                                             struct platform_device *pdev)
+{
+        return true;
+}
+#endif
+
 static int axp20x_pek_probe(struct platform_device *pdev)
 {
         struct axp20x_pek *axp20x_pek;
@@ -268,13 +304,7 @@ static int axp20x_pek_probe(struct platform_device *pdev)
 
         axp20x_pek->axp20x = dev_get_drvdata(pdev->dev.parent);
 
-        /*
-         * Do not register the input device if there is an "INTCFD9"
-         * gpio button ACPI device, that handles the power button too,
-         * and otherwise we end up reporting all presses twice.
-         */
-        if (!acpi_dev_found("INTCFD9") ||
-            !IS_ENABLED(CONFIG_INPUT_SOC_BUTTON_ARRAY)) {
+        if (axp20x_pek_should_register_input(axp20x_pek, pdev)) {
                 error = axp20x_pek_probe_input_device(axp20x_pek, pdev);
                 if (error)
                         return error;
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index e37d37273182..f600f3a7a3c6 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -248,7 +248,8 @@ static struct soc_button_info *soc_button_get_button_info(struct device *dev)
 
         if (!btns_desc) {
                 dev_err(dev, "ACPI Button Descriptors not found\n");
-                return ERR_PTR(-ENODEV);
+                button_info = ERR_PTR(-ENODEV);
+                goto out;
         }
 
         /* The first package describes the collection */
@@ -264,24 +265,31 @@ static struct soc_button_info *soc_button_get_button_info(struct device *dev)
         }
         if (collection_uid == -1) {
                 dev_err(dev, "Invalid Button Collection Descriptor\n");
-                return ERR_PTR(-ENODEV);
+                button_info = ERR_PTR(-ENODEV);
+                goto out;
         }
 
         /* There are package.count - 1 buttons + 1 terminating empty entry */
         button_info = devm_kcalloc(dev, btns_desc->package.count,
                                    sizeof(*button_info), GFP_KERNEL);
-        if (!button_info)
-                return ERR_PTR(-ENOMEM);
+        if (!button_info) {
+                button_info = ERR_PTR(-ENOMEM);
+                goto out;
+        }
 
         /* Parse the button descriptors */
         for (i = 1, btn = 0; i < btns_desc->package.count; i++, btn++) {
                 if (soc_button_parse_btn_desc(dev,
                                               &btns_desc->package.elements[i],
                                               collection_uid,
-                                              &button_info[btn]))
-                        return ERR_PTR(-ENODEV);
+                                              &button_info[btn])) {
+                        button_info = ERR_PTR(-ENODEV);
+                        goto out;
+                }
         }
 
+out:
+        kfree(buf.pointer);
         return button_info;
 }
 
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index a679e56c44cd..f431da07f861 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -554,32 +554,34 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
                                      struct completion *completion)
 {
         struct device *dev = &client->dev;
-        long ret;
         int error;
         int len;
-        u8 buffer[ETP_I2C_INF_LENGTH];
+        u8 buffer[ETP_I2C_REPORT_LEN];
+
+        len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
+        if (len != ETP_I2C_REPORT_LEN) {
+                error = len < 0 ? len : -EIO;
+                dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
+                        error, len);
+        }
 
         reinit_completion(completion);
         enable_irq(client->irq);
 
         error = elan_i2c_write_cmd(client, ETP_I2C_STAND_CMD, ETP_I2C_RESET);
-        if (!error)
-                ret = wait_for_completion_interruptible_timeout(completion,
-                                                        msecs_to_jiffies(300));
-        disable_irq(client->irq);
-
         if (error) {
                 dev_err(dev, "device reset failed: %d\n", error);
-                return error;
-        } else if (ret == 0) {
+        } else if (!wait_for_completion_timeout(completion,
+                                                msecs_to_jiffies(300))) {
                 dev_err(dev, "timeout waiting for device reset\n");
-                return -ETIMEDOUT;
-        } else if (ret < 0) {
-                error = ret;
-                dev_err(dev, "error waiting for device reset: %d\n", error);
-                return error;
+                error = -ETIMEDOUT;
         }
 
+        disable_irq(client->irq);
+
+        if (error)
+                return error;
+
         len = i2c_master_recv(client, buffer, ETP_I2C_INF_LENGTH);
         if (len != ETP_I2C_INF_LENGTH) {
                 error = len < 0 ? len : -EIO;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index e73d968023f7..f1fa1f172107 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,8 +1118,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E546   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
+ * Fujitsu LIFEBOOK E557   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
@@ -1525,6 +1527,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E546  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -1546,6 +1555,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 131df9d3660f..16c30460ef04 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -176,6 +176,12 @@ static const char * const smbus_pnp_ids[] = {
         NULL
 };
 
+static const char * const forcepad_pnp_ids[] = {
+        "SYN300D",
+        "SYN3014",
+        NULL
+};
+
 /*
  * Send a command to the synpatics touchpad by special commands
  */
@@ -397,6 +403,8 @@ static int synaptics_query_hardware(struct psmouse *psmouse,
 {
         int error;
 
+        memset(info, 0, sizeof(*info));
+
         error = synaptics_identify(psmouse, info);
         if (error)
                 return error;
@@ -480,13 +488,6 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
         { }
 };
 
-/* This list has been kindly provided by Synaptics. */
-static const char * const forcepad_pnp_ids[] = {
-        "SYN300D",
-        "SYN3014",
-        NULL
-};
-
 /*****************************************************************************
  *      Synaptics communications functions
  ****************************************************************************/
@@ -1687,7 +1688,8 @@ enum {
         SYNAPTICS_INTERTOUCH_ON,
 };
 
-static int synaptics_intertouch = SYNAPTICS_INTERTOUCH_NOT_SET;
+static int synaptics_intertouch = IS_ENABLED(CONFIG_RMI4_SMB) ?
+                SYNAPTICS_INTERTOUCH_NOT_SET : SYNAPTICS_INTERTOUCH_OFF;
 module_param_named(synaptics_intertouch, synaptics_intertouch, int, 0644);
 MODULE_PARM_DESC(synaptics_intertouch, "Use a secondary bus for the Synaptics device.");
 
@@ -1737,8 +1739,16 @@ static int synaptics_setup_intertouch(struct psmouse *psmouse,
 
         if (synaptics_intertouch == SYNAPTICS_INTERTOUCH_NOT_SET) {
                 if (!psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
-                    !psmouse_matches_pnp_id(psmouse, smbus_pnp_ids))
+                    !psmouse_matches_pnp_id(psmouse, smbus_pnp_ids)) {
+
+                        if (!psmouse_matches_pnp_id(psmouse, forcepad_pnp_ids))
+                                psmouse_info(psmouse,
+                                             "Your touchpad (%s) says it can support a different bus. "
+                                             "If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org.\n",
+                                             psmouse->ps2dev.serio->firmware_id);
+
                         return -ENXIO;
+                }
         }
 
         psmouse_info(psmouse, "Trying to set up SMBus access\n");
@@ -1810,6 +1820,15 @@ int synaptics_init(struct psmouse *psmouse)
         }
 
         if (SYN_CAP_INTERTOUCH(info.ext_cap_0c)) {
+                if ((!IS_ENABLED(CONFIG_RMI4_SMB) ||
+                     !IS_ENABLED(CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS)) &&
+                    /* Forcepads need F21, which is not ready */
+                    !psmouse_matches_pnp_id(psmouse, forcepad_pnp_ids)) {
+                        psmouse_warn(psmouse,
+                                     "The touchpad can support a better bus than the too old PS/2 protocol. "
+                                     "Make sure MOUSE_PS2_SYNAPTICS_SMBUS and RMI4_SMB are enabled to get a better touchpad experience.\n");
+                }
+
                 error = synaptics_setup_intertouch(psmouse, &info, true);
                 if (!error)
                         return PSMOUSE_SYNAPTICS_SMBUS;
diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c
index 77dad045a468..ad71a5e768dc 100644
--- a/drivers/input/rmi4/rmi_f03.c
+++ b/drivers/input/rmi4/rmi_f03.c
@@ -146,7 +146,7 @@ static int rmi_f03_register_pt(struct f03_data *f03)
         if (!serio)
                 return -ENOMEM;
 
-        serio->id.type = SERIO_8042;
+        serio->id.type = SERIO_PS_PSTHRU;
         serio->write = rmi_f03_pt_write;
         serio->port_data = f03;
 
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
index dea63e2db3e6..f5206e2c767e 100644
--- a/drivers/input/rmi4/rmi_f54.c
+++ b/drivers/input/rmi4/rmi_f54.c
@@ -31,9 +31,6 @@
 #define F54_GET_REPORT          1
 #define F54_FORCE_CAL           2
 
-/* Fixed sizes of reports */
-#define F54_QUERY_LEN                   27
-
 /* F54 capabilities */
 #define F54_CAP_BASELINE        (1 << 2)
 #define F54_CAP_IMAGE8          (1 << 3)
@@ -95,7 +92,6 @@ struct rmi_f54_reports {
 struct f54_data {
         struct rmi_function *fn;
 
-        u8 qry[F54_QUERY_LEN];
         u8 num_rx_electrodes;
         u8 num_tx_electrodes;
         u8 capabilities;
@@ -632,22 +628,23 @@ static int rmi_f54_detect(struct rmi_function *fn)
 {
         int error;
         struct f54_data *f54;
+        u8 buf[6];
 
         f54 = dev_get_drvdata(&fn->dev);
 
         error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-                               &f54->qry, sizeof(f54->qry));
+                               buf, sizeof(buf));
         if (error) {
                 dev_err(&fn->dev, "%s: Failed to query F54 properties\n",
                         __func__);
                 return error;
         }
 
-        f54->num_rx_electrodes = f54->qry[0];
-        f54->num_tx_electrodes = f54->qry[1];
-        f54->capabilities = f54->qry[2];
-        f54->clock_rate = f54->qry[3] | (f54->qry[4] << 8);
-        f54->family = f54->qry[5];
+        f54->num_rx_electrodes = buf[0];
+        f54->num_tx_electrodes = buf[1];
+        f54->capabilities = buf[2];
+        f54->clock_rate = buf[3] | (buf[4] << 8);
+        f54->family = buf[5];
 
         rmi_dbg(RMI_DEBUG_FN, &fn->dev, "F54 num_rx_electrodes: %d\n",
                 f54->num_rx_electrodes);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 09720d950686..f932a83b4990 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -723,6 +723,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
                 },
         },
+        {
+                /* Fujitsu UH554 laptop */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 2302aef2b2d4..dd042a9b0aaa 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -350,6 +350,7 @@ static bool mxt_object_readable(unsigned int type)
         case MXT_TOUCH_KEYARRAY_T15:
         case MXT_TOUCH_PROXIMITY_T23:
         case MXT_TOUCH_PROXKEY_T52:
+        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
         case MXT_PROCI_GRIPFACE_T20:
         case MXT_PROCG_NOISE_T22:
         case MXT_PROCI_ONETOUCH_T24:
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 8cf8d8d5d4ef..f872817e81e4 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -471,7 +471,7 @@ static EDT_ATTR(gain, S_IWUSR | S_IRUGO, WORK_REGISTER_GAIN,
 static EDT_ATTR(offset, S_IWUSR | S_IRUGO, WORK_REGISTER_OFFSET,
                 M09_REGISTER_OFFSET, 0, 31);
 static EDT_ATTR(threshold, S_IWUSR | S_IRUGO, WORK_REGISTER_THRESHOLD,
-                M09_REGISTER_THRESHOLD, 20, 80);
+                M09_REGISTER_THRESHOLD, 0, 80);
 static EDT_ATTR(report_rate, S_IWUSR | S_IRUGO, WORK_REGISTER_REPORT_RATE,
                 NO_REGISTER, 3, 14);
 
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index 813dd68a5c82..0dbcf105f7db 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -526,6 +526,7 @@ static int __maybe_unused silead_ts_suspend(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
 
+        disable_irq(client->irq);
         silead_ts_set_power(client, SILEAD_POWER_OFF);
         return 0;
 }
@@ -551,6 +552,8 @@ static int __maybe_unused silead_ts_resume(struct device *dev)
                 return -ENODEV;
         }
 
+        enable_irq(client->irq);
+
         return 0;
 }
 
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 63cacf5d6cf2..0f1219fa8561 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3879,11 +3879,9 @@ static void irte_ga_prepare(void *entry,
                             u8 vector, u32 dest_apicid, int devid)
 {
         struct irte_ga *irte = (struct irte_ga *) entry;
-        struct iommu_dev_data *dev_data = search_dev_data(devid);
 
         irte->lo.val                      = 0;
         irte->hi.val                      = 0;
-        irte->lo.fields_remap.guest_mode  = dev_data ? dev_data->use_vapic : 0;
         irte->lo.fields_remap.int_type    = delivery_mode;
         irte->lo.fields_remap.dm          = dest_mode;
         irte->hi.fields.vector            = vector;
@@ -3939,10 +3937,10 @@ static void irte_ga_set_affinity(void *entry, u16 devid, u16 index,
         struct irte_ga *irte = (struct irte_ga *) entry;
         struct iommu_dev_data *dev_data = search_dev_data(devid);
 
-        if (!dev_data || !dev_data->use_vapic) {
+        if (!dev_data || !dev_data->use_vapic ||
+            !irte->lo.fields_remap.guest_mode) {
                 irte->hi.fields.vector = vector;
                 irte->lo.fields_remap.destination = dest_apicid;
-                irte->lo.fields_remap.guest_mode = 0;
                 modify_irte_ga(devid, index, irte, NULL);
         }
 }
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index 9f44ee8ea1bc..19779b88a479 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -118,6 +118,7 @@ static const struct iommu_ops
 
         ops = iommu_ops_from_fwnode(fwnode);
         if ((ops && !ops->of_xlate) ||
+            !of_device_is_available(iommu_spec->np) ||
             (!ops && !of_iommu_driver_present(iommu_spec->np)))
                 return NULL;
 
@@ -236,6 +237,12 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
                         ops = ERR_PTR(err);
         }
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index eb7fbe159963..929f8558bf1c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -140,7 +140,7 @@ static inline void gic_map_to_vpe(unsigned int intr, unsigned int vpe)
 }
 
 #ifdef CONFIG_CLKSRC_MIPS_GIC
-u64 gic_read_count(void)
+u64 notrace gic_read_count(void)
 {
         unsigned int hi, hi2, lo;
 
@@ -167,7 +167,7 @@ unsigned int gic_get_count_width(void)
         return bits;
 }
 
-void gic_write_compare(u64 cnt)
+void notrace gic_write_compare(u64 cnt)
 {
         if (mips_cm_is64) {
                 gic_write(GIC_REG(VPE_LOCAL, GIC_VPE_COMPARE), cnt);
@@ -179,7 +179,7 @@ void gic_write_compare(u64 cnt)
         }
 }
 
-void gic_write_cpu_compare(u64 cnt, int cpu)
+void notrace gic_write_cpu_compare(u64 cnt, int cpu)
 {
         unsigned long flags;
 
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index bb3ac5fe5846..72a391e01011 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = {
 int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_mx_irq_domain_ops,
                                 &xtensa_mx_irq_chip);
         irq_set_default_host(root_domain);
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index 472ae1770964..f728755fa292 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = {
 int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_irq_domain_ops, &xtensa_irq_chip);
         irq_set_default_host(root_domain);
         return 0;
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index d07dd5196ffc..8aa158a09180 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
                        id);
                 return NULL;
         } else {
-                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
                 if (!rs)
                         return NULL;
                 rs->state = CCPResetIdle;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 8b7faea2ddf8..422dced7c90a 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -75,7 +75,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
                 if (sk->sk_state != MISDN_BOUND)
                         continue;
                 if (!cskb)
-                        cskb = skb_copy(skb, GFP_KERNEL);
+                        cskb = skb_copy(skb, GFP_ATOMIC);
                 if (!cskb) {
                         printk(KERN_WARNING "%s no skb\n", __func__);
                         break;
diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
index 1548259297c1..2cfd9389ee96 100644
--- a/drivers/leds/leds-bcm6328.c
+++ b/drivers/leds/leds-bcm6328.c
@@ -242,7 +242,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << (((sel % 4) * 4) + 16));
+                val |= (BIT(reg % 4) << (((sel % 4) * 4) + 16));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
@@ -269,7 +269,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << ((sel % 4) * 4));
+                val |= (BIT(reg % 4) << ((sel % 4) * 4));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 78a7ce816a47..9a873118ea5f 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -285,7 +285,7 @@ static int pca955x_probe(struct i2c_client *client,
                         "slave address 0x%02x\n",
                         client->name, chip->bits, client->addr);
 
-        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -EIO;
 
         if (pdata) {
diff --git a/drivers/leds/trigger/ledtrig-heartbeat.c b/drivers/leds/trigger/ledtrig-heartbeat.c
index afa3b4099214..e95ea65380c8 100644
--- a/drivers/leds/trigger/ledtrig-heartbeat.c
+++ b/drivers/leds/trigger/ledtrig-heartbeat.c
@@ -20,7 +20,6 @@
 #include <linux/sched/loadavg.h>
 #include <linux/leds.h>
 #include <linux/reboot.h>
-#include <linux/suspend.h>
 #include "../leds.h"
 
 static int panic_heartbeats;
@@ -163,30 +162,6 @@ static struct led_trigger heartbeat_led_trigger = {
         .deactivate = heartbeat_trig_deactivate,
 };
 
-static int heartbeat_pm_notifier(struct notifier_block *nb,
-                                 unsigned long pm_event, void *unused)
-{
-        int rc;
-
-        switch (pm_event) {
-        case PM_SUSPEND_PREPARE:
-        case PM_HIBERNATION_PREPARE:
-        case PM_RESTORE_PREPARE:
-                led_trigger_unregister(&heartbeat_led_trigger);
-                break;
-        case PM_POST_SUSPEND:
-        case PM_POST_HIBERNATION:
-        case PM_POST_RESTORE:
-                rc = led_trigger_register(&heartbeat_led_trigger);
-                if (rc)
-                        pr_err("could not re-register heartbeat trigger\n");
-                break;
-        default:
-                break;
-        }
-        return NOTIFY_DONE;
-}
-
 static int heartbeat_reboot_notifier(struct notifier_block *nb,
                                      unsigned long code, void *unused)
 {
@@ -201,10 +176,6 @@ static int heartbeat_panic_notifier(struct notifier_block *nb,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block heartbeat_pm_nb = {
-        .notifier_call = heartbeat_pm_notifier,
-};
-
 static struct notifier_block heartbeat_reboot_nb = {
         .notifier_call = heartbeat_reboot_notifier,
 };
@@ -221,14 +192,12 @@ static int __init heartbeat_trig_init(void)
                 atomic_notifier_chain_register(&panic_notifier_list,
                                                &heartbeat_panic_nb);
                 register_reboot_notifier(&heartbeat_reboot_nb);
-                register_pm_notifier(&heartbeat_pm_nb);
         }
         return rc;
 }
 
 static void __exit heartbeat_trig_exit(void)
 {
-        unregister_pm_notifier(&heartbeat_pm_nb);
         unregister_reboot_notifier(&heartbeat_reboot_nb);
         atomic_notifier_chain_unregister(&panic_notifier_list,
                                          &heartbeat_panic_nb);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index bf7419a56454..f4eace5ea184 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -485,10 +485,10 @@ void bitmap_print_sb(struct bitmap *bitmap)
         pr_debug("         magic: %08x\n", le32_to_cpu(sb->magic));
         pr_debug("       version: %d\n", le32_to_cpu(sb->version));
         pr_debug("          uuid: %08x.%08x.%08x.%08x\n",
-                 *(__u32 *)(sb->uuid+0),
-                 *(__u32 *)(sb->uuid+4),
-                 *(__u32 *)(sb->uuid+8),
-                 *(__u32 *)(sb->uuid+12));
+                 le32_to_cpu(*(__u32 *)(sb->uuid+0)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+4)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+8)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+12)));
         pr_debug("        events: %llu\n",
                  (unsigned long long) le64_to_cpu(sb->events));
         pr_debug("events cleared: %llu\n",
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index cd8139593ccd..840c1496b2b1 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1334,7 +1334,7 @@ int dm_bufio_issue_flush(struct dm_bufio_client *c)
 {
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = c->dm_io,
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index c7f7c8d76576..93b181088168 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -783,7 +783,8 @@ static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsi
                         for (i = 0; i < commit_sections; i++)
                                 rw_section_mac(ic, commit_start + i, true);
                 }
-                rw_journal(ic, REQ_OP_WRITE, REQ_FUA, commit_start, commit_sections, &io_comp);
+                rw_journal(ic, REQ_OP_WRITE, REQ_FUA | REQ_SYNC, commit_start,
+                           commit_sections, &io_comp);
         } else {
                 unsigned to_end;
                 io_comp.in_flight = (atomic_t)ATOMIC_INIT(2);
@@ -1104,10 +1105,13 @@ static void schedule_autocommit(struct dm_integrity_c *ic)
 static void submit_flush_bio(struct dm_integrity_c *ic, struct dm_integrity_io *dio)
 {
         struct bio *bio;
-        spin_lock_irq(&ic->endio_wait.lock);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ic->endio_wait.lock, flags);
         bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
         bio_list_add(&ic->flush_bio_list, bio);
-        spin_unlock_irq(&ic->endio_wait.lock);
+        spin_unlock_irqrestore(&ic->endio_wait.lock, flags);
+
         queue_work(ic->commit_wq, &ic->commit_work);
 }
 
@@ -2374,21 +2378,6 @@ static void dm_integrity_set(struct dm_target *ti, struct dm_integrity_c *ic)
         blk_queue_max_integrity_segments(disk->queue, UINT_MAX);
 }
 
-/* FIXME: use new kvmalloc */
-static void *dm_integrity_kvmalloc(size_t size, gfp_t gfp)
-{
-        void *ptr = NULL;
-
-        if (size <= PAGE_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | gfp);
-        if (!ptr && size <= KMALLOC_MAX_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | gfp);
-        if (!ptr)
-                ptr = __vmalloc(size, GFP_KERNEL | gfp, PAGE_KERNEL);
-
-        return ptr;
-}
-
 static void dm_integrity_free_page_list(struct dm_integrity_c *ic, struct page_list *pl)
 {
         unsigned i;
@@ -2407,7 +2396,7 @@ static struct page_list *dm_integrity_alloc_page_list(struct dm_integrity_c *ic)
         struct page_list *pl;
         unsigned i;
 
-        pl = dm_integrity_kvmalloc(page_list_desc_size, __GFP_ZERO);
+        pl = kvmalloc(page_list_desc_size, GFP_KERNEL | __GFP_ZERO);
         if (!pl)
                 return NULL;
 
@@ -2437,7 +2426,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
         struct scatterlist **sl;
         unsigned i;
 
-        sl = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), __GFP_ZERO);
+        sl = kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), GFP_KERNEL | __GFP_ZERO);
         if (!sl)
                 return NULL;
 
@@ -2453,7 +2442,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
 
                 n_pages = (end_index - start_index + 1);
 
-                s = dm_integrity_kvmalloc(n_pages * sizeof(struct scatterlist), 0);
+                s = kvmalloc(n_pages * sizeof(struct scatterlist), GFP_KERNEL);
                 if (!s) {
                         dm_integrity_free_journal_scatterlist(ic, sl);
                         return NULL;
@@ -2617,7 +2606,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 goto bad;
                         }
 
-                        sg = dm_integrity_kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), 0);
+                        sg = kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), GFP_KERNEL);
                         if (!sg) {
                                 *error = "Unable to allocate sg list";
                                 r = -ENOMEM;
@@ -2673,7 +2662,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 r = -ENOMEM;
                                 goto bad;
                         }
-                        ic->sk_requests = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), __GFP_ZERO);
+                        ic->sk_requests = kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), GFP_KERNEL | __GFP_ZERO);
                         if (!ic->sk_requests) {
                                 *error = "Unable to allocate sk requests";
                                 r = -ENOMEM;
@@ -2740,7 +2729,7 @@ retest_commit_id:
                 r = -ENOMEM;
                 goto bad;
         }
-        ic->journal_tree = dm_integrity_kvmalloc(journal_tree_size, 0);
+        ic->journal_tree = kvmalloc(journal_tree_size, GFP_KERNEL);
         if (!ic->journal_tree) {
                 *error = "Could not allocate memory for journal tree";
                 r = -ENOMEM;
@@ -3054,6 +3043,11 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 ti->error = "The device is too small";
                 goto bad;
         }
+        if (ti->len > ic->provided_data_sectors) {
+                r = -EINVAL;
+                ti->error = "Not enough provided sectors for requested mapping size";
+                goto bad;
+        }
 
         if (!buffer_sectors)
                 buffer_sectors = 1;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 3702e502466d..8d5ca30f6551 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -317,8 +317,8 @@ static void do_region(int op, int op_flags, unsigned region,
         else if (op == REQ_OP_WRITE_SAME)
                 special_cmd_max_sectors = q->limits.max_write_same_sectors;
         if ((op == REQ_OP_DISCARD || op == REQ_OP_WRITE_ZEROES ||
-             op == REQ_OP_WRITE_SAME)  &&
-            special_cmd_max_sectors == 0) {
+             op == REQ_OP_WRITE_SAME) && special_cmd_max_sectors == 0) {
+                atomic_inc(&io->count);
                 dec_count(io, region, -EOPNOTSUPP);
                 return;
         }
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 0555b4410e05..41852ae287a5 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1710,12 +1710,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
         }
 
         /*
-         * Try to avoid low memory issues when a device is suspended.
+         * Use __GFP_HIGH to avoid low memory issues when a device is
+         * suspended and the ioctl is needed to resume it.
          * Use kmalloc() rather than vmalloc() when we can.
          */
         dmi = NULL;
         noio_flag = memalloc_noio_save();
-        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL);
+        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL | __GFP_HIGH);
         memalloc_noio_restore(noio_flag);
 
         if (!dmi) {
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 7d893228c40f..b4b75dad816a 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -1927,7 +1927,7 @@ struct dm_raid_superblock {
         /********************************************************************
          * BELOW FOLLOW V1.9.0 EXTENSIONS TO THE PRISTINE SUPERBLOCK FORMAT!!!
          *
-         * FEATURE_FLAG_SUPPORTS_V190 in the features member indicates that those exist
+         * FEATURE_FLAG_SUPPORTS_V190 in the compat_features member indicates that those exist
          */
 
         __le32 flags; /* Flags defining array states for reshaping */
@@ -2092,6 +2092,11 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
         sb->layout = cpu_to_le32(mddev->layout);
         sb->stripe_sectors = cpu_to_le32(mddev->chunk_sectors);
 
+        /********************************************************************
+         * BELOW FOLLOW V1.9.0 EXTENSIONS TO THE PRISTINE SUPERBLOCK FORMAT!!!
+         *
+         * FEATURE_FLAG_SUPPORTS_V190 in the compat_features member indicates that those exist
+         */
         sb->new_level = cpu_to_le32(mddev->new_level);
         sb->new_layout = cpu_to_le32(mddev->new_layout);
         sb->new_stripe_sectors = cpu_to_le32(mddev->new_chunk_sectors);
@@ -2438,8 +2443,14 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
         mddev->bitmap_info.default_offset = mddev->bitmap_info.offset;
 
         if (!test_and_clear_bit(FirstUse, &rdev->flags)) {
-                /* Retrieve device size stored in superblock to be prepared for shrink */
-                rdev->sectors = le64_to_cpu(sb->sectors);
+                /*
+                 * Retrieve rdev size stored in superblock to be prepared for shrink.
+                 * Check extended superblock members are present otherwise the size
+                 * will not be set!
+                 */
+                if (le32_to_cpu(sb->compat_features) & FEATURE_FLAG_SUPPORTS_V190)
+                        rdev->sectors = le64_to_cpu(sb->sectors);
+
                 rdev->recovery_offset = le64_to_cpu(sb->disk_recovery_offset);
                 if (rdev->recovery_offset == MaxSector)
                         set_bit(In_sync, &rdev->flags);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index a95cbb80fb34..4da8858856fb 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -145,6 +145,7 @@ static void dispatch_bios(void *context, struct bio_list *bio_list)
 
 struct dm_raid1_bio_record {
         struct mirror *m;
+        /* if details->bi_bdev == NULL, details were not saved */
         struct dm_bio_details details;
         region_t write_region;
 };
@@ -260,7 +261,7 @@ static int mirror_flush(struct dm_target *ti)
         struct mirror *m;
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = ms->io_client,
@@ -1198,6 +1199,8 @@ static int mirror_map(struct dm_target *ti, struct bio *bio)
         struct dm_raid1_bio_record *bio_record =
           dm_per_bio_data(bio, sizeof(struct dm_raid1_bio_record));
 
+        bio_record->details.bi_bdev = NULL;
+
         if (rw == WRITE) {
                 /* Save region for mirror_end_io() handler */
                 bio_record->write_region = dm_rh_bio_to_region(ms->rh, bio);
@@ -1256,12 +1259,22 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
         }
 
         if (error == -EOPNOTSUPP)
-                return error;
+                goto out;
 
         if ((error == -EWOULDBLOCK) && (bio->bi_opf & REQ_RAHEAD))
-                return error;
+                goto out;
 
         if (unlikely(error)) {
+                if (!bio_record->details.bi_bdev) {
+                        /*
+                         * There wasn't enough memory to record necessary
+                         * information for a retry or there was no other
+                         * mirror in-sync.
+                         */
+                        DMERR_LIMIT("Mirror read failed.");
+                        return -EIO;
+                }
+
                 m = bio_record->m;
 
                 DMERR("Mirror read failed from %s. Trying alternative device.",
@@ -1277,6 +1290,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                         bd = &bio_record->details;
 
                         dm_bio_restore(bd, bio);
+                        bio_record->details.bi_bdev = NULL;
                         bio->bi_error = 0;
 
                         queue_bio(ms, bio, rw);
@@ -1285,6 +1299,9 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                 DMERR("All replicated volumes dead, failing I/O");
         }
 
+out:
+        bio_record->details.bi_bdev = NULL;
+
         return error;
 }
 
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index b93476c3ba3f..c5534d294773 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -741,7 +741,8 @@ static void persistent_commit_exception(struct dm_exception_store *store,
         /*
          * Commit exceptions to disk.
          */
-        if (ps->valid && area_io(ps, REQ_OP_WRITE, REQ_PREFLUSH | REQ_FUA))
+        if (ps->valid && area_io(ps, REQ_OP_WRITE,
+                                 REQ_PREFLUSH | REQ_FUA | REQ_SYNC))
                 ps->valid = 0;
 
         /*
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 17ad50daed08..28808e5ec0fd 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1094,6 +1094,19 @@ static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m)
                 return;
         }
 
+        /*
+         * Increment the unmapped blocks.  This prevents a race between the
+         * passdown io and reallocation of freed blocks.
+         */
+        r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
+        if (r) {
+                metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
+                bio_io_error(m->bio);
+                cell_defer_no_holder(tc, m->cell);
+                mempool_free(m, pool->mapping_pool);
+                return;
+        }
+
         discard_parent = bio_alloc(GFP_NOIO, 1);
         if (!discard_parent) {
                 DMWARN("%s: unable to allocate top level discard bio for passdown. Skipping passdown.",
@@ -1114,19 +1127,6 @@ static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m)
                         end_discard(&op, r);
                 }
         }
-
-        /*
-         * Increment the unmapped blocks.  This prevents a race between the
-         * passdown io and reallocation of freed blocks.
-         */
-        r = dm_pool_inc_data_range(pool->pmd, m->data_block, data_end);
-        if (r) {
-                metadata_operation_failed(pool, "dm_pool_inc_data_range", r);
-                bio_io_error(m->bio);
-                cell_defer_no_holder(tc, m->cell);
-                mempool_free(m, pool->mapping_pool);
-                return;
-        }
 }
 
 static void process_prepared_discard_passdown_pt2(struct dm_thin_new_mapping *m)
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 97de961a3bfc..1ec9b2c51c07 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -166,7 +166,7 @@ static int verity_hash_init(struct dm_verity *v, struct ahash_request *req,
                 return r;
         }
 
-        if (likely(v->version >= 1))
+        if (likely(v->salt_size && (v->version >= 1)))
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
         return r;
@@ -177,7 +177,7 @@ static int verity_hash_final(struct dm_verity *v, struct ahash_request *req,
 {
         int r;
 
-        if (unlikely(!v->version)) {
+        if (unlikely(v->salt_size && (!v->version))) {
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
                 if (r < 0) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6ef9500226c0..37ccd73c79ec 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1657,7 +1657,7 @@ static struct mapped_device *alloc_dev(int minor)
 
         bio_init(&md->flush_bio, NULL, 0);
         md->flush_bio.bi_bdev = md->bdev;
-        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
 
         dm_stats_init(&md->stats);
 
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 7299ce2f08a8..03082e17c65c 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1311,8 +1311,10 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev)
         cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
         lock_comm(cinfo, 1);
         ret = __sendmsg(cinfo, &cmsg);
-        if (ret)
+        if (ret) {
+                unlock_comm(cinfo);
                 return ret;
+        }
         cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE;
         ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX);
         cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 10367ffe92e3..87edc342ccb3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -765,7 +765,7 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
             test_bit(FailFast, &rdev->flags) &&
             !test_bit(LastDev, &rdev->flags))
                 ff = MD_FAILFAST;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_FUA | ff;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff;
 
         atomic_inc(&mddev->pending_writes);
         submit_bio(bio);
@@ -5174,6 +5174,18 @@ static void mddev_delayed_delete(struct work_struct *ws)
 
 static void no_op(struct percpu_ref *r) {}
 
+int mddev_init_writes_pending(struct mddev *mddev)
+{
+        if (mddev->writes_pending.percpu_count_ptr)
+                return 0;
+        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
+                return -ENOMEM;
+        /* We want to start with the refcount at zero */
+        percpu_ref_put(&mddev->writes_pending);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_init_writes_pending);
+
 static int md_alloc(dev_t dev, char *name)
 {
         /*
@@ -5239,10 +5251,6 @@ static int md_alloc(dev_t dev, char *name)
         blk_queue_make_request(mddev->queue, md_make_request);
         blk_set_stacking_limits(&mddev->queue->limits);
 
-        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
-                goto abort;
-        /* We want to start with the refcount at zero */
-        percpu_ref_put(&mddev->writes_pending);
         disk = alloc_disk(1 << shift);
         if (!disk) {
                 blk_cleanup_queue(mddev->queue);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 11f15146ce51..0fa1de42c42b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -648,6 +648,7 @@ extern void md_unregister_thread(struct md_thread **threadp);
 extern void md_wakeup_thread(struct md_thread *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
+extern int mddev_init_writes_pending(struct mddev *mddev);
 extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af5056d56878..e1a7e3d4c5e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3063,6 +3063,8 @@ static int raid1_run(struct mddev *mddev)
                         mdname(mddev));
                 return -EIO;
         }
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
         /*
          * copy the already verified devices into our private RAID1
          * bookkeeping area. [whatever we allocate in run(),
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4343d7ff9916..797ed60abd5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3611,6 +3611,9 @@ static int raid10_run(struct mddev *mddev)
         int first = 1;
         bool discard_supported = false;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->private == NULL) {
                 conf = setup_conf(mddev);
                 if (IS_ERR(conf))
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 4c00bc248287..0a7af8b0a80a 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1782,7 +1782,7 @@ static int r5l_log_write_empty_meta_block(struct r5l_log *log, sector_t pos,
         mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                              mb, PAGE_SIZE));
         if (!sync_page_io(log->rdev, pos, PAGE_SIZE, page, REQ_OP_WRITE,
-                          REQ_FUA, false)) {
+                          REQ_SYNC | REQ_FUA, false)) {
                 __free_page(page);
                 return -EIO;
         }
@@ -2388,7 +2388,7 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                 mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                                      mb, PAGE_SIZE));
                 sync_page_io(log->rdev, ctx->pos, PAGE_SIZE, page,
-                             REQ_OP_WRITE, REQ_FUA, false);
+                             REQ_OP_WRITE, REQ_SYNC | REQ_FUA, false);
                 sh->log_start = ctx->pos;
                 list_add_tail(&sh->r5c, &log->stripe_in_journal_list);
                 atomic_inc(&log->stripe_in_journal_count);
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 5d25bebf3328..ccce92e68d7f 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -907,8 +907,8 @@ static int ppl_write_empty_header(struct ppl_log *log)
         pplhdr->checksum = cpu_to_le32(~crc32c_le(~0, pplhdr, PAGE_SIZE));
 
         if (!sync_page_io(rdev, rdev->ppl.sector - rdev->data_offset,
-                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_FUA, 0,
-                          false)) {
+                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_SYNC |
+                          REQ_FUA, 0, false)) {
                 md_error(rdev->mddev, rdev);
                 ret = -EIO;
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 9c4f7659f8b1..ec0f951ae19f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4085,10 +4085,15 @@ static void handle_parity_checks5(struct r5conf *conf, struct stripe_head *sh,
                         set_bit(STRIPE_INSYNC, &sh->state);
                 else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 sh->check_state = check_state_compute_run;
                                 set_bit(STRIPE_COMPUTE_RUN, &sh->state);
                                 set_bit(STRIPE_OP_COMPUTE_BLK, &s->ops_request);
@@ -4237,10 +4242,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
                         }
                 } else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 int *target = &sh->ops.target;
 
                                 sh->ops.target = -1;
@@ -7108,6 +7118,9 @@ static int raid5_run(struct mddev *mddev)
         long long min_offset_diff = 0;
         int first = 1;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->recovery_cp != MaxSector)
                 pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
                           mdname(mddev));
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index b72edd27f880..55d9c2b82b7e 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -2,6 +2,12 @@
 # Multimedia device configuration
 #
 
+config CEC_CORE
+        tristate
+
+config CEC_NOTIFIER
+        bool
+
 menuconfig MEDIA_SUPPORT
         tristate "Multimedia support"
         depends on HAS_IOMEM
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 523fea3648ad..044503aa8801 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -4,8 +4,6 @@
 
 media-objs      := media-device.o media-devnode.o media-entity.o
 
-obj-$(CONFIG_CEC_CORE) += cec/
-
 #
 # I2C drivers should come before other drivers, otherwise they'll fail
 # when compiled as builtin drivers
@@ -26,6 +24,8 @@ obj-$(CONFIG_DVB_CORE)  += dvb-core/
 # There are both core and drivers at RC subtree - merge before drivers
 obj-y += rc/
 
+obj-$(CONFIG_CEC_CORE) += cec/
+
 #
 # Finally, merge the drivers that require the core
 #
diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig
index f944d93e3167..43428cec3a01 100644
--- a/drivers/media/cec/Kconfig
+++ b/drivers/media/cec/Kconfig
@@ -1,19 +1,6 @@
-config CEC_CORE
-        tristate
-        depends on MEDIA_CEC_SUPPORT
-        default y
-
-config MEDIA_CEC_NOTIFIER
-        bool
-
 config MEDIA_CEC_RC
         bool "HDMI CEC RC integration"
         depends on CEC_CORE && RC_CORE
+        depends on CEC_CORE=m || RC_CORE=y
         ---help---
           Pass on CEC remote control messages to the RC framework.
-
-config MEDIA_CEC_DEBUG
-        bool "HDMI CEC debugfs interface"
-        depends on CEC_CORE && DEBUG_FS
-        ---help---
-          Turns on the DebugFS interface for CEC devices.
diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
index 402a6c62a3e8..eaf408e64669 100644
--- a/drivers/media/cec/Makefile
+++ b/drivers/media/cec/Makefile
@@ -1,6 +1,6 @@
 cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
 
-ifeq ($(CONFIG_MEDIA_CEC_NOTIFIER),y)
+ifeq ($(CONFIG_CEC_NOTIFIER),y)
   cec-objs += cec-notifier.o
 endif
 
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index f5fe01c9da8a..9dfc79800c71 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1864,7 +1864,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
 }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
 /*
  * Log the current state of the CEC adapter.
  * Very useful for debugging.
diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 0860fb458757..999926f731c8 100644
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -271,16 +271,10 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh,
                         bool block, struct cec_msg __user *parg)
 {
         struct cec_msg msg = {};
-        long err = 0;
+        long err;
 
         if (copy_from_user(&msg, parg, sizeof(msg)))
                 return -EFAULT;
-        mutex_lock(&adap->lock);
-        if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR)
-                err = -ENONET;
-        mutex_unlock(&adap->lock);
-        if (err)
-                return err;
 
         err = cec_receive_msg(fh, &msg, block);
         if (err)
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index f9ebff90f8eb..2f87748ba4fc 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -187,7 +187,7 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
         put_device(&devnode->dev);
 }
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 static void cec_cec_notify(struct cec_adapter *adap, u16 pa)
 {
         cec_s_phys_addr(adap, pa, false);
@@ -323,7 +323,7 @@ int cec_register_adapter(struct cec_adapter *adap,
         }
 
         dev_set_drvdata(&adap->devnode.dev, adap);
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         if (!top_cec_dir)
                 return 0;
 
@@ -355,7 +355,7 @@ void cec_unregister_adapter(struct cec_adapter *adap)
         adap->rc = NULL;
 #endif
         debugfs_remove_recursive(adap->cec_dir);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         if (adap->notifier)
                 cec_notifier_unregister(adap->notifier);
 #endif
@@ -395,7 +395,7 @@ static int __init cec_devnode_init(void)
                 return ret;
         }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         top_cec_dir = debugfs_create_dir("cec", NULL);
         if (IS_ERR_OR_NULL(top_cec_dir)) {
                 pr_warn("cec: Failed to create debugfs cec dir\n");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index fd181c99ce11..aaa9471c7d11 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -220,7 +220,8 @@ config VIDEO_ADV7604
 
 config VIDEO_ADV7604_CEC
         bool "Enable Analog Devices ADV7604 CEC support"
-        depends on VIDEO_ADV7604 && CEC_CORE
+        depends on VIDEO_ADV7604
+        select CEC_CORE
         ---help---
           When selected the adv7604 will support the optional
           HDMI CEC feature.
@@ -240,7 +241,8 @@ config VIDEO_ADV7842
 
 config VIDEO_ADV7842_CEC
         bool "Enable Analog Devices ADV7842 CEC support"
-        depends on VIDEO_ADV7842 && CEC_CORE
+        depends on VIDEO_ADV7842
+        select CEC_CORE
         ---help---
           When selected the adv7842 will support the optional
           HDMI CEC feature.
@@ -478,7 +480,8 @@ config VIDEO_ADV7511
 
 config VIDEO_ADV7511_CEC
         bool "Enable Analog Devices ADV7511 CEC support"
-        depends on VIDEO_ADV7511 && CEC_CORE
+        depends on VIDEO_ADV7511
+        select CEC_CORE
         ---help---
           When selected the adv7511 will support the optional
           HDMI CEC feature.
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index acef4eca269f..3251cba89e8f 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -223,7 +223,7 @@ static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val)
 static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg,
                 u8 mask, u8 val)
 {
-        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2);
+        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1);
 }
 
 static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index ac026ee1ca07..041cb80a26b1 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -501,8 +501,9 @@ if CEC_PLATFORM_DRIVERS
 
 config VIDEO_SAMSUNG_S5P_CEC
        tristate "Samsung S5P CEC driver"
-       depends on CEC_CORE && (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for Samsung S5P HDMI CEC interface. It uses the
          generic CEC framework interface.
@@ -511,8 +512,9 @@ config VIDEO_SAMSUNG_S5P_CEC
 
 config VIDEO_STI_HDMI_CEC
        tristate "STMicroelectronics STiH4xx HDMI CEC driver"
-       depends on CEC_CORE && (ARCH_STI || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on ARCH_STI || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for STIH4xx HDMI CEC interface. It uses the
          generic CEC framework interface.
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
index 57a842ff3097..b7731b18ecae 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
@@ -493,10 +493,10 @@ static int vdec_h264_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_h264_if = {
-        vdec_h264_init,
-        vdec_h264_decode,
-        vdec_h264_get_param,
-        vdec_h264_deinit,
+        .init           = vdec_h264_init,
+        .decode         = vdec_h264_decode,
+        .get_param      = vdec_h264_get_param,
+        .deinit         = vdec_h264_deinit,
 };
 
 struct vdec_common_if *get_h264_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
index 6e7a62ae0842..b9fad6a48879 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
@@ -620,10 +620,10 @@ static void vdec_vp8_deinit(unsigned long h_vdec)
 }
 
 static struct vdec_common_if vdec_vp8_if = {
-        vdec_vp8_init,
-        vdec_vp8_decode,
-        vdec_vp8_get_param,
-        vdec_vp8_deinit,
+        .init           = vdec_vp8_init,
+        .decode         = vdec_vp8_decode,
+        .get_param      = vdec_vp8_get_param,
+        .deinit         = vdec_vp8_deinit,
 };
 
 struct vdec_common_if *get_vp8_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index 5539b1853f16..1daee1207469 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -979,10 +979,10 @@ static int vdec_vp9_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_vp9_if = {
-        vdec_vp9_init,
-        vdec_vp9_decode,
-        vdec_vp9_get_param,
-        vdec_vp9_deinit,
+        .init           = vdec_vp9_init,
+        .decode         = vdec_vp9_decode,
+        .get_param      = vdec_vp9_get_param,
+        .deinit         = vdec_vp9_deinit,
 };
 
 struct vdec_common_if *get_vp9_dec_comm_if(void);
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index b36ac19dc6e4..154de92dd809 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -26,7 +26,8 @@ config VIDEO_VIVID
 
 config VIDEO_VIVID_CEC
         bool "Enable CEC emulation support"
-        depends on VIDEO_VIVID && CEC_CORE
+        depends on VIDEO_VIVID
+        select CEC_CORE
         ---help---
           When selected the vivid module will emulate the optional
           HDMI CEC feature.
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 90f66dc7c0d7..a2fc1a1d58b0 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
  */
 void ir_raw_event_handle(struct rc_dev *dev)
 {
-        if (!dev->raw)
+        if (!dev->raw || !dev->raw->thread)
                 return;
 
         wake_up_process(dev->raw->thread);
@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
         int rc;
         struct ir_raw_handler *handler;
+        struct task_struct *thread;
 
         if (!dev)
                 return -EINVAL;
@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
          * because the event is coming from userspace
          */
         if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
-                                               "rc%u", dev->minor);
+                thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
+                                     dev->minor);
 
-                if (IS_ERR(dev->raw->thread)) {
-                        rc = PTR_ERR(dev->raw->thread);
+                if (IS_ERR(thread)) {
+                        rc = PTR_ERR(thread);
                         goto out;
                 }
+
+                dev->raw->thread = thread;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
index e12ec50bf0bf..90a5f8fd5eea 100644
--- a/drivers/media/rc/sir_ir.c
+++ b/drivers/media/rc/sir_ir.c
@@ -183,9 +183,15 @@ static irqreturn_t sir_interrupt(int irq, void *dev_id)
         static unsigned long delt;
         unsigned long deltintr;
         unsigned long flags;
+        int counter = 0;
         int iir, lsr;
 
         while ((iir = inb(io + UART_IIR) & UART_IIR_ID)) {
+                if (++counter > 256) {
+                        dev_err(&sir_ir_dev->dev, "Trapped in interrupt");
+                        break;
+                }
+
                 switch (iir & UART_IIR_ID) { /* FIXME toto treba preriedit */
                 case UART_IIR_MSI:
                         (void)inb(io + UART_MSR);
diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig
index 8937f3986a01..18ead44824ba 100644
--- a/drivers/media/usb/pulse8-cec/Kconfig
+++ b/drivers/media/usb/pulse8-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_PULSE8_CEC
         tristate "Pulse Eight HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig
index 3eb86607efb8..030ef01b1ff0 100644
--- a/drivers/media/usb/rainshadow-cec/Kconfig
+++ b/drivers/media/usb/rainshadow-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_RAINSHADOW_CEC
         tristate "RainShadow Tech HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index 541ca543f71f..4126552c9055 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -119,7 +119,7 @@ static void rain_irq_work_handler(struct work_struct *work)
 
         while (true) {
                 unsigned long flags;
-                bool exit_loop;
+                bool exit_loop = false;
                 char data;
 
                 spin_lock_irqsave(&rain->buf_lock, flags);
@@ -336,6 +336,7 @@ static int rain_connect(struct serio *serio, struct serio_driver *drv)
         serio_set_drvdata(serio, rain);
         INIT_WORK(&rain->work, rain_irq_work_handler);
         mutex_init(&rain->write_lock);
+        spin_lock_init(&rain->buf_lock);
 
         err = serio_open(serio, drv);
         if (err)
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 94afbbf92807..c0175ea7e7ad 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
 
 void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
 {
-        if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+        if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
                 return NULL;
 
         return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 35910f945bfa..99e644cda4d1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -581,7 +581,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
         return of_platform_populate(np, NULL, NULL, dev);
 }
 
-static int atmel_ebi_resume(struct device *dev)
+static __maybe_unused int atmel_ebi_resume(struct device *dev)
 {
         struct atmel_ebi *ebi = dev_get_drvdata(dev);
         struct atmel_ebi_dev *ebid;
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index 75488e65cd96..8d46e3ad9529 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -245,8 +245,7 @@ static int arizona_poll_reg(struct arizona *arizona,
         int ret;
 
         ret = regmap_read_poll_timeout(arizona->regmap,
-                                       ARIZONA_INTERRUPT_RAW_STATUS_5, val,
-                                       ((val & mask) == target),
+                                       reg, val, ((val & mask) == target),
                                        ARIZONA_REG_POLL_DELAY_US,
                                        timeout_ms * 1000);
         if (ret)
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index 4472ce11f98d..8c32040b9c09 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -45,7 +45,7 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master)
         mutex_init(&ctx->mapping_lock);
         ctx->mapping = NULL;
 
-        if (cxl_is_psl8(afu)) {
+        if (cxl_is_power8()) {
                 spin_lock_init(&ctx->sste_lock);
 
                 /*
@@ -189,7 +189,7 @@ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma)
                 if (start + len > ctx->afu->adapter->ps_size)
                         return -EINVAL;
 
-                if (cxl_is_psl9(ctx->afu)) {
+                if (cxl_is_power9()) {
                         /*
                          * Make sure there is a valid problem state
                          * area space for this AFU.
@@ -324,7 +324,7 @@ static void reclaim_ctx(struct rcu_head *rcu)
 {
         struct cxl_context *ctx = container_of(rcu, struct cxl_context, rcu);
 
-        if (cxl_is_psl8(ctx->afu))
+        if (cxl_is_power8())
                 free_page((u64)ctx->sstp);
         if (ctx->ff_page)
                 __free_page(ctx->ff_page);
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index c8568ea7c518..a03f8e7535e5 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -357,6 +357,7 @@ static const cxl_p2n_reg_t CXL_PSL_WED_An     = {0x0A0};
 #define CXL_PSL9_DSISR_An_PF_RGP  0x0000000000000090ULL  /* PTE not found (Radix Guest (parent)) 0b10010000 */
 #define CXL_PSL9_DSISR_An_PF_HRH  0x0000000000000094ULL  /* PTE not found (HPT/Radix Host)       0b10010100 */
 #define CXL_PSL9_DSISR_An_PF_STEG 0x000000000000009CULL  /* PTE not found (STEG VA)              0b10011100 */
+#define CXL_PSL9_DSISR_An_URTCH   0x00000000000000B4ULL  /* Unsupported Radix Tree Configuration 0b10110100 */
 
 /****** CXL_PSL_TFC_An ******************************************************/
 #define CXL_PSL_TFC_An_A  (1ull << (63-28)) /* Acknowledge non-translation fault */
@@ -844,24 +845,15 @@ static inline bool cxl_is_power8(void)
 
 static inline bool cxl_is_power9(void)
 {
-        /* intermediate solution */
-        if (!cxl_is_power8() &&
-           (cpu_has_feature(CPU_FTRS_POWER9) ||
-            cpu_has_feature(CPU_FTR_POWER9_DD1)))
+        if (pvr_version_is(PVR_POWER9))
                 return true;
         return false;
 }
 
-static inline bool cxl_is_psl8(struct cxl_afu *afu)
+static inline bool cxl_is_power9_dd1(void)
 {
-        if (afu->adapter->caia_major == 1)
-                return true;
-        return false;
-}
-
-static inline bool cxl_is_psl9(struct cxl_afu *afu)
-{
-        if (afu->adapter->caia_major == 2)
+        if ((pvr_version_is(PVR_POWER9)) &&
+            cpu_has_feature(CPU_FTR_POWER9_DD1))
                 return true;
         return false;
 }
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index 5344448f514e..c79e39bad7a4 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -187,7 +187,7 @@ static struct mm_struct *get_mem_context(struct cxl_context *ctx)
 
 static bool cxl_is_segment_miss(struct cxl_context *ctx, u64 dsisr)
 {
-        if ((cxl_is_psl8(ctx->afu)) && (dsisr & CXL_PSL_DSISR_An_DS))
+        if ((cxl_is_power8() && (dsisr & CXL_PSL_DSISR_An_DS)))
                 return true;
 
         return false;
@@ -195,16 +195,23 @@ static bool cxl_is_segment_miss(struct cxl_context *ctx, u64 dsisr)
 
 static bool cxl_is_page_fault(struct cxl_context *ctx, u64 dsisr)
 {
-        if ((cxl_is_psl8(ctx->afu)) && (dsisr & CXL_PSL_DSISR_An_DM))
-                return true;
+        u64 crs; /* Translation Checkout Response Status */
 
-        if ((cxl_is_psl9(ctx->afu)) &&
-           ((dsisr & CXL_PSL9_DSISR_An_CO_MASK) &
-                (CXL_PSL9_DSISR_An_PF_SLR | CXL_PSL9_DSISR_An_PF_RGC |
-                 CXL_PSL9_DSISR_An_PF_RGP | CXL_PSL9_DSISR_An_PF_HRH |
-                 CXL_PSL9_DSISR_An_PF_STEG)))
+        if ((cxl_is_power8()) && (dsisr & CXL_PSL_DSISR_An_DM))
                 return true;
 
+        if (cxl_is_power9()) {
+                crs = (dsisr & CXL_PSL9_DSISR_An_CO_MASK);
+                if ((crs == CXL_PSL9_DSISR_An_PF_SLR) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_RGC) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_RGP) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_HRH) ||
+                    (crs == CXL_PSL9_DSISR_An_PF_STEG) ||
+                    (crs == CXL_PSL9_DSISR_An_URTCH)) {
+                        return true;
+                }
+        }
+
         return false;
 }
 
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 17b433f1ce23..0761271d68c5 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -159,11 +159,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
 
         /* Do this outside the status_mutex to avoid a circular dependency with
          * the locking in cxl_mmap_fault() */
-        if (copy_from_user(&work, uwork,
-                           sizeof(struct cxl_ioctl_start_work))) {
-                rc = -EFAULT;
-                goto out;
-        }
+        if (copy_from_user(&work, uwork, sizeof(work)))
+                return -EFAULT;
 
         mutex_lock(&ctx->status_mutex);
         if (ctx->status != OPENED) {
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index 1703655072b1..c1ba0d42cbc8 100644
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -329,8 +329,15 @@ static int __init init_cxl(void)
 
         cxl_debugfs_init();
 
-        if ((rc = register_cxl_calls(&cxl_calls)))
-                goto err;
+        /*
+         * we don't register the callback on P9. slb callack is only
+         * used for the PSL8 MMU and CX4.
+         */
+        if (cxl_is_power8()) {
+                rc = register_cxl_calls(&cxl_calls);
+                if (rc)
+                        goto err;
+        }
 
         if (cpu_has_feature(CPU_FTR_HVMODE)) {
                 cxl_ops = &cxl_native_ops;
@@ -347,7 +354,8 @@ static int __init init_cxl(void)
 
         return 0;
 err1:
-        unregister_cxl_calls(&cxl_calls);
+        if (cxl_is_power8())
+                unregister_cxl_calls(&cxl_calls);
 err:
         cxl_debugfs_exit();
         cxl_file_exit();
@@ -366,7 +374,8 @@ static void exit_cxl(void)
 
         cxl_debugfs_exit();
         cxl_file_exit();
-        unregister_cxl_calls(&cxl_calls);
+        if (cxl_is_power8())
+                unregister_cxl_calls(&cxl_calls);
         idr_destroy(&cxl_adapter_idr);
 }
 
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 871a2f09c718..2b2f8894149d 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -105,11 +105,16 @@ static int native_afu_reset(struct cxl_afu *afu)
                            CXL_AFU_Cntl_An_RS_MASK | CXL_AFU_Cntl_An_ES_MASK,
                            false);
 
-        /* Re-enable any masked interrupts */
-        serr = cxl_p1n_read(afu, CXL_PSL_SERR_An);
-        serr &= ~CXL_PSL_SERR_An_IRQ_MASKS;
-        cxl_p1n_write(afu, CXL_PSL_SERR_An, serr);
-
+        /*
+         * Re-enable any masked interrupts when the AFU is not
+         * activated to avoid side effects after attaching a process
+         * in dedicated mode.
+         */
+        if (afu->current_mode == 0) {
+                serr = cxl_p1n_read(afu, CXL_PSL_SERR_An);
+                serr &= ~CXL_PSL_SERR_An_IRQ_MASKS;
+                cxl_p1n_write(afu, CXL_PSL_SERR_An, serr);
+        }
 
         return rc;
 }
@@ -139,9 +144,9 @@ int cxl_psl_purge(struct cxl_afu *afu)
 
         pr_devel("PSL purge request\n");
 
-        if (cxl_is_psl8(afu))
+        if (cxl_is_power8())
                 trans_fault = CXL_PSL_DSISR_TRANS;
-        if (cxl_is_psl9(afu))
+        if (cxl_is_power9())
                 trans_fault = CXL_PSL9_DSISR_An_TF;
 
         if (!cxl_ops->link_ok(afu->adapter, afu)) {
@@ -603,7 +608,7 @@ static u64 calculate_sr(struct cxl_context *ctx)
                 if (!test_tsk_thread_flag(current, TIF_32BIT))
                         sr |= CXL_PSL_SR_An_SF;
         }
-        if (cxl_is_psl9(ctx->afu)) {
+        if (cxl_is_power9()) {
                 if (radix_enabled())
                         sr |= CXL_PSL_SR_An_XLAT_ror;
                 else
@@ -1117,10 +1122,10 @@ static irqreturn_t native_handle_psl_slice_error(struct cxl_context *ctx,
 
 static bool cxl_is_translation_fault(struct cxl_afu *afu, u64 dsisr)
 {
-        if ((cxl_is_psl8(afu)) && (dsisr & CXL_PSL_DSISR_TRANS))
+        if ((cxl_is_power8()) && (dsisr & CXL_PSL_DSISR_TRANS))
                 return true;
 
-        if ((cxl_is_psl9(afu)) && (dsisr & CXL_PSL9_DSISR_An_TF))
+        if ((cxl_is_power9()) && (dsisr & CXL_PSL9_DSISR_An_TF))
                 return true;
 
         return false;
@@ -1194,10 +1199,10 @@ static void native_irq_wait(struct cxl_context *ctx)
                 if (ph != ctx->pe)
                         return;
                 dsisr = cxl_p2n_read(ctx->afu, CXL_PSL_DSISR_An);
-                if (cxl_is_psl8(ctx->afu) &&
+                if (cxl_is_power8() &&
                    ((dsisr & CXL_PSL_DSISR_PENDING) == 0))
                         return;
-                if (cxl_is_psl9(ctx->afu) &&
+                if (cxl_is_power9() &&
                    ((dsisr & CXL_PSL9_DSISR_PENDING) == 0))
                         return;
                 /*
@@ -1302,13 +1307,16 @@ int cxl_native_register_psl_err_irq(struct cxl *adapter)
 
 void cxl_native_release_psl_err_irq(struct cxl *adapter)
 {
-        if (adapter->native->err_virq != irq_find_mapping(NULL, adapter->native->err_hwirq))
+        if (adapter->native->err_virq == 0 ||
+            adapter->native->err_virq !=
+            irq_find_mapping(NULL, adapter->native->err_hwirq))
                 return;
 
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
         cxl_unmap_irq(adapter->native->err_virq, adapter);
         cxl_ops->release_one_irq(adapter, adapter->native->err_hwirq);
         kfree(adapter->irq_name);
+        adapter->native->err_virq = 0;
 }
 
 int cxl_native_register_serr_irq(struct cxl_afu *afu)
@@ -1346,13 +1354,15 @@ int cxl_native_register_serr_irq(struct cxl_afu *afu)
 
 void cxl_native_release_serr_irq(struct cxl_afu *afu)
 {
-        if (afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
+        if (afu->serr_virq == 0 ||
+            afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
                 return;
 
         cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
         cxl_unmap_irq(afu->serr_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->serr_hwirq);
         kfree(afu->err_irq_name);
+        afu->serr_virq = 0;
 }
 
 int cxl_native_register_psl_irq(struct cxl_afu *afu)
@@ -1375,12 +1385,15 @@ int cxl_native_register_psl_irq(struct cxl_afu *afu)
 
 void cxl_native_release_psl_irq(struct cxl_afu *afu)
 {
-        if (afu->native->psl_virq != irq_find_mapping(NULL, afu->native->psl_hwirq))
+        if (afu->native->psl_virq == 0 ||
+            afu->native->psl_virq !=
+            irq_find_mapping(NULL, afu->native->psl_hwirq))
                 return;
 
         cxl_unmap_irq(afu->native->psl_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->native->psl_hwirq);
         kfree(afu->psl_irq_name);
+        afu->native->psl_virq = 0;
 }
 
 static void recover_psl_err(struct cxl_afu *afu, u64 errstat)
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 6dc1ee5b92c9..1eb9859809bf 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -436,7 +436,7 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, struct pci
         /* nMMU_ID Defaults to: b’000001001’*/
         xsl_dsnctl |= ((u64)0x09 << (63-28));
 
-        if (cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1)) {
+        if (!(cxl_is_power9_dd1())) {
                 /*
                  * Used to identify CAPI packets which should be sorted into
                  * the Non-Blocking queues by the PHB. This field should match
@@ -491,7 +491,7 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, struct pci
         cxl_p1_write(adapter, CXL_PSL9_APCDEDTYPE, 0x40000003FFFF0000ULL);
 
         /* Disable vc dd1 fix */
-        if ((cxl_is_power9() && cpu_has_feature(CPU_FTR_POWER9_DD1)))
+        if (cxl_is_power9_dd1())
                 cxl_p1_write(adapter, CXL_PSL9_GP_CT, 0x0400000000000001ULL);
 
         return 0;
@@ -1439,8 +1439,7 @@ int cxl_pci_reset(struct cxl *adapter)
          * The adapter is about to be reset, so ignore errors.
          * Not supported on P9 DD1
          */
-        if ((cxl_is_power8()) ||
-            ((cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1))))
+        if ((cxl_is_power8()) || (!(cxl_is_power9_dd1())))
                 cxl_data_cache_flush(adapter);
 
         /* pcie_warm_reset requests a fundamental pci reset which includes a
@@ -1750,7 +1749,6 @@ static const struct cxl_service_layer_ops psl9_ops = {
         .debugfs_add_adapter_regs = cxl_debugfs_add_adapter_regs_psl9,
         .debugfs_add_afu_regs = cxl_debugfs_add_afu_regs_psl9,
         .psl_irq_dump_registers = cxl_native_irq_dump_regs_psl9,
-        .err_irq_dump_registers = cxl_native_err_irq_dump_regs,
         .debugfs_stop_trace = cxl_stop_trace_psl9,
         .write_timebase_ctrl = write_timebase_ctrl_psl9,
         .timebase_read = timebase_read_psl9,
@@ -1889,8 +1887,7 @@ static void cxl_pci_remove_adapter(struct cxl *adapter)
          * Flush adapter datacache as its about to be removed.
          * Not supported on P9 DD1.
          */
-        if ((cxl_is_power8()) ||
-            ((cxl_is_power9() && !cpu_has_feature(CPU_FTR_POWER9_DD1))))
+        if ((cxl_is_power8()) || (!(cxl_is_power9_dd1())))
                 cxl_data_cache_flush(adapter);
 
         cxl_deconfigure_adapter(adapter);
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index d1928fdd0f43..07aad8576334 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -763,8 +763,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a,
 {
         struct mei_cl_device *cldev = to_mei_cl_device(dev);
         const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl);
+        u8 version = mei_me_cl_ver(cldev->me_cl);
 
-        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid);
+        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:%02X:",
+                         cldev->name, uuid, version);
 }
 static DEVICE_ATTR_RO(modalias);
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index c862cd4583cc..b8069eec18cb 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -309,6 +309,9 @@ static inline enum xp_retval
 xpc_send(short partid, int ch_number, u32 flags, void *payload,
          u16 payload_size)
 {
+        if (!xpc_interface.send)
+                return xpNotLoaded;
+
         return xpc_interface.send(partid, ch_number, flags, payload,
                                   payload_size);
 }
@@ -317,6 +320,9 @@ static inline enum xp_retval
 xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
                 u16 payload_size, xpc_notify_func func, void *key)
 {
+        if (!xpc_interface.send_notify)
+                return xpNotLoaded;
+
         return xpc_interface.send_notify(partid, ch_number, flags, payload,
                                          payload_size, func, key);
 }
@@ -324,12 +330,16 @@ xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
 static inline void
 xpc_received(short partid, int ch_number, void *payload)
 {
-        return xpc_interface.received(partid, ch_number, payload);
+        if (xpc_interface.received)
+                xpc_interface.received(partid, ch_number, payload);
 }
 
 static inline enum xp_retval
 xpc_partid_to_nasids(short partid, void *nasids)
 {
+        if (!xpc_interface.partid_to_nasids)
+                return xpNotLoaded;
+
         return xpc_interface.partid_to_nasids(partid, nasids);
 }
 
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 01be66d02ca8..6d7f557fd1c1 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -69,23 +69,9 @@ struct xpc_registration xpc_registrations[XPC_MAX_NCHANNELS];
 EXPORT_SYMBOL_GPL(xpc_registrations);
 
 /*
- * Initialize the XPC interface to indicate that XPC isn't loaded.
+ * Initialize the XPC interface to NULL to indicate that XPC isn't loaded.
  */
-static enum xp_retval
-xpc_notloaded(void)
-{
-        return xpNotLoaded;
-}
-
-struct xpc_interface xpc_interface = {
-        (void (*)(int))xpc_notloaded,
-        (void (*)(int))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
-                           void *))xpc_notloaded,
-        (void (*)(short, int, void *))xpc_notloaded,
-        (enum xp_retval(*)(short, void *))xpc_notloaded
-};
+struct xpc_interface xpc_interface = { };
 EXPORT_SYMBOL_GPL(xpc_interface);
 
 /*
@@ -115,17 +101,7 @@ EXPORT_SYMBOL_GPL(xpc_set_interface);
 void
 xpc_clear_interface(void)
 {
-        xpc_interface.connect = (void (*)(int))xpc_notloaded;
-        xpc_interface.disconnect = (void (*)(int))xpc_notloaded;
-        xpc_interface.send = (enum xp_retval(*)(short, int, u32, void *, u16))
-            xpc_notloaded;
-        xpc_interface.send_notify = (enum xp_retval(*)(short, int, u32, void *,
-                                                       u16, xpc_notify_func,
-                                                       void *))xpc_notloaded;
-        xpc_interface.received = (void (*)(short, int, void *))
-            xpc_notloaded;
-        xpc_interface.partid_to_nasids = (enum xp_retval(*)(short, void *))
-            xpc_notloaded;
+        memset(&xpc_interface, 0, sizeof(xpc_interface));
 }
 EXPORT_SYMBOL_GPL(xpc_clear_interface);
 
@@ -188,7 +164,8 @@ xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
 
         mutex_unlock(&registration->mutex);
 
-        xpc_interface.connect(ch_number);
+        if (xpc_interface.connect)
+                xpc_interface.connect(ch_number);
 
         return xpSuccess;
 }
@@ -237,7 +214,8 @@ xpc_disconnect(int ch_number)
         registration->assigned_limit = 0;
         registration->idle_limit = 0;
 
-        xpc_interface.disconnect(ch_number);
+        if (xpc_interface.disconnect)
+                xpc_interface.disconnect(ch_number);
 
         mutex_unlock(&registration->mutex);
 
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index 1304160de168..13ef162cf066 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -27,6 +27,7 @@ struct mmc_pwrseq_simple {
         struct mmc_pwrseq pwrseq;
         bool clk_enabled;
         u32 post_power_on_delay_ms;
+        u32 power_off_delay_us;
         struct clk *ext_clk;
         struct gpio_descs *reset_gpios;
 };
@@ -78,6 +79,10 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host)
 
         mmc_pwrseq_simple_set_gpios_value(pwrseq, 1);
 
+        if (pwrseq->power_off_delay_us)
+                usleep_range(pwrseq->power_off_delay_us,
+                        2 * pwrseq->power_off_delay_us);
+
         if (!IS_ERR(pwrseq->ext_clk) && pwrseq->clk_enabled) {
                 clk_disable_unprepare(pwrseq->ext_clk);
                 pwrseq->clk_enabled = false;
@@ -119,6 +124,8 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev)
 
         device_property_read_u32(dev, "post-power-on-delay-ms",
                                  &pwrseq->post_power_on_delay_ms);
+        device_property_read_u32(dev, "power-off-delay-us",
+                                 &pwrseq->power_off_delay_us);
 
         pwrseq->pwrseq.dev = dev;
         pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops;
diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c
index 772d0900026d..951d2cdd7888 100644
--- a/drivers/mmc/host/cavium-octeon.c
+++ b/drivers/mmc/host/cavium-octeon.c
@@ -108,7 +108,7 @@ static void octeon_mmc_release_bus(struct cvm_mmc_host *host)
 static void octeon_mmc_int_enable(struct cvm_mmc_host *host, u64 val)
 {
         writeq(val, host->base + MIO_EMM_INT(host));
-        if (!host->dma_active || (host->dma_active && !host->has_ciu3))
+        if (!host->has_ciu3)
                 writeq(val, host->base + MIO_EMM_INT_EN(host));
 }
 
@@ -267,7 +267,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)
         }
 
         host->global_pwr_gpiod = devm_gpiod_get_optional(&pdev->dev,
-                                                         "power-gpios",
+                                                         "power",
                                                          GPIOD_OUT_HIGH);
         if (IS_ERR(host->global_pwr_gpiod)) {
                 dev_err(&pdev->dev, "Invalid power GPIO\n");
@@ -288,11 +288,20 @@ static int octeon_mmc_probe(struct platform_device *pdev)
                 if (ret) {
                         dev_err(&pdev->dev, "Error populating slots\n");
                         octeon_mmc_set_shared_power(host, 0);
-                        return ret;
+                        goto error;
                 }
                 i++;
         }
         return 0;
+
+error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
+        return ret;
 }
 
 static int octeon_mmc_remove(struct platform_device *pdev)
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index fe3d77267cd6..b9cc95998799 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -146,6 +146,12 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
         return 0;
 
 error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
         clk_disable_unprepare(host->clk);
         return ret;
 }
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 58b51ba6aabd..b8aaf0fdb77c 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -839,14 +839,14 @@ static void cvm_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 cvm_mmc_reset_bus(slot);
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 0);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0);
                 break;
 
         case MMC_POWER_UP:
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 1);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
                 break;
         }
@@ -968,20 +968,15 @@ static int cvm_mmc_of_parse(struct device *dev, struct cvm_mmc_slot *slot)
                 return -EINVAL;
         }
 
-        mmc->supply.vmmc = devm_regulator_get_optional(dev, "vmmc");
-        if (IS_ERR(mmc->supply.vmmc)) {
-                if (PTR_ERR(mmc->supply.vmmc) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                /*
-                 * Legacy Octeon firmware has no regulator entry, fall-back to
-                 * a hard-coded voltage to get a sane OCR.
-                 */
+        ret = mmc_regulator_get_supply(mmc);
+        if (ret == -EPROBE_DEFER)
+                return ret;
+        /*
+         * Legacy Octeon firmware has no regulator entry, fall-back to
+         * a hard-coded voltage to get a sane OCR.
+         */
+        if (IS_ERR(mmc->supply.vmmc))
                 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-        } else {
-                ret = mmc_regulator_get_ocrmask(mmc->supply.vmmc);
-                if (ret > 0)
-                        mmc->ocr_avail = ret;
-        }
 
         /* Common MMC bindings */
         ret = mmc_of_parse(mmc);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 1842ed341af1..de962c2d5e00 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -210,6 +210,15 @@ static void meson_mmc_get_transfer_mode(struct mmc_host *mmc,
         int i;
         bool use_desc_chain_mode = true;
 
+        /*
+         * Broken SDIO with AP6255-based WiFi on Khadas VIM Pro has been
+         * reported. For some strange reason this occurs in descriptor
+         * chain mode only. So let's fall back to bounce buffer mode
+         * for command SD_IO_RW_EXTENDED.
+         */
+        if (mrq->cmd->opcode == SD_IO_RW_EXTENDED)
+                return;
+
         for_each_sg(data->sg, sg, data->sg_len, i)
                 /* check for 8 byte alignment */
                 if (sg->offset & 7) {
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 3275d4995812..61666d269771 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -187,7 +187,8 @@ static const struct sdhci_iproc_data iproc_cygnus_data = {
 };
 
 static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = {
-        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+                  SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
         .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
         .ops = &sdhci_iproc_ops,
 };
diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
index 6356781f1cca..f7e26b031e76 100644
--- a/drivers/mmc/host/sdhci-xenon-phy.c
+++ b/drivers/mmc/host/sdhci-xenon-phy.c
@@ -787,14 +787,6 @@ int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios)
         return ret;
 }
 
-void xenon_clean_phy(struct sdhci_host *host)
-{
-        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
-
-        kfree(priv->phy_params);
-}
-
 static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
                          const char *phy_name)
 {
@@ -819,11 +811,7 @@ static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
         if (ret)
                 return ret;
 
-        ret = xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
-        if (ret)
-                xenon_clean_phy(host);
-
-        return ret;
+        return xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
 }
 
 int xenon_phy_parse_dt(struct device_node *np, struct sdhci_host *host)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 67246655315b..bc1781bb070b 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -486,7 +486,7 @@ static int xenon_probe(struct platform_device *pdev)
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto clean_phy_param;
+                goto err_clk;
 
         err = sdhci_add_host(host);
         if (err)
@@ -496,8 +496,6 @@ static int xenon_probe(struct platform_device *pdev)
 
 remove_sdhc:
         xenon_sdhc_unprepare(host);
-clean_phy_param:
-        xenon_clean_phy(host);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -510,8 +508,6 @@ static int xenon_remove(struct platform_device *pdev)
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        xenon_clean_phy(host);
-
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 6e6523ea01ce..73debb42dc2f 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -93,7 +93,6 @@ struct xenon_priv {
 };
 
 int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios);
-void xenon_clean_phy(struct sdhci_host *host);
 int xenon_phy_parse_dt(struct device_node *np,
                        struct sdhci_host *host);
 void xenon_soc_pad_ctrl(struct sdhci_host *host,
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d474378ed810..b1dd12729f19 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -202,7 +202,7 @@ static int nand_ooblayout_free_lp_hamming(struct mtd_info *mtd, int section,
         return 0;
 }
 
-const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
+static const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
         .ecc = nand_ooblayout_ecc_lp_hamming,
         .free = nand_ooblayout_free_lp_hamming,
 };
@@ -4361,7 +4361,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         /* Initialize the ->data_interface field. */
         ret = nand_init_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         /*
          * Setup the data interface correctly on the chip and controller side.
@@ -4373,7 +4373,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
          */
         ret = nand_setup_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         nand_maf_id = chip->id.data[0];
         nand_dev_id = chip->id.data[1];
@@ -4404,6 +4404,12 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         mtd->size = i * chip->chipsize;
 
         return 0;
+
+err_nand_init:
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
+        return ret;
 }
 EXPORT_SYMBOL(nand_scan_ident);
 
@@ -4574,18 +4580,23 @@ int nand_scan_tail(struct mtd_info *mtd)
 
         /* New bad blocks should be marked in OOB, flash-based BBT, or both */
         if (WARN_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-                   !(chip->bbt_options & NAND_BBT_USE_FLASH)))
-                return -EINVAL;
+                   !(chip->bbt_options & NAND_BBT_USE_FLASH))) {
+                ret = -EINVAL;
+                goto err_ident;
+        }
 
         if (invalid_ecc_page_accessors(chip)) {
                 pr_err("Invalid ECC page accessors setup\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_ident;
         }
 
         if (!(chip->options & NAND_OWN_BUFFERS)) {
                 nbuf = kzalloc(sizeof(*nbuf), GFP_KERNEL);
-                if (!nbuf)
-                        return -ENOMEM;
+                if (!nbuf) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
 
                 nbuf->ecccalc = kmalloc(mtd->oobsize, GFP_KERNEL);
                 if (!nbuf->ecccalc) {
@@ -4608,8 +4619,10 @@ int nand_scan_tail(struct mtd_info *mtd)
 
                 chip->buffers = nbuf;
         } else {
-                if (!chip->buffers)
-                        return -ENOMEM;
+                if (!chip->buffers) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
         }
 
         /* Set the internal oob buffer location, just after the page data */
@@ -4842,7 +4855,11 @@ int nand_scan_tail(struct mtd_info *mtd)
                 return 0;
 
         /* Build bad block table */
-        return chip->scan_bbt(mtd);
+        ret = chip->scan_bbt(mtd);
+        if (ret)
+                goto err_free;
+        return 0;
+
 err_free:
         if (nbuf) {
                 kfree(nbuf->databuf);
@@ -4850,6 +4867,13 @@ err_free:
                 kfree(nbuf->ecccalc);
                 kfree(nbuf);
         }
+
+err_ident:
+        /* Clean up nand_scan_ident(). */
+
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
         return ret;
 }
 EXPORT_SYMBOL(nand_scan_tail);
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index 9d5ca0e540b5..92e2cf8e9ff9 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -6,7 +6,6 @@
  * published by the Free Software Foundation.
  *
  */
-#include <linux/module.h>
 #include <linux/mtd/nand.h>
 #include <linux/sizes.h>
 
diff --git a/drivers/mtd/nand/nand_samsung.c b/drivers/mtd/nand/nand_samsung.c
index 9cfc4035a420..1e0755997762 100644
--- a/drivers/mtd/nand/nand_samsung.c
+++ b/drivers/mtd/nand/nand_samsung.c
@@ -84,6 +84,9 @@ static void samsung_nand_decode_id(struct nand_chip *chip)
                         case 7:
                                 chip->ecc_strength_ds = 60;
                                 break;
+                        default:
+                                WARN(1, "Could not decode ECC info");
+                                chip->ecc_step_ds = 0;
                         }
                 }
         } else {
diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c
index 05b6e1065203..49b286c6c10f 100644
--- a/drivers/mtd/nand/tango_nand.c
+++ b/drivers/mtd/nand/tango_nand.c
@@ -55,10 +55,10 @@
  * byte 1 for other packets in the page (PKT_N, for N > 0)
  * ERR_COUNT_PKT_N is the max error count over all but the first packet.
  */
-#define DECODE_OK_PKT_0(v)      ((v) & BIT(7))
-#define DECODE_OK_PKT_N(v)      ((v) & BIT(15))
 #define ERR_COUNT_PKT_0(v)      (((v) >> 0) & 0x3f)
 #define ERR_COUNT_PKT_N(v)      (((v) >> 8) & 0x3f)
+#define DECODE_FAIL_PKT_0(v)    (((v) & BIT(7)) == 0)
+#define DECODE_FAIL_PKT_N(v)    (((v) & BIT(15)) == 0)
 
 /* Offsets relative to pbus_base */
 #define PBUS_CS_CTRL    0x83c
@@ -193,6 +193,8 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
                                                   chip->ecc.strength);
                 if (res < 0)
                         mtd->ecc_stats.failed++;
+                else
+                        mtd->ecc_stats.corrected += res;
 
                 bitflips = max(res, bitflips);
                 buf += pkt_size;
@@ -202,9 +204,11 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
         return bitflips;
 }
 
-static int decode_error_report(struct tango_nfc *nfc)
+static int decode_error_report(struct nand_chip *chip)
 {
         u32 status, res;
+        struct mtd_info *mtd = nand_to_mtd(chip);
+        struct tango_nfc *nfc = to_tango_nfc(chip->controller);
 
         status = readl_relaxed(nfc->reg_base + NFC_XFER_STATUS);
         if (status & PAGE_IS_EMPTY)
@@ -212,10 +216,14 @@ static int decode_error_report(struct tango_nfc *nfc)
 
         res = readl_relaxed(nfc->mem_base + ERROR_REPORT);
 
-        if (DECODE_OK_PKT_0(res) && DECODE_OK_PKT_N(res))
-                return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
+        if (DECODE_FAIL_PKT_0(res) || DECODE_FAIL_PKT_N(res))
+                return -EBADMSG;
+
+        /* ERR_COUNT_PKT_N is max, not sum, but that's all we have */
+        mtd->ecc_stats.corrected +=
+                ERR_COUNT_PKT_0(res) + ERR_COUNT_PKT_N(res);
 
-        return -EBADMSG;
+        return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
 }
 
 static void tango_dma_callback(void *arg)
@@ -282,7 +290,7 @@ static int tango_read_page(struct mtd_info *mtd, struct nand_chip *chip,
         if (err)
                 return err;
 
-        res = decode_error_report(nfc);
+        res = decode_error_report(chip);
         if (res < 0) {
                 chip->ecc.read_oob_raw(mtd, chip, page);
                 res = check_erased_page(chip, buf);
@@ -663,6 +671,7 @@ static const struct of_device_id tango_nand_ids[] = {
         { .compatible = "sigma,smp8758-nand" },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, tango_nand_ids);
 
 static struct platform_driver tango_nand_driver = {
         .probe  = tango_nand_probe,
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 62ee439d5882..53a1cb551def 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -756,6 +756,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         struct net_device *dev = dev_id;
         struct arcnet_local *lp;
         int recbuf, status, diagstatus, didsomething, boguscount;
+        unsigned long flags;
         int retval = IRQ_NONE;
 
         arc_printk(D_DURING, dev, "\n");
@@ -765,7 +766,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         lp = netdev_priv(dev);
         BUG_ON(!lp);
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
 
         /* RESET flag was enabled - if device is not running, we must
          * clear it right away (but nothing else).
@@ -774,7 +775,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
                 if (lp->hw.status(dev) & RESETflag)
                         lp->hw.command(dev, CFLAGScmd | RESETclear);
                 lp->hw.intmask(dev, 0);
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                 return retval;
         }
 
@@ -998,7 +999,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id)
         udelay(1);
         lp->hw.intmask(dev, lp->intmask);
 
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
         return retval;
 }
 EXPORT_SYMBOL(arcnet_interrupt);
diff --git a/drivers/net/arcnet/capmode.c b/drivers/net/arcnet/capmode.c
index 2056878fb087..4fa2e46b48d3 100644
--- a/drivers/net/arcnet/capmode.c
+++ b/drivers/net/arcnet/capmode.c
@@ -212,7 +212,7 @@ static int ack_tx(struct net_device *dev, int acked)
         ackpkt->soft.cap.proto = 0; /* using protocol 0 for acknowledge */
         ackpkt->soft.cap.mes.ack = acked;
 
-        arc_printk(D_PROTO, dev, "Ackknowledge for cap packet %x.\n",
+        arc_printk(D_PROTO, dev, "Acknowledge for cap packet %x.\n",
                    *((int *)&ackpkt->soft.cap.cookie[0]));
 
         ackskb->protocol = cpu_to_be16(ETH_P_ARCNET);
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 239de38fbd6a..47f80b83dcf4 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -135,6 +135,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
         for (i = 0; i < ci->devcount; i++) {
                 struct com20020_pci_channel_map *cm = &ci->chan_map_tbl[i];
                 struct com20020_dev *card;
+                int dev_id_mask = 0xf;
 
                 dev = alloc_arcdev(device);
                 if (!dev) {
@@ -166,6 +167,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
                 arcnet_outb(0x00, ioaddr, COM20020_REG_W_COMMAND);
                 arcnet_inb(ioaddr, COM20020_REG_R_DIAGSTAT);
 
+                SET_NETDEV_DEV(dev, &pdev->dev);
                 dev->base_addr = ioaddr;
                 dev->dev_addr[0] = node;
                 dev->irq = pdev->irq;
@@ -179,8 +181,8 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
                 /* Get the dev_id from the PLX rotary coder */
                 if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15))
-                        dev->dev_id = 0xc;
-                dev->dev_id ^= inb(priv->misc + ci->rotary) >> 4;
+                        dev_id_mask = 0x3;
+                dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask;
 
                 snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
 
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 13d9ad4b3f5c..78043a9c5981 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -246,8 +246,6 @@ int com20020_found(struct net_device *dev, int shared)
                 return -ENODEV;
         }
 
-        dev->base_addr = ioaddr;
-
         arc_printk(D_NORMAL, dev, "%s: station %02Xh found at %03lXh, IRQ %d.\n",
                    lp->card_name, dev->dev_addr[0], dev->base_addr, dev->irq);
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index c5fd4259da33..e5386ab706ec 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -90,10 +90,13 @@ enum ad_link_speed_type {
         AD_LINK_SPEED_100MBPS,
         AD_LINK_SPEED_1000MBPS,
         AD_LINK_SPEED_2500MBPS,
+        AD_LINK_SPEED_5000MBPS,
         AD_LINK_SPEED_10000MBPS,
+        AD_LINK_SPEED_14000MBPS,
         AD_LINK_SPEED_20000MBPS,
         AD_LINK_SPEED_25000MBPS,
         AD_LINK_SPEED_40000MBPS,
+        AD_LINK_SPEED_50000MBPS,
         AD_LINK_SPEED_56000MBPS,
         AD_LINK_SPEED_100000MBPS,
 };
@@ -259,10 +262,13 @@ static inline int __check_agg_selection_timer(struct port *port)
  *     %AD_LINK_SPEED_100MBPS,
  *     %AD_LINK_SPEED_1000MBPS,
  *     %AD_LINK_SPEED_2500MBPS,
+ *     %AD_LINK_SPEED_5000MBPS,
  *     %AD_LINK_SPEED_10000MBPS
+ *     %AD_LINK_SPEED_14000MBPS,
  *     %AD_LINK_SPEED_20000MBPS
  *     %AD_LINK_SPEED_25000MBPS
  *     %AD_LINK_SPEED_40000MBPS
+ *     %AD_LINK_SPEED_50000MBPS
  *     %AD_LINK_SPEED_56000MBPS
  *     %AD_LINK_SPEED_100000MBPS
  */
@@ -296,10 +302,18 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_2500MBPS;
                         break;
 
+                case SPEED_5000:
+                        speed = AD_LINK_SPEED_5000MBPS;
+                        break;
+
                 case SPEED_10000:
                         speed = AD_LINK_SPEED_10000MBPS;
                         break;
 
+                case SPEED_14000:
+                        speed = AD_LINK_SPEED_14000MBPS;
+                        break;
+
                 case SPEED_20000:
                         speed = AD_LINK_SPEED_20000MBPS;
                         break;
@@ -312,6 +326,10 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_40000MBPS;
                         break;
 
+                case SPEED_50000:
+                        speed = AD_LINK_SPEED_50000MBPS;
+                        break;
+
                 case SPEED_56000:
                         speed = AD_LINK_SPEED_56000MBPS;
                         break;
@@ -707,9 +725,15 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_2500MBPS:
                         bandwidth = nports * 2500;
                         break;
+                case AD_LINK_SPEED_5000MBPS:
+                        bandwidth = nports * 5000;
+                        break;
                 case AD_LINK_SPEED_10000MBPS:
                         bandwidth = nports * 10000;
                         break;
+                case AD_LINK_SPEED_14000MBPS:
+                        bandwidth = nports * 14000;
+                        break;
                 case AD_LINK_SPEED_20000MBPS:
                         bandwidth = nports * 20000;
                         break;
@@ -719,6 +743,9 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_40000MBPS:
                         bandwidth = nports * 40000;
                         break;
+                case AD_LINK_SPEED_50000MBPS:
+                        bandwidth = nports * 50000;
+                        break;
                 case AD_LINK_SPEED_56000MBPS:
                         bandwidth = nports * 56000;
                         break;
@@ -2577,7 +2604,7 @@ int __bond_3ad_get_active_agg_info(struct bonding *bond,
                 return -1;
 
         ad_info->aggregator_id = aggregator->aggregator_identifier;
-        ad_info->ports = aggregator->num_of_ports;
+        ad_info->ports = __agg_active_ports(aggregator);
         ad_info->actor_key = aggregator->actor_oper_aggregator_key;
         ad_info->partner_key = aggregator->partner_oper_aggregator_key;
         ether_addr_copy(ad_info->partner_system,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2be78807fd6e..8ab6bdbe1682 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2612,11 +2612,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
         bond_for_each_slave_rcu(bond, slave, iter) {
                 unsigned long trans_start = dev_trans_start(slave->dev);
 
+                slave->new_link = BOND_LINK_NOCHANGE;
+
                 if (slave->link != BOND_LINK_UP) {
                         if (bond_time_in_interval(bond, trans_start, 1) &&
                             bond_time_in_interval(bond, slave->last_rx, 1)) {
 
-                                slave->link  = BOND_LINK_UP;
+                                slave->new_link = BOND_LINK_UP;
                                 slave_state_changed = 1;
 
                                 /* primary_slave has no meaning in round-robin
@@ -2643,7 +2645,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                         if (!bond_time_in_interval(bond, trans_start, 2) ||
                             !bond_time_in_interval(bond, slave->last_rx, 2)) {
 
-                                slave->link  = BOND_LINK_DOWN;
+                                slave->new_link = BOND_LINK_DOWN;
                                 slave_state_changed = 1;
 
                                 if (slave->link_failure_count < UINT_MAX)
@@ -2674,6 +2676,11 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                 if (!rtnl_trylock())
                         goto re_arm;
 
+                bond_for_each_slave(bond, slave, iter) {
+                        if (slave->new_link != BOND_LINK_NOCHANGE)
+                                slave->link = slave->new_link;
+                }
+
                 if (slave_state_changed) {
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
@@ -4185,7 +4192,6 @@ static void bond_destructor(struct net_device *bond_dev)
         struct bonding *bond = netdev_priv(bond_dev);
         if (bond->wq)
                 destroy_workqueue(bond->wq);
-        free_netdev(bond_dev);
 }
 
 void bond_setup(struct net_device *bond_dev)
@@ -4205,7 +4211,8 @@ void bond_setup(struct net_device *bond_dev)
         bond_dev->netdev_ops = &bond_netdev_ops;
         bond_dev->ethtool_ops = &bond_ethtool_ops;
 
-        bond_dev->destructor = bond_destructor;
+        bond_dev->needs_free_netdev = true;
+        bond_dev->priv_destructor = bond_destructor;
 
         SET_NETDEV_DEVTYPE(bond_dev, &bond_type);
 
@@ -4271,10 +4278,10 @@ static int bond_check_params(struct bond_params *params)
         int arp_validate_value, fail_over_mac_value, primary_reselect_value, i;
         struct bond_opt_value newval;
         const struct bond_opt_value *valptr;
-        int arp_all_targets_value;
+        int arp_all_targets_value = 0;
         u16 ad_actor_sys_prio = 0;
         u16 ad_user_port_key = 0;
-        __be32 arp_target[BOND_MAX_ARP_TARGETS];
+        __be32 arp_target[BOND_MAX_ARP_TARGETS] = { 0 };
         int arp_ip_count;
         int bond_mode   = BOND_MODE_ROUNDROBIN;
         int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
@@ -4501,7 +4508,6 @@ static int bond_check_params(struct bond_params *params)
                 arp_validate_value = 0;
         }
 
-        arp_all_targets_value = 0;
         if (arp_all_targets) {
                 bond_opt_initstr(&newval, arp_all_targets);
                 valptr = bond_opt_parse(bond_opt_get(BOND_OPT_ARP_ALL_TARGETS),
@@ -4730,7 +4736,7 @@ int bond_create(struct net *net, const char *name)
 
         rtnl_unlock();
         if (res < 0)
-                bond_destructor(bond_dev);
+                free_netdev(bond_dev);
         return res;
 }
 
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index ddabce759456..71a7c3b44fdd 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -1121,7 +1121,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->netdev_ops = &cfhsi_netdevops;
         for (i = 0; i < CFHSI_PRIO_LAST; ++i)
                 skb_queue_head_init(&cfhsi->qhead[i]);
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index c2dea4916e5d..76e1d3545105 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -428,7 +428,7 @@ static void caifdev_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CAIF_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&serdev->head);
         serdev->common.link_select = CAIF_LINK_LOW_LATENCY;
         serdev->common.use_frag = true;
diff --git a/drivers/net/caif/caif_spi.c b/drivers/net/caif/caif_spi.c
index 3a529fbe539f..fc21afe852b9 100644
--- a/drivers/net/caif/caif_spi.c
+++ b/drivers/net/caif/caif_spi.c
@@ -712,7 +712,7 @@ static void cfspi_setup(struct net_device *dev)
         dev->flags = IFF_NOARP | IFF_POINTOPOINT;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->mtu = SPI_MAX_PAYLOAD_SIZE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&cfspi->qhead);
         skb_queue_head_init(&cfspi->chead);
         cfspi->cfdev.link_select = CAIF_LINK_HIGH_BANDW;
diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c
index 6122768c8644..1794ea0420b7 100644
--- a/drivers/net/caif/caif_virtio.c
+++ b/drivers/net/caif/caif_virtio.c
@@ -617,7 +617,7 @@ static void cfv_netdev_setup(struct net_device *netdev)
         netdev->tx_queue_len = 100;
         netdev->flags = IFF_POINTOPOINT | IFF_NOARP;
         netdev->mtu = CFV_DEF_MTU_SIZE;
-        netdev->destructor = free_netdev;
+        netdev->needs_free_netdev = true;
 }
 
 /* Create debugfs counters for the device */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 611d16a7061d..ae4ed03dc642 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -391,6 +391,9 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
         can_update_state_error_stats(dev, new_state);
         priv->state = new_state;
 
+        if (!cf)
+                return;
+
         if (unlikely(new_state == CAN_STATE_BUS_OFF)) {
                 cf->can_id |= CAN_ERR_BUSOFF;
                 return;
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 0d57be5ea97b..85268be0c913 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -489,7 +489,7 @@ int peak_canfd_handle_msgs_list(struct peak_canfd_priv *priv,
                                 struct pucan_rx_msg *msg_list, int msg_count)
 {
         void *msg_ptr = msg_list;
-        int i, msg_size;
+        int i, msg_size = 0;
 
         for (i = 0; i < msg_count; i++) {
                 msg_size = peak_canfd_handle_msg(priv, msg_ptr);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index eb7173713bbc..6a6e896e52fa 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -417,7 +417,7 @@ static int slc_open(struct net_device *dev)
 static void slc_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slcan_devs[i] = NULL;
 }
 
@@ -436,7 +436,8 @@ static const struct net_device_ops slc_netdev_ops = {
 static void slc_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &slc_netdev_ops;
-        dev->destructor         = slc_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = slc_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -761,8 +762,6 @@ static void __exit slcan_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index eecee7f8dfb7..afcc1312dbaf 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *gsusb, struct gs_can *gsdev)
                              sizeof(*dm),
                              1000);
 
+        kfree(dm);
+
         return rc;
 }
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 57913dbbae0a..1ca76e03e965 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -908,8 +908,6 @@ static int peak_usb_probe(struct usb_interface *intf,
         const struct peak_usb_adapter *peak_usb_adapter = NULL;
         int i, err = -ENOMEM;
 
-        usb_dev = interface_to_usbdev(intf);
-
         /* get corresponding PCAN-USB adapter */
         for (i = 0; i < ARRAY_SIZE(peak_usb_adapters_list); i++)
                 if (peak_usb_adapters_list[i]->device_id == usb_id_product) {
@@ -920,7 +918,7 @@ static int peak_usb_probe(struct usb_interface *intf,
         if (!peak_usb_adapter) {
                 /* should never come except device_id bad usage in this file */
                 pr_err("%s: didn't find device id. 0x%x in devices list\n",
-                        PCAN_USB_DRIVER_NAME, usb_dev->descriptor.idProduct);
+                        PCAN_USB_DRIVER_NAME, usb_id_product);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index facca33d53e9..a8cb33264ff1 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -152,7 +152,7 @@ static const struct net_device_ops vcan_netdev_ops = {
 static void vcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
@@ -163,7 +163,7 @@ static void vcan_setup(struct net_device *dev)
                 dev->flags |= IFF_ECHO;
 
         dev->netdev_ops         = &vcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct rtnl_link_ops vcan_link_ops __read_mostly = {
diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
index 7fbb24795681..cfe889e8f172 100644
--- a/drivers/net/can/vxcan.c
+++ b/drivers/net/can/vxcan.c
@@ -150,13 +150,13 @@ static const struct net_device_ops vxcan_netdev_ops = {
 static void vxcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
         dev->flags              = (IFF_NOARP|IFF_ECHO);
         dev->netdev_ops         = &vxcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /* forward declaration for rtnl_create_link() */
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 96046bb12ca1..14c0be98e0a4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -114,13 +114,13 @@ static inline int mv88e6xxx_g2_set_eeprom16(struct mv88e6xxx_chip *chip,
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
-                           int src_port, u16 data)
+static inline int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip,
+                                         int src_dev, int src_port, u16 data)
 {
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
+static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
 {
         return -EOPNOTSUPP;
 }
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 149244aac20a..9905b52fe293 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -328,7 +328,6 @@ static void dummy_free_netdev(struct net_device *dev)
         struct dummy_priv *priv = netdev_priv(dev);
 
         kfree(priv->vfinfo);
-        free_netdev(dev);
 }
 
 static void dummy_setup(struct net_device *dev)
@@ -338,7 +337,8 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &dummy_netdev_ops;
         dev->ethtool_ops = &dummy_ethtool_ops;
-        dev->destructor = dummy_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = dummy_free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         dev->flags |= IFF_NOARP;
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index b0a3b85fc6f8..db02bc2fb4b2 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -748,13 +748,13 @@ static int ax_init_dev(struct net_device *dev)
 
         ret = ax_mii_init(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         ax_NS8390_init(dev, 0);
 
         ret = register_netdev(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         netdev_info(dev, "%dbit, irq %d, %lx, MAC: %pM\n",
                     ei_local->word16 ? 16 : 8, dev->irq, dev->base_addr,
@@ -762,9 +762,6 @@ static int ax_init_dev(struct net_device *dev)
 
         return 0;
 
- out_irq:
-        /* cleanup irq */
-        free_irq(dev->irq, dev);
  err_out:
         return ret;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 08d11cede9c9..f5b237e0bd60 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -61,6 +61,8 @@
 
 #define ENA_MMIO_READ_TIMEOUT 0xFFFFFFFF
 
+#define ENA_REGS_ADMIN_INTR_MASK 1
+
 /*****************************************************************************/
 /*****************************************************************************/
 /*****************************************************************************/
@@ -232,11 +234,9 @@ static struct ena_comp_ctx *__ena_com_submit_admin_cmd(struct ena_com_admin_queu
         tail_masked = admin_queue->sq.tail & queue_size_mask;
 
         /* In case of queue FULL */
-        cnt = admin_queue->sq.tail - admin_queue->sq.head;
+        cnt = atomic_read(&admin_queue->outstanding_cmds);
         if (cnt >= admin_queue->q_depth) {
-                pr_debug("admin queue is FULL (tail %d head %d depth: %d)\n",
-                         admin_queue->sq.tail, admin_queue->sq.head,
-                         admin_queue->q_depth);
+                pr_debug("admin queue is full.\n");
                 admin_queue->stats.out_of_space++;
                 return ERR_PTR(-ENOSPC);
         }
@@ -508,15 +508,20 @@ static int ena_com_comp_status_to_errno(u8 comp_status)
 static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_ctx,
                                                      struct ena_com_admin_queue *admin_queue)
 {
-        unsigned long flags;
-        u32 start_time;
+        unsigned long flags, timeout;
         int ret;
 
-        start_time = ((u32)jiffies_to_usecs(jiffies));
+        timeout = jiffies + ADMIN_CMD_TIMEOUT_US;
+
+        while (1) {
+                spin_lock_irqsave(&admin_queue->q_lock, flags);
+                ena_com_handle_admin_completion(admin_queue);
+                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
+
+                if (comp_ctx->status != ENA_CMD_SUBMITTED)
+                        break;
 
-        while (comp_ctx->status == ENA_CMD_SUBMITTED) {
-                if ((((u32)jiffies_to_usecs(jiffies)) - start_time) >
-                    ADMIN_CMD_TIMEOUT_US) {
+                if (time_is_before_jiffies(timeout)) {
                         pr_err("Wait for completion (polling) timeout\n");
                         /* ENA didn't have any completion */
                         spin_lock_irqsave(&admin_queue->q_lock, flags);
@@ -528,10 +533,6 @@ static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_c
                         goto err;
                 }
 
-                spin_lock_irqsave(&admin_queue->q_lock, flags);
-                ena_com_handle_admin_completion(admin_queue);
-                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
-
                 msleep(100);
         }
 
@@ -1455,6 +1456,12 @@ void ena_com_admin_destroy(struct ena_com_dev *ena_dev)
 
 void ena_com_set_admin_polling_mode(struct ena_com_dev *ena_dev, bool polling)
 {
+        u32 mask_value = 0;
+
+        if (polling)
+                mask_value = ENA_REGS_ADMIN_INTR_MASK;
+
+        writel(mask_value, ena_dev->reg_bar + ENA_REGS_INTR_MASK_OFF);
         ena_dev->admin_queue.polling = polling;
 }
 
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 67b2338f8fb3..3ee55e2fd694 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -80,7 +80,6 @@ static const struct ena_stats ena_stats_tx_strings[] = {
         ENA_STAT_TX_ENTRY(tx_poll),
         ENA_STAT_TX_ENTRY(doorbells),
         ENA_STAT_TX_ENTRY(prepare_ctx_err),
-        ENA_STAT_TX_ENTRY(missing_tx_comp),
         ENA_STAT_TX_ENTRY(bad_req_id),
 };
 
@@ -94,6 +93,7 @@ static const struct ena_stats ena_stats_rx_strings[] = {
         ENA_STAT_RX_ENTRY(dma_mapping_err),
         ENA_STAT_RX_ENTRY(bad_desc_num),
         ENA_STAT_RX_ENTRY(rx_copybreak_pkt),
+        ENA_STAT_RX_ENTRY(empty_rx_ring),
 };
 
 static const struct ena_stats ena_stats_ena_com_strings[] = {
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 7c1214d78855..4f16ed38bcf3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -190,6 +190,7 @@ static void ena_init_io_rings(struct ena_adapter *adapter)
                 rxr->sgl_size = adapter->max_rx_sgl_size;
                 rxr->smoothed_interval =
                         ena_com_get_nonadaptive_moderation_interval_rx(ena_dev);
+                rxr->empty_rx_queue = 0;
         }
 }
 
@@ -1078,6 +1079,26 @@ inline void ena_adjust_intr_moderation(struct ena_ring *rx_ring,
         rx_ring->per_napi_bytes = 0;
 }
 
+static inline void ena_unmask_interrupt(struct ena_ring *tx_ring,
+                                        struct ena_ring *rx_ring)
+{
+        struct ena_eth_io_intr_reg intr_reg;
+
+        /* Update intr register: rx intr delay,
+         * tx intr delay and interrupt unmask
+         */
+        ena_com_update_intr_reg(&intr_reg,
+                                rx_ring->smoothed_interval,
+                                tx_ring->smoothed_interval,
+                                true);
+
+        /* It is a shared MSI-X.
+         * Tx and Rx CQ have pointer to it.
+         * So we use one of them to reach the intr reg
+         */
+        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+}
+
 static inline void ena_update_ring_numa_node(struct ena_ring *tx_ring,
                                              struct ena_ring *rx_ring)
 {
@@ -1108,7 +1129,6 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
 {
         struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi);
         struct ena_ring *tx_ring, *rx_ring;
-        struct ena_eth_io_intr_reg intr_reg;
 
         u32 tx_work_done;
         u32 rx_work_done;
@@ -1149,22 +1169,9 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
                         if (ena_com_get_adaptive_moderation_enabled(rx_ring->ena_dev))
                                 ena_adjust_intr_moderation(rx_ring, tx_ring);
 
-                        /* Update intr register: rx intr delay,
-                         * tx intr delay and interrupt unmask
-                         */
-                        ena_com_update_intr_reg(&intr_reg,
-                                                rx_ring->smoothed_interval,
-                                                tx_ring->smoothed_interval,
-                                                true);
-
-                        /* It is a shared MSI-X.
-                         * Tx and Rx CQ have pointer to it.
-                         * So we use one of them to reach the intr reg
-                         */
-                        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+                        ena_unmask_interrupt(tx_ring, rx_ring);
                 }
 
-
                 ena_update_ring_numa_node(tx_ring, rx_ring);
 
                 ret = rx_work_done;
@@ -1485,6 +1492,11 @@ static int ena_up_complete(struct ena_adapter *adapter)
 
         ena_napi_enable_all(adapter);
 
+        /* Enable completion queues interrupt */
+        for (i = 0; i < adapter->num_queues; i++)
+                ena_unmask_interrupt(&adapter->tx_ring[i],
+                                     &adapter->rx_ring[i]);
+
         /* schedule napi in case we had pending packets
          * from the last time we disable napi
          */
@@ -1532,6 +1544,7 @@ static int ena_create_io_tx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get TX queue handlers. TX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(tx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1596,6 +1609,7 @@ static int ena_create_io_rx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get RX queue handlers. RX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(rx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1981,6 +1995,7 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_info->tx_descs = nb_hw_desc;
         tx_info->last_jiffies = jiffies;
+        tx_info->print_once = 0;
 
         tx_ring->next_to_use = ENA_TX_RING_IDX_NEXT(next_to_use,
                 tx_ring->ring_size);
@@ -2550,13 +2565,44 @@ err:
                 "Reset attempt failed. Can not reset the device\n");
 }
 
-static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+static int check_missing_comp_in_queue(struct ena_adapter *adapter,
+                                       struct ena_ring *tx_ring)
 {
         struct ena_tx_buffer *tx_buf;
         unsigned long last_jiffies;
+        u32 missed_tx = 0;
+        int i;
+
+        for (i = 0; i < tx_ring->ring_size; i++) {
+                tx_buf = &tx_ring->tx_buffer_info[i];
+                last_jiffies = tx_buf->last_jiffies;
+                if (unlikely(last_jiffies &&
+                             time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
+                        if (!tx_buf->print_once)
+                                netif_notice(adapter, tx_err, adapter->netdev,
+                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
+                                             tx_ring->qid, i);
+
+                        tx_buf->print_once = 1;
+                        missed_tx++;
+
+                        if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
+                                netif_err(adapter, tx_err, adapter->netdev,
+                                          "The number of lost tx completions is above the threshold (%d > %d). Reset the device\n",
+                                          missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
+                                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+                                return -EIO;
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+{
         struct ena_ring *tx_ring;
-        int i, j, budget;
-        u32 missed_tx;
+        int i, budget, rc;
 
         /* Make sure the driver doesn't turn the device in other process */
         smp_rmb();
@@ -2572,31 +2618,9 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         for (i = adapter->last_monitored_tx_qid; i < adapter->num_queues; i++) {
                 tx_ring = &adapter->tx_ring[i];
 
-                for (j = 0; j < tx_ring->ring_size; j++) {
-                        tx_buf = &tx_ring->tx_buffer_info[j];
-                        last_jiffies = tx_buf->last_jiffies;
-                        if (unlikely(last_jiffies && time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
-                                netif_notice(adapter, tx_err, adapter->netdev,
-                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
-                                             tx_ring->qid, j);
-
-                                u64_stats_update_begin(&tx_ring->syncp);
-                                missed_tx = tx_ring->tx_stats.missing_tx_comp++;
-                                u64_stats_update_end(&tx_ring->syncp);
-
-                                /* Clear last jiffies so the lost buffer won't
-                                 * be counted twice.
-                                 */
-                                tx_buf->last_jiffies = 0;
-
-                                if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
-                                        netif_err(adapter, tx_err, adapter->netdev,
-                                                  "The number of lost tx completion is above the threshold (%d > %d). Reset the device\n",
-                                                  missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
-                                        set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-                                }
-                        }
-                }
+                rc = check_missing_comp_in_queue(adapter, tx_ring);
+                if (unlikely(rc))
+                        return;
 
                 budget--;
                 if (!budget)
@@ -2606,6 +2630,58 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         adapter->last_monitored_tx_qid = i % adapter->num_queues;
 }
 
+/* trigger napi schedule after 2 consecutive detections */
+#define EMPTY_RX_REFILL 2
+/* For the rare case where the device runs out of Rx descriptors and the
+ * napi handler failed to refill new Rx descriptors (due to a lack of memory
+ * for example).
+ * This case will lead to a deadlock:
+ * The device won't send interrupts since all the new Rx packets will be dropped
+ * The napi handler won't allocate new Rx descriptors so the device will be
+ * able to send new packets.
+ *
+ * This scenario can happen when the kernel's vm.min_free_kbytes is too small.
+ * It is recommended to have at least 512MB, with a minimum of 128MB for
+ * constrained environment).
+ *
+ * When such a situation is detected - Reschedule napi
+ */
+static void check_for_empty_rx_ring(struct ena_adapter *adapter)
+{
+        struct ena_ring *rx_ring;
+        int i, refill_required;
+
+        if (!test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
+                return;
+
+        if (test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))
+                return;
+
+        for (i = 0; i < adapter->num_queues; i++) {
+                rx_ring = &adapter->rx_ring[i];
+
+                refill_required =
+                        ena_com_sq_empty_space(rx_ring->ena_com_io_sq);
+                if (unlikely(refill_required == (rx_ring->ring_size - 1))) {
+                        rx_ring->empty_rx_queue++;
+
+                        if (rx_ring->empty_rx_queue >= EMPTY_RX_REFILL) {
+                                u64_stats_update_begin(&rx_ring->syncp);
+                                rx_ring->rx_stats.empty_rx_ring++;
+                                u64_stats_update_end(&rx_ring->syncp);
+
+                                netif_err(adapter, drv, adapter->netdev,
+                                          "trigger refill for ring %d\n", i);
+
+                                napi_schedule(rx_ring->napi);
+                                rx_ring->empty_rx_queue = 0;
+                        }
+                } else {
+                        rx_ring->empty_rx_queue = 0;
+                }
+        }
+}
+
 /* Check for keep alive expiration */
 static void check_for_missing_keep_alive(struct ena_adapter *adapter)
 {
@@ -2660,6 +2736,8 @@ static void ena_timer_service(unsigned long data)
 
         check_for_missing_tx_completions(adapter);
 
+        check_for_empty_rx_ring(adapter);
+
         if (debug_area)
                 ena_dump_stats_to_buf(adapter, debug_area);
 
@@ -2840,6 +2918,11 @@ static void ena_release_bars(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
 {
         int release_bars;
 
+        if (ena_dev->mem_bar)
+                devm_iounmap(&pdev->dev, ena_dev->mem_bar);
+
+        devm_iounmap(&pdev->dev, ena_dev->reg_bar);
+
         release_bars = pci_select_bars(pdev, IORESOURCE_MEM) & ENA_BAR_MASK;
         pci_release_selected_regions(pdev, release_bars);
 }
@@ -2927,8 +3010,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_free_ena_dev;
         }
 
-        ena_dev->reg_bar = ioremap(pci_resource_start(pdev, ENA_REG_BAR),
-                                   pci_resource_len(pdev, ENA_REG_BAR));
+        ena_dev->reg_bar = devm_ioremap(&pdev->dev,
+                                        pci_resource_start(pdev, ENA_REG_BAR),
+                                        pci_resource_len(pdev, ENA_REG_BAR));
         if (!ena_dev->reg_bar) {
                 dev_err(&pdev->dev, "failed to remap regs bar\n");
                 rc = -EFAULT;
@@ -2948,8 +3032,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         ena_set_push_mode(pdev, ena_dev, &get_feat_ctx);
 
         if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) {
-                ena_dev->mem_bar = ioremap_wc(pci_resource_start(pdev, ENA_MEM_BAR),
-                                              pci_resource_len(pdev, ENA_MEM_BAR));
+                ena_dev->mem_bar = devm_ioremap_wc(&pdev->dev,
+                                                   pci_resource_start(pdev, ENA_MEM_BAR),
+                                                   pci_resource_len(pdev, ENA_MEM_BAR));
                 if (!ena_dev->mem_bar) {
                         rc = -EFAULT;
                         goto err_device_destroy;
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 0e22bce6239d..a4d3d5e21068 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    1
 #define DRV_MODULE_VER_MINOR    1
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 7
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
@@ -146,7 +146,18 @@ struct ena_tx_buffer {
         u32 tx_descs;
         /* num of buffers used by this skb */
         u32 num_of_bufs;
-        /* Save the last jiffies to detect missing tx packets */
+
+        /* Used for detect missing tx packets to limit the number of prints */
+        u32 print_once;
+        /* Save the last jiffies to detect missing tx packets
+         *
+         * sets to non zero value on ena_start_xmit and set to zero on
+         * napi and timer_Service_routine.
+         *
+         * while this value is not protected by lock,
+         * a given packet is not expected to be handled by ena_start_xmit
+         * and by napi/timer_service at the same time.
+         */
         unsigned long last_jiffies;
         struct ena_com_buf bufs[ENA_PKT_MAX_BUFS];
 } ____cacheline_aligned;
@@ -170,7 +181,6 @@ struct ena_stats_tx {
         u64 napi_comp;
         u64 tx_poll;
         u64 doorbells;
-        u64 missing_tx_comp;
         u64 bad_req_id;
 };
 
@@ -184,6 +194,7 @@ struct ena_stats_rx {
         u64 dma_mapping_err;
         u64 bad_desc_num;
         u64 rx_copybreak_pkt;
+        u64 empty_rx_ring;
 };
 
 struct ena_ring {
@@ -231,6 +242,7 @@ struct ena_ring {
                 struct ena_stats_tx tx_stats;
                 struct ena_stats_rx rx_stats;
         };
+        int empty_rx_queue;
 } ____cacheline_aligned;
 
 struct ena_stats_dev {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index b3bc87fe3764..0a98c369df20 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -324,7 +324,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
                               struct xgbe_ring *ring,
                               struct xgbe_ring_data *rdata)
 {
-        int order, ret;
+        int ret;
 
         if (!ring->rx_hdr_pa.pages) {
                 ret = xgbe_alloc_pages(pdata, &ring->rx_hdr_pa, GFP_ATOMIC, 0);
@@ -333,9 +333,8 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
         }
 
         if (!ring->rx_buf_pa.pages) {
-                order = max_t(int, PAGE_ALLOC_COSTLY_ORDER - 1, 0);
                 ret = xgbe_alloc_pages(pdata, &ring->rx_buf_pa, GFP_ATOMIC,
-                                       order);
+                                       PAGE_ALLOC_COSTLY_ORDER);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index b8e3d88f0879..a66aee51ab5b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -193,9 +193,6 @@ int hw_atl_utils_hw_get_regs(struct aq_hw_s *self,
                              struct aq_hw_caps_s *aq_hw_caps,
                              u32 *regs_buff);
 
-int hw_atl_utils_hw_get_settings(struct aq_hw_s *self,
-                                 struct ethtool_cmd *cmd);
-
 int hw_atl_utils_hw_set_power(struct aq_hw_s *self,
                               unsigned int power_state);
 
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index 63f2deec2a52..77a1c03255de 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1353,6 +1353,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) &&
                 pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
                 printk(KERN_ERR "atl2: No usable DMA configuration, aborting\n");
+                err = -EIO;
                 goto err_dma;
         }
 
@@ -1366,10 +1367,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * pcibios_set_master to do the needed arch specific settings */
         pci_set_master(pdev);
 
-        err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct atl2_adapter));
-        if (!netdev)
+        if (!netdev) {
+                err = -ENOMEM;
                 goto err_alloc_etherdev;
+        }
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
@@ -1408,8 +1410,6 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_sw_init;
 
-        err = -EIO;
-
         netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
         netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 099b374c1b17..5274501428e4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2026,9 +2026,12 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         priv->num_rx_desc_words = params->num_rx_desc_words;
 
         priv->irq0 = platform_get_irq(pdev, 0);
-        if (!priv->is_lite)
+        if (!priv->is_lite) {
                 priv->irq1 = platform_get_irq(pdev, 1);
-        priv->wol_irq = platform_get_irq(pdev, 2);
+                priv->wol_irq = platform_get_irq(pdev, 2);
+        } else {
+                priv->wol_irq = platform_get_irq(pdev, 1);
+        }
         if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index eccb3d1b6abb..f619c4cac51f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1926,7 +1926,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
@@ -3883,15 +3883,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* when transmitting in a vf, start bd must hold the ethertype
                  * for fw to enforce it
                  */
+                u16 vlan_tci = 0;
 #ifndef BNX2X_STOP_ON_ERROR
-                if (IS_VF(bp))
+                if (IS_VF(bp)) {
 #endif
-                        tx_start_bd->vlan_or_ethertype =
-                                cpu_to_le16(ntohs(eth->h_proto));
+                        /* Still need to consider inband vlan for enforced */
+                        if (__vlan_get_tag(skb, &vlan_tci)) {
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(ntohs(eth->h_proto));
+                        } else {
+                                tx_start_bd->bd_flags.as_bitfield |=
+                                        (X_ETH_INBAND_VLAN <<
+                                         ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(vlan_tci);
+                        }
 #ifndef BNX2X_STOP_ON_ERROR
-                else
+                } else {
                         /* used by FW for packet accounting */
                         tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
+                }
 #endif
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a851f95c307a..349a46593abf 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12729,7 +12729,7 @@ static int bnx2x_set_mc_list(struct bnx2x *bp)
         } else {
                 /* If no mc addresses are required, flush the configuration */
                 rc = bnx2x_config_mcast(bp, &rparam, BNX2X_MCAST_CMD_DEL);
-                if (rc)
+                if (rc < 0)
                         BNX2X_ERR("Failed to clear multicast configuration %d\n",
                                   rc);
         }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index bdfd53b46bc5..9ca994d0bab6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -901,6 +901,8 @@ static void bnx2x_vf_flr(struct bnx2x *bp, struct bnx2x_virtf *vf)
         /* release VF resources */
         bnx2x_vf_free_resc(bp, vf);
 
+        vf->malicious = false;
+
         /* re-open the mailbox */
         bnx2x_vf_enable_mbx(bp, vf->abs_vfid);
         return;
@@ -1822,9 +1824,11 @@ get_vf:
                    vf->abs_vfid, qidx);
                 bnx2x_vf_handle_rss_update_eqe(bp, vf);
         case EVENT_RING_OPCODE_VF_FLR:
-        case EVENT_RING_OPCODE_MALICIOUS_VF:
                 /* Do nothing for now */
                 return 0;
+        case EVENT_RING_OPCODE_MALICIOUS_VF:
+                vf->malicious = true;
+                return 0;
         }
 
         return 0;
@@ -1905,6 +1909,13 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                         continue;
                 }
 
+                if (vf->malicious) {
+                        DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                               "vf %d malicious so no stats for it\n",
+                               vf->abs_vfid);
+                        continue;
+                }
+
                 DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
                        "add addresses for vf %d\n", vf->abs_vfid);
                 for_each_vfq(vf, j) {
@@ -3042,7 +3053,7 @@ void bnx2x_vf_pci_dealloc(struct bnx2x *bp)
 {
         BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
                        sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
+        BNX2X_PCI_FREE(bp->pf2vf_bulletin, bp->pf2vf_bulletin_mapping,
                        sizeof(union pf_vf_bulletin));
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 888d0b6632e8..53466f6cebab 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -141,6 +141,7 @@ struct bnx2x_virtf {
 #define VF_RESET        3       /* VF FLR'd, pending cleanup */
 
         bool flr_clnup_stage;   /* true during flr cleanup */
+        bool malicious;         /* true if FW indicated so, until FLR */
 
         /* dma */
         dma_addr_t fw_stat_map;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 03f55daecb20..74e8e215524d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1301,10 +1301,11 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
                 cp_cons = NEXT_CMP(cp_cons);
         }
 
-        if (unlikely(agg_bufs > MAX_SKB_FRAGS)) {
+        if (unlikely(agg_bufs > MAX_SKB_FRAGS || TPA_END_ERRORS(tpa_end1))) {
                 bnxt_abort_tpa(bp, bnapi, cp_cons, agg_bufs);
-                netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
-                            agg_bufs, (int)MAX_SKB_FRAGS);
+                if (agg_bufs > MAX_SKB_FRAGS)
+                        netdev_warn(bp->dev, "TPA frags %d exceeded MAX_SKB_FRAGS %d\n",
+                                    agg_bufs, (int)MAX_SKB_FRAGS);
                 return NULL;
         }
 
@@ -1562,6 +1563,45 @@ next_rx_no_prod:
         return rc;
 }
 
+/* In netpoll mode, if we are using a combined completion ring, we need to
+ * discard the rx packets and recycle the buffers.
+ */
+static int bnxt_force_rx_discard(struct bnxt *bp, struct bnxt_napi *bnapi,
+                                 u32 *raw_cons, u8 *event)
+{
+        struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+        u32 tmp_raw_cons = *raw_cons;
+        struct rx_cmp_ext *rxcmp1;
+        struct rx_cmp *rxcmp;
+        u16 cp_cons;
+        u8 cmp_type;
+
+        cp_cons = RING_CMP(tmp_raw_cons);
+        rxcmp = (struct rx_cmp *)
+                        &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
+
+        tmp_raw_cons = NEXT_RAW_CMP(tmp_raw_cons);
+        cp_cons = RING_CMP(tmp_raw_cons);
+        rxcmp1 = (struct rx_cmp_ext *)
+                        &cpr->cp_desc_ring[CP_RING(cp_cons)][CP_IDX(cp_cons)];
+
+        if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+                return -EBUSY;
+
+        cmp_type = RX_CMP_TYPE(rxcmp);
+        if (cmp_type == CMP_TYPE_RX_L2_CMP) {
+                rxcmp1->rx_cmp_cfa_code_errors_v2 |=
+                        cpu_to_le32(RX_CMPL_ERRORS_CRC_ERROR);
+        } else if (cmp_type == CMP_TYPE_RX_L2_TPA_END_CMP) {
+                struct rx_tpa_end_cmp_ext *tpa_end1;
+
+                tpa_end1 = (struct rx_tpa_end_cmp_ext *)rxcmp1;
+                tpa_end1->rx_tpa_end_cmp_errors_v2 |=
+                        cpu_to_le32(RX_TPA_END_CMP_ERRORS);
+        }
+        return bnxt_rx_pkt(bp, bnapi, raw_cons, event);
+}
+
 #define BNXT_GET_EVENT_PORT(data)       \
         ((data) &                       \
          ASYNC_EVENT_CMPL_PORT_CONN_NOT_ALLOWED_EVENT_DATA1_PORT_ID_MASK)
@@ -1744,7 +1784,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
                         if (unlikely(tx_pkts > bp->tx_wake_thresh))
                                 rx_pkts = budget;
                 } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
-                        rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
+                        if (likely(budget))
+                                rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
+                        else
+                                rc = bnxt_force_rx_discard(bp, bnapi, &raw_cons,
+                                                           &event);
                         if (likely(rc >= 0))
                                 rx_pkts += rc;
                         else if (rc == -EBUSY)  /* partial completion */
@@ -6663,12 +6707,11 @@ static void bnxt_poll_controller(struct net_device *dev)
         struct bnxt *bp = netdev_priv(dev);
         int i;
 
-        for (i = 0; i < bp->cp_nr_rings; i++) {
-                struct bnxt_irq *irq = &bp->irq_tbl[i];
+        /* Only process tx rings/combined rings in netpoll mode. */
+        for (i = 0; i < bp->tx_nr_rings; i++) {
+                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
 
-                disable_irq(irq->vector);
-                irq->handler(irq->vector, bp->bnapi[i]);
-                enable_irq(irq->vector);
+                napi_schedule(&txr->bnapi->napi);
         }
 }
 #endif
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 3ef42dbc6327..d46a85041083 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -374,12 +374,16 @@ struct rx_tpa_end_cmp_ext {
 
         __le32 rx_tpa_end_cmp_errors_v2;
         #define RX_TPA_END_CMP_V2                               (0x1 << 0)
-        #define RX_TPA_END_CMP_ERRORS                           (0x7fff << 1)
+        #define RX_TPA_END_CMP_ERRORS                           (0x3 << 1)
         #define RX_TPA_END_CMPL_ERRORS_SHIFT                     1
 
         u32 rx_tpa_end_cmp_start_opaque;
 };
 
+#define TPA_END_ERRORS(rx_tpa_end_ext)                                  \
+        ((rx_tpa_end_ext)->rx_tpa_end_cmp_errors_v2 &                   \
+         cpu_to_le32(RX_TPA_END_CMP_ERRORS))
+
 #define DB_IDX_MASK                                             0xffffff
 #define DB_IDX_VALID                                            (0x1 << 26)
 #define DB_IRQ_DIS                                              (0x1 << 27)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 38a5c6764bb5..53309f659951 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2171,9 +2171,10 @@ static int cxgb_up(struct adapter *adap)
 {
         int err;
 
+        mutex_lock(&uld_mutex);
         err = setup_sge_queues(adap);
         if (err)
-                goto out;
+                goto rel_lock;
         err = setup_rss(adap);
         if (err)
                 goto freeq;
@@ -2196,23 +2197,28 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto irq_err;
         }
+
         enable_rx(adap);
         t4_sge_start(adap);
         t4_intr_enable(adap);
         adap->flags |= FULL_INIT_DONE;
+        mutex_unlock(&uld_mutex);
+
         notify_ulds(adap, CXGB4_STATE_UP);
 #if IS_ENABLED(CONFIG_IPV6)
         update_clip(adap);
 #endif
         /* Initialize hash mac addr list*/
         INIT_LIST_HEAD(&adap->mac_hlist);
- out:
         return err;
+
  irq_err:
         dev_err(adap->pdev_dev, "request_irq failed, err %d\n", err);
  freeq:
         t4_free_sge_resources(adap);
-        goto out;
+ rel_lock:
+        mutex_unlock(&uld_mutex);
+        return err;
 }
 
 static void cxgb_down(struct adapter *adapter)
@@ -2771,6 +2777,9 @@ void t4_fatal_err(struct adapter *adap)
 {
         int port;
 
+        if (pci_channel_offline(adap->pdev))
+                return;
+
         /* Disable the SGE since ULDs are going to free resources that
          * could be exposed to the adapter.  RDMA MWs for example...
          */
@@ -3882,9 +3891,10 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
         spin_lock(&adap->stats_lock);
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                netif_device_detach(dev);
-                netif_carrier_off(dev);
+                if (dev) {
+                        netif_device_detach(dev);
+                        netif_carrier_off(dev);
+                }
         }
         spin_unlock(&adap->stats_lock);
         disable_interrupts(adap);
@@ -3963,12 +3973,13 @@ static void eeh_resume(struct pci_dev *pdev)
         rtnl_lock();
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                if (netif_running(dev)) {
-                        link_start(dev);
-                        cxgb_set_rxmode(dev);
+                if (dev) {
+                        if (netif_running(dev)) {
+                                link_start(dev);
+                                cxgb_set_rxmode(dev);
+                        }
+                        netif_device_attach(dev);
                 }
-                netif_device_attach(dev);
         }
         rtnl_unlock();
 }
@@ -4516,7 +4527,7 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &cxgb4_mgmt_netdev_ops;
         dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static int config_mgmt_dev(struct pci_dev *pdev)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index aded42b96f6d..3a34aa629f7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4557,8 +4557,13 @@ void t4_intr_enable(struct adapter *adapter)
  */
 void t4_intr_disable(struct adapter *adapter)
 {
-        u32 whoami = t4_read_reg(adapter, PL_WHOAMI_A);
-        u32 pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
+        u32 whoami, pf;
+
+        if (pci_channel_offline(adapter->pdev))
+                return;
+
+        whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
                         SOURCEPF_G(whoami) : T6_SOURCEPF_G(whoami);
 
         t4_write_reg(adapter, MYPF_REG(PL_PF_INT_ENABLE_A), 0);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 3549d3876278..f2d623a7aee0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2B
+#define T4FW_VERSION_MICRO 0x2D
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2B
+#define T5FW_VERSION_MICRO 0x2D
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2B
+#define T6FW_VERSION_MICRO 0x2D
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index f3a09ab55900..4eee18ce9be4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5078,9 +5078,11 @@ static netdev_features_t be_features_check(struct sk_buff *skb,
         struct be_adapter *adapter = netdev_priv(dev);
         u8 l4_hdr = 0;
 
-        /* The code below restricts offload features for some tunneled packets.
+        /* The code below restricts offload features for some tunneled and
+         * Q-in-Q packets.
          * Offload features for normal (non tunnel) packets are unchanged.
          */
+        features = vlan_features_check(skb, features);
         if (!skb->encapsulation ||
             !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS))
                 return features;
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index e863ba74d005..8bb0db990c8f 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -739,6 +739,8 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
+        napi_enable(&priv->napi);
+
         ethoc_init_ring(priv, dev->mem_start);
         ethoc_reset(priv);
 
@@ -754,7 +756,6 @@ static int ethoc_open(struct net_device *dev)
         priv->old_duplex = -1;
 
         phy_start(dev->phydev);
-        napi_enable(&priv->napi);
 
         if (netif_msg_ifup(priv)) {
                 dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 9a520e4f0df9..290ad0563320 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2647,7 +2647,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
         priv->buf_layout[TX].priv_data_size = DPAA_TX_PRIV_DATA_SIZE; /* Tx */
 
         /* device used for DMA mapping */
-        arch_setup_dma_ops(dev, 0, 0, NULL, false);
+        set_dma_ops(dev, get_dma_ops(&pdev->dev));
         err = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(40));
         if (err) {
                 dev_err(dev, "dma_coerce_mask_and_coherent() failed\n");
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56a563f90b0b..f7c8649fd28f 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3192,7 +3192,7 @@ static int fec_reset_phy(struct platform_device *pdev)
 {
         int err, phy_reset;
         bool active_high = false;
-        int msec = 1;
+        int msec = 1, phy_post_delay = 0;
         struct device_node *np = pdev->dev.of_node;
 
         if (!np)
@@ -3209,6 +3209,11 @@ static int fec_reset_phy(struct platform_device *pdev)
         else if (!gpio_is_valid(phy_reset))
                 return 0;
 
+        err = of_property_read_u32(np, "phy-reset-post-delay", &phy_post_delay);
+        /* valid reset duration should be less than 1s */
+        if (!err && phy_post_delay > 1000)
+                return -EINVAL;
+
         active_high = of_property_read_bool(np, "phy-reset-active-high");
 
         err = devm_gpio_request_one(&pdev->dev, phy_reset,
@@ -3226,6 +3231,15 @@ static int fec_reset_phy(struct platform_device *pdev)
 
         gpio_set_value_cansleep(phy_reset, !active_high);
 
+        if (!phy_post_delay)
+                return 0;
+
+        if (phy_post_delay > 20)
+                msleep(phy_post_delay);
+        else
+                usleep_range(phy_post_delay * 1000,
+                             phy_post_delay * 1000 + 1000);
+
         return 0;
 }
 #else /* CONFIG_OF */
diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig
index dc0850b3b517..8870a9a798ca 100644
--- a/drivers/net/ethernet/freescale/fman/Kconfig
+++ b/drivers/net/ethernet/freescale/fman/Kconfig
@@ -2,6 +2,7 @@ config FSL_FMAN
         tristate "FMan support"
         depends on FSL_SOC || ARCH_LAYERSCAPE || COMPILE_TEST
         select GENERIC_ALLOCATOR
+        depends on HAS_DMA
         select PHYLIB
         default n
         help
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 0b31f8502ada..6e67d22fd0d5 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -623,6 +623,8 @@ static struct platform_device *dpaa_eth_add_device(int fman_id,
                 goto no_mem;
         }
 
+        set_dma_ops(&pdev->dev, get_dma_ops(priv->dev));
+
         ret = platform_device_add_data(pdev, &data, sizeof(data));
         if (ret)
                 goto err;
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 446c7b374ff5..a10de1e9c157 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
 {
         const struct of_device_id *id =
                 of_match_device(fsl_pq_mdio_match, &pdev->dev);
-        const struct fsl_pq_mdio_data *data = id->data;
+        const struct fsl_pq_mdio_data *data;
         struct device_node *np = pdev->dev.of_node;
         struct resource res;
         struct device_node *tbi;
@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
         struct mii_bus *new_bus;
         int err;
 
+        if (!id) {
+                dev_err(&pdev->dev, "Failed to match device\n");
+                return -ENODEV;
+        }
+
+        data = id->data;
+
         dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
 
         new_bus = mdiobus_alloc_size(sizeof(*priv));
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index b8fab149690f..e95795b3c841 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -288,9 +288,15 @@ static int hns_nic_config_phy_loopback(struct phy_device *phy_dev, u8 en)
 
                 /* Force 1000M Link, Default is 0x0200 */
                 phy_write(phy_dev, 7, 0x20C);
-                phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
 
-                /* Enable PHY loop-back */
+                /* Powerup Fiber */
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 1);
+                val = phy_read(phy_dev, COPPER_CONTROL_REG);
+                val &= ~PHY_POWER_DOWN;
+                phy_write(phy_dev, COPPER_CONTROL_REG, val);
+
+                /* Enable Phy Loopback */
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
                 val = phy_read(phy_dev, COPPER_CONTROL_REG);
                 val |= PHY_LOOP_BACK;
                 val &= ~PHY_POWER_DOWN;
@@ -299,6 +305,12 @@ static int hns_nic_config_phy_loopback(struct phy_device *phy_dev, u8 en)
                 phy_write(phy_dev, HNS_PHY_PAGE_REG, 0xFA);
                 phy_write(phy_dev, 1, 0x400);
                 phy_write(phy_dev, 7, 0x200);
+
+                phy_write(phy_dev, HNS_PHY_PAGE_REG, 1);
+                val = phy_read(phy_dev, COPPER_CONTROL_REG);
+                val |= PHY_POWER_DOWN;
+                phy_write(phy_dev, COPPER_CONTROL_REG, val);
+
                 phy_write(phy_dev, HNS_PHY_PAGE_REG, 0);
                 phy_write(phy_dev, 9, 0xF00);
 
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 508923f39ccf..259e69a52ec5 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -343,6 +343,7 @@ static int emac_reset(struct emac_instance *dev)
 {
         struct emac_regs __iomem *p = dev->emacp;
         int n = 20;
+        bool __maybe_unused try_internal_clock = false;
 
         DBG(dev, "reset" NL);
 
@@ -355,6 +356,7 @@ static int emac_reset(struct emac_instance *dev)
         }
 
 #ifdef CONFIG_PPC_DCR_NATIVE
+do_retry:
         /*
          * PPC460EX/GT Embedded Processor Advanced User's Manual
          * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
@@ -362,10 +364,19 @@ static int emac_reset(struct emac_instance *dev)
          * of the EMAC. If none is present, select the internal clock
          * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
          * After a soft reset, select the external clock.
+         *
+         * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
+         * ethernet cable is not attached. This causes the reset to timeout
+         * and the PHY detection code in emac_init_phy() is unable to
+         * communicate and detect the AR8035-A PHY. As a result, the emac
+         * driver bails out early and the user has no ethernet.
+         * In order to stay compatible with existing configurations, the
+         * driver will temporarily switch to the internal clock, after
+         * the first reset fails.
          */
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: select internal loop clock before reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     0, SDR0_ETH_CFG_ECS << dev->cell_index);
@@ -383,8 +394,15 @@ static int emac_reset(struct emac_instance *dev)
 
 #ifdef CONFIG_PPC_DCR_NATIVE
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (!n && !try_internal_clock) {
+                        /* first attempt has timed out. */
+                        n = 20;
+                        try_internal_clock = true;
+                        goto do_retry;
+                }
+
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: restore external clock source after reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     SDR0_ETH_CFG_ECS << dev->cell_index, 0);
@@ -2460,20 +2478,24 @@ static int emac_mii_bus_reset(struct mii_bus *bus)
         return emac_reset(dev);
 }
 
+static int emac_mdio_phy_start_aneg(struct mii_phy *phy,
+                                    struct phy_device *phy_dev)
+{
+        phy_dev->autoneg = phy->autoneg;
+        phy_dev->speed = phy->speed;
+        phy_dev->duplex = phy->duplex;
+        phy_dev->advertising = phy->advertising;
+        return phy_start_aneg(phy_dev);
+}
+
 static int emac_mdio_setup_aneg(struct mii_phy *phy, u32 advertise)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg = AUTONEG_ENABLE;
-        dev->phy.speed = SPEED_1000;
-        dev->phy.duplex = DUPLEX_FULL;
-        dev->phy.advertising = advertise;
         phy->autoneg = AUTONEG_ENABLE;
-        phy->speed = dev->phy.speed;
-        phy->duplex = dev->phy.duplex;
         phy->advertising = advertise;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
@@ -2481,13 +2503,10 @@ static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg =  AUTONEG_DISABLE;
-        dev->phy.speed = speed;
-        dev->phy.duplex = fd;
         phy->autoneg = AUTONEG_DISABLE;
         phy->speed = speed;
         phy->duplex = fd;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_poll_link(struct mii_phy *phy)
@@ -2509,16 +2528,17 @@ static int emac_mdio_read_link(struct mii_phy *phy)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
+        struct phy_device *phy_dev = dev->phy_dev;
         int res;
 
-        res = phy_read_status(dev->phy_dev);
+        res = phy_read_status(phy_dev);
         if (res)
                 return res;
 
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
+        phy->speed = phy_dev->speed;
+        phy->duplex = phy_dev->duplex;
+        phy->pause = phy_dev->pause;
+        phy->asym_pause = phy_dev->asym_pause;
         return 0;
 }
 
@@ -2528,13 +2548,6 @@ static int emac_mdio_init_phy(struct mii_phy *phy)
         struct emac_instance *dev = netdev_priv(ndev);
 
         phy_start(dev->phy_dev);
-        dev->phy.autoneg = phy->autoneg;
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.advertising = phy->advertising;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
-
         return phy_init_hw(dev->phy_dev);
 }
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f2d329dba99..c0fbeb387db4 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -81,7 +81,7 @@
 static const char ibmvnic_driver_name[] = "ibmvnic";
 static const char ibmvnic_driver_string[] = "IBM System i/p Virtual NIC Driver";
 
-MODULE_AUTHOR("Santiago Leon <santi_leon@yahoo.com>");
+MODULE_AUTHOR("Santiago Leon");
 MODULE_DESCRIPTION("IBM System i/p Virtual NIC Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
@@ -1468,6 +1468,11 @@ static void ibmvnic_netpoll_controller(struct net_device *dev)
 }
 #endif
 
+static int ibmvnic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        return -EOPNOTSUPP;
+}
+
 static const struct net_device_ops ibmvnic_netdev_ops = {
         .ndo_open               = ibmvnic_open,
         .ndo_stop               = ibmvnic_close,
@@ -1479,6 +1484,7 @@ static const struct net_device_ops ibmvnic_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ibmvnic_netpoll_controller,
 #endif
+        .ndo_change_mtu         = ibmvnic_change_mtu,
 };
 
 /* ethtool functions */
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index cdde3cc28fb5..44d9610f7a15 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -399,6 +399,7 @@ struct i40e_pf {
 #define I40E_FLAG_RX_CSUM_ENABLED               BIT_ULL(1)
 #define I40E_FLAG_MSI_ENABLED                   BIT_ULL(2)
 #define I40E_FLAG_MSIX_ENABLED                  BIT_ULL(3)
+#define I40E_FLAG_HW_ATR_EVICT_ENABLED          BIT_ULL(4)
 #define I40E_FLAG_RSS_ENABLED                   BIT_ULL(6)
 #define I40E_FLAG_VMDQ_ENABLED                  BIT_ULL(7)
 #define I40E_FLAG_IWARP_ENABLED                 BIT_ULL(10)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 7a8eb486b9ea..894c8e57ba00 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -224,7 +224,7 @@ static const struct i40e_priv_flags i40e_gstrings_priv_flags[] = {
         I40E_PRIV_FLAG("LinkPolling", I40E_FLAG_LINK_POLLING_ENABLED, 0),
         I40E_PRIV_FLAG("flow-director-atr", I40E_FLAG_FD_ATR_ENABLED, 0),
         I40E_PRIV_FLAG("veb-stats", I40E_FLAG_VEB_STATS_ENABLED, 0),
-        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_CAPABLE, 0),
+        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_ENABLED, 0),
         I40E_PRIV_FLAG("legacy-rx", I40E_FLAG_LEGACY_RX, 0),
 };
 
@@ -4092,7 +4092,7 @@ flags_complete:
 
         /* Only allow ATR evict on hardware that is capable of handling it */
         if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
-                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_CAPABLE;
+                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_ENABLED;
 
         if (changed_flags & I40E_FLAG_TRUE_PROMISC_SUPPORT) {
                 u16 sw_flags = 0, valid_flags = 0;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d5c9c9e06ff5..a7a4b28b4144 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -295,7 +295,7 @@ struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
  **/
 void i40e_service_event_schedule(struct i40e_pf *pf)
 {
-        if (!test_bit(__I40E_VSI_DOWN, pf->state) &&
+        if (!test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
                 queue_work(i40e_wq, &pf->service_task);
 }
@@ -3611,7 +3611,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
                  * this is not a performance path and napi_schedule()
                  * can deal with rescheduling.
                  */
-                if (!test_bit(__I40E_VSI_DOWN, pf->state))
+                if (!test_bit(__I40E_DOWN, pf->state))
                         napi_schedule_irqoff(&q_vector->napi);
         }
 
@@ -3687,7 +3687,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
 enable_intr:
         /* re-enable interrupt causes */
         wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        if (!test_bit(__I40E_VSI_DOWN, pf->state)) {
+        if (!test_bit(__I40E_DOWN, pf->state)) {
                 i40e_service_event_schedule(pf);
                 i40e_irq_dynamic_enable_icr0(pf, false);
         }
@@ -6203,7 +6203,7 @@ static void i40e_fdir_reinit_subtask(struct i40e_pf *pf)
 {
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 return;
 
         if (test_bit(__I40E_FD_FLUSH_REQUESTED, pf->state))
@@ -6344,7 +6344,7 @@ static void i40e_watchdog_subtask(struct i40e_pf *pf)
         int i;
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state) ||
+        if (test_bit(__I40E_DOWN, pf->state) ||
             test_bit(__I40E_CONFIG_BUSY, pf->state))
                 return;
 
@@ -6399,9 +6399,9 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
                 reset_flags |= BIT(__I40E_GLOBAL_RESET_REQUESTED);
                 clear_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
         }
-        if (test_bit(__I40E_VSI_DOWN_REQUESTED, pf->state)) {
-                reset_flags |= BIT(__I40E_VSI_DOWN_REQUESTED);
-                clear_bit(__I40E_VSI_DOWN_REQUESTED, pf->state);
+        if (test_bit(__I40E_DOWN_REQUESTED, pf->state)) {
+                reset_flags |= BIT(__I40E_DOWN_REQUESTED);
+                clear_bit(__I40E_DOWN_REQUESTED, pf->state);
         }
 
         /* If there's a recovery already waiting, it takes
@@ -6415,7 +6415,7 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
 
         /* If we're already down or resetting, just bail */
         if (reset_flags &&
-            !test_bit(__I40E_VSI_DOWN, pf->state) &&
+            !test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_CONFIG_BUSY, pf->state)) {
                 rtnl_lock();
                 i40e_do_reset(pf, reset_flags, true);
@@ -7002,7 +7002,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
         u32 val;
         int v;
 
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 goto clear_recovery;
         dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n");
 
@@ -8821,11 +8821,12 @@ static int i40e_sw_init(struct i40e_pf *pf)
                     (pf->hw.aq.api_min_ver > 4))) {
                 /* Supported in FW API version higher than 1.4 */
                 pf->flags |= I40E_FLAG_GENEVE_OFFLOAD_CAPABLE;
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
-        } else {
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
         }
 
+        /* Enable HW ATR eviction if possible */
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+                pf->flags |= I40E_FLAG_HW_ATR_EVICT_ENABLED;
+
         pf->eeprom_version = 0xDEAD;
         pf->lan_veb = I40E_NO_VEB;
         pf->lan_vsi = I40E_NO_VSI;
@@ -9767,7 +9768,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
                 return -ENODEV;
         }
         if (vsi == pf->vsi[pf->lan_vsi] &&
-            !test_bit(__I40E_VSI_DOWN, pf->state)) {
+            !test_bit(__I40E_DOWN, pf->state)) {
                 dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
                 return -ENODEV;
         }
@@ -11003,7 +11004,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         pf->next_vsi = 0;
         pf->pdev = pdev;
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         hw = &pf->hw;
         hw->back = pf;
@@ -11293,7 +11294,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * before setting up the misc vector or we get a race and the vector
          * ends up disabled forever.
          */
-        clear_bit(__I40E_VSI_DOWN, pf->state);
+        clear_bit(__I40E_DOWN, pf->state);
 
         /* In case of MSIX we are going to setup the misc vector right here
          * to handle admin queue events etc. In case of legacy and MSI
@@ -11448,7 +11449,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* Unwind what we've done if something failed in the setup */
 err_vsis:
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         i40e_clear_interrupt_scheme(pf);
         kfree(pf->vsi);
 err_switch_setup:
@@ -11500,7 +11501,7 @@ static void i40e_remove(struct pci_dev *pdev)
 
         /* no more scheduling of any task */
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         if (pf->service_timer.data)
                 del_timer_sync(&pf->service_timer);
         if (pf->service_task.func)
@@ -11740,7 +11741,7 @@ static void i40e_shutdown(struct pci_dev *pdev)
         struct i40e_hw *hw = &pf->hw;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         rtnl_lock();
         i40e_prep_for_reset(pf, true);
         rtnl_unlock();
@@ -11789,7 +11790,7 @@ static int i40e_suspend(struct pci_dev *pdev, pm_message_t state)
         int retval = 0;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         if (pf->wol_en && (pf->flags & I40E_FLAG_WOL_MC_MAGIC_PKT_WAKE))
                 i40e_enable_mc_magic_wake(pf);
@@ -11841,7 +11842,7 @@ static int i40e_resume(struct pci_dev *pdev)
 
         /* handling the reset will rebuild the device state */
         if (test_and_clear_bit(__I40E_SUSPENDED, pf->state)) {
-                clear_bit(__I40E_VSI_DOWN, pf->state);
+                clear_bit(__I40E_DOWN, pf->state);
                 rtnl_lock();
                 i40e_reset_and_rebuild(pf, false, true);
                 rtnl_unlock();
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 29321a6167a6..77115c25d96f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1854,7 +1854,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
@@ -2340,7 +2341,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         /* Due to lack of space, no more new filters can be programmed */
         if (th->syn && (pf->flags & I40E_FLAG_FD_ATR_AUTO_DISABLED))
                 return;
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE) {
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED) {
                 /* HW ATR eviction will take care of removing filters on FIN
                  * and RST packets.
                  */
@@ -2402,7 +2403,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
                         I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT) &
                         I40E_TXD_FLTR_QW1_CNTINDEX_MASK;
 
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED)
                 dtype_cmd |= I40E_TXD_FLTR_QW1_ATR_MASK;
 
         fdir_desc->qindex_flex_ptype_vsi = cpu_to_le32(flex_ptype);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 95c23fbaa211..0fb38ca78900 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3017,10 +3017,12 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,
                                            VLAN_VID_MASK));
         }
 
+        spin_unlock_bh(&vsi->mac_filter_hash_lock);
         if (vlan_id || qos)
                 ret = i40e_vsi_add_pvid(vsi, vlanprio);
         else
                 i40e_vsi_remove_pvid(vsi);
+        spin_lock_bh(&vsi->mac_filter_hash_lock);
 
         if (vlan_id) {
                 dev_info(&pf->pdev->dev, "Setting VLAN %d, QOS 0x%x on VF %d\n",
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index dfe241a12ad0..12b02e530503 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1190,7 +1190,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 9b875d776b29..33c901622ed5 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3719,7 +3719,7 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                                     dma_addr_t *dma_addr,
                                     phys_addr_t *phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         *dma_addr = mvpp2_percpu_read(priv, cpu,
                                       MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
@@ -3740,6 +3740,8 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                 if (sizeof(phys_addr_t) == 8)
                         *phys_addr |= (u64)phys_addr_highbits << 32;
         }
+
+        put_cpu();
 }
 
 /* Free all buffers from the pool */
@@ -3920,18 +3922,12 @@ static inline u32 mvpp2_bm_cookie_pool_set(u32 cookie, int pool)
         return bm;
 }
 
-/* Get pool number from a BM cookie */
-static inline int mvpp2_bm_cookie_pool_get(unsigned long cookie)
-{
-        return (cookie >> MVPP2_BM_COOKIE_POOL_OFFS) & 0xFF;
-}
-
 /* Release buffer to BM */
 static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                                      dma_addr_t buf_dma_addr,
                                      phys_addr_t buf_phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (port->priv->hw_version == MVPP22) {
                 u32 val = 0;
@@ -3958,15 +3954,15 @@ static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                            MVPP2_BM_VIRT_RLS_REG, buf_phys_addr);
         mvpp2_percpu_write(port->priv, cpu,
                            MVPP2_BM_PHY_RLS_REG(pool), buf_dma_addr);
+
+        put_cpu();
 }
 
 /* Refill BM pool */
-static void mvpp2_pool_refill(struct mvpp2_port *port, u32 bm,
+static void mvpp2_pool_refill(struct mvpp2_port *port, int pool,
                               dma_addr_t dma_addr,
                               phys_addr_t phys_addr)
 {
-        int pool = mvpp2_bm_cookie_pool_get(bm);
-
         mvpp2_bm_pool_put(port, pool, dma_addr, phys_addr);
 }
 
@@ -4186,8 +4182,6 @@ static void mvpp22_port_mii_set(struct mvpp2_port *port)
 {
         u32 val;
 
-        return;
-
         /* Only GOP port 0 has an XLG MAC */
         if (port->gop_id == 0) {
                 val = readl(port->base + MVPP22_XLG_CTRL3_REG);
@@ -4515,21 +4509,6 @@ static void mvpp2_rxq_offset_set(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_CONFIG_REG(prxq), val);
 }
 
-/* Obtain BM cookie information from descriptor */
-static u32 mvpp2_bm_cookie_build(struct mvpp2_port *port,
-                                 struct mvpp2_rx_desc *rx_desc)
-{
-        int cpu = smp_processor_id();
-        int pool;
-
-        pool = (mvpp2_rxdesc_status_get(port, rx_desc) &
-                MVPP2_RXD_BM_POOL_ID_MASK) >>
-                MVPP2_RXD_BM_POOL_ID_OFFS;
-
-        return ((pool & 0xFF) << MVPP2_BM_COOKIE_POOL_OFFS) |
-               ((cpu & 0xFF) << MVPP2_BM_COOKIE_CPU_OFFS);
-}
-
 /* Tx descriptors helper methods */
 
 /* Get pointer to next Tx descriptor to be processed (send) by HW */
@@ -4757,7 +4736,7 @@ static void mvpp2_txp_max_tx_size_set(struct mvpp2_port *port)
 static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
                                    struct mvpp2_rx_queue *rxq)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (rxq->pkts_coal > MVPP2_OCCUPIED_THRESH_MASK)
                 rxq->pkts_coal = MVPP2_OCCUPIED_THRESH_MASK;
@@ -4765,6 +4744,8 @@ static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_THRESH_REG,
                            rxq->pkts_coal);
+
+        put_cpu();
 }
 
 static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz)
@@ -4945,7 +4926,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
 
         /* Set Rx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         if (port->priv->hw_version == MVPP21)
                 rxq_dma = rxq->descs_dma;
@@ -4954,6 +4935,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, rxq_dma);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, rxq->size);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_INDEX_REG, 0);
+        put_cpu();
 
         /* Set Offset */
         mvpp2_rxq_offset_set(port, rxq->id, NET_SKB_PAD);
@@ -4980,9 +4962,13 @@ static void mvpp2_rxq_drop_pkts(struct mvpp2_port *port,
 
         for (i = 0; i < rx_received; i++) {
                 struct mvpp2_rx_desc *rx_desc = mvpp2_rxq_next_desc_get(rxq);
-                u32 bm = mvpp2_bm_cookie_build(port, rx_desc);
+                u32 status = mvpp2_rxdesc_status_get(port, rx_desc);
+                int pool;
+
+                pool = (status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
 
-                mvpp2_pool_refill(port, bm,
+                mvpp2_pool_refill(port, pool,
                                   mvpp2_rxdesc_dma_addr_get(port, rx_desc),
                                   mvpp2_rxdesc_cookie_get(port, rx_desc));
         }
@@ -5012,10 +4998,11 @@ static void mvpp2_rxq_deinit(struct mvpp2_port *port,
          * free descriptor number
          */
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Create and initialize a Tx queue */
@@ -5038,7 +5025,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         txq->last_desc = txq->size - 1;
 
         /* Set Tx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG,
                            txq->descs_dma);
@@ -5063,6 +5050,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG,
                            MVPP2_PREF_BUF_PTR(desc) | MVPP2_PREF_BUF_SIZE_16 |
                            MVPP2_PREF_BUF_THRESH(desc_per_txq / 2));
+        put_cpu();
 
         /* WRR / EJP configuration - indirect access */
         tx_port_num = mvpp2_egress_port(port);
@@ -5133,10 +5121,11 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->id), 0);
 
         /* Set Tx descriptors queue starting address and size */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Cleanup Tx ports */
@@ -5146,7 +5135,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
         int delay, pending, cpu;
         u32 val;
 
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         val = mvpp2_percpu_read(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG);
         val |= MVPP2_TXQ_DRAIN_EN_MASK;
@@ -5173,6 +5162,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
 
         val &= ~MVPP2_TXQ_DRAIN_EN_MASK;
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG, val);
+        put_cpu();
 
         for_each_present_cpu(cpu) {
                 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
@@ -5420,7 +5410,7 @@ static void mvpp2_rx_csum(struct mvpp2_port *port, u32 status,
 
 /* Reuse skb if possible, or allocate a new skb and add it to BM pool */
 static int mvpp2_rx_refill(struct mvpp2_port *port,
-                           struct mvpp2_bm_pool *bm_pool, u32 bm)
+                           struct mvpp2_bm_pool *bm_pool, int pool)
 {
         dma_addr_t dma_addr;
         phys_addr_t phys_addr;
@@ -5432,7 +5422,7 @@ static int mvpp2_rx_refill(struct mvpp2_port *port,
         if (!buf)
                 return -ENOMEM;
 
-        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
 
         return 0;
 }
@@ -5490,7 +5480,7 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 unsigned int frag_size;
                 dma_addr_t dma_addr;
                 phys_addr_t phys_addr;
-                u32 bm, rx_status;
+                u32 rx_status;
                 int pool, rx_bytes, err;
                 void *data;
 
@@ -5502,8 +5492,8 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 phys_addr = mvpp2_rxdesc_cookie_get(port, rx_desc);
                 data = (void *)phys_to_virt(phys_addr);
 
-                bm = mvpp2_bm_cookie_build(port, rx_desc);
-                pool = mvpp2_bm_cookie_pool_get(bm);
+                pool = (rx_status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
                 bm_pool = &port->priv->bm_pools[pool];
 
                 /* In case of an error, release the requested buffer pointer
@@ -5516,7 +5506,7 @@ err_drop_frame:
                         dev->stats.rx_errors++;
                         mvpp2_rx_error(port, rx_desc);
                         /* Return the buffer to the pool */
-                        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+                        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
                         continue;
                 }
 
@@ -5531,7 +5521,7 @@ err_drop_frame:
                         goto err_drop_frame;
                 }
 
-                err = mvpp2_rx_refill(port, bm_pool, bm);
+                err = mvpp2_rx_refill(port, bm_pool, pool);
                 if (err) {
                         netdev_err(port->dev, "failed to refill BM pools\n");
                         goto err_drop_frame;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index ae5fdc2df654..ffbcb27c05e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1562,11 +1562,6 @@ static int mlx4_en_flow_replace(struct net_device *dev,
                 qpn = priv->drop_qp.qpn;
         else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
                 qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
-                if (qpn < priv->rss_map.base_qpn ||
-                    qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
-                        en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
-                        return -EINVAL;
-                }
         } else {
                 if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
                         en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 1a670b681555..0710b3677464 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -35,6 +35,7 @@
 #include <linux/etherdevice.h>
 
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include <linux/export.h>
 
 #include "mlx4.h"
@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
 
+        if (!mlx4_qp_lookup(dev, rule->qpn)) {
+                mlx4_err_rule(dev, "QP doesn't exist\n", rule);
+                ret = -EINVAL;
+                goto out;
+        }
+
         trans_rule_ctrl_to_hw(rule, mailbox->buf);
 
         size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
 
         list_for_each_entry(cur, &rule->list, list) {
                 ret = parse_trans_rule(dev, cur, mailbox->buf + size);
-                if (ret < 0) {
-                        mlx4_free_cmd_mailbox(dev, mailbox);
-                        return ret;
-                }
+                if (ret < 0)
+                        goto out;
+
                 size += ret;
         }
 
@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
                 }
         }
 
+out:
         mlx4_free_cmd_mailbox(dev, mailbox);
 
         return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2d6abd4662b1..5a310d313e94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -384,6 +384,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
                 __mlx4_qp_free_icm(dev, qpn);
 }
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+{
+        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+        struct mlx4_qp *qp;
+
+        spin_lock(&qp_table->lock);
+
+        qp = __mlx4_qp_lookup(dev, qpn);
+
+        spin_unlock(&qp_table->lock);
+        return qp;
+}
+
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -471,6 +484,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
         }
 
         if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
+                if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
+                        mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
                 qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
                 cmd->qp_context.qos_vport = params->qos_vport;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 07516545474f..812783865205 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5255,6 +5255,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
 
+static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
+                           struct mlx4_vf_immed_vlan_work *work)
+{
+        ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
+        ctx->qp_context.qos_vport = work->qos_vport;
+}
+
 void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
 {
         struct mlx4_vf_immed_vlan_work *work =
@@ -5369,11 +5376,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
                                         qp->sched_queue & 0xC7;
                                 upd_context->qp_context.pri_path.sched_queue |=
                                         ((work->qos & 0x7) << 3);
-                                upd_context->qp_mask |=
-                                        cpu_to_be64(1ULL <<
-                                                    MLX4_UPD_QP_MASK_QOS_VPP);
-                                upd_context->qp_context.qos_vport =
-                                        work->qos_vport;
+
+                                if (dev->caps.flags2 &
+                                    MLX4_DEV_CAP_FLAG2_QOS_VPP)
+                                        update_qos_vpp(upd_context, work);
                         }
 
                         err = mlx4_cmd(dev, mailbox->dma,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5bdaf3d545b2..10d282841f5b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -774,7 +774,7 @@ static void cb_timeout_handler(struct work_struct *work)
         mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
                        mlx5_command_str(msg_to_opcode(ent->in)),
                        msg_to_opcode(ent->in));
-        mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+        mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
 }
 
 static void cmd_work_handler(struct work_struct *work)
@@ -804,6 +804,7 @@ static void cmd_work_handler(struct work_struct *work)
         }
 
         cmd->ent_arr[ent->idx] = ent;
+        set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
         memset(lay, 0, sizeof(*lay));
@@ -825,6 +826,20 @@ static void cmd_work_handler(struct work_struct *work)
         if (ent->callback)
                 schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
 
+        /* Skip sending command to fw if internal error */
+        if (pci_channel_offline(dev->pdev) ||
+            dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+                u8 status = 0;
+                u32 drv_synd;
+
+                ent->ret = mlx5_internal_err_ret_value(dev, msg_to_opcode(ent->in), &drv_synd, &status);
+                MLX5_SET(mbox_out, ent->out, status, status);
+                MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+                return;
+        }
+
         /* ring doorbell after the descriptor is valid */
         mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
         wmb();
@@ -835,7 +850,7 @@ static void cmd_work_handler(struct work_struct *work)
                 poll_timeout(ent);
                 /* make sure we read the descriptor after ownership is SW */
                 rmb();
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
         }
 }
 
@@ -879,7 +894,7 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
                 wait_for_completion(&ent->done);
         } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
                 ent->ret = -ETIMEDOUT;
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
         }
 
         err = ent->ret;
@@ -1375,7 +1390,7 @@ static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)
         }
 }
 
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -1395,6 +1410,19 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                         struct semaphore *sem;
 
                         ent = cmd->ent_arr[i];
+
+                        /* if we already completed the command, ignore it */
+                        if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP,
+                                                &ent->state)) {
+                                /* only real completion can free the cmd slot */
+                                if (!forced) {
+                                        mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+                                                      ent->idx);
+                                        free_ent(cmd, ent->idx);
+                                }
+                                continue;
+                        }
+
                         if (ent->callback)
                                 cancel_delayed_work(&ent->cb_timeout_work);
                         if (ent->page_queue)
@@ -1417,7 +1445,10 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                                 mlx5_core_dbg(dev, "command completed. ret 0x%x, delivery status %s(0x%x)\n",
                                               ent->ret, deliv_status_to_str(ent->status), ent->status);
                         }
-                        free_ent(cmd, ent->idx);
+
+                        /* only real completion will free the entry slot */
+                        if (!forced)
+                                free_ent(cmd, ent->idx);
 
                         if (ent->callback) {
                                 ds = ent->ts2 - ent->ts1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 2fd044b23875..944fc1742464 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -458,13 +458,15 @@ struct mlx5e_mpw_info {
 
 struct mlx5e_rx_am_stats {
         int ppms; /* packets per msec */
+        int bpms; /* bytes per msec */
         int epms; /* events per msec */
 };
 
 struct mlx5e_rx_am_sample {
-        ktime_t         time;
-        unsigned int    pkt_ctr;
-        u16             event_ctr;
+        ktime_t time;
+        u32     pkt_ctr;
+        u32     byte_ctr;
+        u16     event_ctr;
 };
 
 struct mlx5e_rx_am { /* Adaptive Moderation */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 8209affa75c3..16486dff1493 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1242,11 +1242,11 @@ static int mlx5e_get_ts_info(struct net_device *dev,
                                  SOF_TIMESTAMPING_RX_HARDWARE |
                                  SOF_TIMESTAMPING_RAW_HARDWARE;
 
-        info->tx_types = (BIT(1) << HWTSTAMP_TX_OFF) |
-                         (BIT(1) << HWTSTAMP_TX_ON);
+        info->tx_types = BIT(HWTSTAMP_TX_OFF) |
+                         BIT(HWTSTAMP_TX_ON);
 
-        info->rx_filters = (BIT(1) << HWTSTAMP_FILTER_NONE) |
-                           (BIT(1) << HWTSTAMP_FILTER_ALL);
+        info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) |
+                           BIT(HWTSTAMP_FILTER_ALL);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 41cd22a223dc..277f4de30375 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -4241,7 +4241,8 @@ struct net_device *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
         return netdev;
 
 err_cleanup_nic:
-        profile->cleanup(priv);
+        if (profile->cleanup)
+                profile->cleanup(priv);
         free_netdev(netdev);
 
         return NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 79462c0368a0..46984a52a94b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -791,6 +791,8 @@ static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
         params->tx_max_inline         = mlx5e_get_max_inline_cap(mdev);
         params->num_tc                = 1;
         params->lro_wqe_sz            = MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
+
+        mlx5_query_min_inline(mdev, &params->tx_min_inline_mode);
 }
 
 static void mlx5e_build_rep_netdev(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 7b1566f0ae58..66b5fec15313 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1041,6 +1041,8 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq)
 #define MLX5_IB_GRH_BYTES       40
 #define MLX5_IPOIB_ENCAP_LEN    4
 #define MLX5_GID_SIZE           16
+#define MLX5_IPOIB_PSEUDO_LEN   20
+#define MLX5_IPOIB_HARD_LEN     (MLX5_IPOIB_PSEUDO_LEN + MLX5_IPOIB_ENCAP_LEN)
 
 static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct mlx5_cqe64 *cqe,
@@ -1048,6 +1050,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct sk_buff *skb)
 {
         struct net_device *netdev = rq->netdev;
+        char *pseudo_header;
         u8 *dgid;
         u8 g;
 
@@ -1076,8 +1079,11 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
         if (likely(netdev->features & NETIF_F_RXHASH))
                 mlx5e_skb_set_hash(cqe, skb);
 
+        /* 20 bytes of ipoib header and 4 for encap existing */
+        pseudo_header = skb_push(skb, MLX5_IPOIB_PSEUDO_LEN);
+        memset(pseudo_header, 0, MLX5_IPOIB_PSEUDO_LEN);
         skb_reset_mac_header(skb);
-        skb_pull(skb, MLX5_IPOIB_ENCAP_LEN);
+        skb_pull(skb, MLX5_IPOIB_HARD_LEN);
 
         skb->dev = netdev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
index 02dd3a95ed8f..acf32fe952cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
@@ -183,28 +183,27 @@ static void mlx5e_am_exit_parking(struct mlx5e_rx_am *am)
         mlx5e_am_step(am);
 }
 
+#define IS_SIGNIFICANT_DIFF(val, ref) \
+        (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
+
 static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
                                   struct mlx5e_rx_am_stats *prev)
 {
-        int diff;
-
-        if (!prev->ppms)
-                return curr->ppms ? MLX5E_AM_STATS_BETTER :
+        if (!prev->bpms)
+                return curr->bpms ? MLX5E_AM_STATS_BETTER :
                                     MLX5E_AM_STATS_SAME;
 
-        diff = curr->ppms - prev->ppms;
-        if (((100 * abs(diff)) / prev->ppms) > 10) /* more than 10% diff */
-                return (diff > 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->bpms, prev->bpms))
+                return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        if (!prev->epms)
-                return curr->epms ? MLX5E_AM_STATS_WORSE :
-                                    MLX5E_AM_STATS_SAME;
+        if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
+                return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        diff = curr->epms - prev->epms;
-        if (((100 * abs(diff)) / prev->epms) > 10) /* more than 10% diff */
-                return (diff < 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
+                return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
         return MLX5E_AM_STATS_SAME;
 }
@@ -266,10 +265,13 @@ static void mlx5e_am_sample(struct mlx5e_rq *rq,
 {
         s->time      = ktime_get();
         s->pkt_ctr   = rq->stats.packets;
+        s->byte_ctr  = rq->stats.bytes;
         s->event_ctr = rq->cq.event_ctr;
 }
 
 #define MLX5E_AM_NEVENTS 64
+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
+#define BIT_GAP(bits, end, start) ((((end) - (start)) + BIT_ULL(bits)) & (BIT_ULL(bits) - 1))
 
 static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
                                 struct mlx5e_rx_am_sample *end,
@@ -277,13 +279,17 @@ static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
 {
         /* u32 holds up to 71 minutes, should be enough */
         u32 delta_us = ktime_us_delta(end->time, start->time);
-        unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
+        u32 npkts = BIT_GAP(BITS_PER_TYPE(u32), end->pkt_ctr, start->pkt_ctr);
+        u32 nbytes = BIT_GAP(BITS_PER_TYPE(u32), end->byte_ctr,
+                             start->byte_ctr);
 
         if (!delta_us)
                 return;
 
-        curr_stats->ppms =            (npkts * USEC_PER_MSEC) / delta_us;
-        curr_stats->epms = (MLX5E_AM_NEVENTS * USEC_PER_MSEC) / delta_us;
+        curr_stats->ppms = DIV_ROUND_UP(npkts * USEC_PER_MSEC, delta_us);
+        curr_stats->bpms = DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us);
+        curr_stats->epms = DIV_ROUND_UP(MLX5E_AM_NEVENTS * USEC_PER_MSEC,
+                                        delta_us);
 }
 
 void mlx5e_rx_am_work(struct work_struct *work)
@@ -308,7 +314,8 @@ void mlx5e_rx_am(struct mlx5e_rq *rq)
 
         switch (am->state) {
         case MLX5E_AM_MEASURE_IN_PROGRESS:
-                nevents = rq->cq.event_ctr - am->start_sample.event_ctr;
+                nevents = BIT_GAP(BITS_PER_TYPE(u16), rq->cq.event_ctr,
+                                  am->start_sample.event_ctr);
                 if (nevents < MLX5E_AM_NEVENTS)
                         break;
                 mlx5e_am_sample(rq, &end_sample);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 53e4992d6511..f81c3aa60b46 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -417,20 +417,13 @@ struct mlx5e_stats {
 };
 
 static const struct counter_desc mlx5e_pme_status_desc[] = {
-        { "module_plug", 0 },
         { "module_unplug", 8 },
 };
 
 static const struct counter_desc mlx5e_pme_error_desc[] = {
-        { "module_pwr_budget_exd", 0 },  /* power budget exceed */
-        { "module_long_range", 8 },      /* long range for non MLNX cable */
-        { "module_bus_stuck", 16 },      /* bus stuck (I2C or data shorted) */
-        { "module_no_eeprom", 24 },      /* no eeprom/retry time out */
-        { "module_enforce_part", 32 },   /* enforce part number list */
-        { "module_unknown_id", 40 },     /* unknown identifier */
-        { "module_high_temp", 48 },      /* high temperature */
+        { "module_bus_stuck", 16 },       /* bus stuck (I2C or data shorted) */
+        { "module_high_temp", 48 },       /* high temperature */
         { "module_bad_shorted", 56 },    /* bad or shorted cable/module */
-        { "module_unknown_status", 64 },
 };
 
 #endif /* __MLX5_EN_STATS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 11c27e4fadf6..9df9fc0d26f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -43,6 +43,7 @@
 #include <net/tc_act/tc_vlan.h>
 #include <net/tc_act/tc_tunnel_key.h>
 #include <net/tc_act/tc_pedit.h>
+#include <net/tc_act/tc_csum.h>
 #include <net/vxlan.h>
 #include <net/arp.h>
 #include "en.h"
@@ -384,7 +385,7 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                 if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                         mlx5_encap_dealloc(priv->mdev, e->encap_id);
 
-                hlist_del_rcu(&e->encap_hlist);
+                hash_del_rcu(&e->encap_hlist);
                 kfree(e->encap_header);
                 kfree(e);
         }
@@ -894,7 +895,6 @@ static struct mlx5_fields fields[] = {
         {MLX5_ACTION_IN_FIELD_OUT_SMAC_15_0,  2, offsetof(struct pedit_headers, eth.h_source[4])},
         {MLX5_ACTION_IN_FIELD_OUT_ETHERTYPE,  2, offsetof(struct pedit_headers, eth.h_proto)},
 
-        {MLX5_ACTION_IN_FIELD_OUT_IP_DSCP, 1, offsetof(struct pedit_headers, ip4.tos)},
         {MLX5_ACTION_IN_FIELD_OUT_IP_TTL,  1, offsetof(struct pedit_headers, ip4.ttl)},
         {MLX5_ACTION_IN_FIELD_OUT_SIPV4,   4, offsetof(struct pedit_headers, ip4.saddr)},
         {MLX5_ACTION_IN_FIELD_OUT_DIPV4,   4, offsetof(struct pedit_headers, ip4.daddr)},
@@ -925,11 +925,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr)
 {
         struct pedit_headers *set_masks, *add_masks, *set_vals, *add_vals;
-        int i, action_size, nactions, max_actions, first, last;
+        int i, action_size, nactions, max_actions, first, last, first_z;
         void *s_masks_p, *a_masks_p, *vals_p;
-        u32 s_mask, a_mask, val;
         struct mlx5_fields *f;
         u8 cmd, field_bsize;
+        u32 s_mask, a_mask;
         unsigned long mask;
         void *action;
 
@@ -946,7 +946,8 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
                 /* avoid seeing bits set from previous iterations */
-                s_mask = a_mask = mask = val = 0;
+                s_mask = 0;
+                a_mask = 0;
 
                 s_masks_p = (void *)set_masks + f->offset;
                 a_masks_p = (void *)add_masks + f->offset;
@@ -981,12 +982,12 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                         memset(a_masks_p, 0, f->size);
                 }
 
-                memcpy(&val, vals_p, f->size);
-
                 field_bsize = f->size * BITS_PER_BYTE;
+
+                first_z = find_first_zero_bit(&mask, field_bsize);
                 first = find_first_bit(&mask, field_bsize);
                 last  = find_last_bit(&mask, field_bsize);
-                if (first > 0 || last != (field_bsize - 1)) {
+                if (first > 0 || last != (field_bsize - 1) || first_z < last) {
                         printk(KERN_WARNING "mlx5: partial rewrite (mask %lx) is currently not offloaded\n",
                                mask);
                         return -EOPNOTSUPP;
@@ -1002,11 +1003,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                 }
 
                 if (field_bsize == 32)
-                        MLX5_SET(set_action_in, action, data, ntohl(val));
+                        MLX5_SET(set_action_in, action, data, ntohl(*(__be32 *)vals_p));
                 else if (field_bsize == 16)
-                        MLX5_SET(set_action_in, action, data, ntohs(val));
+                        MLX5_SET(set_action_in, action, data, ntohs(*(__be16 *)vals_p));
                 else if (field_bsize == 8)
-                        MLX5_SET(set_action_in, action, data, val);
+                        MLX5_SET(set_action_in, action, data, *(u8 *)vals_p);
 
                 action += action_size;
                 nactions++;
@@ -1109,6 +1110,28 @@ out_err:
         return err;
 }
 
+static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 update_flags)
+{
+        u32 prot_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR | TCA_CSUM_UPDATE_FLAG_TCP |
+                         TCA_CSUM_UPDATE_FLAG_UDP;
+
+        /*  The HW recalcs checksums only if re-writing headers */
+        if (!(action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)) {
+                netdev_warn(priv->netdev,
+                            "TC csum action is only offloaded with pedit\n");
+                return false;
+        }
+
+        if (update_flags & ~prot_flags) {
+                netdev_warn(priv->netdev,
+                            "can't offload TC csum action for some header/s - flags %#x\n",
+                            update_flags);
+                return false;
+        }
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1149,6 +1172,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_skbedit_mark(a)) {
                         u32 mark = tcf_skbedit_mark(a);
 
@@ -1651,6 +1682,14 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
                         struct net_device *out_dev, *encap_dev = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ea5d8d37a75c..33eae5ad2fb0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -422,7 +422,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
 
                 case MLX5_EVENT_TYPE_CMD:
-                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector));
+                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
                         break;
 
                 case MLX5_EVENT_TYPE_PORT_CHANGE:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f991f669047e..a53e982a6863 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -906,21 +906,34 @@ static int esw_inline_mode_to_devlink(u8 mlx5_mode, u8 *mode)
         return 0;
 }
 
-int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
+static int mlx5_devlink_eswitch_check(struct devlink *devlink)
 {
-        struct mlx5_core_dev *dev;
-        u16 cur_mlx5_mode, mlx5_mode = 0;
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
 
-        dev = devlink_priv(devlink);
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return -EOPNOTSUPP;
 
         if (!MLX5_CAP_GEN(dev, vport_group_manager))
                 return -EOPNOTSUPP;
 
-        cur_mlx5_mode = dev->priv.eswitch->mode;
-
-        if (cur_mlx5_mode == SRIOV_NONE)
+        if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
+        return 0;
+}
+
+int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
+{
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
+        u16 cur_mlx5_mode, mlx5_mode = 0;
+        int err;
+
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
+
+        cur_mlx5_mode = dev->priv.eswitch->mode;
+
         if (esw_mode_from_devlink(mode, &mlx5_mode))
                 return -EINVAL;
 
@@ -937,15 +950,12 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 
 int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
 {
-        struct mlx5_core_dev *dev;
-
-        dev = devlink_priv(devlink);
-
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
+        struct mlx5_core_dev *dev = devlink_priv(devlink);
+        int err;
 
-        if (dev->priv.eswitch->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
 }
@@ -954,15 +964,12 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
-        int num_vports = esw->enabled_vports;
         int err, vport;
         u8 mlx5_mode;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         switch (MLX5_CAP_ETH(dev, wqe_inline_mode)) {
         case MLX5_CAP_INLINE_MODE_NOT_REQUIRED:
@@ -985,7 +992,7 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
         if (err)
                 goto out;
 
-        for (vport = 1; vport < num_vports; vport++) {
+        for (vport = 1; vport < esw->enabled_vports; vport++) {
                 err = mlx5_modify_nic_vport_min_inline(dev, vport, mlx5_mode);
                 if (err) {
                         esw_warn(dev, "Failed to set min inline on vport %d\n",
@@ -1010,12 +1017,11 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
+        int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         return esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode);
 }
@@ -1062,11 +1068,9 @@ int mlx5_devlink_eswitch_encap_mode_set(struct devlink *devlink, u8 encap)
         struct mlx5_eswitch *esw = dev->priv.eswitch;
         int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         if (encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE &&
             (!MLX5_CAP_ESW_FLOWTABLE_FDB(dev, encap) ||
@@ -1105,12 +1109,11 @@ int mlx5_devlink_eswitch_encap_mode_get(struct devlink *devlink, u8 *encap)
 {
         struct mlx5_core_dev *dev = devlink_priv(devlink);
         struct mlx5_eswitch *esw = dev->priv.eswitch;
+        int err;
 
-        if (!MLX5_CAP_GEN(dev, vport_group_manager))
-                return -EOPNOTSUPP;
-
-        if (esw->mode == SRIOV_NONE)
-                return -EOPNOTSUPP;
+        err = mlx5_devlink_eswitch_check(devlink);
+        if (err)
+                return err;
 
         *encap = esw->offloads.encap;
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 0e487e8ca634..8f5125ccd8d4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -862,7 +862,7 @@ struct mlx5_flow_table *mlx5_create_vport_flow_table(struct mlx5_flow_namespace
         ft_attr.level   = level;
         ft_attr.prio    = prio;
 
-        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, 0);
+        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, vport);
 }
 
 struct mlx5_flow_table*
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d0515391d33b..f27f84ffbc85 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -90,7 +90,7 @@ static void trigger_cmd_completions(struct mlx5_core_dev *dev)
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 
         mlx5_core_dbg(dev, "vector 0x%llx\n", vector);
-        mlx5_cmd_comp_handler(dev, vector);
+        mlx5_cmd_comp_handler(dev, vector, true);
         return;
 
 no_trig:
@@ -275,10 +275,8 @@ static void poll_health(unsigned long data)
         struct mlx5_core_health *health = &dev->priv.health;
         u32 count;
 
-        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-                mod_timer(&health->timer, get_next_poll_jiffies());
-                return;
-        }
+        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
+                goto out;
 
         count = ioread32be(health->health_counter);
         if (count == health->prev)
@@ -290,8 +288,6 @@ static void poll_health(unsigned long data)
         if (health->miss_counter == MAX_MISSES) {
                 dev_err(&dev->pdev->dev, "device's health compromised - reached miss count\n");
                 print_health_info(dev);
-        } else {
-                mod_timer(&health->timer, get_next_poll_jiffies());
         }
 
         if (in_fatal(dev) && !health->sick) {
@@ -305,6 +301,9 @@ static void poll_health(unsigned long data)
                                 "new health works are not permitted at this stage\n");
                 spin_unlock(&health->wq_lock);
         }
+
+out:
+        mod_timer(&health->timer, get_next_poll_jiffies());
 }
 
 void mlx5_start_health_poll(struct mlx5_core_dev *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 0c123d571b4c..13be264587f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -175,8 +175,9 @@ static struct mlx5_profile profile[] = {
         },
 };
 
-#define FW_INIT_TIMEOUT_MILI    2000
-#define FW_INIT_WAIT_MS         2
+#define FW_INIT_TIMEOUT_MILI            2000
+#define FW_INIT_WAIT_MS                 2
+#define FW_PRE_INIT_TIMEOUT_MILI        10000
 
 static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili)
 {
@@ -537,8 +538,10 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         /* disable cmdif checksum */
         MLX5_SET(cmd_hca_cap, set_hca_cap, cmdif_checksum, 0);
 
-        /* If the HCA supports 4K UARs use it */
-        if (MLX5_CAP_GEN_MAX(dev, uar_4k))
+        /* Enable 4K UAR only when HCA supports it and page size is bigger
+         * than 4K.
+         */
+        if (MLX5_CAP_GEN_MAX(dev, uar_4k) && PAGE_SIZE > 4096)
                 MLX5_SET(cmd_hca_cap, set_hca_cap, uar_4k, 1);
 
         MLX5_SET(cmd_hca_cap, set_hca_cap, log_uar_page_sz, PAGE_SHIFT - 12);
@@ -612,7 +615,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         struct mlx5_priv *priv  = &mdev->priv;
         struct msix_entry *msix = priv->msix_arr;
         int irq                 = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
-        int err;
 
         if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
                 mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
@@ -622,18 +624,11 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-        err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
-        if (err) {
-                mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
-                               irq);
-                goto err_clear_mask;
-        }
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
 
         return 0;
-
-err_clear_mask:
-        free_cpumask_var(priv->irq_info[i].mask);
-        return err;
 }
 
 static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
@@ -1019,6 +1014,15 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
          */
         dev->state = MLX5_DEVICE_STATE_UP;
 
+        /* wait for firmware to accept initialization segments configurations
+         */
+        err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI);
+        if (err) {
+                dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n",
+                        FW_PRE_INIT_TIMEOUT_MILI);
+                goto out;
+        }
+
         err = mlx5_cmd_init(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed initializing command interface, aborting\n");
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 9f89c4137d21..0744452a0b18 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -3334,6 +3334,9 @@ static int mlxsw_sp_inetaddr_vlan_event(struct net_device *vlan_dev,
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(vlan_dev);
         u16 vid = vlan_dev_vlan_id(vlan_dev);
 
+        if (netif_is_bridge_port(vlan_dev))
+                return 0;
+
         if (mlxsw_sp_port_dev_check(real_dev))
                 return mlxsw_sp_inetaddr_vport_event(vlan_dev, real_dev, event,
                                                      vid);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 483241b4b05d..a672f6a860dc 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -2956,7 +2956,7 @@ static u32 qed_grc_dump_ctx_data(struct qed_hwfn *p_hwfn,
                                 qed_wr(p_hwfn,
                                        p_ptt,
                                        s_storm_defs[storm_id].cm_ctx_wr_addr,
-                                       BIT(9) | lid);
+                                       (i << 9) | lid);
                                 *(dump_buf + offset) = qed_rd(p_hwfn,
                                                               p_ptt,
                                                               rd_reg_addr);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 537d1236a4fe..715b3aaf83ac 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1730,7 +1730,8 @@ void qed_get_protocol_stats(struct qed_dev *cdev,
                 qed_get_protocol_stats_iscsi(cdev, &stats->iscsi_stats);
                 break;
         default:
-                DP_ERR(cdev, "Invalid protocol type = %d\n", type);
+                DP_VERBOSE(cdev, QED_MSG_SP,
+                           "Invalid protocol type = %d\n", type);
                 return;
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7245b1072518..81312924df14 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1824,22 +1824,44 @@ struct qlcnic_hardware_ops {
         u32 (*get_cap_size)(void *, int);
         void (*set_sys_info)(void *, int, u32);
         void (*store_cap_mask)(void *, u32);
+        bool (*encap_rx_offload) (struct qlcnic_adapter *adapter);
+        bool (*encap_tx_offload) (struct qlcnic_adapter *adapter);
 };
 
 extern struct qlcnic_nic_template qlcnic_vf_ops;
 
-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD;
 }
 
-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD;
 }
 
+static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_rx_offload(adapter);
+}
+
+static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_tx_offload(adapter);
+}
+
 static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
         return adapter->nic_ops->start_firmware(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4fb68797630e..f7080d0ab874 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = {
         .get_cap_size                   = qlcnic_83xx_get_cap_size,
         .set_sys_info                   = qlcnic_83xx_set_sys_info,
         .store_cap_mask                 = qlcnic_83xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_83xx_ops = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 838cc0ceafd8..7848cf04b29a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                         }
                         return -EIO;
                 }
-                usleep_range(1000, 1500);
+                udelay(1200);
         }
 
         if (id_reg)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index b6628aaa6e4a..1b5f7d57b6f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = {
         .get_cap_size                   = qlcnic_82xx_get_cap_size,
         .set_sys_info                   = qlcnic_82xx_set_sys_info,
         .store_cap_mask                 = qlcnic_82xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_82xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_82xx_encap_tx_offload,
 };
 
 static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 2f656f395f39..c58180f40844 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = {
         .free_mac_list                  = qlcnic_sriov_vf_free_mac_list,
         .enable_sds_intr                = qlcnic_83xx_enable_sds_intr,
         .disable_sds_intr               = qlcnic_83xx_disable_sds_intr,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_sriov_vf_ops = {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index cc065ffbe4b5..bcd4708b3745 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -931,7 +931,7 @@ int emac_mac_up(struct emac_adapter *adpt)
         emac_mac_config(adpt);
         emac_mac_rx_descs_refill(adpt, &adpt->rx_q);
 
-        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
+        adpt->phydev->irq = PHY_POLL;
         ret = phy_connect_direct(netdev, adpt->phydev, emac_adjust_link,
                                  PHY_INTERFACE_MODE_SGMII);
         if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 441c19366489..18461fcb9815 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -13,15 +13,11 @@
 /* Qualcomm Technologies, Inc. EMAC PHY Controller driver.
  */
 
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/phy.h>
 #include <linux/iopoll.h>
 #include <linux/acpi.h>
 #include "emac.h"
-#include "emac-mac.h"
 
 /* EMAC base register offsets */
 #define EMAC_MDIO_CTRL                                        0x001414
@@ -52,62 +48,10 @@
 
 #define MDIO_WAIT_TIMES                                           1000
 
-#define EMAC_LINK_SPEED_DEFAULT (\
-                EMAC_LINK_SPEED_10_HALF  |\
-                EMAC_LINK_SPEED_10_FULL  |\
-                EMAC_LINK_SPEED_100_HALF |\
-                EMAC_LINK_SPEED_100_FULL |\
-                EMAC_LINK_SPEED_1GB_FULL)
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The autopoll feature takes over the MDIO bus.  In order for
- * the PHY driver to be able to talk to the PHY over the MDIO
- * bus, we need to temporarily disable the autopoll feature.
- */
-static int emac_phy_mdio_autopoll_disable(struct emac_adapter *adpt)
-{
-        u32 val;
-
-        /* disable autopoll */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, MDIO_AP_EN, 0);
-
-        /* wait for any mdio polling to complete */
-        if (!readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, val,
-                                !(val & MDIO_BUSY), 100, MDIO_WAIT_TIMES * 100))
-                return 0;
-
-        /* failed to disable; ensure it is enabled before returning */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-
-        return -EBUSY;
-}
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The EMAC has the ability to poll the external PHY on the MDIO
- * bus for link state changes.  This eliminates the need for the
- * driver to poll the phy.  If if the link state does change,
- * the EMAC issues an interrupt on behalf of the PHY.
- */
-static void emac_phy_mdio_autopoll_enable(struct emac_adapter *adpt)
-{
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-}
-
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -122,24 +66,15 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
                                100, MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
-        else
-                ret = (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
 }
 
 static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -155,11 +90,9 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)), 100,
                                MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return 0;
 }
 
 /* Configure the MDIO bus and connect the external PHY */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 28a8cdc36485..98a326faea29 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -50,19 +50,7 @@
 #define DMAR_DLY_CNT_DEF                                    15
 #define DMAW_DLY_CNT_DEF                                     4
 
-#define IMR_NORMAL_MASK         (\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
-
-#define IMR_EXTENDED_MASK       (\
-                SW_MAN_INT      |\
-                ISR_OVER        |\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
+#define IMR_NORMAL_MASK         (ISR_ERROR | ISR_OVER | ISR_TX_PKT)
 
 #define ISR_TX_PKT      (\
         TX_PKT_INT      |\
@@ -70,10 +58,6 @@
         TX_PKT_INT2     |\
         TX_PKT_INT3)
 
-#define ISR_GPHY_LINK        (\
-        GPHY_LINK_UP_INT     |\
-        GPHY_LINK_DOWN_INT)
-
 #define ISR_OVER        (\
         RFD0_UR_INT     |\
         RFD1_UR_INT     |\
@@ -187,10 +171,6 @@ irqreturn_t emac_isr(int _irq, void *data)
         if (status & ISR_OVER)
                 net_warn_ratelimited("warning: TX/RX overflow\n");
 
-        /* link event */
-        if (status & ISR_GPHY_LINK)
-                phy_mac_interrupt(adpt->phydev, !!(status & GPHY_LINK_UP_INT));
-
 exit:
         /* enable the interrupt */
         writel(irq->mask, adpt->base + EMAC_INT_MASK);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3cd7989c007d..784782da3a85 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -230,18 +230,6 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         int ring_size;
         int i;
 
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
-
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
-
         if (priv->rx_ring[q]) {
                 for (i = 0; i < priv->num_rx_ring[q]; i++) {
                         struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -270,6 +258,18 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                 priv->tx_ring[q] = NULL;
         }
 
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
+
         /* Free TX skb ringbuffer.
          * SKBs are freed by ravb_tx_free() call above.
          */
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 2ae852454780..a9ce82d3e9cf 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -1505,8 +1505,8 @@ static int ofdpa_port_ipv4_nh(struct ofdpa_port *ofdpa_port,
                 *index = entry->index;
                 resolved = false;
         } else if (removing) {
-                ofdpa_neigh_del(trans, found);
                 *index = found->index;
+                ofdpa_neigh_del(trans, found);
         } else if (updating) {
                 ofdpa_neigh_update(found, trans, NULL, false);
                 resolved = !is_zero_ether_addr(found->eth_dst);
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 78efb2822b86..78f9e43420e0 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4172,7 +4172,7 @@ found:
          * recipients
          */
         if (is_mc_recip) {
-                MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+                MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
                 unsigned int depth, i;
 
                 memset(inbuf, 0, sizeof(inbuf));
@@ -4320,7 +4320,7 @@ static int efx_ef10_filter_remove_internal(struct efx_nic *efx,
                         efx_ef10_filter_set_entry(table, filter_idx, NULL, 0);
                 } else {
                         efx_mcdi_display_error(efx, MC_CMD_FILTER_OP,
-                                               MC_CMD_FILTER_OP_IN_LEN,
+                                               MC_CMD_FILTER_OP_EXT_IN_LEN,
                                                NULL, 0, rc);
                 }
         }
@@ -4453,7 +4453,7 @@ static s32 efx_ef10_filter_rfs_insert(struct efx_nic *efx,
                                       struct efx_filter_spec *spec)
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
         struct efx_filter_spec *saved_spec;
         unsigned int hash, i, depth = 1;
         bool replacing = false;
@@ -4940,7 +4940,7 @@ not_restored:
 static void efx_ef10_filter_table_remove(struct efx_nic *efx)
 {
         struct efx_ef10_filter_table *table = efx->filter_state;
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_IN_LEN);
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_FILTER_OP_EXT_IN_LEN);
         struct efx_filter_spec *spec;
         unsigned int filter_idx;
         int rc;
@@ -5105,6 +5105,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
 
         /* Insert/renew filters */
         for (i = 0; i < addr_count; i++) {
+                EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
                 rc = efx_ef10_filter_insert(efx, &spec, true);
@@ -5122,11 +5123,11 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                                 }
                                 return rc;
                         } else {
-                                /* mark as not inserted, and carry on */
-                                rc = EFX_EF10_FILTER_ID_INVALID;
+                                /* keep invalid ID, and carry on */
                         }
+                } else {
+                        ids[i] = efx_ef10_filter_get_unsafe_id(rc);
                 }
-                ids[i] = efx_ef10_filter_get_unsafe_id(rc);
         }
 
         if (multicast && rollback) {
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index b7e4345c990d..019cef1d3cf7 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -661,8 +661,6 @@ restore_filters:
                 up_write(&vf->efx->filter_sem);
                 mutex_unlock(&vf->efx->mac_lock);
 
-                up_write(&vf->efx->filter_sem);
-
                 rc2 = efx_net_open(vf->efx->net_dev);
                 if (rc2)
                         goto reset_nic;
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 489ef146201e..6a9c954492f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -37,6 +37,7 @@
 #define TSE_PCS_CONTROL_AN_EN_MASK                      BIT(12)
 #define TSE_PCS_CONTROL_REG                             0x00
 #define TSE_PCS_CONTROL_RESTART_AN_MASK                 BIT(9)
+#define TSE_PCS_CTRL_AUTONEG_SGMII                      0x1140
 #define TSE_PCS_IF_MODE_REG                             0x28
 #define TSE_PCS_LINK_TIMER_0_REG                        0x24
 #define TSE_PCS_LINK_TIMER_1_REG                        0x26
@@ -65,6 +66,7 @@
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
 #define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
 #define TSE_PCS_USE_SGMII_ENA                           BIT(0)
+#define TSE_PCS_IF_USE_SGMII                            0x03
 
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
 {
         int ret = 0;
 
-        writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG);
+
+        writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG);
 
         writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG);
         writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index aa6476439aee..e0ef02f9503b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -214,13 +214,13 @@ static int dwmac4_wrback_get_tx_timestamp_status(struct dma_desc *p)
 {
         /* Context type from W/B descriptor must be zero */
         if (le32_to_cpu(p->des3) & TDES3_CONTEXT_TYPE)
-                return -EINVAL;
+                return 0;
 
         /* Tx Timestamp Status is 1 so des0 and des1'll have valid values */
         if (le32_to_cpu(p->des3) & TDES3_TIMESTAMP_STATUS)
-                return 0;
+                return 1;
 
-        return 1;
+        return 0;
 }
 
 static inline u64 dwmac4_get_timestamp(void *desc, u32 ats)
@@ -282,7 +282,10 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
                 }
         }
 exit:
-        return ret;
+        if (likely(ret == 0))
+                return 1;
+
+        return 0;
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a74c481401c4..6e4cbc6ce0ef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -434,14 +434,14 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
                 return;
 
         /* check tx tstamp status */
-        if (!priv->hw->desc->get_tx_timestamp_status(p)) {
+        if (priv->hw->desc->get_tx_timestamp_status(p)) {
                 /* get the valid tstamp */
                 ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
                 memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp.hwtstamp = ns_to_ktime(ns);
 
-                netdev_info(priv->dev, "get valid TX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid TX hw timestamp %llu\n", ns);
                 /* pass tstamp to stack */
                 skb_tstamp_tx(skb, &shhwtstamp);
         }
@@ -468,19 +468,19 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                 return;
 
         /* Check if timestamp is available */
-        if (!priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
+        if (priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
                 /* For GMAC4, the valid timestamp is from CTX next desc. */
                 if (priv->plat->has_gmac4)
                         ns = priv->hw->desc->get_timestamp(np, priv->adv_ts);
                 else
                         ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
-                netdev_info(priv->dev, "get valid RX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
                 memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp->hwtstamp = ns_to_ktime(ns);
         } else  {
-                netdev_err(priv->dev, "cannot get RX hw timestamp\n");
+                netdev_dbg(priv->dev, "cannot get RX hw timestamp\n");
         }
 }
 
@@ -546,7 +546,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         /* PTP v1, UDP, any kind of event packet */
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -578,7 +581,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -612,7 +618,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -1208,7 +1217,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
         u32 rx_count = priv->plat->rx_queues_to_use;
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
-        u32 queue;
+        int queue;
         int i;
 
         if (priv->hw->mode->set_16kib_bfsize)
@@ -2724,7 +2733,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
 
                 priv->hw->desc->prepare_tso_tx_desc(desc, 0, buff_size,
                         0, 1,
-                        (last_segment) && (buff_size < TSO_MAX_BUFF_SIZE),
+                        (last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
                         0, 0);
 
                 tmp_len -= TSO_MAX_BUFF_SIZE;
@@ -2822,7 +2831,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q->tx_skbuff_dma[first_entry].buf = des;
         tx_q->tx_skbuff_dma[first_entry].len = skb_headlen(skb);
-        tx_q->tx_skbuff[first_entry] = skb;
 
         first->des0 = cpu_to_le32(des);
 
@@ -2856,6 +2864,14 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q->tx_skbuff_dma[tx_q->cur_tx].last_segment = true;
 
+        /* Only the last descriptor gets to point to the skb. */
+        tx_q->tx_skbuff[tx_q->cur_tx] = skb;
+
+        /* We've used all descriptors we need for this skb, however,
+         * advance cur_tx so that it references a fresh descriptor.
+         * ndo_start_xmit will fill this descriptor the next time it's
+         * called and stmmac_tx_clean may clean up to this descriptor.
+         */
         tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
 
         if (unlikely(stmmac_tx_avail(priv, queue) <= (MAX_SKB_FRAGS + 1))) {
@@ -2947,7 +2963,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int i, csum_insertion = 0, is_jumbo = 0;
         u32 queue = skb_get_queue_mapping(skb);
         int nfrags = skb_shinfo(skb)->nr_frags;
-        unsigned int entry, first_entry;
+        int entry;
+        unsigned int first_entry;
         struct dma_desc *desc, *first;
         struct stmmac_tx_queue *tx_q;
         unsigned int enh_desc;
@@ -2988,8 +3005,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         first = desc;
 
-        tx_q->tx_skbuff[first_entry] = skb;
-
         enh_desc = priv->plat->enh_desc;
         /* To program the descriptors according to the size of the frame */
         if (enh_desc)
@@ -3037,8 +3052,15 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                                                 skb->len);
         }
 
-        entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+        /* Only the last descriptor gets to point to the skb. */
+        tx_q->tx_skbuff[entry] = skb;
 
+        /* We've used all descriptors we need for this skb, however,
+         * advance cur_tx so that it references a fresh descriptor.
+         * ndo_start_xmit will fill this descriptor the next time it's
+         * called and stmmac_tx_clean may clean up to this descriptor.
+         */
+        entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
         tx_q->cur_tx = entry;
 
         if (netif_msg_pktdata(priv)) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
index 48fb72fc423c..f4b31d69f60e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
@@ -59,7 +59,8 @@
 /* Enable Snapshot for Messages Relevant to Master */
 #define PTP_TCR_TSMSTRENA       BIT(15)
 /* Select PTP packets for Taking Snapshots */
-#define PTP_TCR_SNAPTYPSEL_1    GENMASK(17, 16)
+#define PTP_TCR_SNAPTYPSEL_1    BIT(16)
+#define PTP_GMAC4_TCR_SNAPTYPSEL_1      GENMASK(17, 16)
 /* Enable MAC address for PTP Frame Filtering */
 #define PTP_TCR_TSENMACADDR     BIT(18)
 
diff --git a/drivers/net/ethernet/ti/cpsw-common.c b/drivers/net/ethernet/ti/cpsw-common.c
index 1562ab4151e1..56ba411421f0 100644
--- a/drivers/net/ethernet/ti/cpsw-common.c
+++ b/drivers/net/ethernet/ti/cpsw-common.c
@@ -90,7 +90,7 @@ int ti_cm_get_macid(struct device *dev, int slave, u8 *mac_addr)
         if (of_device_is_compatible(dev->of_node, "ti,dm816-emac"))
                 return cpsw_am33xx_cm_get_macid(dev, 0x30, slave, mac_addr);
 
-        if (of_machine_is_compatible("ti,am4372"))
+        if (of_machine_is_compatible("ti,am43"))
                 return cpsw_am33xx_cm_get_macid(dev, 0x630, slave, mac_addr);
 
         if (of_machine_is_compatible("ti,dra7"))
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index dec5d563ab19..199459bd6961 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1007,7 +1007,7 @@ static void geneve_setup(struct net_device *dev)
 
         dev->netdev_ops = &geneve_netdev_ops;
         dev->ethtool_ops = &geneve_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         SET_NETDEV_DEVTYPE(dev, &geneve_type);
 
@@ -1133,7 +1133,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 
         /* make enough headroom for basic scenario */
         encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
                 encap_len += sizeof(struct iphdr);
                 dev->max_mtu -= sizeof(struct iphdr);
         } else {
@@ -1293,7 +1293,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
         if (nla_put_u32(skb, IFLA_GENEVE_ID, vni))
                 goto nla_put_failure;
 
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (rtnl_dereference(geneve->sock4)) {
                 if (nla_put_in_addr(skb, IFLA_GENEVE_REMOTE,
                                     info->key.u.ipv4.dst))
                         goto nla_put_failure;
@@ -1302,8 +1302,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                                !!(info->key.tun_flags & TUNNEL_CSUM)))
                         goto nla_put_failure;
 
+        }
+
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
+        if (rtnl_dereference(geneve->sock6)) {
                 if (nla_put_in6_addr(skb, IFLA_GENEVE_REMOTE6,
                                      &info->key.u.ipv6.dst))
                         goto nla_put_failure;
@@ -1315,8 +1317,8 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                 if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
                                !geneve->use_udp6_rx_checksums))
                         goto nla_put_failure;
-#endif
         }
+#endif
 
         if (nla_put_u8(skb, IFLA_GENEVE_TTL, info->key.ttl) ||
             nla_put_u8(skb, IFLA_GENEVE_TOS, info->key.tos) ||
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 4fea1b3dfbb4..ca110cd2a4e4 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -611,7 +611,7 @@ static const struct net_device_ops gtp_netdev_ops = {
 static void gtp_link_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &gtp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dev->hard_header_len = 0;
         dev->addr_len = 0;
@@ -873,7 +873,7 @@ static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 
         /* Check if there's an existing gtpX device to configure */
         dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
-        if (dev->netdev_ops == &gtp_netdev_ops)
+        if (dev && dev->netdev_ops == &gtp_netdev_ops)
                 gtp = netdev_priv(dev);
 
         put_net(net);
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 922bf440e9f1..021a8ec411ab 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -311,7 +311,7 @@ static void sp_setup(struct net_device *dev)
 {
         /* Finish setting up the DEVICE info. */
         dev->netdev_ops         = &sp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->mtu                = SIXP_MTU;
         dev->hard_header_len    = AX25_MAX_HEADER_LEN;
         dev->header_ops         = &ax25_header_ops;
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index f62e7f325cf9..78a6414c5fd9 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -476,7 +476,7 @@ static const struct net_device_ops bpq_netdev_ops = {
 static void bpq_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &bpq_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 
         memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
         memcpy(dev->dev_addr,  &ax25_defaddr, AX25_ADDR_LEN);
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c1d078..97e3bc60c3e7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case HDLCDRVCTL_CALIBRATE:
                 if(!capable(CAP_SYS_RAWIO))
                         return -EPERM;
+                if (s->par.bitrate <= 0)
+                        return -EINVAL;
                 if (bi.data.calibrate > INT_MAX / s->par.bitrate)
                         return -EINVAL;
                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 262b2ea576a3..6066f1bcaf2d 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -171,6 +171,8 @@ struct rndis_device {
         spinlock_t request_lock;
         struct list_head req_list;
 
+        struct work_struct mcast_work;
+
         u8 hw_mac_adr[ETH_ALEN];
         u8 rss_key[NETVSC_HASH_KEYLEN];
         u16 ind_table[ITAB_NUM];
@@ -201,6 +203,7 @@ int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 int rndis_filter_device_add(struct hv_device *dev,
                             struct netvsc_device_info *info);
+void rndis_filter_update(struct netvsc_device *nvdev);
 void rndis_filter_device_remove(struct hv_device *dev,
                                 struct netvsc_device *nvdev);
 int rndis_filter_set_rss_param(struct rndis_device *rdev,
@@ -211,7 +214,6 @@ int rndis_filter_receive(struct net_device *ndev,
                          struct vmbus_channel *channel,
                          void *data, u32 buflen);
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter);
 int rndis_filter_set_device_mac(struct net_device *ndev, char *mac);
 
 void netvsc_switch_datapath(struct net_device *nv_dev, bool vf);
@@ -696,7 +698,6 @@ struct net_device_context {
         /* list protection */
         spinlock_t lock;
 
-        struct work_struct work;
         u32 msg_enable; /* debug level */
 
         u32 tx_checksum_mask;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 4421a6d00375..643c539a08ba 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -56,37 +56,12 @@ static int debug = -1;
 module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
-static void do_set_multicast(struct work_struct *w)
-{
-        struct net_device_context *ndevctx =
-                container_of(w, struct net_device_context, work);
-        struct hv_device *device_obj = ndevctx->device_ctx;
-        struct net_device *ndev = hv_get_drvdata(device_obj);
-        struct netvsc_device *nvdev = rcu_dereference(ndevctx->nvdev);
-        struct rndis_device *rdev;
-
-        if (!nvdev)
-                return;
-
-        rdev = nvdev->extension;
-        if (rdev == NULL)
-                return;
-
-        if (ndev->flags & IFF_PROMISC)
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_PROMISCUOUS);
-        else
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_BROADCAST |
-                        NDIS_PACKET_TYPE_ALL_MULTICAST |
-                        NDIS_PACKET_TYPE_DIRECTED);
-}
-
 static void netvsc_set_multicast_list(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
+        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
 
-        schedule_work(&net_device_ctx->work);
+        rndis_filter_update(nvdev);
 }
 
 static int netvsc_open(struct net_device *net)
@@ -123,8 +98,6 @@ static int netvsc_close(struct net_device *net)
 
         netif_tx_disable(net);
 
-        /* Make sure netvsc_set_multicast_list doesn't re-enable filter! */
-        cancel_work_sync(&net_device_ctx->work);
         ret = rndis_filter_close(nvdev);
         if (ret != 0) {
                 netdev_err(net, "unable to close device (ret %d).\n", ret);
@@ -803,7 +776,7 @@ static int netvsc_set_channels(struct net_device *net,
             channels->rx_count || channels->tx_count || channels->other_count)
                 return -EINVAL;
 
-        if (count > net->num_tx_queues || count > net->num_rx_queues)
+        if (count > net->num_tx_queues || count > VRSS_CHANNEL_MAX)
                 return -EINVAL;
 
         if (!nvdev || nvdev->destroy)
@@ -1028,7 +1001,7 @@ static const struct {
 static int netvsc_get_sset_count(struct net_device *dev, int string_set)
 {
         struct net_device_context *ndc = netdev_priv(dev);
-        struct netvsc_device *nvdev = rcu_dereference(ndc->nvdev);
+        struct netvsc_device *nvdev = rtnl_dereference(ndc->nvdev);
 
         if (!nvdev)
                 return -ENODEV;
@@ -1158,11 +1131,22 @@ netvsc_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static void netvsc_poll_controller(struct net_device *net)
+static void netvsc_poll_controller(struct net_device *dev)
 {
-        /* As netvsc_start_xmit() works synchronous we don't have to
-         * trigger anything here.
-         */
+        struct net_device_context *ndc = netdev_priv(dev);
+        struct netvsc_device *ndev;
+        int i;
+
+        rcu_read_lock();
+        ndev = rcu_dereference(ndc->nvdev);
+        if (ndev) {
+                for (i = 0; i < ndev->num_chn; i++) {
+                        struct netvsc_channel *nvchan = &ndev->chan_table[i];
+
+                        napi_schedule(&nvchan->napi);
+                }
+        }
+        rcu_read_unlock();
 }
 #endif
 
@@ -1219,7 +1203,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
         rndis_dev = ndev->extension;
         if (indir) {
                 for (i = 0; i < ITAB_NUM; i++)
-                        if (indir[i] >= dev->num_rx_queues)
+                        if (indir[i] >= VRSS_CHANNEL_MAX)
                                 return -EINVAL;
 
                 for (i = 0; i < ITAB_NUM; i++)
@@ -1552,7 +1536,6 @@ static int netvsc_probe(struct hv_device *dev,
         hv_set_drvdata(dev, net);
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
-        INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
@@ -1622,7 +1605,6 @@ static int netvsc_remove(struct hv_device *dev)
         netif_device_detach(net);
 
         cancel_delayed_work_sync(&ndev_ctx->dwork);
-        cancel_work_sync(&ndev_ctx->work);
 
         /*
          * Call to the vsc driver to let it know that the device is being
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index f9d5b0b8209a..cb79cd081f42 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -31,6 +31,7 @@
 
 #include "hyperv_net.h"
 
+static void rndis_set_multicast(struct work_struct *w);
 
 #define RNDIS_EXT_LEN PAGE_SIZE
 struct rndis_request {
@@ -76,6 +77,7 @@ static struct rndis_device *get_rndis_device(void)
         spin_lock_init(&device->request_lock);
 
         INIT_LIST_HEAD(&device->req_list);
+        INIT_WORK(&device->mcast_work, rndis_set_multicast);
 
         device->state = RNDIS_DEV_UNINITIALIZED;
 
@@ -815,7 +817,8 @@ static int rndis_filter_query_link_speed(struct rndis_device *dev)
         return ret;
 }
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
+static int rndis_filter_set_packet_filter(struct rndis_device *dev,
+                                          u32 new_filter)
 {
         struct rndis_request *request;
         struct rndis_set_request *set;
@@ -846,6 +849,28 @@ int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
         return ret;
 }
 
+static void rndis_set_multicast(struct work_struct *w)
+{
+        struct rndis_device *rdev
+                = container_of(w, struct rndis_device, mcast_work);
+
+        if (rdev->ndev->flags & IFF_PROMISC)
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_PROMISCUOUS);
+        else
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_BROADCAST |
+                                               NDIS_PACKET_TYPE_ALL_MULTICAST |
+                                               NDIS_PACKET_TYPE_DIRECTED);
+}
+
+void rndis_filter_update(struct netvsc_device *nvdev)
+{
+        struct rndis_device *rdev = nvdev->extension;
+
+        schedule_work(&rdev->mcast_work);
+}
+
 static int rndis_filter_init_device(struct rndis_device *dev)
 {
         struct rndis_request *request;
@@ -973,6 +998,9 @@ static int rndis_filter_close_device(struct rndis_device *dev)
         if (dev->state != RNDIS_DEV_DATAINITIALIZED)
                 return 0;
 
+        /* Make sure rndis_set_multicast doesn't re-enable filter! */
+        cancel_work_sync(&dev->mcast_work);
+
         ret = rndis_filter_set_packet_filter(dev, 0);
         if (ret == -ENODEV)
                 ret = 0;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 312fce7302d3..144ea5ae8ab4 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -207,7 +207,6 @@ static void ifb_dev_free(struct net_device *dev)
                 __skb_queue_purge(&txp->tq);
         }
         kfree(dp->tx_private);
-        free_netdev(dev);
 }
 
 static void ifb_setup(struct net_device *dev)
@@ -230,7 +229,8 @@ static void ifb_setup(struct net_device *dev)
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netif_keep_dst(dev);
         eth_hw_addr_random(dev);
-        dev->destructor = ifb_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ifb_dev_free;
 }
 
 static netdev_tx_t ifb_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 618ed88fad0f..7c7680c8f0e3 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -632,7 +632,7 @@ void ipvlan_link_setup(struct net_device *dev)
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_UNICAST_FLT | IFF_NO_QUEUE;
         dev->netdev_ops = &ipvlan_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->header_ops = &ipvlan_header_ops;
         dev->ethtool_ops = &ipvlan_ethtool_ops;
 }
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 224f65cb576b..30612497643c 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -159,7 +159,6 @@ static void loopback_dev_free(struct net_device *dev)
 {
         dev_net(dev)->loopback_dev = NULL;
         free_percpu(dev->lstats);
-        free_netdev(dev);
 }
 
 static const struct net_device_ops loopback_ops = {
@@ -196,7 +195,8 @@ static void loopback_setup(struct net_device *dev)
         dev->ethtool_ops        = &loopback_ethtool_ops;
         dev->header_ops         = &eth_header_ops;
         dev->netdev_ops         = &loopback_ops;
-        dev->destructor         = loopback_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = loopback_dev_free;
 }
 
 /* Setup and register the loopback device. */
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index cdc347be68f2..79411675f0e6 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2996,7 +2996,6 @@ static void macsec_free_netdev(struct net_device *dev)
         free_percpu(macsec->secy.tx_sc.stats);
 
         dev_put(real_dev);
-        free_netdev(dev);
 }
 
 static void macsec_setup(struct net_device *dev)
@@ -3006,7 +3005,8 @@ static void macsec_setup(struct net_device *dev)
         dev->max_mtu = ETH_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->netdev_ops = &macsec_netdev_ops;
-        dev->destructor = macsec_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = macsec_free_netdev;
         SET_NETDEV_DEVTYPE(dev, &macsec_type);
 
         eth_zero_addr(dev->broadcast);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 346ad2ff3998..72b801803aa4 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -39,16 +39,20 @@
 #define MACVLAN_HASH_SIZE       (1<<MACVLAN_HASH_BITS)
 #define MACVLAN_BC_QUEUE_LEN    1000
 
+#define MACVLAN_F_PASSTHRU      1
+#define MACVLAN_F_ADDRCHANGE    2
+
 struct macvlan_port {
         struct net_device       *dev;
         struct hlist_head       vlan_hash[MACVLAN_HASH_SIZE];
         struct list_head        vlans;
         struct sk_buff_head     bc_queue;
         struct work_struct      bc_work;
-        bool                    passthru;
+        u32                     flags;
         int                     count;
         struct hlist_head       vlan_source_hash[MACVLAN_HASH_SIZE];
         DECLARE_BITMAP(mc_filter, MACVLAN_MC_FILTER_SZ);
+        unsigned char           perm_addr[ETH_ALEN];
 };
 
 struct macvlan_source_entry {
@@ -66,6 +70,31 @@ struct macvlan_skb_cb {
 
 static void macvlan_port_destroy(struct net_device *dev);
 
+static inline bool macvlan_passthru(const struct macvlan_port *port)
+{
+        return port->flags & MACVLAN_F_PASSTHRU;
+}
+
+static inline void macvlan_set_passthru(struct macvlan_port *port)
+{
+        port->flags |= MACVLAN_F_PASSTHRU;
+}
+
+static inline bool macvlan_addr_change(const struct macvlan_port *port)
+{
+        return port->flags & MACVLAN_F_ADDRCHANGE;
+}
+
+static inline void macvlan_set_addr_change(struct macvlan_port *port)
+{
+        port->flags |= MACVLAN_F_ADDRCHANGE;
+}
+
+static inline void macvlan_clear_addr_change(struct macvlan_port *port)
+{
+        port->flags &= ~MACVLAN_F_ADDRCHANGE;
+}
+
 /* Hash Ethernet address */
 static u32 macvlan_eth_hash(const unsigned char *addr)
 {
@@ -181,11 +210,12 @@ static void macvlan_hash_change_addr(struct macvlan_dev *vlan,
 static bool macvlan_addr_busy(const struct macvlan_port *port,
                               const unsigned char *addr)
 {
-        /* Test to see if the specified multicast address is
+        /* Test to see if the specified address is
          * currently in use by the underlying device or
          * another macvlan.
          */
-        if (ether_addr_equal_64bits(port->dev->dev_addr, addr))
+        if (!macvlan_passthru(port) && !macvlan_addr_change(port) &&
+            ether_addr_equal_64bits(port->dev->dev_addr, addr))
                 return true;
 
         if (macvlan_hash_lookup(port, addr))
@@ -445,7 +475,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
         }
 
         macvlan_forward_source(skb, port, eth->h_source);
-        if (port->passthru)
+        if (macvlan_passthru(port))
                 vlan = list_first_or_null_rcu(&port->vlans,
                                               struct macvlan_dev, list);
         else
@@ -574,7 +604,7 @@ static int macvlan_open(struct net_device *dev)
         struct net_device *lowerdev = vlan->lowerdev;
         int err;
 
-        if (vlan->port->passthru) {
+        if (macvlan_passthru(vlan->port)) {
                 if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
                         err = dev_set_promiscuity(lowerdev, 1);
                         if (err < 0)
@@ -649,7 +679,7 @@ static int macvlan_stop(struct net_device *dev)
         dev_uc_unsync(lowerdev, dev);
         dev_mc_unsync(lowerdev, dev);
 
-        if (vlan->port->passthru) {
+        if (macvlan_passthru(vlan->port)) {
                 if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
                         dev_set_promiscuity(lowerdev, -1);
                 goto hash_del;
@@ -672,6 +702,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
         struct net_device *lowerdev = vlan->lowerdev;
+        struct macvlan_port *port = vlan->port;
         int err;
 
         if (!(dev->flags & IFF_UP)) {
@@ -682,7 +713,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
                 if (macvlan_addr_busy(vlan->port, addr))
                         return -EBUSY;
 
-                if (!vlan->port->passthru) {
+                if (!macvlan_passthru(port)) {
                         err = dev_uc_add(lowerdev, addr);
                         if (err)
                                 return err;
@@ -692,6 +723,15 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
 
                 macvlan_hash_change_addr(vlan, addr);
         }
+        if (macvlan_passthru(port) && !macvlan_addr_change(port)) {
+                /* Since addr_change isn't set, we are here due to lower
+                 * device change.  Save the lower-dev address so we can
+                 * restore it later.
+                 */
+                ether_addr_copy(vlan->port->perm_addr,
+                                lowerdev->dev_addr);
+        }
+        macvlan_clear_addr_change(port);
         return 0;
 }
 
@@ -703,7 +743,12 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p)
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
+        /* If the addresses are the same, this is a no-op */
+        if (ether_addr_equal(dev->dev_addr, addr->sa_data))
+                return 0;
+
         if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
+                macvlan_set_addr_change(vlan->port);
                 dev_set_mac_address(vlan->lowerdev, addr);
                 return 0;
         }
@@ -928,7 +973,7 @@ static int macvlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
         /* Support unicast filter only on passthru devices.
          * Multicast filter should be allowed on all devices.
          */
-        if (!vlan->port->passthru && is_unicast_ether_addr(addr))
+        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                 return -EOPNOTSUPP;
 
         if (flags & NLM_F_REPLACE)
@@ -952,7 +997,7 @@ static int macvlan_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
         /* Support unicast filter only on passthru devices.
          * Multicast filter should be allowed on all devices.
          */
-        if (!vlan->port->passthru && is_unicast_ether_addr(addr))
+        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                 return -EOPNOTSUPP;
 
         if (is_unicast_ether_addr(addr))
@@ -1092,7 +1137,7 @@ void macvlan_common_setup(struct net_device *dev)
         netif_keep_dst(dev);
         dev->priv_flags        |= IFF_UNICAST_FLT;
         dev->netdev_ops         = &macvlan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &macvlan_hard_header_ops;
         dev->ethtool_ops        = &macvlan_ethtool_ops;
 }
@@ -1120,8 +1165,8 @@ static int macvlan_port_create(struct net_device *dev)
         if (port == NULL)
                 return -ENOMEM;
 
-        port->passthru = false;
         port->dev = dev;
+        ether_addr_copy(port->perm_addr, dev->dev_addr);
         INIT_LIST_HEAD(&port->vlans);
         for (i = 0; i < MACVLAN_HASH_SIZE; i++)
                 INIT_HLIST_HEAD(&port->vlan_hash[i]);
@@ -1161,6 +1206,18 @@ static void macvlan_port_destroy(struct net_device *dev)
                 kfree_skb(skb);
         }
 
+        /* If the lower device address has been changed by passthru
+         * macvlan, put it back.
+         */
+        if (macvlan_passthru(port) &&
+            !ether_addr_equal(port->dev->dev_addr, port->perm_addr)) {
+                struct sockaddr sa;
+
+                sa.sa_family = port->dev->type;
+                memcpy(&sa.sa_data, port->perm_addr, port->dev->addr_len);
+                dev_set_mac_address(port->dev, &sa);
+        }
+
         kfree(port);
 }
 
@@ -1326,7 +1383,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         port = macvlan_port_get_rtnl(lowerdev);
 
         /* Only 1 macvlan device can be created in passthru mode */
-        if (port->passthru) {
+        if (macvlan_passthru(port)) {
                 /* The macvlan port must be not created this time,
                  * still goto destroy_macvlan_port for readability.
                  */
@@ -1352,7 +1409,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                         err = -EINVAL;
                         goto destroy_macvlan_port;
                 }
-                port->passthru = true;
+                macvlan_set_passthru(port);
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
@@ -1434,7 +1491,7 @@ static int macvlan_changelink(struct net_device *dev,
         if (data && data[IFLA_MACVLAN_FLAGS]) {
                 __u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
                 bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
-                if (vlan->port->passthru && promisc) {
+                if (macvlan_passthru(vlan->port) && promisc) {
                         int err;
 
                         if (flags & MACVLAN_FLAG_NOPROMISC)
@@ -1597,7 +1654,7 @@ static int macvlan_device_event(struct notifier_block *unused,
                 }
                 break;
         case NETDEV_CHANGEADDR:
-                if (!port->passthru)
+                if (!macvlan_passthru(port))
                         return NOTIFY_DONE;
 
                 vlan = list_first_entry_or_null(&port->vlans,
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 06ee6395117f..0e27920c2b6b 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -358,7 +358,7 @@ static ssize_t enabled_store(struct config_item *item,
                 if (err)
                         goto out_unlock;
 
-                pr_info("netconsole: network logging started\n");
+                pr_info("network logging started\n");
         } else {        /* false */
                 /* We need to disable the netconsole before cleaning it up
                  * otherwise we might end up in write_msg() with
diff --git a/drivers/net/nlmon.c b/drivers/net/nlmon.c
index b91603835d26..c4b3362da4a2 100644
--- a/drivers/net/nlmon.c
+++ b/drivers/net/nlmon.c
@@ -113,7 +113,7 @@ static void nlmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &nlmon_ops;
         dev->ethtool_ops = &nlmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 60ffc9da6a28..3ab6c58d4be6 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -108,7 +108,7 @@ config MDIO_MOXART
 config MDIO_OCTEON
         tristate "Octeon and some ThunderX SOCs MDIO buses"
         depends on 64BIT
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && OF_MDIO
         select MDIO_CAVIUM
         help
           This module provides a driver for the Octeon and ThunderX MDIO
@@ -127,6 +127,7 @@ config MDIO_THUNDER
         tristate "ThunderX SOCs MDIO buses"
         depends on 64BIT
         depends on PCI
+        depends on !(MDIO_DEVICE=y && PHYLIB=m)
         select MDIO_CAVIUM
         help
           This driver supports the MDIO interfaces found on Cavium
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index ed0d10f54f26..c3065236ffcc 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -908,7 +908,7 @@ static void decode_txts(struct dp83640_private *dp83640,
         if (overflow) {
                 pr_debug("tx timestamp queue overflow, count %d\n", overflow);
                 while (skb) {
-                        skb_complete_tx_timestamp(skb, NULL);
+                        kfree_skb(skb);
                         skb = skb_dequeue(&dp83640->tx_queue);
                 }
                 return;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 272b051a0199..57297ba23987 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -255,34 +255,6 @@ static int marvell_config_aneg(struct phy_device *phydev)
 {
         int err;
 
-        /* The Marvell PHY has an errata which requires
-         * that certain registers get written in order
-         * to restart autonegotiation */
-        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x1f);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x200c);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x5);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x100);
-        if (err < 0)
-                return err;
-
         err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
         if (err < 0)
                 return err;
@@ -316,6 +288,42 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1101_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* This Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x1f);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x200c);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x5);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x100);
+        if (err < 0)
+                return err;
+
+        return marvell_config_aneg(phydev);
+}
+
 static int m88e1111_config_aneg(struct phy_device *phydev)
 {
         int err;
@@ -1119,8 +1127,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
-
                 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
                         phydev->duplex = DUPLEX_FULL;
                 else
@@ -1892,7 +1898,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &marvell_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8e73f5f36e71..f99c21f78b63 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -658,6 +658,18 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int mdio_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int rc;
+
+        /* Some devices have extra OF data and an OF-style MODALIAS */
+        rc = of_device_uevent_modalias(dev, env);
+        if (rc != -ENODEV)
+                return rc;
+
+        return 0;
+}
+
 #ifdef CONFIG_PM
 static int mdio_bus_suspend(struct device *dev)
 {
@@ -708,6 +720,7 @@ static const struct dev_pm_ops mdio_bus_pm_ops = {
 struct bus_type mdio_bus_type = {
         .name           = "mdio_bus",
         .match          = mdio_bus_match,
+        .uevent         = mdio_uevent,
         .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6a5fd18f062c..8b2038844ba9 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -268,23 +268,12 @@ out:
         return ret;
 }
 
-static int kszphy_config_init(struct phy_device *phydev)
+/* Some config bits need to be set again on resume, handle them here. */
+static int kszphy_config_reset(struct phy_device *phydev)
 {
         struct kszphy_priv *priv = phydev->priv;
-        const struct kszphy_type *type;
         int ret;
 
-        if (!priv)
-                return 0;
-
-        type = priv->type;
-
-        if (type->has_broadcast_disable)
-                kszphy_broadcast_disable(phydev);
-
-        if (type->has_nand_tree_disable)
-                kszphy_nand_tree_disable(phydev);
-
         if (priv->rmii_ref_clk_sel) {
                 ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
                 if (ret) {
@@ -295,11 +284,30 @@ static int kszphy_config_init(struct phy_device *phydev)
         }
 
         if (priv->led_mode >= 0)
-                kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
+                kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
 
         return 0;
 }
 
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        struct kszphy_priv *priv = phydev->priv;
+        const struct kszphy_type *type;
+
+        if (!priv)
+                return 0;
+
+        type = priv->type;
+
+        if (type->has_broadcast_disable)
+                kszphy_broadcast_disable(phydev);
+
+        if (type->has_nand_tree_disable)
+                kszphy_nand_tree_disable(phydev);
+
+        return kszphy_config_reset(phydev);
+}
+
 static int ksz8041_config_init(struct phy_device *phydev)
 {
         struct device_node *of_node = phydev->mdio.dev.of_node;
@@ -611,6 +619,8 @@ static int ksz9031_read_status(struct phy_device *phydev)
         if ((regval & 0xFF) == 0xFF) {
                 phy_init_hw(phydev);
                 phydev->link = 0;
+                if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
+                        phydev->drv->config_intr(phydev);
         }
 
         return 0;
@@ -700,8 +710,14 @@ static int kszphy_suspend(struct phy_device *phydev)
 
 static int kszphy_resume(struct phy_device *phydev)
 {
+        int ret;
+
         genphy_resume(phydev);
 
+        ret = kszphy_config_reset(phydev);
+        if (ret)
+                return ret;
+
         /* Enable PHY Interrupts */
         if (phy_interrupt_is_valid(phydev)) {
                 phydev->interrupts = PHY_INTERRUPT_ENABLED;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 82ab8fb82587..eebb0e1c70ff 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -54,6 +54,8 @@ static const char *phy_speed_to_str(int speed)
                 return "5Gbps";
         case SPEED_10000:
                 return "10Gbps";
+        case SPEED_14000:
+                return "14Gbps";
         case SPEED_20000:
                 return "20Gbps";
         case SPEED_25000:
@@ -241,7 +243,7 @@ static const struct phy_setting settings[] = {
  * phy_lookup_setting - lookup a PHY setting
  * @speed: speed to match
  * @duplex: duplex to match
- * @feature: allowed link modes
+ * @features: allowed link modes
  * @exact: an exact match is required
  *
  * Search the settings array for a setting that matches the speed and
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 1da31dc47f86..74b907206aa7 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -629,7 +629,7 @@ static void sl_uninit(struct net_device *dev)
 static void sl_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slip_devs[i] = NULL;
 }
 
@@ -651,7 +651,8 @@ static const struct net_device_ops sl_netdev_ops = {
 static void sl_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &sl_netdev_ops;
-        dev->destructor         = sl_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = sl_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -1369,8 +1370,6 @@ static void __exit slip_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6c5d5ef46f75..fba8c136aa7c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1643,7 +1643,6 @@ static void team_destructor(struct net_device *dev)
         struct team *team = netdev_priv(dev);
 
         free_percpu(team->pcpu_stats);
-        free_netdev(dev);
 }
 
 static int team_open(struct net_device *dev)
@@ -2079,7 +2078,8 @@ static void team_setup(struct net_device *dev)
 
         dev->netdev_ops = &team_netdev_ops;
         dev->ethtool_ops = &team_ethtool_ops;
-        dev->destructor = team_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = team_destructor;
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->priv_flags |= IFF_TEAM;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index bbd707b9ef7a..9ee7d4275640 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1560,7 +1560,6 @@ static void tun_free_netdev(struct net_device *dev)
         free_percpu(tun->pcpu_stats);
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
-        free_netdev(dev);
 }
 
 static void tun_setup(struct net_device *dev)
@@ -1571,7 +1570,8 @@ static void tun_setup(struct net_device *dev)
         tun->group = INVALID_GID;
 
         dev->ethtool_ops = &tun_ethtool_ops;
-        dev->destructor = tun_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = tun_free_netdev;
         /* We prefer our own queue length */
         dev->tx_queue_len = TUN_READQ_SIZE;
 }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 51cf60092a18..4037ab27734a 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1722,6 +1722,18 @@ static const struct driver_info lenovo_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info belkin_info = {
+        .description = "Belkin USB Ethernet Adapter",
+        .bind   = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset  = ax88179_reset,
+        .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1751,6 +1763,10 @@ static const struct usb_device_id products[] = {
         /* Lenovo OneLinkDock Gigabit LAN */
         USB_DEVICE(0x17ef, 0x304b),
         .driver_info = (unsigned long)&lenovo_info,
+}, {
+        /* Belkin B2B128 USB 3.0 Hub + Gigabit Ethernet Adapter */
+        USB_DEVICE(0x050d, 0x0128),
+        .driver_info = (unsigned long)&belkin_info,
 },
         { },
 };
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index eb52de8205f0..c7a350bbaaa7 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -298,7 +298,7 @@ static void usbpn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = 3;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f3ae88fdf332..8ab281b478f2 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -310,6 +310,26 @@ skip:
                 return -ENODEV;
         }
 
+        return 0;
+
+bad_desc:
+        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+
+
+/* like usbnet_generic_cdc_bind() but handles filter initialization
+ * correctly
+ */
+int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int rv;
+
+        rv = usbnet_generic_cdc_bind(dev, intf);
+        if (rv < 0)
+                goto bail_out;
+
         /* Some devices don't initialise properly. In particular
          * the packet filter is not reset. There are devices that
          * don't do reset all the way. So the packet filter should
@@ -317,13 +337,10 @@ skip:
          */
         usbnet_cdc_update_filter(dev);
 
-        return 0;
-
-bad_desc:
-        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
-        return -ENODEV;
+bail_out:
+        return rv;
 }
-EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
 
 void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
@@ -417,7 +434,7 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
                         < sizeof(struct cdc_state)));
 
-        status = usbnet_generic_cdc_bind(dev, intf);
+        status = usbnet_ether_cdc_bind(dev, intf);
         if (status < 0)
                 return status;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8f923a147fa9..32a22f4e8356 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -123,7 +123,7 @@ static void qmimux_setup(struct net_device *dev)
         dev->addr_len        = 0;
         dev->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
         dev->netdev_ops      = &qmimux_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static struct net_device *qmimux_find_dev(struct usbnet *dev, u8 mux_id)
@@ -1192,6 +1192,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
         {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
@@ -1206,6 +1208,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
+        {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
+        {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)},    /* Telewell TW-3G HSPA+ */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ddc62cb69be8..1a419a45e2a2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -4368,6 +4368,8 @@ static u8 rtl_get_version(struct usb_interface *intf)
                 break;
         }
 
+        dev_dbg(&intf->dev, "Detected version 0x%04x\n", version);
+
         return version;
 }
 
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 765400b62168..2dfca96a63b6 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -681,7 +681,7 @@ static int smsc95xx_set_features(struct net_device *netdev,
         if (ret < 0)
                 return ret;
 
-        if (features & NETIF_F_HW_CSUM)
+        if (features & NETIF_F_IP_CSUM)
                 read_buf |= Tx_COE_EN_;
         else
                 read_buf &= ~Tx_COE_EN_;
@@ -1279,12 +1279,19 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         spin_lock_init(&pdata->mac_cr_lock);
 
+        /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff.
+         * RFC 2460, ipv6 UDP calculated checksum yields a result of zero must
+         * be changed to 0xffff. RFC 768, ipv4 UDP computed checksum is zero,
+         * it is transmitted as all ones. The zero transmitted checksum means
+         * transmitter generated no checksum. Hence, enable csum offload only
+         * for ipv4 packets.
+         */
         if (DEFAULT_TX_CSUM_ENABLE)
-                dev->net->features |= NETIF_F_HW_CSUM;
+                dev->net->features |= NETIF_F_IP_CSUM;
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
-        dev->net->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+        dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         smsc95xx_init_mac_address(dev);
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 38f0f03a29c8..364fa9d11d1a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -222,7 +222,6 @@ static int veth_dev_init(struct net_device *dev)
 static void veth_dev_free(struct net_device *dev)
 {
         free_percpu(dev->vstats);
-        free_netdev(dev);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -317,7 +316,8 @@ static void veth_setup(struct net_device *dev)
                                NETIF_F_HW_VLAN_STAG_TX |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_STAG_RX);
-        dev->destructor = veth_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = veth_dev_free;
         dev->max_mtu = ETH_MAX_MTU;
 
         dev->hw_features = VETH_FEATURES;
@@ -383,7 +383,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
                 tbp = tb;
         }
 
-        if (tbp[IFLA_IFNAME]) {
+        if (ifmp && tbp[IFLA_IFNAME]) {
                 nla_strlcpy(ifname, tbp[IFLA_IFNAME], IFNAMSIZ);
                 name_assign_type = NET_NAME_USER;
         } else {
@@ -402,7 +402,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
                 return PTR_ERR(peer);
         }
 
-        if (tbp[IFLA_ADDRESS] == NULL)
+        if (!ifmp || !tbp[IFLA_ADDRESS])
                 eth_hw_addr_random(peer);
 
         if (ifmp && (dev->ifindex != 0))
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9320d96a1632..143d8a95a60d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -869,7 +869,7 @@ static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
         unsigned int len;
 
         len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
-                                rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len);
+                                rq->min_buf_len, PAGE_SIZE - hdr_len);
         return ALIGN(len, L1_CACHE_BYTES);
 }
 
@@ -1797,6 +1797,7 @@ static void virtnet_freeze_down(struct virtio_device *vdev)
         flush_work(&vi->config_work);
 
         netif_device_detach(vi->dev);
+        netif_tx_disable(vi->dev);
         cancel_delayed_work_sync(&vi->refill);
 
         if (netif_running(vi->dev)) {
@@ -1989,6 +1990,7 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_poll_controller = virtnet_netpoll,
 #endif
         .ndo_xdp                = virtnet_xdp,
+        .ndo_features_check     = passthru_features_check,
 };
 
 static void virtnet_config_changed_work(struct work_struct *work)
@@ -2143,7 +2145,8 @@ static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct virtqu
         unsigned int buf_len = hdr_len + ETH_HLEN + VLAN_HLEN + packet_len;
         unsigned int min_buf_len = DIV_ROUND_UP(buf_len, rq_size);
 
-        return max(min_buf_len, hdr_len);
+        return max(max(min_buf_len, hdr_len) - hdr_len,
+                   (unsigned int)GOOD_PACKET_LEN);
 }
 
 static int virtnet_find_vqs(struct virtnet_info *vi)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index db882493875c..022c0b5f9844 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -36,12 +36,14 @@
 #include <net/addrconf.h>
 #include <net/l3mdev.h>
 #include <net/fib_rules.h>
+#include <net/netns/generic.h>
 
 #define DRV_NAME        "vrf"
 #define DRV_VERSION     "1.0"
 
 #define FIB_RULE_PREF  1000       /* default preference for FIB rules */
-static bool add_fib_rules = true;
+
+static unsigned int vrf_net_id;
 
 struct net_vrf {
         struct rtable __rcu     *rth;
@@ -1348,7 +1350,7 @@ static void vrf_setup(struct net_device *dev)
         dev->netdev_ops = &vrf_netdev_ops;
         dev->l3mdev_ops = &vrf_l3mdev_ops;
         dev->ethtool_ops = &vrf_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         /* Fill in device structure with ethernet-generic values. */
         eth_hw_addr_random(dev);
@@ -1394,6 +1396,8 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
                        struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_vrf *vrf = netdev_priv(dev);
+        bool *add_fib_rules;
+        struct net *net;
         int err;
 
         if (!data || !data[IFLA_VRF_TABLE])
@@ -1409,13 +1413,15 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto out;
 
-        if (add_fib_rules) {
+        net = dev_net(dev);
+        add_fib_rules = net_generic(net, vrf_net_id);
+        if (*add_fib_rules) {
                 err = vrf_add_fib_rules(dev);
                 if (err) {
                         unregister_netdevice(dev);
                         goto out;
                 }
-                add_fib_rules = false;
+                *add_fib_rules = false;
         }
 
 out:
@@ -1498,16 +1504,38 @@ static struct notifier_block vrf_notifier_block __read_mostly = {
         .notifier_call = vrf_device_event,
 };
 
+/* Initialize per network namespace state */
+static int __net_init vrf_netns_init(struct net *net)
+{
+        bool *add_fib_rules = net_generic(net, vrf_net_id);
+
+        *add_fib_rules = true;
+
+        return 0;
+}
+
+static struct pernet_operations vrf_net_ops __net_initdata = {
+        .init = vrf_netns_init,
+        .id   = &vrf_net_id,
+        .size = sizeof(bool),
+};
+
 static int __init vrf_init_module(void)
 {
         int rc;
 
         register_netdevice_notifier(&vrf_notifier_block);
 
-        rc = rtnl_link_register(&vrf_link_ops);
+        rc = register_pernet_subsys(&vrf_net_ops);
         if (rc < 0)
                 goto error;
 
+        rc = rtnl_link_register(&vrf_link_ops);
+        if (rc < 0) {
+                unregister_pernet_subsys(&vrf_net_ops);
+                goto error;
+        }
+
         return 0;
 
 error:
diff --git a/drivers/net/vsockmon.c b/drivers/net/vsockmon.c
index 7f0136f2dd9d..c28bdce14fd5 100644
--- a/drivers/net/vsockmon.c
+++ b/drivers/net/vsockmon.c
@@ -135,7 +135,7 @@ static void vsockmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &vsockmon_ops;
         dev->ethtool_ops = &vsockmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b4712683c..5fa798a5c9a6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN + 2];
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
         struct list_head  vxlan_list;
@@ -740,6 +742,22 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
         call_rcu(&f->rcu, vxlan_fdb_free);
 }
 
+static void vxlan_dst_free(struct rcu_head *head)
+{
+        struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
+
+        dst_cache_destroy(&rd->dst_cache);
+        kfree(rd);
+}
+
+static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                                  struct vxlan_rdst *rd)
+{
+        list_del_rcu(&rd->list);
+        vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
+        call_rcu(&rd->rcu, vxlan_dst_free);
+}
+
 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
                            union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
                            __be32 *vni, u32 *ifindex)
@@ -864,9 +882,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
          * otherwise destroy the fdb entry
          */
         if (rd && !list_is_singular(&f->remotes)) {
-                list_del_rcu(&rd->list);
-                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
-                kfree_rcu(rd, rcu);
+                vxlan_fdb_dst_destroy(vxlan, f, rd);
                 goto out;
         }
 
@@ -1067,6 +1083,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
         rcu_assign_pointer(vxlan->vn4_sock, NULL);
         synchronize_net();
 
+        vxlan_vs_del_dev(vxlan);
+
         if (__vxlan_sock_release_prep(sock4)) {
                 udp_tunnel_sock_release(sock4->sock);
                 kfree(sock4);
@@ -2342,6 +2360,15 @@ static void vxlan_cleanup(unsigned long arg)
         mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+        spin_lock(&vn->sock_lock);
+        hlist_del_init_rcu(&vxlan->hlist);
+        spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -2584,7 +2611,7 @@ static void vxlan_setup(struct net_device *dev)
         eth_hw_addr_random(dev);
         ether_setup(dev);
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         SET_NETDEV_DEVTYPE(dev, &vxlan_type);
 
         dev->features   |= NETIF_F_LLTX;
@@ -3286,15 +3313,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
         vxlan_flush(vxlan, true);
 
-        spin_lock(&vn->sock_lock);
-        if (!hlist_unhashed(&vxlan->hlist))
-                hlist_del_rcu(&vxlan->hlist);
-        spin_unlock(&vn->sock_lock);
-
         gro_cells_destroy(&vxlan->gro_cells);
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 65ee2a6f248c..a0d76f70c428 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -475,7 +475,7 @@ static void dlci_setup(struct net_device *dev)
         dev->flags              = 0;
         dev->header_ops         = &dlci_header_ops;
         dev->netdev_ops         = &dlci_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dlp->receive            = dlci_receive;
 
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index eb915281197e..78596e42a3f3 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -1106,7 +1106,7 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
                 return -EIO;
         }
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         *get_dev_p(pvc, type) = dev;
         if (!used) {
                 state(hdlc)->dce_changed = 1;
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 9df9ed62beff..63f749078a1f 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -306,7 +306,7 @@ static const struct net_device_ops lapbeth_netdev_ops = {
 static void lapbeth_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &lapbeth_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
         dev->type            = ARPHRD_X25;
         dev->hard_header_len = 3;
         dev->mtu             = 1000;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 91ee542de3d7..b90c77ef792e 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -1287,7 +1287,7 @@ void init_netdev(struct net_device *dev)
         struct ath6kl *ar = ath6kl_priv(dev);
 
         dev->netdev_ops = &ath6kl_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
 
         dev->needed_headroom = ETH_HLEN;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index d5e993dc9b23..517a315e259b 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1271,6 +1271,8 @@ static int wcn36xx_remove(struct platform_device *pdev)
         qcom_smem_state_put(wcn->tx_enable_state);
         qcom_smem_state_put(wcn->tx_rings_empty_state);
 
+        rpmsg_destroy_ept(wcn->smd_channel);
+
         iounmap(wcn->dxe_base);
         iounmap(wcn->ccu_base);
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index cd1d6730eab7..617199c0e5a0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5225,7 +5225,6 @@ void brcmf_cfg80211_free_netdev(struct net_device *ndev)
 
         if (vif)
                 brcmf_free_vif(vif);
-        free_netdev(ndev);
 }
 
 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index a3d82368f1a9..511d190c6cca 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -624,7 +624,8 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
                 if (!ndev)
                         return ERR_PTR(-ENOMEM);
 
-                ndev->destructor = brcmf_cfg80211_free_netdev;
+                ndev->needs_free_netdev = true;
+                ndev->priv_destructor = brcmf_cfg80211_free_netdev;
                 ifp = netdev_priv(ndev);
                 ifp->ndev = ndev;
                 /* store mapping ifidx to bsscfgidx */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index c7c1e9906500..d231042f19d6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -442,7 +442,7 @@ struct brcmf_fw {
         const char *nvram_name;
         u16 domain_nr;
         u16 bus_nr;
-        void (*done)(struct device *dev, const struct firmware *fw,
+        void (*done)(struct device *dev, int err, const struct firmware *fw,
                      void *nvram_image, u32 nvram_len);
 };
 
@@ -477,52 +477,51 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
         if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
                 goto fail;
 
-        fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
+        fwctx->done(fwctx->dev, 0, fwctx->code, nvram, nvram_length);
         kfree(fwctx);
         return;
 
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
         release_firmware(fwctx->code);
-        device_release_driver(fwctx->dev);
+        fwctx->done(fwctx->dev, -ENOENT, NULL, NULL, 0);
         kfree(fwctx);
 }
 
 static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
 {
         struct brcmf_fw *fwctx = ctx;
-        int ret;
+        int ret = 0;
 
         brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
-        if (!fw)
+        if (!fw) {
+                ret = -ENOENT;
                 goto fail;
-
-        /* only requested code so done here */
-        if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
-                fwctx->done(fwctx->dev, fw, NULL, 0);
-                kfree(fwctx);
-                return;
         }
+        /* only requested code so done here */
+        if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM))
+                goto done;
+
         fwctx->code = fw;
         ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
                                       fwctx->dev, GFP_KERNEL, fwctx,
                                       brcmf_fw_request_nvram_done);
 
-        if (!ret)
-                return;
-
-        brcmf_fw_request_nvram_done(NULL, fwctx);
+        /* pass NULL to nvram callback for bcm47xx fallback */
+        if (ret)
+                brcmf_fw_request_nvram_done(NULL, fwctx);
         return;
 
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-        device_release_driver(fwctx->dev);
+done:
+        fwctx->done(fwctx->dev, ret, fw, NULL, 0);
         kfree(fwctx);
 }
 
 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
                                 const char *code, const char *nvram,
-                                void (*fw_cb)(struct device *dev,
+                                void (*fw_cb)(struct device *dev, int err,
                                               const struct firmware *fw,
                                               void *nvram_image, u32 nvram_len),
                                 u16 domain_nr, u16 bus_nr)
@@ -555,7 +554,7 @@ int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
 
 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
                            const char *code, const char *nvram,
-                           void (*fw_cb)(struct device *dev,
+                           void (*fw_cb)(struct device *dev, int err,
                                          const struct firmware *fw,
                                          void *nvram_image, u32 nvram_len))
 {
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
index d3c9f0d52ae3..8fa4b7e1ab3d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h
@@ -73,13 +73,13 @@ void brcmf_fw_nvram_free(void *nvram);
  */
 int brcmf_fw_get_firmwares_pcie(struct device *dev, u16 flags,
                                 const char *code, const char *nvram,
-                                void (*fw_cb)(struct device *dev,
+                                void (*fw_cb)(struct device *dev, int err,
                                               const struct firmware *fw,
                                               void *nvram_image, u32 nvram_len),
                                 u16 domain_nr, u16 bus_nr);
 int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
                            const char *code, const char *nvram,
-                           void (*fw_cb)(struct device *dev,
+                           void (*fw_cb)(struct device *dev, int err,
                                          const struct firmware *fw,
                                          void *nvram_image, u32 nvram_len));
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
index 72373e59308e..f59642b2c935 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
@@ -2145,7 +2145,7 @@ void brcmf_fws_add_interface(struct brcmf_if *ifp)
         struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
         struct brcmf_fws_mac_descriptor *entry;
 
-        if (!ifp->ndev || fws->fcmode == BRCMF_FWS_FCMODE_NONE)
+        if (!ifp->ndev || !brcmf_fws_queue_skbs(fws))
                 return;
 
         entry = &fws->desc.iface[ifp->ifidx];
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index f36b96dc6acd..f878706613e6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1650,16 +1650,23 @@ static const struct brcmf_buscore_ops brcmf_pcie_buscore_ops = {
         .write32 = brcmf_pcie_buscore_write32,
 };
 
-static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
+static void brcmf_pcie_setup(struct device *dev, int ret,
+                             const struct firmware *fw,
                              void *nvram, u32 nvram_len)
 {
-        struct brcmf_bus *bus = dev_get_drvdata(dev);
-        struct brcmf_pciedev *pcie_bus_dev = bus->bus_priv.pcie;
-        struct brcmf_pciedev_info *devinfo = pcie_bus_dev->devinfo;
+        struct brcmf_bus *bus;
+        struct brcmf_pciedev *pcie_bus_dev;
+        struct brcmf_pciedev_info *devinfo;
         struct brcmf_commonring **flowrings;
-        int ret;
         u32 i;
 
+        /* check firmware loading result */
+        if (ret)
+                goto fail;
+
+        bus = dev_get_drvdata(dev);
+        pcie_bus_dev = bus->bus_priv.pcie;
+        devinfo = pcie_bus_dev->devinfo;
         brcmf_pcie_attach(devinfo);
 
         /* Some of the firmwares have the size of the memory of the device
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fc64b8913aa6..5653d6dd38f6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 /* otherwise, set txglomalign */
                 value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                 /* SDIO ADMA requires at least 32 bit alignment */
-                value = max_t(u32, value, 4);
+                value = max_t(u32, value, ALIGNMENT);
                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
                                            sizeof(u32));
         }
@@ -3982,21 +3982,26 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .get_memdump = brcmf_sdio_bus_get_memdump,
 };
 
-static void brcmf_sdio_firmware_callback(struct device *dev,
+static void brcmf_sdio_firmware_callback(struct device *dev, int err,
                                          const struct firmware *code,
                                          void *nvram, u32 nvram_len)
 {
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        struct brcmf_sdio *bus = sdiodev->bus;
-        int err = 0;
+        struct brcmf_bus *bus_if;
+        struct brcmf_sdio_dev *sdiodev;
+        struct brcmf_sdio *bus;
         u8 saveclk;
 
-        brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
+        brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+        bus_if = dev_get_drvdata(dev);
+        sdiodev = bus_if->bus_priv.sdio;
+        if (err)
+                goto fail;
 
         if (!bus_if->drvr)
                 return;
 
+        bus = sdiodev->bus;
+
         /* try to download image and nvram to the dongle */
         bus->alp_only = true;
         err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
@@ -4083,6 +4088,7 @@ release:
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
         device_release_driver(dev);
+        device_release_driver(&sdiodev->func[2]->dev);
 }
 
 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index e4d545f9edee..0eea48e73331 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1159,17 +1159,18 @@ fail:
         return ret;
 }
 
-static void brcmf_usb_probe_phase2(struct device *dev,
+static void brcmf_usb_probe_phase2(struct device *dev, int ret,
                                    const struct firmware *fw,
                                    void *nvram, u32 nvlen)
 {
         struct brcmf_bus *bus = dev_get_drvdata(dev);
-        struct brcmf_usbdev_info *devinfo;
-        int ret;
+        struct brcmf_usbdev_info *devinfo = bus->bus_priv.usb->devinfo;
+
+        if (ret)
+                goto error;
 
         brcmf_dbg(USB, "Start fw downloading\n");
 
-        devinfo = bus->bus_priv.usb->devinfo;
         ret = check_file(fw->data);
         if (ret < 0) {
                 brcmf_err("invalid firmware\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index 3b3e076571d6..45e2efc70d19 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -79,8 +79,8 @@
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   17
 #define IWL7265_UCODE_API_MIN   17
-#define IWL7265D_UCODE_API_MIN  17
-#define IWL3168_UCODE_API_MIN   20
+#define IWL7265D_UCODE_API_MIN  22
+#define IWL3168_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index b9718c0cf174..89137717c1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -74,8 +74,8 @@
 #define IWL8265_UCODE_API_MAX   30
 
 /* Lowest firmware API version supported */
-#define IWL8000_UCODE_API_MIN   17
-#define IWL8265_UCODE_API_MIN   20
+#define IWL8000_UCODE_API_MIN   22
+#define IWL8265_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 306bc967742e..77efbb78e867 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -370,6 +370,7 @@
 #define MON_DMARB_RD_DATA_ADDR          (0xa03c5c)
 
 #define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
 
 /* enable the ID buf for read */
 #define WFPM_PS_CTL_CLR                 0xA0300C
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
index 1b7d265ffb0a..a10c6aae9ab9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
@@ -307,6 +307,11 @@ enum {
 /* Bit 1-3: LQ command color. Used to match responses to LQ commands */
 #define LQ_FLAG_COLOR_POS               1
 #define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f)           (((_f) & LQ_FLAG_COLOR_MSK) >>\
+                                         LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c)          ((((_c) + 1) << LQ_FLAG_COLOR_POS) &\
+                                         LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c)       ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
 
 /* Bit 4-5: Tx RTS BW Signalling
  * (0) No RTS BW signalling
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
index 81b98915b1a4..1360ebfdc51b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
@@ -519,8 +519,11 @@ struct agg_tx_status {
  * bit-7 invalid rate indication
  */
 #define TX_RES_INIT_RATE_INDEX_MSK 0x0f
+#define TX_RES_RATE_TABLE_COLOR_POS 4
 #define TX_RES_RATE_TABLE_COLOR_MSK 0x70
 #define TX_RES_INV_RATE_INDEX_MSK 0x80
+#define TX_RES_RATE_TABLE_COL_GET(_f) (((_f) & TX_RES_RATE_TABLE_COLOR_MSK) >>\
+                                       TX_RES_RATE_TABLE_COLOR_POS)
 
 #define IWL_MVM_TX_RES_GET_TID(_ra_tid) ((_ra_tid) & 0x0f)
 #define IWL_MVM_TX_RES_GET_RA(_ra_tid) ((_ra_tid) >> 4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 7b86a4f1b574..c8712e6eea74 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -1002,14 +1002,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
         return 0;
 }
 
-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
-{
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
-        else
-                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
-}
-
 int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
 {
         u8 *ptr;
@@ -1023,10 +1015,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         /* EARLY START - firmware's configuration is hard coded */
         if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
              !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
-            conf_id == FW_DBG_START_FROM_ALIVE) {
-                iwl_mvm_restart_early_start(mvm);
+            conf_id == FW_DBG_START_FROM_ALIVE)
                 return 0;
-        }
 
         if (!mvm->fw->dbg_conf_tlv[conf_id])
                 return -EINVAL;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 0f1831b41915..fd2fc46e2fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1040,7 +1040,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                 struct iwl_mac_beacon_cmd_v6 beacon_cmd_v6;
                 struct iwl_mac_beacon_cmd_v7 beacon_cmd;
         } u = {};
-        struct iwl_mac_beacon_cmd beacon_cmd;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
         struct ieee80211_tx_info *info;
         u32 beacon_skb_len;
         u32 rate, tx_flags;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4e74a6b90e70..52f8d7a6a7dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1730,8 +1730,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
  */
 static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 {
+        u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
+                IWL_MVM_CMD_QUEUE;
+
         return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
-                ~BIT(IWL_MVM_CMD_QUEUE));
+                ~BIT(cmd_queue));
 }
 
 static inline
@@ -1753,6 +1756,7 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
         if (!iwl_mvm_has_new_tx_api(mvm))
                 iwl_free_fw_paging(mvm);
         mvm->ucode_loaded = false;
+        mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_trans_stop_device(mvm->trans);
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 9ffff6ed8133..3da5ec40aaea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1149,21 +1149,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
 
         mutex_lock(&mvm->mutex);
 
-        /* stop recording */
         if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                /* stop recording */
                 iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+
+                iwl_mvm_fw_error_dump(mvm);
+
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv)
+                        iwl_clear_bits_prph(mvm->trans,
+                                            MON_BUFF_SAMPLE_CTL, 0x100);
         } else {
+                u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
+                u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
+
+                /* stop recording */
                 iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
-                /* wait before we collect the data till the DBGC stop */
                 udelay(100);
-        }
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+                /* wait before we collect the data till the DBGC stop */
+                udelay(500);
 
-        iwl_mvm_fw_error_dump(mvm);
+                iwl_mvm_fw_error_dump(mvm);
 
-        /* start recording again if the firmware is not crashed */
-        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
-                     mvm->fw->dbg_dest_tlv &&
-                     iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv) {
+                        iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
+                        iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
+                }
+        }
 
         mutex_unlock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 7788eefcd2bd..aa785cf3cf68 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2,7 +2,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016 Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -1083,34 +1083,6 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
                 rs_get_lower_rate_in_column(lq_sta, rate);
 }
 
-/* Check if both rates are identical
- * allow_ant_mismatch enables matching a SISO rate on ANT_A or ANT_B
- * with a rate indicating STBC/BFER and ANT_AB.
- */
-static inline bool rs_rate_equal(struct rs_rate *a,
-                                 struct rs_rate *b,
-                                 bool allow_ant_mismatch)
-
-{
-        bool ant_match = (a->ant == b->ant) && (a->stbc == b->stbc) &&
-                (a->bfer == b->bfer);
-
-        if (allow_ant_mismatch) {
-                if (a->stbc || a->bfer) {
-                        WARN_ONCE(a->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  a->stbc, a->bfer, a->ant);
-                        ant_match |= (b->ant == ANT_A || b->ant == ANT_B);
-                } else if (b->stbc || b->bfer) {
-                        WARN_ONCE(b->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  b->stbc, b->bfer, b->ant);
-                        ant_match |= (a->ant == ANT_A || a->ant == ANT_B);
-                }
-        }
-
-        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi) &&
-                (a->ldpc == b->ldpc) && (a->index == b->index) && ant_match;
-}
-
 /* Check if both rates share the same column */
 static inline bool rs_rate_column_match(struct rs_rate *a,
                                         struct rs_rate *b)
@@ -1182,12 +1154,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         u32 lq_hwrate;
         struct rs_rate lq_rate, tx_resp_rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
         u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta;
-        bool allow_ant_mismatch = fw_has_api(&mvm->fw->ucode_capa,
-                                             IWL_UCODE_TLV_API_LQ_SS_PARAMS);
 
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
@@ -1262,10 +1234,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
 
         /* Here we actually compare this rate to the latest LQ command */
-        if (!rs_rate_equal(&tx_resp_rate, &lq_rate, allow_ant_mismatch)) {
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
                 IWL_DEBUG_RATE(mvm,
-                               "initial tx resp rate 0x%x does not match 0x%x\n",
-                               tx_resp_hwrate, lq_hwrate);
+                               "tx resp color 0x%x does not match 0x%x\n",
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
 
                 /*
                  * Since rates mis-match, the last LQ command may have failed.
@@ -3326,6 +3298,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
+        u32 color;
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
@@ -3380,6 +3353,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
                                  num_rates, num_retries, valid_tx_ant,
                                  toggle_ant);
 
+        /* update the color of the LQ command (as a counter at bits 1-3) */
+        color = LQ_FLAGS_COLOR_INC(LQ_FLAG_COLOR_GET(lq_cmd->flags));
+        lq_cmd->flags = LQ_FLAG_COLOR_SET(lq_cmd->flags, color);
 }
 
 struct rs_bfer_active_iter_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index ee207f2c0a90..3abde1cb0303 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -2,6 +2,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -357,6 +358,20 @@ struct iwl_lq_sta {
         } pers;
 };
 
+/* ieee80211_tx_info's status_driver_data[0] is packed with lq color and txp
+ * Note, it's iwlmvm <-> mac80211 interface.
+ * bits 0-7: reduced tx power
+ * bits 8-10: LQ command's color
+ */
+#define RS_DRV_DATA_TXP_MSK 0xff
+#define RS_DRV_DATA_LQ_COLOR_POS 8
+#define RS_DRV_DATA_LQ_COLOR_MSK (7 << RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_LQ_COLOR_GET(_f) (((_f) & RS_DRV_DATA_LQ_COLOR_MSK) >>\
+                                      RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_PACK(_c, _p) ((void *)(uintptr_t)\
+                                  (((uintptr_t)_p) |\
+                                   ((_c) << RS_DRV_DATA_LQ_COLOR_POS)))
+
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           enum nl80211_band band, bool init);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f5c786ddc526..614d67810d05 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2120,7 +2120,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (!iwl_mvm_is_dqa_supported(mvm))
                 return 0;
 
-        if (WARN_ON(vif->type != NL80211_IFTYPE_AP))
+        if (WARN_ON(vif->type != NL80211_IFTYPE_AP &&
+                    vif->type != NL80211_IFTYPE_ADHOC))
                 return -ENOTSUPP;
 
         /*
@@ -2155,6 +2156,16 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
                                IWL_UCODE_TLV_API_STA_TYPE)) {
+                /*
+                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+                 * invalid, so make sure we use the queue we want.
+                 * Note that this is done here as we want to avoid making DQA
+                 * changes in mac80211 layer.
+                 */
+                if (vif->type == NL80211_IFTYPE_ADHOC) {
+                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                        mvmvif->cab_queue = vif->cab_queue;
+                }
                 iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                    &cfg, timeout);
         }
@@ -3321,18 +3332,15 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
 
         /* Get the station from the mvm local station table */
         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
-        if (!mvm_sta) {
-                IWL_ERR(mvm, "Failed to find station\n");
-                return -EINVAL;
-        }
-        sta_id = mvm_sta->sta_id;
+        if (mvm_sta)
+                sta_id = mvm_sta->sta_id;
 
         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                       keyconf->keyidx, sta_id);
 
-        if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+        if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
                 return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
 
         if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 2716cb5483bf..ad62b67dceb2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -313,6 +313,7 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @lq_color: the color of the LQ command as it appears in tx response.
  * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session / DQA
@@ -331,6 +332,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
+        u8 lq_color;
         bool amsdu_in_ampdu_allowed;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index f9cbd197246f..506d58104e1c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
         struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
         int ret;
 
-        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
-                return -EIO;
-
         mutex_lock(&mvm->mutex);
 
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto unlock;
+        }
+
         if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
                 ret = -EINVAL;
                 goto unlock;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index bcaceb64a6e8..f21901cd4a4f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1323,6 +1323,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct sk_buff_head skbs;
         u8 skb_freed = 0;
+        u8 lq_color;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
 
@@ -1405,8 +1406,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 info->status.tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
                 BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
                 info->status.status_driver_data[0] =
-                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+                        RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
 
                 ieee80211_tx_status(mvm->hw, skb);
         }
@@ -1638,6 +1640,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                         le32_to_cpu(tx_resp->initial_rate);
                 mvmsta->tid_data[tid].tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
+                mvmsta->tid_data[tid].lq_color =
+                        (tx_resp->tlc_info & TX_RES_RATE_TABLE_COLOR_MSK) >>
+                        TX_RES_RATE_TABLE_COLOR_POS;
         }
 
         rcu_read_unlock();
@@ -1707,6 +1712,11 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
         iwl_mvm_check_ratid_empty(mvm, sta, tid);
 
         freed = 0;
+
+        /* pack lq color from tid_data along the reduced txp */
+        ba_info->status.status_driver_data[0] =
+                RS_DRV_DATA_PACK(tid_data->lq_color,
+                                 ba_info->status.status_driver_data[0]);
         ba_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 70acf850a9f1..93cbc7a69bcd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2803,7 +2803,8 @@ static struct iwl_trans_dump_data
 #ifdef CONFIG_PM_SLEEP
 static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 return iwl_pci_fw_enter_d0i3(trans);
 
         return 0;
@@ -2811,7 +2812,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_resume(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 iwl_pci_fw_exit_d0i3(trans);
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..9c9bfbbabdf1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -906,7 +906,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 
         if (WARN_ON(iwl_rx_packet_payload_len(hcmd.resp_pkt) != sizeof(*rsp))) {
                 ret = -EINVAL;
-                goto error;
+                goto error_free_resp;
         }
 
         rsp = (void *)hcmd.resp_pkt->data;
@@ -915,13 +915,13 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
         if (qid > ARRAY_SIZE(trans_pcie->txq)) {
                 WARN_ONCE(1, "queue index %d unsupported", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         if (test_and_set_bit(qid, trans_pcie->queue_used)) {
                 WARN_ONCE(1, "queue %d already used", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         txq->id = qid;
@@ -934,8 +934,11 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
                            (txq->write_ptr) | (qid << 16));
         IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d\n", qid);
 
+        iwl_free_resp(&hcmd);
         return qid;
 
+error_free_resp:
+        iwl_free_resp(&hcmd);
 error:
         iwl_pcie_gen2_txq_free_memory(trans, txq);
         return ret;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c
index 544fc09dcb62..1372b20f931e 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_main.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_main.c
@@ -73,7 +73,7 @@ struct net_device * hostap_add_interface(struct local_info *local,
         dev->mem_end = mdev->mem_end;
 
         hostap_setup_dev(dev, local, type);
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         sprintf(dev->name, "%s%s", prefix, name);
         if (!rtnl_locked)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 002b25cff5b6..c854a557998b 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2861,7 +2861,7 @@ static const struct net_device_ops hwsim_netdev_ops = {
 static void hwsim_mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &hwsim_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211_RADIOTAP;
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index dd87b9ff64c3..39b6b5e3f6e0 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1280,7 +1280,7 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
                               struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         /* Initialize private structure */
         priv->current_key_index = 0;
         priv->media_connected = false;
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 530586be05b4..5b1d2e8402d9 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -199,6 +199,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         unsigned long   remaining_credit;
         struct timer_list credit_timeout;
         u64 credit_window_start;
+        bool rate_limited;
 
         /* Statistics */
         struct xenvif_stats stats;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 8397f6c92451..e322a862ddfe 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -106,7 +106,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete_done(napi, work_done);
-                xenvif_napi_schedule_or_enable_events(queue);
+                /* If the queue is rate-limited, it shall be
+                 * rescheduled in the timer callback.
+                 */
+                if (likely(!queue->rate_limited))
+                        xenvif_napi_schedule_or_enable_events(queue);
         }
 
         return work_done;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 602d408fa25e..5042ff8d449a 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -180,6 +180,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
                 max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
 
         queue->remaining_credit = min(max_credit, max_burst);
+        queue->rate_limited = false;
 }
 
 void xenvif_tx_credit_callback(unsigned long data)
@@ -686,8 +687,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
                 msecs_to_jiffies(queue->credit_usec / 1000);
 
         /* Timer could already be pending in rare cases. */
-        if (timer_pending(&queue->credit_timeout))
+        if (timer_pending(&queue->credit_timeout)) {
+                queue->rate_limited = true;
                 return true;
+        }
 
         /* Passed the point where we can replenish credit? */
         if (time_after_eq64(now, next_credit)) {
@@ -702,6 +705,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
                 mod_timer(&queue->credit_timeout,
                           next_credit);
                 queue->credit_window_start = next_credit;
+                queue->rate_limited = true;
 
                 return true;
         }
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index c00238491673..7b3b6fd63d7d 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -2878,7 +2878,7 @@ static const struct intel_ntb_reg skx_reg = {
         .link_is_up             = xeon_link_is_up,
         .db_ioread              = skx_db_ioread,
         .db_iowrite             = skx_db_iowrite,
-        .db_size                = sizeof(u64),
+        .db_size                = sizeof(u32),
         .ntb_ctl                = SKX_NTBCNTL_OFFSET,
         .mw_bar                 = {2, 4},
 };
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 02ca45fdd892..10e5bf460139 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -177,14 +177,12 @@ struct ntb_transport_qp {
         u64 rx_err_ver;
         u64 rx_memcpy;
         u64 rx_async;
-        u64 dma_rx_prep_err;
         u64 tx_bytes;
         u64 tx_pkts;
         u64 tx_ring_full;
         u64 tx_err_no_buf;
         u64 tx_memcpy;
         u64 tx_async;
-        u64 dma_tx_prep_err;
 };
 
 struct ntb_transport_mw {
@@ -254,8 +252,6 @@ enum {
 #define QP_TO_MW(nt, qp)        ((qp) % nt->mw_count)
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
-#define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
@@ -516,12 +512,6 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "free tx - \t%u\n",
                                ntb_transport_tx_free_entry(qp));
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA tx prep err - \t%llu\n",
-                               qp->dma_tx_prep_err);
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA rx prep err - \t%llu\n",
-                               qp->dma_rx_prep_err);
 
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "\n");
@@ -623,7 +613,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
         if (!mw->virt_addr)
                 return -ENOMEM;
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -768,8 +758,6 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
         qp->tx_err_no_buf = 0;
         qp->tx_memcpy = 0;
         qp->tx_async = 0;
-        qp->dma_tx_prep_err = 0;
-        qp->dma_rx_prep_err = 0;
 }
 
 static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
@@ -1000,7 +988,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         qp->event_handler = NULL;
         ntb_qp_link_down_reset(qp);
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -1128,8 +1116,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         qp_count = ilog2(qp_bitmap);
         if (max_num_clients && max_num_clients < qp_count)
                 qp_count = max_num_clients;
-        else if (mw_count < qp_count)
-                qp_count = mw_count;
+        else if (nt->mw_count < qp_count)
+                qp_count = nt->mw_count;
 
         qp_bitmap &= BIT_ULL(qp_count) - 1;
 
@@ -1317,7 +1305,6 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
         struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         void *buf = entry->buf;
-        int retries = 0;
 
         len = entry->len;
         device = chan->device;
@@ -1346,22 +1333,11 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
 
         unmap->from_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan,
-                                                     unmap->addr[1],
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_rx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, unmap->addr[1],
+                                             unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_rx_copy_callback;
         txd->callback_param = entry;
@@ -1606,7 +1582,6 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
         struct dmaengine_unmap_data *unmap;
         dma_addr_t dest;
         dma_cookie_t cookie;
-        int retries = 0;
 
         device = chan->device;
         dest = qp->tx_mw_phys + qp->tx_max_frame * entry->tx_index;
@@ -1628,21 +1603,10 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
 
         unmap->to_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan, dest,
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_tx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, dest, unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_tx_copy_callback;
         txd->callback_param = entry;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 434e1d474f33..5cab2831ce99 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -90,11 +90,11 @@ MODULE_PARM_DESC(max_mw_size, "Limit size of large memory windows");
 
 static unsigned int seg_order = 19; /* 512K */
 module_param(seg_order, uint, 0644);
-MODULE_PARM_DESC(seg_order, "size order [n^2] of buffer segment for testing");
+MODULE_PARM_DESC(seg_order, "size order [2^n] of buffer segment for testing");
 
 static unsigned int run_order = 32; /* 4G */
 module_param(run_order, uint, 0644);
-MODULE_PARM_DESC(run_order, "size order [n^2] of total data to transfer");
+MODULE_PARM_DESC(run_order, "size order [2^n] of total data to transfer");
 
 static bool use_dma; /* default to 0 */
 module_param(use_dma, bool, 0644);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5e0906262ea..903d5813023a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
 static int nvme_char_major;
 module_param(nvme_char_major, int, 0);
 
-static unsigned long default_ps_max_latency_us = 25000;
+static unsigned long default_ps_max_latency_us = 100000;
 module_param(default_ps_max_latency_us, ulong, 0644);
 MODULE_PARM_DESC(default_ps_max_latency_us,
                  "max power saving latency for new devices; use PM QOS to change per device");
@@ -925,6 +925,29 @@ static int nvme_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 }
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+        struct nvme_ns *ns = disk->private_data;
+        u16 old_ms = ns->ms;
+        u8 pi_type = 0;
+
+        ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+
+        /* PI implementation requires metadata equal t10 pi tuple size */
+        if (ns->ms == sizeof(struct t10_pi_tuple))
+                pi_type = id->dps & NVME_NS_DPS_PI_MASK;
+
+        if (blk_get_integrity(disk) &&
+            (ns->pi_type != pi_type || ns->ms != old_ms ||
+             bs != queue_logical_block_size(disk->queue) ||
+             (ns->ms && ns->ext)))
+                blk_integrity_unregister(disk);
+
+        ns->pi_type = pi_type;
+}
+
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
         struct blk_integrity integrity;
@@ -951,6 +974,10 @@ static void nvme_init_integrity(struct nvme_ns *ns)
         blk_queue_max_integrity_segments(ns->queue, 1);
 }
 #else
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+}
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
 }
@@ -997,37 +1024,22 @@ static int nvme_revalidate_ns(struct nvme_ns *ns, struct nvme_id_ns **id)
 static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
 {
         struct nvme_ns *ns = disk->private_data;
-        u8 lbaf, pi_type;
-        u16 old_ms;
-        unsigned short bs;
-
-        old_ms = ns->ms;
-        lbaf = id->flbas & NVME_NS_FLBAS_LBA_MASK;
-        ns->lba_shift = id->lbaf[lbaf].ds;
-        ns->ms = le16_to_cpu(id->lbaf[lbaf].ms);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+        u16 bs;
 
         /*
          * If identify namespace failed, use default 512 byte block size so
          * block layer can use before failing read/write for 0 capacity.
          */
+        ns->lba_shift = id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ds;
         if (ns->lba_shift == 0)
                 ns->lba_shift = 9;
         bs = 1 << ns->lba_shift;
-        /* XXX: PI implementation requires metadata equal t10 pi tuple size */
-        pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
-                                        id->dps & NVME_NS_DPS_PI_MASK : 0;
 
         blk_mq_freeze_queue(disk->queue);
-        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
-                                ns->ms != old_ms ||
-                                bs != queue_logical_block_size(disk->queue) ||
-                                (ns->ms && ns->ext)))
-                blk_integrity_unregister(disk);
 
-        ns->pi_type = pi_type;
+        if (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)
+                nvme_prep_integrity(disk, id, bs);
         blk_queue_logical_block_size(ns->queue, bs);
-
         if (ns->ms && !blk_get_integrity(disk) && !ns->ext)
                 nvme_init_integrity(ns);
         if (ns->ms && !(ns->ms == 8 && ns->pi_type) && !blk_get_integrity(disk))
@@ -1330,7 +1342,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * transitioning between power states.  Therefore, when running
          * in any given state, we will enter the next lower-power
          * non-operational state after waiting 50 * (enlat + exlat)
-         * microseconds, as long as that state's total latency is under
+         * microseconds, as long as that state's exit latency is under
          * the requested maximum latency.
          *
          * We will not autonomously enter any non-operational state for
@@ -1375,7 +1387,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                  * lowest-power state, not the number of states.
                  */
                 for (state = (int)ctrl->npss; state >= 0; state--) {
-                        u64 total_latency_us, transition_ms;
+                        u64 total_latency_us, exit_latency_us, transition_ms;
 
                         if (target)
                                 table->entries[state] = target;
@@ -1396,12 +1408,15 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                               NVME_PS_FLAGS_NON_OP_STATE))
                                 continue;
 
-                        total_latency_us =
-                                (u64)le32_to_cpu(ctrl->psd[state].entry_lat) +
-                                + le32_to_cpu(ctrl->psd[state].exit_lat);
-                        if (total_latency_us > ctrl->ps_max_latency_us)
+                        exit_latency_us =
+                                (u64)le32_to_cpu(ctrl->psd[state].exit_lat);
+                        if (exit_latency_us > ctrl->ps_max_latency_us)
                                 continue;
 
+                        total_latency_us =
+                                exit_latency_us +
+                                le32_to_cpu(ctrl->psd[state].entry_lat);
+
                         /*
                          * This state is good.  Use it as the APST idle
                          * target for higher power states.
@@ -1605,7 +1620,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         }
         memcpy(ctrl->psd, id->psd, sizeof(ctrl->psd));
 
-        if (ctrl->ops->is_fabrics) {
+        if (ctrl->ops->flags & NVME_F_FABRICS) {
                 ctrl->icdoff = le16_to_cpu(id->icdoff);
                 ctrl->ioccsz = le32_to_cpu(id->ioccsz);
                 ctrl->iorcsz = le32_to_cpu(id->iorcsz);
@@ -2098,7 +2113,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 if (ns->ndev)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
-                blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
 
@@ -2427,6 +2441,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns;
 
         mutex_lock(&ctrl->namespaces_mutex);
+
+        /* Forcibly start all queues to avoid having stuck requests */
+        blk_mq_start_hw_queues(ctrl->admin_q);
+
         list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
                  * Revalidating a dead namespace sets capacity to 0. This will
@@ -2436,8 +2454,16 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
                         continue;
                 revalidate_disk(ns->disk);
                 blk_set_queue_dying(ns->queue);
-                blk_mq_abort_requeue_list(ns->queue);
-                blk_mq_start_stopped_hw_queues(ns->queue, true);
+
+                /*
+                 * Forcibly start all queues to avoid having stuck requests.
+                 * Note that we must ensure the queues are not stopped
+                 * when the final removal happens.
+                 */
+                blk_mq_start_hw_queues(ns->queue);
+
+                /* draining requests in requeue list */
+                blk_mq_kick_requeue_list(ns->queue);
         }
         mutex_unlock(&ctrl->namespaces_mutex);
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index dca7165fabcf..92964cef0f4b 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -45,8 +45,6 @@ enum nvme_fc_queue_flags {
 
 #define NVMEFC_QUEUE_DELAY      3               /* ms units */
 
-#define NVME_FC_MAX_CONNECT_ATTEMPTS    1
-
 struct nvme_fc_queue {
         struct nvme_fc_ctrl     *ctrl;
         struct device           *dev;
@@ -165,8 +163,6 @@ struct nvme_fc_ctrl {
         struct work_struct      delete_work;
         struct work_struct      reset_work;
         struct delayed_work     connect_work;
-        int                     reconnect_delay;
-        int                     connect_attempts;
 
         struct kref             ref;
         u32                     flags;
@@ -1143,6 +1139,7 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 /* *********************** NVME Ctrl Routines **************************** */
 
 static void __nvme_fc_final_op_cleanup(struct request *rq);
+static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
 nvme_fc_reinit_request(void *data, struct request *rq)
@@ -1269,7 +1266,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         struct nvme_command *sqe = &op->cmd_iu.sqe;
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
-        bool complete_rq;
+        bool complete_rq, terminate_assoc = true;
 
         /*
          * WARNING:
@@ -1298,6 +1295,14 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * fabricate a CQE, the following fields will not be set as they
          * are not referenced:
          *      cqe.sqid,  cqe.sqhd,  cqe.command_id
+         *
+         * Failure or error of an individual i/o, in a transport
+         * detected fashion unrelated to the nvme completion status,
+         * potentially cause the initiator and target sides to get out
+         * of sync on SQ head/tail (aka outstanding io count allowed).
+         * Per FC-NVME spec, failure of an individual command requires
+         * the connection to be terminated, which in turn requires the
+         * association to be terminated.
          */
 
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
@@ -1363,6 +1368,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 goto done;
         }
 
+        terminate_assoc = false;
+
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
@@ -1370,19 +1377,23 @@ done:
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
-                return;
+                goto check_error;
         }
 
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
         if (!complete_rq) {
                 if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
-                        status = cpu_to_le16(NVME_SC_ABORT_REQ);
+                        status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
                         if (blk_queue_dying(rq->q))
-                                status |= cpu_to_le16(NVME_SC_DNR);
+                                status |= cpu_to_le16(NVME_SC_DNR << 1);
                 }
                 nvme_end_request(rq, status, result);
         } else
                 __nvme_fc_final_op_cleanup(rq);
+
+check_error:
+        if (terminate_assoc)
+                nvme_fc_error_recovery(ctrl, "transport detected io error");
 }
 
 static int
@@ -1751,7 +1762,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
         dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: transport association error detected: %s\n",
                 ctrl->cnum, errmsg);
-        dev_info(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: resetting controller\n", ctrl->cnum);
 
         /* stop the queues on error, cleanup is in reset thread */
@@ -2195,9 +2206,6 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
         if (!opts->nr_io_queues)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
@@ -2268,9 +2276,6 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ctrl->queue_count == 1)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "Recreating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         ret = blk_mq_reinit_tagset(&ctrl->tag_set);
@@ -2306,7 +2311,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         int ret;
         bool changed;
 
-        ctrl->connect_attempts++;
+        ++ctrl->ctrl.opts->nr_reconnects;
 
         /*
          * Create the admin queue
@@ -2403,9 +2408,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
         WARN_ON_ONCE(!changed);
 
-        ctrl->connect_attempts = 0;
-
-        kref_get(&ctrl->ctrl.kref);
+        ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
@@ -2536,26 +2539,32 @@ nvme_fc_delete_ctrl_work(struct work_struct *work)
 
         /*
          * tear down the controller
-         * This will result in the last reference on the nvme ctrl to
-         * expire, calling the transport nvme_fc_nvme_ctrl_freed() callback.
-         * From there, the transport will tear down it's logical queues and
-         * association.
+         * After the last reference on the nvme ctrl is removed,
+         * the transport nvme_fc_nvme_ctrl_freed() callback will be
+         * invoked. From there, the transport will tear down it's
+         * logical queues and association.
          */
         nvme_uninit_ctrl(&ctrl->ctrl);
 
         nvme_put_ctrl(&ctrl->ctrl);
 }
 
-static int
-__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+static bool
+__nvme_fc_schedule_delete_work(struct nvme_fc_ctrl *ctrl)
 {
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return -EBUSY;
+                return true;
 
         if (!queue_work(nvme_fc_wq, &ctrl->delete_work))
-                return -EBUSY;
+                return true;
 
-        return 0;
+        return false;
+}
+
+static int
+__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+{
+        return __nvme_fc_schedule_delete_work(ctrl) ? -EBUSY : 0;
 }
 
 /*
@@ -2581,6 +2590,35 @@ nvme_fc_del_nvme_ctrl(struct nvme_ctrl *nctrl)
 }
 
 static void
+nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+{
+        /* If we are resetting/deleting then do nothing */
+        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+                WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
+                        ctrl->ctrl.state == NVME_CTRL_LIVE);
+                return;
+        }
+
+        dev_info(ctrl->ctrl.device,
+                "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
+                ctrl->cnum, status);
+
+        if (nvmf_should_reconnect(&ctrl->ctrl)) {
+                dev_info(ctrl->ctrl.device,
+                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
+                        ctrl->cnum, ctrl->ctrl.opts->reconnect_delay);
+                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
+                                ctrl->ctrl.opts->reconnect_delay * HZ);
+        } else {
+                dev_warn(ctrl->ctrl.device,
+                                "NVME-FC{%d}: Max reconnect attempts (%d) "
+                                "reached. Removing controller\n",
+                                ctrl->cnum, ctrl->ctrl.opts->nr_reconnects);
+                WARN_ON(__nvme_fc_schedule_delete_work(ctrl));
+        }
+}
+
+static void
 nvme_fc_reset_ctrl_work(struct work_struct *work)
 {
         struct nvme_fc_ctrl *ctrl =
@@ -2591,34 +2629,9 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         nvme_fc_delete_association(ctrl);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reset complete\n", ctrl->cnum);
 }
@@ -2632,7 +2645,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
-        dev_warn(ctrl->ctrl.device,
+        dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: admin requested controller reset\n", ctrl->cnum);
 
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
@@ -2649,7 +2662,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
@@ -2671,34 +2684,9 @@ nvme_fc_connect_ctrl_work(struct work_struct *work)
                                 struct nvme_fc_ctrl, connect_work);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reconnect complete\n",
                         ctrl->cnum);
@@ -2755,7 +2743,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         INIT_WORK(&ctrl->delete_work, nvme_fc_delete_ctrl_work);
         INIT_WORK(&ctrl->reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
-        ctrl->reconnect_delay = opts->reconnect_delay;
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -2835,6 +2822,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 return ERR_PTR(ret);
         }
 
+        kref_get(&ctrl->ctrl.kref);
+
         dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: new ctrl: NQN \"%s\"\n",
                 ctrl->cnum, ctrl->ctrl.opts->subsysnqn);
@@ -2971,7 +2960,7 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
 static struct nvmf_transport_ops nvme_fc_transport = {
         .name           = "fc",
         .required_opts  = NVMF_OPT_TRADDR | NVMF_OPT_HOST_TRADDR,
-        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY,
+        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY | NVMF_OPT_CTRL_LOSS_TMO,
         .create_ctrl    = nvme_fc_create_ctrl,
 };
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 29c708ca9621..9d6a070d4391 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -208,7 +208,9 @@ struct nvme_ns {
 struct nvme_ctrl_ops {
         const char *name;
         struct module *module;
-        bool is_fabrics;
+        unsigned int flags;
+#define NVME_F_FABRICS                  (1 << 0)
+#define NVME_F_METADATA_SUPPORTED       (1 << 1)
         int (*reg_read32)(struct nvme_ctrl *ctrl, u32 off, u32 *val);
         int (*reg_write32)(struct nvme_ctrl *ctrl, u32 off, u32 val);
         int (*reg_read64)(struct nvme_ctrl *ctrl, u32 off, u64 *val);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4c2ff2bb26bc..40c7581caeb0 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -263,7 +263,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
         c.dbbuf.prp2 = cpu_to_le64(dev->dbbuf_eis_dma_addr);
 
         if (nvme_submit_sync_cmd(dev->ctrl.admin_q, &c, NULL, 0)) {
-                dev_warn(dev->dev, "unable to set dbbuf\n");
+                dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
                 /* Free memory and continue on */
                 nvme_dbbuf_dma_free(dev);
         }
@@ -1367,7 +1367,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
 
         /* If there is a reset ongoing, we shouldn't reset again. */
-        if (work_busy(&dev->reset_work))
+        if (dev->ctrl.state == NVME_CTRL_RESETTING)
                 return false;
 
         /* We shouldn't reset unless the controller is on fatal error state
@@ -1394,11 +1394,11 @@ static void nvme_warn_reset(struct nvme_dev *dev, u32 csts)
         result = pci_read_config_word(to_pci_dev(dev->dev), PCI_STATUS,
                                       &pci_status);
         if (result == PCIBIOS_SUCCESSFUL)
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS=0x%hx\n",
                          csts, pci_status);
         else
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS read failed (%d)\n",
                          csts, result);
 }
@@ -1740,8 +1740,8 @@ static int nvme_pci_enable(struct nvme_dev *dev)
          */
         if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
                 dev->q_depth = 2;
-                dev_warn(dev->dev, "detected Apple NVMe controller, set "
-                        "queue depth=%u to work around controller resets\n",
+                dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
+                        "set queue depth=%u to work around controller resets\n",
                         dev->q_depth);
         }
 
@@ -1759,7 +1759,7 @@ static int nvme_pci_enable(struct nvme_dev *dev)
                 if (dev->cmbsz) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
-                                dev_warn(dev->dev,
+                                dev_warn(dev->ctrl.device,
                                          "failed to add sysfs attribute for CMB\n");
                 }
         }
@@ -1805,7 +1805,8 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
         if (pci_is_enabled(pdev)) {
                 u32 csts = readl(dev->bar + NVME_REG_CSTS);
 
-                if (dev->ctrl.state == NVME_CTRL_LIVE)
+                if (dev->ctrl.state == NVME_CTRL_LIVE ||
+                    dev->ctrl.state == NVME_CTRL_RESETTING)
                         nvme_start_freeze(&dev->ctrl);
                 dead = !!((csts & NVME_CSTS_CFS) || !(csts & NVME_CSTS_RDY) ||
                         pdev->error_state  != pci_channel_io_normal);
@@ -1903,7 +1904,7 @@ static void nvme_reset_work(struct work_struct *work)
         bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
         int result = -ENODEV;
 
-        if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
+        if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
                 goto out;
 
         /*
@@ -1913,9 +1914,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                goto out;
-
         result = nvme_pci_enable(dev);
         if (result)
                 goto out;
@@ -2009,8 +2007,8 @@ static int nvme_reset(struct nvme_dev *dev)
 {
         if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                 return -ENODEV;
-        if (work_busy(&dev->reset_work))
-                return -ENODEV;
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+                return -EBUSY;
         if (!queue_work(nvme_workq, &dev->reset_work))
                 return -EBUSY;
         return 0;
@@ -2047,6 +2045,7 @@ static int nvme_pci_reset_ctrl(struct nvme_ctrl *ctrl)
 static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
         .name                   = "pcie",
         .module                 = THIS_MODULE,
+        .flags                  = NVME_F_METADATA_SUPPORTED,
         .reg_read32             = nvme_pci_reg_read32,
         .reg_write32            = nvme_pci_reg_write32,
         .reg_read64             = nvme_pci_reg_read64,
@@ -2135,6 +2134,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto release_pools;
 
+        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         queue_work(nvme_workq, &dev->reset_work);
@@ -2178,6 +2178,7 @@ static void nvme_remove(struct pci_dev *pdev)
 
         nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
 
+        cancel_work_sync(&dev->reset_work);
         pci_set_drvdata(pdev, NULL);
 
         if (!pci_device_is_present(pdev)) {
@@ -2293,6 +2294,8 @@ static const struct pci_device_id nvme_id_table[] = {
         { PCI_VDEVICE(INTEL, 0x0a54),
                 .driver_data = NVME_QUIRK_STRIPE_SIZE |
                                 NVME_QUIRK_DEALLOCATE_ZEROES, },
+        { PCI_VDEVICE(INTEL, 0xf1a5),   /* Intel 600P/P3100 */
+                .driver_data = NVME_QUIRK_NO_DEEPEST_PS },
         { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index dd1c6deef82f..24397d306d53 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -753,28 +753,26 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         if (ret)
                 goto requeue;
 
-        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
-
         ret = nvmf_connect_admin_queue(&ctrl->ctrl);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
 
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         nvme_start_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 ret = nvme_rdma_init_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
 
                 ret = nvme_rdma_connect_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -782,7 +780,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
-                nvme_start_queues(&ctrl->ctrl);
                 nvme_queue_scan(&ctrl->ctrl);
                 nvme_queue_async_events(&ctrl->ctrl);
         }
@@ -791,8 +788,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
 
         return;
 
-stop_admin_q:
-        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
 requeue:
         dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
                         ctrl->ctrl.opts->nr_reconnects);
@@ -823,6 +818,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                 nvme_cancel_request, &ctrl->ctrl);
 
+        /*
+         * queues are not a live anymore, so restart the queues to fail fast
+         * new IO
+         */
+        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
+        nvme_start_queues(&ctrl->ctrl);
+
         nvme_rdma_reconnect_or_remove(ctrl);
 }
 
@@ -1038,6 +1040,19 @@ static void nvme_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
                 nvme_rdma_wr_error(cq, wc, "SEND");
 }
 
+static inline int nvme_rdma_queue_sig_limit(struct nvme_rdma_queue *queue)
+{
+        int sig_limit;
+
+        /*
+         * We signal completion every queue depth/2 and also handle the
+         * degenerated case of a  device with queue_depth=1, where we
+         * would need to signal every message.
+         */
+        sig_limit = max(queue->queue_size / 2, 1);
+        return (++queue->sig_count % sig_limit) == 0;
+}
+
 static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
                 struct nvme_rdma_qe *qe, struct ib_sge *sge, u32 num_sge,
                 struct ib_send_wr *first, bool flush)
@@ -1065,9 +1080,6 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * Would have been way to obvious to handle this in hardware or
          * at least the RDMA stack..
          *
-         * This messy and racy code sniplet is copy and pasted from the iSER
-         * initiator, and the magic '32' comes from there as well.
-         *
          * Always signal the flushes. The magic request used for the flush
          * sequencer is not allocated in our driver's tagset and it's
          * triggered to be freed by blk_cleanup_queue(). So we need to
@@ -1075,7 +1087,7 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * embedded in request's payload, is not freed when __ib_process_cq()
          * calls wr_cqe->done().
          */
-        if ((++queue->sig_count % 32) == 0 || flush)
+        if (nvme_rdma_queue_sig_limit(queue) || flush)
                 wr.send_flags |= IB_SEND_SIGNALED;
 
         if (first)
@@ -1423,7 +1435,7 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
 /*
  * We cannot accept any other command until the Connect command has completed.
  */
-static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+static inline int nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                 struct request *rq)
 {
         if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
@@ -1431,11 +1443,22 @@ static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
 
                 if (!blk_rq_is_passthrough(rq) ||
                     cmd->common.opcode != nvme_fabrics_command ||
-                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
-                        return false;
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect) {
+                        /*
+                         * reconnecting state means transport disruption, which
+                         * can take a long time and even might fail permanently,
+                         * so we can't let incoming I/O be requeued forever.
+                         * fail it fast to allow upper layers a chance to
+                         * failover.
+                         */
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                                return -EIO;
+                        else
+                                return -EAGAIN;
+                }
         }
 
-        return true;
+        return 0;
 }
 
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1453,8 +1476,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         WARN_ON_ONCE(rq->tag < 0);
 
-        if (!nvme_rdma_queue_is_ready(queue, rq))
-                return BLK_MQ_RQ_QUEUE_BUSY;
+        ret = nvme_rdma_queue_is_ready(queue, rq);
+        if (unlikely(ret))
+                goto err;
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
@@ -1782,7 +1806,7 @@ static int nvme_rdma_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
         .name                   = "rdma",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index feb497134aee..e503cfff0337 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -558,7 +558,7 @@ static int nvme_loop_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
         .name                   = "loop",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 28d5f53bc631..cb1c49ae3b88 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1601,6 +1601,7 @@ int of_phandle_iterator_init(struct of_phandle_iterator *it,
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(of_phandle_iterator_init);
 
 int of_phandle_iterator_next(struct of_phandle_iterator *it)
 {
@@ -1670,6 +1671,7 @@ err:
 
         return -EINVAL;
 }
+EXPORT_SYMBOL_GPL(of_phandle_iterator_next);
 
 int of_phandle_iterator_args(struct of_phandle_iterator *it,
                              uint32_t *args,
@@ -2485,6 +2487,41 @@ struct device_node *of_graph_get_endpoint_by_regs(
 EXPORT_SYMBOL(of_graph_get_endpoint_by_regs);
 
 /**
+ * of_graph_get_remote_endpoint() - get remote endpoint node
+ * @node: pointer to a local endpoint device_node
+ *
+ * Return: Remote endpoint node associated with remote endpoint node linked
+ *         to @node. Use of_node_put() on it when done.
+ */
+struct device_node *of_graph_get_remote_endpoint(const struct device_node *node)
+{
+        /* Get remote endpoint node. */
+        return of_parse_phandle(node, "remote-endpoint", 0);
+}
+EXPORT_SYMBOL(of_graph_get_remote_endpoint);
+
+/**
+ * of_graph_get_port_parent() - get port's parent node
+ * @node: pointer to a local endpoint device_node
+ *
+ * Return: device node associated with endpoint node linked
+ *         to @node. Use of_node_put() on it when done.
+ */
+struct device_node *of_graph_get_port_parent(struct device_node *node)
+{
+        unsigned int depth;
+
+        /* Walk 3 levels up only if there is 'ports' node. */
+        for (depth = 3; depth && node; depth--) {
+                node = of_get_next_parent(node);
+                if (depth == 2 && of_node_cmp(node->name, "ports"))
+                        break;
+        }
+        return node;
+}
+EXPORT_SYMBOL(of_graph_get_port_parent);
+
+/**
  * of_graph_get_remote_port_parent() - get remote port's parent node
  * @node: pointer to a local endpoint device_node
  *
@@ -2495,18 +2532,11 @@ struct device_node *of_graph_get_remote_port_parent(
                                const struct device_node *node)
 {
         struct device_node *np;
-        unsigned int depth;
 
         /* Get remote endpoint node. */
-        np = of_parse_phandle(node, "remote-endpoint", 0);
+        np = of_graph_get_remote_endpoint(node);
 
-        /* Walk 3 levels up only if there is 'ports' node. */
-        for (depth = 3; depth && np; depth--) {
-                np = of_get_next_parent(np);
-                if (depth == 2 && of_node_cmp(np->name, "ports"))
-                        break;
-        }
-        return np;
+        return of_graph_get_port_parent(np);
 }
 EXPORT_SYMBOL(of_graph_get_remote_port_parent);
 
@@ -2522,13 +2552,25 @@ struct device_node *of_graph_get_remote_port(const struct device_node *node)
         struct device_node *np;
 
         /* Get remote endpoint node. */
-        np = of_parse_phandle(node, "remote-endpoint", 0);
+        np = of_graph_get_remote_endpoint(node);
         if (!np)
                 return NULL;
         return of_get_next_parent(np);
 }
 EXPORT_SYMBOL(of_graph_get_remote_port);
 
+int of_graph_get_endpoint_count(const struct device_node *np)
+{
+        struct device_node *endpoint;
+        int num = 0;
+
+        for_each_endpoint_of_node(np, endpoint)
+                num++;
+
+        return num;
+}
+EXPORT_SYMBOL(of_graph_get_endpoint_count);
+
 /**
  * of_graph_get_remote_node() - get remote parent device_node for given port/endpoint
  * @node: pointer to parent device_node containing graph port/endpoint
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 9416d052cb89..28c38c756f92 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -144,8 +144,8 @@ int of_dma_configure(struct device *dev, struct device_node *np)
                 coherent ? " " : " not ");
 
         iommu = of_iommu_configure(dev, np);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         dev_dbg(dev, "device is%sbehind an iommu\n",
                 iommu ? " " : " not ");
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 71fecc2debfc..703a42118ffc 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -523,7 +523,7 @@ static int __init of_platform_default_populate_init(void)
 arch_initcall_sync(of_platform_default_populate_init);
 #endif
 
-static int of_platform_device_destroy(struct device *dev, void *data)
+int of_platform_device_destroy(struct device *dev, void *data)
 {
         /* Do not touch devices not populated from the device tree */
         if (!dev->of_node || !of_node_check_flag(dev->of_node, OF_POPULATED))
@@ -544,6 +544,7 @@ static int of_platform_device_destroy(struct device *dev, void *data)
         of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
         return 0;
 }
+EXPORT_SYMBOL_GPL(of_platform_device_destroy);
 
 /**
  * of_platform_depopulate() - Remove devices populated from device tree
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index 74cf5fffb1e1..c80e37a69305 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -896,7 +896,7 @@ int pci_read_config_byte(const struct pci_dev *dev, int where, u8 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_byte(dev->bus, dev->devfn, where, val);
 }
@@ -906,7 +906,7 @@ int pci_read_config_word(const struct pci_dev *dev, int where, u16 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_word(dev->bus, dev->devfn, where, val);
 }
@@ -917,7 +917,7 @@ int pci_read_config_dword(const struct pci_dev *dev, int where,
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_dword(dev->bus, dev->devfn, where, val);
 }
@@ -926,7 +926,7 @@ EXPORT_SYMBOL(pci_read_config_dword);
 int pci_write_config_byte(const struct pci_dev *dev, int where, u8 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_byte(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_byte);
@@ -934,7 +934,7 @@ EXPORT_SYMBOL(pci_write_config_byte);
 int pci_write_config_word(const struct pci_dev *dev, int where, u16 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_word(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_word);
@@ -943,7 +943,7 @@ int pci_write_config_dword(const struct pci_dev *dev, int where,
                                          u32 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_dword(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_dword);
diff --git a/drivers/pci/dwc/pci-imx6.c b/drivers/pci/dwc/pci-imx6.c
index a98cba55c7f0..19a289b8cc94 100644
--- a/drivers/pci/dwc/pci-imx6.c
+++ b/drivers/pci/dwc/pci-imx6.c
@@ -252,7 +252,34 @@ static void imx6_pcie_reset_phy(struct imx6_pcie *imx6_pcie)
 static int imx6q_pcie_abort_handler(unsigned long addr,
                 unsigned int fsr, struct pt_regs *regs)
 {
-        return 0;
+        unsigned long pc = instruction_pointer(regs);
+        unsigned long instr = *(unsigned long *)pc;
+        int reg = (instr >> 12) & 15;
+
+        /*
+         * If the instruction being executed was a read,
+         * make it look like it read all-ones.
+         */
+        if ((instr & 0x0c100000) == 0x04100000) {
+                unsigned long val;
+
+                if (instr & 0x00400000)
+                        val = 255;
+                else
+                        val = -1;
+
+                regs->uregs[reg] = val;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        if ((instr & 0x0e100090) == 0x00100090) {
+                regs->uregs[reg] = -1;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        return 1;
 }
 
 static void imx6_pcie_assert_core_reset(struct imx6_pcie *imx6_pcie)
@@ -819,8 +846,8 @@ static int __init imx6_pcie_init(void)
          * we can install the handler here without risking it
          * accessing some uninitialized driver state.
          */
-        hook_fault_code(16 + 6, imx6q_pcie_abort_handler, SIGBUS, 0,
-                        "imprecise external abort");
+        hook_fault_code(8, imx6q_pcie_abort_handler, SIGBUS, 0,
+                        "external abort on non-linefetch");
 
         return platform_driver_register(&imx6_pcie_driver);
 }
diff --git a/drivers/pci/endpoint/Kconfig b/drivers/pci/endpoint/Kconfig
index c23f146fb5a6..c09623ca8c3b 100644
--- a/drivers/pci/endpoint/Kconfig
+++ b/drivers/pci/endpoint/Kconfig
@@ -6,6 +6,7 @@ menu "PCI Endpoint"
 
 config PCI_ENDPOINT
         bool "PCI Endpoint Support"
+        depends on HAS_DMA
         help
            Enable this configuration option to support configurable PCI
            endpoint. This should be enabled if the platform has a PCI
diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
index 175edad42d2f..2942066607e0 100644
--- a/drivers/pci/endpoint/functions/Kconfig
+++ b/drivers/pci/endpoint/functions/Kconfig
@@ -5,6 +5,7 @@
 config PCI_EPF_TEST
         tristate "PCI Endpoint Test driver"
         depends on PCI_ENDPOINT
+        select CRC32
         help
            Enable this configuration option to enable the test driver
            for PCI Endpoint.
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b01bd5bba8e6..563901cd9c06 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2144,7 +2144,8 @@ bool pci_dev_keep_suspended(struct pci_dev *pci_dev)
 
         if (!pm_runtime_suspended(dev)
             || pci_target_state(pci_dev) != pci_dev->current_state
-            || platform_pci_need_resume(pci_dev))
+            || platform_pci_need_resume(pci_dev)
+            || (pci_dev->dev_flags & PCI_DEV_FLAGS_NEEDS_RESUME))
                 return false;
 
         /*
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index cc6e085008fb..f6a63406c76e 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1291,7 +1291,6 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
         cdev = &stdev->cdev;
         cdev_init(cdev, &switchtec_fops);
         cdev->owner = THIS_MODULE;
-        cdev->kobj.parent = &dev->kobj;
 
         return stdev;
 
@@ -1442,12 +1441,15 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
         stdev->mmio_sys_info = stdev->mmio + SWITCHTEC_GAS_SYS_INFO_OFFSET;
         stdev->mmio_flash_info = stdev->mmio + SWITCHTEC_GAS_FLASH_INFO_OFFSET;
         stdev->mmio_ntb = stdev->mmio + SWITCHTEC_GAS_NTB_OFFSET;
-        stdev->partition = ioread8(&stdev->mmio_ntb->partition_id);
+        stdev->partition = ioread8(&stdev->mmio_sys_info->partition_id);
         stdev->partition_count = ioread8(&stdev->mmio_ntb->partition_count);
         stdev->mmio_part_cfg_all = stdev->mmio + SWITCHTEC_GAS_PART_CFG_OFFSET;
         stdev->mmio_part_cfg = &stdev->mmio_part_cfg_all[stdev->partition];
         stdev->mmio_pff_csr = stdev->mmio + SWITCHTEC_GAS_PFF_CSR_OFFSET;
 
+        if (stdev->partition_count < 1)
+                stdev->partition_count = 1;
+
         init_pff(stdev);
 
         pci_set_drvdata(pdev, stdev);
@@ -1479,11 +1481,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
                   SWITCHTEC_EVENT_EN_IRQ,
                   &stdev->mmio_part_cfg->mrpc_comp_hdr);
 
-        rc = cdev_add(&stdev->cdev, stdev->dev.devt, 1);
-        if (rc)
-                goto err_put;
-
-        rc = device_add(&stdev->dev);
+        rc = cdev_device_add(&stdev->cdev, &stdev->dev);
         if (rc)
                 goto err_devadd;
 
@@ -1492,7 +1490,6 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
         return 0;
 
 err_devadd:
-        cdev_del(&stdev->cdev);
         stdev_kill(stdev);
 err_put:
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
@@ -1506,8 +1503,7 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
 
         pci_set_drvdata(pdev, NULL);
 
-        device_del(&stdev->dev);
-        cdev_del(&stdev->cdev);
+        cdev_device_del(&stdev->cdev, &stdev->dev);
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
         dev_info(&stdev->dev, "unregistered.\n");
 
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 34c862f213c7..0a9b78705ee8 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -29,6 +29,17 @@ static int arm_pmu_acpi_register_irq(int cpu)
                 return -EINVAL;
 
         gsi = gicc->performance_interrupt;
+
+        /*
+         * Per the ACPI spec, the MADT cannot describe a PMU that doesn't
+         * have an interrupt. QEMU advertises this by using a GSI of zero,
+         * which is not known to be valid on any hardware despite being
+         * valid per the spec. Take the pragmatic approach and reject a
+         * GSI of zero for now.
+         */
+        if (!gsi)
+                return 0;
+
         if (gicc->flags & ACPI_MADT_PERFORMANCE_IRQ_MODE)
                 trigger = ACPI_EDGE_SENSITIVE;
         else
diff --git a/drivers/phy/phy-qcom-qmp.c b/drivers/phy/phy-qcom-qmp.c
index 727e23be7cac..78ca62897784 100644
--- a/drivers/phy/phy-qcom-qmp.c
+++ b/drivers/phy/phy-qcom-qmp.c
@@ -844,7 +844,7 @@ static int qcom_qmp_phy_vreg_init(struct device *dev)
         int num = qmp->cfg->num_vregs;
         int i;
 
-        qmp->vregs = devm_kcalloc(dev, num, sizeof(qmp->vregs), GFP_KERNEL);
+        qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
         if (!qmp->vregs)
                 return -ENOMEM;
 
@@ -983,16 +983,16 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
          * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
          */
         qphy->tx = of_iomap(np, 0);
-        if (IS_ERR(qphy->tx))
-                return PTR_ERR(qphy->tx);
+        if (!qphy->tx)
+                return -ENOMEM;
 
         qphy->rx = of_iomap(np, 1);
-        if (IS_ERR(qphy->rx))
-                return PTR_ERR(qphy->rx);
+        if (!qphy->rx)
+                return -ENOMEM;
 
         qphy->pcs = of_iomap(np, 2);
-        if (IS_ERR(qphy->pcs))
-                return PTR_ERR(qphy->pcs);
+        if (!qphy->pcs)
+                return -ENOMEM;
 
         /*
          * Get PHY's Pipe clock, if any. USB3 and PCIe are PIPE3
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 1653cbda6a82..bd459a93b0e7 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -680,30 +680,16 @@ EXPORT_SYMBOL_GPL(pinctrl_generic_remove_group);
  * pinctrl_generic_free_groups() - removes all pin groups
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl groups
+ * are allocated with devm_kzalloc() so no need to free them here.
  */
 static void pinctrl_generic_free_groups(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct group_desc *group;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_groups, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_group_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_groups; i++) {
-                group = radix_tree_lookup(&pctldev->pin_group_tree,
-                                          indices[i]);
-                radix_tree_delete(&pctldev->pin_group_tree, indices[i]);
-                devm_kfree(pctldev->dev, group);
-        }
+                radix_tree_delete(&pctldev->pin_group_tree, iter.index);
 
         pctldev->num_groups = 0;
 }
diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c
index 41b5b07d5a2b..6852010a6d70 100644
--- a/drivers/pinctrl/freescale/pinctrl-mxs.c
+++ b/drivers/pinctrl/freescale/pinctrl-mxs.c
@@ -194,6 +194,16 @@ static int mxs_pinctrl_get_func_groups(struct pinctrl_dev *pctldev,
         return 0;
 }
 
+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
+{
+        u32 tmp;
+
+        tmp = readl(reg);
+        tmp &= ~(mask << shift);
+        tmp |= value << shift;
+        writel(tmp, reg);
+}
+
 static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                                unsigned group)
 {
@@ -211,8 +221,7 @@ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                 reg += bank * 0x20 + pin / 16 * 0x10;
                 shift = pin % 16 * 2;
 
-                writel(0x3 << shift, reg + CLR);
-                writel(g->muxsel[i] << shift, reg + SET);
+                mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
         }
 
         return 0;
@@ -279,8 +288,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
                         /* mA */
                         if (config & MA_PRESENT) {
                                 shift = pin % 8 * 4;
-                                writel(0x3 << shift, reg + CLR);
-                                writel(ma << shift, reg + SET);
+                                mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
                         }
 
                         /* vol */
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 2debba62fac9..20f1b4493994 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,15 +1539,29 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
  * is not listed below.
  */
 static const struct dmi_system_id chv_no_valid_mask[] = {
+        /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
         {
-                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
-                .ident = "Acer Chromebook (CYAN)",
+                .ident = "Intel_Strago based Chromebooks (All models)",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
-                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
                 },
-        }
+        },
+        {
+                .ident = "Acer Chromebook R11 (Cyan)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+                },
+        },
+        {
+                .ident = "Samsung Chromebook 3 (Celes)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+                },
+        },
+        {}
 };
 
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c
index 0d6b7f4b82af..720a19fd38d2 100644
--- a/drivers/pinctrl/pinconf-generic.c
+++ b/drivers/pinctrl/pinconf-generic.c
@@ -35,7 +35,6 @@ static const struct pin_config_item conf_items[] = {
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
                                 "input bias pull to pin specific state", NULL, false),
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false),
-        PCONFDUMP(PIN_CONFIG_BIDIRECTIONAL, "bi-directional pin operations", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false),
@@ -161,7 +160,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "bias-pull-up", PIN_CONFIG_BIAS_PULL_UP, 1 },
         { "bias-pull-pin-default", PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, 1 },
         { "bias-pull-down", PIN_CONFIG_BIAS_PULL_DOWN, 1 },
-        { "bi-directional", PIN_CONFIG_BIDIRECTIONAL, 1 },
         { "drive-open-drain", PIN_CONFIG_DRIVE_OPEN_DRAIN, 0 },
         { "drive-open-source", PIN_CONFIG_DRIVE_OPEN_SOURCE, 0 },
         { "drive-push-pull", PIN_CONFIG_DRIVE_PUSH_PULL, 0 },
@@ -174,7 +172,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "input-schmitt-enable", PIN_CONFIG_INPUT_SCHMITT_ENABLE, 1 },
         { "low-power-disable", PIN_CONFIG_LOW_POWER_MODE, 0 },
         { "low-power-enable", PIN_CONFIG_LOW_POWER_MODE, 1 },
-        { "output-enable", PIN_CONFIG_OUTPUT, 1, },
         { "output-high", PIN_CONFIG_OUTPUT, 1, },
         { "output-low", PIN_CONFIG_OUTPUT, 0, },
         { "power-source", PIN_CONFIG_POWER_SOURCE, 0 },
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 1482d132fbb8..e432ec887479 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -495,64 +495,54 @@ static struct irq_chip amd_gpio_irqchip = {
         .flags        = IRQCHIP_SKIP_SET_WAKE,
 };
 
-static void amd_gpio_irq_handler(struct irq_desc *desc)
+#define PIN_IRQ_PENDING (BIT(INTERRUPT_STS_OFF) | BIT(WAKE_STS_OFF))
+
+static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
 {
-        u32 i;
-        u32 off;
-        u32 reg;
-        u32 pin_reg;
-        u64 reg64;
-        int handled = 0;
-        unsigned int irq;
+        struct amd_gpio *gpio_dev = dev_id;
+        struct gpio_chip *gc = &gpio_dev->gc;
+        irqreturn_t ret = IRQ_NONE;
+        unsigned int i, irqnr;
         unsigned long flags;
-        struct irq_chip *chip = irq_desc_get_chip(desc);
-        struct gpio_chip *gc = irq_desc_get_handler_data(desc);
-        struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
+        u32 *regs, regval;
+        u64 status, mask;
 
-        chained_irq_enter(chip, desc);
-        /*enable GPIO interrupt again*/
+        /* Read the wake status */
         raw_spin_lock_irqsave(&gpio_dev->lock, flags);
-        reg = readl(gpio_dev->base + WAKE_INT_STATUS_REG1);
-        reg64 = reg;
-        reg64 = reg64 << 32;
-
-        reg = readl(gpio_dev->base + WAKE_INT_STATUS_REG0);
-        reg64 |= reg;
+        status = readl(gpio_dev->base + WAKE_INT_STATUS_REG1);
+        status <<= 32;
+        status |= readl(gpio_dev->base + WAKE_INT_STATUS_REG0);
         raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
 
-        /*
-         * first 46 bits indicates interrupt status.
-         * one bit represents four interrupt sources.
-        */
-        for (off = 0; off < 46 ; off++) {
-                if (reg64 & BIT(off)) {
-                        for (i = 0; i < 4; i++) {
-                                pin_reg = readl(gpio_dev->base +
-                                                (off * 4 + i) * 4);
-                                if ((pin_reg & BIT(INTERRUPT_STS_OFF)) ||
-                                        (pin_reg & BIT(WAKE_STS_OFF))) {
-                                        irq = irq_find_mapping(gc->irqdomain,
-                                                                off * 4 + i);
-                                        generic_handle_irq(irq);
-                                        writel(pin_reg,
-                                                gpio_dev->base
-                                                + (off * 4 + i) * 4);
-                                        handled++;
-                                }
-                        }
+        /* Bit 0-45 contain the relevant status bits */
+        status &= (1ULL << 46) - 1;
+        regs = gpio_dev->base;
+        for (mask = 1, irqnr = 0; status; mask <<= 1, regs += 4, irqnr += 4) {
+                if (!(status & mask))
+                        continue;
+                status &= ~mask;
+
+                /* Each status bit covers four pins */
+                for (i = 0; i < 4; i++) {
+                        regval = readl(regs + i);
+                        if (!(regval & PIN_IRQ_PENDING))
+                                continue;
+                        irq = irq_find_mapping(gc->irqdomain, irqnr + i);
+                        generic_handle_irq(irq);
+                        /* Clear interrupt */
+                        writel(regval, regs + i);
+                        ret = IRQ_HANDLED;
                 }
         }
 
-        if (handled == 0)
-                handle_bad_irq(desc);
-
+        /* Signal EOI to the GPIO unit */
         raw_spin_lock_irqsave(&gpio_dev->lock, flags);
-        reg = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
-        reg |= EOI_MASK;
-        writel(reg, gpio_dev->base + WAKE_INT_MASTER_REG);
+        regval = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
+        regval |= EOI_MASK;
+        writel(regval, gpio_dev->base + WAKE_INT_MASTER_REG);
         raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
 
-        chained_irq_exit(chip, desc);
+        return ret;
 }
 
 static int amd_get_groups_count(struct pinctrl_dev *pctldev)
@@ -821,10 +811,11 @@ static int amd_gpio_probe(struct platform_device *pdev)
                 goto out2;
         }
 
-        gpiochip_set_chained_irqchip(&gpio_dev->gc,
-                                 &amd_gpio_irqchip,
-                                 irq_base,
-                                 amd_gpio_irq_handler);
+        ret = devm_request_irq(&pdev->dev, irq_base, amd_gpio_irq_handler, 0,
+                               KBUILD_MODNAME, gpio_dev);
+        if (ret)
+                goto out2;
+
         platform_set_drvdata(pdev, gpio_dev);
 
         dev_dbg(&pdev->dev, "amd gpio driver loaded\n");
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index f141aa0430b1..9dd981ddbb17 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -143,9 +143,6 @@ struct rockchip_drv {
  * @gpio_chip: gpiolib chip
  * @grange: gpio range
  * @slock: spinlock for the gpio bank
- * @irq_lock: bus lock for irq chip
- * @new_irqs: newly configured irqs which must be muxed as GPIOs in
- *      irq_bus_sync_unlock()
  */
 struct rockchip_pin_bank {
         void __iomem                    *reg_base;
@@ -168,8 +165,6 @@ struct rockchip_pin_bank {
         struct pinctrl_gpio_range       grange;
         raw_spinlock_t                  slock;
         u32                             toggle_edge_mode;
-        struct mutex                    irq_lock;
-        u32                             new_irqs;
 };
 
 #define PIN_BANK(id, pins, label)                       \
@@ -2134,12 +2129,11 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
         int ret;
 
         /* make sure the pin is configured as gpio input */
-        ret = rockchip_verify_mux(bank, d->hwirq, RK_FUNC_GPIO);
+        ret = rockchip_set_mux(bank, d->hwirq, RK_FUNC_GPIO);
         if (ret < 0)
                 return ret;
 
-        bank->new_irqs |= mask;
-
+        clk_enable(bank->clk);
         raw_spin_lock_irqsave(&bank->slock, flags);
 
         data = readl_relaxed(bank->reg_base + GPIO_SWPORT_DDR);
@@ -2197,6 +2191,7 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
         default:
                 irq_gc_unlock(gc);
                 raw_spin_unlock_irqrestore(&bank->slock, flags);
+                clk_disable(bank->clk);
                 return -EINVAL;
         }
 
@@ -2205,6 +2200,7 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
 
         irq_gc_unlock(gc);
         raw_spin_unlock_irqrestore(&bank->slock, flags);
+        clk_disable(bank->clk);
 
         return 0;
 }
@@ -2248,34 +2244,6 @@ static void rockchip_irq_disable(struct irq_data *d)
         clk_disable(bank->clk);
 }
 
-static void rockchip_irq_bus_lock(struct irq_data *d)
-{
-        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
-        struct rockchip_pin_bank *bank = gc->private;
-
-        clk_enable(bank->clk);
-        mutex_lock(&bank->irq_lock);
-}
-
-static void rockchip_irq_bus_sync_unlock(struct irq_data *d)
-{
-        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
-        struct rockchip_pin_bank *bank = gc->private;
-
-        while (bank->new_irqs) {
-                unsigned int irq = __ffs(bank->new_irqs);
-                int ret;
-
-                ret = rockchip_set_mux(bank, irq, RK_FUNC_GPIO);
-                WARN_ON(ret < 0);
-
-                bank->new_irqs &= ~BIT(irq);
-        }
-
-        mutex_unlock(&bank->irq_lock);
-        clk_disable(bank->clk);
-}
-
 static int rockchip_interrupts_register(struct platform_device *pdev,
                                                 struct rockchip_pinctrl *info)
 {
@@ -2342,9 +2310,6 @@ static int rockchip_interrupts_register(struct platform_device *pdev,
                 gc->chip_types[0].chip.irq_suspend = rockchip_irq_suspend;
                 gc->chip_types[0].chip.irq_resume = rockchip_irq_resume;
                 gc->chip_types[0].chip.irq_set_type = rockchip_irq_set_type;
-                gc->chip_types[0].chip.irq_bus_lock = rockchip_irq_bus_lock;
-                gc->chip_types[0].chip.irq_bus_sync_unlock =
-                                                rockchip_irq_bus_sync_unlock;
                 gc->wake_enabled = IRQ_MSK(bank->nr_pins);
 
                 irq_set_chained_handler_and_data(bank->irq,
@@ -2518,7 +2483,6 @@ static struct rockchip_pin_ctrl *rockchip_pinctrl_get_soc_data(
                 int bank_pins = 0;
 
                 raw_spin_lock_init(&bank->slock);
-                mutex_init(&bank->irq_lock);
                 bank->drvdata = d;
                 bank->pin_base = ctrl->nr_pins;
                 ctrl->nr_pins += bank->nr_pins;
diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
index 9fd6d9087dc5..16b3ae5e4f44 100644
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -826,30 +826,17 @@ EXPORT_SYMBOL_GPL(pinmux_generic_remove_function);
  * pinmux_generic_free_functions() - removes all functions
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl
+ * functions are allocated with devm_kzalloc() so no need to free
+ * them here.
  */
 void pinmux_generic_free_functions(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct function_desc *function;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_functions, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_function_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_functions; i++) {
-                function = radix_tree_lookup(&pctldev->pin_function_tree,
-                                             indices[i]);
-                radix_tree_delete(&pctldev->pin_function_tree, indices[i]);
-                devm_kfree(pctldev->dev, function);
-        }
+                radix_tree_delete(&pctldev->pin_function_tree, iter.index);
 
         pctldev->num_functions = 0;
 }
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index d3c5f5dfbbd7..222b6685b09f 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -798,7 +798,7 @@ static int stm32_pconf_parse_conf(struct pinctrl_dev *pctldev,
                 break;
         case PIN_CONFIG_OUTPUT:
                 __stm32_gpio_set(bank, offset, arg);
-                ret = stm32_pmx_gpio_set_direction(pctldev, NULL, pin, false);
+                ret = stm32_pmx_gpio_set_direction(pctldev, range, pin, false);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
index 9aec1d2232dd..6624499eae72 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x3, "owa")),          /* DOUT */
+                  SUNXI_FUNCTION(0x3, "spdif")),        /* DOUT */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out")),
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 2de1e603bd2b..5f3672153b12 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -704,7 +704,7 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
                 /* Reallocate the array */
                 u32 new_capacity = 2 * dev->pipes_capacity;
                 struct goldfish_pipe **pipes =
-                        kcalloc(new_capacity, sizeof(*pipes), GFP_KERNEL);
+                        kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
                 if (!pipes)
                         return -ENOMEM;
                 memcpy(pipes, dev->pipes, sizeof(*pipes) * dev->pipes_capacity);
diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
index ef29f18b1951..4cc2f4ea0a25 100644
--- a/drivers/platform/x86/intel_telemetry_debugfs.c
+++ b/drivers/platform/x86/intel_telemetry_debugfs.c
@@ -97,11 +97,9 @@
         } \
 }
 
-#ifdef CONFIG_PM_SLEEP
 static u8 suspend_prep_ok;
 static u32 suspend_shlw_ctr_temp, suspend_deep_ctr_temp;
 static u64 suspend_shlw_res_temp, suspend_deep_res_temp;
-#endif
 
 struct telemetry_susp_stats {
         u32 shlw_swake_ctr;
@@ -807,7 +805,6 @@ static const struct file_operations telem_ioss_trc_verb_ops = {
         .release        = single_release,
 };
 
-#ifdef CONFIG_PM_SLEEP
 static int pm_suspend_prep_cb(void)
 {
         struct telemetry_evtlog evtlog[TELEM_MAX_OS_ALLOCATED_EVENTS];
@@ -937,7 +934,6 @@ static int pm_notification(struct notifier_block *this,
 static struct notifier_block pm_notifier = {
         .notifier_call = pm_notification,
 };
-#endif /* CONFIG_PM_SLEEP */
 
 static int __init telemetry_debugfs_init(void)
 {
@@ -960,14 +956,13 @@ static int __init telemetry_debugfs_init(void)
         if (err < 0)
                 return -EINVAL;
 
-
-#ifdef CONFIG_PM_SLEEP
         register_pm_notifier(&pm_notifier);
-#endif /* CONFIG_PM_SLEEP */
 
         debugfs_conf->telemetry_dbg_dir = debugfs_create_dir("telemetry", NULL);
-        if (!debugfs_conf->telemetry_dbg_dir)
-                return -ENOMEM;
+        if (!debugfs_conf->telemetry_dbg_dir) {
+                err = -ENOMEM;
+                goto out_pm;
+        }
 
         f = debugfs_create_file("pss_info", S_IFREG | S_IRUGO,
                                 debugfs_conf->telemetry_dbg_dir, NULL,
@@ -1014,6 +1009,8 @@ static int __init telemetry_debugfs_init(void)
 out:
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+out_pm:
+        unregister_pm_notifier(&pm_notifier);
 
         return err;
 }
@@ -1022,6 +1019,7 @@ static void __exit telemetry_debugfs_exit(void)
 {
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+        unregister_pm_notifier(&pm_notifier);
 }
 
 late_initcall(telemetry_debugfs_init);
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 14bde0db8c24..5b10b50f8686 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone(
 
         power_zone->id = result;
         idr_init(&power_zone->idr);
+        result = -ENOMEM;
         power_zone->name = kstrdup(name, GFP_KERNEL);
         if (!power_zone->name)
                 goto err_name_alloc;
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 35ce53edabf9..d5e5229308f2 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void)
 }
 
 postcore_initcall(hi6220_reset_init);
+
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b3de973a6260..9dca53df3584 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -1088,7 +1088,7 @@ static u32 rtc_handler(void *context)
         }
         spin_unlock_irqrestore(&rtc_lock, flags);
 
-        pm_wakeup_event(dev, 0);
+        pm_wakeup_hard_event(dev);
         acpi_clear_event(ACPI_EVENT_RTC);
         acpi_disable_event(ACPI_EVENT_RTC, 0);
         return ACPI_INTERRUPT_HANDLED;
diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index e72abbc18ee3..a66a317f3e4f 100644
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -70,14 +70,14 @@ static ssize_t name_show(struct kobject *kobj, struct device *dev, char *buf)
 {
         return sprintf(buf, "I/O subchannel (Non-QDIO)\n");
 }
-MDEV_TYPE_ATTR_RO(name);
+static MDEV_TYPE_ATTR_RO(name);
 
 static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
                                char *buf)
 {
         return sprintf(buf, "%s\n", VFIO_DEVICE_API_CCW_STRING);
 }
-MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(device_api);
 
 static ssize_t available_instances_show(struct kobject *kobj,
                                         struct device *dev, char *buf)
@@ -86,7 +86,7 @@ static ssize_t available_instances_show(struct kobject *kobj,
 
         return sprintf(buf, "%d\n", atomic_read(&private->avail));
 }
-MDEV_TYPE_ATTR_RO(available_instances);
+static MDEV_TYPE_ATTR_RO(available_instances);
 
 static struct attribute *mdev_types_attrs[] = {
         &mdev_type_attr_name.attr,
@@ -100,7 +100,7 @@ static struct attribute_group mdev_type_group = {
         .attrs = mdev_types_attrs,
 };
 
-struct attribute_group *mdev_type_groups[] = {
+static struct attribute_group *mdev_type_groups[] = {
         &mdev_type_group,
         NULL,
 };
@@ -152,7 +152,7 @@ static int vfio_ccw_mdev_open(struct mdev_device *mdev)
                                       &events, &private->nb);
 }
 
-void vfio_ccw_mdev_release(struct mdev_device *mdev)
+static void vfio_ccw_mdev_release(struct mdev_device *mdev)
 {
         struct vfio_ccw_private *private =
                 dev_get_drvdata(mdev_parent_dev(mdev));
@@ -233,7 +233,7 @@ static int vfio_ccw_mdev_get_region_info(struct vfio_region_info *info,
         }
 }
 
-int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
+static int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
 {
         if (info->index != VFIO_CCW_IO_IRQ_INDEX)
                 return -EINVAL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9be4596d8a08..ea099910b4e9 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -668,10 +668,28 @@ static int ap_device_probe(struct device *dev)
         struct ap_driver *ap_drv = to_ap_drv(dev->driver);
         int rc;
 
+        /* Add queue/card to list of active queues/cards */
+        spin_lock_bh(&ap_list_lock);
+        if (is_card_dev(dev))
+                list_add(&to_ap_card(dev)->list, &ap_card_list);
+        else
+                list_add(&to_ap_queue(dev)->list,
+                         &to_ap_queue(dev)->card->queues);
+        spin_unlock_bh(&ap_list_lock);
+
         ap_dev->drv = ap_drv;
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (rc)
+
+        if (rc) {
+                spin_lock_bh(&ap_list_lock);
+                if (is_card_dev(dev))
+                        list_del_init(&to_ap_card(dev)->list);
+                else
+                        list_del_init(&to_ap_queue(dev)->list);
+                spin_unlock_bh(&ap_list_lock);
                 ap_dev->drv = NULL;
+        }
+
         return rc;
 }
 
@@ -680,14 +698,17 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
+
+        /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
                 list_del_init(&to_ap_card(dev)->list);
         else
                 list_del_init(&to_ap_queue(dev)->list);
         spin_unlock_bh(&ap_list_lock);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
+
         return 0;
 }
 
@@ -1056,10 +1077,6 @@ static void ap_scan_bus(struct work_struct *unused)
                                 }
                                 /* get it and thus adjust reference counter */
                                 get_device(&ac->ap_dev.device);
-                                /* Add card device to card list */
-                                spin_lock_bh(&ap_list_lock);
-                                list_add(&ac->list, &ap_card_list);
-                                spin_unlock_bh(&ap_list_lock);
                         }
                         /* now create the new queue device */
                         aq = ap_queue_create(qid, type);
@@ -1070,10 +1087,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Add queue device to card queue list */
-                        spin_lock_bh(&ap_list_lock);
-                        list_add(&aq->list, &ac->queues);
-                        spin_unlock_bh(&ap_list_lock);
                         /* Start with a device reset */
                         spin_lock_bh(&aq->lock);
                         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
@@ -1081,9 +1094,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
-                                spin_lock_bh(&ap_list_lock);
-                                list_del_init(&aq->list);
-                                spin_unlock_bh(&ap_list_lock);
                                 put_device(&aq->ap_dev.device);
                                 continue;
                         }
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index cfa161ccc74e..836efac96813 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -160,7 +160,14 @@ static struct device_type ap_card_type = {
 
 static void ap_card_device_release(struct device *dev)
 {
-        kfree(to_ap_card(dev));
+        struct ap_card *ac = to_ap_card(dev);
+
+        if (!list_empty(&ac->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&ac->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(ac);
 }
 
 struct ap_card *ap_card_create(int id, int queue_depth, int device_type,
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 480c58a63769..0f1a5d02acb0 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -584,7 +584,14 @@ static struct device_type ap_queue_type = {
 
 static void ap_queue_device_release(struct device *dev)
 {
-        kfree(to_ap_queue(dev));
+        struct ap_queue *aq = to_ap_queue(dev);
+
+        if (!list_empty(&aq->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&aq->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(aq);
 }
 
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index dba94b486f05..fa732bd86729 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -1954,7 +1954,6 @@ static void netiucv_free_netdevice(struct net_device *dev)
                 privptr->conn = NULL; privptr->fsm = NULL;
                 /* privptr gets freed by free_netdev() */
         }
-        free_netdev(dev);
 }
 
 /**
@@ -1972,7 +1971,8 @@ static void netiucv_setup_netdevice(struct net_device *dev)
         dev->mtu                 = NETIUCV_MTU_DEFAULT;
         dev->min_mtu             = 576;
         dev->max_mtu             = NETIUCV_MTU_MAX;
-        dev->destructor          = netiucv_free_netdevice;
+        dev->needs_free_netdev   = true;
+        dev->priv_destructor     = netiucv_free_netdevice;
         dev->hard_header_len     = NETIUCV_HDRLEN;
         dev->addr_len            = 0;
         dev->type                = ARPHRD_SLIP;
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 4fc8ed5fe067..1f424e40afdf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -191,6 +191,7 @@ struct bnx2fc_hba {
         struct bnx2fc_cmd_mgr *cmd_mgr;
         spinlock_t hba_lock;
         struct mutex hba_mutex;
+        struct mutex hba_stats_mutex;
         unsigned long adapter_state;
                 #define ADAPTER_STATE_UP                0
                 #define ADAPTER_STATE_GOING_DOWN        1
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 93b5a0012417..902722dc4ce3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -663,15 +663,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
         if (!fw_stats)
                 return NULL;
 
+        mutex_lock(&hba->hba_stats_mutex);
+
         bnx2fc_stats = fc_get_host_stats(shost);
 
         init_completion(&hba->stat_req_done);
         if (bnx2fc_send_stat_req(hba))
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
         if (!rc) {
                 BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         }
         BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
         bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
@@ -693,6 +695,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
 
         memcpy(&hba->prev_stats, hba->stats_buffer,
                sizeof(struct fcoe_statistics_params));
+
+unlock_stats_mutex:
+        mutex_unlock(&hba->hba_stats_mutex);
         return bnx2fc_stats;
 }
 
@@ -1340,6 +1345,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
         }
         spin_lock_init(&hba->hba_lock);
         mutex_init(&hba->hba_mutex);
+        mutex_init(&hba->hba_stats_mutex);
 
         hba->cnic = cnic;
 
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 622bdabc8894..dab195f04da7 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
                 goto bye;
         }
 
-        mempool_free(mbp, hw->mb_mempool);
         if (finicsum != cfcsum) {
                 csio_warn(hw,
                       "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
         rv = csio_hw_validate_caps(hw, mbp);
         if (rv != 0)
                 goto bye;
+
+        mempool_free(mbp, hw->mb_mempool);
+        mbp = NULL;
+
         /*
          * Note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 1076c1578322..0aae094ab91c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1595,7 +1595,6 @@ static void release_offload_resources(struct cxgbi_sock *csk)
                 cxgbi_sock_put(csk);
         }
         csk->dst = NULL;
-        csk->cdev = NULL;
 }
 
 static int init_act_open(struct cxgbi_sock *csk)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index bd7d39ecbd24..e4c83b7c96a8 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -867,7 +867,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         log_debug(1 << CXGBI_DBG_SOCK, "csk 0x%p,%u,0x%lx,%u.\n",
                 csk, (csk)->state, (csk)->flags, (csk)->tid);
         spin_lock_bh(&csk->lock);
-        dst_confirm(csk->dst);
+        if (csk->dst)
+                dst_confirm(csk->dst);
         data_lost = skb_queue_len(&csk->receive_queue);
         __skb_queue_purge(&csk->receive_queue);
 
@@ -882,7 +883,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         }
 
         if (close_req) {
-                if (data_lost)
+                if (!cxgbi_sock_flag(csk, CTPF_LOGOUT_RSP_RCVD) ||
+                    data_lost)
                         csk->cdev->csk_send_abort_req(csk);
                 else
                         csk->cdev->csk_send_close_req(csk);
@@ -1186,9 +1188,10 @@ static int cxgbi_sock_send_pdus(struct cxgbi_sock *csk, struct sk_buff *skb)
                                 cxgbi_ulp_extra_len(cxgbi_skcb_ulp_mode(skb));
                 skb = next;
         }
-done:
+
         if (likely(skb_queue_len(&csk->write_queue)))
                 cdev->csk_push_tx_frames(csk, 1);
+done:
         spin_unlock_bh(&csk->lock);
         return copied;
 
@@ -1568,9 +1571,12 @@ static inline int read_pdu_skb(struct iscsi_conn *conn,
         }
 }
 
-static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
+static int
+skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
+                 struct sk_buff *skb)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+        int err;
 
         log_debug(1 << CXGBI_DBG_PDU_RX,
                 "conn 0x%p, skb 0x%p, len %u, flag 0x%lx.\n",
@@ -1608,7 +1614,16 @@ static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
                 }
         }
 
-        return read_pdu_skb(conn, skb, 0, 0);
+        err = read_pdu_skb(conn, skb, 0, 0);
+        if (likely(err >= 0)) {
+                struct iscsi_hdr *hdr = (struct iscsi_hdr *)skb->data;
+                u8 opcode = hdr->opcode & ISCSI_OPCODE_MASK;
+
+                if (unlikely(opcode == ISCSI_OP_LOGOUT_RSP))
+                        cxgbi_sock_set_flag(csk, CTPF_LOGOUT_RSP_RCVD);
+        }
+
+        return err;
 }
 
 static int skb_read_pdu_data(struct iscsi_conn *conn, struct sk_buff *lskb,
@@ -1713,7 +1728,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                         cxgbi_skcb_rx_pdulen(skb));
 
                 if (cxgbi_skcb_test_flag(skb, SKCBF_RX_COALESCED)) {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("coalesced bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1731,7 +1746,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                                         cxgbi_skcb_flags(skb),
                                         cxgbi_skcb_rx_pdulen(skb));
                 } else {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1873,6 +1888,11 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
         tcp_task->dd_data = tdata;
         task->hdr = NULL;
 
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
+
         if (SKB_MAX_HEAD(cdev->skb_tx_rsvd) > (512 * MAX_SKB_FRAGS) &&
             (opcode == ISCSI_OP_SCSI_DATA_OUT ||
              (opcode == ISCSI_OP_SCSI_CMD &&
@@ -1890,6 +1910,7 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
                 return -ENOMEM;
         }
 
+        skb_get(tdata->skb);
         skb_reserve(tdata->skb, cdev->skb_tx_rsvd);
         task->hdr = (struct iscsi_hdr *)tdata->skb->data;
         task->hdr_max = SKB_TX_ISCSI_PDU_HEADER_MAX; /* BHS + AHS */
@@ -2035,9 +2056,9 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         unsigned int datalen;
         int err;
 
-        if (!skb) {
+        if (!skb || cxgbi_skcb_test_flag(skb, SKCBF_TX_DONE)) {
                 log_debug(1 << CXGBI_DBG_ISCSI | 1 << CXGBI_DBG_PDU_TX,
-                        "task 0x%p, skb NULL.\n", task);
+                        "task 0x%p, skb 0x%p\n", task, skb);
                 return 0;
         }
 
@@ -2050,7 +2071,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         }
 
         datalen = skb->data_len;
-        tdata->skb = NULL;
 
         /* write ppod first if using ofldq to write ppod */
         if (ttinfo->flags & CXGBI_PPOD_INFO_FLAG_VALID) {
@@ -2078,6 +2098,7 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         pdulen += ISCSI_DIGEST_SIZE;
 
                 task->conn->txdata_octets += pdulen;
+                cxgbi_skcb_set_flag(skb, SKCBF_TX_DONE);
                 return 0;
         }
 
@@ -2086,7 +2107,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         "task 0x%p, skb 0x%p, len %u/%u, %d EAGAIN.\n",
                         task, skb, skb->len, skb->data_len, err);
                 /* reset skb to send when we are called again */
-                tdata->skb = skb;
                 return err;
         }
 
@@ -2094,7 +2114,8 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                 "itt 0x%x, skb 0x%p, len %u/%u, xmit err %d.\n",
                 task->itt, skb, skb->len, skb->data_len, err);
 
-        kfree_skb(skb);
+        __kfree_skb(tdata->skb);
+        tdata->skb = NULL;
 
         iscsi_conn_printk(KERN_ERR, task->conn, "xmit err %d.\n", err);
         iscsi_conn_failure(task->conn, ISCSI_ERR_XMIT_FAILED);
@@ -2113,8 +2134,10 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
 
         tcp_task->dd_data = NULL;
         /*  never reached the xmit task callout */
-        if (tdata->skb)
-                __kfree_skb(tdata->skb);
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
 
         task_release_itt(task, task->hdr_itt);
         memset(tdata, 0, sizeof(*tdata));
@@ -2714,6 +2737,9 @@ EXPORT_SYMBOL_GPL(cxgbi_attr_is_visible);
 static int __init libcxgbi_init_module(void)
 {
         pr_info("%s", version);
+
+        BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, cb) <
+                     sizeof(struct cxgbi_skb_cb));
         return 0;
 }
 
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 18e0ea83d361..37f07aaab1e4 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -187,6 +187,7 @@ enum cxgbi_sock_flags {
         CTPF_HAS_ATID,          /* reserved atid */
         CTPF_HAS_TID,           /* reserved hw tid */
         CTPF_OFFLOAD_DOWN,      /* offload function off */
+        CTPF_LOGOUT_RSP_RCVD,   /* received logout response */
 };
 
 struct cxgbi_skb_rx_cb {
@@ -195,7 +196,8 @@ struct cxgbi_skb_rx_cb {
 };
 
 struct cxgbi_skb_tx_cb {
-        void *l2t;
+        void *handle;
+        void *arp_err_handler;
         struct sk_buff *wr_next;
 };
 
@@ -203,6 +205,7 @@ enum cxgbi_skcb_flags {
         SKCBF_TX_NEED_HDR,      /* packet needs a header */
         SKCBF_TX_MEM_WRITE,     /* memory write */
         SKCBF_TX_FLAG_COMPL,    /* wr completion flag */
+        SKCBF_TX_DONE,          /* skb tx done */
         SKCBF_RX_COALESCED,     /* received whole pdu */
         SKCBF_RX_HDR,           /* received pdu header */
         SKCBF_RX_DATA,          /* received pdu payload */
@@ -215,13 +218,13 @@ enum cxgbi_skcb_flags {
 };
 
 struct cxgbi_skb_cb {
-        unsigned char ulp_mode;
-        unsigned long flags;
-        unsigned int seq;
         union {
                 struct cxgbi_skb_rx_cb rx;
                 struct cxgbi_skb_tx_cb tx;
         };
+        unsigned char ulp_mode;
+        unsigned long flags;
+        unsigned int seq;
 };
 
 #define CXGBI_SKB_CB(skb)       ((struct cxgbi_skb_cb *)&((skb)->cb[0]))
@@ -374,11 +377,9 @@ static inline void cxgbi_sock_enqueue_wr(struct cxgbi_sock *csk,
         cxgbi_skcb_tx_wr_next(skb) = NULL;
         /*
          * We want to take an extra reference since both us and the driver
-         * need to free the packet before it's really freed. We know there's
-         * just one user currently so we use atomic_set rather than skb_get
-         * to avoid the atomic op.
+         * need to free the packet before it's really freed.
          */
-        atomic_set(&skb->users, 2);
+        skb_get(skb);
 
         if (!csk->wr_pending_head)
                 csk->wr_pending_head = skb;
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 3cbab8710e58..2ceff585f189 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -265,18 +265,16 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                                       struct list_head *list,
                                       unsigned char *cdb)
 {
-        struct scsi_device *sdev = ctlr->ms_sdev;
-        struct rdac_dh_data *h = sdev->handler_data;
         struct rdac_mode_common *common;
         unsigned data_size;
         struct rdac_queue_data *qdata;
         u8 *lun_table;
 
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 struct rdac_pg_expanded *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_expanded);
-                rdac_pg = &h->ctlr->mode_select.expanded;
+                rdac_pg = &ctlr->mode_select.expanded;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER + 0x40;
@@ -288,7 +286,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                 struct rdac_pg_legacy *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_legacy);
-                rdac_pg = &h->ctlr->mode_select.legacy;
+                rdac_pg = &ctlr->mode_select.legacy;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER;
@@ -304,7 +302,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
         }
 
         /* Prepare the command. */
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 cdb[0] = MODE_SELECT_10;
                 cdb[7] = data_size >> 8;
                 cdb[8] = data_size & 0xff;
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index d390325c99ec..abf6026645dd 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -1170,6 +1170,8 @@ static struct ibmvscsis_cmd *ibmvscsis_get_free_cmd(struct scsi_info *vscsi)
                 cmd = list_first_entry_or_null(&vscsi->free_cmd,
                                                struct ibmvscsis_cmd, list);
                 if (cmd) {
+                        if (cmd->abort_cmd)
+                                cmd->abort_cmd = NULL;
                         cmd->flags &= ~(DELAY_SEND);
                         list_del(&cmd->list);
                         cmd->iue = iue;
@@ -1774,6 +1776,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                 if (cmd->abort_cmd) {
                                         retry = true;
                                         cmd->abort_cmd->flags &= ~(DELAY_SEND);
+                                        cmd->abort_cmd = NULL;
                                 }
 
                                 /*
@@ -1788,6 +1791,25 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                         list_del(&cmd->list);
                                         ibmvscsis_free_cmd_resources(vscsi,
                                                                      cmd);
+                                        /*
+                                         * With a successfully aborted op
+                                         * through LIO we want to increment the
+                                         * the vscsi credit so that when we dont
+                                         * send a rsp to the original scsi abort
+                                         * op (h_send_crq), but the tm rsp to
+                                         * the abort is sent, the credit is
+                                         * correctly sent with the abort tm rsp.
+                                         * We would need 1 for the abort tm rsp
+                                         * and 1 credit for the aborted scsi op.
+                                         * Thus we need to increment here.
+                                         * Also we want to increment the credit
+                                         * here because we want to make sure
+                                         * cmd is actually released first
+                                         * otherwise the client will think it
+                                         * it can send a new cmd, and we could
+                                         * find ourselves short of cmd elements.
+                                         */
+                                        vscsi->credit += 1;
                                 } else {
                                         iue = cmd->iue;
 
@@ -2962,10 +2984,7 @@ static long srp_build_response(struct scsi_info *vscsi,
 
         rsp->opcode = SRP_RSP;
 
-        if (vscsi->credit > 0 && vscsi->state == SRP_PROCESSING)
-                rsp->req_lim_delta = cpu_to_be32(vscsi->credit);
-        else
-                rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
+        rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
         rsp->tag = cmd->rsp.tag;
         rsp->flags = 0;
 
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index b44c3136eb51..520325867e2b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -1422,7 +1422,7 @@ static void fc_rport_recv_rtv_req(struct fc_rport_priv *rdata,
         fp = fc_frame_alloc(lport, sizeof(*rtv));
         if (!fp) {
                 rjt_data.reason = ELS_RJT_UNAB;
-                rjt_data.reason = ELS_EXPL_INSUF_RES;
+                rjt_data.explan = ELS_EXPL_INSUF_RES;
                 fc_seq_els_rsp_send(in_fp, ELS_LS_RJT, &rjt_data);
                 goto drop;
         }
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 6d7840b096e6..f2c0ba6ced78 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -141,6 +141,13 @@ struct lpfc_dmabuf {
         uint32_t   buffer_tag;  /* used for tagged queue ring */
 };
 
+struct lpfc_nvmet_ctxbuf {
+        struct list_head list;
+        struct lpfc_nvmet_rcv_ctx *context;
+        struct lpfc_iocbq *iocbq;
+        struct lpfc_sglq *sglq;
+};
+
 struct lpfc_dma_pool {
         struct lpfc_dmabuf   *elements;
         uint32_t    max_count;
@@ -163,9 +170,7 @@ struct rqb_dmabuf {
         struct lpfc_dmabuf dbuf;
         uint16_t total_size;
         uint16_t bytes_recv;
-        void *context;
-        struct lpfc_iocbq *iocbq;
-        struct lpfc_sglq *sglq;
+        uint16_t idx;
         struct lpfc_queue *hrq;   /* ptr to associated Header RQ */
         struct lpfc_queue *drq;   /* ptr to associated Data RQ */
 };
@@ -670,6 +675,8 @@ struct lpfc_hba {
                                         /* INIT_LINK mailbox command */
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
+#define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
+#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
@@ -777,7 +784,6 @@ struct lpfc_hba {
         uint32_t cfg_nvme_oas;
         uint32_t cfg_nvme_io_channel;
         uint32_t cfg_nvmet_mrq;
-        uint32_t cfg_nvmet_mrq_post;
         uint32_t cfg_enable_nvmet;
         uint32_t cfg_nvme_enable_fb;
         uint32_t cfg_nvmet_fb_size;
@@ -943,6 +949,7 @@ struct lpfc_hba {
         struct pci_pool *lpfc_mbuf_pool;
         struct pci_pool *lpfc_hrb_pool; /* header receive buffer pool */
         struct pci_pool *lpfc_drb_pool; /* data receive buffer pool */
+        struct pci_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
         struct pci_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
         struct pci_pool *txrdy_payload_pool;
         struct lpfc_dma_pool lpfc_mbuf_safety_pool;
@@ -1228,7 +1235,11 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 static inline struct lpfc_sli_ring *
 lpfc_phba_elsring(struct lpfc_hba *phba)
 {
-        if (phba->sli_rev == LPFC_SLI_REV4)
-                return phba->sli4_hba.els_wq->pring;
+        if (phba->sli_rev == LPFC_SLI_REV4) {
+                if (phba->sli4_hba.els_wq)
+                        return phba->sli4_hba.els_wq->pring;
+                else
+                        return NULL;
+        }
         return &phba->sli.sli3_ring[LPFC_ELS_RING];
 }
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4830370bfab1..bb2d9e238225 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -60,9 +60,9 @@
 #define LPFC_MIN_DEVLOSS_TMO    1
 #define LPFC_MAX_DEVLOSS_TMO    255
 
-#define LPFC_DEF_MRQ_POST       256
-#define LPFC_MIN_MRQ_POST       32
-#define LPFC_MAX_MRQ_POST       512
+#define LPFC_DEF_MRQ_POST       512
+#define LPFC_MIN_MRQ_POST       512
+#define LPFC_MAX_MRQ_POST       2048
 
 /*
  * Write key size should be multiple of 4. If write key is changed
@@ -205,8 +205,9 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Release %08x Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
@@ -218,15 +219,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                 }
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x\n",
+                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x "
+                                "drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_read),
                                 atomic_read(&tgtp->xmt_fcp_read_rsp),
                                 atomic_read(&tgtp->xmt_fcp_write),
-                                atomic_read(&tgtp->xmt_fcp_rsp));
-
-                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_rsp),
                                 atomic_read(&tgtp->xmt_fcp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
@@ -236,10 +234,22 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "IO_CTX: %08x outstanding %08x total %x",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
 
                 len +=  snprintf(buf+len, PAGE_SIZE-len, "\n");
                 return len;
@@ -3312,14 +3322,6 @@ LPFC_ATTR_R(nvmet_mrq,
             "Specify number of RQ pairs for processing NVMET cmds");
 
 /*
- * lpfc_nvmet_mrq_post: Specify number buffers to post on every MRQ
- *
- */
-LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
-            LPFC_MIN_MRQ_POST, LPFC_MAX_MRQ_POST,
-            "Specify number of buffers to post on every MRQ");
-
-/*
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
@@ -5154,7 +5156,6 @@ struct device_attribute *lpfc_hba_attrs[] = {
         &dev_attr_lpfc_suppress_rsp,
         &dev_attr_lpfc_nvme_io_channel,
         &dev_attr_lpfc_nvmet_mrq,
-        &dev_attr_lpfc_nvmet_mrq_post,
         &dev_attr_lpfc_nvme_enable_fb,
         &dev_attr_lpfc_nvmet_fb_size,
         &dev_attr_lpfc_enable_bg,
@@ -6194,7 +6195,6 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 
         lpfc_enable_fc4_type_init(phba, lpfc_enable_fc4_type);
         lpfc_nvmet_mrq_init(phba, lpfc_nvmet_mrq);
-        lpfc_nvmet_mrq_post_init(phba, lpfc_nvmet_mrq_post);
 
         /* Initialize first burst. Target vs Initiator are different. */
         lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
@@ -6291,7 +6291,6 @@ lpfc_nvme_mod_param_dep(struct lpfc_hba *phba)
                 /* Not NVME Target mode.  Turn off Target parameters. */
                 phba->nvmet_support = 0;
                 phba->cfg_nvmet_mrq = 0;
-                phba->cfg_nvmet_mrq_post = 0;
                 phba->cfg_nvmet_fb_size = 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 1c55408ac718..da669dce12fe 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -75,6 +75,10 @@ void lpfc_init_vpi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_cancel_all_vport_retry_delay_timer(struct lpfc_hba *);
 void lpfc_retry_pport_discovery(struct lpfc_hba *);
 void lpfc_release_rpi(struct lpfc_hba *, struct lpfc_vport *, uint16_t);
+int lpfc_init_iocb_list(struct lpfc_hba *phba, int cnt);
+void lpfc_free_iocb_list(struct lpfc_hba *phba);
+int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                        struct lpfc_queue *drq, int count, int idx);
 
 void lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbx_cmpl_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
@@ -123,7 +127,7 @@ int lpfc_disc_state_machine(struct lpfc_vport *, struct lpfc_nodelist *, void *,
 void lpfc_do_scr_ns_plogi(struct lpfc_hba *, struct lpfc_vport *);
 int lpfc_check_sparm(struct lpfc_vport *, struct lpfc_nodelist *,
                      struct serv_parm *, uint32_t, int);
-int lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
+void lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
 void lpfc_more_plogi(struct lpfc_vport *);
 void lpfc_more_adisc(struct lpfc_vport *);
 void lpfc_end_rscn(struct lpfc_vport *);
@@ -246,16 +250,14 @@ struct hbq_dmabuf *lpfc_sli4_rb_alloc(struct lpfc_hba *);
 void lpfc_sli4_rb_free(struct lpfc_hba *, struct hbq_dmabuf *);
 struct rqb_dmabuf *lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba);
 void lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab);
-void lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                        struct lpfc_dmabuf *mp);
+void lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba,
+                            struct lpfc_nvmet_ctxbuf *ctxp);
 int lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
                                struct fc_frame_header *fc_hdr);
 void lpfc_sli4_build_dflt_fcf_record(struct lpfc_hba *, struct fcf_record *,
                         uint16_t);
 int lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
                      struct lpfc_rqe *hrqe, struct lpfc_rqe *drqe);
-int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq,
-                        struct lpfc_queue *dq, int count);
 int lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq);
 void lpfc_unregister_fcf(struct lpfc_hba *);
 void lpfc_unregister_fcf_rescan(struct lpfc_hba *);
@@ -271,6 +273,7 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *, uint16_t);
 void lpfc_sli4_clear_fcf_rr_bmask(struct lpfc_hba *);
 
 int lpfc_mem_alloc(struct lpfc_hba *, int align);
+int lpfc_nvmet_mem_alloc(struct lpfc_hba *phba);
 int lpfc_mem_alloc_active_rrq_pool_s4(struct lpfc_hba *);
 void lpfc_mem_free(struct lpfc_hba *);
 void lpfc_mem_free_all(struct lpfc_hba *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index c7962dae4dab..24ce96dcc94d 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -978,9 +978,10 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
                         ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
+
+                        lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
+                        lpfc_issue_els_prli(vport, ndlp, 0);
                 }
-                lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
-                lpfc_issue_els_prli(vport, ndlp, 0);
         } else
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_DISCOVERY,
                                  "3065 GFT_ID failed x%08x\n", irsp->ulpStatus);
@@ -2092,6 +2093,7 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
 
         ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
         ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+        ae->un.AttrTypes[6] = 0x01; /* Type 40 - NVME */
         ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
         size = FOURBYTES + 32;
         ad->AttrLen = cpu_to_be16(size);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index fce549a91911..4bcb92c844ca 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -798,21 +798,22 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_fcp_rsp));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
-                                atomic_read(&tgtp->xmt_fcp_drop));
-
-                len += snprintf(buf + len, size - len,
                                 "FCP Rsp Cmpl: %08x err %08x drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_rsp_cmpl),
                                 atomic_read(&tgtp->xmt_fcp_rsp_error),
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf + len, size - len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, size - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
 
                 len +=  snprintf(buf + len, size - len, "\n");
 
@@ -841,6 +842,12 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                         }
                         spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 }
+
+                len += snprintf(buf + len, size - len,
+                                "IO_CTX: %08x  outstanding %08x total %08x\n",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
         } else {
                 if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
                         return len;
@@ -1959,6 +1966,7 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -1967,19 +1975,22 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
 
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return nbytes;
 }
@@ -3070,11 +3081,11 @@ __lpfc_idiag_print_wq(struct lpfc_queue *qp, char *wqtype,
                         qp->assoc_qid, qp->q_cnt_1,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len,
                         LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
         return len;
@@ -3121,11 +3132,11 @@ __lpfc_idiag_print_cq(struct lpfc_queue *qp, char *cqtype,
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\tCQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\tCQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
 
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
@@ -3143,20 +3154,20 @@ __lpfc_idiag_print_rqpair(struct lpfc_queue *qp, struct lpfc_queue *datqp,
                         "\t\t%s RQ info: ", rqtype);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
                         "AssocCQID[%02d]: RQ-STAT[nopost:x%x nobuf:x%x "
-                        "trunc:x%x rcv:x%llx]\n",
+                        "posted:x%x rcv:x%llx]\n",
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         datqp->queue_id, datqp->entry_count,
                         datqp->entry_size, datqp->host_index,
-                        datqp->hba_index);
+                        datqp->hba_index, datqp->entry_repost);
         return len;
 }
 
@@ -3242,10 +3253,10 @@ __lpfc_idiag_print_eq(struct lpfc_queue *qp, char *eqtype,
                         eqtype, qp->q_cnt_1, qp->q_cnt_2, qp->q_cnt_3,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "EQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "EQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
         return len;
@@ -5855,8 +5866,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport)
                         atomic_dec(&lpfc_debugfs_hba_count);
                 }
 
-                debugfs_remove(lpfc_debugfs_root); /* lpfc */
-                lpfc_debugfs_root = NULL;
+                if (atomic_read(&lpfc_debugfs_hba_count) == 0) {
+                        debugfs_remove(lpfc_debugfs_root); /* lpfc */
+                        lpfc_debugfs_root = NULL;
+                }
         }
 #endif
         return;
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 9d5a379f4b15..094c97b9e5f7 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -90,6 +90,7 @@ struct lpfc_nodelist {
 #define NLP_FCP_INITIATOR  0x10                 /* entry is an FCP Initiator */
 #define NLP_NVME_TARGET    0x20                 /* entry is a NVME Target */
 #define NLP_NVME_INITIATOR 0x40                 /* entry is a NVME Initiator */
+#define NLP_NVME_DISCOVERY 0x80                 /* entry has NVME disc srvc */
 
         uint16_t        nlp_fc4_type;           /* FC types node supports. */
                                                 /* Assigned from GID_FF, only
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 67827e397431..8e532b39ae93 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1047,6 +1047,13 @@ stop_rr_fcf_flogi:
                                  irsp->ulpStatus, irsp->un.ulpWord[4],
                                  irsp->ulpTimeout);
 
+
+                /* If this is not a loop open failure, bail out */
+                if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+                      ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
+                                        IOERR_LOOP_OPEN_FAILURE)))
+                        goto flogifail;
+
                 /* FLOGI failed, so there is no fabric */
                 spin_lock_irq(shost->host_lock);
                 vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP);
@@ -2077,16 +2084,19 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
         if (irsp->ulpStatus) {
                 /* Check for retry */
+                ndlp->fc4_prli_sent--;
                 if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
                         /* ELS command is being retried */
-                        ndlp->fc4_prli_sent--;
                         goto out;
                 }
+
                 /* PRLI failed */
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
-                                 "2754 PRLI failure DID:%06X Status:x%x/x%x\n",
+                                 "2754 PRLI failure DID:%06X Status:x%x/x%x, "
+                                 "data: x%x\n",
                                  ndlp->nlp_DID, irsp->ulpStatus,
-                                 irsp->un.ulpWord[4]);
+                                 irsp->un.ulpWord[4], ndlp->fc4_prli_sent);
+
                 /* Do not call DSM for lpfc_els_abort'ed ELS cmds */
                 if (lpfc_error_lost_link(irsp))
                         goto out;
@@ -7441,6 +7451,13 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)
          */
         spin_lock_irq(&phba->hbalock);
         pring = lpfc_phba_elsring(phba);
+
+        /* Bail out if we've no ELS wq, like in PCI error recovery case. */
+        if (unlikely(!pring)) {
+                spin_unlock_irq(&phba->hbalock);
+                return;
+        }
+
         if (phba->sli_rev == LPFC_SLI_REV4)
                 spin_lock(&pring->ring_lock);
 
@@ -8667,7 +8684,8 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                 lpfc_do_scr_ns_plogi(phba, vport);
         goto out;
 fdisc_failed:
-        if (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS)
+        if (vport->fc_vport &&
+            (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS))
                 lpfc_vport_set_state(vport, FC_VPORT_FAILED);
         /* Cancel discovery timer */
         lpfc_can_disctmo(vport);
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 0482c5580331..3ffcd9215ca8 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -693,15 +693,16 @@ lpfc_work_done(struct lpfc_hba *phba)
         pring = lpfc_phba_elsring(phba);
         status = (ha_copy & (HA_RXMASK  << (4*LPFC_ELS_RING)));
         status >>= (4*LPFC_ELS_RING);
-        if ((status & HA_RXMASK) ||
-            (pring->flag & LPFC_DEFERRED_RING_EVENT) ||
-            (phba->hba_flag & HBA_SP_QUEUE_EVT)) {
+        if (pring && (status & HA_RXMASK ||
+                      pring->flag & LPFC_DEFERRED_RING_EVENT ||
+                      phba->hba_flag & HBA_SP_QUEUE_EVT)) {
                 if (pring->flag & LPFC_STOP_IOCB_EVENT) {
                         pring->flag |= LPFC_DEFERRED_RING_EVENT;
                         /* Set the lpfc data pending flag */
                         set_bit(LPFC_DATA_READY, &phba->data_flags);
                 } else {
-                        if (phba->link_state >= LPFC_LINK_UP) {
+                        if (phba->link_state >= LPFC_LINK_UP ||
+                            phba->link_flag & LS_MDS_LOOPBACK) {
                                 pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
                                 lpfc_sli_handle_slow_ring_event(phba, pring,
                                                                 (status &
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 1d12f2be36bc..e0a5fce416ae 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1356,6 +1356,7 @@ struct lpfc_mbx_wq_destroy {
 
 #define LPFC_HDR_BUF_SIZE 128
 #define LPFC_DATA_BUF_SIZE 2048
+#define LPFC_NVMET_DATA_BUF_SIZE 128
 struct rq_context {
         uint32_t word0;
 #define lpfc_rq_context_rqe_count_SHIFT 16      /* Version 0 Only */
@@ -4420,6 +4421,19 @@ struct fcp_treceive64_wqe {
 };
 #define TXRDY_PAYLOAD_LEN      12
 
+#define CMD_SEND_FRAME  0xE1
+
+struct send_frame_wqe {
+        struct ulp_bde64 bde;          /* words 0-2 */
+        uint32_t frame_len;            /* word 3 */
+        uint32_t fc_hdr_wd0;           /* word 4 */
+        uint32_t fc_hdr_wd1;           /* word 5 */
+        struct wqe_common wqe_com;     /* words 6-11 */
+        uint32_t fc_hdr_wd2;           /* word 12 */
+        uint32_t fc_hdr_wd3;           /* word 13 */
+        uint32_t fc_hdr_wd4;           /* word 14 */
+        uint32_t fc_hdr_wd5;           /* word 15 */
+};
 
 union lpfc_wqe {
         uint32_t words[16];
@@ -4438,7 +4452,7 @@ union lpfc_wqe {
         struct fcp_trsp64_wqe fcp_trsp;
         struct fcp_tsend64_wqe fcp_tsend;
         struct fcp_treceive64_wqe fcp_treceive;
-
+        struct send_frame_wqe send_frame;
 };
 
 union lpfc_wqe128 {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 4b1eb98c228d..9add9473cae5 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1099,7 +1099,7 @@ lpfc_hba_down_post_s4(struct lpfc_hba *phba)
 
                 list_for_each_entry_safe(ctxp, ctxp_next, &nvmet_aborts, list) {
                         ctxp->flag &= ~(LPFC_NVMET_XBUSY | LPFC_NVMET_ABORT_OP);
-                        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
                 }
         }
 
@@ -3381,7 +3381,7 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
 {
         struct lpfc_sglq *sglq_entry = NULL, *sglq_entry_next = NULL;
         uint16_t i, lxri, xri_cnt, els_xri_cnt;
-        uint16_t nvmet_xri_cnt, tot_cnt;
+        uint16_t nvmet_xri_cnt;
         LIST_HEAD(nvmet_sgl_list);
         int rc;
 
@@ -3389,15 +3389,9 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
          * update on pci function's nvmet xri-sgl list
          */
         els_xri_cnt = lpfc_sli4_get_els_iocb_cnt(phba);
-        nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-        tot_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
-        if (nvmet_xri_cnt > tot_cnt) {
-                phba->cfg_nvmet_mrq_post = tot_cnt / phba->cfg_nvmet_mrq;
-                nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                                "6301 NVMET post-sgl count changed to %d\n",
-                                phba->cfg_nvmet_mrq_post);
-        }
+
+        /* For NVMET, ALL remaining XRIs are dedicated for IO processing */
+        nvmet_xri_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
 
         if (nvmet_xri_cnt > phba->sli4_hba.nvmet_xri_cnt) {
                 /* els xri-sgl expanded */
@@ -4546,6 +4540,19 @@ lpfc_sli4_async_fc_evt(struct lpfc_hba *phba, struct lpfc_acqe_fc_la *acqe_fc)
         pmb->vport = phba->pport;
 
         if (phba->sli4_hba.link_state.status != LPFC_FC_LA_TYPE_LINK_UP) {
+                phba->link_flag &= ~(LS_MDS_LINK_DOWN | LS_MDS_LOOPBACK);
+
+                switch (phba->sli4_hba.link_state.status) {
+                case LPFC_FC_LA_TYPE_MDS_LINK_DOWN:
+                        phba->link_flag |= LS_MDS_LINK_DOWN;
+                        break;
+                case LPFC_FC_LA_TYPE_MDS_LOOPBACK:
+                        phba->link_flag |= LS_MDS_LOOPBACK;
+                        break;
+                default:
+                        break;
+                }
+
                 /* Parse and translate status field */
                 mb = &pmb->u.mb;
                 mb->mbxStatus = lpfc_sli4_parse_latt_fault(phba,
@@ -5830,6 +5837,9 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_io_wait_list);
+
                 /* Fast-path XRI aborted CQ Event work queue list */
                 INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
@@ -5837,6 +5847,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* This abort list used by worker thread */
         spin_lock_init(&phba->sli4_hba.sgl_list_lock);
         spin_lock_init(&phba->sli4_hba.nvmet_io_lock);
+        spin_lock_init(&phba->sli4_hba.nvmet_io_wait_lock);
 
         /*
          * Initialize driver internal slow-path work queues
@@ -5951,16 +5962,21 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
 #if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+                                if (lpfc_nvmet_mem_alloc(phba))
+                                        break;
+
+                                phba->nvmet_support = 1; /* a match */
+
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
-                                phba->nvmet_support = 1; /* a match */
 #else
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6021 Can't enable NVME Target."
                                                 " NVME_TARGET_FC infrastructure"
                                                 " is not in kernel\n");
 #endif
+                                break;
                         }
                 }
         }
@@ -6269,7 +6285,7 @@ lpfc_unset_driver_resource_phase2(struct lpfc_hba *phba)
  *
  * This routine is invoked to free the driver's IOCB list and memory.
  **/
-static void
+void
 lpfc_free_iocb_list(struct lpfc_hba *phba)
 {
         struct lpfc_iocbq *iocbq_entry = NULL, *iocbq_next = NULL;
@@ -6297,7 +6313,7 @@ lpfc_free_iocb_list(struct lpfc_hba *phba)
  *      0 - successful
  *      other values - error
  **/
-static int
+int
 lpfc_init_iocb_list(struct lpfc_hba *phba, int iocb_count)
 {
         struct lpfc_iocbq *iocbq_entry = NULL;
@@ -6525,7 +6541,6 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         uint16_t rpi_limit, curr_rpi_range;
         struct lpfc_dmabuf *dmabuf;
         struct lpfc_rpi_hdr *rpi_hdr;
-        uint32_t rpi_count;
 
         /*
          * If the SLI4 port supports extents, posting the rpi header isn't
@@ -6538,8 +6553,7 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
                 return NULL;
 
         /* The limit on the logical index is just the max_rpi count. */
-        rpi_limit = phba->sli4_hba.max_cfg_param.rpi_base +
-        phba->sli4_hba.max_cfg_param.max_rpi - 1;
+        rpi_limit = phba->sli4_hba.max_cfg_param.max_rpi;
 
         spin_lock_irq(&phba->hbalock);
         /*
@@ -6550,18 +6564,10 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         curr_rpi_range = phba->sli4_hba.next_rpi;
         spin_unlock_irq(&phba->hbalock);
 
-        /*
-         * The port has a limited number of rpis. The increment here
-         * is LPFC_RPI_HDR_COUNT - 1 to account for the starting value
-         * and to allow the full max_rpi range per port.
-         */
-        if ((curr_rpi_range + (LPFC_RPI_HDR_COUNT - 1)) > rpi_limit)
-                rpi_count = rpi_limit - curr_rpi_range;
-        else
-                rpi_count = LPFC_RPI_HDR_COUNT;
-
-        if (!rpi_count)
+        /* Reached full RPI range */
+        if (curr_rpi_range == rpi_limit)
                 return NULL;
+
         /*
          * First allocate the protocol header region for the port.  The
          * port expects a 4KB DMA-mapped memory region that is 4K aligned.
@@ -6595,13 +6601,9 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
 
         /* The rpi_hdr stores the logical index only. */
         rpi_hdr->start_rpi = curr_rpi_range;
+        rpi_hdr->next_rpi = phba->sli4_hba.next_rpi + LPFC_RPI_HDR_COUNT;
         list_add_tail(&rpi_hdr->list, &phba->sli4_hba.lpfc_rpi_hdr_list);
 
-        /*
-         * The next_rpi stores the next logical module-64 rpi value used
-         * to post physical rpis in subsequent rpi postings.
-         */
-        phba->sli4_hba.next_rpi += rpi_count;
         spin_unlock_irq(&phba->hbalock);
         return rpi_hdr;
 
@@ -8172,7 +8174,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for header */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3146 Failed allocate "
@@ -8194,7 +8196,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for data */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3156 Failed allocate "
@@ -8326,46 +8328,6 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
 }
 
 int
-lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
-                    struct lpfc_queue *drq, int count)
-{
-        int rc, i;
-        struct lpfc_rqe hrqe;
-        struct lpfc_rqe drqe;
-        struct lpfc_rqb *rqbp;
-        struct rqb_dmabuf *rqb_buffer;
-        LIST_HEAD(rqb_buf_list);
-
-        rqbp = hrq->rqbp;
-        for (i = 0; i < count; i++) {
-                rqb_buffer = (rqbp->rqb_alloc_buffer)(phba);
-                if (!rqb_buffer)
-                        break;
-                rqb_buffer->hrq = hrq;
-                rqb_buffer->drq = drq;
-                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
-        }
-        while (!list_empty(&rqb_buf_list)) {
-                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
-                                 hbuf.list);
-
-                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
-                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
-                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
-                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
-                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
-                if (rc < 0) {
-                        (rqbp->rqb_free_buffer)(phba, rqb_buffer);
-                } else {
-                        list_add_tail(&rqb_buffer->hbuf.list,
-                                      &rqbp->rqb_buffer_list);
-                        rqbp->buffer_count++;
-                }
-        }
-        return 1;
-}
-
-int
 lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *rq)
 {
         struct lpfc_rqb *rqbp;
@@ -8784,9 +8746,6 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 goto out_destroy;
         }
 
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.hdr_rq, LPFC_ELS_HBQ);
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.dat_rq, LPFC_ELS_HBQ);
-
         rc = lpfc_rq_create(phba, phba->sli4_hba.hdr_rq, phba->sli4_hba.dat_rq,
                             phba->sli4_hba.els_cq, LPFC_USOL);
         if (rc) {
@@ -11110,7 +11069,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         struct lpfc_hba   *phba;
         struct lpfc_vport *vport = NULL;
         struct Scsi_Host  *shost = NULL;
-        int error, cnt;
+        int error;
         uint32_t cfg_mode, intr_mode;
 
         /* Allocate memory for HBA structure */
@@ -11144,22 +11103,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_unset_pci_mem_s4;
         }
 
-        cnt = phba->cfg_iocb_cnt * 1024;
-        if (phba->nvmet_support)
-                cnt += phba->cfg_nvmet_mrq_post * phba->cfg_nvmet_mrq;
-
-        /* Initialize and populate the iocb list per host */
-        lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-                        "2821 initialize iocb list %d total %d\n",
-                        phba->cfg_iocb_cnt, cnt);
-        error = lpfc_init_iocb_list(phba, cnt);
-
-        if (error) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                "1413 Failed to initialize iocb list.\n");
-                goto out_unset_driver_resource_s4;
-        }
-
         INIT_LIST_HEAD(&phba->active_rrq_list);
         INIT_LIST_HEAD(&phba->fcf.fcf_pri_list);
 
@@ -11168,7 +11111,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "1414 Failed to set up driver resource.\n");
-                goto out_free_iocb_list;
+                goto out_unset_driver_resource_s4;
         }
 
         /* Get the default values for Model Name and Description */
@@ -11268,8 +11211,6 @@ out_destroy_shost:
         lpfc_destroy_shost(phba);
 out_unset_driver_resource:
         lpfc_unset_driver_resource_phase2(phba);
-out_free_iocb_list:
-        lpfc_free_iocb_list(phba);
 out_unset_driver_resource_s4:
         lpfc_sli4_driver_resource_unset(phba);
 out_unset_pci_mem_s4:
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 5986c7957199..fcc05a1517c2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -214,6 +214,21 @@ fail_free_drb_pool:
         return -ENOMEM;
 }
 
+int
+lpfc_nvmet_mem_alloc(struct lpfc_hba *phba)
+{
+        phba->lpfc_nvmet_drb_pool =
+                pci_pool_create("lpfc_nvmet_drb_pool",
+                                phba->pcidev, LPFC_NVMET_DATA_BUF_SIZE,
+                                SGL_ALIGN_SZ, 0);
+        if (!phba->lpfc_nvmet_drb_pool) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6024 Can't enable NVME Target - no memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
 /**
  * lpfc_mem_free - Frees memory allocated by lpfc_mem_alloc
  * @phba: HBA to free memory for
@@ -232,6 +247,9 @@ lpfc_mem_free(struct lpfc_hba *phba)
 
         /* Free HBQ pools */
         lpfc_sli_hbqbuf_free_all(phba);
+        if (phba->lpfc_nvmet_drb_pool)
+                pci_pool_destroy(phba->lpfc_nvmet_drb_pool);
+        phba->lpfc_nvmet_drb_pool = NULL;
         if (phba->lpfc_drb_pool)
                 pci_pool_destroy(phba->lpfc_drb_pool);
         phba->lpfc_drb_pool = NULL;
@@ -611,8 +629,6 @@ struct rqb_dmabuf *
 lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 {
         struct rqb_dmabuf *dma_buf;
-        struct lpfc_iocbq *nvmewqe;
-        union lpfc_wqe128 *wqe;
 
         dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
         if (!dma_buf)
@@ -624,69 +640,15 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
-                                            &dma_buf->dbuf.phys);
+        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_nvmet_drb_pool,
+                                            GFP_KERNEL, &dma_buf->dbuf.phys);
         if (!dma_buf->dbuf.virt) {
                 pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
                               dma_buf->hbuf.phys);
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->total_size = LPFC_DATA_BUF_SIZE;
-
-        dma_buf->context = kzalloc(sizeof(struct lpfc_nvmet_rcv_ctx),
-                                   GFP_KERNEL);
-        if (!dma_buf->context) {
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                return NULL;
-        }
-
-        dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        if (!dma_buf->iocbq) {
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "2621 Ran out of nvmet iocb/WQEs\n");
-                return NULL;
-        }
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
-        nvmewqe = dma_buf->iocbq;
-        wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
-        /* Initialize WQE */
-        memset(wqe, 0, sizeof(union lpfc_wqe));
-        /* Word 7 */
-        bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
-        bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
-        bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
-        /* Word 10 */
-        bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
-        bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
-        bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
-
-        dma_buf->iocbq->context1 = NULL;
-        spin_lock(&phba->sli4_hba.sgl_list_lock);
-        dma_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, dma_buf->iocbq);
-        spin_unlock(&phba->sli4_hba.sgl_list_lock);
-        if (!dma_buf->sglq) {
-                lpfc_sli_release_iocbq(phba, dma_buf->iocbq);
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "6132 Ran out of nvmet XRIs\n");
-                return NULL;
-        }
+        dma_buf->total_size = LPFC_NVMET_DATA_BUF_SIZE;
         return dma_buf;
 }
 
@@ -705,20 +667,9 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 void
 lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab)
 {
-        unsigned long flags;
-
-        __lpfc_clear_active_sglq(phba, dmab->sglq->sli4_lxritag);
-        dmab->sglq->state = SGL_FREED;
-        dmab->sglq->ndlp = NULL;
-
-        spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
-        list_add_tail(&dmab->sglq->list, &phba->sli4_hba.lpfc_nvmet_sgl_list);
-        spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, flags);
-
-        lpfc_sli_release_iocbq(phba, dmab->iocbq);
-        kfree(dmab->context);
         pci_pool_free(phba->lpfc_hrb_pool, dmab->hbuf.virt, dmab->hbuf.phys);
-        pci_pool_free(phba->lpfc_drb_pool, dmab->dbuf.virt, dmab->dbuf.phys);
+        pci_pool_free(phba->lpfc_nvmet_drb_pool,
+                      dmab->dbuf.virt, dmab->dbuf.phys);
         kfree(dmab);
 }
 
@@ -803,6 +754,11 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
                 (rqbp->rqb_free_buffer)(phba, rqb_entry);
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6409 Cannot post to RQ %d: %x %x\n",
+                                rqb_entry->hrq->queue_id,
+                                rqb_entry->hrq->host_index,
+                                rqb_entry->hrq->hba_index);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8777c2d5f50d..f74cb0142fd4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -206,7 +206,7 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
  * associated with a LPFC_NODELIST entry. This
  * routine effectively results in a "software abort".
  */
-int
+void
 lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 {
         LIST_HEAD(abort_list);
@@ -215,6 +215,10 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 
         pring = lpfc_phba_elsring(phba);
 
+        /* In case of error recovery path, we might have a NULL pring here */
+        if (!pring)
+                return;
+
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_DISCOVERY,
                          "2819 Abort outstanding I/O on NPort x%x "
@@ -273,7 +277,6 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
                               IOSTAT_LOCAL_REJECT, IOERR_SLI_ABORTED);
 
         lpfc_cancel_retry_delay_tmo(phba->pport, ndlp);
-        return 0;
 }
 
 static int
@@ -1944,7 +1947,13 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 
                 /* Target driver cannot solicit NVME FB. */
                 if (bf_get_be32(prli_tgt, nvpr)) {
+                        /* Complete the nvme target roles.  The transport
+                         * needs to know if the rport is capable of
+                         * discovery in addition to its role.
+                         */
                         ndlp->nlp_type |= NLP_NVME_TARGET;
+                        if (bf_get_be32(prli_disc, nvpr))
+                                ndlp->nlp_type |= NLP_NVME_DISCOVERY;
                         if ((bf_get_be32(prli_fba, nvpr) == 1) &&
                             (bf_get_be32(prli_fb_sz, nvpr) > 0) &&
                             (phba->cfg_nvme_enable_fb) &&
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 0488580eea12..518b15e6f222 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -142,7 +142,7 @@ out:
 }
 
 /**
- * lpfc_nvmet_rq_post - Repost a NVMET RQ DMA buffer and clean up context
+ * lpfc_nvmet_ctxbuf_post - Repost a NVMET RQ DMA buffer and clean up context
  * @phba: HBA buffer is associated with
  * @ctxp: context to clean up
  * @mp: Buffer to free
@@ -155,24 +155,113 @@ out:
  * Returns: None
  **/
 void
-lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                   struct lpfc_dmabuf *mp)
+lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf)
 {
-        if (ctxp) {
-                if (ctxp->flag)
-                        lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                                "6314 rq_post ctx xri x%x flag x%x\n",
-                                ctxp->oxid, ctxp->flag);
-
-                if (ctxp->txrdy) {
-                        pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
-                                      ctxp->txrdy_phys);
-                        ctxp->txrdy = NULL;
-                        ctxp->txrdy_phys = 0;
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+        struct lpfc_nvmet_rcv_ctx *ctxp = ctx_buf->context;
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct fc_frame_header *fc_hdr;
+        struct rqb_dmabuf *nvmebuf;
+        struct lpfc_dmabuf *hbufp;
+        uint32_t *payload;
+        uint32_t size, oxid, sid, rc;
+        unsigned long iflag;
+
+        if (ctxp->txrdy) {
+                pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
+                              ctxp->txrdy_phys);
+                ctxp->txrdy = NULL;
+                ctxp->txrdy_phys = 0;
+        }
+        ctxp->state = LPFC_NVMET_STE_FREE;
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+        if (phba->sli4_hba.nvmet_io_wait_cnt) {
+                hbufp = &nvmebuf->hbuf;
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_io_wait_list,
+                                 nvmebuf, struct rqb_dmabuf,
+                                 hbuf.list);
+                phba->sli4_hba.nvmet_io_wait_cnt--;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
+                oxid = be16_to_cpu(fc_hdr->fh_ox_id);
+                tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+                payload = (uint32_t *)(nvmebuf->dbuf.virt);
+                size = nvmebuf->bytes_recv;
+                sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+                ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
+                memset(ctxp, 0, sizeof(ctxp->ctx));
+                ctxp->wqeq = NULL;
+                ctxp->txrdy = NULL;
+                ctxp->offset = 0;
+                ctxp->phba = phba;
+                ctxp->size = size;
+                ctxp->oxid = oxid;
+                ctxp->sid = sid;
+                ctxp->state = LPFC_NVMET_STE_RCV;
+                ctxp->entry_cnt = 1;
+                ctxp->flag = 0;
+                ctxp->ctxbuf = ctx_buf;
+                spin_lock_init(&ctxp->ctxlock);
+
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+                if (phba->ktime_on) {
+                        ctxp->ts_cmd_nvme = ktime_get_ns();
+                        ctxp->ts_isr_cmd = ctxp->ts_cmd_nvme;
+                        ctxp->ts_nvme_data = 0;
+                        ctxp->ts_data_wqput = 0;
+                        ctxp->ts_isr_data = 0;
+                        ctxp->ts_data_nvme = 0;
+                        ctxp->ts_nvme_status = 0;
+                        ctxp->ts_status_wqput = 0;
+                        ctxp->ts_isr_status = 0;
+                        ctxp->ts_status_nvme = 0;
                 }
-                ctxp->state = LPFC_NVMET_STE_FREE;
+#endif
+                atomic_inc(&tgtp->rcv_fcp_cmd_in);
+                /*
+                 * The calling sequence should be:
+                 * nvmet_fc_rcv_fcp_req->lpfc_nvmet_xmt_fcp_op/cmp- req->done
+                 * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+                 * When we return from nvmet_fc_rcv_fcp_req, all relevant info
+                 * the NVME command / FC header is stored.
+                 * A buffer has already been reposted for this IO, so just free
+                 * the nvmebuf.
+                 */
+                rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
+                                          payload, size);
+
+                /* Process FCP command */
+                if (rc == 0) {
+                        atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                        nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                        return;
+                }
+
+                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
+                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
+                                "2582 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                                ctxp->oxid, rc,
+                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                atomic_read(&tgtp->xmt_fcp_release));
+
+                lpfc_nvmet_defer_release(phba, ctxp);
+                lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                return;
         }
-        lpfc_rq_buf_free(phba, mp);
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        list_add_tail(&ctx_buf->list,
+                      &phba->sli4_hba.lpfc_nvmet_ctx_list);
+        phba->sli4_hba.nvmet_ctx_cnt++;
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
+#endif
 }
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -502,6 +591,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
                                 "6150 LS Drop IO x%x: Prep\n",
                                 ctxp->oxid);
                 lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+                atomic_inc(&nvmep->xmt_ls_abort);
                 lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp,
                                                 ctxp->sid, ctxp->oxid);
                 return -ENOMEM;
@@ -545,6 +635,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
         lpfc_nlp_put(nvmewqeq->context1);
 
         lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+        atomic_inc(&nvmep->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, ctxp->sid, ctxp->oxid);
         return -ENXIO;
 }
@@ -612,9 +703,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP CMND: xri x%x op x%x len x%x\n",
                          ctxp->oxid, rsp->op, rsp->rsplen);
 
+        ctxp->flag |= LPFC_NVMET_IO_INP;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, nvmewqeq);
         if (rc == WQE_SUCCESS) {
-                ctxp->flag |= LPFC_NVMET_IO_INP;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
                 if (!phba->ktime_on)
                         return 0;
@@ -692,6 +783,7 @@ static void
 lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
                            struct nvmefc_tgt_fcp_req *rsp)
 {
+        struct lpfc_nvmet_tgtport *lpfc_nvmep = tgtport->private;
         struct lpfc_nvmet_rcv_ctx *ctxp =
                 container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
         struct lpfc_hba *phba = ctxp->phba;
@@ -707,13 +799,15 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         }
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
 
-        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
-                         ctxp->state, 0);
+        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d abt %d\n", ctxp->oxid,
+                         ctxp->state, aborting);
+
+        atomic_inc(&lpfc_nvmep->xmt_fcp_release);
 
         if (aborting)
                 return;
 
-        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
@@ -734,17 +828,128 @@ static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .target_priv_sz = sizeof(struct lpfc_nvmet_tgtport),
 };
 
+void
+lpfc_nvmet_cleanup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf, *next_ctx_buf;
+        unsigned long flags;
+
+        list_for_each_entry_safe(
+                ctx_buf, next_ctx_buf,
+                &phba->sli4_hba.lpfc_nvmet_ctx_list, list) {
+                spin_lock_irqsave(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                list_del_init(&ctx_buf->list);
+                spin_unlock_irqrestore(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                __lpfc_clear_active_sglq(phba,
+                                         ctx_buf->sglq->sli4_lxritag);
+                ctx_buf->sglq->state = SGL_FREED;
+                ctx_buf->sglq->ndlp = NULL;
+
+                spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
+                list_add_tail(&ctx_buf->sglq->list,
+                              &phba->sli4_hba.lpfc_nvmet_sgl_list);
+                spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+                                       flags);
+
+                lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                kfree(ctx_buf->context);
+        }
+}
+
+int
+lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
+        struct lpfc_iocbq *nvmewqe;
+        union lpfc_wqe128 *wqe;
+        int i;
+
+        lpfc_printf_log(phba, KERN_INFO, LOG_NVME,
+                        "6403 Allocate NVMET resources for %d XRIs\n",
+                        phba->sli4_hba.nvmet_xri_cnt);
+
+        /* For all nvmet xris, allocate resources needed to process a
+         * received command on a per xri basis.
+         */
+        for (i = 0; i < phba->sli4_hba.nvmet_xri_cnt; i++) {
+                ctx_buf = kzalloc(sizeof(*ctx_buf), GFP_KERNEL);
+                if (!ctx_buf) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6404 Ran out of memory for NVMET\n");
+                        return -ENOMEM;
+                }
+
+                ctx_buf->context = kzalloc(sizeof(*ctx_buf->context),
+                                           GFP_KERNEL);
+                if (!ctx_buf->context) {
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6405 Ran out of NVMET "
+                                        "context memory\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->context->ctxbuf = ctx_buf;
+
+                ctx_buf->iocbq = lpfc_sli_get_iocbq(phba);
+                if (!ctx_buf->iocbq) {
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6406 Ran out of NVMET iocb/WQEs\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
+                nvmewqe = ctx_buf->iocbq;
+                wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
+                /* Initialize WQE */
+                memset(wqe, 0, sizeof(union lpfc_wqe));
+                /* Word 7 */
+                bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
+                bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
+                bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
+                /* Word 10 */
+                bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
+                bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
+                bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
+
+                ctx_buf->iocbq->context1 = NULL;
+                spin_lock(&phba->sli4_hba.sgl_list_lock);
+                ctx_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, ctx_buf->iocbq);
+                spin_unlock(&phba->sli4_hba.sgl_list_lock);
+                if (!ctx_buf->sglq) {
+                        lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6407 Ran out of NVMET XRIs\n");
+                        return -ENOMEM;
+                }
+                spin_lock(&phba->sli4_hba.nvmet_io_lock);
+                list_add_tail(&ctx_buf->list,
+                              &phba->sli4_hba.lpfc_nvmet_ctx_list);
+                spin_unlock(&phba->sli4_hba.nvmet_io_lock);
+        }
+        phba->sli4_hba.nvmet_ctx_cnt = phba->sli4_hba.nvmet_xri_cnt;
+        return 0;
+}
+
 int
 lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
 {
         struct lpfc_vport  *vport = phba->pport;
         struct lpfc_nvmet_tgtport *tgtp;
         struct nvmet_fc_port_info pinfo;
-        int error = 0;
+        int error;
 
         if (phba->targetport)
                 return 0;
 
+        error = lpfc_nvmet_setup_io_context(phba);
+        if (error)
+                return error;
+
         memset(&pinfo, 0, sizeof(struct nvmet_fc_port_info));
         pinfo.node_name = wwn_to_u64(vport->fc_nodename.u.wwn);
         pinfo.port_name = wwn_to_u64(vport->fc_portname.u.wwn);
@@ -772,13 +977,16 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                                              &phba->pcidev->dev,
                                              &phba->targetport);
 #else
-        error = -ENOMEM;
+        error = -ENOENT;
 #endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
                                 "x%x\n", error);
                 phba->targetport = NULL;
+
+                lpfc_nvmet_cleanup_io_context(phba);
+
         } else {
                 tgtp = (struct lpfc_nvmet_tgtport *)
                         phba->targetport->private;
@@ -795,6 +1003,7 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -802,18 +1011,21 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return error;
 }
@@ -864,7 +1076,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 /* Check if we already received a free context call
@@ -885,7 +1097,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                     (ndlp->nlp_state == NLP_STE_UNMAPPED_NODE ||
                      ndlp->nlp_state == NLP_STE_MAPPED_NODE)) {
                         lpfc_set_rrq_active(phba, ndlp,
-                                ctxp->rqb_buffer->sglq->sli4_lxritag,
+                                ctxp->ctxbuf->sglq->sli4_lxritag,
                                 rxid, 1);
                         lpfc_sli4_abts_err_handler(phba, ndlp, axri);
                 }
@@ -894,8 +1106,8 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                                 "6318 XB aborted %x flg x%x (%x)\n",
                                 ctxp->oxid, ctxp->flag, released);
                 if (released)
-                        lpfc_nvmet_rq_post(phba, ctxp,
-                                           &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
+
                 if (rrq_empty)
                         lpfc_worker_wake_up(phba);
                 return;
@@ -923,7 +1135,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
@@ -975,6 +1187,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 init_completion(&tgtp->tport_unreg_done);
                 nvmet_fc_unregister_targetport(phba->targetport);
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
 #endif
@@ -1010,6 +1223,7 @@ lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
@@ -1104,39 +1318,71 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
         uint32_t *payload;
-        uint32_t size, oxid, sid, rc;
+        uint32_t size, oxid, sid, rc, qno;
+        unsigned long iflag;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint32_t id;
 #endif
 
+        ctx_buf = NULL;
         if (!nvmebuf || !phba->targetport) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6157 FCP Drop IO\n");
+                                "6157 NVMET FCP Drop IO\n");
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        if (phba->sli4_hba.nvmet_ctx_cnt) {
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_ctx_list,
+                                 ctx_buf, struct lpfc_nvmet_ctxbuf, list);
+                phba->sli4_hba.nvmet_ctx_cnt--;
+        }
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
 
-        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        payload = (uint32_t *)(nvmebuf->dbuf.virt);
         fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
-        size = nvmebuf->bytes_recv;
         oxid = be16_to_cpu(fc_hdr->fh_ox_id);
-        sid = sli4_sid_from_fc_hdr(fc_hdr);
+        size = nvmebuf->bytes_recv;
 
-        ctxp = (struct lpfc_nvmet_rcv_ctx *)nvmebuf->context;
-        if (ctxp == NULL) {
-                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6158 FCP Drop IO x%x: Alloc\n",
-                                oxid);
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-                /* Cannot send ABTS without context */
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
+                id = smp_processor_id();
+                if (id < LPFC_CHECK_CPU_CNT)
+                        phba->cpucheck_rcv_io[id]++;
+        }
+#endif
+
+        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
+                         oxid, size, smp_processor_id());
+
+        if (!ctx_buf) {
+                /* Queue this NVME IO to process later */
+                spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+                list_add_tail(&nvmebuf->hbuf.list,
+                              &phba->sli4_hba.lpfc_nvmet_io_wait_list);
+                phba->sli4_hba.nvmet_io_wait_cnt++;
+                phba->sli4_hba.nvmet_io_wait_total++;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                /* Post a brand new DMA buffer to RQ */
+                qno = nvmebuf->idx;
+                lpfc_post_rq_buffer(
+                        phba, phba->sli4_hba.nvmet_mrq_hdr[qno],
+                        phba->sli4_hba.nvmet_mrq_data[qno], 1, qno);
                 return;
         }
+
+        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+        payload = (uint32_t *)(nvmebuf->dbuf.virt);
+        sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+        ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
         memset(ctxp, 0, sizeof(ctxp->ctx));
         ctxp->wqeq = NULL;
         ctxp->txrdy = NULL;
@@ -1146,9 +1392,9 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         ctxp->oxid = oxid;
         ctxp->sid = sid;
         ctxp->state = LPFC_NVMET_STE_RCV;
-        ctxp->rqb_buffer = nvmebuf;
         ctxp->entry_cnt = 1;
         ctxp->flag = 0;
+        ctxp->ctxbuf = ctx_buf;
         spin_lock_init(&ctxp->ctxlock);
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -1164,22 +1410,16 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 ctxp->ts_isr_status = 0;
                 ctxp->ts_status_nvme = 0;
         }
-
-        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
-                id = smp_processor_id();
-                if (id < LPFC_CHECK_CPU_CNT)
-                        phba->cpucheck_rcv_io[id]++;
-        }
 #endif
 
-        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
-                         oxid, size, smp_processor_id());
-
         atomic_inc(&tgtp->rcv_fcp_cmd_in);
         /*
          * The calling sequence should be:
          * nvmet_fc_rcv_fcp_req -> lpfc_nvmet_xmt_fcp_op/cmp -> req->done
          * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+         * When we return from nvmet_fc_rcv_fcp_req, all relevant info in
+         * the NVME command / FC header is stored, so we are free to repost
+         * the buffer.
          */
         rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
                                   payload, size);
@@ -1187,26 +1427,32 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         /* Process FCP command */
         if (rc == 0) {
                 atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: err x%x\n",
-                        ctxp->oxid, rc);
+                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                        ctxp->oxid, rc,
+                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                        atomic_read(&tgtp->xmt_fcp_release));
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
                          oxid, size, sid);
         if (oxid) {
+                lpfc_nvmet_defer_release(phba, ctxp);
                 lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
-        if (nvmebuf) {
-                nvmebuf->iocbq->hba_wqidx = 0;
-                /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-        }
+        if (ctx_buf)
+                lpfc_nvmet_ctxbuf_post(phba, ctx_buf);
+
+        if (nvmebuf)
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
 #endif
 }
 
@@ -1258,7 +1504,7 @@ lpfc_nvmet_unsol_fcp_event(struct lpfc_hba *phba,
                            uint64_t isr_timestamp)
 {
         if (phba->nvmet_support == 0) {
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf);
                 return;
         }
         lpfc_nvmet_unsol_fcp_buffer(phba, pring, nvmebuf,
@@ -1459,7 +1705,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
         nvmewqe = ctxp->wqeq;
         if (nvmewqe == NULL) {
                 /* Allocate buffer for  command wqe */
-                nvmewqe = ctxp->rqb_buffer->iocbq;
+                nvmewqe = ctxp->ctxbuf->iocbq;
                 if (nvmewqe == NULL) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                         "6110 lpfc_nvmet_prep_fcp_wqe: No "
@@ -1486,7 +1732,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
                 return NULL;
         }
 
-        sgl  = (struct sli4_sge *)ctxp->rqb_buffer->sglq->sgl;
+        sgl  = (struct sli4_sge *)ctxp->ctxbuf->sglq->sgl;
         switch (rsp->op) {
         case NVMET_FCOP_READDATA:
         case NVMET_FCOP_READDATA_RSP:
@@ -1811,7 +2057,8 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         ctxp->state = LPFC_NVMET_STE_DONE;
 
@@ -1826,6 +2073,7 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
                         "6165 ABORT cmpl: xri x%x flg x%x (%d) "
@@ -1834,15 +2082,16 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
 
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+        /* This is the iocbq for the abort, not the command */
         lpfc_sli_release_iocbq(phba, cmdwqe);
 
         /* Since iaab/iaar are NOT set, there is no work left.
@@ -1876,7 +2125,8 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         if (!ctxp) {
                 /* if context is clear, related io alrady complete */
@@ -1906,6 +2156,7 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6316 ABTS cmpl xri x%x flg x%x (%x) "
@@ -1913,15 +2164,15 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         ctxp->oxid, ctxp->flag, released,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
+
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
-
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
         /* Since iaab/iaar are NOT set, there is no work left.
          * For LPFC_NVMET_XBUSY, lpfc_sli4_nvmet_xri_aborted
@@ -1952,7 +2203,7 @@ lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        atomic_inc(&tgtp->xmt_ls_abort_cmpl);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6083 Abort cmpl: ctx %p WCQE: %08x %08x %08x %08x\n",
@@ -1983,10 +2234,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                         sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
-                ctxp->wqeq->hba_wqidx = 0;
-        }
 
         ndlp = lpfc_findnode_did(phba->pport, sid);
         if (!ndlp || !NLP_CHK_NODE_ACT(ndlp) ||
@@ -2082,7 +2329,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2103,6 +2350,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Issue ABTS for this WQE based on iotag */
         ctxp->abort_wqeq = lpfc_sli_get_iocbq(phba);
         if (!ctxp->abort_wqeq) {
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6161 ABORT failed: No wqeqs: "
                                 "xri: x%x\n", ctxp->oxid);
@@ -2127,6 +2375,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* driver queued commands are in process of being flushed */
         if (phba->hba_flag & HBA_NVME_IOQ_FLUSH) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6163 Driver in reset cleanup - flushing "
                                 "NVME Req now. hba_flag x%x oxid x%x\n",
@@ -2139,6 +2388,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Outstanding abort is in progress */
         if (abts_wqeq->iocb_flag & LPFC_DRIVER_ABORTED) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6164 Outstanding NVME I/O Abort Request "
                                 "still pending on oxid x%x\n",
@@ -2189,9 +2439,12 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         abts_wqeq->context2 = ctxp;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
-        if (rc == WQE_SUCCESS)
+        if (rc == WQE_SUCCESS) {
+                atomic_inc(&tgtp->xmt_abort_sol);
                 return 0;
+        }
 
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         lpfc_sli_release_iocbq(phba, abts_wqeq);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
@@ -2214,7 +2467,7 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2230,11 +2483,11 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
                 return 0;
         }
 
 aerr:
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         atomic_inc(&tgtp->xmt_abort_rsp_error);
         lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
@@ -2269,6 +2522,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         }
         abts_wqeq = ctxp->wqeq;
         wqe_abts = &abts_wqeq->wqe;
+
         lpfc_nvmet_unsol_issue_abort(phba, ctxp, sid, xri);
 
         spin_lock_irqsave(&phba->hbalock, flags);
@@ -2278,7 +2532,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_ELS_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
+                atomic_inc(&tgtp->xmt_abort_unsol);
                 return 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 128759fe6650..6eb2f5d8d4ed 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -22,6 +22,7 @@
  ********************************************************************/
 
 #define LPFC_NVMET_DEFAULT_SEGS         (64 + 1)        /* 256K IOs */
+#define LPFC_NVMET_RQE_DEF_COUNT        512
 #define LPFC_NVMET_SUCCESS_LEN  12
 
 /* Used for NVME Target */
@@ -34,6 +35,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_ls_req_out;
         atomic_t rcv_ls_req_drop;
         atomic_t xmt_ls_abort;
+        atomic_t xmt_ls_abort_cmpl;
 
         /* Stats counters - lpfc_nvmet_xmt_ls_rsp */
         atomic_t xmt_ls_rsp;
@@ -47,9 +49,9 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
-        atomic_t xmt_fcp_abort;
         atomic_t xmt_fcp_drop;
         atomic_t xmt_fcp_read_rsp;
         atomic_t xmt_fcp_read;
@@ -62,12 +64,13 @@ struct lpfc_nvmet_tgtport {
         atomic_t xmt_fcp_rsp_drop;
 
 
-        /* Stats counters - lpfc_nvmet_unsol_issue_abort */
+        /* Stats counters - lpfc_nvmet_xmt_fcp_abort */
+        atomic_t xmt_fcp_abort;
+        atomic_t xmt_fcp_abort_cmpl;
+        atomic_t xmt_abort_sol;
+        atomic_t xmt_abort_unsol;
         atomic_t xmt_abort_rsp;
         atomic_t xmt_abort_rsp_error;
-
-        /* Stats counters - lpfc_nvmet_xmt_abort_cmp */
-        atomic_t xmt_abort_cmpl;
 };
 
 struct lpfc_nvmet_rcv_ctx {
@@ -103,6 +106,7 @@ struct lpfc_nvmet_rcv_ctx {
 #define LPFC_NVMET_CTX_RLS              0x8  /* ctx free requested */
 #define LPFC_NVMET_ABTS_RCV             0x10  /* ABTS received on exchange */
         struct rqb_dmabuf *rqb_buffer;
+        struct lpfc_nvmet_ctxbuf *ctxbuf;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint64_t ts_isr_cmd;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 2a4fc00dfa9b..d6b184839bc2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -74,6 +74,8 @@ static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *,
                                                          struct lpfc_iocbq *);
 static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *,
                                       struct hbq_dmabuf *);
+static void lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                                          struct hbq_dmabuf *dmabuf);
 static int lpfc_sli4_fp_handle_cqe(struct lpfc_hba *, struct lpfc_queue *,
                                     struct lpfc_cqe *);
 static int lpfc_sli4_post_sgl_list(struct lpfc_hba *, struct list_head *,
@@ -479,22 +481,23 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         if (unlikely(!hq) || unlikely(!dq))
                 return -ENOMEM;
         put_index = hq->host_index;
-        temp_hrqe = hq->qe[hq->host_index].rqe;
+        temp_hrqe = hq->qe[put_index].rqe;
         temp_drqe = dq->qe[dq->host_index].rqe;
 
         if (hq->type != LPFC_HRQ || dq->type != LPFC_DRQ)
                 return -EINVAL;
-        if (hq->host_index != dq->host_index)
+        if (put_index != dq->host_index)
                 return -EINVAL;
         /* If the host has not yet processed the next entry then we are done */
-        if (((hq->host_index + 1) % hq->entry_count) == hq->hba_index)
+        if (((put_index + 1) % hq->entry_count) == hq->hba_index)
                 return -EBUSY;
         lpfc_sli_pcimem_bcopy(hrqe, temp_hrqe, hq->entry_size);
         lpfc_sli_pcimem_bcopy(drqe, temp_drqe, dq->entry_size);
 
         /* Update the host index to point to the next slot */
-        hq->host_index = ((hq->host_index + 1) % hq->entry_count);
+        hq->host_index = ((put_index + 1) % hq->entry_count);
         dq->host_index = ((dq->host_index + 1) % dq->entry_count);
+        hq->RQ_buf_posted++;
 
         /* Ring The Header Receive Queue Doorbell */
         if (!(hq->host_index % hq->entry_repost)) {
@@ -5906,7 +5909,7 @@ lpfc_set_features(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox,
                 bf_set(lpfc_mbx_set_feature_mds,
                        &mbox->u.mqe.un.set_feature, 1);
                 bf_set(lpfc_mbx_set_feature_mds_deep_loopbk,
-                       &mbox->u.mqe.un.set_feature, 0);
+                       &mbox->u.mqe.un.set_feature, 1);
                 mbox->u.mqe.un.set_feature.feature = LPFC_SET_MDS_DIAGS;
                 mbox->u.mqe.un.set_feature.param_len = 8;
                 break;
@@ -6512,6 +6515,50 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
                  (phba->hba_flag & HBA_FCOE_MODE) ? "FCoE" : "FC");
 }
 
+int
+lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                    struct lpfc_queue *drq, int count, int idx)
+{
+        int rc, i;
+        struct lpfc_rqe hrqe;
+        struct lpfc_rqe drqe;
+        struct lpfc_rqb *rqbp;
+        struct rqb_dmabuf *rqb_buffer;
+        LIST_HEAD(rqb_buf_list);
+
+        rqbp = hrq->rqbp;
+        for (i = 0; i < count; i++) {
+                /* IF RQ is already full, don't bother */
+                if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+                        break;
+                rqb_buffer = rqbp->rqb_alloc_buffer(phba);
+                if (!rqb_buffer)
+                        break;
+                rqb_buffer->hrq = hrq;
+                rqb_buffer->drq = drq;
+                rqb_buffer->idx = idx;
+                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
+        }
+        while (!list_empty(&rqb_buf_list)) {
+                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
+                                 hbuf.list);
+
+                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
+                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
+                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
+                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
+                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
+                if (rc < 0) {
+                        rqbp->rqb_free_buffer(phba, rqb_buffer);
+                } else {
+                        list_add_tail(&rqb_buffer->hbuf.list,
+                                      &rqbp->rqb_buffer_list);
+                        rqbp->buffer_count++;
+                }
+        }
+        return 1;
+}
+
 /**
  * lpfc_sli4_hba_setup - SLI4 device initialization PCI function
  * @phba: Pointer to HBA context object.
@@ -6524,7 +6571,7 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 int
 lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 {
-        int rc, i;
+        int rc, i, cnt;
         LPFC_MBOXQ_t *mboxq;
         struct lpfc_mqe *mqe;
         uint8_t *vpd;
@@ -6875,6 +6922,21 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                         goto out_destroy_queue;
                 }
                 phba->sli4_hba.nvmet_xri_cnt = rc;
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* We need 1 iocbq for every SGL, for IO processing */
+                cnt += phba->sli4_hba.nvmet_xri_cnt;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2821 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "1413 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
+
                 lpfc_nvmet_create_targetport(phba);
         } else {
                 /* update host scsi xri-sgl sizes and mappings */
@@ -6894,28 +6956,34 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                                         "and mapping: %d\n", rc);
                         goto out_destroy_queue;
                 }
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2820 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "6301 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
         }
 
         if (phba->nvmet_support && phba->cfg_nvmet_mrq) {
-
                 /* Post initial buffers to all RQs created */
                 for (i = 0; i < phba->cfg_nvmet_mrq; i++) {
                         rqbp = phba->sli4_hba.nvmet_mrq_hdr[i]->rqbp;
                         INIT_LIST_HEAD(&rqbp->rqb_buffer_list);
                         rqbp->rqb_alloc_buffer = lpfc_sli4_nvmet_alloc;
                         rqbp->rqb_free_buffer = lpfc_sli4_nvmet_free;
-                        rqbp->entry_count = 256;
+                        rqbp->entry_count = LPFC_NVMET_RQE_DEF_COUNT;
                         rqbp->buffer_count = 0;
 
-                        /* Divide by 4 and round down to multiple of 16 */
-                        rc = (phba->cfg_nvmet_mrq_post >> 2) & 0xfff8;
-                        phba->sli4_hba.nvmet_mrq_hdr[i]->entry_repost = rc;
-                        phba->sli4_hba.nvmet_mrq_data[i]->entry_repost = rc;
-
                         lpfc_post_rq_buffer(
                                 phba, phba->sli4_hba.nvmet_mrq_hdr[i],
                                 phba->sli4_hba.nvmet_mrq_data[i],
-                                phba->cfg_nvmet_mrq_post);
+                                LPFC_NVMET_RQE_DEF_COUNT, i);
                 }
         }
 
@@ -7082,6 +7150,7 @@ out_unset_queue:
         /* Unset all the queues set up in this routine when error out */
         lpfc_sli4_queue_unset(phba);
 out_destroy_queue:
+        lpfc_free_iocb_list(phba);
         lpfc_sli4_queue_destroy(phba);
 out_stop_timers:
         lpfc_stop_hba_timers(phba);
@@ -8621,8 +8690,11 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 memset(wqe, 0, sizeof(union lpfc_wqe128));
         /* Some of the fields are in the right position already */
         memcpy(wqe, &iocbq->iocb, sizeof(union lpfc_wqe));
-        wqe->generic.wqe_com.word7 = 0; /* The ct field has moved so reset */
-        wqe->generic.wqe_com.word10 = 0;
+        if (iocbq->iocb.ulpCommand != CMD_SEND_FRAME) {
+                /* The ct field has moved so reset */
+                wqe->generic.wqe_com.word7 = 0;
+                wqe->generic.wqe_com.word10 = 0;
+        }
 
         abort_tag = (uint32_t) iocbq->iotag;
         xritag = iocbq->sli4_xritag;
@@ -9116,6 +9188,10 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 }
 
                 break;
+        case CMD_SEND_FRAME:
+                bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag);
+                bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag);
+                return 0;
         case CMD_XRI_ABORTED_CX:
         case CMD_CREATE_XRI_CR: /* Do we expect to use this? */
         case CMD_IOCB_FCP_IBIDIR64_CR: /* bidirectional xfer */
@@ -12788,6 +12864,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         struct fc_frame_header *fc_hdr;
         struct lpfc_queue *hrq = phba->sli4_hba.hdr_rq;
         struct lpfc_queue *drq = phba->sli4_hba.dat_rq;
+        struct lpfc_nvmet_tgtport *tgtp;
         struct hbq_dmabuf *dma_buf;
         uint32_t status, rq_id;
         unsigned long iflags;
@@ -12808,7 +12885,6 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "2537 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12819,6 +12895,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                         goto out;
                 }
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 memcpy(&dma_buf->cq_event.cqe.rcqe_cmpl, rcqe, sizeof(*rcqe));
 
                 /* If a NVME LS event (type 0x28), treat it as Fast path */
@@ -12832,8 +12909,21 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6402 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12951,7 +13041,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                 while ((cqe = lpfc_sli4_cq_get(cq))) {
                         workposted |= lpfc_sli4_sp_handle_mcqe(phba, cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                         cq->CQ_mbox++;
                 }
                 break;
@@ -12965,7 +13055,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                                 workposted |= lpfc_sli4_sp_handle_cqe(phba, cq,
                                                                       cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                 }
 
                 /* Track the max number of CQEs processed in 1 EQ */
@@ -13135,6 +13225,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         struct lpfc_queue *drq;
         struct rqb_dmabuf *dma_buf;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_tgtport *tgtp;
         uint32_t status, rq_id;
         unsigned long iflags;
         uint32_t fctl, idx;
@@ -13165,8 +13256,6 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "6126 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
-                break;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -13178,6 +13267,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
                 }
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 fc_hdr = (struct fc_frame_header *)dma_buf->hbuf.virt;
 
                 /* Just some basic sanity checks on FCP Command frame */
@@ -13200,14 +13290,23 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
 drop:
                 lpfc_in_buf_free(phba, &dma_buf->dbuf);
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6401 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
-                spin_lock_irqsave(&phba->hbalock, iflags);
-                phba->hba_flag |= HBA_POST_RECEIVE_BUFFER;
-                spin_unlock_irqrestore(&phba->hbalock, iflags);
-                workposted = true;
                 break;
         }
 out:
@@ -13361,7 +13460,7 @@ process_cq:
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13452,7 +13551,7 @@ lpfc_sli4_fof_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe)
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13534,7 +13633,7 @@ lpfc_sli4_fof_intr_handler(int irq, void *dev_id)
         while ((eqe = lpfc_sli4_eq_get(eq))) {
                 lpfc_sli4_fof_handle_eqe(phba, eqe);
                 if (!(++ecount % eq->entry_repost))
-                        lpfc_sli4_eq_release(eq, LPFC_QUEUE_NOARM);
+                        break;
                 eq->EQ_processed++;
         }
 
@@ -13651,7 +13750,7 @@ lpfc_sli4_hba_intr_handler(int irq, void *dev_id)
 
                 lpfc_sli4_hba_handle_eqe(phba, eqe, hba_eqidx);
                 if (!(++ecount % fpeq->entry_repost))
-                        lpfc_sli4_eq_release(fpeq, LPFC_QUEUE_NOARM);
+                        break;
                 fpeq->EQ_processed++;
         }
 
@@ -13832,17 +13931,10 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t entry_size,
         }
         queue->entry_size = entry_size;
         queue->entry_count = entry_count;
-
-        /*
-         * entry_repost is calculated based on the number of entries in the
-         * queue. This works out except for RQs. If buffers are NOT initially
-         * posted for every RQE, entry_repost should be adjusted accordingly.
-         */
-        queue->entry_repost = (entry_count >> 3);
-        if (queue->entry_repost < LPFC_QUEUE_MIN_REPOST)
-                queue->entry_repost = LPFC_QUEUE_MIN_REPOST;
         queue->phba = phba;
 
+        /* entry_repost will be set during q creation */
+
         return queue;
 out_fail:
         lpfc_sli4_queue_free(queue);
@@ -14073,6 +14165,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                 status = -ENXIO;
         eq->host_index = 0;
         eq->hba_index = 0;
+        eq->entry_repost = LPFC_EQ_REPOST;
 
         mempool_free(mbox, phba->mbox_mem_pool);
         return status;
@@ -14146,9 +14239,9 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "0361 Unsupported CQ count: "
-                                "entry cnt %d sz %d pg cnt %d repost %d\n",
+                                "entry cnt %d sz %d pg cnt %d\n",
                                 cq->entry_count, cq->entry_size,
-                                cq->page_count, cq->entry_repost);
+                                cq->page_count);
                 if (cq->entry_count < 256) {
                         status = -EINVAL;
                         goto out;
@@ -14201,6 +14294,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         cq->assoc_qid = eq->queue_id;
         cq->host_index = 0;
         cq->hba_index = 0;
+        cq->entry_repost = LPFC_CQ_REPOST;
 
 out:
         mempool_free(mbox, phba->mbox_mem_pool);
@@ -14392,6 +14486,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                 cq->assoc_qid = eq->queue_id;
                 cq->host_index = 0;
                 cq->hba_index = 0;
+                cq->entry_repost = LPFC_CQ_REPOST;
 
                 rc = 0;
                 list_for_each_entry(dmabuf, &cq->page_list, list) {
@@ -14640,6 +14735,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
         mq->subtype = subtype;
         mq->host_index = 0;
         mq->hba_index = 0;
+        mq->entry_repost = LPFC_MQ_REPOST;
 
         /* link the mq onto the parent cq child list */
         list_add_tail(&mq->list, &cq->child_list);
@@ -14865,34 +14961,6 @@ out:
 }
 
 /**
- * lpfc_rq_adjust_repost - Adjust entry_repost for an RQ
- * @phba: HBA structure that indicates port to create a queue on.
- * @rq:   The queue structure to use for the receive queue.
- * @qno:  The associated HBQ number
- *
- *
- * For SLI4 we need to adjust the RQ repost value based on
- * the number of buffers that are initially posted to the RQ.
- */
-void
-lpfc_rq_adjust_repost(struct lpfc_hba *phba, struct lpfc_queue *rq, int qno)
-{
-        uint32_t cnt;
-
-        /* sanity check on queue memory */
-        if (!rq)
-                return;
-        cnt = lpfc_hbq_defs[qno]->entry_count;
-
-        /* Recalc repost for RQs based on buffers initially posted */
-        cnt = (cnt >> 3);
-        if (cnt < LPFC_QUEUE_MIN_REPOST)
-                cnt = LPFC_QUEUE_MIN_REPOST;
-
-        rq->entry_repost = cnt;
-}
-
-/**
  * lpfc_rq_create - Create a Receive Queue on the HBA
  * @phba: HBA structure that indicates port to create a queue on.
  * @hrq: The queue structure to use to create the header receive queue.
@@ -15077,6 +15145,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         hrq->subtype = subtype;
         hrq->host_index = 0;
         hrq->hba_index = 0;
+        hrq->entry_repost = LPFC_RQ_REPOST;
 
         /* now create the data queue */
         lpfc_sli4_config(phba, mbox, LPFC_MBOX_SUBSYSTEM_FCOE,
@@ -15087,7 +15156,12 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         if (phba->sli4_hba.pc_sli4_params.rqv == LPFC_Q_CREATE_VERSION_1) {
                 bf_set(lpfc_rq_context_rqe_count_1,
                        &rq_create->u.request.context, hrq->entry_count);
-                rq_create->u.request.context.buffer_size = LPFC_DATA_BUF_SIZE;
+                if (subtype == LPFC_NVMET)
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_NVMET_DATA_BUF_SIZE;
+                else
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_DATA_BUF_SIZE;
                 bf_set(lpfc_rq_context_rqe_size, &rq_create->u.request.context,
                        LPFC_RQE_SIZE_8);
                 bf_set(lpfc_rq_context_page_size, &rq_create->u.request.context,
@@ -15124,8 +15198,14 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                LPFC_RQ_RING_SIZE_4096);
                         break;
                 }
-                bf_set(lpfc_rq_context_buf_size, &rq_create->u.request.context,
-                       LPFC_DATA_BUF_SIZE);
+                if (subtype == LPFC_NVMET)
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_NVMET_DATA_BUF_SIZE);
+                else
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_DATA_BUF_SIZE);
         }
         bf_set(lpfc_rq_context_cq_id, &rq_create->u.request.context,
                cq->queue_id);
@@ -15158,6 +15238,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         drq->subtype = subtype;
         drq->host_index = 0;
         drq->hba_index = 0;
+        drq->entry_repost = LPFC_RQ_REPOST;
 
         /* link the header and data RQs onto the parent cq child list */
         list_add_tail(&hrq->list, &cq->child_list);
@@ -15270,7 +15351,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                                cq->queue_id);
                         bf_set(lpfc_rq_context_data_size,
                                &rq_create->u.request.context,
-                               LPFC_DATA_BUF_SIZE);
+                               LPFC_NVMET_DATA_BUF_SIZE);
                         bf_set(lpfc_rq_context_hdr_size,
                                &rq_create->u.request.context,
                                LPFC_HDR_BUF_SIZE);
@@ -15315,6 +15396,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 hrq->subtype = subtype;
                 hrq->host_index = 0;
                 hrq->hba_index = 0;
+                hrq->entry_repost = LPFC_RQ_REPOST;
 
                 drq->db_format = LPFC_DB_RING_FORMAT;
                 drq->db_regaddr = phba->sli4_hba.RQDBregaddr;
@@ -15323,6 +15405,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq->subtype = subtype;
                 drq->host_index = 0;
                 drq->hba_index = 0;
+                drq->entry_repost = LPFC_RQ_REPOST;
 
                 list_add_tail(&hrq->list, &cq->child_list);
                 list_add_tail(&drq->list, &cq->child_list);
@@ -16063,6 +16146,8 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         struct fc_vft_header *fc_vft_hdr;
         uint32_t *header = (uint32_t *) fc_hdr;
 
+#define FC_RCTL_MDS_DIAGS       0xF4
+
         switch (fc_hdr->fh_r_ctl) {
         case FC_RCTL_DD_UNCAT:          /* uncategorized information */
         case FC_RCTL_DD_SOL_DATA:       /* solicited data */
@@ -16090,6 +16175,7 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         case FC_RCTL_F_BSY:     /* fabric busy to data frame */
         case FC_RCTL_F_BSYL:    /* fabric busy to link control frame */
         case FC_RCTL_LCR:       /* link credit reset */
+        case FC_RCTL_MDS_DIAGS: /* MDS Diagnostics */
         case FC_RCTL_END:       /* end */
                 break;
         case FC_RCTL_VFTH:      /* Virtual Fabric tagging Header */
@@ -16099,12 +16185,16 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         default:
                 goto drop;
         }
+
+#define FC_TYPE_VENDOR_UNIQUE   0xFF
+
         switch (fc_hdr->fh_type) {
         case FC_TYPE_BLS:
         case FC_TYPE_ELS:
         case FC_TYPE_FCP:
         case FC_TYPE_CT:
         case FC_TYPE_NVME:
+        case FC_TYPE_VENDOR_UNIQUE:
                 break;
         case FC_TYPE_IP:
         case FC_TYPE_ILS:
@@ -16115,12 +16205,14 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
                         "2538 Received frame rctl:%s (x%x), type:%s (x%x), "
                         "frame Data:%08x %08x %08x %08x %08x %08x %08x\n",
+                        (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS) ? "MDS Diags" :
                         lpfc_rctl_names[fc_hdr->fh_r_ctl], fc_hdr->fh_r_ctl,
-                        lpfc_type_names[fc_hdr->fh_type], fc_hdr->fh_type,
-                        be32_to_cpu(header[0]), be32_to_cpu(header[1]),
-                        be32_to_cpu(header[2]), be32_to_cpu(header[3]),
-                        be32_to_cpu(header[4]), be32_to_cpu(header[5]),
-                        be32_to_cpu(header[6]));
+                        (fc_hdr->fh_type == FC_TYPE_VENDOR_UNIQUE) ?
+                        "Vendor Unique" : lpfc_type_names[fc_hdr->fh_type],
+                        fc_hdr->fh_type, be32_to_cpu(header[0]),
+                        be32_to_cpu(header[1]), be32_to_cpu(header[2]),
+                        be32_to_cpu(header[3]), be32_to_cpu(header[4]),
+                        be32_to_cpu(header[5]), be32_to_cpu(header[6]));
         return 0;
 drop:
         lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
@@ -16926,6 +17018,96 @@ lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
         lpfc_sli_release_iocbq(phba, iocbq);
 }
 
+static void
+lpfc_sli4_mds_loopback_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                            struct lpfc_iocbq *rspiocb)
+{
+        struct lpfc_dmabuf *pcmd = cmdiocb->context2;
+
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, cmdiocb);
+}
+
+static void
+lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                              struct hbq_dmabuf *dmabuf)
+{
+        struct fc_frame_header *fc_hdr;
+        struct lpfc_hba *phba = vport->phba;
+        struct lpfc_iocbq *iocbq = NULL;
+        union  lpfc_wqe *wqe;
+        struct lpfc_dmabuf *pcmd = NULL;
+        uint32_t frame_len;
+        int rc;
+
+        fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+        frame_len = bf_get(lpfc_rcqe_length, &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+        /* Send the received frame back */
+        iocbq = lpfc_sli_get_iocbq(phba);
+        if (!iocbq)
+                goto exit;
+
+        /* Allocate buffer for command payload */
+        pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+        if (pcmd)
+                pcmd->virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
+                                            &pcmd->phys);
+        if (!pcmd || !pcmd->virt)
+                goto exit;
+
+        INIT_LIST_HEAD(&pcmd->list);
+
+        /* copyin the payload */
+        memcpy(pcmd->virt, dmabuf->dbuf.virt, frame_len);
+
+        /* fill in BDE's for command */
+        iocbq->iocb.un.xseq64.bdl.addrHigh = putPaddrHigh(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.addrLow = putPaddrLow(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.bdeFlags = BUFF_TYPE_BDE_64;
+        iocbq->iocb.un.xseq64.bdl.bdeSize = frame_len;
+
+        iocbq->context2 = pcmd;
+        iocbq->vport = vport;
+        iocbq->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK;
+        iocbq->iocb_flag |= LPFC_USE_FCPWQIDX;
+
+        /*
+         * Setup rest of the iocb as though it were a WQE
+         * Build the SEND_FRAME WQE
+         */
+        wqe = (union lpfc_wqe *)&iocbq->iocb;
+
+        wqe->send_frame.frame_len = frame_len;
+        wqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((uint32_t *)fc_hdr));
+        wqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((uint32_t *)fc_hdr + 1));
+        wqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((uint32_t *)fc_hdr + 2));
+        wqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((uint32_t *)fc_hdr + 3));
+        wqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((uint32_t *)fc_hdr + 4));
+        wqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((uint32_t *)fc_hdr + 5));
+
+        iocbq->iocb.ulpCommand = CMD_SEND_FRAME;
+        iocbq->iocb.ulpLe = 1;
+        iocbq->iocb_cmpl = lpfc_sli4_mds_loopback_cmpl;
+        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0);
+        if (rc == IOCB_ERROR)
+                goto exit;
+
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+        return;
+
+exit:
+        lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+                        "2023 Unable to process MDS loopback frame\n");
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, iocbq);
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+}
+
 /**
  * lpfc_sli4_handle_received_buffer - Handle received buffers from firmware
  * @phba: Pointer to HBA context object.
@@ -16964,6 +17146,13 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
                 fcfi = bf_get(lpfc_rcqe_fcf_id,
                               &dmabuf->cq_event.cqe.rcqe_cmpl);
 
+        if (fc_hdr->fh_r_ctl == 0xF4 && fc_hdr->fh_type == 0xFF) {
+                vport = phba->pport;
+                /* Handle MDS Loopback frames */
+                lpfc_sli4_handle_mds_loopback(vport, dmabuf);
+                return;
+        }
+
         /* d_id this frame is directed to */
         did = sli4_did_from_fc_hdr(fc_hdr);
 
@@ -17137,6 +17326,14 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page)
                                 "status x%x add_status x%x, mbx status x%x\n",
                                 shdr_status, shdr_add_status, rc);
                 rc = -ENXIO;
+        } else {
+                /*
+                 * The next_rpi stores the next logical module-64 rpi value used
+                 * to post physical rpis in subsequent rpi postings.
+                 */
+                spin_lock_irq(&phba->hbalock);
+                phba->sli4_hba.next_rpi = rpi_page->next_rpi;
+                spin_unlock_irq(&phba->hbalock);
         }
         return rc;
 }
@@ -18717,7 +18914,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, uint32_t ring_number,
 
                 spin_lock_irqsave(&pring->ring_lock, iflags);
                 ctxp = pwqe->context2;
-                sglq = ctxp->rqb_buffer->sglq;
+                sglq = ctxp->ctxbuf->sglq;
                 if (pwqe->sli4_xritag ==  NO_XRI) {
                         pwqe->sli4_lxritag = sglq->sli4_lxritag;
                         pwqe->sli4_xritag = sglq->sli4_xritag;
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index da46471337c8..cf863db27700 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -24,7 +24,6 @@
 #define LPFC_XRI_EXCH_BUSY_WAIT_TMO             10000
 #define LPFC_XRI_EXCH_BUSY_WAIT_T1              10
 #define LPFC_XRI_EXCH_BUSY_WAIT_T2              30000
-#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32
 #define LPFC_RPI_LOW_WATER_MARK                 10
 
 #define LPFC_UNREG_FCF                          1
@@ -155,7 +154,11 @@ struct lpfc_queue {
         uint32_t entry_count;   /* Number of entries to support on the queue */
         uint32_t entry_size;    /* Size of each queue entry. */
         uint32_t entry_repost;  /* Count of entries before doorbell is rung */
-#define LPFC_QUEUE_MIN_REPOST   8
+#define LPFC_EQ_REPOST          8
+#define LPFC_MQ_REPOST          8
+#define LPFC_CQ_REPOST          64
+#define LPFC_RQ_REPOST          64
+#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32  /* For WQs */
         uint32_t queue_id;      /* Queue ID assigned by the hardware */
         uint32_t assoc_qid;     /* Queue ID associated with, for CQ/WQ/MQ */
         uint32_t page_count;    /* Number of pages allocated for this queue */
@@ -195,7 +198,7 @@ struct lpfc_queue {
 /* defines for RQ stats */
 #define RQ_no_posted_buf        q_cnt_1
 #define RQ_no_buf_found         q_cnt_2
-#define RQ_buf_trunc            q_cnt_3
+#define RQ_buf_posted           q_cnt_3
 #define RQ_rcv_buf              q_cnt_4
 
         uint64_t isr_timestamp;
@@ -617,12 +620,17 @@ struct lpfc_sli4_hba {
         uint16_t scsi_xri_start;
         uint16_t els_xri_cnt;
         uint16_t nvmet_xri_cnt;
+        uint16_t nvmet_ctx_cnt;
+        uint16_t nvmet_io_wait_cnt;
+        uint16_t nvmet_io_wait_total;
         struct list_head lpfc_els_sgl_list;
         struct list_head lpfc_abts_els_sgl_list;
         struct list_head lpfc_nvmet_sgl_list;
         struct list_head lpfc_abts_nvmet_ctx_list;
         struct list_head lpfc_abts_scsi_buf_list;
         struct list_head lpfc_abts_nvme_buf_list;
+        struct list_head lpfc_nvmet_ctx_list;
+        struct list_head lpfc_nvmet_io_wait_list;
         struct lpfc_sglq **lpfc_sglq_active_list;
         struct list_head lpfc_rpi_hdr_list;
         unsigned long *rpi_bmask;
@@ -654,6 +662,7 @@ struct lpfc_sli4_hba {
         spinlock_t abts_scsi_buf_list_lock; /* list of aborted SCSI IOs */
         spinlock_t sgl_list_lock; /* list of aborted els IOs */
         spinlock_t nvmet_io_lock;
+        spinlock_t nvmet_io_wait_lock; /* IOs waiting for ctx resources */
         uint32_t physical_port;
 
         /* CPU to vector mapping information */
@@ -661,8 +670,6 @@ struct lpfc_sli4_hba {
         uint16_t num_online_cpu;
         uint16_t num_present_cpu;
         uint16_t curr_disp_cpu;
-
-        uint16_t nvmet_mrq_post_idx;
 };
 
 enum lpfc_sge_type {
@@ -698,6 +705,7 @@ struct lpfc_rpi_hdr {
         struct lpfc_dmabuf *dmabuf;
         uint32_t page_count;
         uint32_t start_rpi;
+        uint16_t next_rpi;
 };
 
 struct lpfc_rsrc_blks {
@@ -762,7 +770,6 @@ int lpfc_rq_create(struct lpfc_hba *, struct lpfc_queue *,
 int lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                         struct lpfc_queue **drqp, struct lpfc_queue **cqp,
                         uint32_t subtype);
-void lpfc_rq_adjust_repost(struct lpfc_hba *, struct lpfc_queue *, int);
 int lpfc_eq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_cq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_mq_destroy(struct lpfc_hba *, struct lpfc_queue *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 1c26dc67151b..c2653244221c 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.12"
+#define LPFC_DRIVER_VERSION "11.2.0.14"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index 5ca3e8c28a3f..32632c9b2276 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -38,7 +38,7 @@ struct qedi_endpoint;
 #define QEDI_MAX_ISCSI_TASK             4096
 #define QEDI_MAX_TASK_NUM               0x0FFF
 #define QEDI_MAX_ISCSI_CONNS_PER_HBA    1024
-#define QEDI_ISCSI_MAX_BDS_PER_CMD      256     /* Firmware max BDs is 256 */
+#define QEDI_ISCSI_MAX_BDS_PER_CMD      255     /* Firmware max BDs is 255 */
 #define MAX_OUSTANDING_TASKS_PER_CON    1024
 
 #define QEDI_MAX_BD_LEN         0xffff
@@ -63,6 +63,7 @@ struct qedi_endpoint;
 #define QEDI_PAGE_MASK          (~((QEDI_PAGE_SIZE) - 1))
 
 #define QEDI_PAGE_SIZE          4096
+#define QEDI_HW_DMA_BOUNDARY    0xfff
 #define QEDI_PATH_HANDLE        0xFE0000000UL
 
 struct qedi_uio_ctrl {
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index d6978cbc56f0..507512cc478b 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -870,7 +870,6 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Delayed or untracked cleanup response, itt=0x%x, tid=0x%x, cid=0x%x, task=%p\n",
                          protoitt, cqe->itid, qedi_conn->iscsi_conn_id, task);
-                WARN_ON(1);
         }
 }
 
@@ -1494,6 +1493,8 @@ static int qedi_send_iscsi_tmf(struct qedi_conn *qedi_conn,
         tmf_hdr = (struct iscsi_tm *)mtask->hdr;
         qedi_cmd = (struct qedi_cmd *)mtask->dd_data;
         ep = qedi_conn->ep;
+        if (!ep)
+                return -ENODEV;
 
         tid = qedi_get_task_idx(qedi);
         if (tid == -1)
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 3548d46f9b27..87f0af358b33 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -59,6 +59,7 @@ struct scsi_host_template qedi_host_template = {
         .this_id = -1,
         .sg_tablesize = QEDI_ISCSI_MAX_BDS_PER_CMD,
         .max_sectors = 0xffff,
+        .dma_boundary = QEDI_HW_DMA_BOUNDARY,
         .cmd_per_lun = 128,
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = qedi_shost_attrs,
@@ -1223,8 +1224,12 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
 
         iscsi_cid = (u32)path_data->handle;
         qedi_ep = qedi->ep_tbl[iscsi_cid];
-        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_CONN,
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "iscsi_cid=0x%x, qedi_ep=%p\n", iscsi_cid, qedi_ep);
+        if (!qedi_ep) {
+                ret = -EINVAL;
+                goto set_path_exit;
+        }
 
         if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
                 QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 92775a8b74b1..879d3b7462f9 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -151,6 +151,11 @@ static int qedi_uio_close(struct uio_info *uinfo, struct inode *inode)
 
 static void __qedi_free_uio_rings(struct qedi_uio_dev *udev)
 {
+        if (udev->uctrl) {
+                free_page((unsigned long)udev->uctrl);
+                udev->uctrl = NULL;
+        }
+
         if (udev->ll2_ring) {
                 free_page((unsigned long)udev->ll2_ring);
                 udev->ll2_ring = NULL;
@@ -169,7 +174,6 @@ static void __qedi_free_uio(struct qedi_uio_dev *udev)
         __qedi_free_uio_rings(udev);
 
         pci_dev_put(udev->pdev);
-        kfree(udev->uctrl);
         kfree(udev);
 }
 
@@ -208,6 +212,11 @@ static int __qedi_alloc_uio_rings(struct qedi_uio_dev *udev)
         if (udev->ll2_ring || udev->ll2_buf)
                 return rc;
 
+        /* Memory for control area.  */
+        udev->uctrl = (void *)get_zeroed_page(GFP_KERNEL);
+        if (!udev->uctrl)
+                return -ENOMEM;
+
         /* Allocating memory for LL2 ring  */
         udev->ll2_ring_size = QEDI_PAGE_SIZE;
         udev->ll2_ring = (void *)get_zeroed_page(GFP_KERNEL | __GFP_COMP);
@@ -237,7 +246,6 @@ exit_alloc_ring:
 static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
 {
         struct qedi_uio_dev *udev = NULL;
-        struct qedi_uio_ctrl *uctrl = NULL;
         int rc = 0;
 
         list_for_each_entry(udev, &qedi_udev_list, list) {
@@ -258,21 +266,14 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
                 goto err_udev;
         }
 
-        uctrl = kzalloc(sizeof(*uctrl), GFP_KERNEL);
-        if (!uctrl) {
-                rc = -ENOMEM;
-                goto err_uctrl;
-        }
-
         udev->uio_dev = -1;
 
         udev->qedi = qedi;
         udev->pdev = qedi->pdev;
-        udev->uctrl = uctrl;
 
         rc = __qedi_alloc_uio_rings(udev);
         if (rc)
-                goto err_uio_rings;
+                goto err_uctrl;
 
         list_add(&udev->list, &qedi_udev_list);
 
@@ -283,8 +284,6 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
         udev->rx_pkt = udev->ll2_buf + LL2_SINGLE_BUF_SIZE;
         return 0;
 
- err_uio_rings:
-        kfree(uctrl);
  err_uctrl:
         kfree(udev);
  err_udev:
@@ -828,6 +827,8 @@ static int qedi_set_iscsi_pf_param(struct qedi_ctx *qedi)
         qedi->pf_params.iscsi_pf_params.num_uhq_pages_in_ring = num_sq_pages;
         qedi->pf_params.iscsi_pf_params.num_queues = qedi->num_queues;
         qedi->pf_params.iscsi_pf_params.debug_mode = qedi_fw_debug;
+        qedi->pf_params.iscsi_pf_params.two_msl_timer = 4000;
+        qedi->pf_params.iscsi_pf_params.max_fin_rt = 2;
 
         for (log_page_size = 0 ; log_page_size < 32 ; log_page_size++) {
                 if ((1 << log_page_size) == PAGE_SIZE)
@@ -1498,11 +1499,9 @@ err_idx:
 
 void qedi_clear_task_idx(struct qedi_ctx *qedi, int idx)
 {
-        if (!test_and_clear_bit(idx, qedi->task_idx_map)) {
+        if (!test_and_clear_bit(idx, qedi->task_idx_map))
                 QEDI_ERR(&qedi->dbg_ctx,
                          "FW task context, already cleared, tid=0x%x\n", idx);
-                WARN_ON(1);
-        }
 }
 
 void qedi_update_itt_map(struct qedi_ctx *qedi, u32 tid, u32 proto_itt,
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 16d1cd50feed..ca3420de5a01 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -730,6 +730,8 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
                 return -EIO;
         }
 
+        memset(&elreq, 0, sizeof(elreq));
+
         elreq.req_sg_cnt = dma_map_sg(&ha->pdev->dev,
                 bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt,
                 DMA_TO_DEVICE);
@@ -795,10 +797,9 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
 
         if (atomic_read(&vha->loop_state) == LOOP_READY &&
             (ha->current_topology == ISP_CFG_F ||
-            ((IS_QLA81XX(ha) || IS_QLA8031(ha) || IS_QLA8044(ha)) &&
-            le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE
-            && req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
-                elreq.options == EXTERNAL_LOOPBACK) {
+            (le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE &&
+             req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
+            elreq.options == EXTERNAL_LOOPBACK) {
                 type = "FC_BSG_HST_VENDOR_ECHO_DIAG";
                 ql_dbg(ql_dbg_user, vha, 0x701e,
                     "BSG request type: %s.\n", type);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 51b4179469d1..88748a6ab73f 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -1131,7 +1131,7 @@ qla24xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
@@ -2090,7 +2090,7 @@ qla83xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ae119018dfaa..eddbc1218a39 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3425,6 +3425,7 @@ struct qla_hw_data {
         uint8_t         max_req_queues;
         uint8_t         max_rsp_queues;
         uint8_t         max_qpairs;
+        uint8_t         num_qpairs;
         struct qla_qpair *base_qpair;
         struct qla_npiv_entry *npiv_info;
         uint16_t        nvram_npiv_size;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 034743309ada..0391fc317003 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -7543,12 +7543,13 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, int v
                 /* Assign available que pair id */
                 mutex_lock(&ha->mq_lock);
                 qpair_id = find_first_zero_bit(ha->qpair_qid_map, ha->max_qpairs);
-                if (qpair_id >= ha->max_qpairs) {
+                if (ha->num_qpairs >= ha->max_qpairs) {
                         mutex_unlock(&ha->mq_lock);
                         ql_log(ql_log_warn, vha, 0x0183,
                             "No resources to create additional q pair.\n");
                         goto fail_qid_map;
                 }
+                ha->num_qpairs++;
                 set_bit(qpair_id, ha->qpair_qid_map);
                 ha->queue_pair_map[qpair_id] = qpair;
                 qpair->id = qpair_id;
@@ -7635,6 +7636,7 @@ fail_rsp:
 fail_msix:
         ha->queue_pair_map[qpair_id] = NULL;
         clear_bit(qpair_id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         mutex_unlock(&ha->mq_lock);
 fail_qid_map:
         kfree(qpair);
@@ -7660,6 +7662,7 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
         mutex_lock(&ha->mq_lock);
         ha->queue_pair_map[qpair->id] = NULL;
         clear_bit(qpair->id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         list_del(&qpair->qp_list_elem);
         if (list_empty(&vha->qp_list))
                 vha->flags.qpairs_available = 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 66df6cec59da..c61a6a871c8e 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -129,28 +129,16 @@ qla2x00_clear_loop_id(fc_port_t *fcport) {
 }
 
 static inline void
-qla2x00_clean_dsd_pool(struct qla_hw_data *ha, srb_t *sp,
-        struct qla_tgt_cmd *tc)
+qla2x00_clean_dsd_pool(struct qla_hw_data *ha, struct crc_context *ctx)
 {
-        struct dsd_dma *dsd_ptr, *tdsd_ptr;
-        struct crc_context *ctx;
-
-        if (sp)
-                ctx = (struct crc_context *)GET_CMD_CTX_SP(sp);
-        else if (tc)
-                ctx = (struct crc_context *)tc->ctx;
-        else {
-                BUG();
-                return;
-        }
+        struct dsd_dma *dsd, *tdsd;
 
         /* clean up allocated prev pool */
-        list_for_each_entry_safe(dsd_ptr, tdsd_ptr,
-            &ctx->dsd_list, list) {
-                dma_pool_free(ha->dl_dma_pool, dsd_ptr->dsd_addr,
-                    dsd_ptr->dsd_list_dma);
-                list_del(&dsd_ptr->list);
-                kfree(dsd_ptr);
+        list_for_each_entry_safe(dsd, tdsd, &ctx->dsd_list, list) {
+                dma_pool_free(ha->dl_dma_pool, dsd->dsd_addr,
+                    dsd->dsd_list_dma);
+                list_del(&dsd->list);
+                kfree(dsd);
         }
         INIT_LIST_HEAD(&ctx->dsd_list);
 }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index aac03504d9a3..2572121b765b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3282,7 +3282,7 @@ msix_register_fail:
         }
 
         /* Enable MSI-X vector for response queue update for queue 0 */
-        if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+        if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
                     (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 ||
                      ql2xmqsupport))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index a113ab3592a7..cba1fc5e8be9 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3676,15 +3676,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                 qlt_update_host_map(vha, id);
                         }
 
-                        fc_host_port_name(vha->host) =
-                            wwn_to_u64(vha->port_name);
-
-                        if (qla_ini_mode_enabled(vha))
-                                ql_dbg(ql_dbg_mbx, vha, 0x1018,
-                                    "FA-WWN portname %016llx (%x)\n",
-                                    fc_host_port_name(vha->host),
-                                    rptid_entry->vp_status);
-
                         set_bit(REGISTER_FC4_NEEDED, &vha->dpc_flags);
                         set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
                 } else {
@@ -4821,9 +4812,9 @@ qla2x00_echo_test(scsi_qla_host_t *vha, struct msg_echo_lb *mreq,
 
         memset(mcp->mb, 0 , sizeof(mcp->mb));
         mcp->mb[0] = MBC_DIAGNOSTIC_ECHO;
-        mcp->mb[1] = mreq->options | BIT_6;     /* BIT_6 specifies 64bit address */
+        /* BIT_6 specifies 64bit address */
+        mcp->mb[1] = mreq->options | BIT_15 | BIT_6;
         if (IS_CNA_CAPABLE(ha)) {
-                mcp->mb[1] |= BIT_15;
                 mcp->mb[2] = vha->fcoe_fcf_idx;
         }
         mcp->mb[16] = LSW(mreq->rcv_dma);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1c7957903283..79f050256c55 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -630,29 +630,34 @@ qla2x00_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx0, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
+                struct ct6_dsd *ctx1 = ctx;
 
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
-                        ctx1->fcp_cmnd_dma);
+                    ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
                 ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
 
+end:
         CMD_SP(cmd) = NULL;
         qla2x00_rel_sp(sp);
 }
@@ -699,21 +704,24 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
-
+                struct ct6_dsd *ctx1 = ctx;
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
                     ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
@@ -721,7 +729,7 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
-
+end:
         CMD_SP(cmd) = NULL;
         qla2xxx_rel_qpair_sp(sp->qpair, sp);
 }
@@ -1632,7 +1640,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 void
 qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
 {
-        int que, cnt;
+        int que, cnt, status;
         unsigned long flags;
         srb_t *sp;
         struct qla_hw_data *ha = vha->hw;
@@ -1662,8 +1670,12 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                          */
                                         sp_get(sp);
                                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                                        qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                        status = qla2xxx_eh_abort(GET_CMD_SP(sp));
                                         spin_lock_irqsave(&ha->hardware_lock, flags);
+                                        /* Get rid of extra reference if immediate exit
+                                         * from ql2xxx_eh_abort */
+                                        if (status == FAILED && (qla2x00_isp_reg_stat(ha)))
+                                                atomic_dec(&sp->ref_count);
                                 }
                                 req->outstanding_cmds[cnt] = NULL;
                                 sp->done(sp, res);
@@ -2623,10 +2635,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (mem_only) {
                 if (pci_enable_device_mem(pdev))
-                        goto probe_out;
+                        return ret;
         } else {
                 if (pci_enable_device(pdev))
-                        goto probe_out;
+                        return ret;
         }
 
         /* This may fail but that's ok */
@@ -2636,7 +2648,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!ha) {
                 ql_log_pci(ql_log_fatal, pdev, 0x0009,
                     "Unable to allocate memory for ha.\n");
-                goto probe_out;
+                goto disable_device;
         }
         ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
             "Memory allocated for ha=%p.\n", ha);
@@ -3254,7 +3266,7 @@ iospace_config_failed:
         pci_release_selected_regions(ha->pdev, ha->bars);
         kfree(ha);
 
-probe_out:
+disable_device:
         pci_disable_device(pdev);
         return ret;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0e03ca2ab3e5..e766d8412384 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2245,11 +2245,13 @@ static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                 pci_unmap_sg(ha->pdev, cmd->prot_sg, cmd->prot_sg_cnt,
                         cmd->dma_data_direction);
 
+        if (!cmd->ctx)
+                return;
+
         if (cmd->ctx_dsd_alloced)
-                qla2x00_clean_dsd_pool(ha, NULL, cmd);
+                qla2x00_clean_dsd_pool(ha, cmd->ctx);
 
-        if (cmd->ctx)
-                dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
+        dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
 }
 
 static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 8a58ef3adab4..c197972a3e2d 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -371,7 +371,7 @@ qla27xx_fwdt_entry_t262(struct scsi_qla_host *vha,
                 goto done;
         }
 
-        if (end <= start || start == 0 || end == 0) {
+        if (end < start || start == 0 || end == 0) {
                 ql_dbg(ql_dbg_misc, vha, 0xd023,
                     "%s: unusable range (start=%x end=%x)\n", __func__,
                     ent->t262.end_addr, ent->t262.start_addr);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 17249c3650fe..dc095a292c61 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1404,7 +1404,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
         arr[5] = (int)have_dif_prot;    /* PROTECT bit */
         if (sdebug_vpd_use_hostno == 0)
-                arr[5] = 0x10; /* claim: implicit TGPS */
+                arr[5] |= 0x10; /* claim: implicit TPGS */
         arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index e31f1cc90b81..99e16ac479e3 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1851,7 +1851,7 @@ static int scsi_mq_prep_fn(struct request *req)
 
         /* zero out the cmd, except for the embedded scsi_request */
         memset((char *)cmd + sizeof(cmd->req), 0,
-                sizeof(*cmd) - sizeof(cmd->req));
+                sizeof(*cmd) - sizeof(cmd->req) + shost->hostt->cmd_size);
 
         req->special = cmd;
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f9d1432d7cc5..b6bb4e0ce0e3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -827,21 +827,32 @@ static int sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
         u64 sector = blk_rq_pos(rq) >> (ilog2(sdp->sector_size) - 9);
         u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+        int ret;
 
         if (!(rq->cmd_flags & REQ_NOUNMAP)) {
                 switch (sdkp->zeroing_mode) {
                 case SD_ZERO_WS16_UNMAP:
-                        return sd_setup_write_same16_cmnd(cmd, true);
+                        ret = sd_setup_write_same16_cmnd(cmd, true);
+                        goto out;
                 case SD_ZERO_WS10_UNMAP:
-                        return sd_setup_write_same10_cmnd(cmd, true);
+                        ret = sd_setup_write_same10_cmnd(cmd, true);
+                        goto out;
                 }
         }
 
         if (sdp->no_write_same)
                 return BLKPREP_INVALID;
+
         if (sdkp->ws16 || sector > 0xffffffff || nr_sectors > 0xffff)
-                return sd_setup_write_same16_cmnd(cmd, false);
-        return sd_setup_write_same10_cmnd(cmd, false);
+                ret = sd_setup_write_same16_cmnd(cmd, false);
+        else
+                ret = sd_setup_write_same10_cmnd(cmd, false);
+
+out:
+        if (sd_is_zoned(sdkp) && ret == BLKPREP_OK)
+                return sd_zbc_write_lock_zone(cmd);
+
+        return ret;
 }
 
 static void sd_config_write_same(struct scsi_disk *sdkp)
@@ -948,6 +959,10 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         rq->__data_len = sdp->sector_size;
         ret = scsi_init_io(cmd);
         rq->__data_len = nr_bytes;
+
+        if (sd_is_zoned(sdkp) && ret != BLKPREP_OK)
+                sd_zbc_write_unlock_zone(cmd);
+
         return ret;
 }
 
@@ -1567,17 +1582,21 @@ out:
         return retval;
 }
 
-static int sd_sync_cache(struct scsi_disk *sdkp)
+static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
 {
         int retries, res;
         struct scsi_device *sdp = sdkp->device;
         const int timeout = sdp->request_queue->rq_timeout
                 * SD_FLUSH_TIMEOUT_MULTIPLIER;
-        struct scsi_sense_hdr sshdr;
+        struct scsi_sense_hdr my_sshdr;
 
         if (!scsi_device_online(sdp))
                 return -ENODEV;
 
+        /* caller might not be interested in sense, but we need it */
+        if (!sshdr)
+                sshdr = &my_sshdr;
+
         for (retries = 3; retries > 0; --retries) {
                 unsigned char cmd[10] = { 0 };
 
@@ -1586,7 +1605,7 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                  * Leave the rest of the command zero to indicate
                  * flush everything.
                  */
-                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
+                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, sshdr,
                                 timeout, SD_MAX_RETRIES, 0, RQF_PM, NULL);
                 if (res == 0)
                         break;
@@ -1596,11 +1615,12 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                 sd_print_result(sdkp, "Synchronize Cache(10) failed", res);
 
                 if (driver_byte(res) & DRIVER_SENSE)
-                        sd_print_sense_hdr(sdkp, &sshdr);
+                        sd_print_sense_hdr(sdkp, sshdr);
+
                 /* we need to evaluate the error return  */
-                if (scsi_sense_valid(&sshdr) &&
-                        (sshdr.asc == 0x3a ||   /* medium not present */
-                         sshdr.asc == 0x20))    /* invalid command */
+                if (scsi_sense_valid(sshdr) &&
+                        (sshdr->asc == 0x3a ||  /* medium not present */
+                         sshdr->asc == 0x20))   /* invalid command */
                                 /* this is no error here */
                                 return 0;
 
@@ -3444,7 +3464,7 @@ static void sd_shutdown(struct device *dev)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                sd_sync_cache(sdkp);
+                sd_sync_cache(sdkp, NULL);
         }
 
         if (system_state != SYSTEM_RESTART && sdkp->device->manage_start_stop) {
@@ -3456,6 +3476,7 @@ static void sd_shutdown(struct device *dev)
 static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 {
         struct scsi_disk *sdkp = dev_get_drvdata(dev);
+        struct scsi_sense_hdr sshdr;
         int ret = 0;
 
         if (!sdkp)      /* E.g.: runtime suspend following sd_remove() */
@@ -3463,12 +3484,23 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                ret = sd_sync_cache(sdkp);
+                ret = sd_sync_cache(sdkp, &sshdr);
+
                 if (ret) {
                         /* ignore OFFLINE device */
                         if (ret == -ENODEV)
-                                ret = 0;
-                        goto done;
+                                return 0;
+
+                        if (!scsi_sense_valid(&sshdr) ||
+                            sshdr.sense_key != ILLEGAL_REQUEST)
+                                return ret;
+
+                        /*
+                         * sshdr.sense_key == ILLEGAL_REQUEST means this drive
+                         * doesn't support sync. There's not much to do and
+                         * suspend shouldn't fail.
+                         */
+                         ret = 0;
                 }
         }
 
@@ -3480,7 +3512,6 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
                         ret = 0;
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0a38ba01b7b4..82c33a6edbea 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
                         resp->done = 2; /* guard against other readers */
-                        break;
+                        write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+                        return resp;
                 }
         }
         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-        return resp;
+        return NULL;
 }
 
 /* always adds to end of list */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index abc7e87937cc..ffe8d8608818 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7698,6 +7698,12 @@ static inline void ufshcd_add_sysfs_nodes(struct ufs_hba *hba)
         ufshcd_add_spm_lvl_sysfs_nodes(hba);
 }
 
+static inline void ufshcd_remove_sysfs_nodes(struct ufs_hba *hba)
+{
+        device_remove_file(hba->dev, &hba->rpm_lvl_attr);
+        device_remove_file(hba->dev, &hba->spm_lvl_attr);
+}
+
 /**
  * ufshcd_shutdown - shutdown routine
  * @hba: per adapter instance
@@ -7735,6 +7741,7 @@ EXPORT_SYMBOL(ufshcd_shutdown);
  */
 void ufshcd_remove(struct ufs_hba *hba)
 {
+        ufshcd_remove_sysfs_nodes(hba);
         scsi_remove_host(hba->host);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
diff --git a/drivers/staging/ccree/Kconfig b/drivers/staging/ccree/Kconfig
index ae627049c499..4be87f503e3b 100644
--- a/drivers/staging/ccree/Kconfig
+++ b/drivers/staging/ccree/Kconfig
@@ -1,6 +1,6 @@
 config CRYPTO_DEV_CCREE
         tristate "Support for ARM TrustZone CryptoCell C7XX family of Crypto accelerators"
-        depends on CRYPTO_HW && OF && HAS_DMA
+        depends on CRYPTO && CRYPTO_HW && OF && HAS_DMA
         default n
         select CRYPTO_HASH
         select CRYPTO_BLKCIPHER
diff --git a/drivers/staging/ccree/ssi_buffer_mgr.c b/drivers/staging/ccree/ssi_buffer_mgr.c
index 038e2ff5e545..6471d3d2d375 100644
--- a/drivers/staging/ccree/ssi_buffer_mgr.c
+++ b/drivers/staging/ccree/ssi_buffer_mgr.c
@@ -216,7 +216,8 @@ void ssi_buffer_mgr_copy_scatterlist_portion(
         uint32_t nents, lbytes;
 
         nents = ssi_buffer_mgr_get_sgl_nents(sg, end, &lbytes, NULL);
-        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip), 0, (direct == SSI_SG_TO_BUF));
+        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip + 1), to_skip,
+                       (direct == SSI_SG_TO_BUF));
 }
 
 static inline int ssi_buffer_mgr_render_buff_to_mlli(
diff --git a/drivers/staging/iio/cdc/ad7152.c b/drivers/staging/iio/cdc/ad7152.c
index dc6ecd824365..ff10d1f0a7e4 100644
--- a/drivers/staging/iio/cdc/ad7152.c
+++ b/drivers/staging/iio/cdc/ad7152.c
@@ -231,16 +231,12 @@ static int ad7152_write_raw_samp_freq(struct device *dev, int val)
         if (i >= ARRAY_SIZE(ad7152_filter_rate_table))
                 i = ARRAY_SIZE(ad7152_filter_rate_table) - 1;
 
-        mutex_lock(&chip->state_lock);
         ret = i2c_smbus_write_byte_data(chip->client,
                                         AD7152_REG_CFG2, AD7152_CFG2_OSR(i));
-        if (ret < 0) {
-                mutex_unlock(&chip->state_lock);
+        if (ret < 0)
                 return ret;
-        }
 
         chip->filter_rate_setup = i;
-        mutex_unlock(&chip->state_lock);
 
         return ret;
 }
diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c
index 2e1bd47337fd..e6727cefde05 100644
--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -293,18 +293,10 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
         size_t lmmk_size;
         size_t lum_size;
         int rc;
-        mm_segment_t seg;
 
         if (!lsm)
                 return -ENODATA;
 
-        /*
-         * "Switch to kernel segment" to allow copying from kernel space by
-         * copy_{to,from}_user().
-         */
-        seg = get_fs();
-        set_fs(KERNEL_DS);
-
         if (lsm->lsm_magic != LOV_MAGIC_V1 && lsm->lsm_magic != LOV_MAGIC_V3) {
                 CERROR("bad LSM MAGIC: 0x%08X != 0x%08X nor 0x%08X\n",
                        lsm->lsm_magic, LOV_MAGIC_V1, LOV_MAGIC_V3);
@@ -406,6 +398,5 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
 out_free:
         kvfree(lmmk);
 out:
-        set_fs(seg);
         return rc;
 }
diff --git a/drivers/staging/media/atomisp/i2c/Makefile b/drivers/staging/media/atomisp/i2c/Makefile
index 8ea01904c0ea..466517c7c8e6 100644
--- a/drivers/staging/media/atomisp/i2c/Makefile
+++ b/drivers/staging/media/atomisp/i2c/Makefile
@@ -19,5 +19,3 @@ obj-$(CONFIG_VIDEO_AP1302)     += ap1302.o
 
 obj-$(CONFIG_VIDEO_LM3554) += lm3554.o
 
-ccflags-y += -Werror
-
diff --git a/drivers/staging/media/atomisp/i2c/imx/Makefile b/drivers/staging/media/atomisp/i2c/imx/Makefile
index 1d7f7ab94cac..6b13a3a66e49 100644
--- a/drivers/staging/media/atomisp/i2c/imx/Makefile
+++ b/drivers/staging/media/atomisp/i2c/imx/Makefile
@@ -4,5 +4,3 @@ imx1x5-objs := imx.o drv201.o ad5816g.o dw9714.o dw9719.o dw9718.o vcm.o otp.o o
 
 ov8858_driver-objs := ../ov8858.o dw9718.o vcm.o
 obj-$(CONFIG_VIDEO_OV8858)     += ov8858_driver.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/Makefile b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
index fceb9e9b881b..c9c0e1245858 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/Makefile
+++ b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
@@ -1,3 +1 @@
 obj-$(CONFIG_VIDEO_OV5693) += ov5693.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 3fa7c1c1479f..f126a89a08e9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -351,5 +351,5 @@ DEFINES := -DHRT_HW -DHRT_ISP_CSS_CUSTOM_HOST -DHRT_USE_VIR_ADDRS -D__HOST__
 DEFINES += -DATOMISP_POSTFIX=\"css2400b0_v21\" -DISP2400B0
 DEFINES += -DSYSTEM_hive_isp_css_2400_system -DISP2400
 
-ccflags-y += $(INCLUDES) $(DEFINES) -fno-common -Werror
+ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
 
diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
index cfe37eb026d6..859d0d6051cd 100644
--- a/drivers/staging/rtl8188eu/os_dep/mon.c
+++ b/drivers/staging/rtl8188eu/os_dep/mon.c
@@ -152,7 +152,7 @@ static const struct net_device_ops mon_netdev_ops = {
 static void mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &mon_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211;
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 36c3189fc4b7..bd4352fe2de3 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -2667,7 +2667,8 @@ static int rtw_cfg80211_add_monitor_if (struct adapter *padapter, char *name, st
         mon_ndev->type = ARPHRD_IEEE80211_RADIOTAP;
         strncpy(mon_ndev->name, name, IFNAMSIZ);
         mon_ndev->name[IFNAMSIZ - 1] = 0;
-        mon_ndev->destructor = rtw_ndev_destructor;
+        mon_ndev->needs_free_netdev = true;
+        mon_ndev->priv_destructor = rtw_ndev_destructor;
 
         mon_ndev->netdev_ops = &rtw_cfg80211_monitor_if_ops;
 
diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
index f83cfc76505c..021589913681 100644
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -1207,8 +1207,6 @@ void rtw_ndev_destructor(struct net_device *ndev)
 
         if (ndev->ieee80211_ptr)
                 kfree((u8 *)ndev->ieee80211_ptr);
-
-        free_netdev(ndev);
 }
 
 void rtw_dev_unload(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/os_dep/osdep_service.c b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
index 02db59e8b593..aa16d1ab955b 100644
--- a/drivers/staging/rtl8723bs/os_dep/osdep_service.c
+++ b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
@@ -160,7 +160,7 @@ static int isFileReadable(char *path)
                 oldfs = get_fs(); set_fs(get_ds());
 
                 if (1!=readFile(fp, &buf, 1))
-                        ret = PTR_ERR(fp);
+                        ret = -EINVAL;
 
                 set_fs(oldfs);
                 filp_close(fp, NULL);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 26a9bcd5ee6a..3fdca2cdd8da 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1279,6 +1279,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
          */
         if (dump_payload)
                 goto after_immediate_data;
+        /*
+         * Check for underflow case where both EDTL and immediate data payload
+         * exceeds what is presented by CDB's TRANSFER LENGTH, and what has
+         * already been set in target_cmd_size_check() as se_cmd->data_length.
+         *
+         * For this special case, fail the command and dump the immediate data
+         * payload.
+         */
+        if (cmd->first_burst_len > cmd->se_cmd.data_length) {
+                cmd->sense_reason = TCM_INVALID_CDB_FIELD;
+                goto after_immediate_data;
+        }
 
         immed_ret = iscsit_handle_immediate_data(cmd, hdr,
                                         cmd->first_burst_len);
@@ -3790,6 +3802,8 @@ int iscsi_target_tx_thread(void *arg)
 {
         int ret = 0;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
+
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
          * connection recovery / failure event can be triggered externally.
@@ -3815,12 +3829,14 @@ get_immediate:
                         goto transport_err;
 
                 ret = iscsit_handle_response_queue(conn);
-                if (ret == 1)
+                if (ret == 1) {
                         goto get_immediate;
-                else if (ret == -ECONNRESET)
+                } else if (ret == -ECONNRESET) {
+                        conn_freed = true;
                         goto out;
-                else if (ret < 0)
+                } else if (ret < 0) {
                         goto transport_err;
+                }
         }
 
 transport_err:
@@ -3830,8 +3846,13 @@ transport_err:
          * responsible for cleaning up the early connection failure.
          */
         if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
-                iscsit_take_action_for_connection_exit(conn);
+                iscsit_take_action_for_connection_exit(conn, &conn_freed);
 out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
         return 0;
 }
 
@@ -4004,6 +4025,7 @@ int iscsi_target_rx_thread(void *arg)
 {
         int rc;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
 
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
@@ -4016,7 +4038,7 @@ int iscsi_target_rx_thread(void *arg)
          */
         rc = wait_for_completion_interruptible(&conn->rx_login_comp);
         if (rc < 0 || iscsi_target_check_conn_state(conn))
-                return 0;
+                goto out;
 
         if (!conn->conn_transport->iscsit_get_rx_pdu)
                 return 0;
@@ -4025,7 +4047,15 @@ int iscsi_target_rx_thread(void *arg)
 
         if (!signal_pending(current))
                 atomic_set(&conn->transport_failed, 1);
-        iscsit_take_action_for_connection_exit(conn);
+        iscsit_take_action_for_connection_exit(conn, &conn_freed);
+
+out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
+
         return 0;
 }
 
@@ -4405,8 +4435,11 @@ static void iscsit_logout_post_handler_closesession(
          * always sleep waiting for RX/TX thread shutdown to complete
          * within iscsit_close_connection().
          */
-        if (!conn->conn_transport->rdma_shutdown)
+        if (!conn->conn_transport->rdma_shutdown) {
                 sleep = cmpxchg(&conn->tx_thread_active, true, false);
+                if (!sleep)
+                        return;
+        }
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
@@ -4422,8 +4455,11 @@ static void iscsit_logout_post_handler_samecid(
 {
         int sleep = 1;
 
-        if (!conn->conn_transport->rdma_shutdown)
+        if (!conn->conn_transport->rdma_shutdown) {
                 sleep = cmpxchg(&conn->tx_thread_active, true, false);
+                if (!sleep)
+                        return;
+        }
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 9a96e17bf7cd..7fe2aa73cff6 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -930,8 +930,10 @@ static void iscsit_handle_connection_cleanup(struct iscsi_conn *conn)
         }
 }
 
-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
 {
+        *conn_freed = false;
+
         spin_lock_bh(&conn->state_lock);
         if (atomic_read(&conn->connection_exit)) {
                 spin_unlock_bh(&conn->state_lock);
@@ -942,6 +944,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                 spin_unlock_bh(&conn->state_lock);
                 iscsit_close_connection(conn);
+                *conn_freed = true;
                 return;
         }
 
@@ -955,4 +958,5 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         spin_unlock_bh(&conn->state_lock);
 
         iscsit_handle_connection_cleanup(conn);
+        *conn_freed = true;
 }
diff --git a/drivers/target/iscsi/iscsi_target_erl0.h b/drivers/target/iscsi/iscsi_target_erl0.h
index 60e69e2af6ed..3822d9cd1230 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.h
+++ b/drivers/target/iscsi/iscsi_target_erl0.h
@@ -15,6 +15,6 @@ extern int iscsit_stop_time2retain_timer(struct iscsi_session *);
 extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
 extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
 extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
 
 #endif   /*** ISCSI_TARGET_ERL0_H ***/
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 66238477137b..92b96b51d506 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1464,5 +1464,9 @@ int iscsi_target_login_thread(void *arg)
                         break;
         }
 
+        while (!kthread_should_stop()) {
+                msleep(100);
+        }
+
         return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 7ccc9c1cbfd1..6f88b31242b0 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -493,14 +493,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn)
 
 static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
 
-static bool iscsi_target_sk_state_check(struct sock *sk)
+static bool __iscsi_target_sk_check_close(struct sock *sk)
 {
         if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
-                pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
+                pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
                         "returning FALSE\n");
-                return false;
+                return true;
         }
-        return true;
+        return false;
+}
+
+static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = test_bit(flag, &conn->login_flags);
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                write_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                if (!state)
+                        clear_bit(flag, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
 }
 
 static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
@@ -540,6 +586,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
                         conn, current->comm, current->pid);
+        /*
+         * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
+         * before initial PDU processing in iscsi_target_start_negotiation()
+         * has completed, go ahead and retry until it's cleared.
+         *
+         * Otherwise if the TCP connection drops while this is occuring,
+         * iscsi_target_start_negotiation() will detect the failure, call
+         * cancel_delayed_work_sync(&conn->login_work), and cleanup the
+         * remaining iscsi connection resources from iscsi_np process context.
+         */
+        if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
+                schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
+                return;
+        }
 
         spin_lock(&tpg->tpg_state_lock);
         state = (tpg->tpg_state == TPG_STATE_ACTIVE);
@@ -547,26 +607,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         if (!state) {
                 pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
+                goto err;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
-                        iscsi_target_restore_sock_callbacks(conn);
-                        iscsi_target_login_drop(conn, login);
-                        iscsit_deaccess_np(np, tpg, tpg_np);
-                        return;
-                }
+        if (iscsi_target_sk_check_close(conn)) {
+                pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+                goto err;
         }
 
         conn->login_kworker = current;
@@ -584,34 +630,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
         flush_signals(current);
         conn->login_kworker = NULL;
 
-        if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
-        }
+        if (rc < 0)
+                goto err;
 
         pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
                         conn, current->comm, current->pid);
 
         rc = iscsi_target_do_login(conn, login);
         if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
+                goto err;
         } else if (!rc) {
-                if (conn->sock) {
-                        struct sock *sk = conn->sock->sk;
-
-                        write_lock_bh(&sk->sk_callback_lock);
-                        clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
-                        write_unlock_bh(&sk->sk_callback_lock);
-                }
+                if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
+                        goto err;
         } else if (rc == 1) {
                 iscsi_target_nego_release(conn);
                 iscsi_post_login_handler(np, conn, zero_tsih);
                 iscsit_deaccess_np(np, tpg, tpg_np);
         }
+        return;
+
+err:
+        iscsi_target_restore_sock_callbacks(conn);
+        iscsi_target_login_drop(conn, login);
+        iscsit_deaccess_np(np, tpg, tpg_np);
 }
 
 static void iscsi_target_do_cleanup(struct work_struct *work)
@@ -659,31 +700,54 @@ static void iscsi_target_sk_state_change(struct sock *sk)
                 orig_state_change(sk);
                 return;
         }
+        state = __iscsi_target_sk_check_close(sk);
+        pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
+
         if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
                          " conn: %p\n", conn);
+                if (state)
+                        set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
-        if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+        if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
                          conn);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
+        /*
+         * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
+         * but only queue conn->login_work -> iscsi_target_do_login_rx()
+         * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
+         *
+         * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
+         * will detect the dropped TCP connection from delayed workqueue context.
+         *
+         * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
+         * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
+         * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
+         * via iscsi_target_sk_check_and_clear() is responsible for detecting the
+         * dropped TCP connection in iscsi_np process context, and cleaning up
+         * the remaining iscsi connection resources.
+         */
+        if (state) {
+                pr_debug("iscsi_target_sk_state_change got failed state\n");
+                set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+                state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
 
-        state = iscsi_target_sk_state_check(sk);
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
+                orig_state_change(sk);
 
-        if (!state) {
-                pr_debug("iscsi_target_sk_state_change got failed state\n");
-                schedule_delayed_work(&conn->login_cleanup_work, 0);
+                if (!state)
+                        schedule_delayed_work(&conn->login_work, 0);
                 return;
         }
+        write_unlock_bh(&sk->sk_callback_lock);
+
         orig_state_change(sk);
 }
 
@@ -946,6 +1010,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                         if (iscsi_target_handle_csg_one(conn, login) < 0)
                                 return -1;
                         if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
+                                /*
+                                 * Check to make sure the TCP connection has not
+                                 * dropped asynchronously while session reinstatement
+                                 * was occuring in this kthread context, before
+                                 * transitioning to full feature phase operation.
+                                 */
+                                if (iscsi_target_sk_check_close(conn))
+                                        return -1;
+
                                 login->tsih = conn->sess->tsih;
                                 login->login_complete = 1;
                                 iscsi_target_restore_sock_callbacks(conn);
@@ -972,21 +1045,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                 break;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-                bool state;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login() failed state for"
-                                 " conn: %p\n", conn);
-                        return -1;
-                }
-        }
-
         return 0;
 }
 
@@ -1255,10 +1313,22 @@ int iscsi_target_start_negotiation(
 
                 write_lock_bh(&sk->sk_callback_lock);
                 set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+                set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
         }
-
+        /*
+         * If iscsi_target_do_login returns zero to signal more PDU
+         * exchanges are required to complete the login, go ahead and
+         * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
+         * is still active.
+         *
+         * Otherwise if TCP connection dropped asynchronously, go ahead
+         * and perform connection cleanup now.
+         */
         ret = iscsi_target_do_login(conn, login);
+        if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
+                ret = -1;
+
         if (ret < 0) {
                 cancel_delayed_work_sync(&conn->login_work);
                 cancel_delayed_work_sync(&conn->login_cleanup_work);
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 9ab7090f7c83..0912de7c0cf8 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -136,7 +136,7 @@ int	init_se_kmem_caches(void);
 void    release_se_kmem_caches(void);
 u32     scsi_get_new_index(scsi_index_t);
 void    transport_subsystem_check_init(void);
-void    transport_cmd_finish_abort(struct se_cmd *, int);
+int     transport_cmd_finish_abort(struct se_cmd *, int);
 unsigned char *transport_dump_cmd_direction(struct se_cmd *);
 void    transport_dump_dev_state(struct se_device *, char *, int *);
 void    transport_dump_dev_info(struct se_device *, struct se_lun *,
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index dce1e1b47316..13f47bf4d16b 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
         kfree(tmr);
 }
 
-static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
+static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
 {
         unsigned long flags;
         bool remove = true, send_tas;
@@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
                 transport_send_task_abort(cmd);
         }
 
-        transport_cmd_finish_abort(cmd, remove);
+        return transport_cmd_finish_abort(cmd, remove);
 }
 
 static int target_check_cdb_and_preempt(struct list_head *list,
@@ -184,8 +184,8 @@ void core_tmr_abort_task(
                 cancel_work_sync(&se_cmd->work);
                 transport_wait_for_tasks(se_cmd);
 
-                transport_cmd_finish_abort(se_cmd, true);
-                target_put_sess_cmd(se_cmd);
+                if (!transport_cmd_finish_abort(se_cmd, true))
+                        target_put_sess_cmd(se_cmd);
 
                 printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
                                 " ref_tag: %llu\n", ref_tag);
@@ -281,8 +281,8 @@ static void core_tmr_drain_tmr_list(
                 cancel_work_sync(&cmd->work);
                 transport_wait_for_tasks(cmd);
 
-                transport_cmd_finish_abort(cmd, 1);
-                target_put_sess_cmd(cmd);
+                if (!transport_cmd_finish_abort(cmd, 1))
+                        target_put_sess_cmd(cmd);
         }
 }
 
@@ -380,8 +380,8 @@ static void core_tmr_drain_state_list(
                 cancel_work_sync(&cmd->work);
                 transport_wait_for_tasks(cmd);
 
-                core_tmr_handle_tas_abort(cmd, tas);
-                target_put_sess_cmd(cmd);
+                if (!core_tmr_handle_tas_abort(cmd, tas))
+                        target_put_sess_cmd(cmd);
         }
 }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 37f57357d4a0..f1b3a46bdcaf 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -651,9 +651,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
                 percpu_ref_put(&lun->lun_ref);
 }
 
-void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
         bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
+        int ret = 0;
 
         if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
                 transport_lun_remove_cmd(cmd);
@@ -665,9 +666,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
                 cmd->se_tfo->aborted_task(cmd);
 
         if (transport_cmd_check_stop_to_fabric(cmd))
-                return;
+                return 1;
         if (remove && ack_kref)
-                transport_put_cmd(cmd);
+                ret = transport_put_cmd(cmd);
+
+        return ret;
 }
 
 static void target_complete_failure_work(struct work_struct *work)
@@ -1160,15 +1163,28 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
         if (cmd->unknown_data_length) {
                 cmd->data_length = size;
         } else if (size != cmd->data_length) {
-                pr_warn("TARGET_CORE[%s]: Expected Transfer Length:"
+                pr_warn_ratelimited("TARGET_CORE[%s]: Expected Transfer Length:"
                         " %u does not match SCSI CDB Length: %u for SAM Opcode:"
                         " 0x%02x\n", cmd->se_tfo->get_fabric_name(),
                                 cmd->data_length, size, cmd->t_task_cdb[0]);
 
-                if (cmd->data_direction == DMA_TO_DEVICE &&
-                    cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
-                        pr_err("Rejecting underflow/overflow WRITE data\n");
-                        return TCM_INVALID_CDB_FIELD;
+                if (cmd->data_direction == DMA_TO_DEVICE) {
+                        if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+                                pr_err_ratelimited("Rejecting underflow/overflow"
+                                                   " for WRITE data CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
+                        /*
+                         * Some fabric drivers like iscsi-target still expect to
+                         * always reject overflow writes.  Reject this case until
+                         * full fabric driver level support for overflow writes
+                         * is introduced tree-wide.
+                         */
+                        if (size > cmd->data_length) {
+                                pr_err_ratelimited("Rejecting overflow for"
+                                                   " WRITE control CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
                 }
                 /*
                  * Reject READ_* or WRITE_* with overflow/underflow for
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 9045837f748b..beb5f098f32d 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -97,7 +97,7 @@ struct tcmu_hba {
 
 struct tcmu_dev {
         struct list_head node;
-
+        struct kref kref;
         struct se_device se_dev;
 
         char *name;
@@ -969,6 +969,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
         udev = kzalloc(sizeof(struct tcmu_dev), GFP_KERNEL);
         if (!udev)
                 return NULL;
+        kref_init(&udev->kref);
 
         udev->name = kstrdup(name, GFP_KERNEL);
         if (!udev->name) {
@@ -1145,6 +1146,24 @@ static int tcmu_open(struct uio_info *info, struct inode *inode)
         return 0;
 }
 
+static void tcmu_dev_call_rcu(struct rcu_head *p)
+{
+        struct se_device *dev = container_of(p, struct se_device, rcu_head);
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+
+        kfree(udev->uio_info.name);
+        kfree(udev->name);
+        kfree(udev);
+}
+
+static void tcmu_dev_kref_release(struct kref *kref)
+{
+        struct tcmu_dev *udev = container_of(kref, struct tcmu_dev, kref);
+        struct se_device *dev = &udev->se_dev;
+
+        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+}
+
 static int tcmu_release(struct uio_info *info, struct inode *inode)
 {
         struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
@@ -1152,7 +1171,8 @@ static int tcmu_release(struct uio_info *info, struct inode *inode)
         clear_bit(TCMU_DEV_BIT_OPEN, &udev->flags);
 
         pr_debug("close\n");
-
+        /* release ref from configure */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         return 0;
 }
 
@@ -1272,6 +1292,12 @@ static int tcmu_configure_device(struct se_device *dev)
                 dev->dev_attrib.hw_max_sectors = 128;
         dev->dev_attrib.hw_queue_depth = 128;
 
+        /*
+         * Get a ref incase userspace does a close on the uio device before
+         * LIO has initiated tcmu_free_device.
+         */
+        kref_get(&udev->kref);
+
         ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
                                  udev->uio_info.uio_dev->minor);
         if (ret)
@@ -1284,11 +1310,13 @@ static int tcmu_configure_device(struct se_device *dev)
         return 0;
 
 err_netlink:
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         uio_unregister_device(&udev->uio_info);
 err_register:
         vfree(udev->mb_addr);
 err_vzalloc:
         kfree(info->name);
+        info->name = NULL;
 
         return ret;
 }
@@ -1302,14 +1330,6 @@ static int tcmu_check_and_free_pending_cmd(struct tcmu_cmd *cmd)
         return -EINVAL;
 }
 
-static void tcmu_dev_call_rcu(struct rcu_head *p)
-{
-        struct se_device *dev = container_of(p, struct se_device, rcu_head);
-        struct tcmu_dev *udev = TCMU_DEV(dev);
-
-        kfree(udev);
-}
-
 static bool tcmu_dev_configured(struct tcmu_dev *udev)
 {
         return udev->uio_info.uio_dev ? true : false;
@@ -1364,10 +1384,10 @@ static void tcmu_free_device(struct se_device *dev)
                                    udev->uio_info.uio_dev->minor);
 
                 uio_unregister_device(&udev->uio_info);
-                kfree(udev->uio_info.name);
-                kfree(udev->name);
         }
-        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+
+        /* release ref from init */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
 }
 
 enum {
diff --git a/drivers/thermal/broadcom/Kconfig b/drivers/thermal/broadcom/Kconfig
index ab08af4654ef..42c098e86f84 100644
--- a/drivers/thermal/broadcom/Kconfig
+++ b/drivers/thermal/broadcom/Kconfig
@@ -9,8 +9,9 @@ config BCM2835_THERMAL
 config BCM_NS_THERMAL
         tristate "Northstar thermal driver"
         depends on ARCH_BCM_IPROC || COMPILE_TEST
+        default y if ARCH_BCM_IPROC
         help
-          Northstar is a family of SoCs that includes e.g. BCM4708, BCM47081,
-          BCM4709 and BCM47094. It contains DMU (Device Management Unit) block
-          with a thermal sensor that allows checking CPU temperature. This
-          driver provides support for it.
+          Support for the Northstar and Northstar Plus family of SoCs (e.g.
+          BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
+          Management Unit) block with a thermal sensor that allows checking CPU
+          temperature.
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index 644ba526d9ea..4362a69ac88d 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -195,7 +195,6 @@ static struct thermal_zone_of_device_ops tmu_tz_ops = {
 static int qoriq_tmu_probe(struct platform_device *pdev)
 {
         int ret;
-        const struct thermal_trip *trip;
         struct qoriq_tmu_data *data;
         struct device_node *np = pdev->dev.of_node;
         u32 site = 0;
@@ -243,8 +242,6 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
                 goto err_tmu;
         }
 
-        trip = of_thermal_get_trip_points(data->tz);
-
         /* Enable monitoring */
         site |= 0x1 << (15 - data->sensor_id);
         tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index b21b9cc2c8d6..5a51c740e372 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -359,7 +359,7 @@ static DECLARE_DELAYED_WORK(thermal_emergency_poweroff_work,
  * This may be called from any critical situation to trigger a system shutdown
  * after a known period of time. By default this is not scheduled.
  */
-void thermal_emergency_poweroff(void)
+static void thermal_emergency_poweroff(void)
 {
         int poweroff_delay_ms = CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS;
         /*
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index ba9c302454fb..696ab3046b87 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1010,7 +1010,7 @@ ti_bandgap_force_single_read(struct ti_bandgap *bgp, int id)
 }
 
 /**
- * ti_bandgap_set_continous_mode() - One time enabling of continuous mode
+ * ti_bandgap_set_continuous_mode() - One time enabling of continuous mode
  * @bgp: pointer to struct ti_bandgap
  *
  * Call this function only if HAS(MODE_CONFIG) is set. As this driver may
@@ -1214,22 +1214,18 @@ static struct ti_bandgap *ti_bandgap_build(struct platform_device *pdev)
         }
 
         bgp = devm_kzalloc(&pdev->dev, sizeof(*bgp), GFP_KERNEL);
-        if (!bgp) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        if (!bgp)
                 return ERR_PTR(-ENOMEM);
-        }
 
         of_id = of_match_device(of_ti_bandgap_match, &pdev->dev);
         if (of_id)
                 bgp->conf = of_id->data;
 
         /* register shadow for context save and restore */
-        bgp->regval = devm_kzalloc(&pdev->dev, sizeof(*bgp->regval) *
-                                   bgp->conf->sensor_count, GFP_KERNEL);
-        if (!bgp->regval) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        bgp->regval = devm_kcalloc(&pdev->dev, bgp->conf->sensor_count,
+                                   sizeof(*bgp->regval), GFP_KERNEL);
+        if (!bgp->regval)
                 return ERR_PTR(-ENOMEM);
-        }
 
         i = 0;
         do {
diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
index 7ac9bcdf1e61..61fe8d6fd24e 100644
--- a/drivers/tty/ehv_bytechan.c
+++ b/drivers/tty/ehv_bytechan.c
@@ -764,7 +764,7 @@ static int __init ehv_bc_init(void)
         ehv_bc_driver = alloc_tty_driver(count);
         if (!ehv_bc_driver) {
                 ret = -ENOMEM;
-                goto error;
+                goto err_free_bcs;
         }
 
         ehv_bc_driver->driver_name = "ehv-bc";
@@ -778,24 +778,23 @@ static int __init ehv_bc_init(void)
         ret = tty_register_driver(ehv_bc_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register tty driver (ret=%i)\n", ret);
-                goto error;
+                goto err_put_tty_driver;
         }
 
         ret = platform_driver_register(&ehv_bc_tty_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register platform driver (ret=%i)\n",
                        ret);
-                goto error;
+                goto err_deregister_tty_driver;
         }
 
         return 0;
 
-error:
-        if (ehv_bc_driver) {
-                tty_unregister_driver(ehv_bc_driver);
-                put_tty_driver(ehv_bc_driver);
-        }
-
+err_deregister_tty_driver:
+        tty_unregister_driver(ehv_bc_driver);
+err_put_tty_driver:
+        put_tty_driver(ehv_bc_driver);
+err_free_bcs:
         kfree(bcs);
 
         return ret;
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 433de5ea9b02..f71b47334149 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -122,6 +122,18 @@ void serdev_device_write_wakeup(struct serdev_device *serdev)
 }
 EXPORT_SYMBOL_GPL(serdev_device_write_wakeup);
 
+int serdev_device_write_buf(struct serdev_device *serdev,
+                            const unsigned char *buf, size_t count)
+{
+        struct serdev_controller *ctrl = serdev->ctrl;
+
+        if (!ctrl || !ctrl->ops->write_buf)
+                return -EINVAL;
+
+        return ctrl->ops->write_buf(ctrl, buf, count);
+}
+EXPORT_SYMBOL_GPL(serdev_device_write_buf);
+
 int serdev_device_write(struct serdev_device *serdev,
                         const unsigned char *buf, size_t count,
                         unsigned long timeout)
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index 487c88f6aa0e..d0a021c93986 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -102,9 +102,6 @@ static int ttyport_open(struct serdev_controller *ctrl)
                 return PTR_ERR(tty);
         serport->tty = tty;
 
-        serport->port->client_ops = &client_ops;
-        serport->port->client_data = ctrl;
-
         if (tty->ops->open)
                 tty->ops->open(serport->tty, NULL);
         else
@@ -215,6 +212,7 @@ struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx)
 {
+        const struct tty_port_client_operations *old_ops;
         struct serdev_controller *ctrl;
         struct serport *serport;
         int ret;
@@ -233,28 +231,37 @@ struct device *serdev_tty_port_register(struct tty_port *port,
 
         ctrl->ops = &ctrl_ops;
 
+        old_ops = port->client_ops;
+        port->client_ops = &client_ops;
+        port->client_data = ctrl;
+
         ret = serdev_controller_add(ctrl);
         if (ret)
-                goto err_controller_put;
+                goto err_reset_data;
 
         dev_info(&ctrl->dev, "tty port %s%d registered\n", drv->name, idx);
         return &ctrl->dev;
 
-err_controller_put:
+err_reset_data:
+        port->client_data = NULL;
+        port->client_ops = old_ops;
         serdev_controller_put(ctrl);
+
         return ERR_PTR(ret);
 }
 
-void serdev_tty_port_unregister(struct tty_port *port)
+int serdev_tty_port_unregister(struct tty_port *port)
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
 
         if (!serport)
-                return;
+                return -ENODEV;
 
         serdev_controller_remove(ctrl);
         port->client_ops = NULL;
         port->client_data = NULL;
         serdev_controller_put(ctrl);
+
+        return 0;
 }
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 09a65a3ec7f7..68fd045a7025 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -47,6 +47,7 @@
 /*
  * These are definitions for the Exar XR17V35X and XR17(C|D)15X
  */
+#define UART_EXAR_INT0          0x80
 #define UART_EXAR_SLEEP         0x8b    /* Sleep mode */
 #define UART_EXAR_DVID          0x8d    /* Device identification */
 
@@ -1337,7 +1338,7 @@ out_lock:
         /*
          * Check if the device is a Fintek F81216A
          */
-        if (port->type == PORT_16550A)
+        if (port->type == PORT_16550A && port->iotype == UPIO_PORT)
                 fintek_8250_probe(up);
 
         if (up->capabilities != old_capabilities) {
@@ -1869,17 +1870,13 @@ static int serial8250_default_handle_irq(struct uart_port *port)
 static int exar_handle_irq(struct uart_port *port)
 {
         unsigned int iir = serial_port_in(port, UART_IIR);
-        int ret;
+        int ret = 0;
 
-        ret = serial8250_handle_irq(port, iir);
+        if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) &&
+            serial_port_in(port, UART_EXAR_INT0) != 0)
+                ret = 1;
 
-        if ((port->type == PORT_XR17V35X) ||
-           (port->type == PORT_XR17D15X)) {
-                serial_port_in(port, 0x80);
-                serial_port_in(port, 0x81);
-                serial_port_in(port, 0x82);
-                serial_port_in(port, 0x83);
-        }
+        ret |= serial8250_handle_irq(port, iir);
 
         return ret;
 }
@@ -2177,6 +2174,8 @@ int serial8250_do_startup(struct uart_port *port)
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
 
         /*
          * At this point, there's no way the LSR could still be 0xff;
@@ -2335,6 +2334,8 @@ dont_test_tx_en:
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
         up->lsr_saved_flags = 0;
         up->msr_saved_flags = 0;
 
diff --git a/drivers/tty/serial/altera_jtaguart.c b/drivers/tty/serial/altera_jtaguart.c
index 18e3f8342b85..0475f5d261ce 100644
--- a/drivers/tty/serial/altera_jtaguart.c
+++ b/drivers/tty/serial/altera_jtaguart.c
@@ -478,6 +478,7 @@ static int altera_jtaguart_remove(struct platform_device *pdev)
 
         port = &altera_jtaguart_ports[i].port;
         uart_remove_one_port(&altera_jtaguart_driver, port);
+        iounmap(port->membase);
 
         return 0;
 }
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 46d3438a0d27..3e4b717670d7 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -615,6 +615,7 @@ static int altera_uart_remove(struct platform_device *pdev)
         if (port) {
                 uart_remove_one_port(&altera_uart_driver, port);
                 port->mapbase = 0;
+                iounmap(port->membase);
         }
 
         return 0;
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index ebd8569f9ad5..9fff25be87f9 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -27,6 +27,7 @@
 #define UARTn_FRAME             0x04
 #define UARTn_FRAME_DATABITS__MASK      0x000f
 #define UARTn_FRAME_DATABITS(n)         ((n) - 3)
+#define UARTn_FRAME_PARITY__MASK        0x0300
 #define UARTn_FRAME_PARITY_NONE         0x0000
 #define UARTn_FRAME_PARITY_EVEN         0x0200
 #define UARTn_FRAME_PARITY_ODD          0x0300
@@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port,
                         16 * (4 + (clkdiv >> 6)));
 
         frame = efm32_uart_read32(efm_port, UARTn_FRAME);
-        if (frame & UARTn_FRAME_PARITY_ODD)
+        switch (frame & UARTn_FRAME_PARITY__MASK) {
+        case UARTn_FRAME_PARITY_ODD:
                 *parity = 'o';
-        else if (frame & UARTn_FRAME_PARITY_EVEN)
+                break;
+        case UARTn_FRAME_PARITY_EVEN:
                 *parity = 'e';
-        else
+                break;
+        default:
                 *parity = 'n';
+        }
 
         *bits = (frame & UARTn_FRAME_DATABITS__MASK) -
                         UARTn_FRAME_DATABITS(4) + 4;
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 157883653256..f190a84a0246 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1382,9 +1382,9 @@ static struct spi_driver ifx_spi_driver = {
 static void __exit ifx_spi_exit(void)
 {
         /* unregister */
+        spi_unregister_driver(&ifx_spi_driver);
         tty_unregister_driver(tty_drv);
         put_tty_driver(tty_drv);
-        spi_unregister_driver(&ifx_spi_driver);
         unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
 }
 
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 33509b4beaec..bbefddd92bfe 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2184,7 +2184,9 @@ static int serial_imx_probe(struct platform_device *pdev)
                  * and DCD (when they are outputs) or enables the respective
                  * irqs. So set this bit early, i.e. before requesting irqs.
                  */
-                writel(UFCR_DCEDTE, sport->port.membase + UFCR);
+                reg = readl(sport->port.membase + UFCR);
+                if (!(reg & UFCR_DCEDTE))
+                        writel(reg | UFCR_DCEDTE, sport->port.membase + UFCR);
 
                 /*
                  * Disable UCR3_RI and UCR3_DCD irqs. They are also not
@@ -2195,7 +2197,15 @@ static int serial_imx_probe(struct platform_device *pdev)
                        sport->port.membase + UCR3);
 
         } else {
-                writel(0, sport->port.membase + UFCR);
+                unsigned long ucr3 = UCR3_DSR;
+
+                reg = readl(sport->port.membase + UFCR);
+                if (reg & UFCR_DCEDTE)
+                        writel(reg & ~UFCR_DCEDTE, sport->port.membase + UFCR);
+
+                if (!is_imx1_uart(sport))
+                        ucr3 |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP;
+                writel(ucr3, sport->port.membase + UCR3);
         }
 
         clk_disable_unprepare(sport->clk_ipg);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 0f45b7884a2c..13bfd5dcffce 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2083,7 +2083,7 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
         mutex_lock(&port->mutex);
 
         tty_dev = device_find_child(uport->dev, &match, serial_match_port);
-        if (device_may_wakeup(tty_dev)) {
+        if (tty_dev && device_may_wakeup(tty_dev)) {
                 if (!enable_irq_wake(uport->irq))
                         uport->irq_wake = 1;
                 put_device(tty_dev);
@@ -2782,7 +2782,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
          * Register the port whether it's detected or not.  This allows
          * setserial to be used to alter this port's parameters.
          */
-        tty_dev = tty_port_register_device_attr(port, drv->tty_driver,
+        tty_dev = tty_port_register_device_attr_serdev(port, drv->tty_driver,
                         uport->line, uport->dev, port, uport->tty_groups);
         if (likely(!IS_ERR(tty_dev))) {
                 device_set_wakeup_capable(tty_dev, 1);
@@ -2845,7 +2845,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *uport)
         /*
          * Remove the devices from the tty layer
          */
-        tty_unregister_device(drv->tty_driver, uport->line);
+        tty_port_unregister_device(port, drv->tty_driver, uport->line);
 
         tty = tty_port_tty_get(port);
         if (tty) {
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 1d21a9c1d33e..6b137194069f 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -129,19 +129,85 @@ struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp)
 {
+        tty_port_link_device(port, driver, index);
+        return tty_register_device_attr(driver, index, device, drvdata,
+                        attr_grp);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+
+/**
+ * tty_port_register_device_attr_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ * @drvdata: driver data for the device
+ * @attr_grp: attribute group for the device
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp)
+{
         struct device *dev;
 
         tty_port_link_device(port, driver, index);
 
         dev = serdev_tty_port_register(port, device, driver, index);
-        if (PTR_ERR(dev) != -ENODEV)
+        if (PTR_ERR(dev) != -ENODEV) {
                 /* Skip creating cdev if we registered a serdev device */
                 return dev;
+        }
 
         return tty_register_device_attr(driver, index, device, drvdata,
                         attr_grp);
 }
-EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr_serdev);
+
+/**
+ * tty_port_register_device_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device)
+{
+        return tty_port_register_device_attr_serdev(port, driver, index,
+                        device, NULL, NULL);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_serdev);
+
+/**
+ * tty_port_unregister_device - deregister a tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ *
+ * If a tty or serdev device is registered with a call to
+ * tty_port_register_device_serdev() then this function must be called when
+ * the device is gone.
+ */
+void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index)
+{
+        int ret;
+
+        ret = serdev_tty_port_unregister(port);
+        if (ret == 0)
+                return;
+
+        tty_unregister_device(driver, index);
+}
+EXPORT_SYMBOL_GPL(tty_port_unregister_device);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
@@ -189,9 +255,6 @@ static void tty_port_destructor(struct kref *kref)
         /* check if last port ref was dropped before tty release */
         if (WARN_ON(port->itty))
                 return;
-
-        serdev_tty_port_unregister(port);
-
         if (port->xmit_buf)
                 free_page((unsigned long)port->xmit_buf);
         tty_port_destroy(port);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 9e217b1361ea..fe4fe2440729 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -843,7 +843,10 @@ static ssize_t ci_role_show(struct device *dev, struct device_attribute *attr,
 {
         struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-        return sprintf(buf, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                return sprintf(buf, "%s\n", ci_role(ci)->name);
+
+        return 0;
 }
 
 static ssize_t ci_role_store(struct device *dev,
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 6d23eede4d8c..1c31e8a08810 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -294,7 +294,8 @@ static int ci_role_show(struct seq_file *s, void *data)
 {
         struct ci_hdrc *ci = s->private;
 
-        seq_printf(s, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                seq_printf(s, "%s\n", ci_role(ci)->name);
 
         return 0;
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 56d2d3213076..d68b125796f9 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1993,6 +1993,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci)
 int ci_hdrc_gadget_init(struct ci_hdrc *ci)
 {
         struct ci_role_driver *rdrv;
+        int ret;
 
         if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC))
                 return -ENXIO;
@@ -2005,7 +2006,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci)
         rdrv->stop      = udc_id_switch_for_host;
         rdrv->irq       = udc_irq;
         rdrv->name      = "gadget";
-        ci->roles[CI_ROLE_GADGET] = rdrv;
 
-        return udc_start(ci);
+        ret = udc_start(ci);
+        if (!ret)
+                ci->roles[CI_ROLE_GADGET] = rdrv;
+
+        return ret;
 }
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index e77a4ed4f021..9f4a0185dd60 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -108,6 +108,8 @@ struct imx_usbmisc {
         const struct usbmisc_ops *ops;
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data);
+
 static int usbmisc_imx25_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
@@ -242,10 +244,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
-                        writel(val, reg);
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
+                                writel(val, reg);
+                        }
+
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH2_CTRL_OFFSET;
@@ -267,10 +274,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
-                        writel(val, reg);
+
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
+                                writel(val, reg);
+                        }
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH3_CTRL_OFFSET;
@@ -456,6 +468,10 @@ static const struct usbmisc_ops imx27_usbmisc_ops = {
         .init = usbmisc_imx27_init,
 };
 
+static const struct usbmisc_ops imx51_usbmisc_ops = {
+        .init = usbmisc_imx53_init,
+};
+
 static const struct usbmisc_ops imx53_usbmisc_ops = {
         .init = usbmisc_imx53_init,
 };
@@ -479,6 +495,13 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = {
         .set_wakeup = usbmisc_imx7d_set_wakeup,
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data)
+{
+        struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
+
+        return usbmisc->ops == &imx53_usbmisc_ops;
+}
+
 int imx_usbmisc_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc;
@@ -536,7 +559,7 @@ static const struct of_device_id usbmisc_imx_dt_ids[] = {
         },
         {
                 .compatible = "fsl,imx51-usbmisc",
-                .data = &imx53_usbmisc_ops,
+                .data = &imx51_usbmisc_ops,
         },
         {
                 .compatible = "fsl,imx53-usbmisc",
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 9cd8722f24f6..a3ffe97170ff 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -144,6 +144,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
         { .compatible = "snps,dwc2" },
         { .compatible = "samsung,s3c6400-hsotg" },
+        { .compatible = "amlogic,meson8-usb",
+          .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson8b-usb",
           .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson-gxbb-usb",
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 49d685ad0da9..45b554032332 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -315,6 +315,9 @@ void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
         list_del(&f->list);
         if (f->unbind)
                 f->unbind(c, f);
+
+        if (f->bind_deactivated)
+                usb_function_activate(f);
 }
 EXPORT_SYMBOL_GPL(usb_remove_function);
 
@@ -956,12 +959,8 @@ static void remove_config(struct usb_composite_dev *cdev,
 
                 f = list_first_entry(&config->functions,
                                 struct usb_function, list);
-                list_del(&f->list);
-                if (f->unbind) {
-                        DBG(cdev, "unbind function '%s'/%p\n", f->name, f);
-                        f->unbind(config, f);
-                        /* may free memory for "f" */
-                }
+
+                usb_remove_function(config, f);
         }
         list_del(&config->list);
         if (config->unbind) {
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 4c8aacc232c0..74d57d6994da 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -396,7 +396,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 /* Caller must hold fsg->lock */
 static void wakeup_thread(struct fsg_common *common)
 {
-        smp_wmb();      /* ensure the write of bh->state is complete */
+        /*
+         * Ensure the reading of thread_wakeup_needed
+         * and the writing of bh->state are completed
+         */
+        smp_mb();
         /* Tell the main thread that something has happened */
         common->thread_wakeup_needed = 1;
         if (common->thread_task)
@@ -627,7 +631,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze)
         }
         __set_current_state(TASK_RUNNING);
         common->thread_wakeup_needed = 0;
-        smp_rmb();      /* ensure the latest bh->state is visible */
+
+        /*
+         * Ensure the writing of thread_wakeup_needed
+         * and the reading of bh->state are completed
+         */
+        smp_mb();
         return rc;
 }
 
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b4058f0000e4..6a1ce6a55158 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -281,7 +281,7 @@ static void pn_net_setup(struct net_device *dev)
         dev->tx_queue_len       = 1;
 
         dev->netdev_ops         = &pn_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index b9ca0a26cbd9..684900fcfe24 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd)
 
         /* closing ep0 === shutdown all */
 
-        if (dev->gadget_registered)
+        if (dev->gadget_registered) {
                 usb_gadget_unregister_driver (&gadgetfs_driver);
+                dev->gadget_registered = false;
+        }
 
         /* at this point "good" hardware has disconnected the
          * device from USB; the host won't see it any more.
@@ -1677,9 +1679,10 @@ static void
 gadgetfs_suspend (struct usb_gadget *gadget)
 {
         struct dev_data         *dev = get_gadget_data (gadget);
+        unsigned long           flags;
 
         INFO (dev, "suspended from state %d\n", dev->state);
-        spin_lock (&dev->lock);
+        spin_lock_irqsave(&dev->lock, flags);
         switch (dev->state) {
         case STATE_DEV_SETUP:           // VERY odd... host died??
         case STATE_DEV_CONNECTED:
@@ -1690,7 +1693,7 @@ gadgetfs_suspend (struct usb_gadget *gadget)
         default:
                 break;
         }
-        spin_unlock (&dev->lock);
+        spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static struct usb_gadget_driver gadgetfs_driver = {
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index ccabb51cb98d..7635fd7cc328 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -442,23 +442,16 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                 /* Report reset and disconnect events to the driver */
                 if (dum->driver && (disconnect || reset)) {
                         stop_activity(dum);
-                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
-                        spin_lock(&dum->lock);
                 }
         } else if (dum_hcd->active != dum_hcd->old_active) {
-                if (dum_hcd->old_active && dum->driver->suspend) {
-                        spin_unlock(&dum->lock);
+                if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
-                        spin_lock(&dum->lock);
-                } else if (!dum_hcd->old_active &&  dum->driver->resume) {
-                        spin_unlock(&dum->lock);
+                else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
-                        spin_lock(&dum->lock);
-                }
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -983,7 +976,9 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
         struct dummy            *dum = dum_hcd->dum;
 
+        spin_lock_irq(&dum->lock);
         dum->driver = NULL;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 6cf07857eaca..f2cbd7f8005e 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -2470,11 +2470,8 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
                 nuke(&dev->ep[i]);
 
         /* report disconnect; the driver is already quiesced */
-        if (driver) {
-                spin_unlock(&dev->lock);
+        if (driver)
                 driver->disconnect(&dev->gadget);
-                spin_lock(&dev->lock);
-        }
 
         usb_reinit(dev);
 }
@@ -3348,8 +3345,6 @@ next_endpoints:
                 BIT(PCI_RETRY_ABORT_INTERRUPT))
 
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
-__releases(dev->lock)
-__acquires(dev->lock)
 {
         struct net2280_ep       *ep;
         u32                     tmp, num, mask, scratch;
@@ -3390,14 +3385,12 @@ __acquires(dev->lock)
                         if (disconnect || reset) {
                                 stop_activity(dev, dev->driver);
                                 ep0_start(dev);
-                                spin_unlock(&dev->lock);
                                 if (reset)
                                         usb_gadget_udc_reset
                                                 (&dev->gadget, dev->driver);
                                 else
                                         (dev->driver->disconnect)
                                                 (&dev->gadget);
-                                spin_lock(&dev->lock);
                                 return;
                         }
                 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 5a2d845fb1a6..cd4c88529721 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -623,7 +623,6 @@ static void renesas_usb3_stop_controller(struct renesas_usb3 *usb3)
 {
         usb3_disconnect(usb3);
         usb3_write(usb3, 0, USB3_P0_INT_ENA);
-        usb3_write(usb3, 0, USB3_PN_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_OTG_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_1);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_2);
@@ -1475,7 +1474,13 @@ static void usb3_request_done_pipen(struct renesas_usb3 *usb3,
                                     struct renesas_usb3_request *usb3_req,
                                     int status)
 {
-        usb3_pn_stop(usb3);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        if (usb3_pn_change(usb3, usb3_ep->num))
+                usb3_pn_stop(usb3);
+        spin_unlock_irqrestore(&usb3->lock, flags);
+
         usb3_disable_pipe_irq(usb3, usb3_ep->num);
         usb3_request_done(usb3_ep, usb3_req, status);
 
@@ -1504,30 +1509,46 @@ static void usb3_irq_epc_pipen_bfrdy(struct renesas_usb3 *usb3, int num)
 {
         struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
         struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
+        bool done = false;
 
         if (!usb3_req)
                 return;
 
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num))
+                goto out;
+
         if (usb3_ep->dir_in) {
                 /* Do not stop the IN pipe here to detect LSTTR interrupt */
                 if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
                         usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
         } else {
                 if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
-                        usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+                        done = true;
         }
+
+out:
+        /* need to unlock because usb3_request_done_pipen() locks it */
+        spin_unlock(&usb3->lock);
+
+        if (done)
+                usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
 }
 
 static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
 {
         u32 pn_int_sta;
 
-        if (usb3_pn_change(usb3, num) < 0)
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num) < 0) {
+                spin_unlock(&usb3->lock);
                 return;
+        }
 
         pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
         pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
         usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
+        spin_unlock(&usb3->lock);
         if (pn_int_sta & PN_INT_LSTTR)
                 usb3_irq_epc_pipen_lsttr(usb3, num);
         if (pn_int_sta & PN_INT_BFRDY)
@@ -1660,6 +1681,7 @@ static int usb3_disable_pipe_n(struct renesas_usb3_ep *usb3_ep)
 
         spin_lock_irqsave(&usb3->lock, flags);
         if (!usb3_pn_change(usb3, usb3_ep->num)) {
+                usb3_write(usb3, 0, USB3_PN_INT_ENA);
                 usb3_write(usb3, 0, USB3_PN_RAMMAP);
                 usb3_clear_bit(usb3, PN_CON_EN, USB3_PN_CON);
         }
@@ -1799,6 +1821,9 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
         /* hook up the driver */
         usb3->driver = driver;
 
+        pm_runtime_enable(usb3_to_dev(usb3));
+        pm_runtime_get_sync(usb3_to_dev(usb3));
+
         renesas_usb3_init_controller(usb3);
 
         return 0;
@@ -1807,14 +1832,14 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
 static int renesas_usb3_stop(struct usb_gadget *gadget)
 {
         struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
-        unsigned long flags;
 
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3->softconnect = false;
         usb3->gadget.speed = USB_SPEED_UNKNOWN;
         usb3->driver = NULL;
         renesas_usb3_stop_controller(usb3);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+
+        pm_runtime_put(usb3_to_dev(usb3));
+        pm_runtime_disable(usb3_to_dev(usb3));
 
         return 0;
 }
@@ -1891,9 +1916,6 @@ static int renesas_usb3_remove(struct platform_device *pdev)
 
         device_remove_file(&pdev->dev, &dev_attr_role);
 
-        pm_runtime_put(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-
         usb_del_gadget_udc(&usb3->gadget);
 
         __renesas_usb3_ep_free_request(usb3->ep0_req);
@@ -2099,9 +2121,6 @@ static int renesas_usb3_probe(struct platform_device *pdev)
 
         usb3->workaround_for_vbus = priv->workaround_for_vbus;
 
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_get_sync(&pdev->dev);
-
         dev_info(&pdev->dev, "probed\n");
 
         return 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1f1687e888d6..fddf2731f798 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2119,11 +2119,12 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
 {
         u32 temp, port_offset, port_count;
         int i;
-        u8 major_revision;
+        u8 major_revision, minor_revision;
         struct xhci_hub *rhub;
 
         temp = readl(addr);
         major_revision = XHCI_EXT_PORT_MAJOR(temp);
+        minor_revision = XHCI_EXT_PORT_MINOR(temp);
 
         if (major_revision == 0x03) {
                 rhub = &xhci->usb3_rhub;
@@ -2137,7 +2138,9 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
                 return;
         }
         rhub->maj_rev = XHCI_EXT_PORT_MAJOR(temp);
-        rhub->min_rev = XHCI_EXT_PORT_MINOR(temp);
+
+        if (rhub->min_rev < minor_revision)
+                rhub->min_rev = minor_revision;
 
         /* Port offset and count in the third dword, see section 7.2 */
         temp = readl(addr + 2);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index fcf1f3f63e7a..1bcf971141c0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -201,6 +201,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
                         pdev->device == 0x1042)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1142)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 9c7ee26ef388..bc6a9be2ccc5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -245,6 +245,11 @@ static int dsps_check_status(struct musb *musb, void *unused)
                 dsps_mod_timer_optional(glue);
                 break;
         case OTG_STATE_A_WAIT_BCON:
+                /* keep VBUS on for host-only mode */
+                if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                        dsps_mod_timer_optional(glue);
+                        break;
+                }
                 musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
                 skip_session = 1;
                 /* fall */
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 687ebb053438..41d7979d81c5 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1048,7 +1048,7 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
 
         for (i = 0; i < (128 - edid[2]) / DETAILED_TIMING_DESCRIPTION_SIZE;
              i++, block += DETAILED_TIMING_DESCRIPTION_SIZE)
-                if (PIXEL_CLOCK)
+                if (PIXEL_CLOCK != 0)
                         edt[num++] = block - edid;
 
         /* Yikes, EDID data is totally useless */
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index ec2e7e353685..449fceaf79d5 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1646,8 +1646,9 @@ static int ufx_usb_probe(struct usb_interface *interface,
         dev_dbg(dev->gdev, "%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         dev_dbg(dev->gdev, "vid_%04x&pid_%04x&rev_%04x driver's ufx_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         dev_dbg(dev->gdev, "console enable=%d\n", console);
         dev_dbg(dev->gdev, "fb_defio enable=%d\n", fb_defio);
 
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 6a3c353de7c3..05ef657235df 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1105,8 +1105,8 @@ static int dlfb_ops_blank(int blank_mode, struct fb_info *info)
         char *bufptr;
         struct urb *urb;
 
-        pr_info("/dev/fb%d FB_BLANK mode %d --> %d\n",
-                info->node, dev->blank_mode, blank_mode);
+        pr_debug("/dev/fb%d FB_BLANK mode %d --> %d\n",
+                 info->node, dev->blank_mode, blank_mode);
 
         if ((dev->blank_mode == FB_BLANK_POWERDOWN) &&
             (blank_mode != FB_BLANK_POWERDOWN)) {
@@ -1613,8 +1613,9 @@ static int dlfb_usb_probe(struct usb_interface *interface,
         pr_info("%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         pr_info("vid_%04x&pid_%04x&rev_%04x driver's dlfb_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         pr_info("console enable=%d\n", console);
         pr_info("fb_defio enable=%d\n", fb_defio);
         pr_info("shadow enable=%d\n", shadow);
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index f9718f012aae..badee04ef496 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -1630,16 +1630,14 @@ static void viafb_init_proc(struct viafb_shared *shared)
 }
 static void viafb_remove_proc(struct viafb_shared *shared)
 {
-        struct proc_dir_entry *viafb_entry = shared->proc_entry,
-                *iga1_entry = shared->iga1_proc_entry,
-                *iga2_entry = shared->iga2_proc_entry;
+        struct proc_dir_entry *viafb_entry = shared->proc_entry;
 
         if (!viafb_entry)
                 return;
 
-        remove_proc_entry("output_devices", iga2_entry);
+        remove_proc_entry("output_devices", shared->iga2_proc_entry);
         remove_proc_entry("iga2", viafb_entry);
-        remove_proc_entry("output_devices", iga1_entry);
+        remove_proc_entry("output_devices", shared->iga1_proc_entry);
         remove_proc_entry("iga1", viafb_entry);
         remove_proc_entry("supported_output_devices", viafb_entry);
 
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 408c174ef0d5..22caf808bfab 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -663,6 +663,12 @@ static int virtballoon_restore(struct virtio_device *vdev)
 }
 #endif
 
+static int virtballoon_validate(struct virtio_device *vdev)
+{
+        __virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
+        return 0;
+}
+
 static unsigned int features[] = {
         VIRTIO_BALLOON_F_MUST_TELL_HOST,
         VIRTIO_BALLOON_F_STATS_VQ,
@@ -675,6 +681,7 @@ static struct virtio_driver virtio_balloon_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtballoon_validate,
         .probe =        virtballoon_probe,
         .remove =       virtballoon_remove,
         .config_changed = virtballoon_changed,
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7a92a5e1d40c..feca75b07fdd 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -362,8 +362,8 @@ static int mmap_batch_fn(void *data, int nr, void *state)
                                 st->global_error = 1;
                 }
         }
-        st->va += PAGE_SIZE * nr;
-        st->index += nr;
+        st->va += XEN_PAGE_SIZE * nr;
+        st->index += nr / XEN_PFN_PER_PAGE;
 
         return 0;
 }
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 734cbf8d9676..dd9f1bebb5a3 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -344,7 +344,7 @@ static int autofs_dev_ioctl_fail(struct file *fp,
         int status;
 
         token = (autofs_wqt_t) param->fail.token;
-        status = param->fail.status ? param->fail.status : -ENOENT;
+        status = param->fail.status < 0 ? param->fail.status : -ENOENT;
         return autofs4_wait_release(sbi, token, status);
 }
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 519599dddd36..0a7404ef9335 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -263,7 +263,10 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
                 kfree(vecs);
 
         if (unlikely(bio.bi_error))
-                return bio.bi_error;
+                ret = bio.bi_error;
+
+        bio_uninit(&bio);
+
         return ret;
 }
 
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 643c70d2b2e6..4f8f75d9e839 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2563,7 +2563,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
 }
 
 /*
@@ -2573,7 +2573,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
 }
 
 int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index 60a750678a82..c24d615e3d7f 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -468,7 +468,7 @@ int verify_dir_item(struct btrfs_fs_info *fs_info,
 
         if (btrfs_dir_name_len(leaf, dir_item) > namelen) {
                 btrfs_crit(fs_info, "invalid dir item name len: %u",
-                       (unsigned)btrfs_dir_data_len(leaf, dir_item));
+                       (unsigned)btrfs_dir_name_len(leaf, dir_item));
                 return 1;
         }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8685d67185d0..5f678dcb20e6 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3467,10 +3467,12 @@ static int write_dev_supers(struct btrfs_device *device,
                  * we fua the first super.  The others we allow
                  * to go down lazy.
                  */
-                if (i == 0)
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_FUA, bh);
-                else
+                if (i == 0) {
+                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
+                                                REQ_SYNC | REQ_FUA, bh);
+                } else {
                         ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
+                }
                 if (ret)
                         errors++;
         }
@@ -3535,7 +3537,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
 
         bio->bi_end_io = btrfs_end_empty_barrier;
         bio->bi_bdev = device->bdev;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH;
         init_completion(&device->flush_wait);
         bio->bi_private = &device->flush_wait;
         device->flush_bio = bio;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e390451c72e6..33d979e9ea2a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3993,6 +3993,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
                                     info->space_info_kobj, "%s",
                                     alloc_name(found->flags));
         if (ret) {
+                percpu_counter_destroy(&found->total_bytes_pinned);
                 kfree(found);
                 return ret;
         }
@@ -4844,7 +4845,7 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_rsv->lock);
 
 commit:
-        trans = btrfs_join_transaction(fs_info->fs_root);
+        trans = btrfs_join_transaction(fs_info->extent_root);
         if (IS_ERR(trans))
                 return -ENOSPC;
 
@@ -4862,7 +4863,7 @@ static int flush_space(struct btrfs_fs_info *fs_info,
                        struct btrfs_space_info *space_info, u64 num_bytes,
                        u64 orig_bytes, int state)
 {
-        struct btrfs_root *root = fs_info->fs_root;
+        struct btrfs_root *root = fs_info->extent_root;
         struct btrfs_trans_handle *trans;
         int nr;
         int ret = 0;
@@ -5062,7 +5063,7 @@ static void priority_reclaim_metadata_space(struct btrfs_fs_info *fs_info,
         int flush_state = FLUSH_DELAYED_ITEMS_NR;
 
         spin_lock(&space_info->lock);
-        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->fs_root,
+        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->extent_root,
                                                       space_info);
         if (!to_reclaim) {
                 spin_unlock(&space_info->lock);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index d8da3edf2ac3..d3619e010005 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2458,7 +2458,7 @@ void end_extent_writepage(struct page *page, int err, u64 start, u64 end)
         if (!uptodate) {
                 ClearPageUptodate(page);
                 SetPageError(page);
-                ret = ret < 0 ? ret : -EIO;
+                ret = err < 0 ? err : -EIO;
                 mapping_set_error(page->mapping, ret);
         }
 }
@@ -4377,6 +4377,123 @@ static struct extent_map *get_extent_skip_holes(struct inode *inode,
         return NULL;
 }
 
+/*
+ * To cache previous fiemap extent
+ *
+ * Will be used for merging fiemap extent
+ */
+struct fiemap_cache {
+        u64 offset;
+        u64 phys;
+        u64 len;
+        u32 flags;
+        bool cached;
+};
+
+/*
+ * Helper to submit fiemap extent.
+ *
+ * Will try to merge current fiemap extent specified by @offset, @phys,
+ * @len and @flags with cached one.
+ * And only when we fails to merge, cached one will be submitted as
+ * fiemap extent.
+ *
+ * Return value is the same as fiemap_fill_next_extent().
+ */
+static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+                                struct fiemap_cache *cache,
+                                u64 offset, u64 phys, u64 len, u32 flags)
+{
+        int ret = 0;
+
+        if (!cache->cached)
+                goto assign;
+
+        /*
+         * Sanity check, extent_fiemap() should have ensured that new
+         * fiemap extent won't overlap with cahced one.
+         * Not recoverable.
+         *
+         * NOTE: Physical address can overlap, due to compression
+         */
+        if (cache->offset + cache->len > offset) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        /*
+         * Only merges fiemap extents if
+         * 1) Their logical addresses are continuous
+         *
+         * 2) Their physical addresses are continuous
+         *    So truly compressed (physical size smaller than logical size)
+         *    extents won't get merged with each other
+         *
+         * 3) Share same flags except FIEMAP_EXTENT_LAST
+         *    So regular extent won't get merged with prealloc extent
+         */
+        if (cache->offset + cache->len  == offset &&
+            cache->phys + cache->len == phys  &&
+            (cache->flags & ~FIEMAP_EXTENT_LAST) ==
+                        (flags & ~FIEMAP_EXTENT_LAST)) {
+                cache->len += len;
+                cache->flags |= flags;
+                goto try_submit_last;
+        }
+
+        /* Not mergeable, need to submit cached one */
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret)
+                return ret;
+assign:
+        cache->cached = true;
+        cache->offset = offset;
+        cache->phys = phys;
+        cache->len = len;
+        cache->flags = flags;
+try_submit_last:
+        if (cache->flags & FIEMAP_EXTENT_LAST) {
+                ret = fiemap_fill_next_extent(fieinfo, cache->offset,
+                                cache->phys, cache->len, cache->flags);
+                cache->cached = false;
+        }
+        return ret;
+}
+
+/*
+ * Sanity check for fiemap cache
+ *
+ * All fiemap cache should be submitted by emit_fiemap_extent()
+ * Iteration should be terminated either by last fiemap extent or
+ * fieinfo->fi_extents_max.
+ * So no cached fiemap should exist.
+ */
+static int check_fiemap_cache(struct btrfs_fs_info *fs_info,
+                               struct fiemap_extent_info *fieinfo,
+                               struct fiemap_cache *cache)
+{
+        int ret;
+
+        if (!cache->cached)
+                return 0;
+
+        /* Small and recoverbale problem, only to info developer */
+#ifdef CONFIG_BTRFS_DEBUG
+        WARN_ON(1);
+#endif
+        btrfs_warn(fs_info,
+                   "unhandled fiemap cache detected: offset=%llu phys=%llu len=%llu flags=0x%x",
+                   cache->offset, cache->phys, cache->len, cache->flags);
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
+
 int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 __u64 start, __u64 len, get_extent_t *get_extent)
 {
@@ -4394,6 +4511,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         struct extent_state *cached_state = NULL;
         struct btrfs_path *path;
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct fiemap_cache cache = { 0 };
         int end = 0;
         u64 em_start = 0;
         u64 em_len = 0;
@@ -4573,8 +4691,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                         flags |= FIEMAP_EXTENT_LAST;
                         end = 1;
                 }
-                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
-                                              em_len, flags);
+                ret = emit_fiemap_extent(fieinfo, &cache, em_start, disko,
+                                           em_len, flags);
                 if (ret) {
                         if (ret == 1)
                                 ret = 0;
@@ -4582,6 +4700,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 }
         }
 out_free:
+        if (!ret)
+                ret = check_fiemap_cache(root->fs_info, fieinfo, &cache);
         free_extent_map(em);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/hash.c b/fs/btrfs/hash.c
index a97fdc156a03..baacc1866861 100644
--- a/fs/btrfs/hash.c
+++ b/fs/btrfs/hash.c
@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
 {
         SHASH_DESC_ON_STACK(shash, tfm);
         u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 retval;
         int err;
 
         shash->tfm = tfm;
@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        retval = *ctx;
+        barrier_data(ctx);
+        return retval;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 17cbe9306faf..ef3c98c527c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2952,7 +2952,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
 
         ret = test_range_bit(io_tree, ordered_extent->file_offset,
                         ordered_extent->file_offset + ordered_extent->len - 1,
-                        EXTENT_DEFRAG, 1, cached_state);
+                        EXTENT_DEFRAG, 0, cached_state);
         if (ret) {
                 u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item);
                 if (0 && last_snapshot >= BTRFS_I(inode)->generation)
@@ -7483,8 +7483,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end)
         int found = false;
         void **pagep = NULL;
         struct page *page = NULL;
-        int start_idx;
-        int end_idx;
+        unsigned long start_idx;
+        unsigned long end_idx;
 
         start_idx = start >> PAGE_SHIFT;
 
diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
index 987044bca1c2..59cb307b15fb 100644
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -131,6 +131,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
         }
 
         if (new_mode != old_mode) {
+                newattrs.ia_ctime = current_time(inode);
                 newattrs.ia_mode = new_mode;
                 newattrs.ia_valid = ATTR_MODE;
                 ret = __ceph_setattr(inode, &newattrs);
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index e8f11fa565c5..7df550c13d7f 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -91,6 +91,10 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, u64 ino)
                 ceph_mdsc_put_request(req);
                 if (!inode)
                         return ERR_PTR(-ESTALE);
+                if (inode->i_nlink == 0) {
+                        iput(inode);
+                        return ERR_PTR(-ESTALE);
+                }
         }
 
         return d_obtain_alias(inode);
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 3fdde0b283c9..29308a80d66f 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1671,8 +1671,12 @@ static long ceph_fallocate(struct file *file, int mode,
         }
 
         size = i_size_read(inode);
-        if (!(mode & FALLOC_FL_KEEP_SIZE))
+        if (!(mode & FALLOC_FL_KEEP_SIZE)) {
                 endoff = offset + length;
+                ret = inode_newsize_ok(inode, endoff);
+                if (ret)
+                        goto unlock;
+        }
 
         if (fi->fmode & CEPH_FILE_MODE_LAZY)
                 want = CEPH_CAP_FILE_BUFFER | CEPH_CAP_FILE_LAZYIO;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index dcce79b84406..4de6cdddf059 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -2022,7 +2022,6 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                     attr->ia_size > inode->i_size) {
                         i_size_write(inode, attr->ia_size);
                         inode->i_blocks = calc_inode_blocks(attr->ia_size);
-                        inode->i_ctime = attr->ia_ctime;
                         ci->i_reported_size = attr->ia_size;
                         dirtied |= CEPH_CAP_FILE_EXCL;
                 } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
@@ -2044,7 +2043,6 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                      inode->i_ctime.tv_sec, inode->i_ctime.tv_nsec,
                      attr->ia_ctime.tv_sec, attr->ia_ctime.tv_nsec,
                      only ? "ctime only" : "ignored");
-                inode->i_ctime = attr->ia_ctime;
                 if (only) {
                         /*
                          * if kernel wants to dirty ctime but nothing else,
@@ -2067,7 +2065,7 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
         if (dirtied) {
                 inode_dirty_flags = __ceph_mark_dirty_caps(ci, dirtied,
                                                            &prealloc_cf);
-                inode->i_ctime = current_time(inode);
+                inode->i_ctime = attr->ia_ctime;
         }
 
         release &= issued;
@@ -2085,6 +2083,7 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                 req->r_inode_drop = release;
                 req->r_args.setattr.mask = cpu_to_le32(mask);
                 req->r_num_caps = 1;
+                req->r_stamp = attr->ia_ctime;
                 err = ceph_mdsc_do_request(mdsc, NULL, req);
         }
         dout("setattr %p result=%d (%s locally, %d remote)\n", inode, err,
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index f38e56fa9712..0c05df44cc6c 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1687,7 +1687,6 @@ struct ceph_mds_request *
 ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
 {
         struct ceph_mds_request *req = kzalloc(sizeof(*req), GFP_NOFS);
-        struct timespec ts;
 
         if (!req)
                 return ERR_PTR(-ENOMEM);
@@ -1706,8 +1705,7 @@ ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
         init_completion(&req->r_safe_completion);
         INIT_LIST_HEAD(&req->r_unsafe_item);
 
-        ktime_get_real_ts(&ts);
-        req->r_stamp = timespec_trunc(ts, mdsc->fsc->sb->s_time_gran);
+        req->r_stamp = timespec_trunc(current_kernel_time(), mdsc->fsc->sb->s_time_gran);
 
         req->r_op = op;
         req->r_direct_mode = mode;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 0fd081bd2a2f..fcef70602b27 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3271,7 +3271,7 @@ ssize_t cifs_user_readv(struct kiocb *iocb, struct iov_iter *to)
         if (!is_sync_kiocb(iocb))
                 ctx->iocb = iocb;
 
-        if (to->type & ITER_IOVEC)
+        if (to->type == ITER_IOVEC)
                 ctx->should_dirty = true;
 
         rc = setup_aio_ctx_iter(ctx, to, READ);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index b08531977daa..3b147dc6af63 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -810,7 +810,7 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw)
 
         if (!pages) {
                 pages = vmalloc(max_pages * sizeof(struct page *));
-                if (!bv) {
+                if (!pages) {
                         kvfree(bv);
                         return -ENOMEM;
                 }
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 27bc360c7ffd..a723df3e0197 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -849,8 +849,13 @@ cifs_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
                      struct cifs_fid *fid, __u16 search_flags,
                      struct cifs_search_info *srch_inf)
 {
-        return CIFSFindFirst(xid, tcon, path, cifs_sb,
-                             &fid->netfid, search_flags, srch_inf, true);
+        int rc;
+
+        rc = CIFSFindFirst(xid, tcon, path, cifs_sb,
+                           &fid->netfid, search_flags, srch_inf, true);
+        if (rc)
+                cifs_dbg(FYI, "find first failed=%d\n", rc);
+        return rc;
 }
 
 static int
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index c58691834eb2..7e48561abd29 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -982,7 +982,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL);
         kfree(utf16_path);
         if (rc) {
-                cifs_dbg(VFS, "open dir failed\n");
+                cifs_dbg(FYI, "open dir failed rc=%d\n", rc);
                 return rc;
         }
 
@@ -992,7 +992,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
                                   fid->volatile_fid, 0, srch_inf);
         if (rc) {
-                cifs_dbg(VFS, "query directory failed\n");
+                cifs_dbg(FYI, "query directory failed rc=%d\n", rc);
                 SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid);
         }
         return rc;
@@ -1809,7 +1809,8 @@ crypt_message(struct TCP_Server_Info *server, struct smb_rqst *rqst, int enc)
 
         sg = init_sg(rqst, sign);
         if (!sg) {
-                cifs_dbg(VFS, "%s: Failed to init sg %d", __func__, rc);
+                cifs_dbg(VFS, "%s: Failed to init sg", __func__);
+                rc = -ENOMEM;
                 goto free_req;
         }
 
@@ -1817,6 +1818,7 @@ crypt_message(struct TCP_Server_Info *server, struct smb_rqst *rqst, int enc)
         iv = kzalloc(iv_len, GFP_KERNEL);
         if (!iv) {
                 cifs_dbg(VFS, "%s: Failed to alloc IV", __func__);
+                rc = -ENOMEM;
                 goto free_sg;
         }
         iv[0] = 3;
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 3cb5c9e2d4e7..de50e749ff05 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -188,8 +188,6 @@ static int cifs_creation_time_get(struct dentry *dentry, struct inode *inode,
         pcreatetime = (__u64 *)value;
         *pcreatetime = CIFS_I(inode)->createtime;
         return sizeof(__u64);
-
-        return rc;
 }
 
 
diff --git a/fs/configfs/item.c b/fs/configfs/item.c
index 8b2a994042dd..a66f6624d899 100644
--- a/fs/configfs/item.c
+++ b/fs/configfs/item.c
@@ -138,6 +138,14 @@ struct config_item *config_item_get(struct config_item *item)
 }
 EXPORT_SYMBOL(config_item_get);
 
+struct config_item *config_item_get_unless_zero(struct config_item *item)
+{
+        if (item && kref_get_unless_zero(&item->ci_kref))
+                return item;
+        return NULL;
+}
+EXPORT_SYMBOL(config_item_get_unless_zero);
+
 static void config_item_cleanup(struct config_item *item)
 {
         struct config_item_type *t = item->ci_type;
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index a6ab012a2c6a..c8aabba502f6 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -83,14 +83,13 @@ static int create_link(struct config_item *parent_item,
         ret = -ENOMEM;
         sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL);
         if (sl) {
-                sl->sl_target = config_item_get(item);
                 spin_lock(&configfs_dirent_lock);
                 if (target_sd->s_type & CONFIGFS_USET_DROPPING) {
                         spin_unlock(&configfs_dirent_lock);
-                        config_item_put(item);
                         kfree(sl);
                         return -ENOENT;
                 }
+                sl->sl_target = config_item_get(item);
                 list_add(&sl->sl_list, &target_sd->s_links);
                 spin_unlock(&configfs_dirent_lock);
                 ret = configfs_create_link(sl, parent_item->ci_dentry,
diff --git a/fs/dax.c b/fs/dax.c
index c22eaf162f95..9187f3b07f3e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -859,6 +859,7 @@ int dax_writeback_mapping_range(struct address_space *mapping,
                         if (ret < 0)
                                 goto out;
                 }
+                start_index = indices[pvec.nr - 1] + 1;
         }
 out:
         put_dax(dax_dev);
@@ -1155,6 +1156,17 @@ static int dax_iomap_pte_fault(struct vm_fault *vmf,
         }
 
         /*
+         * It is possible, particularly with mixed reads & writes to private
+         * mappings, that we have raced with a PMD fault that overlaps with
+         * the PTE we need to set up.  If so just return and the fault will be
+         * retried.
+         */
+        if (pmd_trans_huge(*vmf->pmd) || pmd_devmap(*vmf->pmd)) {
+                vmf_ret = VM_FAULT_NOPAGE;
+                goto unlock_entry;
+        }
+
+        /*
          * Note that we don't bother to use iomap_apply here: DAX required
          * the file system block size to be equal the page size, which means
          * that we never have to deal with more than a single extent here.
@@ -1398,6 +1410,18 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf,
                 goto fallback;
 
         /*
+         * It is possible, particularly with mixed reads & writes to private
+         * mappings, that we have raced with a PTE fault that overlaps with
+         * the PMD we need to set up.  If so just return and the fault will be
+         * retried.
+         */
+        if (!pmd_none(*vmf->pmd) && !pmd_trans_huge(*vmf->pmd) &&
+                        !pmd_devmap(*vmf->pmd)) {
+                result = 0;
+                goto unlock_entry;
+        }
+
+        /*
          * Note that we don't use iomap_apply here.  We aren't doing I/O, only
          * setting up a mapping, so really we're using iomap_begin() as a way
          * to look up our filesystem block.
diff --git a/fs/dcache.c b/fs/dcache.c
index cddf39777835..a9f995f6859e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1494,7 +1494,7 @@ static void check_and_drop(void *_data)
 {
         struct detach_data *data = _data;
 
-        if (!data->mountpoint && !data->select.found)
+        if (!data->mountpoint && list_empty(&data->select.dispose))
                 __d_drop(data->select.start);
 }
 
@@ -1536,17 +1536,15 @@ void d_invalidate(struct dentry *dentry)
 
                 d_walk(dentry, &data, detach_and_collect, check_and_drop);
 
-                if (data.select.found)
+                if (!list_empty(&data.select.dispose))
                         shrink_dentry_list(&data.select.dispose);
+                else if (!data.mountpoint)
+                        return;
 
                 if (data.mountpoint) {
                         detach_mounts(data.mountpoint);
                         dput(data.mountpoint);
                 }
-
-                if (!data.mountpoint && !data.select.found)
-                        break;
-
                 cond_resched();
         }
 }
diff --git a/fs/exec.c b/fs/exec.c
index 72934df68471..904199086490 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -220,8 +220,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 
         if (write) {
                 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
+                unsigned long ptr_size;
                 struct rlimit *rlim;
 
+                /*
+                 * Since the stack will hold pointers to the strings, we
+                 * must account for them as well.
+                 *
+                 * The size calculation is the entire vma while each arg page is
+                 * built, so each time we get here it's calculating how far it
+                 * is currently (rather than each call being just the newly
+                 * added size from the arg page).  As a result, we need to
+                 * always add the entire size of the pointers, so that on the
+                 * last call to get_arg_page() we'll actually have the entire
+                 * correct size.
+                 */
+                ptr_size = (bprm->argc + bprm->envc) * sizeof(void *);
+                if (ptr_size > ULONG_MAX - size)
+                        goto fail;
+                size += ptr_size;
+
                 acct_arg_size(bprm, size / PAGE_SIZE);
 
                 /*
@@ -239,13 +257,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                  *    to work from.
                  */
                 rlim = current->signal->rlim;
-                if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
-                        put_page(page);
-                        return NULL;
-                }
+                if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)
+                        goto fail;
         }
 
         return page;
+
+fail:
+        put_page(page);
+        return NULL;
 }
 
 static void put_arg_page(struct page *page)
diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
index fd389935ecd1..3ec0e46de95f 100644
--- a/fs/ext4/acl.c
+++ b/fs/ext4/acl.c
@@ -4,6 +4,7 @@
  * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
  */
 
+#include <linux/quotaops.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 #include "xattr.h"
@@ -232,6 +233,9 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type)
         handle_t *handle;
         int error, retries = 0;
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR,
                                     ext4_jbd2_credits_xattr(inode));
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 8e8046104f4d..32191548abed 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2523,7 +2523,6 @@ extern int ext4_search_dir(struct buffer_head *bh,
                            int buf_size,
                            struct inode *dir,
                            struct ext4_filename *fname,
-                           const struct qstr *d_name,
                            unsigned int offset,
                            struct ext4_dir_entry_2 **res_dir);
 extern int ext4_generic_delete_entry(handle_t *handle,
@@ -3007,7 +3006,6 @@ extern int htree_inlinedir_to_tree(struct file *dir_file,
                                    int *has_inline_data);
 extern struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data);
 extern int ext4_delete_inline_entry(handle_t *handle,
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2a97dff87b96..3e36508610b7 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3413,13 +3413,13 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         struct ext4_sb_info *sbi;
         struct ext4_extent_header *eh;
         struct ext4_map_blocks split_map;
-        struct ext4_extent zero_ex;
+        struct ext4_extent zero_ex1, zero_ex2;
         struct ext4_extent *ex, *abut_ex;
         ext4_lblk_t ee_block, eof_block;
         unsigned int ee_len, depth, map_len = map->m_len;
         int allocated = 0, max_zeroout = 0;
         int err = 0;
-        int split_flag = 0;
+        int split_flag = EXT4_EXT_DATA_VALID2;
 
         ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
                 "block %llu, max_blocks %u\n", inode->i_ino,
@@ -3436,7 +3436,8 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         ex = path[depth].p_ext;
         ee_block = le32_to_cpu(ex->ee_block);
         ee_len = ext4_ext_get_actual_len(ex);
-        zero_ex.ee_len = 0;
+        zero_ex1.ee_len = 0;
+        zero_ex2.ee_len = 0;
 
         trace_ext4_ext_convert_to_initialized_enter(inode, map, ex);
 
@@ -3576,62 +3577,52 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         if (ext4_encrypted_inode(inode))
                 max_zeroout = 0;
 
-        /* If extent is less than s_max_zeroout_kb, zeroout directly */
-        if (max_zeroout && (ee_len <= max_zeroout)) {
-                err = ext4_ext_zeroout(inode, ex);
-                if (err)
-                        goto out;
-                zero_ex.ee_block = ex->ee_block;
-                zero_ex.ee_len = cpu_to_le16(ext4_ext_get_actual_len(ex));
-                ext4_ext_store_pblock(&zero_ex, ext4_ext_pblock(ex));
-
-                err = ext4_ext_get_access(handle, inode, path + depth);
-                if (err)
-                        goto out;
-                ext4_ext_mark_initialized(ex);
-                ext4_ext_try_to_merge(handle, inode, path, ex);
-                err = ext4_ext_dirty(handle, inode, path + path->p_depth);
-                goto out;
-        }
-
         /*
-         * four cases:
+         * five cases:
          * 1. split the extent into three extents.
-         * 2. split the extent into two extents, zeroout the first half.
-         * 3. split the extent into two extents, zeroout the second half.
+         * 2. split the extent into two extents, zeroout the head of the first
+         *    extent.
+         * 3. split the extent into two extents, zeroout the tail of the second
+         *    extent.
          * 4. split the extent into two extents with out zeroout.
+         * 5. no splitting needed, just possibly zeroout the head and / or the
+         *    tail of the extent.
          */
         split_map.m_lblk = map->m_lblk;
         split_map.m_len = map->m_len;
 
-        if (max_zeroout && (allocated > map->m_len)) {
+        if (max_zeroout && (allocated > split_map.m_len)) {
                 if (allocated <= max_zeroout) {
-                        /* case 3 */
-                        zero_ex.ee_block =
-                                         cpu_to_le32(map->m_lblk);
-                        zero_ex.ee_len = cpu_to_le16(allocated);
-                        ext4_ext_store_pblock(&zero_ex,
-                                ext4_ext_pblock(ex) + map->m_lblk - ee_block);
-                        err = ext4_ext_zeroout(inode, &zero_ex);
+                        /* case 3 or 5 */
+                        zero_ex1.ee_block =
+                                 cpu_to_le32(split_map.m_lblk +
+                                             split_map.m_len);
+                        zero_ex1.ee_len =
+                                cpu_to_le16(allocated - split_map.m_len);
+                        ext4_ext_store_pblock(&zero_ex1,
+                                ext4_ext_pblock(ex) + split_map.m_lblk +
+                                split_map.m_len - ee_block);
+                        err = ext4_ext_zeroout(inode, &zero_ex1);
                         if (err)
                                 goto out;
-                        split_map.m_lblk = map->m_lblk;
                         split_map.m_len = allocated;
-                } else if (map->m_lblk - ee_block + map->m_len < max_zeroout) {
-                        /* case 2 */
-                        if (map->m_lblk != ee_block) {
-                                zero_ex.ee_block = ex->ee_block;
-                                zero_ex.ee_len = cpu_to_le16(map->m_lblk -
+                }
+                if (split_map.m_lblk - ee_block + split_map.m_len <
+                                                                max_zeroout) {
+                        /* case 2 or 5 */
+                        if (split_map.m_lblk != ee_block) {
+                                zero_ex2.ee_block = ex->ee_block;
+                                zero_ex2.ee_len = cpu_to_le16(split_map.m_lblk -
                                                         ee_block);
-                                ext4_ext_store_pblock(&zero_ex,
+                                ext4_ext_store_pblock(&zero_ex2,
                                                       ext4_ext_pblock(ex));
-                                err = ext4_ext_zeroout(inode, &zero_ex);
+                                err = ext4_ext_zeroout(inode, &zero_ex2);
                                 if (err)
                                         goto out;
                         }
 
+                        split_map.m_len += split_map.m_lblk - ee_block;
                         split_map.m_lblk = ee_block;
-                        split_map.m_len = map->m_lblk - ee_block + map->m_len;
                         allocated = map->m_len;
                 }
         }
@@ -3642,8 +3633,11 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 err = 0;
 out:
         /* If we have gotten a failure, don't zero out status tree */
-        if (!err)
-                err = ext4_zeroout_es(inode, &zero_ex);
+        if (!err) {
+                err = ext4_zeroout_es(inode, &zero_ex1);
+                if (!err)
+                        err = ext4_zeroout_es(inode, &zero_ex2);
+        }
         return err ? err : allocated;
 }
 
@@ -4883,6 +4877,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
         /* Zero out partial block at the edges of the range */
         ret = ext4_zero_partial_blocks(handle, inode, offset, len);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
         if (file->f_flags & O_SYNC)
                 ext4_handle_sync(handle);
@@ -5569,6 +5565,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
                 ext4_handle_sync(handle);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
@@ -5742,6 +5739,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
         up_write(&EXT4_I(inode)->i_data_sem);
         if (IS_SYNC(inode))
                 ext4_handle_sync(handle);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 831fd6beebf0..02ce7e7bbdf5 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -474,57 +474,37 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
         endoff = (loff_t)end_blk << blkbits;
 
         index = startoff >> PAGE_SHIFT;
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
 
         pagevec_init(&pvec, 0);
         do {
                 int i, num;
                 unsigned long nr_pages;
 
-                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           (pgoff_t)num);
-                if (nr_pages == 0) {
-                        if (whence == SEEK_DATA)
-                                break;
-
-                        BUG_ON(whence != SEEK_HOLE);
-                        /*
-                         * If this is the first time to go into the loop and
-                         * offset is not beyond the end offset, it will be a
-                         * hole at this offset
-                         */
-                        if (lastoff == startoff || lastoff < endoff)
-                                found = 1;
-                        break;
-                }
-
-                /*
-                 * If this is the first time to go into the loop and
-                 * offset is smaller than the first page offset, it will be a
-                 * hole at this offset.
-                 */
-                if (lastoff == startoff && whence == SEEK_HOLE &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = 1;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page *page = pvec.pages[i];
                         struct buffer_head *bh, *head;
 
                         /*
-                         * If the current offset is not beyond the end of given
-                         * range, it will be a hole.
+                         * If current offset is smaller than the page offset,
+                         * there is a hole at this offset.
                          */
-                        if (lastoff < endoff && whence == SEEK_HOLE &&
-                            page->index > end) {
+                        if (whence == SEEK_HOLE && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
                                 found = 1;
                                 *offset = lastoff;
                                 goto out;
                         }
 
+                        if (page->index > end)
+                                goto out;
+
                         lock_page(page);
 
                         if (unlikely(page->mapping != inode->i_mapping)) {
@@ -564,20 +544,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
                         unlock_page(page);
                 }
 
-                /*
-                 * The no. of pages is less than our desired, that would be a
-                 * hole in there.
-                 */
-                if (nr_pages < num && whence == SEEK_HOLE) {
-                        found = 1;
-                        *offset = lastoff;
+                /* The no. of pages is less than our desired, we are done. */
+                if (nr_pages < num)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        if (whence == SEEK_HOLE && lastoff < endoff) {
+                found = 1;
+                *offset = lastoff;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index d5dea4c293ef..8d141c0c8ff9 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1627,7 +1627,6 @@ out:
 
 struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data)
 {
@@ -1649,7 +1648,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                                 EXT4_INLINE_DOTDOT_SIZE;
         inline_size = EXT4_MIN_INLINE_DATA_SIZE - EXT4_INLINE_DOTDOT_SIZE;
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
         if (ret < 0)
@@ -1662,7 +1661,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
         inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
 
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1bd0bfa547f6..5cf82d03968c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2124,15 +2124,29 @@ static int ext4_writepage(struct page *page,
 static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
 {
         int len;
-        loff_t size = i_size_read(mpd->inode);
+        loff_t size;
         int err;
 
         BUG_ON(page->index != mpd->first_page);
+        clear_page_dirty_for_io(page);
+        /*
+         * We have to be very careful here!  Nothing protects writeback path
+         * against i_size changes and the page can be writeably mapped into
+         * page tables. So an application can be growing i_size and writing
+         * data through mmap while writeback runs. clear_page_dirty_for_io()
+         * write-protects our page in page tables and the page cannot get
+         * written to again until we release page lock. So only after
+         * clear_page_dirty_for_io() we are safe to sample i_size for
+         * ext4_bio_write_page() to zero-out tail of the written page. We rely
+         * on the barrier provided by TestClearPageDirty in
+         * clear_page_dirty_for_io() to make sure i_size is really sampled only
+         * after page tables are updated.
+         */
+        size = i_size_read(mpd->inode);
         if (page->index == size >> PAGE_SHIFT)
                 len = size & ~PAGE_MASK;
         else
                 len = PAGE_SIZE;
-        clear_page_dirty_for_io(page);
         err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false);
         if (!err)
                 mpd->wbc->nr_to_write--;
@@ -3629,9 +3643,6 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter)
                 get_block_func = ext4_dio_get_block_unwritten_async;
                 dio_flags = DIO_LOCKING;
         }
-#ifdef CONFIG_EXT4_FS_ENCRYPTION
-        BUG_ON(ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode));
-#endif
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev, iter,
                                    get_block_func, ext4_end_io_dio, NULL,
                                    dio_flags);
@@ -3713,7 +3724,7 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
          */
         inode_lock_shared(inode);
         ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
-                                           iocb->ki_pos + count);
+                                           iocb->ki_pos + count - 1);
         if (ret)
                 goto out_unlock;
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev,
@@ -4207,6 +4218,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
 
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 out_stop:
         ext4_journal_stop(handle);
 out_dio:
@@ -5637,8 +5650,9 @@ static int ext4_expand_extra_isize(struct inode *inode,
         /* No extended attributes present */
         if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
             header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
-                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
-                        new_extra_isize);
+                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+                       EXT4_I(inode)->i_extra_isize, 0,
+                       new_extra_isize - EXT4_I(inode)->i_extra_isize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
                 return 0;
         }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 5083bce20ac4..b7928cddd539 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3887,7 +3887,8 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
 
         err = ext4_mb_load_buddy(sb, group, &e4b);
         if (err) {
-                ext4_error(sb, "Error loading buddy information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             err, group);
                 put_bh(bitmap_bh);
                 return 0;
         }
@@ -4044,10 +4045,11 @@ repeat:
                 BUG_ON(pa->pa_type != MB_INODE_PA);
                 group = ext4_get_group_number(sb, pa->pa_pstart);
 
-                err = ext4_mb_load_buddy(sb, group, &e4b);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
                 if (err) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
 
@@ -4303,11 +4305,14 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
         spin_unlock(&lg->lg_prealloc_lock);
 
         list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
+                int err;
 
                 group = ext4_get_group_number(sb, pa->pa_pstart);
-                if (ext4_mb_load_buddy(sb, group, &e4b)) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
+                if (err) {
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
                 ext4_lock_group(sb, group);
@@ -5127,8 +5132,8 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,
 
         ret = ext4_mb_load_buddy(sb, group, &e4b);
         if (ret) {
-                ext4_error(sb, "Error in loading buddy "
-                                "information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             ret, group);
                 return ret;
         }
         bitmap = e4b.bd_bitmap;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b81f7d46f344..404256caf9cf 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1155,12 +1155,11 @@ errout:
 static inline int search_dirblock(struct buffer_head *bh,
                                   struct inode *dir,
                                   struct ext4_filename *fname,
-                                  const struct qstr *d_name,
                                   unsigned int offset,
                                   struct ext4_dir_entry_2 **res_dir)
 {
         return ext4_search_dir(bh, bh->b_data, dir->i_sb->s_blocksize, dir,
-                               fname, d_name, offset, res_dir);
+                               fname, offset, res_dir);
 }
 
 /*
@@ -1262,7 +1261,6 @@ static inline bool ext4_match(const struct ext4_filename *fname,
  */
 int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
                     struct inode *dir, struct ext4_filename *fname,
-                    const struct qstr *d_name,
                     unsigned int offset, struct ext4_dir_entry_2 **res_dir)
 {
         struct ext4_dir_entry_2 * de;
@@ -1355,7 +1353,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
 
         if (ext4_has_inline_data(dir)) {
                 int has_inline_data = 1;
-                ret = ext4_find_inline_entry(dir, &fname, d_name, res_dir,
+                ret = ext4_find_inline_entry(dir, &fname, res_dir,
                                              &has_inline_data);
                 if (has_inline_data) {
                         if (inlined)
@@ -1447,7 +1445,7 @@ restart:
                         goto next;
                 }
                 set_buffer_verified(bh);
-                i = search_dirblock(bh, dir, &fname, d_name,
+                i = search_dirblock(bh, dir, &fname,
                             block << EXT4_BLOCK_SIZE_BITS(sb), res_dir);
                 if (i == 1) {
                         EXT4_I(dir)->i_dir_start_lookup = block;
@@ -1488,7 +1486,6 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 {
         struct super_block * sb = dir->i_sb;
         struct dx_frame frames[2], *frame;
-        const struct qstr *d_name = fname->usr_fname;
         struct buffer_head *bh;
         ext4_lblk_t block;
         int retval;
@@ -1505,7 +1502,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
                 if (IS_ERR(bh))
                         goto errout;
 
-                retval = search_dirblock(bh, dir, fname, d_name,
+                retval = search_dirblock(bh, dir, fname,
                                          block << EXT4_BLOCK_SIZE_BITS(sb),
                                          res_dir);
                 if (retval == 1)
@@ -1530,7 +1527,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 
         bh = NULL;
 errout:
-        dxtrace(printk(KERN_DEBUG "%s not found\n", d_name->name));
+        dxtrace(printk(KERN_DEBUG "%s not found\n", fname->usr_fname->name));
 success:
         dx_release(frames);
         return bh;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0b177da9ea82..d37c81f327e7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -848,14 +848,9 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
 {
         int type;
 
-        if (ext4_has_feature_quota(sb)) {
-                dquot_disable(sb, -1,
-                              DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED);
-        } else {
-                /* Use our quota_off function to clear inode flags etc. */
-                for (type = 0; type < EXT4_MAXQUOTAS; type++)
-                        ext4_quota_off(sb, type);
-        }
+        /* Use our quota_off function to clear inode flags etc. */
+        for (type = 0; type < EXT4_MAXQUOTAS; type++)
+                ext4_quota_off(sb, type);
 }
 #else
 static inline void ext4_quota_off_umount(struct super_block *sb)
@@ -1179,6 +1174,9 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                 return res;
         }
 
+        res = dquot_initialize(inode);
+        if (res)
+                return res;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_MISC,
                         ext4_jbd2_credits_xattr(inode));
@@ -5485,7 +5483,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
                 goto out;
 
         err = dquot_quota_off(sb, type);
-        if (err)
+        if (err || ext4_has_feature_quota(sb))
                 goto out_put;
 
         inode_lock(inode);
@@ -5505,6 +5503,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
 out_unlock:
         inode_unlock(inode);
 out_put:
+        lockdep_set_quota_inode(inode, I_DATA_SEM_NORMAL);
         iput(inode);
         return err;
 out:
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 8fb7ce14e6eb..5d3c2536641c 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -888,6 +888,8 @@ inserted:
                         else {
                                 u32 ref;
 
+                                WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                                 /* The old block is released after updating
                                    the inode. */
                                 error = dquot_alloc_block(inode,
@@ -954,6 +956,8 @@ inserted:
                         /* We need to allocate a new block */
                         ext4_fsblk_t goal, block;
 
+                        WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                         goal = ext4_group_first_block_no(sb,
                                                 EXT4_I(inode)->i_block_group);
 
@@ -1166,6 +1170,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
                 return -EINVAL;
         if (strlen(name) > 255)
                 return -ERANGE;
+
         ext4_write_lock_xattr(inode, &no_expand);
 
         error = ext4_reserve_inode_write(handle, inode, &is.iloc);
@@ -1267,6 +1272,9 @@ ext4_xattr_set(struct inode *inode, int name_index, const char *name,
         int error, retries = 0;
         int credits = ext4_jbd2_credits_xattr(inode);
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR, credits);
         if (IS_ERR(handle)) {
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 2185c7a040a1..fd2e651bad6d 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1078,6 +1078,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
 {
         SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver);
         u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 retval;
         int err;
 
         shash->tfm = sbi->s_chksum_driver;
@@ -1087,7 +1088,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        retval = *ctx;
+        barrier_data(ctx);
+        return retval;
 }
 
 static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index f865b96374df..d2955daf17a4 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -659,7 +659,7 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags)
         struct gfs2_log_header *lh;
         unsigned int tail;
         u32 hash;
-        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META;
+        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META | REQ_SYNC;
         struct page *page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
         enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state);
         lh = page_address(page);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index dde861387a40..d44f5456eb9b 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -200,7 +200,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 9ee4832b6f8b..2d30a6da7013 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -680,6 +680,12 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
 
         rwsem_release(&journal->j_trans_commit_map, 1, _THIS_IP_);
         handle->h_buffer_credits = nblocks;
+        /*
+         * Restore the original nofs context because the journal restart
+         * is basically the same thing as journal stop and start.
+         * start_this_handle will start a new nofs context.
+         */
+        memalloc_nofs_restore(handle->saved_alloc_context);
         ret = start_this_handle(journal, handle, gfp_mask);
         return ret;
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 8bd3e4d448b9..5a4438445bf7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3488,6 +3488,8 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
                 return err;
         }
 
+        put_mnt_ns(old_mnt_ns);
+
         /* Update the pwd and root */
         set_fs_pwd(fs, &root);
         set_fs_root(fs, &root);
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index c14758e08d73..390ac9c39c59 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -753,7 +753,6 @@ static void nfs4_callback_free_slot(struct nfs4_session *session,
          * A single slot, so highest used slotid is either 0 or -1
          */
         nfs4_free_slot(tbl, slot);
-        nfs4_slot_tbl_drain_complete(tbl);
         spin_unlock(&tbl->slot_tbl_lock);
 }
 
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32ccd7754f8a..2ac00bf4ecf1 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1946,29 +1946,6 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
 }
 EXPORT_SYMBOL_GPL(nfs_link);
 
-static void
-nfs_complete_rename(struct rpc_task *task, struct nfs_renamedata *data)
-{
-        struct dentry *old_dentry = data->old_dentry;
-        struct dentry *new_dentry = data->new_dentry;
-        struct inode *old_inode = d_inode(old_dentry);
-        struct inode *new_inode = d_inode(new_dentry);
-
-        nfs_mark_for_revalidate(old_inode);
-
-        switch (task->tk_status) {
-        case 0:
-                if (new_inode != NULL)
-                        nfs_drop_nlink(new_inode);
-                d_move(old_dentry, new_dentry);
-                nfs_set_verifier(new_dentry,
-                                        nfs_save_change_attribute(data->new_dir));
-                break;
-        case -ENOENT:
-                nfs_dentry_handle_enoent(old_dentry);
-        }
-}
-
 /*
  * RENAME
  * FIXME: Some nfsds, like the Linux user space nfsd, may generate a
@@ -1999,7 +1976,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = d_inode(old_dentry);
         struct inode *new_inode = d_inode(new_dentry);
-        struct dentry *dentry = NULL;
+        struct dentry *dentry = NULL, *rehash = NULL;
         struct rpc_task *task;
         int error = -EBUSY;
 
@@ -2022,8 +1999,10 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                  * To prevent any new references to the target during the
                  * rename, we unhash the dentry in advance.
                  */
-                if (!d_unhashed(new_dentry))
+                if (!d_unhashed(new_dentry)) {
                         d_drop(new_dentry);
+                        rehash = new_dentry;
+                }
 
                 if (d_count(new_dentry) > 2) {
                         int err;
@@ -2040,6 +2019,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
+                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
@@ -2048,8 +2028,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (new_inode != NULL)
                 NFS_PROTO(new_inode)->return_delegation(new_inode);
 
-        task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry,
-                                        nfs_complete_rename);
+        task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, NULL);
         if (IS_ERR(task)) {
                 error = PTR_ERR(task);
                 goto out;
@@ -2059,9 +2038,27 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (error == 0)
                 error = task->tk_status;
         rpc_put_task(task);
+        nfs_mark_for_revalidate(old_inode);
 out:
+        if (rehash)
+                d_rehash(rehash);
         trace_nfs_rename_exit(old_dir, old_dentry,
                         new_dir, new_dentry, error);
+        if (!error) {
+                if (new_inode != NULL)
+                        nfs_drop_nlink(new_inode);
+                /*
+                 * The d_move() should be here instead of in an async RPC completion
+                 * handler because we need the proper locks to move the dentry.  If
+                 * we're interrupted by a signal, the async RPC completion handler
+                 * should mark the directories for revalidation.
+                 */
+                d_move(old_dentry, new_dentry);
+                nfs_set_verifier(new_dentry,
+                                        nfs_save_change_attribute(new_dir));
+        } else if (error == -ENOENT)
+                nfs_dentry_handle_enoent(old_dentry);
+
         /* new dentry created? */
         if (dentry)
                 dput(dentry);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index f5714ee01000..23542dc44a25 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -454,6 +454,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
                         goto out_err_free;
 
                 /* fh */
+                rc = -EIO;
                 p = xdr_inline_decode(&stream, 4);
                 if (!p)
                         goto out_err_free;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index e9b4c3320e37..3e24392f2caa 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -398,7 +398,6 @@ extern struct file_system_type nfs4_referral_fs_type;
 bool nfs_auth_info_match(const struct nfs_auth_info *, rpc_authflavor_t);
 struct dentry *nfs_try_mount(int, const char *, struct nfs_mount_info *,
                         struct nfs_subversion *);
-void nfs_initialise_sb(struct super_block *);
 int nfs_set_sb_security(struct super_block *, struct dentry *, struct nfs_mount_info *);
 int nfs_clone_sb_security(struct super_block *, struct dentry *, struct nfs_mount_info *);
 struct dentry *nfs_fs_mount_common(struct nfs_server *, int, const char *,
@@ -458,7 +457,6 @@ extern void nfs_read_prepare(struct rpc_task *task, void *calldata);
 extern void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio);
 
 /* super.c */
-void nfs_clone_super(struct super_block *, struct nfs_mount_info *);
 void nfs_umount_begin(struct super_block *);
 int  nfs_statfs(struct dentry *, struct kstatfs *);
 int  nfs_show_options(struct seq_file *, struct dentry *);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 1a224a33a6c2..e5686be67be8 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -246,7 +246,7 @@ struct vfsmount *nfs_do_submount(struct dentry *dentry, struct nfs_fh *fh,
 
         devname = nfs_devname(dentry, page, PAGE_SIZE);
         if (IS_ERR(devname))
-                mnt = (struct vfsmount *)devname;
+                mnt = ERR_CAST(devname);
         else
                 mnt = nfs_do_clone_mount(NFS_SB(dentry->d_sb), devname, &mountdata);
 
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 929d09a5310a..319a47db218d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -177,7 +177,7 @@ static ssize_t _nfs42_proc_copy(struct file *src,
         if (status)
                 goto out;
 
-        if (!nfs_write_verifier_cmp(&res->write_res.verifier.verifier,
+        if (nfs_write_verifier_cmp(&res->write_res.verifier.verifier,
                                     &res->commit_res.verf->verifier)) {
                 status = -EAGAIN;
                 goto out;
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 692a7a8bfc7a..66776f022111 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -582,7 +582,6 @@ int nfs40_walk_client_list(struct nfs_client *new,
                          */
                         nfs4_schedule_path_down_recovery(pos);
                 default:
-                        spin_lock(&nn->nfs_client_lock);
                         goto out;
                 }
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c08c46a3b8cd..dbfa18900e25 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2589,7 +2589,8 @@ static inline void nfs4_exclusive_attrset(struct nfs4_opendata *opendata,
 
         /* Except MODE, it seems harmless of setting twice. */
         if (opendata->o_arg.createmode != NFS4_CREATE_EXCLUSIVE &&
-                attrset[1] & FATTR4_WORD1_MODE)
+                (attrset[1] & FATTR4_WORD1_MODE ||
+                 attrset[2] & FATTR4_WORD2_MODE_UMASK))
                 sattr->ia_valid &= ~ATTR_MODE;
 
         if (attrset[2] & FATTR4_WORD2_SECURITY_LABEL)
@@ -8416,6 +8417,7 @@ static void nfs4_layoutget_release(void *calldata)
         size_t max_pages = max_response_pages(server);
 
         dprintk("--> %s\n", __func__);
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
         nfs4_free_pages(lgp->args.layout.pages, max_pages);
         pnfs_put_layout_hdr(NFS_I(inode)->layout);
         put_nfs_open_context(lgp->args.ctx);
@@ -8490,7 +8492,6 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
         /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
         if (status == 0 && lgp->res.layoutp->len)
                 lseg = pnfs_layout_process(lgp);
-        nfs4_sequence_free_slot(&lgp->res.seq_res);
         rpc_put_task(task);
         dprintk("<-- %s status=%d\n", __func__, status);
         if (status)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index b34de036501b..cbf82b0d4467 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2134,6 +2134,8 @@ again:
         put_rpccred(cred);
         switch (status) {
         case 0:
+        case -EINTR:
+        case -ERESTARTSYS:
                 break;
         case -ETIMEDOUT:
                 if (clnt->cl_softrtry)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index adc6ec28d4b5..c383d0913b54 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2094,12 +2094,26 @@ pnfs_generic_pg_check_layout(struct nfs_pageio_descriptor *pgio)
 }
 EXPORT_SYMBOL_GPL(pnfs_generic_pg_check_layout);
 
+/*
+ * Check for any intersection between the request and the pgio->pg_lseg,
+ * and if none, put this pgio->pg_lseg away.
+ */
+static void
+pnfs_generic_pg_check_range(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        if (pgio->pg_lseg && !pnfs_lseg_request_intersecting(pgio->pg_lseg, req)) {
+                pnfs_put_lseg(pgio->pg_lseg);
+                pgio->pg_lseg = NULL;
+        }
+}
+
 void
 pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         u64 rd_size = req->wb_bytes;
 
         pnfs_generic_pg_check_layout(pgio);
+        pnfs_generic_pg_check_range(pgio, req);
         if (pgio->pg_lseg == NULL) {
                 if (pgio->pg_dreq == NULL)
                         rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
@@ -2131,6 +2145,7 @@ pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio,
                            struct nfs_page *req, u64 wb_size)
 {
         pnfs_generic_pg_check_layout(pgio);
+        pnfs_generic_pg_check_range(pgio, req);
         if (pgio->pg_lseg == NULL) {
                 pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                    req->wb_context,
@@ -2191,16 +2206,10 @@ pnfs_generic_pg_test(struct nfs_pageio_descriptor *pgio,
                 seg_end = pnfs_end_offset(pgio->pg_lseg->pls_range.offset,
                                      pgio->pg_lseg->pls_range.length);
                 req_start = req_offset(req);
-                WARN_ON_ONCE(req_start >= seg_end);
+
                 /* start of request is past the last byte of this segment */
-                if (req_start >= seg_end) {
-                        /* reference the new lseg */
-                        if (pgio->pg_ops->pg_cleanup)
-                                pgio->pg_ops->pg_cleanup(pgio);
-                        if (pgio->pg_ops->pg_init)
-                                pgio->pg_ops->pg_init(pgio, req);
+                if (req_start >= seg_end)
                         return 0;
-                }
 
                 /* adjust 'size' iff there are fewer bytes left in the
                  * segment than what nfs_generic_pg_test returned */
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2d05b756a8d6..99731e3e332f 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -593,6 +593,16 @@ pnfs_lseg_range_intersecting(const struct pnfs_layout_range *l1,
         return pnfs_is_range_intersecting(l1->offset, end1, l2->offset, end2);
 }
 
+static inline bool
+pnfs_lseg_request_intersecting(struct pnfs_layout_segment *lseg, struct nfs_page *req)
+{
+        u64 seg_last = pnfs_end_offset(lseg->pls_range.offset, lseg->pls_range.length);
+        u64 req_last = req_offset(req) + req->wb_bytes;
+
+        return pnfs_is_range_intersecting(lseg->pls_range.offset, seg_last,
+                                req_offset(req), req_last);
+}
+
 extern unsigned int layoutstats_timer;
 
 #ifdef NFS_DEBUG
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2f3822a4a7d5..eceb4eabb064 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2301,7 +2301,7 @@ EXPORT_SYMBOL_GPL(nfs_remount);
 /*
  * Initialise the common bits of the superblock
  */
-inline void nfs_initialise_sb(struct super_block *sb)
+static void nfs_initialise_sb(struct super_block *sb)
 {
         struct nfs_server *server = NFS_SB(sb);
 
@@ -2348,7 +2348,8 @@ EXPORT_SYMBOL_GPL(nfs_fill_super);
 /*
  * Finish setting up a cloned NFS2/3/4 superblock
  */
-void nfs_clone_super(struct super_block *sb, struct nfs_mount_info *mount_info)
+static void nfs_clone_super(struct super_block *sb,
+                            struct nfs_mount_info *mount_info)
 {
         const struct super_block *old_sb = mount_info->cloned->sb;
         struct nfs_server *server = NFS_SB(sb);
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 12feac6ee2fd..452334694a5d 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -334,11 +334,8 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         if (!p)
                 return 0;
         p = xdr_decode_hyper(p, &args->offset);
-        args->count = ntohl(*p++);
-
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
 
+        args->count = ntohl(*p++);
         len = min(args->count, max_blocksize);
 
         /* set up the kvec */
@@ -352,7 +349,7 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                 v++;
         }
         args->vlen = v;
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -544,11 +541,9 @@ nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p,
         p = decode_fh(p, &args->fh);
         if (!p)
                 return 0;
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -574,14 +569,10 @@ nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
         args->verf   = p; p += 2;
         args->dircount = ~0;
         args->count  = ntohl(*p++);
-
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         args->count  = min_t(u32, args->count, PAGE_SIZE);
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -599,9 +590,6 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
         args->dircount = ntohl(*p++);
         args->count    = ntohl(*p++);
 
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         len = args->count = min(args->count, max_blocksize);
         while (len > 0) {
                 struct page *p = *(rqstp->rq_next_page++);
@@ -609,7 +597,8 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
                         args->buffer = page_address(p);
                 len -= PAGE_SIZE;
         }
-        return 1;
+
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c453a1998e00..dadb3bf305b2 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1769,6 +1769,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         opdesc->op_get_currentstateid(cstate, &op->u);
                 op->status = opdesc->op_func(rqstp, cstate, &op->u);
 
+                /* Only from SEQUENCE */
+                if (cstate->status == nfserr_replay_cache) {
+                        dprintk("%s NFS4.1 replay from cache\n", __func__);
+                        status = op->status;
+                        goto out;
+                }
                 if (!op->status) {
                         if (opdesc->op_set_currentstateid)
                                 opdesc->op_set_currentstateid(cstate, &op->u);
@@ -1779,14 +1785,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         if (need_wrongsec_check(rqstp))
                                 op->status = check_nfsd_access(current_fh->fh_export, rqstp);
                 }
-
 encode_op:
-                /* Only from SEQUENCE */
-                if (cstate->status == nfserr_replay_cache) {
-                        dprintk("%s NFS4.1 replay from cache\n", __func__);
-                        status = op->status;
-                        goto out;
-                }
                 if (op->status == nfserr_replay_me) {
                         op->replay = &cstate->replay_owner->so_replay;
                         nfsd4_encode_replay(&resp->xdr, op);
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 6a4947a3f4fa..de07ff625777 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -257,9 +257,6 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         len = args->count     = ntohl(*p++);
         p++; /* totalcount - unused */
 
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2);
 
         /* set up somewhere to store response.
@@ -275,7 +272,7 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                 v++;
         }
         args->vlen = v;
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -365,11 +362,9 @@ nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_readli
         p = decode_fh(p, &args->fh);
         if (!p)
                 return 0;
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -407,11 +402,9 @@ nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
         args->cookie = ntohl(*p++);
         args->count  = ntohl(*p++);
         args->count  = min_t(u32, args->count, PAGE_SIZE);
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 /*
diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index 358258364616..4690cd75d8d7 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -159,7 +159,7 @@ static struct dentry *ntfs_lookup(struct inode *dir_ino, struct dentry *dent,
                                         PTR_ERR(dent_inode));
                 kfree(name);
                 /* Return the error code. */
-                return (struct dentry *)dent_inode;
+                return ERR_CAST(dent_inode);
         }
         /* It is guaranteed that @name is no longer allocated at this point. */
         if (MREF_ERR(mref) == -ENOENT) {
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 3b7c937a36b5..4689940a953c 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2591,6 +2591,10 @@ void ocfs2_inode_unlock_tracker(struct inode *inode,
         struct ocfs2_lock_res *lockres;
 
         lockres = &OCFS2_I(inode)->ip_inode_lockres;
+        /* had_lock means that the currect process already takes the cluster
+         * lock previously. If had_lock is 1, we have nothing to do here, and
+         * it will get unlocked where we got the lock.
+         */
         if (!had_lock) {
                 ocfs2_remove_holder(lockres, oh);
                 ocfs2_inode_unlock(inode, ex);
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 827fc9809bc2..9f88188060db 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -119,7 +119,7 @@ check_err:
 
         if (IS_ERR(inode)) {
                 mlog_errno(PTR_ERR(inode));
-                result = (void *)inode;
+                result = ERR_CAST(inode);
                 goto bail;
         }
 
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 3c5384d9b3a5..f70c3778d600 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1328,20 +1328,21 @@ static int ocfs2_xattr_get(struct inode *inode,
                            void *buffer,
                            size_t buffer_size)
 {
-        int ret;
+        int ret, had_lock;
         struct buffer_head *di_bh = NULL;
+        struct ocfs2_lock_holder oh;
 
-        ret = ocfs2_inode_lock(inode, &di_bh, 0);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+        had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh);
+        if (had_lock < 0) {
+                mlog_errno(had_lock);
+                return had_lock;
         }
         down_read(&OCFS2_I(inode)->ip_xattr_sem);
         ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index,
                                      name, buffer, buffer_size);
         up_read(&OCFS2_I(inode)->ip_xattr_sem);
 
-        ocfs2_inode_unlock(inode, 0);
+        ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);
 
         brelse(di_bh);
 
@@ -3537,11 +3538,12 @@ int ocfs2_xattr_set(struct inode *inode,
 {
         struct buffer_head *di_bh = NULL;
         struct ocfs2_dinode *di;
-        int ret, credits, ref_meta = 0, ref_credits = 0;
+        int ret, credits, had_lock, ref_meta = 0, ref_credits = 0;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct inode *tl_inode = osb->osb_tl_inode;
         struct ocfs2_xattr_set_ctxt ctxt = { NULL, NULL, NULL, };
         struct ocfs2_refcount_tree *ref_tree = NULL;
+        struct ocfs2_lock_holder oh;
 
         struct ocfs2_xattr_info xi = {
                 .xi_name_index = name_index,
@@ -3572,8 +3574,9 @@ int ocfs2_xattr_set(struct inode *inode,
                 return -ENOMEM;
         }
 
-        ret = ocfs2_inode_lock(inode, &di_bh, 1);
-        if (ret < 0) {
+        had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 1, &oh);
+        if (had_lock < 0) {
+                ret = had_lock;
                 mlog_errno(ret);
                 goto cleanup_nolock;
         }
@@ -3670,7 +3673,7 @@ cleanup:
                 if (ret)
                         mlog_errno(ret);
         }
-        ocfs2_inode_unlock(inode, 1);
+        ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
 cleanup_nolock:
         brelse(di_bh);
         brelse(xbs.xattr_bh);
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index 0daac5112f7a..c0c9683934b7 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -1,5 +1,6 @@
 config OVERLAY_FS
         tristate "Overlay filesystem support"
+        select EXPORTFS
         help
           An overlay filesystem combines two filesystems - an 'upper' filesystem
           and a 'lower' filesystem.  When a name exists in both filesystems, the
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 9008ab9fbd2e..a2a65120c9d0 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -300,7 +300,11 @@ static int ovl_set_origin(struct dentry *dentry, struct dentry *lower,
                         return PTR_ERR(fh);
         }
 
-        err = ovl_do_setxattr(upper, OVL_XATTR_ORIGIN, fh, fh ? fh->len : 0, 0);
+        /*
+         * Do not fail when upper doesn't support xattrs.
+         */
+        err = ovl_check_setxattr(dentry, upper, OVL_XATTR_ORIGIN, fh,
+                                 fh ? fh->len : 0, 0);
         kfree(fh);
 
         return err;
@@ -326,15 +330,9 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
                 .link = link
         };
 
-        upper = lookup_one_len(dentry->d_name.name, upperdir,
-                               dentry->d_name.len);
-        err = PTR_ERR(upper);
-        if (IS_ERR(upper))
-                goto out;
-
         err = security_inode_copy_up(dentry, &new_creds);
         if (err < 0)
-                goto out1;
+                goto out;
 
         if (new_creds)
                 old_creds = override_creds(new_creds);
@@ -342,13 +340,14 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
         if (tmpfile)
                 temp = ovl_do_tmpfile(upperdir, stat->mode);
         else
-                temp = ovl_lookup_temp(workdir, dentry);
-        err = PTR_ERR(temp);
-        if (IS_ERR(temp))
-                goto out1;
-
+                temp = ovl_lookup_temp(workdir);
         err = 0;
-        if (!tmpfile)
+        if (IS_ERR(temp)) {
+                err = PTR_ERR(temp);
+                temp = NULL;
+        }
+
+        if (!err && !tmpfile)
                 err = ovl_create_real(wdir, temp, &cattr, NULL, true);
 
         if (new_creds) {
@@ -357,7 +356,7 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
         }
 
         if (err)
-                goto out2;
+                goto out;
 
         if (S_ISREG(stat->mode)) {
                 struct path upperpath;
@@ -393,10 +392,23 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
         /*
          * Store identifier of lower inode in upper inode xattr to
          * allow lookup of the copy up origin inode.
+         *
+         * Don't set origin when we are breaking the association with a lower
+         * hard link.
          */
-        err = ovl_set_origin(dentry, lowerpath->dentry, temp);
-        if (err)
+        if (S_ISDIR(stat->mode) || stat->nlink == 1) {
+                err = ovl_set_origin(dentry, lowerpath->dentry, temp);
+                if (err)
+                        goto out_cleanup;
+        }
+
+        upper = lookup_one_len(dentry->d_name.name, upperdir,
+                               dentry->d_name.len);
+        if (IS_ERR(upper)) {
+                err = PTR_ERR(upper);
+                upper = NULL;
                 goto out_cleanup;
+        }
 
         if (tmpfile)
                 err = ovl_do_link(temp, udir, upper, true);
@@ -411,17 +423,15 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
 
         /* Restore timestamps on parent (best effort) */
         ovl_set_timestamps(upperdir, pstat);
-out2:
+out:
         dput(temp);
-out1:
         dput(upper);
-out:
         return err;
 
 out_cleanup:
         if (!tmpfile)
                 ovl_cleanup(wdir, temp);
-        goto out2;
+        goto out;
 }
 
 /*
@@ -454,6 +464,11 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
         ovl_path_upper(parent, &parentpath);
         upperdir = parentpath.dentry;
 
+        /* Mark parent "impure" because it may now contain non-pure upper */
+        err = ovl_set_impure(parent, upperdir);
+        if (err)
+                return err;
+
         err = vfs_getattr(&parentpath, &pstat,
                           STATX_ATIME | STATX_MTIME, AT_STATX_SYNC_AS_STAT);
         if (err)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 723b98b90698..a63a71656e9b 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -41,7 +41,7 @@ void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
         }
 }
 
-struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry)
+struct dentry *ovl_lookup_temp(struct dentry *workdir)
 {
         struct dentry *temp;
         char name[20];
@@ -68,7 +68,7 @@ static struct dentry *ovl_whiteout(struct dentry *workdir,
         struct dentry *whiteout;
         struct inode *wdir = workdir->d_inode;
 
-        whiteout = ovl_lookup_temp(workdir, dentry);
+        whiteout = ovl_lookup_temp(workdir);
         if (IS_ERR(whiteout))
                 return whiteout;
 
@@ -127,17 +127,28 @@ int ovl_create_real(struct inode *dir, struct dentry *newdentry,
         return err;
 }
 
-static int ovl_set_opaque(struct dentry *dentry, struct dentry *upperdentry)
+static int ovl_set_opaque_xerr(struct dentry *dentry, struct dentry *upper,
+                               int xerr)
 {
         int err;
 
-        err = ovl_do_setxattr(upperdentry, OVL_XATTR_OPAQUE, "y", 1, 0);
+        err = ovl_check_setxattr(dentry, upper, OVL_XATTR_OPAQUE, "y", 1, xerr);
         if (!err)
                 ovl_dentry_set_opaque(dentry);
 
         return err;
 }
 
+static int ovl_set_opaque(struct dentry *dentry, struct dentry *upperdentry)
+{
+        /*
+         * Fail with -EIO when trying to create opaque dir and upper doesn't
+         * support xattrs. ovl_rename() calls ovl_set_opaque_xerr(-EXDEV) to
+         * return a specific error for noxattr case.
+         */
+        return ovl_set_opaque_xerr(dentry, upperdentry, -EIO);
+}
+
 /* Common operations required to be done after creation of file on upper */
 static void ovl_instantiate(struct dentry *dentry, struct inode *inode,
                             struct dentry *newdentry, bool hardlink)
@@ -162,6 +173,11 @@ static bool ovl_type_merge(struct dentry *dentry)
         return OVL_TYPE_MERGE(ovl_path_type(dentry));
 }
 
+static bool ovl_type_origin(struct dentry *dentry)
+{
+        return OVL_TYPE_ORIGIN(ovl_path_type(dentry));
+}
+
 static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
                             struct cattr *attr, struct dentry *hardlink)
 {
@@ -250,7 +266,7 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
         if (upper->d_parent->d_inode != udir)
                 goto out_unlock;
 
-        opaquedir = ovl_lookup_temp(workdir, dentry);
+        opaquedir = ovl_lookup_temp(workdir);
         err = PTR_ERR(opaquedir);
         if (IS_ERR(opaquedir))
                 goto out_unlock;
@@ -382,7 +398,7 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
         if (err)
                 goto out;
 
-        newdentry = ovl_lookup_temp(workdir, dentry);
+        newdentry = ovl_lookup_temp(workdir);
         err = PTR_ERR(newdentry);
         if (IS_ERR(newdentry))
                 goto out_unlock;
@@ -846,18 +862,16 @@ static int ovl_set_redirect(struct dentry *dentry, bool samedir)
         if (IS_ERR(redirect))
                 return PTR_ERR(redirect);
 
-        err = ovl_do_setxattr(ovl_dentry_upper(dentry), OVL_XATTR_REDIRECT,
-                              redirect, strlen(redirect), 0);
+        err = ovl_check_setxattr(dentry, ovl_dentry_upper(dentry),
+                                 OVL_XATTR_REDIRECT,
+                                 redirect, strlen(redirect), -EXDEV);
         if (!err) {
                 spin_lock(&dentry->d_lock);
                 ovl_dentry_set_redirect(dentry, redirect);
                 spin_unlock(&dentry->d_lock);
         } else {
                 kfree(redirect);
-                if (err == -EOPNOTSUPP)
-                        ovl_clear_redirect_dir(dentry->d_sb);
-                else
-                        pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
+                pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
                 /* Fall back to userspace copy-up */
                 err = -EXDEV;
         }
@@ -943,6 +957,25 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
         old_upperdir = ovl_dentry_upper(old->d_parent);
         new_upperdir = ovl_dentry_upper(new->d_parent);
 
+        if (!samedir) {
+                /*
+                 * When moving a merge dir or non-dir with copy up origin into
+                 * a new parent, we are marking the new parent dir "impure".
+                 * When ovl_iterate() iterates an "impure" upper dir, it will
+                 * lookup the origin inodes of the entries to fill d_ino.
+                 */
+                if (ovl_type_origin(old)) {
+                        err = ovl_set_impure(new->d_parent, new_upperdir);
+                        if (err)
+                                goto out_revert_creds;
+                }
+                if (!overwrite && ovl_type_origin(new)) {
+                        err = ovl_set_impure(old->d_parent, old_upperdir);
+                        if (err)
+                                goto out_revert_creds;
+                }
+        }
+
         trap = lock_rename(new_upperdir, old_upperdir);
 
         olddentry = lookup_one_len(old->d_name.name, old_upperdir,
@@ -992,7 +1025,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
                 if (ovl_type_merge_or_lower(old))
                         err = ovl_set_redirect(old, samedir);
                 else if (!old_opaque && ovl_type_merge(new->d_parent))
-                        err = ovl_set_opaque(old, olddentry);
+                        err = ovl_set_opaque_xerr(old, olddentry, -EXDEV);
                 if (err)
                         goto out_dput;
         }
@@ -1000,7 +1033,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
                 if (ovl_type_merge_or_lower(new))
                         err = ovl_set_redirect(new, samedir);
                 else if (!new_opaque && ovl_type_merge(old->d_parent))
-                        err = ovl_set_opaque(new, newdentry);
+                        err = ovl_set_opaque_xerr(new, newdentry, -EXDEV);
                 if (err)
                         goto out_dput;
         }
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index ad9547f82da5..d613e2c41242 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -240,6 +240,16 @@ int ovl_xattr_get(struct dentry *dentry, const char *name,
         return res;
 }
 
+static bool ovl_can_list(const char *s)
+{
+        /* List all non-trusted xatts */
+        if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0)
+                return true;
+
+        /* Never list trusted.overlay, list other trusted for superuser only */
+        return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
+}
+
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
@@ -263,7 +273,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
                         return -EIO;
 
                 len -= slen;
-                if (ovl_is_private_xattr(s)) {
+                if (!ovl_can_list(s)) {
                         res -= slen;
                         memmove(s, s + slen, len);
                 } else {
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index bad0f665a635..f3136c31e72a 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -169,17 +169,7 @@ invalid:
 
 static bool ovl_is_opaquedir(struct dentry *dentry)
 {
-        int res;
-        char val;
-
-        if (!d_is_dir(dentry))
-                return false;
-
-        res = vfs_getxattr(dentry, OVL_XATTR_OPAQUE, &val, 1);
-        if (res == 1 && val == 'y')
-                return true;
-
-        return false;
+        return ovl_check_dir_xattr(dentry, OVL_XATTR_OPAQUE);
 }
 
 static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
@@ -351,6 +341,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
         unsigned int ctr = 0;
         struct inode *inode = NULL;
         bool upperopaque = false;
+        bool upperimpure = false;
         char *upperredirect = NULL;
         struct dentry *this;
         unsigned int i;
@@ -395,6 +386,8 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                                 poe = roe;
                 }
                 upperopaque = d.opaque;
+                if (upperdentry && d.is_dir)
+                        upperimpure = ovl_is_impuredir(upperdentry);
         }
 
         if (!d.stop && poe->numlower) {
@@ -463,6 +456,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
 
         revert_creds(old_cred);
         oe->opaque = upperopaque;
+        oe->impure = upperimpure;
         oe->redirect = upperredirect;
         oe->__upperdentry = upperdentry;
         memcpy(oe->lowerstack, stack, sizeof(struct path) * ctr);
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index caa36cb9c46d..0623cebeefff 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -24,6 +24,7 @@ enum ovl_path_type {
 #define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX "opaque"
 #define OVL_XATTR_REDIRECT OVL_XATTR_PREFIX "redirect"
 #define OVL_XATTR_ORIGIN OVL_XATTR_PREFIX "origin"
+#define OVL_XATTR_IMPURE OVL_XATTR_PREFIX "impure"
 
 /*
  * The tuple (fh,uuid) is a universal unique identifier for a copy up origin,
@@ -203,10 +204,10 @@ struct dentry *ovl_dentry_real(struct dentry *dentry);
 struct ovl_dir_cache *ovl_dir_cache(struct dentry *dentry);
 void ovl_set_dir_cache(struct dentry *dentry, struct ovl_dir_cache *cache);
 bool ovl_dentry_is_opaque(struct dentry *dentry);
+bool ovl_dentry_is_impure(struct dentry *dentry);
 bool ovl_dentry_is_whiteout(struct dentry *dentry);
 void ovl_dentry_set_opaque(struct dentry *dentry);
 bool ovl_redirect_dir(struct super_block *sb);
-void ovl_clear_redirect_dir(struct super_block *sb);
 const char *ovl_dentry_get_redirect(struct dentry *dentry);
 void ovl_dentry_set_redirect(struct dentry *dentry, const char *redirect);
 void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry);
@@ -219,6 +220,17 @@ bool ovl_is_whiteout(struct dentry *dentry);
 struct file *ovl_path_open(struct path *path, int flags);
 int ovl_copy_up_start(struct dentry *dentry);
 void ovl_copy_up_end(struct dentry *dentry);
+bool ovl_check_dir_xattr(struct dentry *dentry, const char *name);
+int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry,
+                       const char *name, const void *value, size_t size,
+                       int xerr);
+int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+
+static inline bool ovl_is_impuredir(struct dentry *dentry)
+{
+        return ovl_check_dir_xattr(dentry, OVL_XATTR_IMPURE);
+}
+
 
 /* namei.c */
 int ovl_path_next(int idx, struct dentry *dentry, struct path *path);
@@ -263,7 +275,7 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to)
 
 /* dir.c */
 extern const struct inode_operations ovl_dir_inode_operations;
-struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry);
+struct dentry *ovl_lookup_temp(struct dentry *workdir);
 struct cattr {
         dev_t rdev;
         umode_t mode;
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index b2023ddb8532..34bc4a9f5c61 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -28,6 +28,7 @@ struct ovl_fs {
         /* creds of process who forced instantiation of super block */
         const struct cred *creator_cred;
         bool tmpfile;
+        bool noxattr;
         wait_queue_head_t copyup_wq;
         /* sb common to all layers */
         struct super_block *same_sb;
@@ -42,6 +43,7 @@ struct ovl_entry {
                         u64 version;
                         const char *redirect;
                         bool opaque;
+                        bool impure;
                         bool copying;
                 };
                 struct rcu_head rcu;
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 9828b7de8999..4882ffb37bae 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -891,6 +891,19 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                                 dput(temp);
                         else
                                 pr_warn("overlayfs: upper fs does not support tmpfile.\n");
+
+                        /*
+                         * Check if upper/work fs supports trusted.overlay.*
+                         * xattr
+                         */
+                        err = ovl_do_setxattr(ufs->workdir, OVL_XATTR_OPAQUE,
+                                              "0", 1, 0);
+                        if (err) {
+                                ufs->noxattr = true;
+                                pr_warn("overlayfs: upper fs does not support xattr.\n");
+                        } else {
+                                vfs_removexattr(ufs->workdir, OVL_XATTR_OPAQUE);
+                        }
                 }
         }
 
@@ -961,7 +974,10 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
         path_put(&workpath);
         kfree(lowertmp);
 
-        oe->__upperdentry = upperpath.dentry;
+        if (upperpath.dentry) {
+                oe->__upperdentry = upperpath.dentry;
+                oe->impure = ovl_is_impuredir(upperpath.dentry);
+        }
         for (i = 0; i < numlower; i++) {
                 oe->lowerstack[i].dentry = stack[i].dentry;
                 oe->lowerstack[i].mnt = ufs->lower_mnt[i];
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index cfdea47313a1..809048913889 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -175,6 +175,13 @@ bool ovl_dentry_is_opaque(struct dentry *dentry)
         return oe->opaque;
 }
 
+bool ovl_dentry_is_impure(struct dentry *dentry)
+{
+        struct ovl_entry *oe = dentry->d_fsdata;
+
+        return oe->impure;
+}
+
 bool ovl_dentry_is_whiteout(struct dentry *dentry)
 {
         return !dentry->d_inode && ovl_dentry_is_opaque(dentry);
@@ -191,14 +198,7 @@ bool ovl_redirect_dir(struct super_block *sb)
 {
         struct ovl_fs *ofs = sb->s_fs_info;
 
-        return ofs->config.redirect_dir;
-}
-
-void ovl_clear_redirect_dir(struct super_block *sb)
-{
-        struct ovl_fs *ofs = sb->s_fs_info;
-
-        ofs->config.redirect_dir = false;
+        return ofs->config.redirect_dir && !ofs->noxattr;
 }
 
 const char *ovl_dentry_get_redirect(struct dentry *dentry)
@@ -303,3 +303,59 @@ void ovl_copy_up_end(struct dentry *dentry)
         wake_up_locked(&ofs->copyup_wq);
         spin_unlock(&ofs->copyup_wq.lock);
 }
+
+bool ovl_check_dir_xattr(struct dentry *dentry, const char *name)
+{
+        int res;
+        char val;
+
+        if (!d_is_dir(dentry))
+                return false;
+
+        res = vfs_getxattr(dentry, name, &val, 1);
+        if (res == 1 && val == 'y')
+                return true;
+
+        return false;
+}
+
+int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry,
+                       const char *name, const void *value, size_t size,
+                       int xerr)
+{
+        int err;
+        struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
+
+        if (ofs->noxattr)
+                return xerr;
+
+        err = ovl_do_setxattr(upperdentry, name, value, size, 0);
+
+        if (err == -EOPNOTSUPP) {
+                pr_warn("overlayfs: cannot set %s xattr on upper\n", name);
+                ofs->noxattr = true;
+                return xerr;
+        }
+
+        return err;
+}
+
+int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry)
+{
+        int err;
+        struct ovl_entry *oe = dentry->d_fsdata;
+
+        if (oe->impure)
+                return 0;
+
+        /*
+         * Do not fail when upper doesn't support xattrs.
+         * Upper inodes won't have origin nor redirect xattr anyway.
+         */
+        err = ovl_check_setxattr(dentry, upperdentry, OVL_XATTR_IMPURE,
+                                 "y", 1, 0);
+        if (!err)
+                oe->impure = true;
+
+        return err;
+}
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 45f6bf68fff3..f1e1927ccd48 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -821,7 +821,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
         if (!mmget_not_zero(mm))
                 goto free;
 
-        flags = write ? FOLL_WRITE : 0;
+        flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
 
         while (count > 0) {
                 int this_len = min_t(int, count, PAGE_SIZE);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f0c8b33d99b1..520802da059c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -300,11 +300,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
 
         /* We don't show the stack guard page in /proc/maps */
         start = vma->vm_start;
-        if (stack_guard_page_start(vma, start))
-                start += PAGE_SIZE;
         end = vma->vm_end;
-        if (stack_guard_page_end(vma, end))
-                end -= PAGE_SIZE;
 
         seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
         seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index ebf80c7739e1..48813aeaab80 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1512,6 +1512,22 @@ int dquot_initialize(struct inode *inode)
 }
 EXPORT_SYMBOL(dquot_initialize);
 
+bool dquot_initialize_needed(struct inode *inode)
+{
+        struct dquot **dquots;
+        int i;
+
+        if (!dquot_active(inode))
+                return false;
+
+        dquots = i_dquot(inode);
+        for (i = 0; i < MAXQUOTAS; i++)
+                if (!dquots[i] && sb_has_quota_active(inode->i_sb, i))
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL(dquot_initialize_needed);
+
 /*
  * Release all quotas referenced by inode.
  *
diff --git a/fs/read_write.c b/fs/read_write.c
index 47c1d4484df9..19d4d88fa285 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1285,7 +1285,7 @@ static size_t compat_writev(struct file *file,
         if (!(file->f_mode & FMODE_CAN_WRITE))
                 goto out;
 
-        ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0);
+        ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags);
 
 out:
         if (ret > 0)
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index da01f497180a..39bb1e838d8d 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1112,7 +1112,7 @@ static int flush_commit_list(struct super_block *s,
                 depth = reiserfs_write_unlock_nested(s);
                 if (reiserfs_barrier_flush(s))
                         __sync_dirty_buffer(jl->j_commit_bh,
-                                        REQ_PREFLUSH | REQ_FUA);
+                                        REQ_SYNC | REQ_PREFLUSH | REQ_FUA);
                 else
                         sync_dirty_buffer(jl->j_commit_bh);
                 reiserfs_write_lock_nested(s, depth);
@@ -1271,7 +1271,7 @@ static int _update_journal_header_block(struct super_block *sb,
 
                 if (reiserfs_barrier_flush(sb))
                         __sync_dirty_buffer(journal->j_header_bh,
-                                        REQ_PREFLUSH | REQ_FUA);
+                                        REQ_SYNC | REQ_PREFLUSH | REQ_FUA);
                 else
                         sync_dirty_buffer(journal->j_header_bh);
 
diff --git a/fs/stat.c b/fs/stat.c
index f494b182c7c7..c35610845ab1 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -672,6 +672,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes)
                 inode->i_bytes -= 512;
         }
 }
+EXPORT_SYMBOL(__inode_add_bytes);
 
 void inode_add_bytes(struct inode *inode, loff_t bytes)
 {
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index a0376a2c1c29..f80be4c5df9d 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -82,7 +82,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
                         ufs_error (sb, "ufs_free_fragments",
                                    "bit already cleared for fragment %u", i);
         }
-        
+
+        inode_sub_bytes(inode, count << uspi->s_fshift);
         fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
         uspi->cs_total.cs_nffree += count;
         fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count);
@@ -184,6 +185,7 @@ do_more:
                         ufs_error(sb, "ufs_free_blocks", "freeing free fragment");
                 }
                 ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
+                inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift);
                 if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                         ufs_clusteracct (sb, ucpi, blkno, 1);
 
@@ -398,10 +400,12 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         /*
          * There is not enough space for user on the device
          */
-        if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) {
-                mutex_unlock(&UFS_SB(sb)->s_lock);
-                UFSD("EXIT (FAILED)\n");
-                return 0;
+        if (unlikely(ufs_freefrags(uspi) <= uspi->s_root_blocks)) {
+                if (!capable(CAP_SYS_RESOURCE)) {
+                        mutex_unlock(&UFS_SB(sb)->s_lock);
+                        UFSD("EXIT (FAILED)\n");
+                        return 0;
+                }
         }
 
         if (goal >= uspi->s_size) 
@@ -419,12 +423,12 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
                 if (result) {
                         ufs_clear_frags(inode, result + oldcount,
                                         newcount - oldcount, locked_page != NULL);
+                        *err = 0;
                         write_seqlock(&UFS_I(inode)->meta_lock);
                         ufs_cpu_to_data_ptr(sb, p, result);
-                        write_sequnlock(&UFS_I(inode)->meta_lock);
-                        *err = 0;
                         UFS_I(inode)->i_lastfrag =
                                 max(UFS_I(inode)->i_lastfrag, fragment + count);
+                        write_sequnlock(&UFS_I(inode)->meta_lock);
                 }
                 mutex_unlock(&UFS_SB(sb)->s_lock);
                 UFSD("EXIT, result %llu\n", (unsigned long long)result);
@@ -437,8 +441,10 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         result = ufs_add_fragments(inode, tmp, oldcount, newcount);
         if (result) {
                 *err = 0;
+                read_seqlock_excl(&UFS_I(inode)->meta_lock);
                 UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
                                                 fragment + count);
+                read_sequnlock_excl(&UFS_I(inode)->meta_lock);
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
                 mutex_unlock(&UFS_SB(sb)->s_lock);
@@ -449,39 +455,29 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         /*
          * allocate new block and move data
          */
-        switch (fs32_to_cpu(sb, usb1->fs_optim)) {
-            case UFS_OPTSPACE:
+        if (fs32_to_cpu(sb, usb1->fs_optim) == UFS_OPTSPACE) {
                 request = newcount;
-                if (uspi->s_minfree < 5 || uspi->cs_total.cs_nffree
-                    > uspi->s_dsize * uspi->s_minfree / (2 * 100))
-                        break;
-                usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTTIME);
-                break;
-            default:
-                usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTTIME);
-        
-            case UFS_OPTTIME:
+                if (uspi->cs_total.cs_nffree < uspi->s_space_to_time)
+                        usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTTIME);
+        } else {
                 request = uspi->s_fpb;
-                if (uspi->cs_total.cs_nffree < uspi->s_dsize *
-                    (uspi->s_minfree - 2) / 100)
-                        break;
-                usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTTIME);
-                break;
+                if (uspi->cs_total.cs_nffree > uspi->s_time_to_space)
+                        usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTSPACE);
         }
         result = ufs_alloc_fragments (inode, cgno, goal, request, err);
         if (result) {
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
+                mutex_unlock(&UFS_SB(sb)->s_lock);
                 ufs_change_blocknr(inode, fragment - oldcount, oldcount,
                                    uspi->s_sbbase + tmp,
                                    uspi->s_sbbase + result, locked_page);
+                *err = 0;
                 write_seqlock(&UFS_I(inode)->meta_lock);
                 ufs_cpu_to_data_ptr(sb, p, result);
-                write_sequnlock(&UFS_I(inode)->meta_lock);
-                *err = 0;
                 UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
                                                 fragment + count);
-                mutex_unlock(&UFS_SB(sb)->s_lock);
+                write_sequnlock(&UFS_I(inode)->meta_lock);
                 if (newcount < request)
                         ufs_free_fragments (inode, result + newcount, request - newcount);
                 ufs_free_fragments (inode, tmp, oldcount);
@@ -494,6 +490,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         return 0;
 }               
 
+static bool try_add_frags(struct inode *inode, unsigned frags)
+{
+        unsigned size = frags * i_blocksize(inode);
+        spin_lock(&inode->i_lock);
+        __inode_add_bytes(inode, size);
+        if (unlikely((u32)inode->i_blocks != inode->i_blocks)) {
+                __inode_sub_bytes(inode, size);
+                spin_unlock(&inode->i_lock);
+                return false;
+        }
+        spin_unlock(&inode->i_lock);
+        return true;
+}
+
 static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
                              unsigned oldcount, unsigned newcount)
 {
@@ -530,6 +540,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
         for (i = oldcount; i < newcount; i++)
                 if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i))
                         return 0;
+
+        if (!try_add_frags(inode, count))
+                return 0;
         /*
          * Block can be extended
          */
@@ -647,6 +660,7 @@ cg_found:
                         ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
                 i = uspi->s_fpb - count;
 
+                inode_sub_bytes(inode, i << uspi->s_fshift);
                 fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
                 uspi->cs_total.cs_nffree += i;
                 fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i);
@@ -657,6 +671,8 @@ cg_found:
         result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
         if (result == INVBLOCK)
                 return 0;
+        if (!try_add_frags(inode, count))
+                return 0;
         for (i = 0; i < count; i++)
                 ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i);
         
@@ -716,6 +732,8 @@ norot:
                 return INVBLOCK;
         ucpi->c_rotor = result;
 gotit:
+        if (!try_add_frags(inode, uspi->s_fpb))
+                return 0;
         blkno = ufs_fragstoblks(result);
         ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
         if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7e41aee7b69a..f36d6a53687d 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to,
 
         p = ufs_get_direct_data_ptr(uspi, ufsi, block);
         tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p),
-                                new_size, err, locked_page);
+                                new_size - (lastfrag & uspi->s_fpbmask), err,
+                                locked_page);
         return tmp != 0;
 }
 
@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index,
                         goal += uspi->s_fpb;
         }
         tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment),
-                                goal, uspi->s_fpb, err, locked_page);
+                                goal, nfrags, err, locked_page);
 
         if (!tmp) {
                 *err = -ENOSPC;
@@ -400,11 +401,20 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff
         u64 phys64 = 0;
         unsigned frag = fragment & uspi->s_fpbmask;
 
-        if (!create) {
-                phys64 = ufs_frag_map(inode, offsets, depth);
-                goto out;
-        }
+        phys64 = ufs_frag_map(inode, offsets, depth);
+        if (!create)
+                goto done;
 
+        if (phys64) {
+                if (fragment >= UFS_NDIR_FRAGMENT)
+                        goto done;
+                read_seqlock_excl(&UFS_I(inode)->meta_lock);
+                if (fragment < UFS_I(inode)->i_lastfrag) {
+                        read_sequnlock_excl(&UFS_I(inode)->meta_lock);
+                        goto done;
+                }
+                read_sequnlock_excl(&UFS_I(inode)->meta_lock);
+        }
         /* This code entered only while writing ....? */
 
         mutex_lock(&UFS_I(inode)->truncate_mutex);
@@ -448,6 +458,11 @@ out:
         }
         mutex_unlock(&UFS_I(inode)->truncate_mutex);
         return err;
+
+done:
+        if (phys64)
+                map_bh(bh_result, sb, phys64 + frag);
+        return 0;
 }
 
 static int ufs_writepage(struct page *page, struct writeback_control *wbc)
@@ -551,10 +566,8 @@ static int ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
          */
         inode->i_mode = mode = fs16_to_cpu(sb, ufs_inode->ui_mode);
         set_nlink(inode, fs16_to_cpu(sb, ufs_inode->ui_nlink));
-        if (inode->i_nlink == 0) {
-                ufs_error (sb, "ufs_read_inode", "inode %lu has zero nlink\n", inode->i_ino);
-                return -1;
-        }
+        if (inode->i_nlink == 0)
+                return -ESTALE;
 
         /*
          * Linux now has 32-bit uid and gid, so we can support EFT.
@@ -563,9 +576,9 @@ static int ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
         i_gid_write(inode, ufs_get_inode_gid(sb, ufs_inode));
 
         inode->i_size = fs64_to_cpu(sb, ufs_inode->ui_size);
-        inode->i_atime.tv_sec = fs32_to_cpu(sb, ufs_inode->ui_atime.tv_sec);
-        inode->i_ctime.tv_sec = fs32_to_cpu(sb, ufs_inode->ui_ctime.tv_sec);
-        inode->i_mtime.tv_sec = fs32_to_cpu(sb, ufs_inode->ui_mtime.tv_sec);
+        inode->i_atime.tv_sec = (signed)fs32_to_cpu(sb, ufs_inode->ui_atime.tv_sec);
+        inode->i_ctime.tv_sec = (signed)fs32_to_cpu(sb, ufs_inode->ui_ctime.tv_sec);
+        inode->i_mtime.tv_sec = (signed)fs32_to_cpu(sb, ufs_inode->ui_mtime.tv_sec);
         inode->i_mtime.tv_nsec = 0;
         inode->i_atime.tv_nsec = 0;
         inode->i_ctime.tv_nsec = 0;
@@ -599,10 +612,8 @@ static int ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
          */
         inode->i_mode = mode = fs16_to_cpu(sb, ufs2_inode->ui_mode);
         set_nlink(inode, fs16_to_cpu(sb, ufs2_inode->ui_nlink));
-        if (inode->i_nlink == 0) {
-                ufs_error (sb, "ufs_read_inode", "inode %lu has zero nlink\n", inode->i_ino);
-                return -1;
-        }
+        if (inode->i_nlink == 0)
+                return -ESTALE;
 
         /*
          * Linux now has 32-bit uid and gid, so we can support EFT.
@@ -642,7 +653,7 @@ struct inode *ufs_iget(struct super_block *sb, unsigned long ino)
         struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
         struct buffer_head * bh;
         struct inode *inode;
-        int err;
+        int err = -EIO;
 
         UFSD("ENTER, ino %lu\n", ino);
 
@@ -677,9 +688,10 @@ struct inode *ufs_iget(struct super_block *sb, unsigned long ino)
                 err = ufs1_read_inode(inode,
                                       ufs_inode + ufs_inotofsbo(inode->i_ino));
         }
-
+        brelse(bh);
         if (err)
                 goto bad_inode;
+
         inode->i_version++;
         ufsi->i_lastfrag =
                 (inode->i_size + uspi->s_fsize - 1) >> uspi->s_fshift;
@@ -688,15 +700,13 @@ struct inode *ufs_iget(struct super_block *sb, unsigned long ino)
 
         ufs_set_inode_ops(inode);
 
-        brelse(bh);
-
         UFSD("EXIT\n");
         unlock_new_inode(inode);
         return inode;
 
 bad_inode:
         iget_failed(inode);
-        return ERR_PTR(-EIO);
+        return ERR_PTR(err);
 }
 
 static void ufs1_update_inode(struct inode *inode, struct ufs_inode *ufs_inode)
@@ -841,8 +851,11 @@ void ufs_evict_inode(struct inode * inode)
         truncate_inode_pages_final(&inode->i_data);
         if (want_delete) {
                 inode->i_size = 0;
-                if (inode->i_blocks)
+                if (inode->i_blocks &&
+                    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                     S_ISLNK(inode->i_mode)))
                         ufs_truncate_blocks(inode);
+                ufs_update_inode(inode, inode_needs_sync(inode));
         }
 
         invalidate_inode_buffers(inode);
@@ -868,7 +881,6 @@ static inline void free_data(struct to_free *ctx, u64 from, unsigned count)
         ctx->to = from + count;
 }
 
-#define DIRECT_BLOCK ((inode->i_size + uspi->s_bsize - 1) >> uspi->s_bshift)
 #define DIRECT_FRAGMENT ((inode->i_size + uspi->s_fsize - 1) >> uspi->s_fshift)
 
 static void ufs_trunc_direct(struct inode *inode)
@@ -1100,25 +1112,30 @@ out:
        return err;
 }
 
-static void __ufs_truncate_blocks(struct inode *inode)
+static void ufs_truncate_blocks(struct inode *inode)
 {
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
         struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
         unsigned offsets[4];
-        int depth = ufs_block_to_path(inode, DIRECT_BLOCK, offsets);
+        int depth;
         int depth2;
         unsigned i;
         struct ufs_buffer_head *ubh[3];
         void *p;
         u64 block;
 
-        if (!depth)
-                return;
+        if (inode->i_size) {
+                sector_t last = (inode->i_size - 1) >> uspi->s_bshift;
+                depth = ufs_block_to_path(inode, last, offsets);
+                if (!depth)
+                        return;
+        } else {
+                depth = 1;
+        }
 
-        /* find the last non-zero in offsets[] */
         for (depth2 = depth - 1; depth2; depth2--)
-                if (offsets[depth2])
+                if (offsets[depth2] != uspi->s_apb - 1)
                         break;
 
         mutex_lock(&ufsi->truncate_mutex);
@@ -1127,9 +1144,8 @@ static void __ufs_truncate_blocks(struct inode *inode)
                 offsets[0] = UFS_IND_BLOCK;
         } else {
                 /* get the blocks that should be partially emptied */
-                p = ufs_get_direct_data_ptr(uspi, ufsi, offsets[0]);
+                p = ufs_get_direct_data_ptr(uspi, ufsi, offsets[0]++);
                 for (i = 0; i < depth2; i++) {
-                        offsets[i]++;   /* next branch is fully freed */
                         block = ufs_data_ptr_to_cpu(sb, p);
                         if (!block)
                                 break;
@@ -1140,7 +1156,7 @@ static void __ufs_truncate_blocks(struct inode *inode)
                                 write_sequnlock(&ufsi->meta_lock);
                                 break;
                         }
-                        p = ubh_get_data_ptr(uspi, ubh[i], offsets[i + 1]);
+                        p = ubh_get_data_ptr(uspi, ubh[i], offsets[i + 1]++);
                 }
                 while (i--)
                         free_branch_tail(inode, offsets[i + 1], ubh[i], depth - i - 1);
@@ -1155,7 +1171,9 @@ static void __ufs_truncate_blocks(struct inode *inode)
                         free_full_branch(inode, block, i - UFS_IND_BLOCK + 1);
                 }
         }
+        read_seqlock_excl(&ufsi->meta_lock);
         ufsi->i_lastfrag = DIRECT_FRAGMENT;
+        read_sequnlock_excl(&ufsi->meta_lock);
         mark_inode_dirty(inode);
         mutex_unlock(&ufsi->truncate_mutex);
 }
@@ -1183,7 +1201,7 @@ static int ufs_truncate(struct inode *inode, loff_t size)
 
         truncate_setsize(inode, size);
 
-        __ufs_truncate_blocks(inode);
+        ufs_truncate_blocks(inode);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         mark_inode_dirty(inode);
 out:
@@ -1191,16 +1209,6 @@ out:
         return err;
 }
 
-static void ufs_truncate_blocks(struct inode *inode)
-{
-        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
-              S_ISLNK(inode->i_mode)))
-                return;
-        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                return;
-        __ufs_truncate_blocks(inode);
-}
-
 int ufs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = d_inode(dentry);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 131b2b77c818..0a4f58a5073c 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -480,7 +480,7 @@ static void ufs_setup_cstotal(struct super_block *sb)
         usb3 = ubh_get_usb_third(uspi);
 
         if ((mtype == UFS_MOUNT_UFSTYPE_44BSD &&
-             (usb1->fs_flags & UFS_FLAGS_UPDATED)) ||
+             (usb2->fs_un.fs_u2.fs_maxbsize == usb1->fs_bsize)) ||
             mtype == UFS_MOUNT_UFSTYPE_UFS2) {
                 /*we have statistic in different place, then usual*/
                 uspi->cs_total.cs_ndir = fs64_to_cpu(sb, usb2->fs_un.fs_u2.cs_ndir);
@@ -596,9 +596,7 @@ static void ufs_put_cstotal(struct super_block *sb)
         usb2 = ubh_get_usb_second(uspi);
         usb3 = ubh_get_usb_third(uspi);
 
-        if ((mtype == UFS_MOUNT_UFSTYPE_44BSD &&
-             (usb1->fs_flags & UFS_FLAGS_UPDATED)) ||
-            mtype == UFS_MOUNT_UFSTYPE_UFS2) {
+        if (mtype == UFS_MOUNT_UFSTYPE_UFS2) {
                 /*we have statistic in different place, then usual*/
                 usb2->fs_un.fs_u2.cs_ndir =
                         cpu_to_fs64(sb, uspi->cs_total.cs_ndir);
@@ -608,16 +606,26 @@ static void ufs_put_cstotal(struct super_block *sb)
                         cpu_to_fs64(sb, uspi->cs_total.cs_nifree);
                 usb3->fs_un1.fs_u2.cs_nffree =
                         cpu_to_fs64(sb, uspi->cs_total.cs_nffree);
-        } else {
-                usb1->fs_cstotal.cs_ndir =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_ndir);
-                usb1->fs_cstotal.cs_nbfree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nbfree);
-                usb1->fs_cstotal.cs_nifree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nifree);
-                usb1->fs_cstotal.cs_nffree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nffree);
+                goto out;
+        }
+
+        if (mtype == UFS_MOUNT_UFSTYPE_44BSD &&
+             (usb2->fs_un.fs_u2.fs_maxbsize == usb1->fs_bsize)) {
+                /* store stats in both old and new places */
+                usb2->fs_un.fs_u2.cs_ndir =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_ndir);
+                usb2->fs_un.fs_u2.cs_nbfree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nbfree);
+                usb3->fs_un1.fs_u2.cs_nifree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nifree);
+                usb3->fs_un1.fs_u2.cs_nffree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nffree);
         }
+        usb1->fs_cstotal.cs_ndir = cpu_to_fs32(sb, uspi->cs_total.cs_ndir);
+        usb1->fs_cstotal.cs_nbfree = cpu_to_fs32(sb, uspi->cs_total.cs_nbfree);
+        usb1->fs_cstotal.cs_nifree = cpu_to_fs32(sb, uspi->cs_total.cs_nifree);
+        usb1->fs_cstotal.cs_nffree = cpu_to_fs32(sb, uspi->cs_total.cs_nffree);
+out:
         ubh_mark_buffer_dirty(USPI_UBH(uspi));
         ufs_print_super_stuff(sb, usb1, usb2, usb3);
         UFSD("EXIT\n");
@@ -746,6 +754,23 @@ static void ufs_put_super(struct super_block *sb)
         return;
 }
 
+static u64 ufs_max_bytes(struct super_block *sb)
+{
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+        int bits = uspi->s_apbshift;
+        u64 res;
+
+        if (bits > 21)
+                res = ~0ULL;
+        else
+                res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) +
+                        (1LL << (3*bits));
+
+        if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift))
+                return MAX_LFS_FILESIZE;
+        return res << uspi->s_bshift;
+}
+
 static int ufs_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct ufs_sb_info * sbi;
@@ -812,9 +837,8 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
         uspi->s_dirblksize = UFS_SECTOR_SIZE;
         super_block_offset=UFS_SBLOCK;
 
-        /* Keep 2Gig file limit. Some UFS variants need to override 
-           this but as I don't know which I'll let those in the know loosen
-           the rules */
+        sb->s_maxbytes = MAX_LFS_FILESIZE;
+
         switch (sbi->s_mount_opt & UFS_MOUNT_UFSTYPE) {
         case UFS_MOUNT_UFSTYPE_44BSD:
                 UFSD("ufstype=44bsd\n");
@@ -980,6 +1004,13 @@ again:
                 flags |=  UFS_ST_SUN;
         }
 
+        if ((flags & UFS_ST_MASK) == UFS_ST_44BSD &&
+            uspi->s_postblformat == UFS_42POSTBLFMT) {
+                if (!silent)
+                        pr_err("this is not a 44bsd filesystem");
+                goto failed;
+        }
+
         /*
          * Check ufs magic number
          */
@@ -1127,8 +1158,8 @@ magic_found:
         uspi->s_cgmask = fs32_to_cpu(sb, usb1->fs_cgmask);
 
         if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2) {
-                uspi->s_u2_size  = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_size);
-                uspi->s_u2_dsize = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
+                uspi->s_size  = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_size);
+                uspi->s_dsize = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
         } else {
                 uspi->s_size  =  fs32_to_cpu(sb, usb1->fs_size);
                 uspi->s_dsize =  fs32_to_cpu(sb, usb1->fs_dsize);
@@ -1177,6 +1208,18 @@ magic_found:
         uspi->s_postbloff = fs32_to_cpu(sb, usb3->fs_postbloff);
         uspi->s_rotbloff = fs32_to_cpu(sb, usb3->fs_rotbloff);
 
+        uspi->s_root_blocks = mul_u64_u32_div(uspi->s_dsize,
+                                              uspi->s_minfree, 100);
+        if (uspi->s_minfree <= 5) {
+                uspi->s_time_to_space = ~0ULL;
+                uspi->s_space_to_time = 0;
+                usb1->fs_optim = cpu_to_fs32(sb, UFS_OPTSPACE);
+        } else {
+                uspi->s_time_to_space = (uspi->s_root_blocks / 2) + 1;
+                uspi->s_space_to_time = mul_u64_u32_div(uspi->s_dsize,
+                                              uspi->s_minfree - 2, 100) - 1;
+        }
+
         /*
          * Compute another frequently used values
          */
@@ -1212,6 +1255,7 @@ magic_found:
                             "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
                 uspi->s_maxsymlinklen = maxsymlen;
         }
+        sb->s_maxbytes = ufs_max_bytes(sb);
         sb->s_max_links = UFS_LINK_MAX;
 
         inode = ufs_iget(sb, UFS_ROOTINO);
@@ -1365,19 +1409,17 @@ static int ufs_statfs(struct dentry *dentry, struct kstatfs *buf)
         mutex_lock(&UFS_SB(sb)->s_lock);
         usb3 = ubh_get_usb_third(uspi);
         
-        if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2) {
+        if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2)
                 buf->f_type = UFS2_MAGIC;
-                buf->f_blocks = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
-        } else {
+        else
                 buf->f_type = UFS_MAGIC;
-                buf->f_blocks = uspi->s_dsize;
-        }
-        buf->f_bfree = ufs_blkstofrags(uspi->cs_total.cs_nbfree) +
-                uspi->cs_total.cs_nffree;
+
+        buf->f_blocks = uspi->s_dsize;
+        buf->f_bfree = ufs_freefrags(uspi);
         buf->f_ffree = uspi->cs_total.cs_nifree;
         buf->f_bsize = sb->s_blocksize;
-        buf->f_bavail = (buf->f_bfree > (((long)buf->f_blocks / 100) * uspi->s_minfree))
-                ? (buf->f_bfree - (((long)buf->f_blocks / 100) * uspi->s_minfree)) : 0;
+        buf->f_bavail = (buf->f_bfree > uspi->s_root_blocks)
+                ? (buf->f_bfree - uspi->s_root_blocks) : 0;
         buf->f_files = uspi->s_ncg * uspi->s_ipg;
         buf->f_namelen = UFS_MAXNAMLEN;
         buf->f_fsid.val[0] = (u32)id;
diff --git a/fs/ufs/ufs_fs.h b/fs/ufs/ufs_fs.h
index 0cbd5d340b67..150eef6f1233 100644
--- a/fs/ufs/ufs_fs.h
+++ b/fs/ufs/ufs_fs.h
@@ -733,10 +733,8 @@ struct ufs_sb_private_info {
         __u32   s_dblkno;       /* offset of first data after cg */
         __u32   s_cgoffset;     /* cylinder group offset in cylinder */
         __u32   s_cgmask;       /* used to calc mod fs_ntrak */
-        __u32   s_size;         /* number of blocks (fragments) in fs */
-        __u32   s_dsize;        /* number of data blocks in fs */
-        __u64   s_u2_size;      /* ufs2: number of blocks (fragments) in fs */
-        __u64   s_u2_dsize;     /*ufs2:  number of data blocks in fs */
+        __u64   s_size;         /* number of blocks (fragments) in fs */
+        __u64   s_dsize;        /* number of data blocks in fs */
         __u32   s_ncg;          /* number of cylinder groups */
         __u32   s_bsize;        /* size of basic blocks */
         __u32   s_fsize;        /* size of fragments */
@@ -793,6 +791,9 @@ struct ufs_sb_private_info {
         __u32   s_maxsymlinklen;/* upper limit on fast symlinks' size */
         __s32   fs_magic;       /* filesystem magic */
         unsigned int s_dirblksize;
+        __u64   s_root_blocks;
+        __u64   s_time_to_space;
+        __u64   s_space_to_time;
 };
 
 /*
diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index f41ad0a6106f..02497a492eb2 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -243,9 +243,8 @@ ufs_set_inode_dev(struct super_block *sb, struct ufs_inode_info *ufsi, dev_t dev
 struct page *ufs_get_locked_page(struct address_space *mapping,
                                  pgoff_t index)
 {
-        struct page *page;
-
-        page = find_lock_page(mapping, index);
+        struct inode *inode = mapping->host;
+        struct page *page = find_lock_page(mapping, index);
         if (!page) {
                 page = read_mapping_page(mapping, index, NULL);
 
@@ -253,7 +252,7 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "read_mapping_page error: ino %lu, index: %lu\n",
                                mapping->host->i_ino, index);
-                        goto out;
+                        return page;
                 }
 
                 lock_page(page);
@@ -262,8 +261,7 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
                         /* Truncate got there first */
                         unlock_page(page);
                         put_page(page);
-                        page = NULL;
-                        goto out;
+                        return NULL;
                 }
 
                 if (!PageUptodate(page) || PageError(page)) {
@@ -272,11 +270,12 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
 
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "can not read page: ino %lu, index: %lu\n",
-                               mapping->host->i_ino, index);
+                               inode->i_ino, index);
 
-                        page = ERR_PTR(-EIO);
+                        return ERR_PTR(-EIO);
                 }
         }
-out:
+        if (!page_has_buffers(page))
+                create_empty_buffers(page, 1 << inode->i_blkbits, 0);
         return page;
 }
diff --git a/fs/ufs/util.h b/fs/ufs/util.h
index b7fbf53dbc81..9fc7119a1551 100644
--- a/fs/ufs/util.h
+++ b/fs/ufs/util.h
@@ -350,16 +350,11 @@ static inline void *ubh_get_data_ptr(struct ufs_sb_private_info *uspi,
 #define ubh_blkmap(ubh,begin,bit) \
         ((*ubh_get_addr(ubh, (begin) + ((bit) >> 3)) >> ((bit) & 7)) & (0xff >> (UFS_MAXFRAG - uspi->s_fpb)))
 
-/*
- * Determine the number of available frags given a
- * percentage to hold in reserve.
- */
 static inline u64
-ufs_freespace(struct ufs_sb_private_info *uspi, int percentreserved)
+ufs_freefrags(struct ufs_sb_private_info *uspi)
 {
         return ufs_blkstofrags(uspi->cs_total.cs_nbfree) +
-                uspi->cs_total.cs_nffree -
-                (uspi->s_dsize * (percentreserved) / 100);
+                uspi->cs_total.cs_nffree;
 }
 
 /*
@@ -473,15 +468,19 @@ static inline unsigned _ubh_find_last_zero_bit_(
 static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
         struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
 {
+        u8 mask;
         switch (uspi->s_fpb) {
         case 8:
                 return (*ubh_get_addr (ubh, begin + block) == 0xff);
         case 4:
-                return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2)));
+                mask = 0x0f << ((block & 0x01) << 2);
+                return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
         case 2:
-                return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1)));
+                mask = 0x03 << ((block & 0x03) << 1);
+                return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
         case 1:
-                return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07)));
+                mask = 0x01 << (block & 0x07);
+                return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
         }
         return 0;       
 }
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index f7555fc25877..1d622f276e3a 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -340,9 +340,28 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
         bool must_wait, return_to_userland;
         long blocking_state;
 
-        BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
-
         ret = VM_FAULT_SIGBUS;
+
+        /*
+         * We don't do userfault handling for the final child pid update.
+         *
+         * We also don't do userfault handling during
+         * coredumping. hugetlbfs has the special
+         * follow_hugetlb_page() to skip missing pages in the
+         * FOLL_DUMP case, anon memory also checks for FOLL_DUMP with
+         * the no_page_table() helper in follow_page_mask(), but the
+         * shmem_vm_ops->fault method is invoked even during
+         * coredumping without mmap_sem and it ends up here.
+         */
+        if (current->flags & (PF_EXITING|PF_DUMPCORE))
+                goto out;
+
+        /*
+         * Coredumping runs without mmap_sem so we can only check that
+         * the mmap_sem is held, if PF_DUMPCORE was not set.
+         */
+        WARN_ON_ONCE(!rwsem_is_locked(&mm->mmap_sem));
+
         ctx = vmf->vma->vm_userfaultfd_ctx.ctx;
         if (!ctx)
                 goto out;
@@ -361,12 +380,6 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
                 goto out;
 
         /*
-         * We don't do userfault handling for the final child pid update.
-         */
-        if (current->flags & PF_EXITING)
-                goto out;
-
-        /*
          * Check that we can return VM_FAULT_RETRY.
          *
          * NOTE: it should become possible to return VM_FAULT_RETRY
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index f02eb7673392..a7048eafa8e6 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1280,7 +1280,6 @@ xfs_bmap_read_extents(
                 xfs_bmbt_rec_t  *frp;
                 xfs_fsblock_t   nextbno;
                 xfs_extnum_t    num_recs;
-                xfs_extnum_t    start;
 
                 num_recs = xfs_btree_get_numrecs(block);
                 if (unlikely(i + num_recs > room)) {
@@ -1303,7 +1302,6 @@ xfs_bmap_read_extents(
                  * Copy records into the extent records.
                  */
                 frp = XFS_BMBT_REC_ADDR(mp, block, 1);
-                start = i;
                 for (j = 0; j < num_recs; j++, i++, frp++) {
                         xfs_bmbt_rec_host_t *trp = xfs_iext_get_ext(ifp, i);
                         trp->l0 = be64_to_cpu(frp->l0);
@@ -2065,8 +2063,10 @@ xfs_bmap_add_extent_delay_real(
                 }
                 temp = xfs_bmap_worst_indlen(bma->ip, temp);
                 temp2 = xfs_bmap_worst_indlen(bma->ip, temp2);
-                diff = (int)(temp + temp2 - startblockval(PREV.br_startblock) -
-                        (bma->cur ? bma->cur->bc_private.b.allocated : 0));
+                diff = (int)(temp + temp2 -
+                             (startblockval(PREV.br_startblock) -
+                              (bma->cur ?
+                               bma->cur->bc_private.b.allocated : 0)));
                 if (diff > 0) {
                         error = xfs_mod_fdblocks(bma->ip->i_mount,
                                                  -((int64_t)diff), false);
@@ -2123,7 +2123,6 @@ xfs_bmap_add_extent_delay_real(
                 temp = da_new;
                 if (bma->cur)
                         temp += bma->cur->bc_private.b.allocated;
-                ASSERT(temp <= da_old);
                 if (temp < da_old)
                         xfs_mod_fdblocks(bma->ip->i_mount,
                                         (int64_t)(da_old - temp), false);
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 5392674bf893..3a673ba201aa 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -4395,7 +4395,7 @@ xfs_btree_visit_blocks(
                         xfs_btree_readahead_ptr(cur, ptr, 1);
 
                         /* save for the next iteration of the loop */
-                        lptr = *ptr;
+                        xfs_btree_copy_ptrs(cur, &lptr, ptr, 1);
                 }
 
                 /* for each buffer in the level */
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index b177ef33cd4c..82a38d86ebad 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1629,13 +1629,28 @@ xfs_refcount_recover_cow_leftovers(
         if (mp->m_sb.sb_agblocks >= XFS_REFC_COW_START)
                 return -EOPNOTSUPP;
 
-        error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
+        INIT_LIST_HEAD(&debris);
+
+        /*
+         * In this first part, we use an empty transaction to gather up
+         * all the leftover CoW extents so that we can subsequently
+         * delete them.  The empty transaction is used to avoid
+         * a buffer lock deadlock if there happens to be a loop in the
+         * refcountbt because we're allowed to re-grab a buffer that is
+         * already attached to our transaction.  When we're done
+         * recording the CoW debris we cancel the (empty) transaction
+         * and everything goes away cleanly.
+         */
+        error = xfs_trans_alloc_empty(mp, &tp);
         if (error)
                 return error;
-        cur = xfs_refcountbt_init_cursor(mp, NULL, agbp, agno, NULL);
+
+        error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);
+        if (error)
+                goto out_trans;
+        cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);
 
         /* Find all the leftover CoW staging extents. */
-        INIT_LIST_HEAD(&debris);
         memset(&low, 0, sizeof(low));
         memset(&high, 0, sizeof(high));
         low.rc.rc_startblock = XFS_REFC_COW_START;
@@ -1645,10 +1660,11 @@ xfs_refcount_recover_cow_leftovers(
         if (error)
                 goto out_cursor;
         xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
-        xfs_buf_relse(agbp);
+        xfs_trans_brelse(tp, agbp);
+        xfs_trans_cancel(tp);
 
         /* Now iterate the list to free the leftovers */
-        list_for_each_entry(rr, &debris, rr_list) {
+        list_for_each_entry_safe(rr, n, &debris, rr_list) {
                 /* Set up transaction. */
                 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, 0, &tp);
                 if (error)
@@ -1676,8 +1692,16 @@ xfs_refcount_recover_cow_leftovers(
                 error = xfs_trans_commit(tp);
                 if (error)
                         goto out_free;
+
+                list_del(&rr->rr_list);
+                kmem_free(rr);
         }
 
+        return error;
+out_defer:
+        xfs_defer_cancel(&dfops);
+out_trans:
+        xfs_trans_cancel(tp);
 out_free:
         /* Free the leftover list */
         list_for_each_entry_safe(rr, n, &debris, rr_list) {
@@ -1688,11 +1712,6 @@ out_free:
 
 out_cursor:
         xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
-        xfs_buf_relse(agbp);
-        goto out_free;
-
-out_defer:
-        xfs_defer_cancel(&dfops);
-        xfs_trans_cancel(tp);
-        goto out_free;
+        xfs_trans_brelse(tp, agbp);
+        goto out_trans;
 }
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 09af0f7cd55e..3b91faacc1ba 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1316,9 +1316,12 @@ xfs_vm_bmap(
          * The swap code (ab-)uses ->bmap to get a block mapping and then
          * bypasseѕ the file system for actual I/O.  We really can't allow
          * that on reflinks inodes, so we have to skip out here.  And yes,
-         * 0 is the magic code for a bmap error..
+         * 0 is the magic code for a bmap error.
+         *
+         * Since we don't pass back blockdev info, we can't return bmap
+         * information for rt files either.
          */
-        if (xfs_is_reflink_inode(ip))
+        if (xfs_is_reflink_inode(ip) || XFS_IS_REALTIME_INODE(ip))
                 return 0;
 
         filemap_write_and_wait(mapping);
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 2b954308a1d6..9e3cc2146d5b 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -582,9 +582,13 @@ xfs_getbmap(
                 }
                 break;
         default:
+                /* Local format data forks report no extents. */
+                if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL) {
+                        bmv->bmv_entries = 0;
+                        return 0;
+                }
                 if (ip->i_d.di_format != XFS_DINODE_FMT_EXTENTS &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_LOCAL)
+                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE)
                         return -EINVAL;
 
                 if (xfs_get_extsz_hint(ip) ||
@@ -712,7 +716,7 @@ xfs_getbmap(
                          * extents.
                          */
                         if (map[i].br_startblock == DELAYSTARTBLOCK &&
-                            map[i].br_startoff <= XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
+                            map[i].br_startoff < XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
                                 ASSERT((iflags & BMV_IF_DELALLOC) != 0);
 
                         if (map[i].br_startblock == HOLESTARTBLOCK &&
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 62fa39276a24..16d6a578fc16 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -97,12 +97,16 @@ static inline void
 xfs_buf_ioacct_inc(
         struct xfs_buf  *bp)
 {
-        if (bp->b_flags & (XBF_NO_IOACCT|_XBF_IN_FLIGHT))
+        if (bp->b_flags & XBF_NO_IOACCT)
                 return;
 
         ASSERT(bp->b_flags & XBF_ASYNC);
-        bp->b_flags |= _XBF_IN_FLIGHT;
-        percpu_counter_inc(&bp->b_target->bt_io_count);
+        spin_lock(&bp->b_lock);
+        if (!(bp->b_state & XFS_BSTATE_IN_FLIGHT)) {
+                bp->b_state |= XFS_BSTATE_IN_FLIGHT;
+                percpu_counter_inc(&bp->b_target->bt_io_count);
+        }
+        spin_unlock(&bp->b_lock);
 }
 
 /*
@@ -110,14 +114,24 @@ xfs_buf_ioacct_inc(
  * freed and unaccount from the buftarg.
  */
 static inline void
-xfs_buf_ioacct_dec(
+__xfs_buf_ioacct_dec(
         struct xfs_buf  *bp)
 {
-        if (!(bp->b_flags & _XBF_IN_FLIGHT))
-                return;
+        lockdep_assert_held(&bp->b_lock);
 
-        bp->b_flags &= ~_XBF_IN_FLIGHT;
-        percpu_counter_dec(&bp->b_target->bt_io_count);
+        if (bp->b_state & XFS_BSTATE_IN_FLIGHT) {
+                bp->b_state &= ~XFS_BSTATE_IN_FLIGHT;
+                percpu_counter_dec(&bp->b_target->bt_io_count);
+        }
+}
+
+static inline void
+xfs_buf_ioacct_dec(
+        struct xfs_buf  *bp)
+{
+        spin_lock(&bp->b_lock);
+        __xfs_buf_ioacct_dec(bp);
+        spin_unlock(&bp->b_lock);
 }
 
 /*
@@ -149,9 +163,9 @@ xfs_buf_stale(
          * unaccounted (released to LRU) before that occurs. Drop in-flight
          * status now to preserve accounting consistency.
          */
-        xfs_buf_ioacct_dec(bp);
-
         spin_lock(&bp->b_lock);
+        __xfs_buf_ioacct_dec(bp);
+
         atomic_set(&bp->b_lru_ref, 0);
         if (!(bp->b_state & XFS_BSTATE_DISPOSE) &&
             (list_lru_del(&bp->b_target->bt_lru, &bp->b_lru)))
@@ -979,12 +993,12 @@ xfs_buf_rele(
                  * ensures the decrement occurs only once per-buf.
                  */
                 if ((atomic_read(&bp->b_hold) == 1) && !list_empty(&bp->b_lru))
-                        xfs_buf_ioacct_dec(bp);
+                        __xfs_buf_ioacct_dec(bp);
                 goto out_unlock;
         }
 
         /* the last reference has been dropped ... */
-        xfs_buf_ioacct_dec(bp);
+        __xfs_buf_ioacct_dec(bp);
         if (!(bp->b_flags & XBF_STALE) && atomic_read(&bp->b_lru_ref)) {
                 /*
                  * If the buffer is added to the LRU take a new reference to the
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 8d1d44f87ce9..1508121f29f2 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -63,7 +63,6 @@ typedef enum {
 #define _XBF_KMEM        (1 << 21)/* backed by heap memory */
 #define _XBF_DELWRI_Q    (1 << 22)/* buffer on a delwri queue */
 #define _XBF_COMPOUND    (1 << 23)/* compound buffer */
-#define _XBF_IN_FLIGHT   (1 << 25) /* I/O in flight, for accounting purposes */
 
 typedef unsigned int xfs_buf_flags_t;
 
@@ -84,14 +83,14 @@ typedef unsigned int xfs_buf_flags_t;
         { _XBF_PAGES,           "PAGES" }, \
         { _XBF_KMEM,            "KMEM" }, \
         { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
-        { _XBF_COMPOUND,        "COMPOUND" }, \
-        { _XBF_IN_FLIGHT,       "IN_FLIGHT" }
+        { _XBF_COMPOUND,        "COMPOUND" }
 
 
 /*
  * Internal state flags.
  */
 #define XFS_BSTATE_DISPOSE       (1 << 0)       /* buffer being discarded */
+#define XFS_BSTATE_IN_FLIGHT     (1 << 1)       /* I/O in flight */
 
 /*
  * The xfs_buftarg contains 2 notions of "sector size" -
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 35703a801372..5fb5a0958a14 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1043,49 +1043,17 @@ xfs_find_get_desired_pgoff(
 
         index = startoff >> PAGE_SHIFT;
         endoff = XFS_FSB_TO_B(mp, map->br_startoff + map->br_blockcount);
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
         do {
                 int             want;
                 unsigned        nr_pages;
                 unsigned int    i;
 
-                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           want);
-                /*
-                 * No page mapped into given range.  If we are searching holes
-                 * and if this is the first time we got into the loop, it means
-                 * that the given offset is landed in a hole, return it.
-                 *
-                 * If we have already stepped through some block buffers to find
-                 * holes but they all contains data.  In this case, the last
-                 * offset is already updated and pointed to the end of the last
-                 * mapped page, if it does not reach the endpoint to search,
-                 * that means there should be a hole between them.
-                 */
-                if (nr_pages == 0) {
-                        /* Data search found nothing */
-                        if (type == DATA_OFF)
-                                break;
-
-                        ASSERT(type == HOLE_OFF);
-                        if (lastoff == startoff || lastoff < endoff) {
-                                found = true;
-                                *offset = lastoff;
-                        }
-                        break;
-                }
-
-                /*
-                 * At lease we found one page.  If this is the first time we
-                 * step into the loop, and if the first page index offset is
-                 * greater than the given search offset, a hole was found.
-                 */
-                if (type == HOLE_OFF && lastoff == startoff &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = true;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page     *page = pvec.pages[i];
@@ -1098,18 +1066,18 @@ xfs_find_get_desired_pgoff(
                          * file mapping. However, page->index will not change
                          * because we have a reference on the page.
                          *
-                         * Searching done if the page index is out of range.
-                         * If the current offset is not reaches the end of
-                         * the specified search range, there should be a hole
-                         * between them.
+                         * If current page offset is beyond where we've ended,
+                         * we've found a hole.
                          */
-                        if (page->index > end) {
-                                if (type == HOLE_OFF && lastoff < endoff) {
-                                        *offset = lastoff;
-                                        found = true;
-                                }
+                        if (type == HOLE_OFF && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
+                                found = true;
+                                *offset = lastoff;
                                 goto out;
                         }
+                        /* Searching done if the page index is out of range. */
+                        if (page->index > end)
+                                goto out;
 
                         lock_page(page);
                         /*
@@ -1151,21 +1119,20 @@ xfs_find_get_desired_pgoff(
 
                 /*
                  * The number of returned pages less than our desired, search
-                 * done.  In this case, nothing was found for searching data,
-                 * but we found a hole behind the last offset.
+                 * done.
                  */
-                if (nr_pages < want) {
-                        if (type == HOLE_OFF) {
-                                *offset = lastoff;
-                                found = true;
-                        }
+                if (nr_pages < want)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        /* No page at lastoff and we are not done - we found a hole. */
+        if (type == HOLE_OFF && lastoff < endoff) {
+                *offset = lastoff;
+                found = true;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 3683819887a5..814ed729881d 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -828,6 +828,7 @@ xfs_getfsmap(
         struct xfs_fsmap                dkeys[2];       /* per-dev keys */
         struct xfs_getfsmap_dev         handlers[XFS_GETFSMAP_DEVS];
         struct xfs_getfsmap_info        info = { NULL };
+        bool                            use_rmap;
         int                             i;
         int                             error = 0;
 
@@ -837,12 +838,14 @@ xfs_getfsmap(
             !xfs_getfsmap_is_valid_device(mp, &head->fmh_keys[1]))
                 return -EINVAL;
 
+        use_rmap = capable(CAP_SYS_ADMIN) &&
+                   xfs_sb_version_hasrmapbt(&mp->m_sb);
         head->fmh_entries = 0;
 
         /* Set up our device handlers. */
         memset(handlers, 0, sizeof(handlers));
         handlers[0].dev = new_encode_dev(mp->m_ddev_targp->bt_dev);
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (use_rmap)
                 handlers[0].fn = xfs_getfsmap_datadev_rmapbt;
         else
                 handlers[0].fn = xfs_getfsmap_datadev_bnobt;
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index f61c84f8e31a..990210fcb9c3 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -66,7 +66,6 @@ xfs_inode_alloc(
 
         XFS_STATS_INC(mp, vn_active);
         ASSERT(atomic_read(&ip->i_pincount) == 0);
-        ASSERT(!spin_is_locked(&ip->i_flags_lock));
         ASSERT(!xfs_isiflocked(ip));
         ASSERT(ip->i_ino == 0);
 
@@ -190,7 +189,7 @@ xfs_perag_set_reclaim_tag(
 {
         struct xfs_mount        *mp = pag->pag_mount;
 
-        ASSERT(spin_is_locked(&pag->pag_ici_lock));
+        lockdep_assert_held(&pag->pag_ici_lock);
         if (pag->pag_ici_reclaimable++)
                 return;
 
@@ -212,7 +211,7 @@ xfs_perag_clear_reclaim_tag(
 {
         struct xfs_mount        *mp = pag->pag_mount;
 
-        ASSERT(spin_is_locked(&pag->pag_ici_lock));
+        lockdep_assert_held(&pag->pag_ici_lock);
         if (--pag->pag_ici_reclaimable)
                 return;
 
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 197f3fffc9a7..408c7820e200 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -210,7 +210,8 @@ struct acpi_device_flags {
         u32 of_compatible_ok:1;
         u32 coherent_dma:1;
         u32 cca_seen:1;
-        u32 reserved:20;
+        u32 spi_i2c_slave:1;
+        u32 reserved:19;
 };
 
 /* File System */
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index d92543f3bbfd..bdc55c0da19c 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -374,6 +374,20 @@ struct acpi_table_desc {
         u16 validation_count;
 };
 
+/*
+ * Maximum value of the validation_count field in struct acpi_table_desc.
+ * When reached, validation_count cannot be changed any more and the table will
+ * be permanently regarded as validated.
+ *
+ * This is to prevent situations in which unbalanced table get/put operations
+ * may cause premature table unmapping in the OS to happen.
+ *
+ * The maximum validation count can be defined to any value, but should be
+ * greater than the maximum number of OS early stage mapping slots to avoid
+ * leaking early stage table mappings to the late stage.
+ */
+#define ACPI_MAX_TABLE_VALIDATIONS          ACPI_UINT16_MAX
+
 /* Masks for Flags field above */
 
 #define ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL  (0) /* Virtual address, external maintained */
diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h
index c0bd0d7651a9..bb837310c07e 100644
--- a/include/drm/drm_dp_helper.h
+++ b/include/drm/drm_dp_helper.h
@@ -913,4 +913,55 @@ void drm_dp_aux_unregister(struct drm_dp_aux *aux);
 int drm_dp_start_crc(struct drm_dp_aux *aux, struct drm_crtc *crtc);
 int drm_dp_stop_crc(struct drm_dp_aux *aux);
 
+struct drm_dp_dpcd_ident {
+        u8 oui[3];
+        u8 device_id[6];
+        u8 hw_rev;
+        u8 sw_major_rev;
+        u8 sw_minor_rev;
+} __packed;
+
+/**
+ * struct drm_dp_desc - DP branch/sink device descriptor
+ * @ident: DP device identification from DPCD 0x400 (sink) or 0x500 (branch).
+ * @quirks: Quirks; use drm_dp_has_quirk() to query for the quirks.
+ */
+struct drm_dp_desc {
+        struct drm_dp_dpcd_ident ident;
+        u32 quirks;
+};
+
+int drm_dp_read_desc(struct drm_dp_aux *aux, struct drm_dp_desc *desc,
+                     bool is_branch);
+
+/**
+ * enum drm_dp_quirk - Display Port sink/branch device specific quirks
+ *
+ * Display Port sink and branch devices in the wild have a variety of bugs, try
+ * to collect them here. The quirks are shared, but it's up to the drivers to
+ * implement workarounds for them.
+ */
+enum drm_dp_quirk {
+        /**
+         * @DP_DPCD_QUIRK_LIMITED_M_N:
+         *
+         * The device requires main link attributes Mvid and Nvid to be limited
+         * to 16 bits.
+         */
+        DP_DPCD_QUIRK_LIMITED_M_N,
+};
+
+/**
+ * drm_dp_has_quirk() - does the DP device have a specific quirk
+ * @desc: Device decriptor filled by drm_dp_read_desc()
+ * @quirk: Quirk to query for
+ *
+ * Return true if DP device identified by @desc has @quirk.
+ */
+static inline bool
+drm_dp_has_quirk(const struct drm_dp_desc *desc, enum drm_dp_quirk quirk)
+{
+        return desc->quirks & BIT(quirk);
+}
+
 #endif /* _DRM_DP_HELPER_H_ */
diff --git a/include/dt-bindings/clock/sun50i-a64-ccu.h b/include/dt-bindings/clock/sun50i-a64-ccu.h
index 370c0a0473fc..d66432c6e675 100644
--- a/include/dt-bindings/clock/sun50i-a64-ccu.h
+++ b/include/dt-bindings/clock/sun50i-a64-ccu.h
@@ -43,6 +43,8 @@
 #ifndef _DT_BINDINGS_CLK_SUN50I_A64_H_
 #define _DT_BINDINGS_CLK_SUN50I_A64_H_
 
+#define CLK_PLL_PERIPH0         11
+
 #define CLK_BUS_MIPI_DSI        28
 #define CLK_BUS_CE              29
 #define CLK_BUS_DMA             30
diff --git a/include/dt-bindings/clock/sun8i-h3-ccu.h b/include/dt-bindings/clock/sun8i-h3-ccu.h
index c2afc41d6964..e139fe5c62ec 100644
--- a/include/dt-bindings/clock/sun8i-h3-ccu.h
+++ b/include/dt-bindings/clock/sun8i-h3-ccu.h
@@ -43,6 +43,8 @@
 #ifndef _DT_BINDINGS_CLK_SUN8I_H3_H_
 #define _DT_BINDINGS_CLK_SUN8I_H3_H_
 
+#define CLK_PLL_PERIPH0         9
+
 #define CLK_CPUX                14
 
 #define CLK_BUS_CE              20
diff --git a/include/linux/bio.h b/include/linux/bio.h
index d1b04b0e99cf..a7e29fa0981f 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -426,6 +426,7 @@ extern void bio_advance(struct bio *, unsigned);
 
 extern void bio_init(struct bio *bio, struct bio_vec *table,
                      unsigned short max_vecs);
+extern void bio_uninit(struct bio *);
 extern void bio_reset(struct bio *);
 void bio_chain(struct bio *, struct bio *);
 
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index c47aa248c640..fcd641032f8d 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -238,7 +238,6 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
                                 bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
-void blk_mq_abort_requeue_list(struct request_queue *q);
 void blk_mq_complete_request(struct request *rq);
 
 bool blk_mq_queue_stopped(struct request_queue *q);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index ab92c4ea138b..1ddd36bd2173 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -391,6 +391,8 @@ struct request_queue {
         int                     nr_rqs[2];      /* # allocated [a]sync rqs */
         int                     nr_rqs_elvpriv; /* # allocated rqs w/ elvpriv */
 
+        atomic_t                shared_hctx_restart;
+
         struct blk_queue_stats  *stats;
         struct rq_wb            *rq_wb;
 
@@ -586,6 +588,8 @@ struct request_queue {
 
         size_t                  cmd_size;
         void                    *rq_alloc_data;
+
+        struct work_struct      release_work;
 };
 
 #define QUEUE_FLAG_QUEUED       1       /* uses generic tag queueing */
diff --git a/include/linux/ceph/ceph_debug.h b/include/linux/ceph/ceph_debug.h
index aa2e19182d99..51c5bd64bd00 100644
--- a/include/linux/ceph/ceph_debug.h
+++ b/include/linux/ceph/ceph_debug.h
@@ -3,6 +3,8 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/string.h>
+
 #ifdef CONFIG_CEPH_LIB_PRETTYDEBUG
 
 /*
@@ -12,12 +14,10 @@
  */
 
 # if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
-extern const char *ceph_file_part(const char *s, int len);
 #  define dout(fmt, ...)                                                \
         pr_debug("%.*s %12.12s:%-4d : " fmt,                            \
                  8 - (int)sizeof(KBUILD_MODNAME), "    ",               \
-                 ceph_file_part(__FILE__, sizeof(__FILE__)),            \
-                 __LINE__, ##__VA_ARGS__)
+                 kbasename(__FILE__), __LINE__, ##__VA_ARGS__)
 # else
 /* faux printk call just to see any compiler warnings. */
 #  define dout(fmt, ...)        do {                            \
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 21745946cae1..ec47101cb1bf 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -48,6 +48,7 @@ enum {
         CSS_ONLINE      = (1 << 1), /* between ->css_online() and ->css_offline() */
         CSS_RELEASED    = (1 << 2), /* refcnt reached zero, released */
         CSS_VISIBLE     = (1 << 3), /* css is visible to userland */
+        CSS_DYING       = (1 << 4), /* css is dying */
 };
 
 /* bits in struct cgroup flags field */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index ed2573e149fa..710a005c6b7a 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -344,6 +344,26 @@ static inline bool css_tryget_online(struct cgroup_subsys_state *css)
 }
 
 /**
+ * css_is_dying - test whether the specified css is dying
+ * @css: target css
+ *
+ * Test whether @css is in the process of offlining or already offline.  In
+ * most cases, ->css_online() and ->css_offline() callbacks should be
+ * enough; however, the actual offline operations are RCU delayed and this
+ * test returns %true also when @css is scheduled to be offlined.
+ *
+ * This is useful, for example, when the use case requires synchronous
+ * behavior with respect to cgroup removal.  cgroup removal schedules css
+ * offlining but the css can seem alive while the operation is being
+ * delayed.  If the delay affects user visible semantics, this test can be
+ * used to resolve the situation.
+ */
+static inline bool css_is_dying(struct cgroup_subsys_state *css)
+{
+        return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt);
+}
+
+/**
  * css_put - put a css reference
  * @css: target css
  *
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index de179993e039..d614c5ea1b5e 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -15,3 +15,11 @@
  * with any version that can compile the kernel
  */
 #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+
+/*
+ * GCC does not warn about unused static inline functions for
+ * -Wunused-function.  This turns out to avoid the need for complex #ifdef
+ * directives.  Suppress the warning in clang as well.
+ */
+#undef inline
+#define inline inline __attribute__((unused)) notrace
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index 2319b8c108e8..c96709049683 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -74,7 +74,8 @@ extern void config_item_init_type_name(struct config_item *item,
                                        const char *name,
                                        struct config_item_type *type);
 
-extern struct config_item * config_item_get(struct config_item *);
+extern struct config_item *config_item_get(struct config_item *);
+extern struct config_item *config_item_get_unless_zero(struct config_item *);
 extern void config_item_put(struct config_item *);
 
 struct config_item_type {
diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
index 4eac2670bfa1..92f20832fd28 100644
--- a/include/linux/dma-iommu.h
+++ b/include/linux/dma-iommu.h
@@ -78,6 +78,7 @@ void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list);
 
 struct iommu_domain;
 struct msi_msg;
+struct device;
 
 static inline int iommu_dma_init(void)
 {
diff --git a/include/linux/dmi.h b/include/linux/dmi.h
index 5e9c74cf8894..9bbf21a516e4 100644
--- a/include/linux/dmi.h
+++ b/include/linux/dmi.h
@@ -136,7 +136,7 @@ static inline int dmi_name_in_vendors(const char *s) { return 0; }
 static inline int dmi_name_in_serial(const char *s) { return 0; }
 #define dmi_available 0
 static inline int dmi_walk(void (*decode)(const struct dmi_header *, void *),
-        void *private_data) { return -1; }
+        void *private_data) { return -ENXIO; }
 static inline bool dmi_match(enum dmi_field f, const char *str)
         { return false; }
 static inline void dmi_memdev_name(u16 handle, const char **bank,
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 9ec5e22846e0..0e306c5a86d6 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -153,7 +153,7 @@ struct elevator_type
 #endif
 
         /* managed by elevator core */
-        char icq_cache_name[ELV_NAME_MAX + 5];  /* elvname + "_io_cq" */
+        char icq_cache_name[ELV_NAME_MAX + 6];  /* elvname + "_io_cq" */
         struct list_head list;
 };
 
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 56197f82af45..62d948f80730 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -272,6 +272,16 @@ struct bpf_prog_aux;
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 2b1a44f5bdb6..a89d37e8b387 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -41,7 +41,7 @@ struct vm_area_struct;
 #define ___GFP_WRITE            0x800000u
 #define ___GFP_KSWAPD_RECLAIM   0x1000000u
 #ifdef CONFIG_LOCKDEP
-#define ___GFP_NOLOCKDEP        0x4000000u
+#define ___GFP_NOLOCKDEP        0x2000000u
 #else
 #define ___GFP_NOLOCKDEP        0
 #endif
diff --git a/include/linux/gpio/machine.h b/include/linux/gpio/machine.h
index c0d712d22b07..f738d50cc17d 100644
--- a/include/linux/gpio/machine.h
+++ b/include/linux/gpio/machine.h
@@ -56,7 +56,14 @@ struct gpiod_lookup_table {
         .flags = _flags,                                                  \
 }
 
+#ifdef CONFIG_GPIOLIB
 void gpiod_add_lookup_table(struct gpiod_lookup_table *table);
 void gpiod_remove_lookup_table(struct gpiod_lookup_table *table);
+#else
+static inline
+void gpiod_add_lookup_table(struct gpiod_lookup_table *table) {}
+static inline
+void gpiod_remove_lookup_table(struct gpiod_lookup_table *table) {}
+#endif
 
 #endif /* __LINUX_GPIO_MACHINE_H */
diff --git a/include/linux/hashtable.h b/include/linux/hashtable.h
index 661e5c2a8e2a..082dc1bd0801 100644
--- a/include/linux/hashtable.h
+++ b/include/linux/hashtable.h
@@ -167,7 +167,6 @@ static inline void hash_del_rcu(struct hlist_node *node)
 /**
  * hash_for_each_possible_rcu - iterate over all possible objects hashing to the
  * same bucket in an rcu enabled hashtable
- * in a rcu enabled hashtable
  * @name: hashtable to iterate
  * @obj: the type * to use as a loop cursor for each entry
  * @member: the name of the hlist_node within the struct
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 8d5fcd6284ce..283dc2f5364d 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -614,14 +614,16 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
 static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
                                                     netdev_features_t features)
 {
-        if (skb_vlan_tagged_multi(skb))
-                features = netdev_intersect_features(features,
-                                                     NETIF_F_SG |
-                                                     NETIF_F_HIGHDMA |
-                                                     NETIF_F_FRAGLIST |
-                                                     NETIF_F_HW_CSUM |
-                                                     NETIF_F_HW_VLAN_CTAG_TX |
-                                                     NETIF_F_HW_VLAN_STAG_TX);
+        if (skb_vlan_tagged_multi(skb)) {
+                /* In the case of multi-tagged packets, use a direct mask
+                 * instead of using netdev_interesect_features(), to make
+                 * sure that only devices supporting NETIF_F_HW_CSUM will
+                 * have checksum offloading support.
+                 */
+                features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_HW_CSUM |
+                            NETIF_F_FRAGLIST | NETIF_F_HW_VLAN_CTAG_TX |
+                            NETIF_F_HW_VLAN_STAG_TX;
+        }
 
         return features;
 }
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index fffb91202bc9..1fa293a37f4a 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -417,6 +417,10 @@
 #define ICH_HCR_EN                      (1 << 0)
 #define ICH_HCR_UIE                     (1 << 1)
 
+#define ICH_VMCR_ACK_CTL_SHIFT          2
+#define ICH_VMCR_ACK_CTL_MASK           (1 << ICH_VMCR_ACK_CTL_SHIFT)
+#define ICH_VMCR_FIQ_EN_SHIFT           3
+#define ICH_VMCR_FIQ_EN_MASK            (1 << ICH_VMCR_FIQ_EN_SHIFT)
 #define ICH_VMCR_CBPR_SHIFT             4
 #define ICH_VMCR_CBPR_MASK              (1 << ICH_VMCR_CBPR_SHIFT)
 #define ICH_VMCR_EOIM_SHIFT             9
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index dc30f3d057eb..d3453ee072fc 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -25,7 +25,18 @@
 #define GICC_ENABLE                     0x1
 #define GICC_INT_PRI_THRESHOLD          0xf0
 
-#define GIC_CPU_CTRL_EOImodeNS          (1 << 9)
+#define GIC_CPU_CTRL_EnableGrp0_SHIFT   0
+#define GIC_CPU_CTRL_EnableGrp0         (1 << GIC_CPU_CTRL_EnableGrp0_SHIFT)
+#define GIC_CPU_CTRL_EnableGrp1_SHIFT   1
+#define GIC_CPU_CTRL_EnableGrp1         (1 << GIC_CPU_CTRL_EnableGrp1_SHIFT)
+#define GIC_CPU_CTRL_AckCtl_SHIFT       2
+#define GIC_CPU_CTRL_AckCtl             (1 << GIC_CPU_CTRL_AckCtl_SHIFT)
+#define GIC_CPU_CTRL_FIQEn_SHIFT        3
+#define GIC_CPU_CTRL_FIQEn              (1 << GIC_CPU_CTRL_FIQEn_SHIFT)
+#define GIC_CPU_CTRL_CBPR_SHIFT         4
+#define GIC_CPU_CTRL_CBPR               (1 << GIC_CPU_CTRL_CBPR_SHIFT)
+#define GIC_CPU_CTRL_EOImodeNS_SHIFT    9
+#define GIC_CPU_CTRL_EOImodeNS          (1 << GIC_CPU_CTRL_EOImodeNS_SHIFT)
 
 #define GICC_IAR_INT_ID_MASK            0x3ff
 #define GICC_INT_SPURIOUS               1023
@@ -84,8 +95,19 @@
 #define GICH_LR_EOI                     (1 << 19)
 #define GICH_LR_HW                      (1 << 31)
 
-#define GICH_VMCR_CTRL_SHIFT            0
-#define GICH_VMCR_CTRL_MASK             (0x21f << GICH_VMCR_CTRL_SHIFT)
+#define GICH_VMCR_ENABLE_GRP0_SHIFT     0
+#define GICH_VMCR_ENABLE_GRP0_MASK      (1 << GICH_VMCR_ENABLE_GRP0_SHIFT)
+#define GICH_VMCR_ENABLE_GRP1_SHIFT     1
+#define GICH_VMCR_ENABLE_GRP1_MASK      (1 << GICH_VMCR_ENABLE_GRP1_SHIFT)
+#define GICH_VMCR_ACK_CTL_SHIFT         2
+#define GICH_VMCR_ACK_CTL_MASK          (1 << GICH_VMCR_ACK_CTL_SHIFT)
+#define GICH_VMCR_FIQ_EN_SHIFT          3
+#define GICH_VMCR_FIQ_EN_MASK           (1 << GICH_VMCR_FIQ_EN_SHIFT)
+#define GICH_VMCR_CBPR_SHIFT            4
+#define GICH_VMCR_CBPR_MASK             (1 << GICH_VMCR_CBPR_SHIFT)
+#define GICH_VMCR_EOI_MODE_SHIFT        9
+#define GICH_VMCR_EOI_MODE_MASK         (1 << GICH_VMCR_EOI_MODE_SHIFT)
+
 #define GICH_VMCR_PRIMASK_SHIFT         27
 #define GICH_VMCR_PRIMASK_MASK          (0x1f << GICH_VMCR_PRIMASK_SHIFT)
 #define GICH_VMCR_BINPOINT_SHIFT        21
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 36872fbb815d..734377ad42e9 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -64,13 +64,17 @@ extern int register_refined_jiffies(long clock_tick_rate);
 /* TICK_USEC is the time between ticks in usec assuming fake USER_HZ */
 #define TICK_USEC ((1000000UL + USER_HZ/2) / USER_HZ)
 
+#ifndef __jiffy_arch_data
+#define __jiffy_arch_data
+#endif
+
 /*
  * The 64-bit value is not atomic - you MUST NOT read it
  * without sampling the sequence number in jiffies_lock.
  * get_jiffies_64() will do this for you as appropriate.
  */
 extern u64 __cacheline_aligned_in_smp jiffies_64;
-extern unsigned long volatile __cacheline_aligned_in_smp jiffies;
+extern unsigned long volatile __cacheline_aligned_in_smp __jiffy_arch_data jiffies;
 
 #if (BITS_PER_LONG < 64)
 u64 get_jiffies_64(void);
diff --git a/include/linux/key.h b/include/linux/key.h
index 0c9b93b0d1f7..78e25aabedaf 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -173,7 +173,6 @@ struct key {
 #ifdef KEY_DEBUGGING
         unsigned                magic;
 #define KEY_DEBUG_MAGIC         0x18273645u
-#define KEY_DEBUG_MAGIC_X       0xf8e9dacbu
 #endif
 
         unsigned long           flags;          /* status flags (change with bitops) */
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 4ce24a376262..8098695e5d8d 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -425,12 +425,20 @@ static inline void early_memtest(phys_addr_t start, phys_addr_t end)
 }
 #endif
 
+extern unsigned long memblock_reserved_memory_within(phys_addr_t start_addr,
+                phys_addr_t end_addr);
 #else
 static inline phys_addr_t memblock_alloc(phys_addr_t size, phys_addr_t align)
 {
         return 0;
 }
 
+static inline unsigned long memblock_reserved_memory_within(phys_addr_t start_addr,
+                phys_addr_t end_addr)
+{
+        return 0;
+}
+
 #endif /* CONFIG_HAVE_MEMBLOCK */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index b4ee8f62ce8d..8e2828d48d7f 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -470,6 +470,7 @@ struct mlx4_update_qp_params {
         u16     rate_val;
 };
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                    enum mlx4_update_qp_attr attr,
                    struct mlx4_update_qp_params *params);
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index dd9a263ed368..a940ec6a046c 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -787,8 +787,14 @@ enum {
 };
 
 enum {
-        CQE_RSS_HTYPE_IP        = 0x3 << 6,
-        CQE_RSS_HTYPE_L4        = 0x3 << 2,
+        CQE_RSS_HTYPE_IP        = 0x3 << 2,
+        /* cqe->rss_hash_type[3:2] - IP destination selected for hash
+         * (00 = none,  01 = IPv4, 10 = IPv6, 11 = Reserved)
+         */
+        CQE_RSS_HTYPE_L4        = 0x3 << 6,
+        /* cqe->rss_hash_type[7:6] - L4 destination selected for hash
+         * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI
+         */
 };
 
 enum {
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index bcdf739ee41a..93273d9ea4d1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -787,7 +787,12 @@ enum {
 
 typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
 
+enum {
+        MLX5_CMD_ENT_STATE_PENDING_COMP,
+};
+
 struct mlx5_cmd_work_ent {
+        unsigned long           state;
         struct mlx5_cmd_msg    *in;
         struct mlx5_cmd_msg    *out;
         void                   *uout;
@@ -976,7 +981,7 @@ void mlx5_cq_completion(struct mlx5_core_dev *dev, u32 cqn);
 void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type);
 void mlx5_srq_event(struct mlx5_core_dev *dev, u32 srqn, int event_type);
 struct mlx5_core_srq *mlx5_core_get_srq(struct mlx5_core_dev *dev, u32 srqn);
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec);
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced);
 void mlx5_cq_event(struct mlx5_core_dev *dev, u32 cqn, int event_type);
 int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                        int nent, u64 mask, const char *name,
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 32de0724b400..edafedb7b509 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -766,6 +766,12 @@ enum {
         MLX5_CAP_PORT_TYPE_ETH = 0x1,
 };
 
+enum {
+        MLX5_CAP_UMR_FENCE_STRONG       = 0x0,
+        MLX5_CAP_UMR_FENCE_SMALL        = 0x1,
+        MLX5_CAP_UMR_FENCE_NONE         = 0x2,
+};
+
 struct mlx5_ifc_cmd_hca_cap_bits {
         u8         reserved_at_0[0x80];
 
@@ -875,7 +881,9 @@ struct mlx5_ifc_cmd_hca_cap_bits {
         u8         reserved_at_202[0x1];
         u8         ipoib_enhanced_offloads[0x1];
         u8         ipoib_basic_offloads[0x1];
-        u8         reserved_at_205[0xa];
+        u8         reserved_at_205[0x5];
+        u8         umr_fence[0x2];
+        u8         reserved_at_20c[0x3];
         u8         drain_sigerr[0x1];
         u8         cmdif_checksum[0x2];
         u8         sigerr_cqe[0x1];
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7cb17c6b97de..6f543a47fc92 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1393,12 +1393,6 @@ int clear_page_dirty_for_io(struct page *page);
 
 int get_cmdline(struct task_struct *task, char *buffer, int buflen);
 
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
-{
-        return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
-
 static inline bool vma_is_anonymous(struct vm_area_struct *vma)
 {
         return !vma->vm_ops;
@@ -1414,28 +1408,6 @@ bool vma_is_shmem(struct vm_area_struct *vma);
 static inline bool vma_is_shmem(struct vm_area_struct *vma) { return false; }
 #endif
 
-static inline int stack_guard_page_start(struct vm_area_struct *vma,
-                                             unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_growsdown(vma->vm_prev, addr);
-}
-
-/* Is the vma a continuation of the stack vma below it? */
-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
-{
-        return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
-}
-
-static inline int stack_guard_page_end(struct vm_area_struct *vma,
-                                           unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSUP) &&
-                (vma->vm_end == addr) &&
-                !vma_growsup(vma->vm_next, addr);
-}
-
 int vma_is_stack_for_current(struct vm_area_struct *vma);
 
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
@@ -2222,6 +2194,7 @@ void page_cache_async_readahead(struct address_space *mapping,
                                 pgoff_t offset,
                                 unsigned long size);
 
+extern unsigned long stack_guard_gap;
 /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
 extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
 
@@ -2250,6 +2223,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m
         return vma;
 }
 
+static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
+{
+        unsigned long vm_start = vma->vm_start;
+
+        if (vma->vm_flags & VM_GROWSDOWN) {
+                vm_start -= stack_guard_gap;
+                if (vm_start > vma->vm_start)
+                        vm_start = 0;
+        }
+        return vm_start;
+}
+
+static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
+{
+        unsigned long vm_end = vma->vm_end;
+
+        if (vma->vm_flags & VM_GROWSUP) {
+                vm_end += stack_guard_gap;
+                if (vm_end < vma->vm_end)
+                        vm_end = -PAGE_SIZE;
+        }
+        return vm_end;
+}
+
 static inline unsigned long vma_pages(struct vm_area_struct *vma)
 {
         return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
@@ -2327,6 +2324,17 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
 #define FOLL_REMOTE     0x2000  /* we are working on non-current tsk/mm */
 #define FOLL_COW        0x4000  /* internal GUP flag */
 
+static inline int vm_fault_to_errno(int vm_fault, int foll_flags)
+{
+        if (vm_fault & VM_FAULT_OOM)
+                return -ENOMEM;
+        if (vm_fault & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+                return (foll_flags & FOLL_HWPOISON) ? -EHWPOISON : -EFAULT;
+        if (vm_fault & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+                return -EFAULT;
+        return 0;
+}
+
 typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
                         void *data);
 extern int apply_to_page_range(struct mm_struct *mm, unsigned long address,
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index ebaccd4e7d8c..ef6a13b7bd3e 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -678,6 +678,7 @@ typedef struct pglist_data {
          * is the first PFN that needs to be initialised.
          */
         unsigned long first_deferred_pfn;
+        unsigned long static_init_size;
 #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 566fda587fcf..3f74ef2281e8 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -467,6 +467,7 @@ enum dmi_field {
         DMI_PRODUCT_VERSION,
         DMI_PRODUCT_SERIAL,
         DMI_PRODUCT_UUID,
+        DMI_PRODUCT_FAMILY,
         DMI_BOARD_VENDOR,
         DMI_BOARD_NAME,
         DMI_BOARD_VERSION,
diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index 6be1949ebcdf..1ee7b30dafec 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h
@@ -457,7 +457,7 @@ enum hwparam_type {
         hwparam_ioport,         /* Module parameter configures an I/O port */
         hwparam_iomem,          /* Module parameter configures an I/O mem address */
         hwparam_ioport_or_iomem, /* Module parameter could be either, depending on other option */
-        hwparam_irq,            /* Module parameter configures an I/O port */
+        hwparam_irq,            /* Module parameter configures an IRQ */
         hwparam_dma,            /* Module parameter configures a DMA channel */
         hwparam_dma_addr,       /* Module parameter configures a DMA buffer address */
         hwparam_other,          /* Module parameter configures some other value */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3f39d27decf4..4ed952c17fc7 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -914,8 +914,7 @@ struct xfrmdev_ops {
  *
  * int (*ndo_change_mtu)(struct net_device *dev, int new_mtu);
  *      Called when a user wants to change the Maximum Transfer Unit
- *      of a device. If not defined, any request to change MTU will
- *      will return an error.
+ *      of a device.
  *
  * void (*ndo_tx_timeout)(struct net_device *dev);
  *      Callback used when the transmitter has not made any progress
@@ -1596,8 +1595,8 @@ enum netdev_priv_flags {
  *      @rtnl_link_state:       This enum represents the phases of creating
  *                              a new link
  *
- *      @destructor:            Called from unregister,
- *                              can be used to call free_netdev
+ *      @needs_free_netdev:     Should unregister perform free_netdev?
+ *      @priv_destructor:       Called from unregister
  *      @npinfo:                XXX: need comments on this one
  *      @nd_net:                Network namespace this network device is inside
  *
@@ -1858,7 +1857,8 @@ struct net_device {
                 RTNL_LINK_INITIALIZING,
         } rtnl_link_state:16;
 
-        void (*destructor)(struct net_device *dev);
+        bool needs_free_netdev;
+        void (*priv_destructor)(struct net_device *dev);
 
 #ifdef CONFIG_NETPOLL
         struct netpoll_info __rcu       *npinfo;
@@ -4261,6 +4261,11 @@ static inline const char *netdev_name(const struct net_device *dev)
         return dev->name;
 }
 
+static inline bool netdev_unregistering(const struct net_device *dev)
+{
+        return dev->reg_state == NETREG_UNREGISTERING;
+}
+
 static inline const char *netdev_reg_state(const struct net_device *dev)
 {
         switch (dev->reg_state) {
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index be378cf47fcc..b3044c2c62cb 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -294,7 +294,7 @@ int xt_match_to_user(const struct xt_entry_match *m,
 int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u);
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size);
+                    int usersize, int size, int aligned_size);
 
 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                                  struct xt_counters_info *info, bool compat);
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index a30efb437e6d..e0cbf17af780 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb,
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 
+static inline bool ebt_invalid_target(int target)
+{
+        return (target < -NUM_STANDARD_TARGETS || target >= 0);
+}
+
 #endif
diff --git a/include/linux/of_graph.h b/include/linux/of_graph.h
index abdb02eaef06..3e058f05ab04 100644
--- a/include/linux/of_graph.h
+++ b/include/linux/of_graph.h
@@ -43,11 +43,15 @@ struct of_endpoint {
 #ifdef CONFIG_OF
 int of_graph_parse_endpoint(const struct device_node *node,
                                 struct of_endpoint *endpoint);
+int of_graph_get_endpoint_count(const struct device_node *np);
 struct device_node *of_graph_get_port_by_id(struct device_node *node, u32 id);
 struct device_node *of_graph_get_next_endpoint(const struct device_node *parent,
                                         struct device_node *previous);
 struct device_node *of_graph_get_endpoint_by_regs(
                 const struct device_node *parent, int port_reg, int reg);
+struct device_node *of_graph_get_remote_endpoint(
+                                        const struct device_node *node);
+struct device_node *of_graph_get_port_parent(struct device_node *node);
 struct device_node *of_graph_get_remote_port_parent(
                                         const struct device_node *node);
 struct device_node *of_graph_get_remote_port(const struct device_node *node);
@@ -61,6 +65,11 @@ static inline int of_graph_parse_endpoint(const struct device_node *node,
         return -ENOSYS;
 }
 
+static inline int of_graph_get_endpoint_count(const struct device_node *np)
+{
+        return 0;
+}
+
 static inline struct device_node *of_graph_get_port_by_id(
                                         struct device_node *node, u32 id)
 {
@@ -80,6 +89,18 @@ static inline struct device_node *of_graph_get_endpoint_by_regs(
         return NULL;
 }
 
+static inline struct device_node *of_graph_get_remote_endpoint(
+                                        const struct device_node *node)
+{
+        return NULL;
+}
+
+static inline struct device_node *of_graph_get_port_parent(
+        struct device_node *node)
+{
+        return NULL;
+}
+
 static inline struct device_node *of_graph_get_remote_port_parent(
                                         const struct device_node *node)
 {
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index dc8224ae28d5..e0d1946270f3 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -64,6 +64,7 @@ extern struct platform_device *of_platform_device_create(struct device_node *np,
                                                    const char *bus_id,
                                                    struct device *parent);
 
+extern int of_platform_device_destroy(struct device *dev, void *data);
 extern int of_platform_bus_probe(struct device_node *root,
                                  const struct of_device_id *matches,
                                  struct device *parent);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 33c2b0b77429..8039f9f0ca05 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -183,6 +183,11 @@ enum pci_dev_flags {
         PCI_DEV_FLAGS_BRIDGE_XLATE_ROOT = (__force pci_dev_flags_t) (1 << 9),
         /* Do not use FLR even if device advertises PCI_AF_CAP */
         PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
+        /*
+         * Resume before calling the driver's system suspend hooks, disabling
+         * the direct_complete optimization.
+         */
+        PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
 };
 
 enum pci_irq_reroute_variant {
@@ -1342,9 +1347,9 @@ pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                unsigned int max_vecs, unsigned int flags,
                                const struct irq_affinity *aff_desc)
 {
-        if (min_vecs > 1)
-                return -EINVAL;
-        return 1;
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1 && dev->irq)
+                return 1;
+        return -ENOSPC;
 }
 
 static inline void pci_free_irq_vectors(struct pci_dev *dev)
diff --git a/include/linux/pinctrl/pinconf-generic.h b/include/linux/pinctrl/pinconf-generic.h
index 279e3c5326e3..7620eb127cff 100644
--- a/include/linux/pinctrl/pinconf-generic.h
+++ b/include/linux/pinctrl/pinconf-generic.h
@@ -42,8 +42,6 @@
  * @PIN_CONFIG_BIAS_PULL_UP: the pin will be pulled up (usually with high
  *      impedance to VDD). If the argument is != 0 pull-up is enabled,
  *      if it is 0, pull-up is total, i.e. the pin is connected to VDD.
- * @PIN_CONFIG_BIDIRECTIONAL: the pin will be configured to allow simultaneous
- *      input and output operations.
  * @PIN_CONFIG_DRIVE_OPEN_DRAIN: the pin will be driven with open drain (open
  *      collector) which means it is usually wired with other output ports
  *      which are then pulled up with an external resistor. Setting this
@@ -98,7 +96,6 @@ enum pin_config_param {
         PIN_CONFIG_BIAS_PULL_DOWN,
         PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
         PIN_CONFIG_BIAS_PULL_UP,
-        PIN_CONFIG_BIDIRECTIONAL,
         PIN_CONFIG_DRIVE_OPEN_DRAIN,
         PIN_CONFIG_DRIVE_OPEN_SOURCE,
         PIN_CONFIG_DRIVE_PUSH_PULL,
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 422bc2e4cb6a..ef3eb8bbfee4 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -54,7 +54,8 @@ extern int ptrace_request(struct task_struct *child, long request,
                           unsigned long addr, unsigned long data);
 extern void ptrace_notify(int exit_code);
 extern void __ptrace_link(struct task_struct *child,
-                          struct task_struct *new_parent);
+                          struct task_struct *new_parent,
+                          const struct cred *ptracer_cred);
 extern void __ptrace_unlink(struct task_struct *child);
 extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_READ        0x01
@@ -206,7 +207,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
         if (unlikely(ptrace) && current->ptrace) {
                 child->ptrace = current->ptrace;
-                __ptrace_link(child, current->parent);
+                __ptrace_link(child, current->parent, current->ptracer_cred);
 
                 if (child->ptrace & PT_SEIZED)
                         task_set_jobctl_pending(child, JOBCTL_TRAP_STOP);
@@ -215,6 +216,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
                 set_tsk_thread_flag(child, TIF_SIGPENDING);
         }
+        else
+                child->ptracer_cred = NULL;
 }
 
 /**
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 9c6f768b7d32..dda22f45fc1b 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -44,6 +44,7 @@ void inode_sub_rsv_space(struct inode *inode, qsize_t number);
 void inode_reclaim_rsv_space(struct inode *inode, qsize_t number);
 
 int dquot_initialize(struct inode *inode);
+bool dquot_initialize_needed(struct inode *inode);
 void dquot_drop(struct inode *inode);
 struct dquot *dqget(struct super_block *sb, struct kqid qid);
 static inline struct dquot *dqgrab(struct dquot *dquot)
@@ -207,6 +208,11 @@ static inline int dquot_initialize(struct inode *inode)
         return 0;
 }
 
+static inline bool dquot_initialize_needed(struct inode *inode)
+{
+        return false;
+}
+
 static inline void dquot_drop(struct inode *inode)
 {
 }
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index cda76c6506ca..e69402d4a8ae 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -195,6 +195,7 @@ int serdev_device_open(struct serdev_device *);
 void serdev_device_close(struct serdev_device *);
 unsigned int serdev_device_set_baudrate(struct serdev_device *, unsigned int);
 void serdev_device_set_flow_control(struct serdev_device *, bool);
+int serdev_device_write_buf(struct serdev_device *, const unsigned char *, size_t);
 void serdev_device_wait_until_sent(struct serdev_device *, long);
 int serdev_device_get_tiocm(struct serdev_device *);
 int serdev_device_set_tiocm(struct serdev_device *, int, int);
@@ -236,6 +237,12 @@ static inline unsigned int serdev_device_set_baudrate(struct serdev_device *sdev
         return 0;
 }
 static inline void serdev_device_set_flow_control(struct serdev_device *sdev, bool enable) {}
+static inline int serdev_device_write_buf(struct serdev_device *serdev,
+                                          const unsigned char *buf,
+                                          size_t count)
+{
+        return -ENODEV;
+}
 static inline void serdev_device_wait_until_sent(struct serdev_device *sdev, long timeout) {}
 static inline int serdev_device_get_tiocm(struct serdev_device *serdev)
 {
@@ -301,7 +308,7 @@ struct tty_driver;
 struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx);
-void serdev_tty_port_unregister(struct tty_port *port);
+int serdev_tty_port_unregister(struct tty_port *port);
 #else
 static inline struct device *serdev_tty_port_register(struct tty_port *port,
                                            struct device *parent,
@@ -309,14 +316,10 @@ static inline struct device *serdev_tty_port_register(struct tty_port *port,
 {
         return ERR_PTR(-ENODEV);
 }
-static inline void serdev_tty_port_unregister(struct tty_port *port) {}
-#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
-
-static inline int serdev_device_write_buf(struct serdev_device *serdev,
-                                          const unsigned char *data,
-                                          size_t count)
+static inline int serdev_tty_port_unregister(struct tty_port *port)
 {
-        return serdev_device_write(serdev, data, count, 0);
+        return -ENODEV;
 }
+#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
 
 #endif /*_LINUX_SERDEV_H */
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index 07ef550c6627..93315d6b21a8 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -84,6 +84,7 @@ struct kmem_cache {
         int red_left_pad;       /* Left redzone padding size */
 #ifdef CONFIG_SYSFS
         struct kobject kobj;    /* For sysfs */
+        struct work_struct kobj_remove_work;
 #endif
 #ifdef CONFIG_MEMCG
         struct memcg_cache_params memcg_params;
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 167ad8831aaf..4c1d5f7e62c4 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -172,9 +172,7 @@ static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
 {
         int retval;
 
-        preempt_disable();
         retval = __srcu_read_lock(sp);
-        preempt_enable();
         rcu_lock_acquire(&(sp)->dep_map);
         return retval;
 }
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 94631026f79c..11cef5a7bc87 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -336,7 +336,8 @@ xdr_argsize_check(struct svc_rqst *rqstp, __be32 *p)
 {
         char *cp = (char *)p;
         struct kvec *vec = &rqstp->rq_arg.head[0];
-        return cp == (char *)vec->iov_base + vec->iov_len;
+        return cp >= (char*)vec->iov_base
+                && cp <= (char*)vec->iov_base + vec->iov_len;
 }
 
 static inline int
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 0b1cf32edfd7..d9718378a8be 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -189,8 +189,6 @@ struct platform_suspend_ops {
 struct platform_freeze_ops {
         int (*begin)(void);
         int (*prepare)(void);
-        void (*wake)(void);
-        void (*sync)(void);
         void (*restore)(void);
         void (*end)(void);
 };
@@ -430,8 +428,7 @@ extern unsigned int pm_wakeup_irq;
 
 extern bool pm_wakeup_pending(void);
 extern void pm_system_wakeup(void);
-extern void pm_system_cancel_wakeup(void);
-extern void pm_wakeup_clear(bool reset);
+extern void pm_wakeup_clear(void);
 extern void pm_system_irq_wakeup(unsigned int irq_number);
 extern bool pm_get_wakeup_count(unsigned int *count, bool block);
 extern bool pm_save_wakeup_count(unsigned int count);
@@ -481,7 +478,7 @@ static inline int unregister_pm_notifier(struct notifier_block *nb)
 
 static inline bool pm_wakeup_pending(void) { return false; }
 static inline void pm_system_wakeup(void) {}
-static inline void pm_wakeup_clear(bool reset) {}
+static inline void pm_wakeup_clear(void) {}
 static inline void pm_system_irq_wakeup(unsigned int irq_number) {}
 
 static inline void lock_system_sleep(void) {}
diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
index 110f4532188c..f7043ccca81c 100644
--- a/include/linux/timekeeper_internal.h
+++ b/include/linux/timekeeper_internal.h
@@ -29,7 +29,6 @@
  */
 struct tk_read_base {
         struct clocksource      *clock;
-        u64                     (*read)(struct clocksource *cs);
         u64                     mask;
         u64                     cycle_last;
         u32                     mult;
@@ -58,7 +57,7 @@ struct tk_read_base {
  *                      interval.
  * @xtime_remainder:    Shifted nano seconds left over when rounding
  *                      @cycle_interval
- * @raw_interval:       Raw nano seconds accumulated per NTP interval.
+ * @raw_interval:       Shifted raw nano seconds accumulated per NTP interval.
  * @ntp_error:          Difference between accumulated time and NTP time in ntp
  *                      shifted nano seconds.
  * @ntp_error_shift:    Shift conversion between clock shifted nano seconds and
@@ -100,7 +99,7 @@ struct timekeeper {
         u64                     cycle_interval;
         u64                     xtime_interval;
         s64                     xtime_remainder;
-        u32                     raw_interval;
+        u64                     raw_interval;
         /* The ntp_tick_length() value currently being used.
          * This cached copy ensures we consistently apply the tick
          * length for an entire tick, as ntp_tick_length may change
diff --git a/include/linux/tty.h b/include/linux/tty.h
index d07cd2105a6c..eccb4ec30a8a 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -558,6 +558,15 @@ extern struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct tty_driver *driver, unsigned index,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp);
+extern struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device);
+extern struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp);
+extern void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index);
 extern int tty_port_alloc_xmit_buf(struct tty_port *port);
 extern void tty_port_free_xmit_buf(struct tty_port *port);
 extern void tty_port_destroy(struct tty_port *port);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 7dffa5624ea6..97116379db5f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -206,6 +206,7 @@ struct cdc_state {
 };
 
 extern int usbnet_generic_cdc_bind(struct usbnet *, struct usb_interface *);
+extern int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf);
 extern int usbnet_cdc_bind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_unbind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_status(struct usbnet *, struct urb *);
diff --git a/include/media/cec-notifier.h b/include/media/cec-notifier.h
index eb50ce54b759..298f996969df 100644
--- a/include/media/cec-notifier.h
+++ b/include/media/cec-notifier.h
@@ -29,7 +29,7 @@ struct edid;
 struct cec_adapter;
 struct cec_notifier;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#if IS_REACHABLE(CONFIG_CEC_CORE) && IS_ENABLED(CONFIG_CEC_NOTIFIER)
 
 /**
  * cec_notifier_get - find or create a new cec_notifier for the given device.
@@ -106,6 +106,16 @@ static inline void cec_notifier_set_phys_addr_from_edid(struct cec_notifier *n,
 {
 }
 
+static inline void cec_notifier_register(struct cec_notifier *n,
+                         struct cec_adapter *adap,
+                         void (*callback)(struct cec_adapter *adap, u16 pa))
+{
+}
+
+static inline void cec_notifier_unregister(struct cec_notifier *n)
+{
+}
+
 #endif
 
 #endif
diff --git a/include/media/cec.h b/include/media/cec.h
index b8eb895731d5..201f060978da 100644
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -173,7 +173,7 @@ struct cec_adapter {
         bool passthrough;
         struct cec_log_addrs log_addrs;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         struct cec_notifier *notifier;
 #endif
 
@@ -206,7 +206,7 @@ static inline bool cec_is_sink(const struct cec_adapter *adap)
 #define cec_phys_addr_exp(pa) \
         ((pa) >> 12), ((pa) >> 8) & 0xf, ((pa) >> 4) & 0xf, (pa) & 0xf
 
-#if IS_ENABLED(CONFIG_CEC_CORE)
+#if IS_REACHABLE(CONFIG_CEC_CORE)
 struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops,
                 void *priv, const char *name, u32 caps, u8 available_las);
 int cec_register_adapter(struct cec_adapter *adap, struct device *parent);
@@ -300,7 +300,7 @@ u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
  */
 int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 void cec_register_cec_notifier(struct cec_adapter *adap,
                                struct cec_notifier *notifier);
 #endif
diff --git a/include/net/dst.h b/include/net/dst.h
index 049af33da3b6..cfc043784166 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -107,10 +107,16 @@ struct dst_entry {
         };
 };
 
+struct dst_metrics {
+        u32             metrics[RTAX_MAX];
+        atomic_t        refcnt;
+};
+extern const struct dst_metrics dst_default_metrics;
+
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
-extern const u32 dst_default_metrics[];
 
 #define DST_METRICS_READ_ONLY           0x1UL
+#define DST_METRICS_REFCOUNTED          0x2UL
 #define DST_METRICS_FLAGS               0x3UL
 #define __DST_METRICS_PTR(Y)    \
         ((u32 *)((Y) & ~DST_METRICS_FLAGS))
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 6692c5758b33..f7f6aa789c61 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -114,11 +114,11 @@ struct fib_info {
         __be32                  fib_prefsrc;
         u32                     fib_tb_id;
         u32                     fib_priority;
-        u32                     *fib_metrics;
-#define fib_mtu fib_metrics[RTAX_MTU-1]
-#define fib_window fib_metrics[RTAX_WINDOW-1]
-#define fib_rtt fib_metrics[RTAX_RTT-1]
-#define fib_advmss fib_metrics[RTAX_ADVMSS-1]
+        struct dst_metrics      *fib_metrics;
+#define fib_mtu fib_metrics->metrics[RTAX_MTU-1]
+#define fib_window fib_metrics->metrics[RTAX_WINDOW-1]
+#define fib_rtt fib_metrics->metrics[RTAX_RTT-1]
+#define fib_advmss fib_metrics->metrics[RTAX_ADVMSS-1]
         int                     fib_nhs;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         int                     fib_weight;
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index dbf0abba33b8..3e505bbff8ca 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1007,6 +1007,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
  */
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
 
 struct group_source_req;
 struct group_filter;
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index e04fa7691e5d..c519bb5b5bb8 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -9,6 +9,7 @@
 
 #ifndef _NF_CONNTRACK_HELPER_H
 #define _NF_CONNTRACK_HELPER_H
+#include <linux/refcount.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_expect.h>
@@ -26,6 +27,7 @@ struct nf_conntrack_helper {
         struct hlist_node hnode;        /* Internal use. */
 
         char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
+        refcount_t refcnt;
         struct module *me;              /* pointer to self */
         const struct nf_conntrack_expect_policy *expect_policy;
 
@@ -79,6 +81,8 @@ struct nf_conntrack_helper *__nf_conntrack_helper_find(const char *name,
 struct nf_conntrack_helper *nf_conntrack_helper_try_module_get(const char *name,
                                                                u16 l3num,
                                                                u8 protonum);
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper);
+
 void nf_ct_helper_init(struct nf_conntrack_helper *helper,
                        u16 l3num, u16 protonum, const char *name,
                        u16 default_port, u16 spec_port, u32 id,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 028faec8fc27..8a8bab8d7b15 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -176,7 +176,7 @@ struct nft_data_desc {
 int nft_data_init(const struct nft_ctx *ctx,
                   struct nft_data *data, unsigned int size,
                   struct nft_data_desc *desc, const struct nlattr *nla);
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type);
+void nft_data_release(const struct nft_data *data, enum nft_data_types type);
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len);
 
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index f31fb6331a53..3248beaf16b0 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <net/act_api.h>
+#include <linux/tc_act/tc_csum.h>
 
 struct tcf_csum {
         struct tc_action common;
@@ -11,4 +12,18 @@ struct tcf_csum {
 };
 #define to_tcf_csum(a) ((struct tcf_csum *)a)
 
+static inline bool is_tcf_csum(const struct tc_action *a)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        if (a->ops && a->ops->type == TCA_ACT_CSUM)
+                return true;
+#endif
+        return false;
+}
+
+static inline u32 tcf_csum_update_flags(const struct tc_action *a)
+{
+        return to_tcf_csum(a)->update_flags;
+}
+
 #endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 38a7427ae902..be6223c586fa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -924,7 +924,7 @@ struct tcp_congestion_ops {
         void (*cwnd_event)(struct sock *sk, enum tcp_ca_event ev);
         /* call when ack arrives (optional) */
         void (*in_ack_event)(struct sock *sk, u32 flags);
-        /* new value of cwnd after loss (optional) */
+        /* new value of cwnd after loss (required) */
         u32  (*undo_cwnd)(struct sock *sk);
         /* hook for packet ack accounting (optional) */
         void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
diff --git a/include/net/wext.h b/include/net/wext.h
index 345911965dbb..454ff763eeba 100644
--- a/include/net/wext.h
+++ b/include/net/wext.h
@@ -6,7 +6,7 @@
 struct net;
 
 #ifdef CONFIG_WEXT_CORE
-int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,
                       void __user *arg);
 int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
                              unsigned long arg);
@@ -14,7 +14,7 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
 struct iw_statistics *get_wireless_stats(struct net_device *dev);
 int call_commit_handler(struct net_device *dev);
 #else
-static inline int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+static inline int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,
                                     void __user *arg)
 {
         return -EINVAL;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6793a30c66b1..62f5a259e597 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -979,10 +979,6 @@ struct xfrm_dst {
         struct flow_cache_object flo;
         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
         int num_pols, num_xfrms;
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct flowi *origin;
-        struct xfrm_selector *partner;
-#endif
         u32 xfrm_genid;
         u32 policy_genid;
         u32 route_mtu_cached;
@@ -998,12 +994,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
         dst_release(xdst->route);
         if (likely(xdst->u.dst.xfrm))
                 xfrm_state_put(xdst->u.dst.xfrm);
-#ifdef CONFIG_XFRM_SUB_POLICY
-        kfree(xdst->origin);
-        xdst->origin = NULL;
-        kfree(xdst->partner);
-        xdst->partner = NULL;
-#endif
 }
 #endif
 
@@ -1860,8 +1850,9 @@ static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
 }
 #endif
 
-#ifdef CONFIG_XFRM_OFFLOAD
 void __net_init xfrm_dev_init(void);
+
+#ifdef CONFIG_XFRM_OFFLOAD
 int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features);
 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
                        struct xfrm_user_offload *xuo);
@@ -1887,10 +1878,6 @@ static inline void xfrm_dev_state_free(struct xfrm_state *x)
         }
 }
 #else
-static inline void __net_init xfrm_dev_init(void)
-{
-}
-
 static inline int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
 {
         return 0;
diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h
index f5f70e345318..355b81f4242d 100644
--- a/include/rdma/ib_sa.h
+++ b/include/rdma/ib_sa.h
@@ -158,7 +158,6 @@ enum sa_path_rec_type {
 };
 
 struct sa_path_rec_ib {
-        __be64       service_id;
         __be16       dlid;
         __be16       slid;
         u8           raw_traffic;
@@ -174,7 +173,6 @@ struct sa_path_rec_roce {
 };
 
 struct sa_path_rec_opa {
-        __be64       service_id;
         __be32       dlid;
         __be32       slid;
         u8           raw_traffic;
@@ -189,6 +187,7 @@ struct sa_path_rec_opa {
 struct sa_path_rec {
         union ib_gid dgid;
         union ib_gid sgid;
+        __be64       service_id;
         /* reserved */
         __be32       flow_label;
         u8           hop_limit;
@@ -262,7 +261,7 @@ static inline void path_conv_opa_to_ib(struct sa_path_rec *ib,
                 ib->ib.dlid     = htons(ntohl(opa->opa.dlid));
                 ib->ib.slid     = htons(ntohl(opa->opa.slid));
         }
-        ib->ib.service_id       = opa->opa.service_id;
+        ib->service_id          = opa->service_id;
         ib->ib.raw_traffic      = opa->opa.raw_traffic;
 }
 
@@ -281,7 +280,7 @@ static inline void path_conv_ib_to_opa(struct sa_path_rec *opa,
         }
         opa->opa.slid           = slid;
         opa->opa.dlid           = dlid;
-        opa->opa.service_id     = ib->ib.service_id;
+        opa->service_id         = ib->service_id;
         opa->opa.raw_traffic    = ib->ib.raw_traffic;
 }
 
@@ -591,15 +590,6 @@ static inline bool sa_path_is_roce(struct sa_path_rec *rec)
                 (rec->rec_type == SA_PATH_REC_TYPE_ROCE_V2));
 }
 
-static inline void sa_path_set_service_id(struct sa_path_rec *rec,
-                                          __be64 service_id)
-{
-        if (rec->rec_type == SA_PATH_REC_TYPE_IB)
-                rec->ib.service_id = service_id;
-        else if (rec->rec_type == SA_PATH_REC_TYPE_OPA)
-                rec->opa.service_id = service_id;
-}
-
 static inline void sa_path_set_slid(struct sa_path_rec *rec, __be32 slid)
 {
         if (rec->rec_type == SA_PATH_REC_TYPE_IB)
@@ -625,15 +615,6 @@ static inline void sa_path_set_raw_traffic(struct sa_path_rec *rec,
                 rec->opa.raw_traffic = raw_traffic;
 }
 
-static inline __be64 sa_path_get_service_id(struct sa_path_rec *rec)
-{
-        if (rec->rec_type == SA_PATH_REC_TYPE_IB)
-                return rec->ib.service_id;
-        else if (rec->rec_type == SA_PATH_REC_TYPE_OPA)
-                return rec->opa.service_id;
-        return 0;
-}
-
 static inline __be32 sa_path_get_slid(struct sa_path_rec *rec)
 {
         if (rec->rec_type == SA_PATH_REC_TYPE_IB)
diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h
index 585266144329..348c102cb5f6 100644
--- a/include/rdma/rdma_netlink.h
+++ b/include/rdma/rdma_netlink.h
@@ -10,9 +10,6 @@ struct ibnl_client_cbs {
         struct module *module;
 };
 
-int ibnl_init(void);
-void ibnl_cleanup(void);
-
 /**
  * Add a a client to the list of IB netlink exporters.
  * @index: Index of the added client
@@ -77,11 +74,4 @@ int ibnl_unicast(struct sk_buff *skb, struct nlmsghdr *nlh,
 int ibnl_multicast(struct sk_buff *skb, struct nlmsghdr *nlh,
                         unsigned int group, gfp_t flags);
 
-/**
- * Check if there are any listeners to the netlink group
- * @group: the netlink group ID
- * Returns 0 on success or a negative for no listeners.
- */
-int ibnl_chk_listeners(unsigned int group);
-
 #endif /* _RDMA_NETLINK_H */
diff --git a/include/sound/cs35l35.h b/include/sound/cs35l35.h
index 29da899e17e4..d69cd7847afd 100644
--- a/include/sound/cs35l35.h
+++ b/include/sound/cs35l35.h
@@ -99,6 +99,8 @@ struct cs35l35_platform_data {
         bool shared_bst;
         /* Specifies this amp is using an external boost supply */
         bool ext_bst;
+        /* Inductor Value */
+        int boost_ind;
         /* ClassH Algorithm */
         struct classh_cfg classh_algo;
         /* Monitor Config */
diff --git a/include/sound/designware_i2s.h b/include/sound/designware_i2s.h
index 5681855396c4..830f5caa915c 100644
--- a/include/sound/designware_i2s.h
+++ b/include/sound/designware_i2s.h
@@ -47,6 +47,7 @@ struct i2s_platform_data {
 
         #define DW_I2S_QUIRK_COMP_REG_OFFSET    (1 << 0)
         #define DW_I2S_QUIRK_COMP_PARAM1        (1 << 1)
+        #define DW_I2S_QUIRK_16BIT_IDX_OVERRIDE (1 << 2)
         unsigned int quirks;
         unsigned int i2s_reg_comp1;
         unsigned int i2s_reg_comp2;
diff --git a/include/sound/hdmi-codec.h b/include/sound/hdmi-codec.h
index 915c4357945c..9483c55f871b 100644
--- a/include/sound/hdmi-codec.h
+++ b/include/sound/hdmi-codec.h
@@ -18,9 +18,11 @@
 #ifndef __HDMI_CODEC_H__
 #define __HDMI_CODEC_H__
 
+#include <linux/of_graph.h>
 #include <linux/hdmi.h>
 #include <drm/drm_edid.h>
 #include <sound/asoundef.h>
+#include <sound/soc.h>
 #include <uapi/sound/asound.h>
 
 /*
@@ -87,6 +89,13 @@ struct hdmi_codec_ops {
          */
         int (*get_eld)(struct device *dev, void *data,
                        uint8_t *buf, size_t len);
+
+        /*
+         * Getting DAI ID
+         * Optional
+         */
+        int (*get_dai_id)(struct snd_soc_component *comment,
+                          struct device_node *endpoint);
 };
 
 /* HDMI codec initalization data */
diff --git a/include/sound/rt5645.h b/include/sound/rt5645.h
index a5cf6152e778..d0c33a9972b9 100644
--- a/include/sound/rt5645.h
+++ b/include/sound/rt5645.h
@@ -21,8 +21,10 @@ struct rt5645_platform_data {
         /* 0 = IN2P; 1 = GPIO6; 2 = GPIO10; 3 = GPIO12 */
 
         unsigned int jd_mode;
-        /* Invert JD when jack insert */
-        bool jd_invert;
+        /* Use level triggered irq */
+        bool level_trigger_irq;
+        /* Invert JD1_1 status polarity */
+        bool inv_jd1_1;
 };
 
 #endif
diff --git a/include/sound/simple_card_utils.h b/include/sound/simple_card_utils.h
index af58d2362975..42c6a6ac3ce6 100644
--- a/include/sound/simple_card_utils.h
+++ b/include/sound/simple_card_utils.h
@@ -22,6 +22,11 @@ struct asoc_simple_dai {
         struct clk *clk;
 };
 
+struct asoc_simple_card_data {
+        u32 convert_rate;
+        u32 convert_channels;
+};
+
 int asoc_simple_card_parse_daifmt(struct device *dev,
                                   struct device_node *node,
                                   struct device_node *codec,
@@ -35,13 +40,18 @@ int asoc_simple_card_parse_card_name(struct snd_soc_card *card,
                                      char *prefix);
 
 #define asoc_simple_card_parse_clk_cpu(dev, node, dai_link, simple_dai)         \
-        asoc_simple_card_parse_clk(dev, node, dai_link->cpu_of_node, simple_dai)
+        asoc_simple_card_parse_clk(dev, node, dai_link->cpu_of_node, simple_dai, \
+                                   dai_link->cpu_dai_name)
 #define asoc_simple_card_parse_clk_codec(dev, node, dai_link, simple_dai)       \
-        asoc_simple_card_parse_clk(dev, node, dai_link->codec_of_node, simple_dai)
+        asoc_simple_card_parse_clk(dev, node, dai_link->codec_of_node, simple_dai,\
+                                   dai_link->codec_dai_name)
 int asoc_simple_card_parse_clk(struct device *dev,
                                struct device_node *node,
                                struct device_node *dai_of_node,
-                               struct asoc_simple_dai *simple_dai);
+                               struct asoc_simple_dai *simple_dai,
+                               const char *name);
+int asoc_simple_card_clk_enable(struct asoc_simple_dai *dai);
+void asoc_simple_card_clk_disable(struct asoc_simple_dai *dai);
 
 #define asoc_simple_card_parse_cpu(node, dai_link,                              \
                                    list_name, cells_name, is_single_link)       \
@@ -60,6 +70,22 @@ int asoc_simple_card_parse_dai(struct device_node *node,
                                   const char *cells_name,
                                   int *is_single_links);
 
+#define asoc_simple_card_parse_graph_cpu(ep, dai_link)                  \
+        asoc_simple_card_parse_graph_dai(ep, &dai_link->cpu_of_node,    \
+                                         &dai_link->cpu_dai_name)
+#define asoc_simple_card_parse_graph_codec(ep, dai_link)                \
+        asoc_simple_card_parse_graph_dai(ep, &dai_link->codec_of_node,  \
+                                         &dai_link->codec_dai_name)
+int asoc_simple_card_parse_graph_dai(struct device_node *ep,
+                                     struct device_node **endpoint_np,
+                                     const char **dai_name);
+
+#define asoc_simple_card_of_parse_tdm(np, dai)                  \
+        snd_soc_of_parse_tdm_slot(np,   &(dai)->tx_slot_mask,   \
+                                        &(dai)->rx_slot_mask,   \
+                                        &(dai)->slots,          \
+                                        &(dai)->slot_width);
+
 int asoc_simple_card_init_dai(struct snd_soc_dai *dai,
                               struct asoc_simple_dai *simple_dai);
 
@@ -69,4 +95,15 @@ void asoc_simple_card_canonicalize_cpu(struct snd_soc_dai_link *dai_link,
 
 int asoc_simple_card_clean_reference(struct snd_soc_card *card);
 
+void asoc_simple_card_convert_fixup(struct asoc_simple_card_data *data,
+                                      struct snd_pcm_hw_params *params);
+void asoc_simple_card_parse_convert(struct device *dev, char *prefix,
+                                    struct asoc_simple_card_data *data);
+
+int asoc_simple_card_of_parse_routing(struct snd_soc_card *card,
+                                      char *prefix,
+                                      int optional);
+int asoc_simple_card_of_parse_widgets(struct snd_soc_card *card,
+                                      char *prefix);
+
 #endif /* __SIMPLE_CARD_UTILS_H */
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index a466f4bdc835..344b96c206a3 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -510,6 +510,13 @@ enum snd_soc_dapm_type {
         snd_soc_dapm_dai_out,
         snd_soc_dapm_dai_link,          /* link between two DAI structures */
         snd_soc_dapm_kcontrol,          /* Auto-disabled kcontrol */
+        snd_soc_dapm_buffer,            /* DSP/CODEC internal buffer */
+        snd_soc_dapm_scheduler,         /* DSP/CODEC internal scheduler */
+        snd_soc_dapm_effect,            /* DSP/CODEC effect component */
+        snd_soc_dapm_src,               /* DSP/CODEC SRC component */
+        snd_soc_dapm_asrc,              /* DSP/CODEC ASRC component */
+        snd_soc_dapm_encoder,           /* FW/SW audio encoder component */
+        snd_soc_dapm_decoder,           /* FW/SW audio decoder component */
 };
 
 enum snd_soc_dapm_subclass {
diff --git a/include/sound/soc-topology.h b/include/sound/soc-topology.h
index f9cc7b9271ac..f552c3f56368 100644
--- a/include/sound/soc-topology.h
+++ b/include/sound/soc-topology.h
@@ -28,6 +28,8 @@ struct snd_soc_component;
 struct snd_soc_tplg_pcm_fe;
 struct snd_soc_dapm_context;
 struct snd_soc_card;
+struct snd_kcontrol_new;
+struct snd_soc_dai_link;
 
 /* object scan be loaded and unloaded in groups with identfying indexes */
 #define SND_SOC_TPLG_INDEX_ALL  0       /* ID that matches all FW objects */
@@ -116,6 +118,9 @@ struct snd_soc_tplg_ops {
         int (*widget_load)(struct snd_soc_component *,
                 struct snd_soc_dapm_widget *,
                 struct snd_soc_tplg_dapm_widget *);
+        int (*widget_ready)(struct snd_soc_component *,
+                struct snd_soc_dapm_widget *,
+                struct snd_soc_tplg_dapm_widget *);
         int (*widget_unload)(struct snd_soc_component *,
                 struct snd_soc_dobj *);
 
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 5170fd81e1fd..9c94b97c17f8 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -803,6 +803,8 @@ struct snd_soc_component_driver {
         int (*of_xlate_dai_name)(struct snd_soc_component *component,
                                  struct of_phandle_args *args,
                                  const char **dai_name);
+        int (*of_xlate_dai_id)(struct snd_soc_component *comment,
+                               struct device_node *endpoint);
         void (*seq_notifier)(struct snd_soc_component *, enum snd_soc_dapm_type,
                 int subseq);
         int (*stream_event)(struct snd_soc_component *, int event);
@@ -1676,6 +1678,7 @@ unsigned int snd_soc_of_parse_daifmt(struct device_node *np,
                                      const char *prefix,
                                      struct device_node **bitclkmaster,
                                      struct device_node **framemaster);
+int snd_soc_get_dai_id(struct device_node *ep);
 int snd_soc_get_dai_name(struct of_phandle_args *args,
                          const char **dai_name);
 int snd_soc_of_get_dai_name(struct device_node *of_node,
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 275581d483dd..5f17fb770477 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -557,6 +557,7 @@ struct iscsi_conn {
 #define LOGIN_FLAGS_READ_ACTIVE         1
 #define LOGIN_FLAGS_CLOSED              2
 #define LOGIN_FLAGS_READY               4
+#define LOGIN_FLAGS_INITIAL_PDU         8
         unsigned long           login_flags;
         struct delayed_work     login_work;
         struct delayed_work     login_cleanup_work;
diff --git a/include/uapi/linux/a.out.h b/include/uapi/linux/a.out.h
index 7caf44c7fa51..295cd3ef6330 100644
--- a/include/uapi/linux/a.out.h
+++ b/include/uapi/linux/a.out.h
@@ -112,24 +112,7 @@ enum machine_type {
 #define N_TXTADDR(x) (N_MAGIC(x) == QMAGIC ? PAGE_SIZE : 0)
 #endif
 
-/* Address of data segment in memory after it is loaded.
-   Note that it is up to you to define SEGMENT_SIZE
-   on machines not listed here.  */
-#if defined(vax) || defined(hp300) || defined(pyr)
-#define SEGMENT_SIZE page_size
-#endif
-#ifdef  sony
-#define SEGMENT_SIZE    0x2000
-#endif  /* Sony.  */
-#ifdef is68k
-#define SEGMENT_SIZE 0x20000
-#endif
-#if defined(m68k) && defined(PORTAR)
-#define PAGE_SIZE 0x400
-#define SEGMENT_SIZE PAGE_SIZE
-#endif
-
-#ifdef linux
+/* Address of data segment in memory after it is loaded. */
 #ifndef __KERNEL__
 #include <unistd.h>
 #endif
@@ -142,7 +125,6 @@ enum machine_type {
 #endif
 #endif
 #endif
-#endif
 
 #define _N_SEGMENT_ROUND(x) ALIGN(x, SEGMENT_SIZE)
 
@@ -260,13 +242,7 @@ struct relocation_info
   unsigned int r_extern:1;
   /* Four bits that aren't used, but when writing an object file
      it is desirable to clear them.  */
-#ifdef NS32K
-  unsigned r_bsr:1;
-  unsigned r_disp:1;
-  unsigned r_pad:2;
-#else
   unsigned int r_pad:4;
-#endif
 };
 #endif /* no N_RELOCATION_INFO_DECLARED.  */
 
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index d179d7767f51..7d4a594d5d58 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1486,8 +1486,10 @@ enum ethtool_link_mode_bit_indices {
  * it was forced up into this mode or autonegotiated.
  */
 
-/* The forced speed, in units of 1Mb. All values 0 to INT_MAX are legal. */
-/* Update drivers/net/phy/phy.c:phy_speed_to_str() when adding new values */
+/* The forced speed, in units of 1Mb. All values 0 to INT_MAX are legal.
+ * Update drivers/net/phy/phy.c:phy_speed_to_str() and
+ * drivers/net/bonding/bond_3ad.c:__get_link_speed() when adding new values.
+ */
 #define SPEED_10                10
 #define SPEED_100               100
 #define SPEED_1000              1000
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 201c6644b237..ef16df06642a 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -70,8 +70,8 @@ struct keyctl_dh_params {
 };
 
 struct keyctl_kdf_params {
-        char *hashname;
-        char *otherinfo;
+        char __user *hashname;
+        char __user *otherinfo;
         __u32 otherinfolen;
         __u32 __spare[8];
 };
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 61b7d36dfe34..156ee4cab82e 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -343,6 +343,7 @@ enum ovs_key_attr {
 #define OVS_KEY_ATTR_MAX (__OVS_KEY_ATTR_MAX - 1)
 
 enum ovs_tunnel_key_attr {
+        /* OVS_TUNNEL_KEY_ATTR_NONE, standard nl API requires this attribute! */
         OVS_TUNNEL_KEY_ATTR_ID,                 /* be64 Tunnel ID */
         OVS_TUNNEL_KEY_ATTR_IPV4_SRC,           /* be32 src IP address. */
         OVS_TUNNEL_KEY_ATTR_IPV4_DST,           /* be32 dst IP address. */
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index 6702533c8bd8..78014ec56357 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -73,7 +73,15 @@
 #define SND_SOC_TPLG_DAPM_DAI_IN        13
 #define SND_SOC_TPLG_DAPM_DAI_OUT       14
 #define SND_SOC_TPLG_DAPM_DAI_LINK      15
-#define SND_SOC_TPLG_DAPM_LAST          SND_SOC_TPLG_DAPM_DAI_LINK
+#define SND_SOC_TPLG_DAPM_BUFFER        16
+#define SND_SOC_TPLG_DAPM_SCHEDULER     17
+#define SND_SOC_TPLG_DAPM_EFFECT        18
+#define SND_SOC_TPLG_DAPM_SIGGEN        19
+#define SND_SOC_TPLG_DAPM_SRC           20
+#define SND_SOC_TPLG_DAPM_ASRC          21
+#define SND_SOC_TPLG_DAPM_ENCODER       22
+#define SND_SOC_TPLG_DAPM_DECODER       23
+#define SND_SOC_TPLG_DAPM_LAST          SND_SOC_TPLG_DAPM_DECODER
 
 /* Header magic number and string sizes */
 #define SND_SOC_TPLG_MAGIC              0x41536F43 /* ASoC */
diff --git a/include/uapi/sound/snd_sst_tokens.h b/include/uapi/sound/snd_sst_tokens.h
index 93392bedcc58..dedb2056160d 100644
--- a/include/uapi/sound/snd_sst_tokens.h
+++ b/include/uapi/sound/snd_sst_tokens.h
@@ -161,6 +161,8 @@
  *
  * %SKL_TKL_U32_D0I3_CAPS:      Specifies the D0i3 capability for module
  *
+ * %SKL_TKN_U32_DMA_BUF_SIZE:   DMA buffer size in millisec
+ *
  * module_id and loadable flags dont have tokens as these values will be
  * read from the DSP FW manifest
  */
@@ -213,8 +215,10 @@ enum SKL_TKNS {
         SKL_TKN_U32_LIB_COUNT,
         SKL_TKN_STR_LIB_NAME,
         SKL_TKN_U32_PMODE,
-        SKL_TKL_U32_D0I3_CAPS,
-        SKL_TKN_MAX = SKL_TKL_U32_D0I3_CAPS,
+        SKL_TKL_U32_D0I3_CAPS, /* Typo added at v4.10 */
+        SKL_TKN_U32_D0I3_CAPS = SKL_TKL_U32_D0I3_CAPS,
+        SKL_TKN_U32_DMA_BUF_SIZE,
+        SKL_TKN_MAX = SKL_TKN_U32_DMA_BUF_SIZE,
 };
 
 #endif
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 5e00b2333c26..172dc8ee0e3b 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -86,6 +86,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         array->map.key_size = attr->key_size;
         array->map.value_size = attr->value_size;
         array->map.max_entries = attr->max_entries;
+        array->map.map_flags = attr->map_flags;
         array->elem_size = elem_size;
 
         if (!percpu)
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 39cfafd895b8..b09185f0f17d 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -432,6 +432,7 @@ static struct bpf_map *trie_alloc(union bpf_attr *attr)
         trie->map.key_size = attr->key_size;
         trie->map.value_size = attr->value_size;
         trie->map.max_entries = attr->max_entries;
+        trie->map.map_flags = attr->map_flags;
         trie->data_size = attr->key_size -
                           offsetof(struct bpf_lpm_trie_key, data);
         trie->max_prefixlen = trie->data_size * 8;
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 4dfd6f2ec2f9..31147d730abf 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -88,6 +88,7 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
         smap->map.key_size = attr->key_size;
         smap->map.value_size = value_size;
         smap->map.max_entries = attr->max_entries;
+        smap->map.map_flags = attr->map_flags;
         smap->n_buckets = n_buckets;
         smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT;
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1eddb713b815..a8a725697bed 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -463,19 +463,22 @@ static const int caller_saved[CALLER_SAVED_REGS] = {
         BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5
 };
 
+static void mark_reg_not_init(struct bpf_reg_state *regs, u32 regno)
+{
+        BUG_ON(regno >= MAX_BPF_REG);
+
+        memset(&regs[regno], 0, sizeof(regs[regno]));
+        regs[regno].type = NOT_INIT;
+        regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
+        regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+}
+
 static void init_reg_state(struct bpf_reg_state *regs)
 {
         int i;
 
-        for (i = 0; i < MAX_BPF_REG; i++) {
-                regs[i].type = NOT_INIT;
-                regs[i].imm = 0;
-                regs[i].min_value = BPF_REGISTER_MIN_RANGE;
-                regs[i].max_value = BPF_REGISTER_MAX_RANGE;
-                regs[i].min_align = 0;
-                regs[i].aux_off = 0;
-                regs[i].aux_off_align = 0;
-        }
+        for (i = 0; i < MAX_BPF_REG; i++)
+                mark_reg_not_init(regs, i);
 
         /* frame pointer */
         regs[BPF_REG_FP].type = FRAME_PTR;
@@ -808,11 +811,15 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
                 reg_off += reg->aux_off;
         }
 
-        /* skb->data is NET_IP_ALIGN-ed, but for strict alignment checking
-         * we force this to 2 which is universally what architectures use
-         * when they don't set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS.
+        /* For platforms that do not have a Kconfig enabling
+         * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS the value of
+         * NET_IP_ALIGN is universally set to '2'.  And on platforms
+         * that do set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, we get
+         * to this code only in strict mode where we want to emulate
+         * the NET_IP_ALIGN==2 checking.  Therefore use an
+         * unconditional IP align value of '2'.
          */
-        ip_align = strict ? 2 : NET_IP_ALIGN;
+        ip_align = 2;
         if ((ip_align + reg_off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
                         ip_align, reg_off, off, size);
@@ -839,9 +846,6 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
 {
         bool strict = env->strict_alignment;
 
-        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
-                strict = true;
-
         switch (reg->type) {
         case PTR_TO_PACKET:
                 return check_pkt_ptr_alignment(reg, off, size, strict);
@@ -985,6 +989,11 @@ static int check_xadd(struct bpf_verifier_env *env, struct bpf_insn *insn)
         if (err)
                 return err;
 
+        if (is_pointer_value(env, insn->src_reg)) {
+                verbose("R%d leaks addr into mem\n", insn->src_reg);
+                return -EACCES;
+        }
+
         /* check whether atomic_add can read the memory */
         err = check_mem_access(env, insn->dst_reg, insn->off,
                                BPF_SIZE(insn->code), BPF_READ, -1);
@@ -1345,7 +1354,6 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         struct bpf_verifier_state *state = &env->cur_state;
         const struct bpf_func_proto *fn = NULL;
         struct bpf_reg_state *regs = state->regs;
-        struct bpf_reg_state *reg;
         struct bpf_call_arg_meta meta;
         bool changes_data;
         int i, err;
@@ -1412,11 +1420,8 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         }
 
         /* reset caller saved regs */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* update return register */
         if (fn->ret_type == RET_INTEGER) {
@@ -2444,7 +2449,6 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
 {
         struct bpf_reg_state *regs = env->cur_state.regs;
         u8 mode = BPF_MODE(insn->code);
-        struct bpf_reg_state *reg;
         int i, err;
 
         if (!may_access_skb(env->prog->type)) {
@@ -2477,11 +2481,8 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
         }
 
         /* reset caller saved regs to unreadable */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* mark destination R0 register as readable, since it contains
          * the value fetched from the packet
@@ -2692,7 +2693,8 @@ err_free:
 /* the following conditions reduce the number of explored insns
  * from ~140k to ~80k for ultra large programs that use a lot of ptr_to_packet
  */
-static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
+static bool compare_ptrs_to_packet(struct bpf_verifier_env *env,
+                                   struct bpf_reg_state *old,
                                    struct bpf_reg_state *cur)
 {
         if (old->id != cur->id)
@@ -2735,7 +2737,7 @@ static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
          * 'if (R4 > data_end)' and all further insn were already good with r=20,
          * so they will be good with r=30 and we can prune the search.
          */
-        if (old->off <= cur->off &&
+        if (!env->strict_alignment && old->off <= cur->off &&
             old->off >= old->range && cur->off >= cur->range)
                 return true;
 
@@ -2806,7 +2808,7 @@ static bool states_equal(struct bpf_verifier_env *env,
                         continue;
 
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
-                    compare_ptrs_to_packet(rold, rcur))
+                    compare_ptrs_to_packet(env, rold, rcur))
                         continue;
 
                 return false;
@@ -3584,10 +3586,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
         } else {
                 log_level = 0;
         }
-        if (attr->prog_flags & BPF_F_STRICT_ALIGNMENT)
+
+        env->strict_alignment = !!(attr->prog_flags & BPF_F_STRICT_ALIGNMENT);
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
                 env->strict_alignment = true;
-        else
-                env->strict_alignment = false;
 
         ret = replace_map_fd_with_map_ptr(env);
         if (ret < 0)
@@ -3693,7 +3695,10 @@ int bpf_analyzer(struct bpf_prog *prog, const struct bpf_ext_analyzer_ops *ops,
         mutex_lock(&bpf_verifier_lock);
 
         log_level = 0;
+
         env->strict_alignment = false;
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+                env->strict_alignment = true;
 
         env->explored_states = kcalloc(env->prog->len,
                                        sizeof(struct bpf_verifier_state_list *),
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c3c9a0e1b3c9..8d4e85eae42c 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4265,6 +4265,11 @@ static void kill_css(struct cgroup_subsys_state *css)
 {
         lockdep_assert_held(&cgroup_mutex);
 
+        if (css->flags & CSS_DYING)
+                return;
+
+        css->flags |= CSS_DYING;
+
         /*
          * This must happen before css is disassociated with its cgroup.
          * See seq_css() for details.
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index f6501f4f6040..ae643412948a 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -176,9 +176,9 @@ typedef enum {
 } cpuset_flagbits_t;
 
 /* convenient tests for these bits */
-static inline bool is_cpuset_online(const struct cpuset *cs)
+static inline bool is_cpuset_online(struct cpuset *cs)
 {
-        return test_bit(CS_ONLINE, &cs->flags);
+        return test_bit(CS_ONLINE, &cs->flags) && !css_is_dying(&cs->css);
 }
 
 static inline int is_cpu_exclusive(const struct cpuset *cs)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 9ae6fbe5b5cf..cb5103413bd8 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1658,13 +1658,13 @@ static ssize_t write_cpuhp_target(struct device *dev,
         ret = !sp->name || sp->cant_stop ? -EINVAL : 0;
         mutex_unlock(&cpuhp_state_mutex);
         if (ret)
-                return ret;
+                goto out;
 
         if (st->state < target)
                 ret = do_cpu_up(dev->id, target);
         else
                 ret = do_cpu_down(dev->id, target);
-
+out:
         unlock_device_hotplug();
         return ret ? ret : count;
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6e75a5c9412d..6c4e523dc1e2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7316,6 +7316,21 @@ int perf_event_account_interrupt(struct perf_event *event)
         return __perf_event_account_interrupt(event, 1);
 }
 
+static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
+{
+        /*
+         * Due to interrupt latency (AKA "skid"), we may enter the
+         * kernel before taking an overflow, even if the PMU is only
+         * counting user events.
+         * To avoid leaking information to userspace, we must always
+         * reject kernel samples when exclude_kernel is set.
+         */
+        if (event->attr.exclude_kernel && !user_mode(regs))
+                return false;
+
+        return true;
+}
+
 /*
  * Generic event overflow handling, sampling.
  */
@@ -7337,6 +7352,12 @@ static int __perf_event_overflow(struct perf_event *event,
         ret = __perf_event_account_interrupt(event, throttle);
 
         /*
+         * For security, drop the skid kernel samples if necessary.
+         */
+        if (!sample_is_allowed(event, regs))
+                return ret;
+
+        /*
          * XXX event_limit might not quite work as expected on inherited
          * events
          */
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 2831480c63a2..ee97196bb151 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -580,7 +580,7 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
         int ret = -ENOMEM, max_order = 0;
 
         if (!has_aux(event))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (event->pmu->capabilities & PERF_PMU_CAP_AUX_NO_SG) {
                 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index aa1076c5e4a9..e53770d2bf95 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process(
         if (!p)
                 goto fork_out;
 
+        /*
+         * This _must_ happen before we call free_task(), i.e. before we jump
+         * to any of the bad_fork_* labels. This is to avoid freeing
+         * p->set_child_tid which is (ab)used as a kthread's data pointer for
+         * kernel threads (PF_KTHREAD).
+         */
+        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+        /*
+         * Clear TID on mm_release()?
+         */
+        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
+
         ftrace_graph_init_task(p);
 
         rt_mutex_init_task(p);
@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process(
                 }
         }
 
-        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
-        /*
-         * Clear TID on mm_release()?
-         */
-        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 #ifdef CONFIG_BLOCK
         p->plug = NULL;
 #endif
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 070be980c37a..425170d4439b 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1312,8 +1312,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                         ret = __irq_set_trigger(desc,
                                                 new->flags & IRQF_TRIGGER_MASK);
 
-                        if (ret)
+                        if (ret) {
+                                irq_release_resources(desc);
                                 goto out_mask;
+                        }
                 }
 
                 desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 2d2d3a568e4e..adfe3b4cfe05 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -122,7 +122,7 @@ static void *alloc_insn_page(void)
         return module_alloc(PAGE_SIZE);
 }
 
-static void free_insn_page(void *page)
+void __weak free_insn_page(void *page)
 {
         module_memfree(page);
 }
diff --git a/kernel/livepatch/Kconfig b/kernel/livepatch/Kconfig
index 045022557936..ec4565122e65 100644
--- a/kernel/livepatch/Kconfig
+++ b/kernel/livepatch/Kconfig
@@ -10,6 +10,7 @@ config LIVEPATCH
         depends on SYSFS
         depends on KALLSYMS_ALL
         depends on HAVE_LIVEPATCH
+        depends on !TRIM_UNUSED_KSYMS
         help
           Say Y here if you want to support kernel live patching.
           This option has no runtime impact until a kernel "patch"
diff --git a/kernel/livepatch/patch.c b/kernel/livepatch/patch.c
index f8269036bf0b..52c4e907c14b 100644
--- a/kernel/livepatch/patch.c
+++ b/kernel/livepatch/patch.c
@@ -59,7 +59,11 @@ static void notrace klp_ftrace_handler(unsigned long ip,
 
         ops = container_of(fops, struct klp_ops, fops);
 
-        rcu_read_lock();
+        /*
+         * A variant of synchronize_sched() is used to allow patching functions
+         * where RCU is not watching, see klp_synchronize_transition().
+         */
+        preempt_disable_notrace();
 
         func = list_first_or_null_rcu(&ops->func_stack, struct klp_func,
                                       stack_node);
@@ -115,7 +119,7 @@ static void notrace klp_ftrace_handler(unsigned long ip,
 
         klp_arch_set_pc(regs, (unsigned long)func->new_func);
 unlock:
-        rcu_read_unlock();
+        preempt_enable_notrace();
 }
 
 /*
diff --git a/kernel/livepatch/transition.c b/kernel/livepatch/transition.c
index adc0cc64aa4b..b004a1fb6032 100644
--- a/kernel/livepatch/transition.c
+++ b/kernel/livepatch/transition.c
@@ -49,6 +49,28 @@ static void klp_transition_work_fn(struct work_struct *work)
 static DECLARE_DELAYED_WORK(klp_transition_work, klp_transition_work_fn);
 
 /*
+ * This function is just a stub to implement a hard force
+ * of synchronize_sched(). This requires synchronizing
+ * tasks even in userspace and idle.
+ */
+static void klp_sync(struct work_struct *work)
+{
+}
+
+/*
+ * We allow to patch also functions where RCU is not watching,
+ * e.g. before user_exit(). We can not rely on the RCU infrastructure
+ * to do the synchronization. Instead hard force the sched synchronization.
+ *
+ * This approach allows to use RCU functions for manipulating func_stack
+ * safely.
+ */
+static void klp_synchronize_transition(void)
+{
+        schedule_on_each_cpu(klp_sync);
+}
+
+/*
  * The transition to the target patch state is complete.  Clean up the data
  * structures.
  */
@@ -73,7 +95,7 @@ static void klp_complete_transition(void)
                  * func->transition gets cleared, the handler may choose a
                  * removed function.
                  */
-                synchronize_rcu();
+                klp_synchronize_transition();
         }
 
         if (klp_transition_patch->immediate)
@@ -92,7 +114,7 @@ static void klp_complete_transition(void)
 
         /* Prevent klp_ftrace_handler() from seeing KLP_UNDEFINED state */
         if (klp_target_state == KLP_PATCHED)
-                synchronize_rcu();
+                klp_synchronize_transition();
 
         read_lock(&tasklist_lock);
         for_each_process_thread(g, task) {
@@ -136,7 +158,11 @@ void klp_cancel_transition(void)
  */
 void klp_update_patch_state(struct task_struct *task)
 {
-        rcu_read_lock();
+        /*
+         * A variant of synchronize_sched() is used to allow patching functions
+         * where RCU is not watching, see klp_synchronize_transition().
+         */
+        preempt_disable_notrace();
 
         /*
          * This test_and_clear_tsk_thread_flag() call also serves as a read
@@ -153,7 +179,7 @@ void klp_update_patch_state(struct task_struct *task)
         if (test_and_clear_tsk_thread_flag(task, TIF_PATCH_PENDING))
                 task->patch_state = READ_ONCE(klp_target_state);
 
-        rcu_read_unlock();
+        preempt_enable_notrace();
 }
 
 /*
@@ -539,7 +565,7 @@ void klp_reverse_transition(void)
                 clear_tsk_thread_flag(idle_task(cpu), TIF_PATCH_PENDING);
 
         /* Let any remaining calls to klp_update_patch_state() complete */
-        synchronize_rcu();
+        klp_synchronize_transition();
 
         klp_start_transition();
 }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index b95509416909..28cd09e635ed 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1785,12 +1785,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
         int ret;
 
         raw_spin_lock_irq(&lock->wait_lock);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-
         /* sleep on the mutex */
+        set_current_state(TASK_INTERRUPTIBLE);
         ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
-
+        /*
+         * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+         * have to fix that up.
+         */
+        fixup_rt_mutex_waiters(lock);
         raw_spin_unlock_irq(&lock->wait_lock);
 
         return ret;
@@ -1822,15 +1824,25 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock_irq(&lock->wait_lock);
         /*
+         * Do an unconditional try-lock, this deals with the lock stealing
+         * state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter()
+         * sets a NULL owner.
+         *
+         * We're not interested in the return value, because the subsequent
+         * test on rt_mutex_owner() will infer that. If the trylock succeeded,
+         * we will own the lock and it will have removed the waiter. If we
+         * failed the trylock, we're still not owner and we need to remove
+         * ourselves.
+         */
+        try_to_take_rt_mutex(lock, current, waiter);
+        /*
          * Unless we're the owner; we're still enqueued on the wait_list.
          * So check if we became owner, if not, take us off the wait_list.
          */
         if (rt_mutex_owner(lock) != current) {
                 remove_waiter(lock, waiter);
-                fixup_rt_mutex_waiters(lock);
                 cleanup = true;
         }
-
         /*
          * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
          * have to fix that up.
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 78672d324a6e..c7209f060eeb 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -132,7 +132,7 @@ int freeze_processes(void)
         if (!pm_freezing)
                 atomic_inc(&system_freezing_cnt);
 
-        pm_wakeup_clear(true);
+        pm_wakeup_clear();
         pr_info("Freezing user space processes ... ");
         pm_freezing = true;
         error = try_to_freeze_tasks(true);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 3b1e0f3ad07f..fa46606f3356 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1425,7 +1425,7 @@ static unsigned int nr_meta_pages;
  * Numbers of normal and highmem page frames allocated for hibernation image
  * before suspending devices.
  */
-unsigned int alloc_normal, alloc_highmem;
+static unsigned int alloc_normal, alloc_highmem;
 /*
  * Memory bitmap used for marking saveable pages (during hibernation) or
  * hibernation image pages (during restore)
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c0248c74d6d4..15e6baef5c73 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -72,8 +72,6 @@ static void freeze_begin(void)
 
 static void freeze_enter(void)
 {
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, true);
-
         spin_lock_irq(&suspend_freeze_lock);
         if (pm_wakeup_pending())
                 goto out;
@@ -100,27 +98,6 @@ static void freeze_enter(void)
  out:
         suspend_freeze_state = FREEZE_STATE_NONE;
         spin_unlock_irq(&suspend_freeze_lock);
-
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, false);
-}
-
-static void s2idle_loop(void)
-{
-        do {
-                freeze_enter();
-
-                if (freeze_ops && freeze_ops->wake)
-                        freeze_ops->wake();
-
-                dpm_resume_noirq(PMSG_RESUME);
-                if (freeze_ops && freeze_ops->sync)
-                        freeze_ops->sync();
-
-                if (pm_wakeup_pending())
-                        break;
-
-                pm_wakeup_clear(false);
-        } while (!dpm_suspend_noirq(PMSG_SUSPEND));
 }
 
 void freeze_wake(void)
@@ -394,8 +371,10 @@ static int suspend_enter(suspend_state_t state, bool *wakeup)
          * all the devices are suspended.
          */
         if (state == PM_SUSPEND_FREEZE) {
-                s2idle_loop();
-                goto Platform_early_resume;
+                trace_suspend_resume(TPS("machine_suspend"), state, true);
+                freeze_enter();
+                trace_suspend_resume(TPS("machine_suspend"), state, false);
+                goto Platform_wake;
         }
 
         error = disable_nonboot_cpus();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a1aecf44ab07..a1db38abac5b 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -269,7 +269,6 @@ static struct console *exclusive_console;
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
-static int console_cmdline_cnt;
 
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -1906,25 +1905,12 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0, c = console_cmdline; i < console_cmdline_cnt; i++, c++) {
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (strcmp(c->name, name) == 0 && c->index == idx) {
-                        if (brl_options)
-                                return 0;
-
-                        /*
-                         * Maintain an invariant that will help to find if
-                         * the matching console is preferred, see
-                         * register_console():
-                         *
-                         * The last non-braille console is always
-                         * the preferred one.
-                         */
-                        if (i != console_cmdline_cnt - 1)
-                                swap(console_cmdline[i],
-                                     console_cmdline[console_cmdline_cnt - 1]);
-
-                        preferred_console = console_cmdline_cnt - 1;
-
+                        if (!brl_options)
+                                preferred_console = i;
                         return 0;
                 }
         }
@@ -1937,7 +1923,6 @@ static int __add_preferred_console(char *name, int idx, char *options,
         braille_set_options(c, brl_options);
 
         c->index = idx;
-        console_cmdline_cnt++;
         return 0;
 }
 /*
@@ -2477,23 +2462,12 @@ void register_console(struct console *newcon)
         }
 
         /*
-         * See if this console matches one we selected on the command line.
-         *
-         * There may be several entries in the console_cmdline array matching
-         * with the same console, one with newcon->match(), another by
-         * name/index:
-         *
-         *      pl011,mmio,0x87e024000000,115200 -- added from SPCR
-         *      ttyAMA0 -- added from command line
-         *
-         * Traverse the console_cmdline array in reverse order to be
-         * sure that if this console is preferred then it will be the first
-         * matching entry.  We use the invariant that is maintained in
-         * __add_preferred_console().
+         *      See if this console matches one we selected on
+         *      the command line.
          */
-        for (i = console_cmdline_cnt - 1; i >= 0; i--) {
-                c = console_cmdline + i;
-
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (!newcon->match ||
                     newcon->match(newcon, c->name, c->index, c->options) != 0) {
                         /* default matching */
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 266ddcc1d8bb..60f356d91060 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -60,19 +60,25 @@ int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
 }
 
 
+void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
+                   const struct cred *ptracer_cred)
+{
+        BUG_ON(!list_empty(&child->ptrace_entry));
+        list_add(&child->ptrace_entry, &new_parent->ptraced);
+        child->parent = new_parent;
+        child->ptracer_cred = get_cred(ptracer_cred);
+}
+
 /*
  * ptrace a task: make the debugger its new parent and
  * move it to the ptrace list.
  *
  * Must be called with the tasklist lock write-held.
  */
-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
+static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
 {
-        BUG_ON(!list_empty(&child->ptrace_entry));
-        list_add(&child->ptrace_entry, &new_parent->ptraced);
-        child->parent = new_parent;
         rcu_read_lock();
-        child->ptracer_cred = get_cred(__task_cred(new_parent));
+        __ptrace_link(child, new_parent, __task_cred(new_parent));
         rcu_read_unlock();
 }
 
@@ -386,7 +392,7 @@ static int ptrace_attach(struct task_struct *task, long request,
                 flags |= PT_SEIZED;
         task->ptrace = flags;
 
-        __ptrace_link(task, current);
+        ptrace_link(task, current);
 
         /* SEIZE doesn't trap tracee on attach */
         if (!seize)
@@ -459,7 +465,7 @@ static int ptrace_traceme(void)
                  */
                 if (!ret && !(current->real_parent->flags & PF_EXITING)) {
                         current->ptrace = PT_PTRACED;
-                        __ptrace_link(current, current->real_parent);
+                        ptrace_link(current, current->real_parent);
                 }
         }
         write_unlock_irq(&tasklist_lock);
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index 584d8a983883..dea03614263f 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -263,7 +263,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -271,7 +271,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->completed) & 0x1;
-        __this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
+        this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -281,7 +281,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 36e1f82faed1..32798eb14853 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -97,8 +97,9 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
- * Returns an index that must be passed to the matching srcu_read_unlock().
+ * srcu_struct.  Can be invoked from irq/bh handlers, but the matching
+ * __srcu_read_unlock() must be in the same handler instance.  Returns an
+ * index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
 {
@@ -112,7 +113,7 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 
 /*
  * Removes the count for the old reader from the appropriate element of
- * the srcu_struct.  Must be called from process context.
+ * the srcu_struct.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 3ae8474557df..157654fa436a 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -357,7 +357,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -365,7 +365,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->srcu_idx) & 0x1;
-        __this_cpu_inc(sp->sda->srcu_lock_count[idx]);
+        this_cpu_inc(sp->sda->srcu_lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -375,7 +375,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 803c3bc274c4..326d4f88e2b1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5605,7 +5605,7 @@ void idle_task_exit(void)
         BUG_ON(cpu_online(smp_processor_id()));
 
         if (mm != &init_mm) {
-                switch_mm_irqs_off(mm, &init_mm, current);
+                switch_mm(mm, &init_mm, current);
                 finish_arch_post_lock_switch();
         }
         mmdrop(mm);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 76877a62b5fa..076a2e31951c 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -101,9 +101,6 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
         if (sg_policy->next_freq == next_freq)
                 return;
 
-        if (sg_policy->next_freq > next_freq)
-                next_freq = (sg_policy->next_freq + next_freq) >> 1;
-
         sg_policy->next_freq = next_freq;
         sg_policy->last_freq_update_time = time;
 
@@ -245,11 +242,10 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         sugov_update_commit(sg_policy, time, next_f);
 }
 
-static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
+static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
 {
         struct sugov_policy *sg_policy = sg_cpu->sg_policy;
         struct cpufreq_policy *policy = sg_policy->policy;
-        u64 last_freq_update_time = sg_policy->last_freq_update_time;
         unsigned long util = 0, max = 1;
         unsigned int j;
 
@@ -265,7 +261,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
                  * enough, don't take the CPU into account as it probably is
                  * idle now (and clear iowait_boost for it).
                  */
-                delta_ns = last_freq_update_time - j_sg_cpu->last_update;
+                delta_ns = time - j_sg_cpu->last_update;
                 if (delta_ns > TICK_NSEC) {
                         j_sg_cpu->iowait_boost = 0;
                         continue;
@@ -309,7 +305,7 @@ static void sugov_update_shared(struct update_util_data *hook, u64 time,
                 if (flags & SCHED_CPUFREQ_RT_DL)
                         next_f = sg_policy->policy->cpuinfo.max_freq;
                 else
-                        next_f = sugov_next_freq_shared(sg_cpu);
+                        next_f = sugov_next_freq_shared(sg_cpu, time);
 
                 sugov_update_commit(sg_policy, time, next_f);
         }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d71109321841..c77e4b1d51c0 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3563,7 +3563,7 @@ static inline void check_schedstat_required(void)
                         trace_sched_stat_runtime_enabled())  {
                 printk_deferred_once("Scheduler tracepoints stat_sleep, stat_iowait, "
                              "stat_blocked and stat_runtime require the "
-                             "kernel parameter schedstats=enabled or "
+                             "kernel parameter schedstats=enable or "
                              "kernel.sched_schedstats=1\n");
         }
 #endif
diff --git a/kernel/signal.c b/kernel/signal.c
index ca92bcfeb322..45b4c1ffe14e 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -510,7 +510,8 @@ int unhandled_signal(struct task_struct *tsk, int sig)
         return !tsk->ptrace;
 }
 
-static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
+static void collect_signal(int sig, struct sigpending *list, siginfo_t *info,
+                           bool *resched_timer)
 {
         struct sigqueue *q, *first = NULL;
 
@@ -532,6 +533,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
 still_pending:
                 list_del_init(&first->list);
                 copy_siginfo(info, &first->info);
+
+                *resched_timer =
+                        (first->flags & SIGQUEUE_PREALLOC) &&
+                        (info->si_code == SI_TIMER) &&
+                        (info->si_sys_private);
+
                 __sigqueue_free(first);
         } else {
                 /*
@@ -548,12 +555,12 @@ still_pending:
 }
 
 static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
-                        siginfo_t *info)
+                        siginfo_t *info, bool *resched_timer)
 {
         int sig = next_signal(pending, mask);
 
         if (sig)
-                collect_signal(sig, pending, info);
+                collect_signal(sig, pending, info, resched_timer);
         return sig;
 }
 
@@ -565,15 +572,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
  */
 int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
 {
+        bool resched_timer = false;
         int signr;
 
         /* We only dequeue private signals from ourselves, we don't let
          * signalfd steal them
          */
-        signr = __dequeue_signal(&tsk->pending, mask, info);
+        signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer);
         if (!signr) {
                 signr = __dequeue_signal(&tsk->signal->shared_pending,
-                                         mask, info);
+                                         mask, info, &resched_timer);
 #ifdef CONFIG_POSIX_TIMERS
                 /*
                  * itimer signal ?
@@ -621,7 +629,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                 current->jobctl |= JOBCTL_STOP_DEQUEUED;
         }
 #ifdef CONFIG_POSIX_TIMERS
-        if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) {
+        if (resched_timer) {
                 /*
                  * Release the siglock to ensure proper locking order
                  * of timer locks outside of siglocks.  Note, we leave
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 5cb5b0008d97..ee2f4202d82a 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -387,7 +387,7 @@ void alarm_start_relative(struct alarm *alarm, ktime_t start)
 {
         struct alarm_base *base = &alarm_bases[alarm->type];
 
-        start = ktime_add(start, base->gettime());
+        start = ktime_add_safe(start, base->gettime());
         alarm_start(alarm, start);
 }
 EXPORT_SYMBOL_GPL(alarm_start_relative);
@@ -475,7 +475,7 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval)
                 overrun++;
         }
 
-        alarm->node.expires = ktime_add(alarm->node.expires, interval);
+        alarm->node.expires = ktime_add_safe(alarm->node.expires, interval);
         return overrun;
 }
 EXPORT_SYMBOL_GPL(alarm_forward);
@@ -660,13 +660,21 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
 
         /* start the timer */
         timr->it.alarm.interval = timespec64_to_ktime(new_setting->it_interval);
+
+        /*
+         * Rate limit to the tick as a hot fix to prevent DOS. Will be
+         * mopped up later.
+         */
+        if (timr->it.alarm.interval < TICK_NSEC)
+                timr->it.alarm.interval = TICK_NSEC;
+
         exp = timespec64_to_ktime(new_setting->it_value);
         /* Convert (if necessary) to absolute time */
         if (flags != TIMER_ABSTIME) {
                 ktime_t now;
 
                 now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
-                exp = ktime_add(now, exp);
+                exp = ktime_add_safe(now, exp);
         }
 
         alarm_start(&timr->it.alarm.alarmtimer, exp);
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 1370f067fb51..d2a1e6dd0291 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -825,8 +825,10 @@ static void check_thread_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -838,8 +840,10 @@ static void check_thread_timers(struct task_struct *tsk,
                                 soft += USEC_PER_SEC;
                                 sig->rlim[RLIMIT_RTTIME].rlim_cur = soft;
                         }
-                        pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                 }
         }
@@ -936,8 +940,10 @@ static void check_process_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -945,8 +951,10 @@ static void check_process_timers(struct task_struct *tsk,
                         /*
                          * At the soft limit, send a SIGXCPU every second.
                          */
-                        pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                         if (soft < hard) {
                                 soft++;
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 987e496bb51a..b398c2ea69b2 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -37,9 +37,11 @@ static int tick_broadcast_forced;
 static __cacheline_aligned_in_smp DEFINE_RAW_SPINLOCK(tick_broadcast_lock);
 
 #ifdef CONFIG_TICK_ONESHOT
+static void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 static void tick_broadcast_clear_oneshot(int cpu);
 static void tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 #else
+static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc) { BUG(); }
 static inline void tick_broadcast_clear_oneshot(int cpu) { }
 static inline void tick_resume_broadcast_oneshot(struct clock_event_device *bc) { }
 #endif
@@ -867,7 +869,7 @@ static void tick_broadcast_init_next_event(struct cpumask *mask,
 /**
  * tick_broadcast_setup_oneshot - setup the broadcast device
  */
-void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+static void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
         int cpu = smp_processor_id();
 
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index f738251000fe..be0ac01f2e12 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -126,7 +126,6 @@ static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
 
 /* Functions related to oneshot broadcasting */
 #if defined(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST) && defined(CONFIG_TICK_ONESHOT)
-extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int cpu);
 extern int tick_broadcast_oneshot_active(void);
@@ -134,7 +133,6 @@ extern void tick_check_oneshot_broadcast_this_cpu(void);
 bool tick_broadcast_oneshot_available(void);
 extern struct cpumask *tick_get_broadcast_oneshot_mask(void);
 #else /* !(BROADCAST && ONESHOT): */
-static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc) { BUG(); }
 static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int cpu) { }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 9652bc57fd09..b602c48cb841 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -118,6 +118,26 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
         tk->offs_boot = ktime_add(tk->offs_boot, delta);
 }
 
+/*
+ * tk_clock_read - atomic clocksource read() helper
+ *
+ * This helper is necessary to use in the read paths because, while the
+ * seqlock ensures we don't return a bad value while structures are updated,
+ * it doesn't protect from potential crashes. There is the possibility that
+ * the tkr's clocksource may change between the read reference, and the
+ * clock reference passed to the read function.  This can cause crashes if
+ * the wrong clocksource is passed to the wrong read function.
+ * This isn't necessary to use when holding the timekeeper_lock or doing
+ * a read of the fast-timekeeper tkrs (which is protected by its own locking
+ * and update logic).
+ */
+static inline u64 tk_clock_read(struct tk_read_base *tkr)
+{
+        struct clocksource *clock = READ_ONCE(tkr->clock);
+
+        return clock->read(clock);
+}
+
 #ifdef CONFIG_DEBUG_TIMEKEEPING
 #define WARNING_FREQ (HZ*300) /* 5 minute rate-limiting */
 
@@ -175,7 +195,7 @@ static inline u64 timekeeping_get_delta(struct tk_read_base *tkr)
          */
         do {
                 seq = read_seqcount_begin(&tk_core.seq);
-                now = tkr->read(tkr->clock);
+                now = tk_clock_read(tkr);
                 last = tkr->cycle_last;
                 mask = tkr->mask;
                 max = tkr->clock->max_cycles;
@@ -209,7 +229,7 @@ static inline u64 timekeeping_get_delta(struct tk_read_base *tkr)
         u64 cycle_now, delta;
 
         /* read clocksource */
-        cycle_now = tkr->read(tkr->clock);
+        cycle_now = tk_clock_read(tkr);
 
         /* calculate the delta since the last update_wall_time */
         delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask);
@@ -238,12 +258,10 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock)
         ++tk->cs_was_changed_seq;
         old_clock = tk->tkr_mono.clock;
         tk->tkr_mono.clock = clock;
-        tk->tkr_mono.read = clock->read;
         tk->tkr_mono.mask = clock->mask;
-        tk->tkr_mono.cycle_last = tk->tkr_mono.read(clock);
+        tk->tkr_mono.cycle_last = tk_clock_read(&tk->tkr_mono);
 
         tk->tkr_raw.clock = clock;
-        tk->tkr_raw.read = clock->read;
         tk->tkr_raw.mask = clock->mask;
         tk->tkr_raw.cycle_last = tk->tkr_mono.cycle_last;
 
@@ -262,7 +280,7 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock)
         /* Go back from cycles -> shifted ns */
         tk->xtime_interval = interval * clock->mult;
         tk->xtime_remainder = ntpinterval - tk->xtime_interval;
-        tk->raw_interval = (interval * clock->mult) >> clock->shift;
+        tk->raw_interval = interval * clock->mult;
 
          /* if changing clocks, convert xtime_nsec shift units */
         if (old_clock) {
@@ -404,7 +422,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
 
                 now += timekeeping_delta_to_ns(tkr,
                                 clocksource_delta(
-                                        tkr->read(tkr->clock),
+                                        tk_clock_read(tkr),
                                         tkr->cycle_last,
                                         tkr->mask));
         } while (read_seqcount_retry(&tkf->seq, seq));
@@ -461,6 +479,10 @@ static u64 dummy_clock_read(struct clocksource *cs)
         return cycles_at_suspend;
 }
 
+static struct clocksource dummy_clock = {
+        .read = dummy_clock_read,
+};
+
 /**
  * halt_fast_timekeeper - Prevent fast timekeeper from accessing clocksource.
  * @tk: Timekeeper to snapshot.
@@ -477,13 +499,13 @@ static void halt_fast_timekeeper(struct timekeeper *tk)
         struct tk_read_base *tkr = &tk->tkr_mono;
 
         memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy));
-        cycles_at_suspend = tkr->read(tkr->clock);
-        tkr_dummy.read = dummy_clock_read;
+        cycles_at_suspend = tk_clock_read(tkr);
+        tkr_dummy.clock = &dummy_clock;
         update_fast_timekeeper(&tkr_dummy, &tk_fast_mono);
 
         tkr = &tk->tkr_raw;
         memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy));
-        tkr_dummy.read = dummy_clock_read;
+        tkr_dummy.clock = &dummy_clock;
         update_fast_timekeeper(&tkr_dummy, &tk_fast_raw);
 }
 
@@ -649,11 +671,10 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action)
  */
 static void timekeeping_forward_now(struct timekeeper *tk)
 {
-        struct clocksource *clock = tk->tkr_mono.clock;
         u64 cycle_now, delta;
         u64 nsec;
 
-        cycle_now = tk->tkr_mono.read(clock);
+        cycle_now = tk_clock_read(&tk->tkr_mono);
         delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last, tk->tkr_mono.mask);
         tk->tkr_mono.cycle_last = cycle_now;
         tk->tkr_raw.cycle_last  = cycle_now;
@@ -929,8 +950,7 @@ void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot)
 
         do {
                 seq = read_seqcount_begin(&tk_core.seq);
-
-                now = tk->tkr_mono.read(tk->tkr_mono.clock);
+                now = tk_clock_read(&tk->tkr_mono);
                 systime_snapshot->cs_was_changed_seq = tk->cs_was_changed_seq;
                 systime_snapshot->clock_was_set_seq = tk->clock_was_set_seq;
                 base_real = ktime_add(tk->tkr_mono.base,
@@ -1108,7 +1128,7 @@ int get_device_system_crosststamp(int (*get_time_fn)
                  * Check whether the system counter value provided by the
                  * device driver is on the current timekeeping interval.
                  */
-                now = tk->tkr_mono.read(tk->tkr_mono.clock);
+                now = tk_clock_read(&tk->tkr_mono);
                 interval_start = tk->tkr_mono.cycle_last;
                 if (!cycle_between(interval_start, cycles, now)) {
                         clock_was_set_seq = tk->clock_was_set_seq;
@@ -1629,7 +1649,7 @@ void timekeeping_resume(void)
          * The less preferred source will only be tried if there is no better
          * usable source. The rtc part is handled separately in rtc core code.
          */
-        cycle_now = tk->tkr_mono.read(clock);
+        cycle_now = tk_clock_read(&tk->tkr_mono);
         if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) &&
                 cycle_now > tk->tkr_mono.cycle_last) {
                 u64 nsec, cyc_delta;
@@ -1976,7 +1996,7 @@ static u64 logarithmic_accumulation(struct timekeeper *tk, u64 offset,
                                     u32 shift, unsigned int *clock_set)
 {
         u64 interval = tk->cycle_interval << shift;
-        u64 raw_nsecs;
+        u64 snsec_per_sec;
 
         /* If the offset is smaller than a shifted interval, do nothing */
         if (offset < interval)
@@ -1991,14 +2011,15 @@ static u64 logarithmic_accumulation(struct timekeeper *tk, u64 offset,
         *clock_set |= accumulate_nsecs_to_secs(tk);
 
         /* Accumulate raw time */
-        raw_nsecs = (u64)tk->raw_interval << shift;
-        raw_nsecs += tk->raw_time.tv_nsec;
-        if (raw_nsecs >= NSEC_PER_SEC) {
-                u64 raw_secs = raw_nsecs;
-                raw_nsecs = do_div(raw_secs, NSEC_PER_SEC);
-                tk->raw_time.tv_sec += raw_secs;
+        tk->tkr_raw.xtime_nsec += (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift;
+        tk->tkr_raw.xtime_nsec += tk->raw_interval << shift;
+        snsec_per_sec = (u64)NSEC_PER_SEC << tk->tkr_raw.shift;
+        while (tk->tkr_raw.xtime_nsec >= snsec_per_sec) {
+                tk->tkr_raw.xtime_nsec -= snsec_per_sec;
+                tk->raw_time.tv_sec++;
         }
-        tk->raw_time.tv_nsec = raw_nsecs;
+        tk->raw_time.tv_nsec = tk->tkr_raw.xtime_nsec >> tk->tkr_raw.shift;
+        tk->tkr_raw.xtime_nsec -= (u64)tk->raw_time.tv_nsec << tk->tkr_raw.shift;
 
         /* Accumulate error between NTP and clock interval */
         tk->ntp_error += tk->ntp_tick << shift;
@@ -2030,7 +2051,7 @@ void update_wall_time(void)
 #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
         offset = real_tk->cycle_interval;
 #else
-        offset = clocksource_delta(tk->tkr_mono.read(tk->tkr_mono.clock),
+        offset = clocksource_delta(tk_clock_read(&tk->tkr_mono),
                                    tk->tkr_mono.cycle_last, tk->tkr_mono.mask);
 #endif
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 74fdfe9ed3db..b308be30dfb9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4337,9 +4337,6 @@ static int ftrace_process_regex(struct ftrace_iterator *iter,
 
         command = strsep(&next, ":");
 
-        if (WARN_ON_ONCE(!tr))
-                return -EINVAL;
-
         mutex_lock(&ftrace_cmd_mutex);
         list_for_each_entry(p, &ftrace_commands, list) {
                 if (strcmp(p->name, command) == 0) {
@@ -5063,7 +5060,7 @@ ftrace_graph_release(struct inode *inode, struct file *file)
         }
 
  out:
-        kfree(fgd->new_hash);
+        free_ftrace_hash(fgd->new_hash);
         kfree(fgd);
 
         return ret;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1122f151466f..091e801145c9 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6881,6 +6881,9 @@ ftrace_trace_snapshot_callback(struct trace_array *tr, struct ftrace_hash *hash,
         char *number;
         int ret;
 
+        if (!tr)
+                return -ENODEV;
+
         /* hash funcs only work with set_ftrace_filter */
         if (!enable)
                 return -EINVAL;
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index a3bddbfd0874..a0910c0cdf2e 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -654,6 +654,9 @@ ftrace_trace_onoff_callback(struct trace_array *tr, struct ftrace_hash *hash,
 {
         struct ftrace_probe_ops *ops;
 
+        if (!tr)
+                return -ENODEV;
+
         /* we register both traceon and traceoff to this callback */
         if (strcmp(cmd, "traceon") == 0)
                 ops = param ? &traceon_count_probe_ops : &traceon_probe_ops;
@@ -670,6 +673,9 @@ ftrace_stacktrace_callback(struct trace_array *tr, struct ftrace_hash *hash,
 {
         struct ftrace_probe_ops *ops;
 
+        if (!tr)
+                return -ENODEV;
+
         ops = param ? &stacktrace_count_probe_ops : &stacktrace_probe_ops;
 
         return ftrace_trace_probe_callback(tr, ops, hash, glob, cmd,
@@ -682,6 +688,9 @@ ftrace_dump_callback(struct trace_array *tr, struct ftrace_hash *hash,
 {
         struct ftrace_probe_ops *ops;
 
+        if (!tr)
+                return -ENODEV;
+
         ops = &dump_probe_ops;
 
         /* Only dump once. */
@@ -695,6 +704,9 @@ ftrace_cpudump_callback(struct trace_array *tr, struct ftrace_hash *hash,
 {
         struct ftrace_probe_ops *ops;
 
+        if (!tr)
+                return -ENODEV;
+
         ops = &cpudump_probe_ops;
 
         /* Only dump once. */
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index c129fca6ec99..b53c8d369163 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -707,20 +707,16 @@ static int create_trace_kprobe(int argc, char **argv)
                 pr_info("Probe point is not specified.\n");
                 return -EINVAL;
         }
-        if (isdigit(argv[1][0])) {
-                /* an address specified */
-                ret = kstrtoul(&argv[1][0], 0, (unsigned long *)&addr);
-                if (ret) {
-                        pr_info("Failed to parse address.\n");
-                        return ret;
-                }
-        } else {
+
+        /* try to parse an address. if that fails, try to read the
+         * input as a symbol. */
+        if (kstrtoul(argv[1], 0, (unsigned long *)&addr)) {
                 /* a symbol specified */
                 symbol = argv[1];
                 /* TODO: support .init module functions */
                 ret = traceprobe_split_symbol_offset(symbol, &offset);
                 if (ret) {
-                        pr_info("Failed to parse symbol.\n");
+                        pr_info("Failed to parse either an address or a symbol.\n");
                         return ret;
                 }
                 if (offset && is_return &&
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 76aa04d4c925..b4a751e8f9d6 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -409,7 +409,9 @@ static const struct file_operations stack_trace_fops = {
 static int
 stack_trace_filter_open(struct inode *inode, struct file *file)
 {
-        return ftrace_regex_open(&trace_ops, FTRACE_ITER_FILTER,
+        struct ftrace_ops *ops = inode->i_private;
+
+        return ftrace_regex_open(ops, FTRACE_ITER_FILTER,
                                  inode, file);
 }
 
@@ -476,7 +478,7 @@ static __init int stack_trace_init(void)
                         NULL, &stack_trace_fops);
 
         trace_create_file("stack_trace_filter", 0444, d_tracer,
-                        NULL, &stack_trace_filter_fops);
+                          &trace_ops, &stack_trace_filter_fops);
 
         if (stack_trace_filter_buf[0])
                 ftrace_set_early_filter(&trace_ops, stack_trace_filter_buf, 1);
diff --git a/lib/cmdline.c b/lib/cmdline.c
index 3c6432df7e63..4c0888c4a68d 100644
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -23,14 +23,14 @@
  *      the values[M, M+1, ..., N] into the ints array in get_options.
  */
 
-static int get_range(char **str, int *pint)
+static int get_range(char **str, int *pint, int n)
 {
         int x, inc_counter, upper_range;
 
         (*str)++;
         upper_range = simple_strtol((*str), NULL, 0);
         inc_counter = upper_range - *pint;
-        for (x = *pint; x < upper_range; x++)
+        for (x = *pint; n && x < upper_range; x++, n--)
                 *pint++ = x;
         return inc_counter;
 }
@@ -97,7 +97,7 @@ char *get_options(const char *str, int nints, int *ints)
                         break;
                 if (res == 3) {
                         int range_nums;
-                        range_nums = get_range((char **)&str, ints + i);
+                        range_nums = get_range((char **)&str, ints + i, nints - i);
                         if (range_nums < 0)
                                 break;
                         /*
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 74a54b7f2562..9f79547d1b97 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;
 u32 crc32c(u32 crc, const void *address, unsigned int length)
 {
         SHASH_DESC_ON_STACK(shash, tfm);
-        u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 ret, *ctx = (u32 *)shash_desc_ctx(shash);
         int err;
 
         shash->tfm = tfm;
@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length)
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        ret = *ctx;
+        barrier_data(ctx);
+        return ret;
 }
 
 EXPORT_SYMBOL(crc32c);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 889bc31785be..be88cbaadde3 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -4504,6 +4504,44 @@ static struct bpf_test tests[] = {
                 { },
                 { { 0, 1 } },
         },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 1",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 6),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 2",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
         /* BPF_JMP | BPF_JGT | BPF_K */
         {
                 "JMP_JGT_K: if (3 > 2) return 1",
diff --git a/mm/gup.c b/mm/gup.c
index d9e6fddcc51f..576c4df58882 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -387,11 +387,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
         /* mlock all present pages, but do not fault in new pages */
         if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK)
                 return -ENOENT;
-        /* For mm_populate(), just skip the stack guard page. */
-        if ((*flags & FOLL_POPULATE) &&
-                        (stack_guard_page_start(vma, address) ||
-                         stack_guard_page_end(vma, address + PAGE_SIZE)))
-                return -ENOENT;
         if (*flags & FOLL_WRITE)
                 fault_flags |= FAULT_FLAG_WRITE;
         if (*flags & FOLL_REMOTE)
@@ -407,12 +402,10 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
 
         ret = handle_mm_fault(vma, address, fault_flags);
         if (ret & VM_FAULT_ERROR) {
-                if (ret & VM_FAULT_OOM)
-                        return -ENOMEM;
-                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
-                        return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
-                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
-                        return -EFAULT;
+                int err = vm_fault_to_errno(ret, *flags);
+
+                if (err)
+                        return err;
                 BUG();
         }
 
@@ -723,12 +716,10 @@ retry:
         ret = handle_mm_fault(vma, address, fault_flags);
         major |= ret & VM_FAULT_MAJOR;
         if (ret & VM_FAULT_ERROR) {
-                if (ret & VM_FAULT_OOM)
-                        return -ENOMEM;
-                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
-                        return -EHWPOISON;
-                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
-                        return -EFAULT;
+                int err = vm_fault_to_errno(ret, 0);
+
+                if (err)
+                        return err;
                 BUG();
         }
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index a84909cf20d3..88c6167f194d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1426,8 +1426,11 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
          */
         if (unlikely(pmd_trans_migrating(*vmf->pmd))) {
                 page = pmd_page(*vmf->pmd);
+                if (!get_page_unless_zero(page))
+                        goto out_unlock;
                 spin_unlock(vmf->ptl);
                 wait_on_page_locked(page);
+                put_page(page);
                 goto out;
         }
 
@@ -1459,9 +1462,12 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
 
         /* Migration could have started since the pmd_trans_migrating check */
         if (!page_locked) {
+                page_nid = -1;
+                if (!get_page_unless_zero(page))
+                        goto out_unlock;
                 spin_unlock(vmf->ptl);
                 wait_on_page_locked(page);
-                page_nid = -1;
+                put_page(page);
                 goto out;
         }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e5828875f7bb..3eedb187e549 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4170,6 +4170,11 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         }
                         ret = hugetlb_fault(mm, vma, vaddr, fault_flags);
                         if (ret & VM_FAULT_ERROR) {
+                                int err = vm_fault_to_errno(ret, flags);
+
+                                if (err)
+                                        return err;
+
                                 remainder = 0;
                                 break;
                         }
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 945fd1ca49b5..df4ebdb2b10a 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -652,7 +652,6 @@ static void __collapse_huge_page_copy(pte_t *pte, struct page *page,
                         spin_unlock(ptl);
                         free_page_and_swap_cache(src_page);
                 }
-                cond_resched();
         }
 }
 
diff --git a/mm/ksm.c b/mm/ksm.c
index d9fc0e456128..216184af0e19 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1028,8 +1028,7 @@ static int try_to_merge_one_page(struct vm_area_struct *vma,
                 goto out;
 
         if (PageTransCompound(page)) {
-                err = split_huge_page(page);
-                if (err)
+                if (split_huge_page(page))
                         goto out_unlock;
         }
 
diff --git a/mm/memblock.c b/mm/memblock.c
index b049c9b2dba8..7b8a5db76a2f 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1739,6 +1739,29 @@ static void __init_memblock memblock_dump(struct memblock_type *type)
         }
 }
 
+extern unsigned long __init_memblock
+memblock_reserved_memory_within(phys_addr_t start_addr, phys_addr_t end_addr)
+{
+        struct memblock_region *rgn;
+        unsigned long size = 0;
+        int idx;
+
+        for_each_memblock_type((&memblock.reserved), rgn) {
+                phys_addr_t start, end;
+
+                if (rgn->base + rgn->size < start_addr)
+                        continue;
+                if (rgn->base > end_addr)
+                        continue;
+
+                start = rgn->base;
+                end = start + rgn->size;
+                size += end - start;
+        }
+
+        return size;
+}
+
 void __init_memblock __memblock_dump_all(void)
 {
         pr_info("MEMBLOCK configuration:\n");
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 2527dfeddb00..ecc183fd94f3 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1184,7 +1184,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
          * page_remove_rmap() in try_to_unmap_one(). So to determine page status
          * correctly, we save a copy of the page flags at this time.
          */
-        page_flags = p->flags;
+        if (PageHuge(p))
+                page_flags = hpage->flags;
+        else
+                page_flags = p->flags;
 
         /*
          * unpoison always clear PG_hwpoison inside page lock
@@ -1595,12 +1598,8 @@ static int soft_offline_huge_page(struct page *page, int flags)
         if (ret) {
                 pr_info("soft offline: %#lx: migration failed %d, type %lx (%pGp)\n",
                         pfn, ret, page->flags, &page->flags);
-                /*
-                 * We know that soft_offline_huge_page() tries to migrate
-                 * only one hugepage pointed to by hpage, so we need not
-                 * run through the pagelist here.
-                 */
-                putback_active_hugepage(hpage);
+                if (!list_empty(&pagelist))
+                        putback_movable_pages(&pagelist);
                 if (ret > 0)
                         ret = -EIO;
         } else {
diff --git a/mm/memory.c b/mm/memory.c
index 6ff5d729ded0..bb11c474857e 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2855,40 +2855,6 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-        address &= PAGE_MASK;
-        if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-                struct vm_area_struct *prev = vma->vm_prev;
-
-                /*
-                 * Is there a mapping abutting this one below?
-                 *
-                 * That's only ok if it's the same stack mapping
-                 * that has gotten split..
-                 */
-                if (prev && prev->vm_end == address)
-                        return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-                return expand_downwards(vma, address - PAGE_SIZE);
-        }
-        if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-                struct vm_area_struct *next = vma->vm_next;
-
-                /* As VM_GROWSDOWN but s/below/above/ */
-                if (next && next->vm_start == address + PAGE_SIZE)
-                        return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-                return expand_upwards(vma, address + PAGE_SIZE);
-        }
-        return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.
@@ -2904,10 +2870,6 @@ static int do_anonymous_page(struct vm_fault *vmf)
         if (vma->vm_flags & VM_SHARED)
                 return VM_FAULT_SIGBUS;
 
-        /* Check if we need to add a guard page to the stack */
-        if (check_stack_guard_page(vma, vmf->address) < 0)
-                return VM_FAULT_SIGSEGV;
-
         /*
          * Use pte_alloc() instead of pte_alloc_map().  We can't run
          * pte_offset_map() on pmds where a huge pmd might be created
@@ -3029,6 +2991,17 @@ static int __do_fault(struct vm_fault *vmf)
         return ret;
 }
 
+/*
+ * The ordering of these checks is important for pmds with _PAGE_DEVMAP set.
+ * If we check pmd_trans_unstable() first we will trip the bad_pmd() check
+ * inside of pmd_none_or_trans_huge_or_clear_bad(). This will end up correctly
+ * returning 1 but not before it spams dmesg with the pmd_clear_bad() output.
+ */
+static int pmd_devmap_trans_unstable(pmd_t *pmd)
+{
+        return pmd_devmap(*pmd) || pmd_trans_unstable(pmd);
+}
+
 static int pte_alloc_one_map(struct vm_fault *vmf)
 {
         struct vm_area_struct *vma = vmf->vma;
@@ -3052,18 +3025,27 @@ static int pte_alloc_one_map(struct vm_fault *vmf)
 map_pte:
         /*
          * If a huge pmd materialized under us just retry later.  Use
-         * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
-         * didn't become pmd_trans_huge under us and then back to pmd_none, as
-         * a result of MADV_DONTNEED running immediately after a huge pmd fault
-         * in a different thread of this mm, in turn leading to a misleading
-         * pmd_trans_huge() retval.  All we have to ensure is that it is a
-         * regular pmd that we can walk with pte_offset_map() and we can do that
-         * through an atomic read in C, which is what pmd_trans_unstable()
-         * provides.
+         * pmd_trans_unstable() via pmd_devmap_trans_unstable() instead of
+         * pmd_trans_huge() to ensure the pmd didn't become pmd_trans_huge
+         * under us and then back to pmd_none, as a result of MADV_DONTNEED
+         * running immediately after a huge pmd fault in a different thread of
+         * this mm, in turn leading to a misleading pmd_trans_huge() retval.
+         * All we have to ensure is that it is a regular pmd that we can walk
+         * with pte_offset_map() and we can do that through an atomic read in
+         * C, which is what pmd_trans_unstable() provides.
          */
-        if (pmd_trans_unstable(vmf->pmd) || pmd_devmap(*vmf->pmd))
+        if (pmd_devmap_trans_unstable(vmf->pmd))
                 return VM_FAULT_NOPAGE;
 
+        /*
+         * At this point we know that our vmf->pmd points to a page of ptes
+         * and it cannot become pmd_none(), pmd_devmap() or pmd_trans_huge()
+         * for the duration of the fault.  If a racing MADV_DONTNEED runs and
+         * we zap the ptes pointed to by our vmf->pmd, the vmf->ptl will still
+         * be valid and we will re-check to make sure the vmf->pte isn't
+         * pte_none() under vmf->ptl protection when we return to
+         * alloc_set_pte().
+         */
         vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,
                         &vmf->ptl);
         return 0;
@@ -3690,7 +3672,7 @@ static int handle_pte_fault(struct vm_fault *vmf)
                 vmf->pte = NULL;
         } else {
                 /* See comment in pte_alloc_one_map() */
-                if (pmd_trans_unstable(vmf->pmd) || pmd_devmap(*vmf->pmd))
+                if (pmd_devmap_trans_unstable(vmf->pmd))
                         return 0;
                 /*
                  * A regular pmd is established and it can't morph into a huge
diff --git a/mm/mlock.c b/mm/mlock.c
index c483c5c20b4b..b562b5523a65 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -284,7 +284,7 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
 {
         int i;
         int nr = pagevec_count(pvec);
-        int delta_munlocked;
+        int delta_munlocked = -nr;
         struct pagevec pvec_putback;
         int pgrescued = 0;
 
@@ -304,6 +304,8 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
                                 continue;
                         else
                                 __munlock_isolation_failed(page);
+                } else {
+                        delta_munlocked++;
                 }
 
                 /*
@@ -315,7 +317,6 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
                 pagevec_add(&pvec_putback, pvec->pages[i]);
                 pvec->pages[i] = NULL;
         }
-        delta_munlocked = -nr + pagevec_count(&pvec_putback);
         __mod_zone_page_state(zone, NR_MLOCK, delta_munlocked);
         spin_unlock_irq(zone_lru_lock(zone));
 
diff --git a/mm/mmap.c b/mm/mmap.c
index f82741e199c0..a5e3dcd75e79 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -183,6 +183,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         unsigned long retval;
         unsigned long newbrk, oldbrk;
         struct mm_struct *mm = current->mm;
+        struct vm_area_struct *next;
         unsigned long min_brk;
         bool populate;
         LIST_HEAD(uf);
@@ -229,7 +230,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         }
 
         /* Check against existing mmap mappings. */
-        if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
+        next = find_vma(mm, oldbrk);
+        if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
                 goto out;
 
         /* Ok, looks good - let it rip. */
@@ -253,10 +255,22 @@ out:
 
 static long vma_compute_subtree_gap(struct vm_area_struct *vma)
 {
-        unsigned long max, subtree_gap;
-        max = vma->vm_start;
-        if (vma->vm_prev)
-                max -= vma->vm_prev->vm_end;
+        unsigned long max, prev_end, subtree_gap;
+
+        /*
+         * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we
+         * allow two stack_guard_gaps between them here, and when choosing
+         * an unmapped area; whereas when expanding we only require one.
+         * That's a little inconsistent, but keeps the code here simpler.
+         */
+        max = vm_start_gap(vma);
+        if (vma->vm_prev) {
+                prev_end = vm_end_gap(vma->vm_prev);
+                if (max > prev_end)
+                        max -= prev_end;
+                else
+                        max = 0;
+        }
         if (vma->vm_rb.rb_left) {
                 subtree_gap = rb_entry(vma->vm_rb.rb_left,
                                 struct vm_area_struct, vm_rb)->rb_subtree_gap;
@@ -352,7 +366,7 @@ static void validate_mm(struct mm_struct *mm)
                         anon_vma_unlock_read(anon_vma);
                 }
 
-                highest_address = vma->vm_end;
+                highest_address = vm_end_gap(vma);
                 vma = vma->vm_next;
                 i++;
         }
@@ -541,7 +555,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
         if (vma->vm_next)
                 vma_gap_update(vma->vm_next);
         else
-                mm->highest_vm_end = vma->vm_end;
+                mm->highest_vm_end = vm_end_gap(vma);
 
         /*
          * vma->vm_prev wasn't known when we followed the rbtree to find the
@@ -856,7 +870,7 @@ again:
                         vma_gap_update(vma);
                 if (end_changed) {
                         if (!next)
-                                mm->highest_vm_end = end;
+                                mm->highest_vm_end = vm_end_gap(vma);
                         else if (!adjust_next)
                                 vma_gap_update(next);
                 }
@@ -941,7 +955,7 @@ again:
                          * mm->highest_vm_end doesn't need any update
                          * in remove_next == 1 case.
                          */
-                        VM_WARN_ON(mm->highest_vm_end != end);
+                        VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma));
                 }
         }
         if (insert && file)
@@ -1787,7 +1801,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
 
         while (true) {
                 /* Visit left subtree if it looks promising */
-                gap_end = vma->vm_start;
+                gap_end = vm_start_gap(vma);
                 if (gap_end >= low_limit && vma->vm_rb.rb_left) {
                         struct vm_area_struct *left =
                                 rb_entry(vma->vm_rb.rb_left,
@@ -1798,12 +1812,13 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
                         }
                 }
 
-                gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
+                gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
 check_current:
                 /* Check if current node has a suitable gap */
                 if (gap_start > high_limit)
                         return -ENOMEM;
-                if (gap_end >= low_limit && gap_end - gap_start >= length)
+                if (gap_end >= low_limit &&
+                    gap_end > gap_start && gap_end - gap_start >= length)
                         goto found;
 
                 /* Visit right subtree if it looks promising */
@@ -1825,8 +1840,8 @@ check_current:
                         vma = rb_entry(rb_parent(prev),
                                        struct vm_area_struct, vm_rb);
                         if (prev == vma->vm_rb.rb_left) {
-                                gap_start = vma->vm_prev->vm_end;
-                                gap_end = vma->vm_start;
+                                gap_start = vm_end_gap(vma->vm_prev);
+                                gap_end = vm_start_gap(vma);
                                 goto check_current;
                         }
                 }
@@ -1890,7 +1905,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 
         while (true) {
                 /* Visit right subtree if it looks promising */
-                gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
+                gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
                 if (gap_start <= high_limit && vma->vm_rb.rb_right) {
                         struct vm_area_struct *right =
                                 rb_entry(vma->vm_rb.rb_right,
@@ -1903,10 +1918,11 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 
 check_current:
                 /* Check if current node has a suitable gap */
-                gap_end = vma->vm_start;
+                gap_end = vm_start_gap(vma);
                 if (gap_end < low_limit)
                         return -ENOMEM;
-                if (gap_start <= high_limit && gap_end - gap_start >= length)
+                if (gap_start <= high_limit &&
+                    gap_end > gap_start && gap_end - gap_start >= length)
                         goto found;
 
                 /* Visit left subtree if it looks promising */
@@ -1929,7 +1945,7 @@ check_current:
                                        struct vm_area_struct, vm_rb);
                         if (prev == vma->vm_rb.rb_right) {
                                 gap_start = vma->vm_prev ?
-                                        vma->vm_prev->vm_end : 0;
+                                        vm_end_gap(vma->vm_prev) : 0;
                                 goto check_current;
                         }
                 }
@@ -1967,7 +1983,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct vm_unmapped_area_info info;
 
         if (len > TASK_SIZE - mmap_min_addr)
@@ -1978,9 +1994,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
         if (addr) {
                 addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         return addr;
         }
 
@@ -2003,7 +2020,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                           const unsigned long len, const unsigned long pgoff,
                           const unsigned long flags)
 {
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         struct vm_unmapped_area_info info;
@@ -2018,9 +2035,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         /* requesting a specific address */
         if (addr) {
                 addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)) &&
+                                (!prev || addr >= vm_end_gap(prev)))
                         return addr;
         }
 
@@ -2155,21 +2173,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  * update accounting. This is shared with both the
  * grow-up and grow-down cases.
  */
-static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow)
+static int acct_stack_growth(struct vm_area_struct *vma,
+                             unsigned long size, unsigned long grow)
 {
         struct mm_struct *mm = vma->vm_mm;
         struct rlimit *rlim = current->signal->rlim;
-        unsigned long new_start, actual_size;
+        unsigned long new_start;
 
         /* address space limit tests */
         if (!may_expand_vm(mm, vma->vm_flags, grow))
                 return -ENOMEM;
 
         /* Stack limit test */
-        actual_size = size;
-        if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
-                actual_size -= PAGE_SIZE;
-        if (actual_size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+        if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur))
                 return -ENOMEM;
 
         /* mlock limit tests */
@@ -2207,16 +2223,32 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
+        struct vm_area_struct *next;
+        unsigned long gap_addr;
         int error = 0;
 
         if (!(vma->vm_flags & VM_GROWSUP))
                 return -EFAULT;
 
-        /* Guard against wrapping around to address 0. */
-        if (address < PAGE_ALIGN(address+4))
-                address = PAGE_ALIGN(address+4);
-        else
+        /* Guard against exceeding limits of the address space. */
+        address &= PAGE_MASK;
+        if (address >= TASK_SIZE)
                 return -ENOMEM;
+        address += PAGE_SIZE;
+
+        /* Enforce stack_guard_gap */
+        gap_addr = address + stack_guard_gap;
+
+        /* Guard against overflow */
+        if (gap_addr < address || gap_addr > TASK_SIZE)
+                gap_addr = TASK_SIZE;
+
+        next = vma->vm_next;
+        if (next && next->vm_start < gap_addr) {
+                if (!(next->vm_flags & VM_GROWSUP))
+                        return -ENOMEM;
+                /* Check that both stack segments have the same anon_vma? */
+        }
 
         /* We must make sure the anon_vma is allocated. */
         if (unlikely(anon_vma_prepare(vma)))
@@ -2261,7 +2293,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                                 if (vma->vm_next)
                                         vma_gap_update(vma->vm_next);
                                 else
-                                        mm->highest_vm_end = address;
+                                        mm->highest_vm_end = vm_end_gap(vma);
                                 spin_unlock(&mm->page_table_lock);
 
                                 perf_event_mmap(vma);
@@ -2282,6 +2314,8 @@ int expand_downwards(struct vm_area_struct *vma,
                                    unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
+        struct vm_area_struct *prev;
+        unsigned long gap_addr;
         int error;
 
         address &= PAGE_MASK;
@@ -2289,6 +2323,17 @@ int expand_downwards(struct vm_area_struct *vma,
         if (error)
                 return error;
 
+        /* Enforce stack_guard_gap */
+        gap_addr = address - stack_guard_gap;
+        if (gap_addr > address)
+                return -ENOMEM;
+        prev = vma->vm_prev;
+        if (prev && prev->vm_end > gap_addr) {
+                if (!(prev->vm_flags & VM_GROWSDOWN))
+                        return -ENOMEM;
+                /* Check that both stack segments have the same anon_vma? */
+        }
+
         /* We must make sure the anon_vma is allocated. */
         if (unlikely(anon_vma_prepare(vma)))
                 return -ENOMEM;
@@ -2343,28 +2388,25 @@ int expand_downwards(struct vm_area_struct *vma,
         return error;
 }
 
-/*
- * Note how expand_stack() refuses to expand the stack all the way to
- * abut the next virtual mapping, *unless* that mapping itself is also
- * a stack mapping. We want to leave room for a guard page, after all
- * (the guard page itself is not added here, that is done by the
- * actual page faulting logic)
- *
- * This matches the behavior of the guard page logic (see mm/memory.c:
- * check_stack_guard_page()), which only allows the guard page to be
- * removed under these circumstances.
- */
+/* enforced gap between the expanding stack and other mappings. */
+unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
+
+static int __init cmdline_parse_stack_guard_gap(char *p)
+{
+        unsigned long val;
+        char *endptr;
+
+        val = simple_strtoul(p, &endptr, 10);
+        if (!*endptr)
+                stack_guard_gap = val << PAGE_SHIFT;
+
+        return 0;
+}
+__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
+
 #ifdef CONFIG_STACK_GROWSUP
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-        struct vm_area_struct *next;
-
-        address &= PAGE_MASK;
-        next = vma->vm_next;
-        if (next && next->vm_start == address + PAGE_SIZE) {
-                if (!(next->vm_flags & VM_GROWSUP))
-                        return -ENOMEM;
-        }
         return expand_upwards(vma, address);
 }
 
@@ -2386,14 +2428,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
 #else
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-        struct vm_area_struct *prev;
-
-        address &= PAGE_MASK;
-        prev = vma->vm_prev;
-        if (prev && prev->vm_end == address) {
-                if (!(prev->vm_flags & VM_GROWSDOWN))
-                        return -ENOMEM;
-        }
         return expand_downwards(vma, address);
 }
 
@@ -2491,7 +2525,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
                 vma->vm_prev = prev;
                 vma_gap_update(vma);
         } else
-                mm->highest_vm_end = prev ? prev->vm_end : 0;
+                mm->highest_vm_end = prev ? vm_end_gap(prev) : 0;
         tail_vma->vm_next = NULL;
 
         /* Kill the cache */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index f9e450c6b6e4..2302f250d6b1 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -292,6 +292,26 @@ int page_group_by_mobility_disabled __read_mostly;
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 static inline void reset_deferred_meminit(pg_data_t *pgdat)
 {
+        unsigned long max_initialise;
+        unsigned long reserved_lowmem;
+
+        /*
+         * Initialise at least 2G of a node but also take into account that
+         * two large system hashes that can take up 1GB for 0.25TB/node.
+         */
+        max_initialise = max(2UL << (30 - PAGE_SHIFT),
+                (pgdat->node_spanned_pages >> 8));
+
+        /*
+         * Compensate the all the memblock reservations (e.g. crash kernel)
+         * from the initial estimation to make sure we will initialize enough
+         * memory to boot.
+         */
+        reserved_lowmem = memblock_reserved_memory_within(pgdat->node_start_pfn,
+                        pgdat->node_start_pfn + max_initialise);
+        max_initialise += reserved_lowmem;
+
+        pgdat->static_init_size = min(max_initialise, pgdat->node_spanned_pages);
         pgdat->first_deferred_pfn = ULONG_MAX;
 }
 
@@ -314,20 +334,11 @@ static inline bool update_defer_init(pg_data_t *pgdat,
                                 unsigned long pfn, unsigned long zone_end,
                                 unsigned long *nr_initialised)
 {
-        unsigned long max_initialise;
-
         /* Always populate low zones for address-contrained allocations */
         if (zone_end < pgdat_end_pfn(pgdat))
                 return true;
-        /*
-         * Initialise at least 2G of a node but also take into account that
-         * two large system hashes that can take up 1GB for 0.25TB/node.
-         */
-        max_initialise = max(2UL << (30 - PAGE_SHIFT),
-                (pgdat->node_spanned_pages >> 8));
-
         (*nr_initialised)++;
-        if ((*nr_initialised > max_initialise) &&
+        if ((*nr_initialised > pgdat->static_init_size) &&
             (pfn & (PAGES_PER_SECTION - 1)) == 0) {
                 pgdat->first_deferred_pfn = pfn;
                 return false;
@@ -3870,7 +3881,9 @@ retry:
                 goto got_pg;
 
         /* Avoid allocations with no watermarks from looping endlessly */
-        if (test_thread_flag(TIF_MEMDIE))
+        if (test_thread_flag(TIF_MEMDIE) &&
+            (alloc_flags == ALLOC_NO_WATERMARKS ||
+             (gfp_mask & __GFP_NOMEMALLOC)))
                 goto nopage;
 
         /* Retry as long as the OOM killer is making progress */
@@ -6136,7 +6149,6 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
         /* pg_data_t should be reset to zero when it's allocated */
         WARN_ON(pgdat->nr_zones || pgdat->kswapd_classzone_idx);
 
-        reset_deferred_meminit(pgdat);
         pgdat->node_id = nid;
         pgdat->node_start_pfn = node_start_pfn;
         pgdat->per_cpu_nodestats = NULL;
@@ -6158,6 +6170,7 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
                 (unsigned long)pgdat->node_mem_map);
 #endif
 
+        reset_deferred_meminit(pgdat);
         free_area_init_core(pgdat);
 }
 
diff --git a/mm/slub.c b/mm/slub.c
index 57e5156f02be..8addc535bcdc 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5512,6 +5512,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                 char mbuf[64];
                 char *buf;
                 struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
+                ssize_t len;
 
                 if (!attr || !attr->store || !attr->show)
                         continue;
@@ -5536,8 +5537,9 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                         buf = buffer;
                 }
 
-                attr->show(root_cache, buf);
-                attr->store(s, buf, strlen(buf));
+                len = attr->show(root_cache, buf);
+                if (len > 0)
+                        attr->store(s, buf, len);
         }
 
         if (buffer)
@@ -5623,6 +5625,28 @@ static char *create_unique_id(struct kmem_cache *s)
         return name;
 }
 
+static void sysfs_slab_remove_workfn(struct work_struct *work)
+{
+        struct kmem_cache *s =
+                container_of(work, struct kmem_cache, kobj_remove_work);
+
+        if (!s->kobj.state_in_sysfs)
+                /*
+                 * For a memcg cache, this may be called during
+                 * deactivation and again on shutdown.  Remove only once.
+                 * A cache is never shut down before deactivation is
+                 * complete, so no need to worry about synchronization.
+                 */
+                return;
+
+#ifdef CONFIG_MEMCG
+        kset_unregister(s->memcg_kset);
+#endif
+        kobject_uevent(&s->kobj, KOBJ_REMOVE);
+        kobject_del(&s->kobj);
+        kobject_put(&s->kobj);
+}
+
 static int sysfs_slab_add(struct kmem_cache *s)
 {
         int err;
@@ -5630,6 +5654,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
         struct kset *kset = cache_kset(s);
         int unmergeable = slab_unmergeable(s);
 
+        INIT_WORK(&s->kobj_remove_work, sysfs_slab_remove_workfn);
+
         if (!kset) {
                 kobject_init(&s->kobj, &slab_ktype);
                 return 0;
@@ -5693,20 +5719,8 @@ static void sysfs_slab_remove(struct kmem_cache *s)
                  */
                 return;
 
-        if (!s->kobj.state_in_sysfs)
-                /*
-                 * For a memcg cache, this may be called during
-                 * deactivation and again on shutdown.  Remove only once.
-                 * A cache is never shut down before deactivation is
-                 * complete, so no need to worry about synchronization.
-                 */
-                return;
-
-#ifdef CONFIG_MEMCG
-        kset_unregister(s->memcg_kset);
-#endif
-        kobject_uevent(&s->kobj, KOBJ_REMOVE);
-        kobject_del(&s->kobj);
+        kobject_get(&s->kobj);
+        schedule_work(&s->kobj_remove_work);
 }
 
 void sysfs_slab_release(struct kmem_cache *s)
diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
index ac6318a064d3..3405b4ee1757 100644
--- a/mm/swap_cgroup.c
+++ b/mm/swap_cgroup.c
@@ -48,6 +48,9 @@ static int swap_cgroup_prepare(int type)
                 if (!page)
                         goto not_enough_page;
                 ctrl->map[idx] = page;
+
+                if (!(idx % SWAP_CLUSTER_MAX))
+                        cond_resched();
         }
         return 0;
 not_enough_page:
diff --git a/mm/util.c b/mm/util.c
index 464df3489903..26be6407abd7 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -357,8 +357,11 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node)
         WARN_ON_ONCE((flags & GFP_KERNEL) != GFP_KERNEL);
 
         /*
-         * Make sure that larger requests are not too disruptive - no OOM
-         * killer and no allocation failure warnings as we have a fallback
+         * We want to attempt a large physically contiguous block first because
+         * it is less likely to fragment multiple larger blocks and therefore
+         * contribute to a long term fragmentation less than vmalloc fallback.
+         * However make sure that larger requests are not too disruptive - no
+         * OOM killer and no allocation failure warnings as we have a fallback.
          */
         if (size > PAGE_SIZE) {
                 kmalloc_flags |= __GFP_NOWARN;
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 34a1c3e46ed7..ecc97f74ab18 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -287,10 +287,21 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
         if (p4d_none(*p4d))
                 return NULL;
         pud = pud_offset(p4d, addr);
-        if (pud_none(*pud))
+
+        /*
+         * Don't dereference bad PUD or PMD (below) entries. This will also
+         * identify huge mappings, which we may encounter on architectures
+         * that define CONFIG_HAVE_ARCH_HUGE_VMAP=y. Such regions will be
+         * identified as vmalloc addresses by is_vmalloc_addr(), but are
+         * not [unambiguously] associated with a struct page, so there is
+         * no correct value to return for them.
+         */
+        WARN_ON_ONCE(pud_bad(*pud));
+        if (pud_none(*pud) || pud_bad(*pud))
                 return NULL;
         pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        WARN_ON_ONCE(pmd_bad(*pmd));
+        if (pmd_none(*pmd) || pmd_bad(*pmd))
                 return NULL;
 
         ptep = pte_offset_map(pmd, addr);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 6063581f705c..ce0618bfa8d0 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -115,9 +115,9 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned,
         unsigned long pressure = 0;
 
         /*
-         * reclaimed can be greater than scanned in cases
-         * like THP, where the scanned is 1 and reclaimed
-         * could be 512
+         * reclaimed can be greater than scanned for things such as reclaimed
+         * slab pages. shrink_node() just adds reclaimed pages without a
+         * related increment to scanned pages.
          */
         if (reclaimed >= scanned)
                 goto out;
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 467069b73ce1..9649579b5b9f 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -277,7 +277,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
         return 0;
 
 out_free_newdev:
-        free_netdev(new_dev);
+        if (new_dev->reg_state == NETREG_UNINITIALIZED)
+                free_netdev(new_dev);
         return err;
 }
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 953b6728bd00..abc5f400fc71 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -813,7 +813,6 @@ static void vlan_dev_free(struct net_device *dev)
 
         free_percpu(vlan->vlan_pcpu_stats);
         vlan->vlan_pcpu_stats = NULL;
-        free_netdev(dev);
 }
 
 void vlan_setup(struct net_device *dev)
@@ -826,7 +825,8 @@ void vlan_setup(struct net_device *dev)
         netif_keep_dst(dev);
 
         dev->netdev_ops         = &vlan_netdev_ops;
-        dev->destructor         = vlan_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = vlan_dev_free;
         dev->ethtool_ops        = &vlan_ethtool_ops;
 
         dev->min_mtu            = 0;
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 013e970eff39..000ca2f113ab 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1064,8 +1064,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
 
                 skb_new->protocol = eth_type_trans(skb_new, soft_iface);
 
-                soft_iface->stats.rx_packets++;
-                soft_iface->stats.rx_bytes += skb->len + ETH_HLEN + hdr_size;
+                batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+                batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                                   skb->len + ETH_HLEN + hdr_size);
 
                 netif_rx(skb_new);
                 batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e1ebe14ee2a6..ae9f4d37d34f 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -987,7 +987,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                            "recv_unicast_packet(): Dropped unicast pkt received from another backbone gw %pM.\n",
                                            orig_addr_gw);
-                                return NET_RX_DROP;
+                                goto free_skb;
                         }
                 }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b25789abf7b9..10f7edfb176e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1034,8 +1034,6 @@ static void batadv_softif_free(struct net_device *dev)
          * netdev and its private data (bat_priv)
          */
         rcu_barrier();
-
-        free_netdev(dev);
 }
 
 /**
@@ -1047,7 +1045,8 @@ static void batadv_softif_init_early(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &batadv_netdev_ops;
-        dev->destructor = batadv_softif_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = batadv_softif_free;
         dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_NETNS_LOCAL;
         dev->priv_flags |= IFF_NO_QUEUE;
 
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 608959989f8e..ab3b654b05cc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -598,7 +598,7 @@ static void netdev_setup(struct net_device *dev)
 
         dev->netdev_ops         = &netdev_ops;
         dev->header_ops         = &header_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct device_type bt_type = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 430b53e7d941..f0f3447e8aa4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -379,7 +379,7 @@ void br_dev_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->ethtool_ops = &br_ethtool_ops;
         SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 574f78824d8a..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                 err = 0;
                 switch (nla_type(attr)) {
                 case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                 return -EINVAL;
                         err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                         if (err)
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 08341d2aa9c9..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,6 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c98b3e5c140a..60b6fe277a8b 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                if (br->stp_enabled != BR_USER_STP)
+                if (br->stp_enabled == BR_KERNEL_STP)
                         mod_timer(&br->hello_timer,
                                   round_jiffies(jiffies + br->hello_time));
         }
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 5929309beaa1..db85230e49c3 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -68,6 +68,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
         if (e->ethproto != htons(ETH_P_ARP) ||
             e->invflags & EBT_IPROTO)
                 return -EINVAL;
+        if (ebt_invalid_target(info->target))
+                return -EINVAL;
+
         return 0;
 }
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 9ec0c9f908fa..9c6e619f452b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1373,7 +1373,8 @@ static inline int ebt_obj_to_user(char __user *um, const char *_name,
         strlcpy(name, _name, sizeof(name));
         if (copy_to_user(um, name, EBT_FUNCTION_MAXNAMELEN) ||
             put_user(datasize, (int __user *)(um + EBT_FUNCTION_MAXNAMELEN)) ||
-            xt_data_to_user(um + entrysize, data, usersize, datasize))
+            xt_data_to_user(um + entrysize, data, usersize, datasize,
+                            XT_ALIGN(datasize)))
                 return -EFAULT;
 
         return 0;
@@ -1658,7 +1659,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
                 if (match->compat_to_user(cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, m->data, match->usersize, msize))
+                if (xt_data_to_user(cm->data, m->data, match->usersize, msize,
+                                    COMPAT_XT_ALIGN(msize)))
                         return -EFAULT;
         }
 
@@ -1687,7 +1689,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
                 if (target->compat_to_user(cm->data, t->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize))
+                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize,
+                                    COMPAT_XT_ALIGN(tsize)))
                         return -EFAULT;
         }
 
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index adcad344c843..21f18ea2fce4 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -754,6 +754,10 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
 
         lock_sock(sk);
 
+        err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         err = -EAFNOSUPPORT;
         if (uaddr->sa_family != AF_CAIF)
                 goto out;
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 59ce1fcc220c..71b6ab240dea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx)
 {
         struct sk_buff *skb;
 
-        if (likely(in_interrupt()))
-                skb = alloc_skb(len + pfx, GFP_ATOMIC);
-        else
-                skb = alloc_skb(len + pfx, GFP_KERNEL);
-
+        skb = alloc_skb(len + pfx, GFP_ATOMIC);
         if (unlikely(skb == NULL))
                 return NULL;
 
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 1816fc9f1ee7..fe3c53efb949 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -392,14 +392,14 @@ static void chnl_net_destructor(struct net_device *dev)
 {
         struct chnl_net *priv = netdev_priv(dev);
         caif_free_client(&priv->chnl);
-        free_netdev(dev);
 }
 
 static void ipcaif_net_setup(struct net_device *dev)
 {
         struct chnl_net *priv;
         dev->netdev_ops = &netdev_ops;
-        dev->destructor = chnl_net_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = chnl_net_destructor;
         dev->flags |= IFF_NOARP;
         dev->flags |= IFF_POINTOPOINT;
         dev->mtu = GPRS_PDP_MTU;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index b6406fe33c76..88edac0f3e36 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -872,8 +872,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 
 static int can_pernet_init(struct net *net)
 {
-        net->can.can_rcvlists_lock =
-                __SPIN_LOCK_UNLOCKED(net->can.can_rcvlists_lock);
+        spin_lock_init(&net->can.can_rcvlists_lock);
         net->can.can_rx_alldev_list =
                 kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
 
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 2034fb926670..8757fb87dab8 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -151,7 +151,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         struct timespec validity;
         void *tp, *tpend;
         void **ptp;
-        struct ceph_crypto_key new_session_key;
+        struct ceph_crypto_key new_session_key = { 0 };
         struct ceph_buffer *new_ticket_blob;
         unsigned long new_expires, new_renew_after;
         u64 new_secret_id;
@@ -215,6 +215,9 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         dout(" ticket blob is %d bytes\n", dlen);
         ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
         blob_struct_v = ceph_decode_8(ptp);
+        if (blob_struct_v != 1)
+                goto bad;
+
         new_secret_id = ceph_decode_64(ptp);
         ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
         if (ret)
@@ -234,13 +237,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
              type, ceph_entity_type_name(type), th->secret_id,
              (int)th->ticket_blob->vec.iov_len);
         xi->have_keys |= th->service;
-
-out:
-        return ret;
+        return 0;
 
 bad:
         ret = -EINVAL;
-        goto out;
+out:
+        ceph_crypto_key_destroy(&new_session_key);
+        return ret;
 }
 
 static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 4fd02831beed..47e94b560ba0 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -56,19 +56,6 @@ static const struct kernel_param_ops param_ops_supported_features = {
 module_param_cb(supported_features, &param_ops_supported_features, NULL,
                 S_IRUGO);
 
-/*
- * find filename portion of a path (/foo/bar/baz -> baz)
- */
-const char *ceph_file_part(const char *s, int len)
-{
-        const char *e = s + len;
-
-        while (e != s && *(e-1) != '/')
-                e--;
-        return e;
-}
-EXPORT_SYMBOL(ceph_file_part);
-
 const char *ceph_msg_type_name(int type)
 {
         switch (type) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 5766a6c896c4..588a91930051 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1174,8 +1174,8 @@ static struct page *ceph_msg_data_next(struct ceph_msg_data_cursor *cursor,
  * Returns true if the result moves the cursor on to the next piece
  * of the data item.
  */
-static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
-                                size_t bytes)
+static void ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
+                                  size_t bytes)
 {
         bool new_piece;
 
@@ -1207,8 +1207,6 @@ static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
                 new_piece = true;
         }
         cursor->need_crc = new_piece;
-
-        return new_piece;
 }
 
 static size_t sizeof_footer(struct ceph_connection *con)
@@ -1577,7 +1575,6 @@ static int write_partial_message_data(struct ceph_connection *con)
                 size_t page_offset;
                 size_t length;
                 bool last_piece;
-                bool need_crc;
                 int ret;
 
                 page = ceph_msg_data_next(cursor, &page_offset, &length,
@@ -1592,7 +1589,7 @@ static int write_partial_message_data(struct ceph_connection *con)
                 }
                 if (do_datacrc && cursor->need_crc)
                         crc = ceph_crc32c_page(crc, page, page_offset, length);
-                need_crc = ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
 
         dout("%s %p msg %p done\n", __func__, con, msg);
@@ -2231,10 +2228,18 @@ static void process_ack(struct ceph_connection *con)
         struct ceph_msg *m;
         u64 ack = le64_to_cpu(con->in_temp_ack);
         u64 seq;
+        bool reconnect = (con->in_tag == CEPH_MSGR_TAG_SEQ);
+        struct list_head *list = reconnect ? &con->out_queue : &con->out_sent;
 
-        while (!list_empty(&con->out_sent)) {
-                m = list_first_entry(&con->out_sent, struct ceph_msg,
-                                     list_head);
+        /*
+         * In the reconnect case, con_fault() has requeued messages
+         * in out_sent. We should cleanup old messages according to
+         * the reconnect seq.
+         */
+        while (!list_empty(list)) {
+                m = list_first_entry(list, struct ceph_msg, list_head);
+                if (reconnect && m->needs_out_seq)
+                        break;
                 seq = le64_to_cpu(m->hdr.seq);
                 if (seq > ack)
                         break;
@@ -2243,6 +2248,7 @@ static void process_ack(struct ceph_connection *con)
                 m->ack_stamp = jiffies;
                 ceph_msg_remove(m);
         }
+
         prepare_read_tag(con);
 }
 
@@ -2299,7 +2305,7 @@ static int read_partial_msg_data(struct ceph_connection *con)
 
                 if (do_datacrc)
                         crc = ceph_crc32c_page(crc, page, page_offset, ret);
-                (void) ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
         if (do_datacrc)
                 con->in_data_crc = crc;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 29a0ef351c5e..250f11f78609 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -43,15 +43,13 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
         int i, err = -EINVAL;
         struct ceph_fsid fsid;
         u32 epoch, num_mon;
-        u16 version;
         u32 len;
 
         ceph_decode_32_safe(&p, end, len, bad);
         ceph_decode_need(&p, end, len, bad);
 
         dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
-
-        ceph_decode_16_safe(&p, end, version, bad);
+        p += sizeof(u16);  /* skip version */
 
         ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
         ceph_decode_copy(&p, &fsid, sizeof(fsid));
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 u32 yes;
                 struct crush_rule *r;
 
+                err = -EINVAL;
                 ceph_decode_32_safe(p, end, yes, bad);
                 if (!yes) {
                         dout("crush_decode NO rule %d off %x %p to %p\n",
diff --git a/net/core/dev.c b/net/core/dev.c
index fca407b4a6ea..416137c64bf8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1253,8 +1253,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
         if (!new_ifalias)
                 return -ENOMEM;
         dev->ifalias = new_ifalias;
+        memcpy(dev->ifalias, alias, len);
+        dev->ifalias[len] = 0;
 
-        strlcpy(dev->ifalias, alias, len+1);
         return len;
 }
 
@@ -4766,6 +4767,13 @@ struct packet_offload *gro_find_complete_by_type(__be16 type)
 }
 EXPORT_SYMBOL(gro_find_complete_by_type);
 
+static void napi_skb_free_stolen_head(struct sk_buff *skb)
+{
+        skb_dst_drop(skb);
+        secpath_reset(skb);
+        kmem_cache_free(skbuff_head_cache, skb);
+}
+
 static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
 {
         switch (ret) {
@@ -4779,13 +4787,10 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
                 break;
 
         case GRO_MERGED_FREE:
-                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) {
-                        skb_dst_drop(skb);
-                        secpath_reset(skb);
-                        kmem_cache_free(skbuff_head_cache, skb);
-                } else {
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                        napi_skb_free_stolen_head(skb);
+                else
                         __kfree_skb(skb);
-                }
                 break;
 
         case GRO_HELD:
@@ -4857,10 +4862,16 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi,
                 break;
 
         case GRO_DROP:
-        case GRO_MERGED_FREE:
                 napi_reuse_skb(napi, skb);
                 break;
 
+        case GRO_MERGED_FREE:
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                        napi_skb_free_stolen_head(skb);
+                else
+                        napi_reuse_skb(napi, skb);
+                break;
+
         case GRO_MERGED:
         case GRO_CONSUMED:
                 break;
@@ -4948,6 +4959,19 @@ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(__skb_gro_checksum_complete);
 
+static void net_rps_send_ipi(struct softnet_data *remsd)
+{
+#ifdef CONFIG_RPS
+        while (remsd) {
+                struct softnet_data *next = remsd->rps_ipi_next;
+
+                if (cpu_online(remsd->cpu))
+                        smp_call_function_single_async(remsd->cpu, &remsd->csd);
+                remsd = next;
+        }
+#endif
+}
+
 /*
  * net_rps_action_and_irq_enable sends any pending IPI's for rps.
  * Note: called with local irq disabled, but exits with local irq enabled.
@@ -4963,14 +4987,7 @@ static void net_rps_action_and_irq_enable(struct softnet_data *sd)
                 local_irq_enable();
 
                 /* Send pending IPI's to kick RPS processing on remote cpus. */
-                while (remsd) {
-                        struct softnet_data *next = remsd->rps_ipi_next;
-
-                        if (cpu_online(remsd->cpu))
-                                smp_call_function_single_async(remsd->cpu,
-                                                           &remsd->csd);
-                        remsd = next;
-                }
+                net_rps_send_ipi(remsd);
         } else
 #endif
                 local_irq_enable();
@@ -5199,8 +5216,6 @@ static void busy_poll_stop(struct napi_struct *napi, void *have_poll_lock)
         if (rc == BUSY_POLL_BUDGET)
                 __napi_schedule(napi);
         local_bh_enable();
-        if (local_softirq_pending())
-                do_softirq();
 }
 
 void napi_busy_loop(unsigned int napi_id,
@@ -7501,6 +7516,8 @@ out:
 err_uninit:
         if (dev->netdev_ops->ndo_uninit)
                 dev->netdev_ops->ndo_uninit(dev);
+        if (dev->priv_destructor)
+                dev->priv_destructor(dev);
         goto out;
 }
 EXPORT_SYMBOL(register_netdevice);
@@ -7708,8 +7725,10 @@ void netdev_run_todo(void)
                 WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                 WARN_ON(dev->dn_ptr);
 
-                if (dev->destructor)
-                        dev->destructor(dev);
+                if (dev->priv_destructor)
+                        dev->priv_destructor(dev);
+                if (dev->needs_free_netdev)
+                        free_netdev(dev);
 
                 /* Report a network device has been unregistered */
                 rtnl_lock();
@@ -7774,9 +7793,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
         } else {
                 netdev_stats_to_stats64(storage, &dev->stats);
         }
-        storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
-        storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
-        storage->rx_nohandler += atomic_long_read(&dev->rx_nohandler);
+        storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
+        storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped);
+        storage->rx_nohandler += (unsigned long)atomic_long_read(&dev->rx_nohandler);
         return storage;
 }
 EXPORT_SYMBOL(dev_get_stats);
@@ -8192,7 +8211,7 @@ static int dev_cpu_dead(unsigned int oldcpu)
         struct sk_buff **list_skb;
         struct sk_buff *skb;
         unsigned int cpu;
-        struct softnet_data *sd, *oldsd;
+        struct softnet_data *sd, *oldsd, *remsd = NULL;
 
         local_irq_disable();
         cpu = smp_processor_id();
@@ -8233,6 +8252,13 @@ static int dev_cpu_dead(unsigned int oldcpu)
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_enable();
 
+#ifdef CONFIG_RPS
+        remsd = oldsd->rps_ipi_list;
+        oldsd->rps_ipi_list = NULL;
+#endif
+        /* send out pending IPI's on offline CPU */
+        net_rps_send_ipi(remsd);
+
         /* Process offline CPU's input_pkt_queue */
         while ((skb = __skb_dequeue(&oldsd->process_queue))) {
                 netif_rx_ni(skb);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index b94b1d293506..27fad31784a8 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -410,6 +410,22 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (cmd == SIOCGIFNAME)
                 return dev_ifname(net, (struct ifreq __user *)arg);
 
+        /*
+         * Take care of Wireless Extensions. Unfortunately struct iwreq
+         * isn't a proper subset of struct ifreq (it's 8 byte shorter)
+         * so we need to treat it specially, otherwise applications may
+         * fault if the struct they're passing happens to land at the
+         * end of a mapped page.
+         */
+        if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
+                struct iwreq iwr;
+
+                if (copy_from_user(&iwr, arg, sizeof(iwr)))
+                        return -EFAULT;
+
+                return wext_handle_ioctl(net, &iwr, cmd, arg);
+        }
+
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
 
@@ -559,9 +575,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                 ret = -EFAULT;
                         return ret;
                 }
-                /* Take care of Wireless Extensions */
-                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
-                        return wext_handle_ioctl(net, &ifr, cmd, arg);
                 return -ENOTTY;
         }
 }
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
diff --git a/net/core/dst.c b/net/core/dst.c
index 960e503b5a52..13ba4a090c41 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
 
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
         /* This initializer is needed to force linker to place this variable
          * into const section. Otherwise it might end into bss section.
          * We really want to avoid false sharing on this variable, and catch
          * any writes on it.
          */
-        [RTAX_MAX] = 0xdeadbeef,
+        .refcnt = ATOMIC_INIT(1),
 };
 
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
         if (dev)
                 dev_hold(dev);
         dst->ops = ops;
-        dst_init_metrics(dst, dst_default_metrics, true);
+        dst_init_metrics(dst, dst_default_metrics.metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
         dst->from = NULL;
@@ -314,25 +314,30 @@ EXPORT_SYMBOL(dst_release);
 
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-        u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+        struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
 
         if (p) {
-                u32 *old_p = __DST_METRICS_PTR(old);
+                struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
                 unsigned long prev, new;
 
-                memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                atomic_set(&p->refcnt, 1);
+                memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
 
                 new = (unsigned long) p;
                 prev = cmpxchg(&dst->_metrics, old, new);
 
                 if (prev != old) {
                         kfree(p);
-                        p = __DST_METRICS_PTR(prev);
+                        p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
                         if (prev & DST_METRICS_READ_ONLY)
                                 p = NULL;
+                } else if (prev & DST_METRICS_REFCOUNTED) {
+                        if (atomic_dec_and_test(&old_p->refcnt))
+                                kfree(old_p);
                 }
         }
-        return p;
+        BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+        return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
 
@@ -341,7 +346,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
         unsigned long prev, new;
 
-        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+        new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
         prev = cmpxchg(&dst->_metrics, old, new);
         if (prev == old)
                 kfree(__DST_METRICS_PTR(old));
@@ -464,6 +469,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
                 spin_lock_bh(&dst_garbage.lock);
                 dst = dst_garbage.list;
                 dst_garbage.list = NULL;
+                /* The code in dst_ifdown places a hold on the loopback device.
+                 * If the gc entry processing is set to expire after a lengthy
+                 * interval, this hold can cause netdev_wait_allrefs() to hang
+                 * out and wait for a long time -- until the the loopback
+                 * interface is released.  If we're really unlucky, it'll emit
+                 * pr_emerg messages to console too.  Reset the interval here,
+                 * so dst cleanups occur in a more timely fashion.
+                 */
+                if (dst_garbage.timer_inc > DST_GC_INC) {
+                        dst_garbage.timer_inc = DST_GC_INC;
+                        dst_garbage.timer_expires = DST_GC_MIN;
+                        mod_delayed_work(system_wq, &dst_gc_work,
+                                         dst_garbage.timer_expires);
+                }
                 spin_unlock_bh(&dst_garbage.lock);
 
                 if (last)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index f21c4d3aeae0..3bba291c6c32 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -568,7 +568,7 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct net *net = sock_net(skb->sk);
         struct fib_rule_hdr *frh = nlmsg_data(nlh);
         struct fib_rules_ops *ops = NULL;
-        struct fib_rule *rule, *tmp;
+        struct fib_rule *rule, *r;
         struct nlattr *tb[FRA_MAX+1];
         struct fib_kuid_range range;
         int err = -EINVAL;
@@ -668,16 +668,23 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
 
                 /*
                  * Check if this rule is a target to any of them. If so,
+                 * adjust to the next one with the same preference or
                  * disable them. As this operation is eventually very
-                 * expensive, it is only performed if goto rules have
-                 * actually been added.
+                 * expensive, it is only performed if goto rules, except
+                 * current if it is goto rule, have actually been added.
                  */
                 if (ops->nr_goto_rules > 0) {
-                        list_for_each_entry(tmp, &ops->rules_list, list) {
-                                if (rtnl_dereference(tmp->ctarget) == rule) {
-                                        RCU_INIT_POINTER(tmp->ctarget, NULL);
+                        struct fib_rule *n;
+
+                        n = list_next_entry(rule, list);
+                        if (&n->list == &ops->rules_list || n->pref != rule->pref)
+                                n = NULL;
+                        list_for_each_entry(r, &ops->rules_list, list) {
+                                if (rtnl_dereference(r->ctarget) != rule)
+                                        continue;
+                                rcu_assign_pointer(r->ctarget, n);
+                                if (!n)
                                         ops->unresolved_rules++;
-                                }
                         }
                 }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index a253a6197e6b..a6bb95fa87b2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2281,6 +2281,7 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_skb_change_head ||
             func == bpf_skb_change_tail ||
             func == bpf_skb_pull_data ||
+            func == bpf_clone_redirect ||
             func == bpf_l3_csum_replace ||
             func == bpf_l4_csum_replace ||
             func == bpf_xdp_adjust_head)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1934efd4a9d4..26bbfababff2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -315,6 +315,25 @@ out_undo:
         goto out;
 }
 
+static int __net_init net_defaults_init_net(struct net *net)
+{
+        net->core.sysctl_somaxconn = SOMAXCONN;
+        return 0;
+}
+
+static struct pernet_operations net_defaults_ops = {
+        .init = net_defaults_init_net,
+};
+
+static __init int net_defaults_init(void)
+{
+        if (register_pernet_subsys(&net_defaults_ops))
+                panic("Cannot initialize net default settings");
+
+        return 0;
+}
+
+core_initcall(net_defaults_init);
 
 #ifdef CONFIG_NET_NS
 static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 49a279a7cc15..467a2f4510a7 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -931,6 +931,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
                + nla_total_size(4) /* IFLA_LINK_NETNSID */
+               + nla_total_size(4) /* IFLA_GROUP */
                + nla_total_size(ext_filter_mask
                                 & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
                + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -1124,6 +1125,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         struct ifla_vf_mac vf_mac;
         struct ifla_vf_info ivi;
 
+        memset(&ivi, 0, sizeof(ivi));
+
         /* Not all SR-IOV capable drivers support the
          * spoofcheck and "RSS query enable" query.  Preset to
          * -1 so the user space tool can detect that the driver
@@ -1132,7 +1135,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         ivi.spoofchk = -1;
         ivi.rss_query_en = -1;
         ivi.trusted = -1;
-        memset(ivi.mac, 0, sizeof(ivi.mac));
         /* The default value for VF link state is "auto"
          * IFLA_VF_LINK_STATE_AUTO which equals zero
          */
@@ -1467,6 +1469,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINK_NETNSID]     = { .type = NLA_S32 },
         [IFLA_PROTO_DOWN]       = { .type = NLA_U8 },
         [IFLA_XDP]              = { .type = NLA_NESTED },
+        [IFLA_GROUP]            = { .type = NLA_U32 },
 };
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
@@ -3231,8 +3234,11 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err = 0;
         int fidx = 0;
 
-        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                        IFLA_MAX, ifla_policy, NULL) == 0) {
+        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+                          IFLA_MAX, ifla_policy, NULL);
+        if (err < 0) {
+                return -EINVAL;
+        } else if (err == 0) {
                 if (tb[IFLA_MASTER])
                         br_idx = nla_get_u32(tb[IFLA_MASTER]);
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 
         spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                 icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
         spin_unlock_irqrestore(&q->lock, flags);
 
         if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index ea23254b2457..b7cd9aafe99e 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -479,8 +479,6 @@ static __net_init int sysctl_core_net_init(struct net *net)
 {
         struct ctl_table *tbl;
 
-        net->core.sysctl_somaxconn = SOMAXCONN;
-
         tbl = netns_core_table;
         if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 4b9518a0d248..6f95612b4d32 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt)
         call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
 
-static inline void dnrt_drop(struct dn_route *rt)
-{
-        dst_release(&rt->dst);
-        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
-}
-
 static void dn_dst_check_expire(unsigned long dummy)
 {
         int i;
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops)
                         }
                         *rtp = rt->dst.dn_next;
                         rt->dst.dn_next = NULL;
-                        dnrt_drop(rt);
+                        dnrt_free(rt);
                         break;
                 }
                 spin_unlock_bh(&dn_rt_hash_table[i].lock);
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
                         dst_use(&rth->dst, now);
                         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
 
-                        dnrt_drop(rt);
+                        dst_free(&rt->dst);
                         *rp = rth;
                         return 0;
                 }
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy)
                 for(; rt; rt = next) {
                         next = rcu_dereference_raw(rt->dst.dn_next);
                         RCU_INIT_POINTER(rt->dst.dn_next, NULL);
-                        dst_free((struct dst_entry *)rt);
+                        dnrt_free(rt);
                 }
 
 nothing_to_declare:
@@ -1187,7 +1181,7 @@ make_route:
         if (dev_out->flags & IFF_LOOPBACK)
                 flags |= RTCF_LOCAL;
 
-        rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
+        rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
         if (rt == NULL)
                 goto e_nobufs;
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 1ed81ac6dd1a..aa8ffecc46a4 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
 
-        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+        if (skb->len < sizeof(*nlh) ||
+            nlh->nlmsg_len < sizeof(*nlh) ||
+            skb->len < nlh->nlmsg_len)
                 return;
 
         if (!netlink_capable(skb, CAP_NET_ADMIN))
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+
+        if (ret)
+                return ret;
+
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
+
 static struct packet_type dsa_pack_type __read_mostly = {
         .type   = cpu_to_be16(ETH_P_XDSA),
         .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                 dsa_ds_unapply(dst, ds);
         }
 
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                 dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
 
         pr_info("DSA: tree %d unapplied\n", dst->tree);
         dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
         dsa_switch_unregister_notifier(ds);
 }
 
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-
-        if (ret)
-                return ret;
-
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
-
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index c73160fb11e7..0a0a392dc2bd 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -378,7 +378,6 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         del_timer_sync(&hsr->announce_timer);
 
         synchronize_rcu();
-        free_netdev(hsr_dev);
 }
 
 static const struct net_device_ops hsr_device_ops = {
@@ -404,7 +403,8 @@ void hsr_dev_setup(struct net_device *dev)
         SET_NETDEV_DEVTYPE(dev, &hsr_type);
         dev->priv_flags |= IFF_NO_QUEUE;
 
-        dev->destructor = hsr_dev_destroy;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = hsr_dev_destroy;
 
         dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
                            NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 4ebe2aa3e7d3..04b5450c5a55 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -324,8 +324,7 @@ static int hsr_fill_frame_info(struct hsr_frame_info *frame,
         unsigned long irqflags;
 
         frame->is_supervision = is_supervision_frame(port->hsr, skb);
-        frame->node_src = hsr_get_node(&port->hsr->node_db, skb,
-                                       frame->is_supervision);
+        frame->node_src = hsr_get_node(port, skb, frame->is_supervision);
         if (frame->node_src == NULL)
                 return -1; /* Unknown node and !is_supervision, or no mem */
 
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 7ea925816f79..284a9b820df8 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -158,9 +158,10 @@ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
 
 /* Get the hsr_node from which 'skb' was sent.
  */
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup)
 {
+        struct list_head *node_db = &port->hsr->node_db;
         struct hsr_node *node;
         struct ethhdr *ethhdr;
         u16 seq_out;
@@ -186,7 +187,11 @@ struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
                  */
                 seq_out = hsr_get_skb_sequence_nr(skb) - 1;
         } else {
-                WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
+                /* this is called also for frames from master port and
+                 * so warn only for non master ports
+                 */
+                if (port->type != HSR_PT_MASTER)
+                        WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
                 seq_out = HSR_SEQNR_START;
         }
 
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 438b40f98f5a..4e04f0e868e9 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -18,7 +18,7 @@ struct hsr_node;
 
 struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
                               u16 seq_out);
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup);
 void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
                           struct hsr_port *port);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index d7efbf0dad20..0a866f332290 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -107,7 +107,7 @@ static void lowpan_setup(struct net_device *ldev)
 
         ldev->netdev_ops        = &lowpan_netdev_ops;
         ldev->header_ops        = &lowpan_header_ops;
-        ldev->destructor        = free_netdev;
+        ldev->needs_free_netdev = true;
         ldev->features          |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                 .type =       SOCK_DGRAM,
                 .protocol =   IPPROTO_ICMP,
                 .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                 .flags =      INET_PROTOSW_REUSE,
        },
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index d54345a06f72..e9f3386a528b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -641,6 +641,32 @@ void arp_xmit(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(arp_xmit);
 
+static bool arp_is_garp(struct net *net, struct net_device *dev,
+                        int *addr_type, __be16 ar_op,
+                        __be32 sip, __be32 tip,
+                        unsigned char *sha, unsigned char *tha)
+{
+        bool is_garp = tip == sip;
+
+        /* Gratuitous ARP _replies_ also require target hwaddr to be
+         * the same as source.
+         */
+        if (is_garp && ar_op == htons(ARPOP_REPLY))
+                is_garp =
+                        /* IPv4 over IEEE 1394 doesn't provide target
+                         * hardware address field in its ARP payload.
+                         */
+                        tha &&
+                        !memcmp(tha, sha, dev->addr_len);
+
+        if (is_garp) {
+                *addr_type = inet_addr_type_dev_table(net, dev, sip);
+                if (*addr_type != RTN_UNICAST)
+                        is_garp = false;
+        }
+        return is_garp;
+}
+
 /*
  *      Process an arp request.
  */
@@ -837,29 +863,25 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
-        if (IN_DEV_ARP_ACCEPT(in_dev)) {
-                unsigned int addr_type = inet_addr_type_dev_table(net, dev, sip);
+        addr_type = -1;
+        if (n || IN_DEV_ARP_ACCEPT(in_dev)) {
+                is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
+                                      sip, tip, sha, tha);
+        }
 
+        if (IN_DEV_ARP_ACCEPT(in_dev)) {
                 /* Unsolicited ARP is not accepted by default.
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
                  */
-                is_garp = tip == sip && addr_type == RTN_UNICAST;
-
-                /* Unsolicited ARP _replies_ also require target hwaddr to be
-                 * the same as source.
-                 */
-                if (is_garp && arp->ar_op == htons(ARPOP_REPLY))
-                        is_garp =
-                                /* IPv4 over IEEE 1394 doesn't provide target
-                                 * hardware address field in its ARP payload.
-                                 */
-                                tha &&
-                                !memcmp(tha, sha, dev->addr_len);
-
                 if (!n &&
-                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
-                                addr_type == RTN_UNICAST) || is_garp))
+                    (is_garp ||
+                     (arp->ar_op == htons(ARPOP_REPLY) &&
+                      (addr_type == RTN_UNICAST ||
+                       (addr_type < 0 &&
+                        /* postpone calculation to as late as possible */
+                        inet_addr_type_dev_table(net, dev, sip) ==
+                                RTN_UNICAST)))))
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 65cc02bd82bc..93322f895eab 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         u8 *tail;
         u8 *vaddr;
         int nfrags;
+        int esph_offset;
         struct page *page;
         struct sk_buff *trailer;
         int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         }
 
 cow:
+        esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
+
         nfrags = skb_cow_data(skb, tailen, &trailer);
         if (nfrags < 0)
                 goto out;
         tail = skb_tail_pointer(trailer);
-        esp->esph = ip_esp_hdr(skb);
+        esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
 
 skip_cow:
         esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index da449ddb8cc1..ad9ad4aab5da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -203,6 +203,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 static void free_fib_info_rcu(struct rcu_head *head)
 {
         struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        struct dst_metrics *m;
 
         change_nexthops(fi) {
                 if (nexthop_nh->nh_dev)
@@ -213,8 +214,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                 rt_fibinfo_free(&nexthop_nh->nh_rth_input);
         } endfor_nexthops(fi);
 
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
-                kfree(fi->fib_metrics);
+        m = fi->fib_metrics;
+        if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
+                kfree(m);
         kfree(fi);
 }
 
@@ -971,11 +973,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                         val = 255;
                 if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                         return -EINVAL;
-                fi->fib_metrics[type - 1] = val;
+                fi->fib_metrics->metrics[type - 1] = val;
         }
 
         if (ecn_ca)
-                fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+                fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
 
         return 0;
 }
@@ -1033,11 +1035,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                 goto failure;
         fib_info_cnt++;
         if (cfg->fc_mx) {
-                fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
                 if (!fi->fib_metrics)
                         goto failure;
+                atomic_set(&fi->fib_metrics->refcnt, 1);
         } else
-                fi->fib_metrics = (u32 *) dst_default_metrics;
+                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
 
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
@@ -1238,7 +1241,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
         if (fi->fib_priority &&
             nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
                 goto nla_put_failure;
-        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+        if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0)
                 goto nla_put_failure;
 
         if (fi->fib_prefsrc &&
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 43318b5f5647..9144fa7df2ad 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -657,8 +657,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         /* Needed by both icmp_global_allow and icmp_xmit_lock */
         local_bh_disable();
 
-        /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv4_global_allow(net, type, code))
+        /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
+         * incoming dev is loopback.  If outgoing dev change to not be
+         * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
+         */
+        if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
+              !icmpv4_global_allow(net, type, code))
                 goto out_bh_enable;
 
         sk = icmp_xmit_lock(net);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44fd86de2823..ec9a396fa466 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1112,6 +1112,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
         if (!pmc)
                 return;
+        spin_lock_init(&pmc->lock);
         spin_lock_bh(&im->lock);
         pmc->interface = im->interface;
         in_dev_hold(in_dev);
@@ -2071,21 +2072,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
 static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
-        struct ip_sf_list *psf, *nextpsf;
+        struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
 
-        for (psf = pmc->tomb; psf; psf = nextpsf) {
+        spin_lock_bh(&pmc->lock);
+        tomb = pmc->tomb;
+        pmc->tomb = NULL;
+        sources = pmc->sources;
+        pmc->sources = NULL;
+        pmc->sfmode = MCAST_EXCLUDE;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
+        pmc->sfcount[MCAST_EXCLUDE] = 1;
+        spin_unlock_bh(&pmc->lock);
+
+        for (psf = tomb; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->tomb = NULL;
-        for (psf = pmc->sources; psf; psf = nextpsf) {
+        for (psf = sources; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->sources = NULL;
-        pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_INCLUDE] = 0;
-        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 
 /* Join a multicast group
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7a3fd25e8913..532b36e9ce2a 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -964,7 +964,8 @@ static int __ip_append_data(struct sock *sk,
                 csummode = CHECKSUM_PARTIAL;
 
         cork->length += length;
-        if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
+        if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+             (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b878ecbc0608..129d1a3616f8 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
         return 0;
 
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
         kfree_skb(skb);
         return 0;
 }
@@ -967,7 +969,6 @@ static void ip_tunnel_dev_free(struct net_device *dev)
         gro_cells_destroy(&tunnel->gro_cells);
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
@@ -1155,7 +1156,8 @@ int ip_tunnel_init(struct net_device *dev)
         struct iphdr *iph = &tunnel->parms.iph;
         int err;
 
-        dev->destructor = ip_tunnel_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip_tunnel_dev_free;
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 551de4d023a8..8ae425cad818 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -101,8 +101,8 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 static void ipmr_free_table(struct mr_table *mrt);
 
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local);
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
@@ -501,7 +501,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
@@ -988,7 +988,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
 
                         rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                 } else {
-                        ip_mr_forward(net, mrt, skb, c, 0);
+                        ip_mr_forward(net, mrt, skb->dev, skb, c, 0);
                 }
         }
 }
@@ -1073,7 +1073,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
 
 /* Queue a packet for resolution. It gets locked cache entry! */
 static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb, struct net_device *dev)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct mfc_cache *c;
@@ -1130,6 +1130,10 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
                 kfree_skb(skb);
                 err = -ENOBUFS;
         } else {
+                if (dev) {
+                        skb->dev = dev;
+                        skb->skb_iif = dev->ifindex;
+                }
                 skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
                 err = 0;
         }
@@ -1828,10 +1832,10 @@ static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 
 /* "local" means that we should preserve one skb (for local delivery) */
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local)
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local)
 {
-        int true_vifi = ipmr_find_vif(mrt, skb->dev);
+        int true_vifi = ipmr_find_vif(mrt, dev);
         int psend = -1;
         int vif, ct;
 
@@ -1853,13 +1857,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt,
         }
 
         /* Wrong interface: drop packet and (maybe) send PIM assert. */
-        if (mrt->vif_table[vif].dev != skb->dev) {
-                struct net_device *mdev;
-
-                mdev = l3mdev_master_dev_rcu(mrt->vif_table[vif].dev);
-                if (mdev == skb->dev)
-                        goto forward;
-
+        if (mrt->vif_table[vif].dev != dev) {
                 if (rt_is_output_route(skb_rtable(skb))) {
                         /* It is our own packet, looped back.
                          * Very complicated situation...
@@ -2053,7 +2051,7 @@ int ip_mr_input(struct sk_buff *skb)
                 read_lock(&mrt_lock);
                 vif = ipmr_find_vif(mrt, dev);
                 if (vif >= 0) {
-                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb, dev);
                         read_unlock(&mrt_lock);
 
                         return err2;
@@ -2064,7 +2062,7 @@ int ip_mr_input(struct sk_buff *skb)
         }
 
         read_lock(&mrt_lock);
-        ip_mr_forward(net, mrt, skb, cache, local);
+        ip_mr_forward(net, mrt, dev, skb, cache, local);
         read_unlock(&mrt_lock);
 
         if (local)
@@ -2238,7 +2236,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
                 iph->saddr = saddr;
                 iph->daddr = daddr;
                 iph->version = 0;
-                err = ipmr_cache_unresolved(mrt, vif, skb2);
+                err = ipmr_cache_unresolved(mrt, vif, skb2, dev);
                 read_unlock(&mrt_lock);
                 rcu_read_unlock();
                 return err;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 655d9eebe43e..6883b3d4ba8f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1385,8 +1385,12 @@ static void rt_add_uncached_list(struct rtable *rt)
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
         struct rtable *rt = (struct rtable *) dst;
 
+        if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt))
+                kfree(p);
+
         if (!list_empty(&rt->rt_uncached)) {
                 struct uncached_list *ul = rt->rt_uncached_list;
 
@@ -1438,7 +1442,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
                         rt->rt_gateway = nh->nh_gw;
                         rt->rt_uses_gateway = 1;
                 }
-                dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+                dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true);
+                if (fi->fib_metrics != &dst_default_metrics) {
+                        rt->dst._metrics |= DST_METRICS_REFCOUNTED;
+                        atomic_inc(&fi->fib_metrics->refcnt);
+                }
 #ifdef CONFIG_IP_ROUTE_CLASSID
                 rt->dst.tclassid = nh->nh_tclassid;
 #endif
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1e4c76d2b827..40aca7803cf2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1084,9 +1084,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
         int err, flags;
 
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                 return -EOPNOTSUPP;
         if (tp->fastopen_req)
                 return -EALREADY; /* Another Fast Open is in progress */
@@ -1108,7 +1111,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                 }
         }
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                     msg->msg_namelen, flags, 1);
         /* fastopen_req could already be freed in __inet_stream_connect
          * if the connection times out or gets rst
@@ -2320,9 +2323,15 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
+        /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+         * issue in __tcp_select_window()
+         */
+        icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
+        dst_release(sk->sk_rx_dst);
+        sk->sk_rx_dst = NULL;
         tcp_saved_syn_free(tp);
 
         /* Clean up fastopen related fields */
@@ -2374,9 +2383,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
         return 0;
 }
 
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                 struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_repair_opt opt;
 
         while (len >= sizeof(opt)) {
@@ -2389,6 +2399,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                 switch (opt.opt_code) {
                 case TCPOPT_MSS:
                         tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                         break;
                 case TCPOPT_WINDOW:
                         {
@@ -2548,7 +2559,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 if (!tp->repair)
                         err = -EINVAL;
                 else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                         (struct tcp_repair_opt __user *)optval,
                                         optlen);
                 else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
 
+        tcp_sk(sk)->prior_ssthresh = 0;
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
         if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6a4fb1e629fb..1d2dbace42ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -332,9 +332,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
                                    unsigned long delay)
 {
-        if (!delayed_work_pending(&ifp->dad_work))
-                in6_ifa_hold(ifp);
-        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+        in6_ifa_hold(ifp);
+        if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
+                in6_ifa_put(ifp);
 }
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -3369,6 +3369,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
+        struct net *net = dev_net(dev);
         int run_pending = 0;
         int err;
 
@@ -3384,7 +3385,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
         case NETDEV_CHANGEMTU:
                 /* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
                 if (dev->mtu < IPV6_MIN_MTU) {
-                        addrconf_ifdown(dev, 1);
+                        addrconf_ifdown(dev, dev != net->loopback_dev);
                         break;
                 }
 
@@ -3500,7 +3501,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                          * IPV6_MIN_MTU stop IPv6 on this interface.
                          */
                         if (dev->mtu < IPV6_MIN_MTU)
-                                addrconf_ifdown(dev, 1);
+                                addrconf_ifdown(dev, dev != net->loopback_dev);
                 }
                 break;
 
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         struct ipv6hdr *ip6_hdr;
         struct ipv6_opt_hdr *hop;
         unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
         unsigned int start, end;
 
         ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         if (ret_val < 0)
                 return ret_val;
 
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
+
         if (len_delta) {
                 if (len_delta > 0)
                         skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                         sizeof(*ip6_hdr) + start);
                 skb_reset_network_header(skb);
                 ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
         }
 
         hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e011122ebd43..5c786f5ab961 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -250,8 +250,14 @@ ipv4_connected:
          */
 
         err = ip6_datagram_dst_update(sk, true);
-        if (err)
+        if (err) {
+                /* Reset daddr and dport so that udp_v6_early_demux()
+                 * fails to find this socket
+                 */
+                memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
+                inet->inet_dport = 0;
                 goto out;
+        }
 
         sk->sk_state = TCP_ESTABLISHED;
         sk_set_txhash(sk);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index d950d43ba255..f02f131f6435 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -30,6 +30,25 @@
 #include <net/ipv6.h>
 #include <linux/icmpv6.h>
 
+static __u16 esp6_nexthdr_esp_offset(struct ipv6hdr *ipv6_hdr, int nhlen)
+{
+        int off = sizeof(struct ipv6hdr);
+        struct ipv6_opt_hdr *exthdr;
+
+        if (likely(ipv6_hdr->nexthdr == NEXTHDR_ESP))
+                return offsetof(struct ipv6hdr, nexthdr);
+
+        while (off < nhlen) {
+                exthdr = (void *)ipv6_hdr + off;
+                if (exthdr->nexthdr == NEXTHDR_ESP)
+                        return off;
+
+                off += ipv6_optlen(exthdr);
+        }
+
+        return 0;
+}
+
 static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
                                          struct sk_buff *skb)
 {
@@ -38,6 +57,7 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
         struct xfrm_state *x;
         __be32 seq;
         __be32 spi;
+        int nhoff;
         int err;
 
         skb_pull(skb, offset);
@@ -72,6 +92,11 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
 
         xo->flags |= XFRM_GRO;
 
+        nhoff = esp6_nexthdr_esp_offset(ipv6_hdr(skb), offset);
+        if (!nhoff)
+                goto out;
+
+        IP6CB(skb)->nhoff = nhoff;
         XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
         XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index eea23b57c6a5..ec849d88a662 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -32,7 +32,6 @@ struct fib6_rule {
 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                    int flags, pol_lookup_t lookup)
 {
-        struct rt6_info *rt;
         struct fib_lookup_arg arg = {
                 .lookup_ptr = lookup,
                 .flags = FIB_LOOKUP_NOREF,
@@ -44,21 +43,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
         fib_rules_lookup(net->ipv6.fib6_rules_ops,
                          flowi6_to_flowi(fl6), flags, &arg);
 
-        rt = arg.result;
+        if (arg.result)
+                return arg.result;
 
-        if (!rt) {
-                dst_hold(&net->ipv6.ip6_null_entry->dst);
-                return &net->ipv6.ip6_null_entry->dst;
-        }
-
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
-                ip6_rt_put(rt);
-                rt = net->ipv6.ip6_null_entry;
-                dst_hold(&rt->dst);
-        }
-
-        return &rt->dst;
+        dst_hold(&net->ipv6.ip6_null_entry->dst);
+        return &net->ipv6.ip6_null_entry->dst;
 }
 
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
@@ -121,7 +110,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                         flp6->saddr = saddr;
                 }
                 err = rt->dst.error;
-                goto out;
+                if (err != -EAGAIN)
+                        goto out;
         }
 again:
         ip6_rt_put(rt);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 230b5aac9f03..8d7b113958b1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -491,7 +491,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         local_bh_disable();
 
         /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv6_global_allow(type))
+        if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
                 goto out_bh_enable;
 
         mip6_addr_swap(skb);
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 2fd5ca151dcf..77f7f8c7d93d 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -62,6 +62,7 @@ static inline u32 ila_locator_hash(struct ila_locator loc)
 {
         u32 *v = (u32 *)loc.v32;
 
+        __ila_hash_secret_init();
         return jhash_2words(v[0], v[1], hashrnd);
 }
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d4bf2c68a545..e6b78ba0e636 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
         struct rt6_info *rt;
 
         rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
+        if (rt->dst.error == -EAGAIN) {
                 ip6_rt_put(rt);
                 rt = net->ipv6.ip6_null_entry;
                 dst_hold(&rt->dst);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8d128ba79b66..64eea3962733 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -537,11 +537,10 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                          & IPV6_TCLASS_MASK;
+                dsfield = ipv4_get_dsfield(iph);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                 fl6.flowi6_mark = skb->mark;
         else
@@ -598,9 +597,11 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+                dsfield = ipv6_get_dsfield(ipv6h);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
+
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                 fl6.flowlabel |= ip6_flowlabel(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -990,13 +991,13 @@ static void ip6gre_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ip6gre_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6gre_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->type = ARPHRD_IP6GRE;
 
@@ -1147,7 +1148,7 @@ static int __net_init ip6gre_init_net(struct net *net)
         return 0;
 
 err_reg_dev:
-        ip6gre_dev_free(ign->fb_tunnel_dev);
+        free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
         return err;
 }
@@ -1299,7 +1300,8 @@ static void ip6gre_tap_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &ip6gre_tap_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 280268f1dd7b..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -116,8 +116,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
                 if (udpfrag) {
                         int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        if (err < 0)
+                        if (err < 0) {
+                                kfree_skb_list(segs);
                                 return ERR_PTR(err);
+                        }
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                         fptr->frag_off = htons(offset);
                         if (skb->next)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d4a31becbd25..1699acb2fa2c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1390,7 +1390,7 @@ emsgsize:
          */
 
         cork->length += length;
-        if ((((length + fragheaderlen) > mtu) ||
+        if ((((length + (skb ? skb->len : headersize)) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
@@ -1466,6 +1466,11 @@ alloc_new_skb:
                          */
                         alloclen += sizeof(struct frag_hdr);
 
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len,
@@ -1515,13 +1520,9 @@ alloc_new_skb:
                                 data += fraggap;
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
-                        copy = datalen - transhdrlen - fraggap;
-
-                        if (copy < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
+                                    copy, fraggap, skb) < 0) {
                                 err = -EFAULT;
                                 kfree_skb(skb);
                                 goto error;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 6eb2ae507500..8c6c3c8e7eef 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -254,7 +254,6 @@ static void ip6_dev_free(struct net_device *dev)
         gro_cells_destroy(&t->gro_cells);
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int ip6_tnl_create2(struct net_device *dev)
@@ -322,7 +321,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         return t;
 
 failed_free:
-        ip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return ERR_PTR(err);
 }
@@ -859,6 +858,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
         return 0;
 
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
         kfree_skb(skb);
         return 0;
 }
@@ -1095,6 +1096,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 
         if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
+
                 dst = ip6_route_output(net, NULL, fl6);
 
                 if (dst->error)
@@ -1196,7 +1200,7 @@ route_lookup:
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
-        ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield),
+        ip6_flow_hdr(ipv6h, dsfield,
                      ip6_make_flowlabel(net, skb, fl6->flowlabel, true, fl6));
         ipv6h->hop_limit = hop_limit;
         ipv6h->nexthdr = proto;
@@ -1231,8 +1235,6 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (tproto != IPPROTO_IPIP && tproto != 0)
                 return -1;
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1246,6 +1248,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield =  key->tos;
         } else {
                 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                         encap_limit = t->parms.encap_limit;
@@ -1254,8 +1257,9 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                         & IPV6_TCLASS_MASK;
+                        dsfield = ipv4_get_dsfield(iph);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                         fl6.flowi6_mark = skb->mark;
                 else
@@ -1267,6 +1271,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPIP);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1300,8 +1306,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        dsfield = ipv6_get_dsfield(ipv6h);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1315,6 +1319,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield = key->tos;
         } else {
                 offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
                 /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
@@ -1337,7 +1342,9 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= (*(__be32 *)ipv6h & IPV6_TCLASS_MASK);
+                        dsfield = ipv6_get_dsfield(ipv6h);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                         fl6.flowlabel |= ip6_flowlabel(ipv6h);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -1351,6 +1358,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1769,7 +1778,8 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6_tnl_netdev_ops;
-        dev->destructor = ip6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->flags |= IFF_NOARP;
@@ -2216,7 +2226,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         return 0;
 
 err_register:
-        ip6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d67ef56454b2..837ea1eefe7f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -180,7 +180,6 @@ vti6_tnl_unlink(struct vti6_net *ip6n, struct ip6_tnl *t)
 static void vti6_dev_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int vti6_tnl_create2(struct net_device *dev)
@@ -235,7 +234,7 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p
         return t;
 
 failed_free:
-        vti6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -842,7 +841,8 @@ static const struct net_device_ops vti6_netdev_ops = {
 static void vti6_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &vti6_netdev_ops;
-        dev->destructor = vti6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = vti6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
@@ -1100,7 +1100,7 @@ static int __net_init vti6_init_net(struct net *net)
         return 0;
 
 err_register:
-        vti6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 374997d26488..2ecb39b943b5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -733,7 +733,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
         .type =      SOCK_DGRAM,
         .protocol =  IPPROTO_ICMPV6,
         .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
         .flags =     INET_PROTOSW_REUSE,
 };
 
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index cc8e3ae9ca73..e88bcb8ff0fd 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
         u64 buff64[SNMP_MIB_MAX];
         int i;
 
-        memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
+        memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
 
         snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
         for (i = 0; itemlist[i].name; i++)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
         .family            = PF_INET6,
         .owner             = THIS_MODULE,
         .release           = inet6_release,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index dc61b0b5e64e..322bd62e688b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2804,6 +2804,7 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
         if ((rt->dst.dev == dev || !dev) &&
             rt != adn->net->ipv6.ip6_null_entry &&
             (rt->rt6i_nsiblings == 0 ||
+             (dev && netdev_unregistering(dev)) ||
              !rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
                 return -1;
 
@@ -3721,7 +3722,11 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
                 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 #endif
-         } else if (event == NETDEV_UNREGISTER) {
+         } else if (event == NETDEV_UNREGISTER &&
+                    dev->reg_state != NETREG_UNREGISTERED) {
+                /* NETDEV_UNREGISTER could be fired for multiple times by
+                 * netdev_wait_allrefs(). Make sure we only call this once.
+                 */
                 in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
                 in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 61e5902f0687..f8ad15891cd7 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -265,7 +265,7 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         return nt;
 
 failed_free:
-        ipip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -305,7 +305,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
          * we try harder to allocate.
          */
         kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
-                kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
+                kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) :
                 NULL;
 
         rcu_read_lock();
@@ -1336,7 +1336,6 @@ static void ipip6_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 #define SIT_FEATURES (NETIF_F_SG           | \
@@ -1351,7 +1350,8 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
         dev->netdev_ops         = &ipip6_netdev_ops;
-        dev->destructor         = ipip6_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = ipip6_dev_free;
 
         dev->type               = ARPHRD_SIT;
         dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 06ec39b79609..75703fda23e7 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -879,7 +879,8 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net,
         struct sock *sk;
 
         udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                if (INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
+                if (sk->sk_state == TCP_ESTABLISHED &&
+                    INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
                         return sk;
                 /* Only check first socket in chain */
                 break;
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 08a807b29298..3ef5d913e7a3 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -43,8 +43,8 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
                 return 1;
 #endif
 
-        ipv6_hdr(skb)->payload_len = htons(skb->len);
         __skb_push(skb, skb->data - skb_network_header(skb));
+        ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 
         if (xo && (xo->flags & XFRM_GRO)) {
                 skb_mac_header_rebuild(skb);
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = ipv6_hdr(skb);
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 74d09f91709e..3be852808a9d 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -65,7 +65,7 @@ static void irlan_eth_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops         = &irlan_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->min_mtu            = 0;
         dev->max_mtu            = ETH_MAX_MTU;
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c1950bb14735..b1432b668033 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1157,6 +1157,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                         goto out;
         }
 
+        err = -ENOBUFS;
         key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
         if (sa->sadb_sa_auth) {
                 int keysize = 0;
@@ -1168,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                 if (key)
                         keysize = (key->sadb_key_bits + 7) / 8;
                 x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
-                if (!x->aalg)
+                if (!x->aalg) {
+                        err = -ENOMEM;
                         goto out;
+                }
                 strcpy(x->aalg->alg_name, a->name);
                 x->aalg->alg_key_len = 0;
                 if (key) {
@@ -1188,8 +1191,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                                 goto out;
                         }
                         x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
-                        if (!x->calg)
+                        if (!x->calg) {
+                                err = -ENOMEM;
                                 goto out;
+                        }
                         strcpy(x->calg->alg_name, a->name);
                         x->props.calgo = sa->sadb_sa_encrypt;
                 } else {
@@ -1203,8 +1208,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                         if (key)
                                 keysize = (key->sadb_key_bits + 7) / 8;
                         x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
-                        if (!x->ealg)
+                        if (!x->ealg) {
+                                err = -ENOMEM;
                                 goto out;
+                        }
                         strcpy(x->ealg->alg_name, a->name);
                         x->ealg->alg_key_len = 0;
                         if (key) {
@@ -1249,8 +1256,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                 struct xfrm_encap_tmpl *natt;
 
                 x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
-                if (!x->encap)
+                if (!x->encap) {
+                        err = -ENOMEM;
                         goto out;
+                }
 
                 natt = x->encap;
                 n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
@@ -2755,6 +2764,8 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad
         int err, err2;
 
         err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true);
+        if (!err)
+                xfrm_garbage_collect(net);
         err2 = unicast_flush_resp(sk, hdr);
         if (err || err2) {
                 if (err == -ESRCH) /* empty table - old silent behavior */
@@ -3285,7 +3296,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 p += pol->sadb_x_policy_len*8;
                 sec_ctx = (struct sadb_x_sec_ctx *)p;
                 if (len < pol->sadb_x_policy_len*8 +
-                    sec_ctx->sadb_x_sec_len) {
+                    sec_ctx->sadb_x_sec_len*8) {
                         *dir = -EINVAL;
                         goto out;
                 }
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8b21af7321b9..4de2ec94b08c 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -114,12 +114,13 @@ static void l2tp_eth_get_stats64(struct net_device *dev,
 {
         struct l2tp_eth *priv = netdev_priv(dev);
 
-        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
-        stats->tx_packets = atomic_long_read(&priv->tx_packets);
-        stats->tx_dropped = atomic_long_read(&priv->tx_dropped);
-        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
-        stats->rx_packets = atomic_long_read(&priv->rx_packets);
-        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        stats->tx_bytes   = (unsigned long) atomic_long_read(&priv->tx_bytes);
+        stats->tx_packets = (unsigned long) atomic_long_read(&priv->tx_packets);
+        stats->tx_dropped = (unsigned long) atomic_long_read(&priv->tx_dropped);
+        stats->rx_bytes   = (unsigned long) atomic_long_read(&priv->rx_bytes);
+        stats->rx_packets = (unsigned long) atomic_long_read(&priv->rx_packets);
+        stats->rx_errors  = (unsigned long) atomic_long_read(&priv->rx_errors);
+
 }
 
 static const struct net_device_ops l2tp_eth_netdev_ops = {
@@ -141,7 +142,7 @@ static void l2tp_eth_dev_setup(struct net_device *dev)
         dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
         dev->features           |= NETIF_F_LLTX;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8364fe5b59e4..c38d16f22d2a 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         int rc = -EINVAL;
 
         dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
+
+        lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
         llc_sap_put(sap);
 out:
+        release_sock(sk);
         return rc;
 }
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_start_txq(sta, tid, true);
 }
 
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
 
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
 
         if (tid >= IEEE80211_NUM_TIDS) {
                 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                        tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
                 ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
 
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                 ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
 
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
-                goto unlock;
-
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
-
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
+        return tid_tx;
 }
 
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         bool send_delba = false;
 
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-
-        mutex_lock(&local->sta_mtx);
-
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
         spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sdata,
                        "unexpected callback to A-MPDU stop for %pM tid %d\n",
                        sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         spin_unlock_bh(&sta->lock);
 
         if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6c2e6060cd54..4a388fe8c2d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -902,6 +902,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         default:
                 return -EINVAL;
         }
+        sdata->u.ap.req_smps = sdata->smps_mode;
+
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
         int i;
 
-        cancel_work_sync(&sta->ampdu_mlme.work);
-
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                 __ieee80211_stop_tx_ba_session(sta, i, reason);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                                reason != AGG_STOP_DESTROY_STA &&
                                                reason != AGG_STOP_PEER_REQUEST);
         }
+
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                 spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
-                                                 &tid_tx->state))
+                if (!tid_tx)
+                        continue;
+
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
                                                         AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
         }
         mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..5e002f62c235 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
         IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
         IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
         return local->hw.wiphy->bands[band];
 }
 
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
-
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
         struct cfg80211_chan_def chandef;
@@ -1539,7 +1531,7 @@ ieee80211_have_rx_timestamp(struct ieee80211_rx_status *status)
                 return true;
         /* can't handle non-legacy preamble yet */
         if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
-            status->encoding != RX_ENC_LEGACY)
+            status->encoding == RX_ENC_LEGACY)
                 return true;
         return false;
 }
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..f5f50150ba1c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1213,7 +1213,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
 static void ieee80211_if_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ieee80211_if_setup(struct net_device *dev)
@@ -1221,7 +1220,8 @@ static void ieee80211_if_setup(struct net_device *dev)
         ether_setup(dev);
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops = &ieee80211_dataif_ops;
-        dev->destructor = ieee80211_if_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ieee80211_if_free;
 }
 
 static void ieee80211_if_setup_no_queue(struct net_device *dev)
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
         struct ieee80211_rx_agg *rx_agg;
 
         if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
         while ((skb = skb_dequeue(&sdata->skb_queue))) {
                 struct ieee80211_mgmt *mgmt = (void *)skb->data;
 
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                         rx_agg = (void *)&skb->cb;
                         mutex_lock(&local->sta_mtx);
                         sta = sta_info_get_bss(sdata, rx_agg->addr);
@@ -1825,6 +1816,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 ret = dev_alloc_name(ndev, ndev->name);
                 if (ret < 0) {
                         ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
 
@@ -1914,7 +1906,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
                 ret = register_netdevice(ndev);
                 if (ret) {
-                        ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0ea9712bd99e..cc8e6ea1b27e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -601,7 +601,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        u32 rate_flags, rates = 0;
+        u32 rates = 0;
 
         sdata_assert_lock(sdata);
 
@@ -612,7 +612,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 return;
         }
         chan = chanctx_conf->def.chan;
-        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
         rcu_read_unlock();
         sband = local->hw.wiphy->bands[chan->band];
         shift = ieee80211_vif_get_shift(&sdata->vif);
@@ -636,9 +635,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                  */
                 rates_len = 0;
                 for (i = 0; i < sband->n_bitrates; i++) {
-                        if ((rate_flags & sband->bitrates[i].flags)
-                            != rate_flags)
-                                continue;
                         rates |= BIT(i);
                         rates_len++;
                 }
@@ -2818,7 +2814,7 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                 u32 *rates, u32 *basic_rates,
                                 bool *have_higher_than_11mbit,
                                 int *min_rate, int *min_rate_index,
-                                int shift, u32 rate_flags)
+                                int shift)
 {
         int i, j;
 
@@ -2846,8 +2842,6 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                         int brate;
 
                         br = &sband->bitrates[j];
-                        if ((rate_flags & br->flags) != rate_flags)
-                                continue;
 
                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
                         if (brate == rate) {
@@ -4398,40 +4392,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         return -ENOMEM;
         }
 
-        if (new_sta || override) {
-                err = ieee80211_prep_channel(sdata, cbss);
-                if (err) {
-                        if (new_sta)
-                                sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-        }
-
+        /*
+         * Set up the information for the new channel before setting the
+         * new channel. We can't - completely race-free - change the basic
+         * rates bitmap and the channel (sband) that it refers to, but if
+         * we set it up before we at least avoid calling into the driver's
+         * bss_info_changed() method with invalid information (since we do
+         * call that from changing the channel - only for IDLE and perhaps
+         * some others, but ...).
+         *
+         * So to avoid that, just set up all the new information before the
+         * channel, but tell the driver to apply it only afterwards, since
+         * it might need the new channel for that.
+         */
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
-                struct ieee80211_chanctx_conf *chanctx_conf;
                 const struct cfg80211_bss_ies *ies;
                 int shift = ieee80211_vif_get_shift(&sdata->vif);
-                u32 rate_flags;
-
-                rcu_read_lock();
-                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (WARN_ON(!chanctx_conf)) {
-                        rcu_read_unlock();
-                        sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
-                rcu_read_unlock();
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
                                     &have_higher_than_11mbit,
                                     &min_rate, &min_rate_index,
-                                    shift, rate_flags);
+                                    shift);
 
                 /*
                  * This used to be a workaround for basic rates missing
@@ -4489,8 +4475,22 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         sdata->vif.bss_conf.sync_dtim_count = 0;
                 }
                 rcu_read_unlock();
+        }
 
-                /* tell driver about BSSID, basic rates and timing */
+        if (new_sta || override) {
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        if (new_sta)
+                                sta_info_free(local, new_sta);
+                        return -EINVAL;
+                }
+        }
+
+        if (new_sta) {
+                /*
+                 * tell driver about BSSID, basic rates and timing
+                 * this was set up above, before setting the channel
+                 */
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
                         BSS_CHANGED_BEACON_INT);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 35f4c7d7a500..3674fe3d67dc 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1613,12 +1613,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          */
         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
             !ieee80211_has_morefrags(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-            /* PM bit is only checked in frames where it isn't reserved,
+            /*
+             * PM bit is only checked in frames where it isn't reserved,
              * in AP mode it's reserved in non-bufferable management frames
              * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             * BAR frames should be ignored as specified in
+             * IEEE 802.11-2012 10.2.1.2.
              */
             (!ieee80211_is_mgmt(hdr->frame_control) ||
              ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
@@ -2492,7 +2496,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 if (is_multicast_ether_addr(hdr->addr1)) {
                         mpp_addr = hdr->addr3;
                         proxied_addr = mesh_hdr->eaddr1;
-                } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+                } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+                            MESH_FLAGS_AE_A5_A6) {
                         /* has_a4 already checked in ieee80211_rx_mesh_check */
                         mpp_addr = hdr->addr4;
                         proxied_addr = mesh_hdr->eaddr2;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         struct ieee80211_sta_rx_stats *cpurxs;
 
                         cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                 }
         }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 
 enum ieee80211_agg_stop_reason {
         AGG_STOP_DECLINED,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c1ef22df865f..cc19614ff4e6 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 
 #include "ieee80211_i.h"
 #include "michael.h"
@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
         michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+        if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
                 goto mic_fail;
 
         /* remove Michael MIC from payload */
@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
                                    skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
                                        skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
                 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
                                        skb->data + 24, skb->len - 24,
                                        mic) < 0 ||
-                    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_gmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 06019dba4b10..bd88a9b80773 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -526,8 +526,6 @@ static void mac802154_wpan_free(struct net_device *dev)
         struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         mac802154_llsec_destroy(&sdata->sec);
-
-        free_netdev(dev);
 }
 
 static void ieee802154_if_setup(struct net_device *dev)
@@ -593,7 +591,8 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
                                         sdata->dev->dev_addr);
 
                 sdata->dev->header_ops = &mac802154_header_ops;
-                sdata->dev->destructor = mac802154_wpan_free;
+                sdata->dev->needs_free_netdev = true;
+                sdata->dev->priv_destructor = mac802154_wpan_free;
                 sdata->dev->netdev_ops = &mac802154_wpan_ops;
                 sdata->dev->ml_priv = &mac802154_mlme_wpan;
                 wpan_dev->promiscuous_mode = false;
@@ -608,7 +607,7 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
 
                 break;
         case NL802154_IFTYPE_MONITOR:
-                sdata->dev->destructor = free_netdev;
+                sdata->dev->needs_free_netdev = true;
                 sdata->dev->netdev_ops = &mac802154_monitor_ops;
                 wpan_dev->promiscuous_mode = true;
                 break;
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                 continue;
                         alive++;
                         nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                 } endfor_nexthops(rt);
 
                 WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d2d7bdf1d510..ad99c1ceea6f 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -849,10 +849,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 {
         unsigned int verdict = NF_DROP;
 
-        if (IP_VS_FWD_METHOD(cp) != 0) {
-                pr_err("shouldn't reach here, because the box is on the "
-                       "half connection in the tun/dr module.\n");
-        }
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                goto ignore_cp;
 
         /* Ensure the checksum is correct */
         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
@@ -886,6 +884,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 0);
+
+ignore_cp:
         verdict = NF_ACCEPT;
 
 out:
@@ -1385,8 +1385,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
          */
         cp = pp->conn_out_get(ipvs, af, skb, &iph);
 
-        if (likely(cp))
+        if (likely(cp)) {
+                if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                        goto ignore_cp;
                 return handle_response(af, skb, pd, cp, &iph, hooknum);
+        }
 
         /* Check for real-server-started requests */
         if (atomic_read(&ipvs->conn_out_counter)) {
@@ -1444,9 +1447,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
                         }
                 }
         }
+
+out:
         IP_VS_DBG_PKT(12, af, pp, skb, iph.off,
                       "ip_vs_out: packet continues traversal as normal");
         return NF_ACCEPT;
+
+ignore_cp:
+        __ip_vs_conn_put(cp);
+        goto out;
 }
 
 /*
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 3a60efa7799b..7f6100ca63be 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -174,6 +174,10 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 #endif
         if (h != NULL && !try_module_get(h->me))
                 h = NULL;
+        if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) {
+                module_put(h->me);
+                h = NULL;
+        }
 
         rcu_read_unlock();
 
@@ -181,6 +185,13 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
 
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper)
+{
+        refcount_dec(&helper->refcnt);
+        module_put(helper->me);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_helper_put);
+
 struct nf_conn_help *
 nf_ct_helper_ext_add(struct nf_conn *ct,
                      struct nf_conntrack_helper *helper, gfp_t gfp)
@@ -417,6 +428,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
                         }
                 }
         }
+        refcount_set(&me->refcnt, 1);
         hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
         nf_ct_helper_count++;
 out:
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -888,8 +890,13 @@ restart:
         }
 out:
         local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
+
                 nf_ct_put(last);
+        }
 
         while (i) {
                 i--;
@@ -1007,9 +1014,8 @@ static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
 
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
-                      struct nf_conntrack_tuple *tuple,
-                      enum ctattr_type type, u_int8_t l3num,
-                      struct nf_conntrack_zone *zone)
+                      struct nf_conntrack_tuple *tuple, u32 type,
+                      u_int8_t l3num, struct nf_conntrack_zone *zone)
 {
         struct nlattr *tb[CTA_TUPLE_MAX+1];
         int err;
@@ -1828,6 +1834,8 @@ ctnetlink_create_conntrack(struct net *net,
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
         nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
         nf_ct_labels_ext_add(ct);
+        nfct_seqadj_ext_add(ct);
+        nfct_synproxy_ext_add(ct);
 
         /* we must add conntrack extensions before confirmation. */
         ct->status |= IPS_CONFIRMED;
@@ -2447,7 +2455,7 @@ static struct nfnl_ct_hook ctnetlink_glue_hook = {
 
 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb,
                                     const struct nf_conntrack_tuple *tuple,
-                                    enum ctattr_expect type)
+                                    u32 type)
 {
         struct nlattr *nest_parms;
 
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                       u8 pf, unsigned int hooknum)
 {
         const struct sctphdr *sh;
-        struct sctphdr _sctph;
         const char *logmsg;
 
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
-        if (!sh) {
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
                 logmsg = "nf_ct_sctp: short packet ";
                 goto out_invalid;
         }
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                         logmsg = "nf_ct_sctp: bad CRC ";
                         goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b48d6b5aae8a..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -409,6 +409,10 @@ nf_nat_setup_info(struct nf_conn *ct,
 {
         struct nf_conntrack_tuple curr_tuple, new_tuple;
 
+        /* Can't setup nat info for confirmed ct. */
+        if (nf_ct_is_confirmed(ct))
+                return NF_ACCEPT;
+
         NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
                      maniptype == NF_NAT_MANIP_DST);
         BUG_ON(nf_nat_initialized(ct, maniptype));
@@ -562,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
          * will delete entry from already-freed table.
          */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
         rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                         nf_nat_bysource_params);
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 559225029740..da314be0c048 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3367,35 +3367,50 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
         return nf_tables_fill_setelem(args->skb, set, elem);
 }
 
+struct nft_set_dump_ctx {
+        const struct nft_set    *set;
+        struct nft_ctx          ctx;
+};
+
 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct nft_set_dump_ctx *dump_ctx = cb->data;
         struct net *net = sock_net(skb->sk);
-        u8 genmask = nft_genmask_cur(net);
+        struct nft_af_info *afi;
+        struct nft_table *table;
         struct nft_set *set;
         struct nft_set_dump_args args;
-        struct nft_ctx ctx;
-        struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
+        bool set_found = false;
         struct nfgenmsg *nfmsg;
         struct nlmsghdr *nlh;
         struct nlattr *nest;
         u32 portid, seq;
-        int event, err;
+        int event;
 
-        err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
-                          NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy,
-                          NULL);
-        if (err < 0)
-                return err;
+        rcu_read_lock();
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
+                if (afi != dump_ctx->ctx.afi)
+                        continue;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, cb->skb, cb->nlh,
-                                         (void *)nla, genmask);
-        if (err < 0)
-                return err;
+                list_for_each_entry_rcu(table, &afi->tables, list) {
+                        if (table != dump_ctx->ctx.table)
+                                continue;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
-        if (IS_ERR(set))
-                return PTR_ERR(set);
+                        list_for_each_entry_rcu(set, &table->sets, list) {
+                                if (set == dump_ctx->set) {
+                                        set_found = true;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+                break;
+        }
+
+        if (!set_found) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
 
         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
         portid = NETLINK_CB(cb->skb).portid;
@@ -3407,11 +3422,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                 goto nla_put_failure;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = ctx.afi->family;
+        nfmsg->nfgen_family = afi->family;
         nfmsg->version      = NFNETLINK_V0;
-        nfmsg->res_id       = htons(ctx.net->nft.base_seq & 0xffff);
+        nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
 
-        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
+        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
                 goto nla_put_failure;
         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
                 goto nla_put_failure;
@@ -3422,12 +3437,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 
         args.cb                 = cb;
         args.skb                = skb;
-        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.genmask       = nft_genmask_cur(net);
         args.iter.skip          = cb->args[0];
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        set->ops->walk(&ctx, set, &args.iter);
+        set->ops->walk(&dump_ctx->ctx, set, &args.iter);
+        rcu_read_unlock();
 
         nla_nest_end(skb, nest);
         nlmsg_end(skb, nlh);
@@ -3441,9 +3457,16 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 
 nla_put_failure:
+        rcu_read_unlock();
         return -ENOSPC;
 }
 
+static int nf_tables_dump_set_done(struct netlink_callback *cb)
+{
+        kfree(cb->data);
+        return 0;
+}
+
 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
@@ -3465,7 +3488,18 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = nf_tables_dump_set,
+                        .done = nf_tables_dump_set_done,
                 };
+                struct nft_set_dump_ctx *dump_ctx;
+
+                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
+                if (!dump_ctx)
+                        return -ENOMEM;
+
+                dump_ctx->set = set;
+                dump_ctx->ctx = ctx;
+
+                c.data = dump_ctx;
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
         return -EOPNOTSUPP;
@@ -3593,9 +3627,9 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 {
         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
-        nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
+        nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
-                nft_data_uninit(nft_set_ext_data(ext), set->dtype);
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
@@ -3604,6 +3638,18 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 }
 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
 
+/* Only called from commit path, nft_set_elem_deactivate() already deals with
+ * the refcounting from the preparation phase.
+ */
+static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+{
+        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+                nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+        kfree(elem);
+}
+
 static int nft_setelem_parse_flags(const struct nft_set *set,
                                    const struct nlattr *attr, u32 *flags)
 {
@@ -3815,9 +3861,9 @@ err4:
         kfree(elem.priv);
 err3:
         if (nla[NFTA_SET_ELEM_DATA] != NULL)
-                nft_data_uninit(&data, d2.type);
+                nft_data_release(&data, d2.type);
 err2:
-        nft_data_uninit(&elem.key.val, d1.type);
+        nft_data_release(&elem.key.val, d1.type);
 err1:
         return err;
 }
@@ -3862,6 +3908,53 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
         return err;
 }
 
+/**
+ *      nft_data_hold - hold a nft_data item
+ *
+ *      @data: struct nft_data to release
+ *      @type: type of data
+ *
+ *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
+ *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
+ *      NFT_GOTO verdicts. This function must be called on active data objects
+ *      from the second phase of the commit protocol.
+ */
+static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+{
+        if (type == NFT_DATA_VERDICT) {
+                switch (data->verdict.code) {
+                case NFT_JUMP:
+                case NFT_GOTO:
+                        data->verdict.chain->use++;
+                        break;
+                }
+        }
+}
+
+static void nft_set_elem_activate(const struct net *net,
+                                  const struct nft_set *set,
+                                  struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_hold(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use++;
+}
+
+static void nft_set_elem_deactivate(const struct net *net,
+                                    const struct nft_set *set,
+                                    struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use--;
+}
+
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
                            const struct nlattr *attr)
 {
@@ -3927,6 +4020,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
         kfree(elem.priv);
         elem.priv = priv;
 
+        nft_set_elem_deactivate(ctx->net, set, &elem);
+
         nft_trans_elem(trans) = elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
         return 0;
@@ -3936,7 +4031,7 @@ err4:
 err3:
         kfree(elem.priv);
 err2:
-        nft_data_uninit(&elem.key.val, desc.type);
+        nft_data_release(&elem.key.val, desc.type);
 err1:
         return err;
 }
@@ -4743,8 +4838,8 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                 nft_set_destroy(nft_trans_set(trans));
                 break;
         case NFT_MSG_DELSETELEM:
-                nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv, true);
+                nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
+                                           nft_trans_elem(trans).priv);
                 break;
         case NFT_MSG_DELOBJ:
                 nft_obj_destroy(nft_trans_obj(trans));
@@ -4979,6 +5074,7 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
                 case NFT_MSG_DELSETELEM:
                         te = (struct nft_trans_elem *)trans->data;
 
+                        nft_set_elem_activate(net, te->set, &te->elem);
                         te->set->ops->activate(net, te->set, &te->elem);
                         te->set->ndeact--;
 
@@ -5464,7 +5560,7 @@ int nft_data_init(const struct nft_ctx *ctx,
 EXPORT_SYMBOL_GPL(nft_data_init);
 
 /**
- *      nft_data_uninit - release a nft_data item
+ *      nft_data_release - release a nft_data item
  *
  *      @data: struct nft_data to release
  *      @type: type of data
@@ -5472,7 +5568,7 @@ EXPORT_SYMBOL_GPL(nft_data_init);
  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
  *      all others need to be released by calling this function.
  */
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
+void nft_data_release(const struct nft_data *data, enum nft_data_types type)
 {
         if (type < NFT_DATA_VERDICT)
                 return;
@@ -5483,7 +5579,7 @@ void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
                 WARN_ON(1);
         }
 }
-EXPORT_SYMBOL_GPL(nft_data_uninit);
+EXPORT_SYMBOL_GPL(nft_data_release);
 
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 950bf6eadc65..be678a323598 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -686,6 +686,7 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
+        ret = -ENOENT;
         list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
                 cur = &nlcth->helper;
                 j++;
@@ -699,16 +700,20 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                      tuple.dst.protonum != cur->tuple.dst.protonum))
                         continue;
 
-                found = true;
-                nf_conntrack_helper_unregister(cur);
-                kfree(cur->expect_policy);
+                if (refcount_dec_if_one(&cur->refcnt)) {
+                        found = true;
+                        nf_conntrack_helper_unregister(cur);
+                        kfree(cur->expect_policy);
 
-                list_del(&nlcth->list);
-                kfree(nlcth);
+                        list_del(&nlcth->list);
+                        kfree(nlcth);
+                } else {
+                        ret = -EBUSY;
+                }
         }
 
         /* Make sure we return success if we flush and there is no helpers */
-        return (found || j == 0) ? 0 : -ENOENT;
+        return (found || j == 0) ? 0 : ret;
 }
 
 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 877d9acd91ef..fff8073e2a56 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -83,17 +83,26 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
                             tb[NFTA_BITWISE_MASK]);
         if (err < 0)
                 return err;
-        if (d1.len != priv->len)
-                return -EINVAL;
+        if (d1.len != priv->len) {
+                err = -EINVAL;
+                goto err1;
+        }
 
         err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2,
                             tb[NFTA_BITWISE_XOR]);
         if (err < 0)
-                return err;
-        if (d2.len != priv->len)
-                return -EINVAL;
+                goto err1;
+        if (d2.len != priv->len) {
+                err = -EINVAL;
+                goto err2;
+        }
 
         return 0;
+err2:
+        nft_data_release(&priv->xor, d2.type);
+err1:
+        nft_data_release(&priv->mask, d1.type);
+        return err;
 }
 
 static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 2b96effeadc1..c2945eb3397c 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -201,10 +201,18 @@ nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
         if (err < 0)
                 return ERR_PTR(err);
 
+        if (desc.type != NFT_DATA_VALUE) {
+                err = -EINVAL;
+                goto err1;
+        }
+
         if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
                 return &nft_cmp_fast_ops;
-        else
-                return &nft_cmp_ops;
+
+        return &nft_cmp_ops;
+err1:
+        nft_data_release(&data, desc.type);
+        return ERR_PTR(-EINVAL);
 }
 
 struct nft_expr_type nft_cmp_type __read_mostly = {
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a34ceb38fc55..1678e9e75e8e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -826,9 +826,9 @@ static void nft_ct_helper_obj_destroy(struct nft_object *obj)
         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 
         if (priv->helper4)
-                module_put(priv->helper4->me);
+                nf_conntrack_helper_put(priv->helper4);
         if (priv->helper6)
-                module_put(priv->helper6->me);
+                nf_conntrack_helper_put(priv->helper6);
 }
 
 static void nft_ct_helper_obj_eval(struct nft_object *obj,
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 728baf88295a..4717d7796927 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -65,7 +65,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
         return 0;
 
 err1:
-        nft_data_uninit(&priv->data, desc.type);
+        nft_data_release(&priv->data, desc.type);
         return err;
 }
 
@@ -73,7 +73,8 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
                                   const struct nft_expr *expr)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
-        return nft_data_uninit(&priv->data, nft_dreg_to_type(priv->dreg));
+
+        return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 
 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index 9edc74eedc10..cedb96c3619f 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -102,9 +102,9 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         priv->len = desc_from.len;
         return 0;
 err2:
-        nft_data_uninit(&priv->data_to, desc_to.type);
+        nft_data_release(&priv->data_to, desc_to.type);
 err1:
-        nft_data_uninit(&priv->data_from, desc_from.type);
+        nft_data_release(&priv->data_from, desc_from.type);
         return err;
 }
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 8ec086b6b56b..3d3a6df4ce70 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -222,7 +222,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
         struct nft_set_elem elem;
         int err;
 
-        err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
+        err = rhashtable_walk_init(&priv->ht, &hti, GFP_ATOMIC);
         iter->err = err;
         if (err)
                 return;
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                 else if (d > 0)
                         p = &parent->rb_right;
                 else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                if (nft_rbtree_interval_end(rbe) &&
-                                    !nft_rbtree_interval_end(new))
-                                        p = &parent->rb_left;
-                                else if (!nft_rbtree_interval_end(rbe) &&
-                                         nft_rbtree_interval_end(new))
-                                        p = &parent->rb_right;
-                                else {
-                                        *ext = &rbe->ext;
-                                        return -EEXIST;
-                                }
+                        if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
+                                *ext = &rbe->ext;
+                                return -EEXIST;
+                        } else {
+                                p = &parent->rb_left;
                         }
                 }
         }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8876b7da6884..1770c1d9b37f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -283,28 +283,30 @@ static int xt_obj_to_user(u16 __user *psize, u16 size,
                        &U->u.user.revision, K->u.kernel.TYPE->revision)
 
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size)
+                    int usersize, int size, int aligned_size)
 {
         usersize = usersize ? : size;
         if (copy_to_user(dst, src, usersize))
                 return -EFAULT;
-        if (usersize != size && clear_user(dst + usersize, size - usersize))
+        if (usersize != aligned_size &&
+            clear_user(dst + usersize, aligned_size - usersize))
                 return -EFAULT;
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(xt_data_to_user);
 
-#define XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                             \
+#define XT_DATA_TO_USER(U, K, TYPE)                                     \
         xt_data_to_user(U->data, K->data,                               \
                         K->u.kernel.TYPE->usersize,                     \
-                        C_SIZE ? : K->u.kernel.TYPE->TYPE##size)
+                        K->u.kernel.TYPE->TYPE##size,                   \
+                        XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
 
 int xt_match_to_user(const struct xt_entry_match *m,
                      struct xt_entry_match __user *u)
 {
         return XT_OBJ_TO_USER(u, m, match, 0) ||
-               XT_DATA_TO_USER(u, m, match, 0);
+               XT_DATA_TO_USER(u, m, match);
 }
 EXPORT_SYMBOL_GPL(xt_match_to_user);
 
@@ -312,7 +314,7 @@ int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u)
 {
         return XT_OBJ_TO_USER(u, t, target, 0) ||
-               XT_DATA_TO_USER(u, t, target, 0);
+               XT_DATA_TO_USER(u, t, target);
 }
 EXPORT_SYMBOL_GPL(xt_target_to_user);
 
@@ -611,6 +613,12 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
 
+#define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                      \
+        xt_data_to_user(U->data, K->data,                               \
+                        K->u.kernel.TYPE->usersize,                     \
+                        C_SIZE,                                         \
+                        COMPAT_XT_ALIGN(C_SIZE))
+
 int xt_compat_match_to_user(const struct xt_entry_match *m,
                             void __user **dstptr, unsigned int *size)
 {
@@ -626,7 +634,7 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
                 if (match->compat_to_user((void __user *)cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
+                if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
                         return -EFAULT;
         }
 
@@ -972,7 +980,7 @@ int xt_compat_target_to_user(const struct xt_entry_target *t,
                 if (target->compat_to_user((void __user *)ct->data, t->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
+                if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
                         return -EFAULT;
         }
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index bb7ad82dcd56..623ef37de886 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -96,7 +96,7 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 
         help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
         if (help == NULL) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -263,7 +263,7 @@ out:
 err4:
         help = nfct_help(ct);
         if (help)
-                module_put(help->helper->me);
+                nf_conntrack_helper_put(help->helper);
 err3:
         nf_ct_tmpl_free(ct);
 err2:
@@ -346,7 +346,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
         if (ct) {
                 help = nfct_help(ct);
                 if (help)
-                        module_put(help->helper->me);
+                        nf_conntrack_helper_put(help->helper);
 
                 nf_ct_netns_put(par->net, par->family);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                 goto out;
         }
         NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
         val = netlink_broadcast_deliver(sk, p->skb2);
         if (val < 0) {
                 netlink_overrun(sk);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index bf602e33c40a..08679ebb3068 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1123,7 +1123,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
 
         help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
         if (!help) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -1584,7 +1584,7 @@ void ovs_ct_free_action(const struct nlattr *a)
 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
         if (ct_info->helper)
-                module_put(ct_info->helper->me);
+                nf_conntrack_helper_put(ct_info->helper);
         if (ct_info->ct)
                 nf_ct_tmpl_free(ct_info->ct);
 }
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 89193a634da4..04a3128adcf0 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -94,7 +94,6 @@ static void internal_dev_destructor(struct net_device *dev)
         struct vport *vport = ovs_internal_dev_get_vport(dev);
 
         ovs_vport_free(vport);
-        free_netdev(dev);
 }
 
 static void
@@ -156,7 +155,8 @@ static void do_setup(struct net_device *netdev)
         netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                               IFF_PHONY_HEADROOM | IFF_NO_QUEUE;
-        netdev->destructor = internal_dev_destructor;
+        netdev->needs_free_netdev = true;
+        netdev->priv_destructor = internal_dev_destructor;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 21c28b51be94..2c9337946e30 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -236,7 +236,7 @@ static void gprs_setup(struct net_device *dev)
         dev->tx_queue_len       = 10;
 
         dev->netdev_ops         = &gprs_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 0a4e28477ad9..54369225766e 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                                        unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, n_parts, loop, tmp;
+        unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
 
         /* there must be at least one name, and at least #names+1 length
          * words */
@@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                 toklen -= 4;
                 if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
                         return -EINVAL;
-                if (tmp > toklen)
+                paddedlen = (tmp + 3) & ~3;
+                if (paddedlen > toklen)
                         return -EINVAL;
                 princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
                 if (!princ->name_parts[loop])
                         return -ENOMEM;
                 memcpy(princ->name_parts[loop], xdr, tmp);
                 princ->name_parts[loop][tmp] = 0;
-                tmp = (tmp + 3) & ~3;
-                toklen -= tmp;
-                xdr += tmp >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         if (toklen < 4)
@@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
         toklen -= 4;
         if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
                 return -EINVAL;
-        if (tmp > toklen)
+        paddedlen = (tmp + 3) & ~3;
+        if (paddedlen > toklen)
                 return -EINVAL;
         princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
         if (!princ->realm)
                 return -ENOMEM;
         memcpy(princ->realm, xdr, tmp);
         princ->realm[tmp] = 0;
-        tmp = (tmp + 3) & ~3;
-        toklen -= tmp;
-        xdr += tmp >> 2;
+        toklen -= paddedlen;
+        xdr += paddedlen >> 2;
 
         _debug("%s/...@%s", princ->name_parts[0], princ->realm);
 
@@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
                                          unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
 
         /* there must be at least one tag and one length word */
         if (toklen <= 8)
@@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
         toklen -= 8;
         if (len > max_data_size)
                 return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
         td->data_len = len;
 
         if (len > 0) {
                 td->data = kmemdup(xdr, len, GFP_KERNEL);
                 if (!td->data)
                         return -ENOMEM;
-                len = (len + 3) & ~3;
-                toklen -= len;
-                xdr += len >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         _debug("tag %x len %x", td->tag, td->data_len);
@@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                                     const __be32 **_xdr, unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
 
         /* there must be at least one length word */
         if (toklen <= 4)
@@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
         toklen -= 4;
         if (len > AFSTOKEN_K5_TIX_MAX)
                 return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
         *_tktlen = len;
 
         _debug("ticket len %u", len);
@@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                 *_ticket = kmemdup(xdr, len, GFP_KERNEL);
                 if (!*_ticket)
                         return -ENOMEM;
-                len = (len + 3) & ~3;
-                toklen -= len;
-                xdr += len >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         *_xdr = xdr;
@@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
 {
         const __be32 *xdr = prep->data, *token;
         const char *cp;
-        unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
+        unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
         size_t datalen = prep->datalen;
         int ret;
 
@@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
         if (len < 1 || len > AFSTOKEN_CELL_MAX)
                 goto not_xdr;
         datalen -= 4;
-        tmp = (len + 3) & ~3;
-        if (tmp > datalen)
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > datalen)
                 goto not_xdr;
 
         cp = (const char *) xdr;
         for (loop = 0; loop < len; loop++)
                 if (!isprint(cp[loop]))
                         goto not_xdr;
-        if (len < tmp)
-                for (; loop < tmp; loop++)
-                        if (cp[loop])
-                                goto not_xdr;
+        for (; loop < paddedlen; loop++)
+                if (cp[loop])
+                        goto not_xdr;
         _debug("cellname: [%u/%u] '%*.*s'",
-               len, tmp, len, len, (const char *) xdr);
-        datalen -= tmp;
-        xdr += tmp >> 2;
+               len, paddedlen, len, len, (const char *) xdr);
+        datalen -= paddedlen;
+        xdr += paddedlen >> 2;
 
         /* get the token count */
         if (datalen < 12)
@@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
                 sec_ix = ntohl(*xdr);
                 datalen -= 4;
                 _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
-                if (toklen < 20 || toklen > datalen)
+                paddedlen = (toklen + 3) & ~3;
+                if (toklen < 20 || toklen > datalen || paddedlen > datalen)
                         goto not_xdr;
-                datalen -= (toklen + 3) & ~3;
-                xdr += (toklen + 3) >> 2;
+                datalen -= paddedlen;
+                xdr += paddedlen >> 2;
 
         } while (--loop > 0);
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 164b5ac094be..7dc5892671c8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -94,8 +94,10 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
                 k++;
         }
 
-        if (n)
+        if (n) {
+                err = -EINVAL;
                 goto err_out;
+        }
 
         return keys_ex;
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index f42008b29311..b062bc80c7cb 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -132,21 +132,21 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
                 }
         }
 
-        spin_lock_bh(&police->tcf_lock);
         if (est) {
                 err = gen_replace_estimator(&police->tcf_bstats, NULL,
                                             &police->tcf_rate_est,
                                             &police->tcf_lock,
                                             NULL, est);
                 if (err)
-                        goto failure_unlock;
+                        goto failure;
         } else if (tb[TCA_POLICE_AVRATE] &&
                    (ret == ACT_P_CREATED ||
                     !gen_estimator_active(&police->tcf_rate_est))) {
                 err = -EINVAL;
-                goto failure_unlock;
+                goto failure;
         }
 
+        spin_lock_bh(&police->tcf_lock);
         /* No failure allowed after this point */
         police->tcfp_mtu = parm->mtu;
         if (police->tcfp_mtu == 0) {
@@ -192,8 +192,6 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
 
         return ret;
 
-failure_unlock:
-        spin_unlock_bh(&police->tcf_lock);
 failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index dee469fed967..51859b8edd7e 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -203,7 +203,6 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
 
         *arg = (unsigned long) head;
         rcu_assign_pointer(tp->root, new);
-        call_rcu(&head->rcu, mall_destroy_rcu);
         return 0;
 
 err_replace_hw_filter:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index e88342fde1bc..cfdbfa18a95e 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1019,7 +1019,8 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
                 return sch;
         }
         /* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
-        ops->destroy(sch);
+        if (ops->destroy)
+                ops->destroy(sch);
 err_out3:
         dev_put(dev);
         kfree((char *) sch - sch->padded);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index a9708da28eb5..95238284c422 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1176,7 +1176,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
 
                 asoc->ctsn_ack_point = asoc->next_tsn - 1;
                 asoc->adv_peer_ack_point = asoc->ctsn_ack_point;
-                if (!asoc->stream) {
+
+                if (sctp_state(asoc, COOKIE_WAIT)) {
+                        sctp_stream_free(asoc->stream);
                         asoc->stream = new->stream;
                         new->stream = NULL;
                 }
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 8c589230794f..3dcd0ecf3d99 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -275,6 +275,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
                 if (sctp_sk(sk)->bind_hash)
                         sctp_put_port(sk);
 
+                sctp_sk(sk)->ep = NULL;
                 sock_put(sk);
         }
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0e06a278d2a9..ba9ad32fc447 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
         union sctp_addr saddr;
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
         struct sctp_association *asoc;
         struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
         __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
         *app = NULL; *tpp = NULL;
 
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
          * discard the packet.
          */
         if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-                          + sizeof(__be32) ||
+                /* chunk header + first 4 octects of init header */
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                     chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                         goto out;
-                }
+
         } else if (vtag != asoc->c.peer_vtag) {
                 goto out;
         }
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 048954eee984..9a647214a91e 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -278,7 +278,6 @@ out:
 
 static int sctp_sock_dump(struct sock *sk, void *p)
 {
-        struct sctp_endpoint *ep = sctp_sk(sk)->ep;
         struct sctp_comm_param *commp = p;
         struct sk_buff *skb = commp->skb;
         struct netlink_callback *cb = commp->cb;
@@ -287,7 +286,9 @@ static int sctp_sock_dump(struct sock *sk, void *p)
         int err = 0;
 
         lock_sock(sk);
-        list_for_each_entry(assoc, &ep->asocs, asocs) {
+        if (!sctp_sk(sk)->ep)
+                goto release;
+        list_for_each_entry(assoc, &sctp_sk(sk)->ep->asocs, asocs) {
                 if (cb->args[4] < cb->args[1])
                         goto next;
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8a08f13469c4..92e332e17391 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2454,16 +2454,11 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * stream sequence number shall be set to 0.
          */
 
-        /* Allocate storage for the negotiated streams if it is not a temporary
-         * association.
-         */
-        if (!asoc->temp) {
-                if (sctp_stream_init(asoc, gfp))
-                        goto clean_up;
+        if (sctp_stream_init(asoc, gfp))
+                goto clean_up;
 
-                if (sctp_assoc_set_id(asoc, gfp))
-                        goto clean_up;
-        }
+        if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
+                goto clean_up;
 
         /* ADDIP Section 4.1 ASCONF Chunk Procedures
          *
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 4f5e6cfc7f60..f863b5573e42 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2088,6 +2088,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
                 }
         }
 
+        /* Set temp so that it won't be added into hashtable */
+        new_asoc->temp = 1;
+
         /* Compare the tie_tag in cookie with the verification tag of
          * current association.
          */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f16c8d97b7f3..3a8318e518f1 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4622,13 +4622,13 @@ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
 
         for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
              hash++, head++) {
-                read_lock(&head->lock);
+                read_lock_bh(&head->lock);
                 sctp_for_each_hentry(epb, &head->chain) {
                         err = cb(sctp_ep(epb), p);
                         if (err)
                                 break;
                 }
-                read_unlock(&head->lock);
+                read_unlock_bh(&head->lock);
         }
 
         return err;
@@ -4666,9 +4666,8 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
         if (err)
                 return err;
 
-        sctp_transport_get_idx(net, &hti, pos);
-        obj = sctp_transport_get_next(net, &hti);
-        for (; obj && !IS_ERR(obj); obj = sctp_transport_get_next(net, &hti)) {
+        obj = sctp_transport_get_idx(net, &hti, pos + 1);
+        for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) {
                 struct sctp_transport *transport = obj;
 
                 if (!sctp_transport_hold(transport))
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 24fedd4b117e..03f6b5840764 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -119,11 +119,9 @@ int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
 
         for (i = 0; i < (reqs << 1); i++) {
                 rqst = kzalloc(sizeof(*rqst), GFP_KERNEL);
-                if (!rqst) {
-                        pr_err("RPC:       %s: Failed to create bc rpc_rqst\n",
-                               __func__);
+                if (!rqst)
                         goto out_free;
-                }
+
                 dprintk("RPC:       %s: new rqst %p\n", __func__, rqst);
 
                 rqst->rq_xprt = &r_xprt->rx_xprt;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 16aff8ddc16f..d5b54c020dec 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2432,7 +2432,12 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         case -ENETUNREACH:
         case -EADDRINUSE:
         case -ENOBUFS:
-                /* retry with existing socket, after a delay */
+                /*
+                 * xs_tcp_force_close() wakes tasks with -EIO.
+                 * We need to wake them first to ensure the
+                 * correct error code.
+                 */
+                xprt_wake_pending_tasks(xprt, status);
                 xs_tcp_force_close(xprt);
                 goto out;
         }
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 312ef7de57d7..ab3087687a32 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
         }
 
         if (skb_cloned(_skb) &&
-            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
                 goto exit;
 
         /* Now reverse the concerned fields */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6a7fe7660551..1a0c961f4ffe 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct path path = { };
 
         err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                 goto out;
 
         if (addr_len == sizeof(short)) {
@@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         unsigned int hash;
         int err;
 
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         if (addr->sa_family != AF_UNSPEC) {
                 err = unix_mkname(sunaddr, alen, &hash);
                 if (err < 0)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6f7f6757ceef..dfc8c51e4d74 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1540,8 +1540,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         long timeout;
         int err;
         struct vsock_transport_send_notify_data send_data;
-
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         sk = sock->sk;
         vsk = vsock_sk(sk);
@@ -1584,11 +1583,10 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         if (err < 0)
                 goto out;
 
-
         while (total_written < len) {
                 ssize_t written;
 
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                add_wait_queue(sk_sleep(sk), &wait);
                 while (vsock_stream_has_space(vsk) == 0 &&
                        sk->sk_err == 0 &&
                        !(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1597,33 +1595,30 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
                         /* Don't wait for non-blocking sockets. */
                         if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         err = transport->notify_send_pre_block(vsk, &send_data);
                         if (err < 0) {
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         release_sock(sk);
-                        timeout = schedule_timeout(timeout);
+                        timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
                         lock_sock(sk);
                         if (signal_pending(current)) {
                                 err = sock_intr_errno(timeout);
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         } else if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
-
-                        prepare_to_wait(sk_sleep(sk), &wait,
-                                        TASK_INTERRUPTIBLE);
                 }
-                finish_wait(sk_sleep(sk), &wait);
+                remove_wait_queue(sk_sleep(sk), &wait);
 
                 /* These checks occur both as part of and after the loop
                  * conditional since we need to check before and after
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 14d5f0c8c45f..9f0901f3e42b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -322,9 +322,9 @@ cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
 {
         struct cfg80211_sched_scan_request *pos;
 
-        ASSERT_RTNL();
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
 
-        list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
+        list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
                 if (pos->reqid == reqid)
                         return pos;
         }
@@ -398,13 +398,13 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
         trace_cfg80211_sched_scan_results(wiphy, reqid);
         /* ignore if we're not scanning */
 
-        rtnl_lock();
+        rcu_read_lock();
         request = cfg80211_find_sched_scan_req(rdev, reqid);
         if (request) {
                 request->report_results = true;
                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
         }
-        rtnl_unlock();
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_results);
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7198373e2920..4992f1025c9d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
         if (iftype == NL80211_IFTYPE_MESH_POINT)
                 skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
 
+        mesh_flags &= MESH_FLAGS_AE;
+
         switch (hdr->frame_control &
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
         case cpu_to_le16(IEEE80211_FCTL_TODS):
@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                              iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_dest, 2 * ETH_ALEN);
@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                      ether_addr_equal(tmp.h_source, addr)))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6)
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_source, ETH_ALEN);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 1a4db6790e20..6cdb054484d6 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -914,13 +914,12 @@ int call_commit_handler(struct net_device *dev)
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
  */
-static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+static int wireless_process_ioctl(struct net *net, struct iwreq *iwr,
                                   unsigned int cmd,
                                   struct iw_request_info *info,
                                   wext_ioctl_func standard,
                                   wext_ioctl_func private)
 {
-        struct iwreq *iwr = (struct iwreq *) ifr;
         struct net_device *dev;
         iw_handler      handler;
 
@@ -928,7 +927,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
          * The copy_to/from_user() of ifr is also dealt with in there */
 
         /* Make sure the device exist */
-        if ((dev = __dev_get_by_name(net, ifr->ifr_name)) == NULL)
+        if ((dev = __dev_get_by_name(net, iwr->ifr_name)) == NULL)
                 return -ENODEV;
 
         /* A bunch of special cases, then the generic case...
@@ -957,9 +956,6 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 else if (private)
                         return private(dev, iwr, cmd, info, handler);
         }
-        /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl)
-                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
         return -EOPNOTSUPP;
 }
 
@@ -977,7 +973,7 @@ static int wext_permission_check(unsigned int cmd)
 }
 
 /* entry point from dev ioctl */
-static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
+static int wext_ioctl_dispatch(struct net *net, struct iwreq *iwr,
                                unsigned int cmd, struct iw_request_info *info,
                                wext_ioctl_func standard,
                                wext_ioctl_func private)
@@ -987,9 +983,9 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
         if (ret)
                 return ret;
 
-        dev_load(net, ifr->ifr_name);
+        dev_load(net, iwr->ifr_name);
         rtnl_lock();
-        ret = wireless_process_ioctl(net, ifr, cmd, info, standard, private);
+        ret = wireless_process_ioctl(net, iwr, cmd, info, standard, private);
         rtnl_unlock();
 
         return ret;
@@ -1039,18 +1035,18 @@ static int ioctl_standard_call(struct net_device *	dev,
 }
 
 
-int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,
                       void __user *arg)
 {
         struct iw_request_info info = { .cmd = cmd, .flags = 0 };
         int ret;
 
-        ret = wext_ioctl_dispatch(net, ifr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, iwr, cmd, &info,
                                   ioctl_standard_call,
                                   ioctl_private_call);
         if (ret >= 0 &&
             IW_IS_GET(cmd) &&
-            copy_to_user(arg, ifr, sizeof(struct iwreq)))
+            copy_to_user(arg, iwr, sizeof(struct iwreq)))
                 return -EFAULT;
 
         return ret;
@@ -1107,7 +1103,7 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
         info.cmd = cmd;
         info.flags = IW_REQUEST_FLAG_COMPAT;
 
-        ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, &iwr, cmd, &info,
                                   compat_standard_call,
                                   compat_private_call);
 
diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
index abf81b329dc1..55b2ac300995 100644
--- a/net/xfrm/Makefile
+++ b/net/xfrm/Makefile
@@ -4,8 +4,7 @@
 
 obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
                       xfrm_input.o xfrm_output.o \
-                      xfrm_sysctl.o xfrm_replay.o
-obj-$(CONFIG_XFRM_OFFLOAD) += xfrm_device.o
+                      xfrm_sysctl.o xfrm_replay.o xfrm_device.o
 obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
 obj-$(CONFIG_XFRM_ALGO) += xfrm_algo.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8ec8a3fcf8d4..5aba03685d7d 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -22,6 +22,7 @@
 #include <net/xfrm.h>
 #include <linux/notifier.h>
 
+#ifdef CONFIG_XFRM_OFFLOAD
 int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
 {
         int err;
@@ -137,6 +138,7 @@ ok:
         return true;
 }
 EXPORT_SYMBOL_GPL(xfrm_dev_offload_ok);
+#endif
 
 int xfrm_dev_register(struct net_device *dev)
 {
@@ -170,7 +172,7 @@ static int xfrm_dev_feat_change(struct net_device *dev)
 
 static int xfrm_dev_down(struct net_device *dev)
 {
-        if (dev->hw_features & NETIF_F_HW_ESP)
+        if (dev->features & NETIF_F_HW_ESP)
                 xfrm_dev_state_flush(dev_net(dev), dev, true);
 
         xfrm_garbage_collect(dev_net(dev));
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b00a1d5a7f52..643a18f72032 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1006,10 +1006,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
                 err = -ESRCH;
 out:
         spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
-
-        if (cnt)
-                xfrm_garbage_collect(net);
-
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_flush);
@@ -1797,43 +1793,6 @@ free_dst:
         goto out;
 }
 
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
-        if (!*target) {
-                *target = kmalloc(size, GFP_ATOMIC);
-                if (!*target)
-                        return -ENOMEM;
-        }
-
-        memcpy(*target, src, size);
-        return 0;
-}
-#endif
-
-static int xfrm_dst_update_parent(struct dst_entry *dst,
-                                  const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->partner),
-                                   sel, sizeof(*sel));
-#else
-        return 0;
-#endif
-}
-
-static int xfrm_dst_update_origin(struct dst_entry *dst,
-                                  const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
-        return 0;
-#endif
-}
-
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
                                 struct xfrm_policy **pols,
                                 int *num_pols, int *num_xfrms)
@@ -1905,16 +1864,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
         xdst = (struct xfrm_dst *)dst;
         xdst->num_xfrms = err;
-        if (num_pols > 1)
-                err = xfrm_dst_update_parent(dst, &pols[1]->selector);
-        else
-                err = xfrm_dst_update_origin(dst, fl);
-        if (unlikely(err)) {
-                dst_free(dst);
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
-                return ERR_PTR(err);
-        }
-
         xdst->num_pols = num_pols;
         memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
         xdst->policy_genid = atomic_read(&pols[0]->genid);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index fc3c5aa38754..2e291bc5f1fc 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1383,6 +1383,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
         x->curlft.add_time = orig->curlft.add_time;
         x->km.state = orig->km.state;
         x->km.seq = orig->km.seq;
+        x->replay = orig->replay;
+        x->preplay = orig->preplay;
 
         return x;
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 38614df33ec8..86116e9aaf3d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2027,6 +2027,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                         return 0;
                 return err;
         }
+        xfrm_garbage_collect(net);
 
         c.data.type = type;
         c.event = nlh->nlmsg_type;
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index ce753a408c56..c583a1e1bd3c 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -14,7 +14,15 @@ __headers:
 include scripts/Kbuild.include
 
 srcdir        := $(srctree)/$(obj)
-subdirs       := $(patsubst $(srcdir)/%/.,%,$(wildcard $(srcdir)/*/.))
+
+# When make is run under a fakechroot environment, the function
+# $(wildcard $(srcdir)/*/.) doesn't only return directories, but also regular
+# files. So, we are using a combination of sort/dir/wildcard which works
+# with fakechroot.
+subdirs       := $(patsubst $(srcdir)/%/,%,\
+                 $(filter-out $(srcdir)/,\
+                 $(sort $(dir $(wildcard $(srcdir)/*/)))))
+
 # caller may set destination dir (when installing to asm/)
 _dst          := $(if $(dst),$(dst),$(obj))
 
diff --git a/scripts/gdb/linux/dmesg.py b/scripts/gdb/linux/dmesg.py
index f9b92ece7834..5afd1098e33a 100644
--- a/scripts/gdb/linux/dmesg.py
+++ b/scripts/gdb/linux/dmesg.py
@@ -23,10 +23,11 @@ class LxDmesg(gdb.Command):
         super(LxDmesg, self).__init__("lx-dmesg", gdb.COMMAND_DATA)
 
     def invoke(self, arg, from_tty):
-        log_buf_addr = int(str(gdb.parse_and_eval("log_buf")).split()[0], 16)
-        log_first_idx = int(gdb.parse_and_eval("log_first_idx"))
-        log_next_idx = int(gdb.parse_and_eval("log_next_idx"))
-        log_buf_len = int(gdb.parse_and_eval("log_buf_len"))
+        log_buf_addr = int(str(gdb.parse_and_eval(
+            "'printk.c'::log_buf")).split()[0], 16)
+        log_first_idx = int(gdb.parse_and_eval("'printk.c'::log_first_idx"))
+        log_next_idx = int(gdb.parse_and_eval("'printk.c'::log_next_idx"))
+        log_buf_len = int(gdb.parse_and_eval("'printk.c'::log_buf_len"))
 
         inf = gdb.inferiors()[0]
         start = log_buf_addr + log_first_idx
diff --git a/scripts/genksyms/genksyms.h b/scripts/genksyms/genksyms.h
index 3bffdcaaa274..b724a0290c75 100644
--- a/scripts/genksyms/genksyms.h
+++ b/scripts/genksyms/genksyms.h
@@ -75,7 +75,7 @@ struct string_list *copy_list_range(struct string_list *start,
 int yylex(void);
 int yyparse(void);
 
-void error_with_pos(const char *, ...);
+void error_with_pos(const char *, ...) __attribute__ ((format(printf, 1, 2)));
 
 /*----------------------------------------------------------------------*/
 #define xmalloc(size) ({ void *__ptr = malloc(size);            \
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 90a091b6ae4d..eb8144643b78 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -196,7 +196,7 @@ clean-files     += config.pot linux.pot
 
 # Check that we have the required ncurses stuff installed for lxdialog (menuconfig)
 PHONY += $(obj)/dochecklxdialog
-$(addprefix $(obj)/,$(lxdialog)): $(obj)/dochecklxdialog
+$(addprefix $(obj)/, mconf.o $(lxdialog)): $(obj)/dochecklxdialog
 $(obj)/dochecklxdialog:
         $(Q)$(CONFIG_SHELL) $(check-lxdialog) -check $(HOSTCC) $(HOST_EXTRACFLAGS) $(HOSTLOADLIBES_mconf)
 
diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index a9bc5334a478..003114779815 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -271,7 +271,7 @@ static struct mitem k_menu_items[MAX_MENU_ITEMS];
 static int items_num;
 static int global_exit;
 /* the currently selected button */
-const char *current_instructions = menu_instructions;
+static const char *current_instructions = menu_instructions;
 
 static char *dialog_input_result;
 static int dialog_input_result_len;
@@ -305,7 +305,7 @@ struct function_keys {
 };
 
 static const int function_keys_num = 9;
-struct function_keys function_keys[] = {
+static struct function_keys function_keys[] = {
         {
                 .key_str = "F1",
                 .func = "Help",
@@ -508,7 +508,7 @@ static int get_mext_match(const char *match_str, match_f flag)
         index = (index + items_num) % items_num;
         while (true) {
                 char *str = k_menu_items[index].str;
-                if (strcasestr(str, match_str) != 0)
+                if (strcasestr(str, match_str) != NULL)
                         return index;
                 if (flag == FIND_NEXT_MATCH_UP ||
                     flag == MATCH_TINKER_PATTERN_UP)
@@ -1067,7 +1067,7 @@ static int do_match(int key, struct match_state *state, int *ans)
 
 static void conf(struct menu *menu)
 {
-        struct menu *submenu = 0;
+        struct menu *submenu = NULL;
         const char *prompt = menu_get_prompt(menu);
         struct symbol *sym;
         int res;
@@ -1234,7 +1234,7 @@ static void show_help(struct menu *menu)
 static void conf_choice(struct menu *menu)
 {
         const char *prompt = _(menu_get_prompt(menu));
-        struct menu *child = 0;
+        struct menu *child = NULL;
         struct symbol *active;
         int selected_index = 0;
         int last_top_row = 0;
@@ -1456,7 +1456,7 @@ static void conf_save(void)
         }
 }
 
-void setup_windows(void)
+static void setup_windows(void)
 {
         int lines, columns;
 
diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index 4b2f44c20caf..a64b1c31253e 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -129,7 +129,7 @@ static void no_colors_theme(void)
         mkattrn(FUNCTION_TEXT, A_REVERSE);
 }
 
-void set_colors()
+void set_colors(void)
 {
         start_color();
         use_default_colors();
@@ -192,7 +192,7 @@ const char *get_line(const char *text, int line_no)
         int lines = 0;
 
         if (!text)
-                return 0;
+                return NULL;
 
         for (i = 0; text[i] != '\0' && lines < line_no; i++)
                 if (text[i] == '\n')
diff --git a/scripts/tags.sh b/scripts/tags.sh
index d661f2f3ef61..d23dcbf17457 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -106,6 +106,7 @@ all_compiled_sources()
                 case "$i" in
                         *.[cS])
                                 j=${i/\.[cS]/\.o}
+                                j="${j#$tree}"
                                 if [ -e $j ]; then
                                         echo $i
                                 fi
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index 6fd95f76bfae..a7a23b5541f8 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -20,6 +20,10 @@ config KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config KEYS_COMPAT
+        def_bool y
+        depends on COMPAT && KEYS
+
 config PERSISTENT_KEYRINGS
         bool "Enable register of persistent per-UID keyrings"
         depends on KEYS
@@ -89,9 +93,9 @@ config ENCRYPTED_KEYS
 config KEY_DH_OPERATIONS
        bool "Diffie-Hellman operations on retained keys"
        depends on KEYS
-       select MPILIB
        select CRYPTO
        select CRYPTO_HASH
+       select CRYPTO_DH
        help
          This option provides support for calculating Diffie-Hellman
          public keys and shared secrets using values stored as keys
diff --git a/security/keys/dh.c b/security/keys/dh.c
index e603bd912e4c..4755d4b4f945 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -8,34 +8,17 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#include <linux/mpi.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <crypto/hash.h>
+#include <crypto/kpp.h>
+#include <crypto/dh.h>
 #include <keys/user-type.h>
 #include "internal.h"
 
-/*
- * Public key or shared secret generation function [RFC2631 sec 2.1.1]
- *
- * ya = g^xa mod p;
- * or
- * ZZ = yb^xa mod p;
- *
- * where xa is the local private key, ya is the local public key, g is
- * the generator, p is the prime, yb is the remote public key, and ZZ
- * is the shared secret.
- *
- * Both are the same calculation, so g or yb are the "base" and ya or
- * ZZ are the "result".
- */
-static int do_dh(MPI result, MPI base, MPI xa, MPI p)
-{
-        return mpi_powm(result, base, xa, p);
-}
-
-static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
+static ssize_t dh_data_from_key(key_serial_t keyid, void **data)
 {
         struct key *key;
         key_ref_t key_ref;
@@ -56,19 +39,17 @@ static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
                 status = key_validate(key);
                 if (status == 0) {
                         const struct user_key_payload *payload;
+                        uint8_t *duplicate;
 
                         payload = user_key_payload_locked(key);
 
-                        if (maxlen == 0) {
-                                *mpi = NULL;
+                        duplicate = kmemdup(payload->data, payload->datalen,
+                                            GFP_KERNEL);
+                        if (duplicate) {
+                                *data = duplicate;
                                 ret = payload->datalen;
-                        } else if (payload->datalen <= maxlen) {
-                                *mpi = mpi_read_raw_data(payload->data,
-                                                         payload->datalen);
-                                if (*mpi)
-                                        ret = payload->datalen;
                         } else {
-                                ret = -EINVAL;
+                                ret = -ENOMEM;
                         }
                 }
                 up_read(&key->sem);
@@ -79,6 +60,29 @@ error:
         return ret;
 }
 
+static void dh_free_data(struct dh *dh)
+{
+        kzfree(dh->key);
+        kzfree(dh->p);
+        kzfree(dh->g);
+}
+
+struct dh_completion {
+        struct completion completion;
+        int err;
+};
+
+static void dh_crypto_done(struct crypto_async_request *req, int err)
+{
+        struct dh_completion *compl = req->data;
+
+        if (err == -EINPROGRESS)
+                return;
+
+        compl->err = err;
+        complete(&compl->completion);
+}
+
 struct kdf_sdesc {
         struct shash_desc shash;
         char ctx[];
@@ -89,6 +93,7 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
         struct crypto_shash *tfm;
         struct kdf_sdesc *sdesc;
         int size;
+        int err;
 
         /* allocate synchronous hash */
         tfm = crypto_alloc_shash(hashname, 0, 0);
@@ -97,16 +102,25 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
                 return PTR_ERR(tfm);
         }
 
+        err = -EINVAL;
+        if (crypto_shash_digestsize(tfm) == 0)
+                goto out_free_tfm;
+
+        err = -ENOMEM;
         size = sizeof(struct shash_desc) + crypto_shash_descsize(tfm);
         sdesc = kmalloc(size, GFP_KERNEL);
         if (!sdesc)
-                return -ENOMEM;
+                goto out_free_tfm;
         sdesc->shash.tfm = tfm;
         sdesc->shash.flags = 0x0;
 
         *sdesc_ret = sdesc;
 
         return 0;
+
+out_free_tfm:
+        crypto_free_shash(tfm);
+        return err;
 }
 
 static void kdf_dealloc(struct kdf_sdesc *sdesc)
@@ -120,14 +134,6 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc)
         kzfree(sdesc);
 }
 
-/* convert 32 bit integer into its string representation */
-static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
-{
-        __be32 *a = (__be32 *)buf;
-
-        *a = cpu_to_be32(val);
-}
-
 /*
  * Implementation of the KDF in counter mode according to SP800-108 section 5.1
  * as well as SP800-56A section 5.8.1 (Single-step KDF).
@@ -138,25 +144,39 @@ static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
  * 5.8.1.2).
  */
 static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
-                   u8 *dst, unsigned int dlen)
+                   u8 *dst, unsigned int dlen, unsigned int zlen)
 {
         struct shash_desc *desc = &sdesc->shash;
         unsigned int h = crypto_shash_digestsize(desc->tfm);
         int err = 0;
         u8 *dst_orig = dst;
-        u32 i = 1;
-        u8 iteration[sizeof(u32)];
+        __be32 counter = cpu_to_be32(1);
 
         while (dlen) {
                 err = crypto_shash_init(desc);
                 if (err)
                         goto err;
 
-                crypto_kw_cpu_to_be32(i, iteration);
-                err = crypto_shash_update(desc, iteration, sizeof(u32));
+                err = crypto_shash_update(desc, (u8 *)&counter, sizeof(__be32));
                 if (err)
                         goto err;
 
+                if (zlen && h) {
+                        u8 tmpbuffer[h];
+                        size_t chunk = min_t(size_t, zlen, h);
+                        memset(tmpbuffer, 0, chunk);
+
+                        do {
+                                err = crypto_shash_update(desc, tmpbuffer,
+                                                          chunk);
+                                if (err)
+                                        goto err;
+
+                                zlen -= chunk;
+                                chunk = min_t(size_t, zlen, h);
+                        } while (zlen);
+                }
+
                 if (src && slen) {
                         err = crypto_shash_update(desc, src, slen);
                         if (err)
@@ -179,7 +199,7 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
 
                         dlen -= h;
                         dst += h;
-                        i++;
+                        counter = cpu_to_be32(be32_to_cpu(counter) + 1);
                 }
         }
 
@@ -192,7 +212,7 @@ err:
 
 static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                                  char __user *buffer, size_t buflen,
-                                 uint8_t *kbuf, size_t kbuflen)
+                                 uint8_t *kbuf, size_t kbuflen, size_t lzero)
 {
         uint8_t *outbuf = NULL;
         int ret;
@@ -203,7 +223,7 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                 goto err;
         }
 
-        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen);
+        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen, lzero);
         if (ret)
                 goto err;
 
@@ -221,21 +241,26 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                          struct keyctl_kdf_params *kdfcopy)
 {
         long ret;
-        MPI base, private, prime, result;
-        unsigned nbytes;
+        ssize_t dlen;
+        int secretlen;
+        int outlen;
         struct keyctl_dh_params pcopy;
-        uint8_t *kbuf;
-        ssize_t keylen;
-        size_t resultlen;
+        struct dh dh_inputs;
+        struct scatterlist outsg;
+        struct dh_completion compl;
+        struct crypto_kpp *tfm;
+        struct kpp_request *req;
+        uint8_t *secret;
+        uint8_t *outbuf;
         struct kdf_sdesc *sdesc = NULL;
 
         if (!params || (!buffer && buflen)) {
                 ret = -EINVAL;
-                goto out;
+                goto out1;
         }
         if (copy_from_user(&pcopy, params, sizeof(pcopy)) != 0) {
                 ret = -EFAULT;
-                goto out;
+                goto out1;
         }
 
         if (kdfcopy) {
@@ -244,104 +269,147 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                 if (buflen > KEYCTL_KDF_MAX_OUTPUT_LEN ||
                     kdfcopy->otherinfolen > KEYCTL_KDF_MAX_OI_LEN) {
                         ret = -EMSGSIZE;
-                        goto out;
+                        goto out1;
                 }
 
                 /* get KDF name string */
                 hashname = strndup_user(kdfcopy->hashname, CRYPTO_MAX_ALG_NAME);
                 if (IS_ERR(hashname)) {
                         ret = PTR_ERR(hashname);
-                        goto out;
+                        goto out1;
                 }
 
                 /* allocate KDF from the kernel crypto API */
                 ret = kdf_alloc(&sdesc, hashname);
                 kfree(hashname);
                 if (ret)
-                        goto out;
+                        goto out1;
         }
 
-        /*
-         * If the caller requests postprocessing with a KDF, allow an
-         * arbitrary output buffer size since the KDF ensures proper truncation.
-         */
-        keylen = mpi_from_key(pcopy.prime, kdfcopy ? SIZE_MAX : buflen, &prime);
-        if (keylen < 0 || !prime) {
-                /* buflen == 0 may be used to query the required buffer size,
-                 * which is the prime key length.
-                 */
-                ret = keylen;
-                goto out;
+        memset(&dh_inputs, 0, sizeof(dh_inputs));
+
+        dlen = dh_data_from_key(pcopy.prime, &dh_inputs.p);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out1;
+        }
+        dh_inputs.p_size = dlen;
+
+        dlen = dh_data_from_key(pcopy.base, &dh_inputs.g);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
         }
+        dh_inputs.g_size = dlen;
 
-        /* The result is never longer than the prime */
-        resultlen = keylen;
+        dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
+        }
+        dh_inputs.key_size = dlen;
 
-        keylen = mpi_from_key(pcopy.base, SIZE_MAX, &base);
-        if (keylen < 0 || !base) {
-                ret = keylen;
-                goto error1;
+        secretlen = crypto_dh_key_len(&dh_inputs);
+        secret = kmalloc(secretlen, GFP_KERNEL);
+        if (!secret) {
+                ret = -ENOMEM;
+                goto out2;
         }
+        ret = crypto_dh_encode_key(secret, secretlen, &dh_inputs);
+        if (ret)
+                goto out3;
 
-        keylen = mpi_from_key(pcopy.private, SIZE_MAX, &private);
-        if (keylen < 0 || !private) {
-                ret = keylen;
-                goto error2;
+        tfm = crypto_alloc_kpp("dh", CRYPTO_ALG_TYPE_KPP, 0);
+        if (IS_ERR(tfm)) {
+                ret = PTR_ERR(tfm);
+                goto out3;
+        }
+
+        ret = crypto_kpp_set_secret(tfm, secret, secretlen);
+        if (ret)
+                goto out4;
+
+        outlen = crypto_kpp_maxsize(tfm);
+
+        if (!kdfcopy) {
+                /*
+                 * When not using a KDF, buflen 0 is used to read the
+                 * required buffer length
+                 */
+                if (buflen == 0) {
+                        ret = outlen;
+                        goto out4;
+                } else if (outlen > buflen) {
+                        ret = -EOVERFLOW;
+                        goto out4;
+                }
         }
 
-        result = mpi_alloc(0);
-        if (!result) {
+        outbuf = kzalloc(kdfcopy ? (outlen + kdfcopy->otherinfolen) : outlen,
+                         GFP_KERNEL);
+        if (!outbuf) {
                 ret = -ENOMEM;
-                goto error3;
+                goto out4;
         }
 
-        /* allocate space for DH shared secret and SP800-56A otherinfo */
-        kbuf = kmalloc(kdfcopy ? (resultlen + kdfcopy->otherinfolen) : resultlen,
-                       GFP_KERNEL);
-        if (!kbuf) {
+        sg_init_one(&outsg, outbuf, outlen);
+
+        req = kpp_request_alloc(tfm, GFP_KERNEL);
+        if (!req) {
                 ret = -ENOMEM;
-                goto error4;
+                goto out5;
         }
 
+        kpp_request_set_input(req, NULL, 0);
+        kpp_request_set_output(req, &outsg, outlen);
+        init_completion(&compl.completion);
+        kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+                                 CRYPTO_TFM_REQ_MAY_SLEEP,
+                                 dh_crypto_done, &compl);
+
         /*
-         * Concatenate SP800-56A otherinfo past DH shared secret -- the
-         * input to the KDF is (DH shared secret || otherinfo)
+         * For DH, generate_public_key and generate_shared_secret are
+         * the same calculation
          */
-        if (kdfcopy && kdfcopy->otherinfo &&
-            copy_from_user(kbuf + resultlen, kdfcopy->otherinfo,
-                           kdfcopy->otherinfolen) != 0) {
-                ret = -EFAULT;
-                goto error5;
+        ret = crypto_kpp_generate_public_key(req);
+        if (ret == -EINPROGRESS) {
+                wait_for_completion(&compl.completion);
+                ret = compl.err;
+                if (ret)
+                        goto out6;
         }
 
-        ret = do_dh(result, base, private, prime);
-        if (ret)
-                goto error5;
-
-        ret = mpi_read_buffer(result, kbuf, resultlen, &nbytes, NULL);
-        if (ret != 0)
-                goto error5;
-
         if (kdfcopy) {
-                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, kbuf,
-                                            resultlen + kdfcopy->otherinfolen);
-        } else {
-                ret = nbytes;
-                if (copy_to_user(buffer, kbuf, nbytes) != 0)
+                /*
+                 * Concatenate SP800-56A otherinfo past DH shared secret -- the
+                 * input to the KDF is (DH shared secret || otherinfo)
+                 */
+                if (copy_from_user(outbuf + req->dst_len, kdfcopy->otherinfo,
+                                   kdfcopy->otherinfolen) != 0) {
                         ret = -EFAULT;
+                        goto out6;
+                }
+
+                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, outbuf,
+                                            req->dst_len + kdfcopy->otherinfolen,
+                                            outlen - req->dst_len);
+        } else if (copy_to_user(buffer, outbuf, req->dst_len) == 0) {
+                ret = req->dst_len;
+        } else {
+                ret = -EFAULT;
         }
 
-error5:
-        kzfree(kbuf);
-error4:
-        mpi_free(result);
-error3:
-        mpi_free(private);
-error2:
-        mpi_free(base);
-error1:
-        mpi_free(prime);
-out:
+out6:
+        kpp_request_free(req);
+out5:
+        kzfree(outbuf);
+out4:
+        crypto_free_kpp(tfm);
+out3:
+        kzfree(secret);
+out2:
+        dh_free_data(&dh_inputs);
+out1:
         kdf_dealloc(sdesc);
         return ret;
 }
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 0010955d7876..bb6324d1ccec 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -30,6 +30,7 @@
 #include <linux/scatterlist.h>
 #include <linux/ctype.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include <crypto/hash.h>
 #include <crypto/sha.h>
 #include <crypto/skcipher.h>
@@ -54,13 +55,7 @@ static int blksize;
 #define MAX_DATA_SIZE 4096
 #define MIN_DATA_SIZE  20
 
-struct sdesc {
-        struct shash_desc shash;
-        char ctx[];
-};
-
-static struct crypto_shash *hashalg;
-static struct crypto_shash *hmacalg;
+static struct crypto_shash *hash_tfm;
 
 enum {
         Opt_err = -1, Opt_new, Opt_load, Opt_update
@@ -141,23 +136,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
  */
 static int valid_master_desc(const char *new_desc, const char *orig_desc)
 {
-        if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
-                                goto out;
-        } else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
-                                goto out;
-        } else
-                goto out;
+        int prefix_len;
+
+        if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
+                prefix_len = KEY_TRUSTED_PREFIX_LEN;
+        else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
+                prefix_len = KEY_USER_PREFIX_LEN;
+        else
+                return -EINVAL;
+
+        if (!new_desc[prefix_len])
+                return -EINVAL;
+
+        if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
+                return -EINVAL;
+
         return 0;
-out:
-        return -EINVAL;
 }
 
 /*
@@ -321,53 +315,38 @@ error:
         return ukey;
 }
 
-static struct sdesc *alloc_sdesc(struct crypto_shash *alg)
-{
-        struct sdesc *sdesc;
-        int size;
-
-        size = sizeof(struct shash_desc) + crypto_shash_descsize(alg);
-        sdesc = kmalloc(size, GFP_KERNEL);
-        if (!sdesc)
-                return ERR_PTR(-ENOMEM);
-        sdesc->shash.tfm = alg;
-        sdesc->shash.flags = 0x0;
-        return sdesc;
-}
-
-static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+static int calc_hash(struct crypto_shash *tfm, u8 *digest,
                      const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        SHASH_DESC_ON_STACK(desc, tfm);
+        int err;
 
-        sdesc = alloc_sdesc(hmacalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hmac_alg);
-                return PTR_ERR(sdesc);
-        }
+        desc->tfm = tfm;
+        desc->flags = 0;
 
-        ret = crypto_shash_setkey(hmacalg, key, keylen);
-        if (!ret)
-                ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_digest(desc, buf, buflen, digest);
+        shash_desc_zero(desc);
+        return err;
 }
 
-static int calc_hash(u8 *digest, const u8 *buf, unsigned int buflen)
+static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+                     const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        struct crypto_shash *tfm;
+        int err;
 
-        sdesc = alloc_sdesc(hashalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hash_alg);
-                return PTR_ERR(sdesc);
+        tfm = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(tfm)) {
+                pr_err("encrypted_key: can't alloc %s transform: %ld\n",
+                       hmac_alg, PTR_ERR(tfm));
+                return PTR_ERR(tfm);
         }
 
-        ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_setkey(tfm, key, keylen);
+        if (!err)
+                err = calc_hash(tfm, digest, buf, buflen);
+        crypto_free_shash(tfm);
+        return err;
 }
 
 enum derived_key_type { ENC_KEY, AUTH_KEY };
@@ -385,10 +364,9 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
                 derived_buf_len = HASH_SIZE;
 
         derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
-        if (!derived_buf) {
-                pr_err("encrypted_key: out of memory\n");
+        if (!derived_buf)
                 return -ENOMEM;
-        }
+
         if (key_type)
                 strcpy(derived_buf, "AUTH_KEY");
         else
@@ -396,8 +374,8 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
 
         memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
                master_keylen);
-        ret = calc_hash(derived_key, derived_buf, derived_buf_len);
-        kfree(derived_buf);
+        ret = calc_hash(hash_tfm, derived_key, derived_buf, derived_buf_len);
+        kzfree(derived_buf);
         return ret;
 }
 
@@ -480,12 +458,9 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        unsigned int padlen;
-        char pad[16];
         int ret;
 
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
-        padlen = encrypted_datalen - epayload->decrypted_datalen;
 
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -493,11 +468,10 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 2);
         sg_set_buf(&sg_in[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_in[1], pad, padlen);
+        sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
 
         sg_init_table(sg_out, 1);
         sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
@@ -533,6 +507,7 @@ static int datablob_hmac_append(struct encrypted_key_payload *epayload,
         if (!ret)
                 dump_hmac(NULL, digest, HASH_SIZE);
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -561,8 +536,8 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
         ret = calc_hmac(digest, derived_key, sizeof derived_key, p, len);
         if (ret < 0)
                 goto out;
-        ret = memcmp(digest, epayload->format + epayload->datablob_len,
-                     sizeof digest);
+        ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
+                            sizeof(digest));
         if (ret) {
                 ret = -EINVAL;
                 dump_hmac("datablob",
@@ -571,6 +546,7 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
                 dump_hmac("calc", digest, HASH_SIZE);
         }
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -584,9 +560,14 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        char pad[16];
+        u8 *pad;
         int ret;
 
+        /* Throwaway buffer to hold the unused zero padding at the end */
+        pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
+        if (!pad)
+                return -ENOMEM;
+
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -594,13 +575,12 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_encrypted_data(epayload, encrypted_datalen);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 1);
         sg_init_table(sg_out, 2);
         sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
         sg_set_buf(&sg_out[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_out[1], pad, sizeof pad);
+        sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
 
         memcpy(iv, epayload->iv, sizeof(iv));
         skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
@@ -612,6 +592,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 out:
+        kfree(pad);
         return ret;
 }
 
@@ -722,6 +703,7 @@ static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -828,13 +810,13 @@ static int encrypted_instantiate(struct key *key,
         ret = encrypted_init(epayload, key->description, format, master_desc,
                              decrypted_datalen, hex_encoded_iv);
         if (ret < 0) {
-                kfree(epayload);
+                kzfree(epayload);
                 goto out;
         }
 
         rcu_assign_keypointer(key, epayload);
 out:
-        kfree(datablob);
+        kzfree(datablob);
         return ret;
 }
 
@@ -843,8 +825,7 @@ static void encrypted_rcu_free(struct rcu_head *rcu)
         struct encrypted_key_payload *epayload;
 
         epayload = container_of(rcu, struct encrypted_key_payload, rcu);
-        memset(epayload->decrypted_data, 0, epayload->decrypted_datalen);
-        kfree(epayload);
+        kzfree(epayload);
 }
 
 /*
@@ -902,7 +883,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
         rcu_assign_keypointer(key, new_epayload);
         call_rcu(&epayload->rcu, encrypted_rcu_free);
 out:
-        kfree(buf);
+        kzfree(buf);
         return ret;
 }
 
@@ -960,33 +941,26 @@ static long encrypted_read(const struct key *key, char __user *buffer,
 
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
 
         if (copy_to_user(buffer, ascii_buf, asciiblob_len) != 0)
                 ret = -EFAULT;
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
 
         return asciiblob_len;
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
 /*
- * encrypted_destroy - before freeing the key, clear the decrypted data
- *
- * Before freeing the key, clear the memory containing the decrypted
- * key data.
+ * encrypted_destroy - clear and free the key's payload
  */
 static void encrypted_destroy(struct key *key)
 {
-        struct encrypted_key_payload *epayload = key->payload.data[0];
-
-        if (!epayload)
-                return;
-
-        memzero_explicit(epayload->decrypted_data, epayload->decrypted_datalen);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_encrypted = {
@@ -999,47 +973,17 @@ struct key_type key_type_encrypted = {
 };
 EXPORT_SYMBOL_GPL(key_type_encrypted);
 
-static void encrypted_shash_release(void)
-{
-        if (hashalg)
-                crypto_free_shash(hashalg);
-        if (hmacalg)
-                crypto_free_shash(hmacalg);
-}
-
-static int __init encrypted_shash_alloc(void)
+static int __init init_encrypted(void)
 {
         int ret;
 
-        hmacalg = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hmacalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hmac_alg);
-                return PTR_ERR(hmacalg);
-        }
-
-        hashalg = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hashalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hash_alg);
-                ret = PTR_ERR(hashalg);
-                goto hashalg_fail;
+        hash_tfm = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(hash_tfm)) {
+                pr_err("encrypted_key: can't allocate %s transform: %ld\n",
+                       hash_alg, PTR_ERR(hash_tfm));
+                return PTR_ERR(hash_tfm);
         }
 
-        return 0;
-
-hashalg_fail:
-        crypto_free_shash(hmacalg);
-        return ret;
-}
-
-static int __init init_encrypted(void)
-{
-        int ret;
-
-        ret = encrypted_shash_alloc();
-        if (ret < 0)
-                return ret;
         ret = aes_get_sizes();
         if (ret < 0)
                 goto out;
@@ -1048,14 +992,14 @@ static int __init init_encrypted(void)
                 goto out;
         return 0;
 out:
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         return ret;
 
 }
 
 static void __exit cleanup_encrypted(void)
 {
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         unregister_key_type(&key_type_encrypted);
 }
 
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 595becc6d0d2..87cb260e4890 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -158,9 +158,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 
                 kfree(key->description);
 
-#ifdef KEY_DEBUGGING
-                key->magic = KEY_DEBUG_MAGIC_X;
-#endif
+                memzero_explicit(key, sizeof(*key));
                 kmem_cache_free(key_jar, key);
         }
 }
diff --git a/security/keys/key.c b/security/keys/key.c
index 455c04d80bbb..83da68d98b40 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -660,14 +660,11 @@ not_found:
         goto error;
 
 found:
-        /* pretend it doesn't exist if it is awaiting deletion */
-        if (refcount_read(&key->usage) == 0)
-                goto not_found;
-
-        /* this races with key_put(), but that doesn't matter since key_put()
-         * doesn't actually change the key
+        /* A key is allowed to be looked up only if someone still owns a
+         * reference to it - otherwise it's awaiting the gc.
          */
-        __key_get(key);
+        if (!refcount_inc_not_zero(&key->usage))
+                goto not_found;
 
 error:
         spin_unlock(&key_serial_lock);
@@ -966,12 +963,11 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
         /* the key must be writable */
         ret = key_permission(key_ref, KEY_NEED_WRITE);
         if (ret < 0)
-                goto error;
+                return ret;
 
         /* attempt to update it if supported */
-        ret = -EOPNOTSUPP;
         if (!key->type->update)
-                goto error;
+                return -EOPNOTSUPP;
 
         memset(&prep, 0, sizeof(prep));
         prep.data = payload;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 447a7d5cee0f..ab0b337c84b4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
         /* pull the payload in if one was supplied */
         payload = NULL;
 
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kvmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -132,7 +132,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
         key_ref_put(keyring_ref);
  error3:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
  error2:
         kfree(description);
  error:
@@ -324,7 +327,7 @@ long keyctl_update_key(key_serial_t id,
 
         /* pull the payload in if one was supplied */
         payload = NULL;
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -347,7 +350,7 @@ long keyctl_update_key(key_serial_t id,
 
         key_ref_put(key_ref);
 error2:
-        kfree(payload);
+        kzfree(payload);
 error:
         return ret;
 }
@@ -1093,7 +1096,10 @@ long keyctl_instantiate_key_common(key_serial_t id,
                 keyctl_change_reqkey_auth(NULL);
 
 error2:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
 error:
         return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 4d1678e4586f..de81793f9920 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -706,7 +706,7 @@ descend_to_keyring:
          * Non-keyrings avoid the leftmost branch of the root entirely (root
          * slots 1-15).
          */
-        ptr = ACCESS_ONCE(keyring->keys.root);
+        ptr = READ_ONCE(keyring->keys.root);
         if (!ptr)
                 goto not_this_keyring;
 
@@ -720,7 +720,7 @@ descend_to_keyring:
                 if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
                         goto not_this_keyring;
 
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 node = assoc_array_ptr_to_node(ptr);
                 goto begin_node;
         }
@@ -740,7 +740,7 @@ descend_to_node:
         if (assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 BUG_ON(!assoc_array_ptr_is_node(ptr));
         }
         node = assoc_array_ptr_to_node(ptr);
@@ -752,7 +752,7 @@ begin_node:
 ascend_to_node:
         /* Go through the slots in a node */
         for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
-                ptr = ACCESS_ONCE(node->slots[slot]);
+                ptr = READ_ONCE(node->slots[slot]);
 
                 if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
                         goto descend_to_node;
@@ -790,13 +790,13 @@ ascend_to_node:
         /* We've dealt with all the slots in the current node, so now we need
          * to ascend to the parent and continue processing there.
          */
-        ptr = ACCESS_ONCE(node->back_pointer);
+        ptr = READ_ONCE(node->back_pointer);
         slot = node->parent_slot;
 
         if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->back_pointer);
+                ptr = READ_ONCE(shortcut->back_pointer);
                 slot = shortcut->parent_slot;
         }
         if (!ptr)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 2217dfec7996..86bced9fdbdf 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -809,15 +809,14 @@ long join_session_keyring(const char *name)
                 ret = PTR_ERR(keyring);
                 goto error2;
         } else if (keyring == new->session_keyring) {
-                key_put(keyring);
                 ret = 0;
-                goto error2;
+                goto error3;
         }
 
         /* we've got a keyring - now to install it */
         ret = install_session_keyring_to_cred(new, keyring);
         if (ret < 0)
-                goto error2;
+                goto error3;
 
         commit_creds(new);
         mutex_unlock(&key_session_mutex);
@@ -827,6 +826,8 @@ long join_session_keyring(const char *name)
 okay:
         return ret;
 
+error3:
+        key_put(keyring);
 error2:
         mutex_unlock(&key_session_mutex);
 error:
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 2ae31c5a87de..435e86e13879 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -70,7 +70,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen,
         }
 
         ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -114,7 +114,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
         if (!ret)
                 ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -165,7 +165,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                                   paramdigest, TPM_NONCE_SIZE, h1,
                                   TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -246,7 +246,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
         if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -347,7 +347,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
         if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -564,7 +564,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                 *bloblen = storedsize;
         }
 out:
-        kfree(td);
+        kzfree(td);
         return ret;
 }
 
@@ -678,7 +678,7 @@ static int key_seal(struct trusted_key_payload *p,
         if (ret < 0)
                 pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -703,7 +703,7 @@ static int key_unseal(struct trusted_key_payload *p,
                 /* pull migratable flag out of sealed key */
                 p->migratable = p->key[--p->key_len];
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -1037,12 +1037,12 @@ static int trusted_instantiate(struct key *key,
         if (!ret && options->pcrlock)
                 ret = pcrlock(options->pcrlock);
 out:
-        kfree(datablob);
-        kfree(options);
+        kzfree(datablob);
+        kzfree(options);
         if (!ret)
                 rcu_assign_keypointer(key, payload);
         else
-                kfree(payload);
+                kzfree(payload);
         return ret;
 }
 
@@ -1051,8 +1051,7 @@ static void trusted_rcu_free(struct rcu_head *rcu)
         struct trusted_key_payload *p;
 
         p = container_of(rcu, struct trusted_key_payload, rcu);
-        memset(p->key, 0, p->key_len);
-        kfree(p);
+        kzfree(p);
 }
 
 /*
@@ -1094,13 +1093,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = datablob_parse(datablob, new_p, new_o);
         if (ret != Opt_update) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
         if (!new_o->keyhandle) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
@@ -1114,22 +1113,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = key_seal(new_p, new_o);
         if (ret < 0) {
                 pr_info("trusted_key: key_seal failed (%d)\n", ret);
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
         if (new_o->pcrlock) {
                 ret = pcrlock(new_o->pcrlock);
                 if (ret < 0) {
                         pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-                        kfree(new_p);
+                        kzfree(new_p);
                         goto out;
                 }
         }
         rcu_assign_keypointer(key, new_p);
         call_rcu(&p->rcu, trusted_rcu_free);
 out:
-        kfree(datablob);
-        kfree(new_o);
+        kzfree(datablob);
+        kzfree(new_o);
         return ret;
 }
 
@@ -1158,24 +1157,19 @@ static long trusted_read(const struct key *key, char __user *buffer,
         for (i = 0; i < p->blob_len; i++)
                 bufp = hex_byte_pack(bufp, p->blob[i]);
         if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-                kfree(ascii_buf);
+                kzfree(ascii_buf);
                 return -EFAULT;
         }
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
         return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-        struct trusted_key_payload *p = key->payload.data[0];
-
-        if (!p)
-                return;
-        memset(p->key, 0, p->key_len);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_trusted = {
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 26605134f17a..3d8c68eba516 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -86,10 +86,18 @@ EXPORT_SYMBOL_GPL(user_preparse);
  */
 void user_free_preparse(struct key_preparsed_payload *prep)
 {
-        kfree(prep->payload.data[0]);
+        kzfree(prep->payload.data[0]);
 }
 EXPORT_SYMBOL_GPL(user_free_preparse);
 
+static void user_free_payload_rcu(struct rcu_head *head)
+{
+        struct user_key_payload *payload;
+
+        payload = container_of(head, struct user_key_payload, rcu);
+        kzfree(payload);
+}
+
 /*
  * update a user defined key
  * - the key's semaphore is write-locked
@@ -112,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
         prep->payload.data[0] = NULL;
 
         if (zap)
-                kfree_rcu(zap, rcu);
+                call_rcu(&zap->rcu, user_free_payload_rcu);
         return ret;
 }
 EXPORT_SYMBOL_GPL(user_update);
@@ -130,7 +138,7 @@ void user_revoke(struct key *key)
 
         if (upayload) {
                 rcu_assign_keypointer(key, NULL);
-                kfree_rcu(upayload, rcu);
+                call_rcu(&upayload->rcu, user_free_payload_rcu);
         }
 }
 
@@ -143,7 +151,7 @@ void user_destroy(struct key *key)
 {
         struct user_key_payload *upayload = key->payload.data[0];
 
-        kfree(upayload);
+        kzfree(upayload);
 }
 
 EXPORT_SYMBOL_GPL(user_destroy);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e67a526d1f30..819fd6858b49 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *options,
 
         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
                                        GFP_KERNEL);
-        if (!opts->mnt_opts_flags) {
-                kfree(opts->mnt_opts);
+        if (!opts->mnt_opts_flags)
                 goto out_err;
-        }
 
         if (fscontext) {
                 opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *options,
         return 0;
 
 out_err:
+        security_free_mnt_opts(opts);
         kfree(context);
         kfree(defcontext);
         kfree(fscontext);
diff --git a/sound/soc/atmel/atmel-pcm.h b/sound/soc/atmel/atmel-pcm.h
index 6eaf081cad50..4b27aed40a51 100644
--- a/sound/soc/atmel/atmel-pcm.h
+++ b/sound/soc/atmel/atmel-pcm.h
@@ -83,8 +83,7 @@ struct atmel_pcm_dma_params {
 #define ssc_readx(base, reg)            (__raw_readl((base) + (reg)))
 #define ssc_writex(base, reg, value)    __raw_writel((value), (base) + (reg))
 
-#if defined(CONFIG_SND_ATMEL_SOC_PDC) || \
-        defined(CONFIG_SND_ATMEL_SOC_PDC_MODULE)
+#if IS_ENABLED(CONFIG_SND_ATMEL_SOC_PDC)
 int atmel_pcm_pdc_platform_register(struct device *dev);
 void atmel_pcm_pdc_platform_unregister(struct device *dev);
 #else
@@ -97,8 +96,7 @@ static inline void atmel_pcm_pdc_platform_unregister(struct device *dev)
 }
 #endif
 
-#if defined(CONFIG_SND_ATMEL_SOC_DMA) || \
-        defined(CONFIG_SND_ATMEL_SOC_DMA_MODULE)
+#if IS_ENABLED(CONFIG_SND_ATMEL_SOC_DMA)
 int atmel_pcm_dma_platform_register(struct device *dev);
 void atmel_pcm_dma_platform_unregister(struct device *dev);
 #else
diff --git a/sound/soc/atmel/tse850-pcm5142.c b/sound/soc/atmel/tse850-pcm5142.c
index a72c7d642026..3a1393283156 100644
--- a/sound/soc/atmel/tse850-pcm5142.c
+++ b/sound/soc/atmel/tse850-pcm5142.c
@@ -227,7 +227,7 @@ int tse850_put_ana(struct snd_kcontrol *kctrl,
 static const char * const mux_text[] = { "Mixer", "Loop" };
 
 static const struct soc_enum mux_enum =
-        SOC_ENUM_SINGLE(SND_SOC_NOPM, 0, 2, mux_text);
+        SOC_ENUM_SINGLE(SND_SOC_NOPM, 0, ARRAY_SIZE(mux_text), mux_text);
 
 static const struct snd_kcontrol_new mux1 =
         SOC_DAPM_ENUM_EXT("MUX1", mux_enum, tse850_get_mux1, tse850_put_mux1);
@@ -252,7 +252,7 @@ static const char * const ana_text[] = {
 };
 
 static const struct soc_enum ana_enum =
-        SOC_ENUM_SINGLE(SND_SOC_NOPM, 0, 9, ana_text);
+        SOC_ENUM_SINGLE(SND_SOC_NOPM, 0, ARRAY_SIZE(ana_text), ana_text);
 
 static const struct snd_kcontrol_new out =
         SOC_DAPM_ENUM_EXT("ANA", ana_enum, tse850_get_ana, tse850_put_ana);
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 883ed4c8a551..6c78b0b49b81 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -72,6 +72,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_DA9055 if I2C
         select SND_SOC_DIO2125
         select SND_SOC_DMIC
+        select SND_SOC_ES8316 if I2C
         select SND_SOC_ES8328_SPI if SPI_MASTER
         select SND_SOC_ES8328_I2C if I2C
         select SND_SOC_ES7134
@@ -543,6 +544,10 @@ config SND_SOC_HDMI_CODEC
 config SND_SOC_ES7134
        tristate "Everest Semi ES7134 CODEC"
 
+config SND_SOC_ES8316
+        tristate "Everest Semi ES8316 CODEC"
+        depends on I2C
+
 config SND_SOC_ES8328
         tristate
 
@@ -1114,6 +1119,11 @@ config SND_SOC_WM9713
         tristate
         select REGMAP_AC97
 
+config SND_SOC_ZX_AUD96P22
+        tristate "ZTE ZX AUD96P22 CODEC"
+        depends on I2C
+        select REGMAP_I2C
+
 # Amp
 config SND_SOC_LM4857
         tristate
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 28a63fdaf982..1755a54e3dc9 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -65,6 +65,7 @@ snd-soc-da732x-objs := da732x.o
 snd-soc-da9055-objs := da9055.o
 snd-soc-dmic-objs := dmic.o
 snd-soc-es7134-objs := es7134.o
+snd-soc-es8316-objs := es8316.o
 snd-soc-es8328-objs := es8328.o
 snd-soc-es8328-i2c-objs := es8328-i2c.o
 snd-soc-es8328-spi-objs := es8328-spi.o
@@ -224,6 +225,7 @@ snd-soc-wm9705-objs := wm9705.o
 snd-soc-wm9712-objs := wm9712.o
 snd-soc-wm9713-objs := wm9713.o
 snd-soc-wm-hubs-objs := wm_hubs.o
+snd-soc-zx-aud96p22-objs := zx_aud96p22.o
 # Amp
 snd-soc-dio2125-objs := dio2125.o
 snd-soc-max9877-objs := max9877.o
@@ -300,6 +302,7 @@ obj-$(CONFIG_SND_SOC_DA732X)	+= snd-soc-da732x.o
 obj-$(CONFIG_SND_SOC_DA9055)    += snd-soc-da9055.o
 obj-$(CONFIG_SND_SOC_DMIC)      += snd-soc-dmic.o
 obj-$(CONFIG_SND_SOC_ES7134)    += snd-soc-es7134.o
+obj-$(CONFIG_SND_SOC_ES8316)    += snd-soc-es8316.o
 obj-$(CONFIG_SND_SOC_ES8328)    += snd-soc-es8328.o
 obj-$(CONFIG_SND_SOC_ES8328_I2C)+= snd-soc-es8328-i2c.o
 obj-$(CONFIG_SND_SOC_ES8328_SPI)+= snd-soc-es8328-spi.o
@@ -455,6 +458,7 @@ obj-$(CONFIG_SND_SOC_WM9712)	+= snd-soc-wm9712.o
 obj-$(CONFIG_SND_SOC_WM9713)    += snd-soc-wm9713.o
 obj-$(CONFIG_SND_SOC_WM_ADSP)   += snd-soc-wm-adsp.o
 obj-$(CONFIG_SND_SOC_WM_HUBS)   += snd-soc-wm-hubs.o
+obj-$(CONFIG_SND_SOC_ZX_AUD96P22) += snd-soc-zx-aud96p22.o
 
 # Amp
 obj-$(CONFIG_SND_SOC_DIO2125)   += snd-soc-dio2125.o
diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c
index b2dfddead227..690edebf029e 100644
--- a/sound/soc/codecs/ak4613.c
+++ b/sound/soc/codecs/ak4613.c
@@ -94,6 +94,8 @@ struct ak4613_interface {
 struct ak4613_priv {
         struct mutex lock;
         const struct ak4613_interface *iface;
+        struct snd_pcm_hw_constraint_list constraint;
+        unsigned int sysclk;
 
         unsigned int fmt;
         u8 oc;
@@ -139,9 +141,7 @@ static const struct reg_default ak4613_reg[] = {
 #define AUDIO_IFACE(b, fmt) { b, SND_SOC_DAIFMT_##fmt }
 static const struct ak4613_interface ak4613_iface[] = {
         /* capture */                           /* playback */
-        [0] = { AUDIO_IFACE(24, LEFT_J),        AUDIO_IFACE(16, RIGHT_J) },
-        [1] = { AUDIO_IFACE(24, LEFT_J),        AUDIO_IFACE(20, RIGHT_J) },
-        [2] = { AUDIO_IFACE(24, LEFT_J),        AUDIO_IFACE(24, RIGHT_J) },
+        /* [0] - [2] are not supported */
         [3] = { AUDIO_IFACE(24, LEFT_J),        AUDIO_IFACE(24, LEFT_J) },
         [4] = { AUDIO_IFACE(24, I2S),           AUDIO_IFACE(24, I2S) },
 };
@@ -254,6 +254,74 @@ static void ak4613_dai_shutdown(struct snd_pcm_substream *substream,
         mutex_unlock(&priv->lock);
 }
 
+static void ak4613_hw_constraints(struct ak4613_priv *priv,
+                                  struct snd_pcm_runtime *runtime)
+{
+        static const unsigned int ak4613_rates[] = {
+                 32000,
+                 44100,
+                 48000,
+                 64000,
+                 88200,
+                 96000,
+                176400,
+                192000,
+        };
+        struct snd_pcm_hw_constraint_list *constraint = &priv->constraint;
+        unsigned int fs;
+        int i;
+
+        constraint->list        = ak4613_rates;
+        constraint->mask        = 0;
+        constraint->count       = 0;
+
+        /*
+         * Slave Mode
+         *      Normal: [32kHz, 48kHz] : 256fs,384fs or 512fs
+         *      Double: [64kHz, 96kHz] : 256fs
+         *      Quad  : [128kHz,192kHz]: 128fs
+         *
+         * Master mode
+         *      Normal: [32kHz, 48kHz] : 256fs or 512fs
+         *      Double: [64kHz, 96kHz] : 256fs
+         *      Quad  : [128kHz,192kHz]: 128fs
+        */
+        for (i = 0; i < ARRAY_SIZE(ak4613_rates); i++) {
+                /* minimum fs on each range */
+                fs = (ak4613_rates[i] <= 96000) ? 256 : 128;
+
+                if (priv->sysclk >= ak4613_rates[i] * fs)
+                        constraint->count = i + 1;
+        }
+
+        snd_pcm_hw_constraint_list(runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE, constraint);
+}
+
+static int ak4613_dai_startup(struct snd_pcm_substream *substream,
+                              struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct ak4613_priv *priv = snd_soc_codec_get_drvdata(codec);
+
+        priv->cnt++;
+
+        ak4613_hw_constraints(priv, substream->runtime);
+
+        return 0;
+}
+
+static int ak4613_dai_set_sysclk(struct snd_soc_dai *codec_dai,
+                                 int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct ak4613_priv *priv = snd_soc_codec_get_drvdata(codec);
+
+        priv->sysclk = freq;
+
+        return 0;
+}
+
 static int ak4613_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 {
         struct snd_soc_codec *codec = dai->codec;
@@ -262,11 +330,9 @@ static int ak4613_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         fmt &= SND_SOC_DAIFMT_FORMAT_MASK;
 
         switch (fmt) {
-        case SND_SOC_DAIFMT_RIGHT_J:
         case SND_SOC_DAIFMT_LEFT_J:
         case SND_SOC_DAIFMT_I2S:
                 priv->fmt = fmt;
-
                 break;
         default:
                 return -EINVAL;
@@ -286,13 +352,8 @@ static bool ak4613_dai_fmt_matching(const struct ak4613_interface *iface,
         if (fmts->fmt != fmt)
                 return false;
 
-        if (fmt == SND_SOC_DAIFMT_RIGHT_J) {
-                if (fmts->width != width)
-                        return false;
-        } else {
-                if (fmts->width < width)
-                        return false;
-        }
+        if (fmts->width != width)
+                return false;
 
         return true;
 }
@@ -319,6 +380,7 @@ static int ak4613_dai_hw_params(struct snd_pcm_substream *substream,
         case 48000:
                 ctrl2 = DFS_NORMAL_SPEED;
                 break;
+        case 64000:
         case 88200:
         case 96000:
                 ctrl2 = DFS_DOUBLE_SPEED;
@@ -345,7 +407,7 @@ static int ak4613_dai_hw_params(struct snd_pcm_substream *substream,
                 if (ak4613_dai_fmt_matching(priv->iface, is_play, fmt, width))
                         iface = priv->iface;
         } else {
-                for (i = ARRAY_SIZE(ak4613_iface); i >= 0; i--) {
+                for (i = ARRAY_SIZE(ak4613_iface) - 1; i >= 0; i--) {
                         if (!ak4613_dai_fmt_matching(ak4613_iface + i,
                                                      is_play,
                                                      fmt, width))
@@ -358,7 +420,6 @@ static int ak4613_dai_hw_params(struct snd_pcm_substream *substream,
         if ((priv->iface == NULL) ||
             (priv->iface == iface)) {
                 priv->iface = iface;
-                priv->cnt++;
                 ret = 0;
         }
         mutex_unlock(&priv->lock);
@@ -407,7 +468,9 @@ static int ak4613_set_bias_level(struct snd_soc_codec *codec,
 }
 
 static const struct snd_soc_dai_ops ak4613_dai_ops = {
+        .startup        = ak4613_dai_startup,
         .shutdown       = ak4613_dai_shutdown,
+        .set_sysclk     = ak4613_dai_set_sysclk,
         .set_fmt        = ak4613_dai_set_fmt,
         .hw_params      = ak4613_dai_hw_params,
 };
@@ -420,8 +483,7 @@ static const struct snd_soc_dai_ops ak4613_dai_ops = {
                                  SNDRV_PCM_RATE_96000  |\
                                  SNDRV_PCM_RATE_176400 |\
                                  SNDRV_PCM_RATE_192000)
-#define AK4613_PCM_FMTBIT       (SNDRV_PCM_FMTBIT_S16_LE |\
-                                 SNDRV_PCM_FMTBIT_S24_LE)
+#define AK4613_PCM_FMTBIT       (SNDRV_PCM_FMTBIT_S24_LE)
 
 static struct snd_soc_dai_driver ak4613_dai = {
         .name = "ak4613-hifi",
@@ -527,6 +589,7 @@ static int ak4613_i2c_probe(struct i2c_client *i2c,
 
         priv->iface             = NULL;
         priv->cnt               = 0;
+        priv->sysclk            = 0;
 
         mutex_init(&priv->lock);
 
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index 23ab9646c351..66de8a2013a6 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -433,7 +433,7 @@ static int ak4642_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 static int ak4642_set_mcko(struct snd_soc_codec *codec,
                            u32 frequency)
 {
-        u32 fs_list[] = {
+        static const u32 fs_list[] = {
                 [0] = 8000,
                 [1] = 12000,
                 [2] = 16000,
@@ -447,7 +447,7 @@ static int ak4642_set_mcko(struct snd_soc_codec *codec,
                 [14] = 29400,
                 [15] = 44100,
         };
-        u32 ps_list[] = {
+        static const u32 ps_list[] = {
                 [0] = 256,
                 [1] = 128,
                 [2] = 64,
diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c
index 7c5d1510cf2c..0a747c66cc6c 100644
--- a/sound/soc/codecs/cs35l34.c
+++ b/sound/soc/codecs/cs35l34.c
@@ -567,12 +567,12 @@ static int cs35l34_pcm_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static unsigned int cs35l34_src_rates[] = {
+static const unsigned int cs35l34_src_rates[] = {
         8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, 48000
 };
 
 
-static struct snd_pcm_hw_constraint_list cs35l34_constraints = {
+static const struct snd_pcm_hw_constraint_list cs35l34_constraints = {
         .count  = ARRAY_SIZE(cs35l34_src_rates),
         .list   = cs35l34_src_rates,
 };
diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
index f8aef5869b03..f1ee184ecab2 100644
--- a/sound/soc/codecs/cs35l35.c
+++ b/sound/soc/codecs/cs35l35.c
@@ -162,6 +162,14 @@ static bool cs35l35_precious_register(struct device *dev, unsigned int reg)
         }
 }
 
+static void cs35l35_reset(struct cs35l35_private *cs35l35)
+{
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
+        usleep_range(2000, 2100);
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 1);
+        usleep_range(1000, 1100);
+}
+
 static int cs35l35_wait_for_pdn(struct cs35l35_private *cs35l35)
 {
         int ret;
@@ -756,6 +764,76 @@ static int cs35l35_codec_set_sysclk(struct snd_soc_codec *codec,
         return ret;
 }
 
+static int cs35l35_boost_inductor(struct cs35l35_private *cs35l35,
+                                  int inductor)
+{
+        struct regmap *regmap = cs35l35->regmap;
+        unsigned int bst_ipk = 0;
+
+        /*
+         * Digital Boost Converter Configuration for feedback,
+         * ramping, switching frequency, and estimation block seeding.
+         */
+
+        regmap_update_bits(regmap, CS35L35_BST_CONV_SW_FREQ,
+                           CS35L35_BST_CONV_SWFREQ_MASK, 0x00);
+
+        regmap_read(regmap, CS35L35_BST_PEAK_I, &bst_ipk);
+        bst_ipk &= CS35L35_BST_IPK_MASK;
+
+        switch (inductor) {
+        case 1000: /* 1 uH */
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_1, 0x24);
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_2, 0x24);
+                regmap_update_bits(regmap, CS35L35_BST_CONV_SW_FREQ,
+                                   CS35L35_BST_CONV_LBST_MASK, 0x00);
+
+                if (bst_ipk < 0x04)
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x1B);
+                else
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x4E);
+                break;
+        case 1200: /* 1.2 uH */
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_1, 0x20);
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_2, 0x20);
+                regmap_update_bits(regmap, CS35L35_BST_CONV_SW_FREQ,
+                                   CS35L35_BST_CONV_LBST_MASK, 0x01);
+
+                if (bst_ipk < 0x04)
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x1B);
+                else
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x47);
+                break;
+        case 1500: /* 1.5uH */
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_1, 0x20);
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_2, 0x20);
+                regmap_update_bits(regmap, CS35L35_BST_CONV_SW_FREQ,
+                                   CS35L35_BST_CONV_LBST_MASK, 0x02);
+
+                if (bst_ipk < 0x04)
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x1B);
+                else
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x3C);
+                break;
+        case 2200: /* 2.2uH */
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_1, 0x19);
+                regmap_write(regmap, CS35L35_BST_CONV_COEF_2, 0x25);
+                regmap_update_bits(regmap, CS35L35_BST_CONV_SW_FREQ,
+                                   CS35L35_BST_CONV_LBST_MASK, 0x03);
+
+                if (bst_ipk < 0x04)
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x1B);
+                else
+                        regmap_write(regmap, CS35L35_BST_CONV_SLOPE_COMP, 0x23);
+                break;
+        default:
+                dev_err(cs35l35->dev, "Invalid Inductor Value %d uH\n",
+                        inductor);
+                return -EINVAL;
+        }
+        return 0;
+}
+
 static int cs35l35_codec_probe(struct snd_soc_codec *codec)
 {
         struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
@@ -775,6 +853,10 @@ static int cs35l35_codec_probe(struct snd_soc_codec *codec)
                                 cs35l35->pdata.bst_ipk <<
                                 CS35L35_BST_IPK_SHIFT);
 
+        ret = cs35l35_boost_inductor(cs35l35, cs35l35->pdata.boost_ind);
+        if (ret)
+                return ret;
+
         if (cs35l35->pdata.gain_zc)
                 regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
                                 CS35L35_AMP_GAIN_ZC_MASK,
@@ -1195,7 +1277,15 @@ static int cs35l35_handle_of_data(struct i2c_client *i2c_client,
                         return -EINVAL;
                 }
 
-                pdata->bst_ipk = (val32 - 1680) / 110;
+                pdata->bst_ipk = ((val32 - 1680) / 110) | CS35L35_VALID_PDATA;
+        }
+
+        ret = of_property_read_u32(np, "cirrus,boost-ind-nanohenry", &val32);
+        if (ret >= 0) {
+                pdata->boost_ind = val32;
+        } else {
+                dev_err(&i2c_client->dev, "Inductor not specified.\n");
+                return -EINVAL;
         }
 
         if (of_property_read_u32(np, "cirrus,sp-drv-strength", &val32) >= 0)
@@ -1454,7 +1544,7 @@ static int cs35l35_i2c_probe(struct i2c_client *i2c_client,
                 }
         }
 
-        gpiod_set_value_cansleep(cs35l35->reset_gpio, 1);
+        cs35l35_reset(cs35l35);
 
         init_completion(&cs35l35->pdn_done);
 
diff --git a/sound/soc/codecs/cs35l35.h b/sound/soc/codecs/cs35l35.h
index 5a6e43a87c4d..621bfef70d03 100644
--- a/sound/soc/codecs/cs35l35.h
+++ b/sound/soc/codecs/cs35l35.h
@@ -200,6 +200,12 @@
 #define CS35L35_SP_I2S_DRV_MASK         0x03
 #define CS35L35_SP_I2S_DRV_SHIFT        0
 
+/* Boost Converter Config */
+#define CS35L35_BST_CONV_COEFF_MASK     0xFF
+#define CS35L35_BST_CONV_SLOPE_MASK     0xFF
+#define CS35L35_BST_CONV_LBST_MASK      0x03
+#define CS35L35_BST_CONV_SWFREQ_MASK    0xF0
+
 /* Class H Algorithm Control */
 #define CS35L35_CH_STEREO_MASK          0x40
 #define CS35L35_CH_STEREO_SHIFT         6
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index e78b5f055f25..d8824773dc29 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -674,8 +674,6 @@ static int cs4271_common_probe(struct device *dev,
                 cs4271->gpio_nreset = cs4271plat->gpio_nreset;
 
         if (gpio_is_valid(cs4271->gpio_nreset)) {
-                int ret;
-
                 ret = devm_gpio_request(dev, cs4271->gpio_nreset,
                                         "CS4271 Reset");
                 if (ret < 0)
diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
index 1e0d5973b758..06933a5d0a75 100644
--- a/sound/soc/codecs/cs53l30.c
+++ b/sound/soc/codecs/cs53l30.c
@@ -747,7 +747,7 @@ static unsigned int const cs53l30_src_rates[] = {
         8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, 48000
 };
 
-static struct snd_pcm_hw_constraint_list src_constraints = {
+static const struct snd_pcm_hw_constraint_list src_constraints = {
         .count = ARRAY_SIZE(cs53l30_src_rates),
         .list = cs53l30_src_rates,
 };
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 024d83fa6a7f..c3e11897f8ae 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -13,6 +13,8 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/of_device.h>
+#include <linux/property.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
@@ -1606,12 +1608,12 @@ static enum da7213_dmic_clk_rate
 }
 
 static struct da7213_platform_data
-        *da7213_of_to_pdata(struct snd_soc_codec *codec)
+        *da7213_fw_to_pdata(struct snd_soc_codec *codec)
 {
-        struct device_node *np = codec->dev->of_node;
+        struct device *dev = codec->dev;
         struct da7213_platform_data *pdata;
-        const char *of_str;
-        u32 of_val32;
+        const char *fw_str;
+        u32 fw_val32;
 
         pdata = devm_kzalloc(codec->dev, sizeof(*pdata), GFP_KERNEL);
         if (!pdata) {
@@ -1619,29 +1621,29 @@ static struct da7213_platform_data
                 return NULL;
         }
 
-        if (of_property_read_u32(np, "dlg,micbias1-lvl", &of_val32) >= 0)
-                pdata->micbias1_lvl = da7213_of_micbias_lvl(codec, of_val32);
+        if (device_property_read_u32(dev, "dlg,micbias1-lvl", &fw_val32) >= 0)
+                pdata->micbias1_lvl = da7213_of_micbias_lvl(codec, fw_val32);
         else
                 pdata->micbias1_lvl = DA7213_MICBIAS_2_2V;
 
-        if (of_property_read_u32(np, "dlg,micbias2-lvl", &of_val32) >= 0)
-                pdata->micbias2_lvl = da7213_of_micbias_lvl(codec, of_val32);
+        if (device_property_read_u32(dev, "dlg,micbias2-lvl", &fw_val32) >= 0)
+                pdata->micbias2_lvl = da7213_of_micbias_lvl(codec, fw_val32);
         else
                 pdata->micbias2_lvl = DA7213_MICBIAS_2_2V;
 
-        if (!of_property_read_string(np, "dlg,dmic-data-sel", &of_str))
-                pdata->dmic_data_sel = da7213_of_dmic_data_sel(codec, of_str);
+        if (!device_property_read_string(dev, "dlg,dmic-data-sel", &fw_str))
+                pdata->dmic_data_sel = da7213_of_dmic_data_sel(codec, fw_str);
         else
                 pdata->dmic_data_sel = DA7213_DMIC_DATA_LRISE_RFALL;
 
-        if (!of_property_read_string(np, "dlg,dmic-samplephase", &of_str))
+        if (!device_property_read_string(dev, "dlg,dmic-samplephase", &fw_str))
                 pdata->dmic_samplephase =
-                        da7213_of_dmic_samplephase(codec, of_str);
+                        da7213_of_dmic_samplephase(codec, fw_str);
         else
                 pdata->dmic_samplephase = DA7213_DMIC_SAMPLE_ON_CLKEDGE;
 
-        if (of_property_read_u32(np, "dlg,dmic-clkrate", &of_val32) >= 0)
-                pdata->dmic_clk_rate = da7213_of_dmic_clkrate(codec, of_val32);
+        if (device_property_read_u32(dev, "dlg,dmic-clkrate", &fw_val32) >= 0)
+                pdata->dmic_clk_rate = da7213_of_dmic_clkrate(codec, fw_val32);
         else
                 pdata->dmic_clk_rate = DA7213_DMIC_CLK_3_0MHZ;
 
@@ -1713,10 +1715,9 @@ static int da7213_probe(struct snd_soc_codec *codec)
                             DA7213_LINE_AMP_OE, DA7213_LINE_AMP_OE);
 
         /* Handle DT/Platform data */
-        if (codec->dev->of_node)
-                da7213->pdata = da7213_of_to_pdata(codec);
-        else
-                da7213->pdata = dev_get_platdata(codec->dev);
+        da7213->pdata = dev_get_platdata(codec->dev);
+        if (!da7213->pdata)
+                da7213->pdata = da7213_fw_to_pdata(codec);
 
         /* Set platform data values */
         if (da7213->pdata) {
diff --git a/sound/soc/codecs/da7218.c b/sound/soc/codecs/da7218.c
index d256ebf9e309..6e1940eb0653 100644
--- a/sound/soc/codecs/da7218.c
+++ b/sound/soc/codecs/da7218.c
@@ -1457,7 +1457,7 @@ static int da7218_dai_event(struct snd_soc_dapm_widget *w,
                                 ++i;
                                 msleep(DA7218_SRM_CHECK_DELAY);
                         }
-                } while ((i < DA7218_SRM_CHECK_TRIES) & (!success));
+                } while ((i < DA7218_SRM_CHECK_TRIES) && (!success));
 
                 if (!success)
                         dev_warn(codec->dev, "SRM failed to lock\n");
diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 6274d79c1353..1d1d10dd92ae 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c
@@ -115,19 +115,21 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
 
         u16 tonegen_freq_hptest;
-        u8 pll_srm_sts, gain_ramp_ctrl, accdet_cfg8;
+        u8 pll_srm_sts, pll_ctrl, gain_ramp_ctrl, accdet_cfg8;
         int report = 0, ret = 0;
 
-        /* Lock DAPM and any Kcontrols that are affected by this test */
+        /* Lock DAPM, Kcontrols affected by this test and the PLL */
         snd_soc_dapm_mutex_lock(dapm);
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
+        mutex_lock(&da7219->pll_lock);
 
         /* Ensure MCLK is available for HP test procedure */
         if (da7219->mclk) {
                 ret = clk_prepare_enable(da7219->mclk);
                 if (ret) {
                         dev_err(codec->dev, "Failed to enable mclk - %d\n", ret);
-                        mutex_unlock(&da7219->lock);
+                        mutex_unlock(&da7219->pll_lock);
+                        mutex_unlock(&da7219->ctrl_lock);
                         snd_soc_dapm_mutex_unlock(dapm);
                         return;
                 }
@@ -136,12 +138,21 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         /*
          * If MCLK not present, then we're using the internal oscillator and
          * require different frequency settings to achieve the same result.
+         *
+         * If MCLK is present, but PLL is not enabled then we enable it here to
+         * ensure a consistent detection procedure.
          */
         pll_srm_sts = snd_soc_read(codec, DA7219_PLL_SRM_STS);
-        if (pll_srm_sts & DA7219_PLL_SRM_STS_MCLK)
+        if (pll_srm_sts & DA7219_PLL_SRM_STS_MCLK) {
                 tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ);
-        else
+
+                pll_ctrl = snd_soc_read(codec, DA7219_PLL_CTRL);
+                if ((pll_ctrl & DA7219_PLL_MODE_MASK) == DA7219_PLL_MODE_BYPASS)
+                        da7219_set_pll(codec, DA7219_SYSCLK_PLL,
+                                       DA7219_PLL_FREQ_OUT_98304);
+        } else {
                 tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ_INT_OSC);
+        }
 
         /* Ensure gain ramping at fastest rate */
         gain_ramp_ctrl = snd_soc_read(codec, DA7219_GAIN_RAMP_CTRL);
@@ -302,11 +313,17 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         snd_soc_update_bits(codec, DA7219_HP_R_CTRL, DA7219_HP_R_AMP_OE_MASK,
                             DA7219_HP_R_AMP_OE_MASK);
 
+        /* Restore PLL to previous configuration, if re-configured */
+        if ((pll_srm_sts & DA7219_PLL_SRM_STS_MCLK) &&
+            ((pll_ctrl & DA7219_PLL_MODE_MASK) == DA7219_PLL_MODE_BYPASS))
+                da7219_set_pll(codec, DA7219_SYSCLK_MCLK, 0);
+
         /* Remove MCLK, if previously enabled */
         if (da7219->mclk)
                 clk_disable_unprepare(da7219->mclk);
 
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->pll_lock);
+        mutex_unlock(&da7219->ctrl_lock);
         snd_soc_dapm_mutex_unlock(dapm);
 
         /*
diff --git a/sound/soc/codecs/da7219.c b/sound/soc/codecs/da7219.c
index 99601627f83c..f71d72c22bfc 100644
--- a/sound/soc/codecs/da7219.c
+++ b/sound/soc/codecs/da7219.c
@@ -260,9 +260,9 @@ static int da7219_volsw_locked_get(struct snd_kcontrol *kcontrol,
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
         int ret;
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = snd_soc_get_volsw(kcontrol, ucontrol);
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         return ret;
 }
@@ -274,9 +274,9 @@ static int da7219_volsw_locked_put(struct snd_kcontrol *kcontrol,
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
         int ret;
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = snd_soc_put_volsw(kcontrol, ucontrol);
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         return ret;
 }
@@ -288,9 +288,9 @@ static int da7219_enum_locked_get(struct snd_kcontrol *kcontrol,
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
         int ret;
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = snd_soc_get_enum_double(kcontrol, ucontrol);
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         return ret;
 }
@@ -302,9 +302,9 @@ static int da7219_enum_locked_put(struct snd_kcontrol *kcontrol,
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
         int ret;
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = snd_soc_put_enum_double(kcontrol, ucontrol);
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         return ret;
 }
@@ -424,9 +424,9 @@ static int da7219_tonegen_freq_get(struct snd_kcontrol *kcontrol,
         u16 val;
         int ret;
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = regmap_raw_read(da7219->regmap, reg, &val, sizeof(val));
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         if (ret)
                 return ret;
@@ -458,9 +458,9 @@ static int da7219_tonegen_freq_put(struct snd_kcontrol *kcontrol,
          */
         val = cpu_to_le16(ucontrol->value.integer.value[0]);
 
-        mutex_lock(&da7219->lock);
+        mutex_lock(&da7219->ctrl_lock);
         ret = regmap_raw_write(da7219->regmap, reg, &val, sizeof(val));
-        mutex_unlock(&da7219->lock);
+        mutex_unlock(&da7219->ctrl_lock);
 
         return ret;
 }
@@ -801,7 +801,7 @@ static int da7219_dai_event(struct snd_soc_dapm_widget *w,
                                 ++i;
                                 msleep(50);
                         }
-                } while ((i < DA7219_SRM_CHECK_RETRIES) && (!srm_lock));
+                } while ((i < DA7219_SRM_CHECK_RETRIES) & (!srm_lock));
 
                 if (!srm_lock)
                         dev_warn(codec->dev, "SRM failed to lock\n");
@@ -1129,6 +1129,8 @@ static int da7219_set_dai_sysclk(struct snd_soc_dai *codec_dai,
                 return -EINVAL;
         }
 
+        mutex_lock(&da7219->pll_lock);
+
         switch (clk_id) {
         case DA7219_CLKSRC_MCLK_SQR:
                 snd_soc_update_bits(codec, DA7219_PLL_CTRL,
@@ -1141,6 +1143,7 @@ static int da7219_set_dai_sysclk(struct snd_soc_dai *codec_dai,
                 break;
         default:
                 dev_err(codec_dai->dev, "Unknown clock source %d\n", clk_id);
+                mutex_unlock(&da7219->pll_lock);
                 return -EINVAL;
         }
 
@@ -1152,19 +1155,20 @@ static int da7219_set_dai_sysclk(struct snd_soc_dai *codec_dai,
                 if (ret) {
                         dev_err(codec_dai->dev, "Failed to set clock rate %d\n",
                                 freq);
+                        mutex_unlock(&da7219->pll_lock);
                         return ret;
                 }
         }
 
         da7219->mclk_rate = freq;
 
+        mutex_unlock(&da7219->pll_lock);
+
         return 0;
 }
 
-static int da7219_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
-                              int source, unsigned int fref, unsigned int fout)
+int da7219_set_pll(struct snd_soc_codec *codec, int source, unsigned int fout)
 {
-        struct snd_soc_codec *codec = codec_dai->codec;
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
 
         u8 pll_ctrl, indiv_bits, indiv;
@@ -1237,6 +1241,20 @@ static int da7219_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
         return 0;
 }
 
+static int da7219_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
+                              int source, unsigned int fref, unsigned int fout)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
+        int ret;
+
+        mutex_lock(&da7219->pll_lock);
+        ret = da7219_set_pll(codec, source, fout);
+        mutex_unlock(&da7219->pll_lock);
+
+        return ret;
+}
+
 static int da7219_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 {
         struct snd_soc_codec *codec = codec_dai->codec;
@@ -1741,7 +1759,8 @@ static int da7219_probe(struct snd_soc_codec *codec)
         unsigned int rev;
         int ret;
 
-        mutex_init(&da7219->lock);
+        mutex_init(&da7219->ctrl_lock);
+        mutex_init(&da7219->pll_lock);
 
         /* Regulator configuration */
         ret = da7219_handle_supplies(codec);
diff --git a/sound/soc/codecs/da7219.h b/sound/soc/codecs/da7219.h
index 6baba7455fa1..8d6c3c8c8026 100644
--- a/sound/soc/codecs/da7219.h
+++ b/sound/soc/codecs/da7219.h
@@ -810,7 +810,8 @@ struct da7219_priv {
         bool wakeup_source;
         struct regulator_bulk_data supplies[DA7219_NUM_SUPPLIES];
         struct regmap *regmap;
-        struct mutex lock;
+        struct mutex ctrl_lock;
+        struct mutex pll_lock;
 
         struct clk *mclk;
         unsigned int mclk_rate;
@@ -821,4 +822,6 @@ struct da7219_priv {
         u8 gain_ramp_ctrl;
 };
 
+int da7219_set_pll(struct snd_soc_codec *codec, int source, unsigned int fout);
+
 #endif /* __DA7219_H */
diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
new file mode 100644
index 000000000000..ecc02449c569
--- /dev/null
+++ b/sound/soc/codecs/es8316.c
@@ -0,0 +1,637 @@
+/*
+ * es8316.c -- es8316 ALSA SoC audio driver
+ * Copyright Everest Semiconductor Co.,Ltd
+ *
+ * Authors: David Yang <yangxiaohua@everest-semi.com>,
+ *          Daniel Drake <drake@endlessm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/mod_devicetable.h>
+#include <linux/regmap.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/tlv.h>
+#include "es8316.h"
+
+/* In slave mode at single speed, the codec is documented as accepting 5
+ * MCLK/LRCK ratios, but we also add ratio 400, which is commonly used on
+ * Intel Cherry Trail platforms (19.2MHz MCLK, 48kHz LRCK).
+ */
+#define NR_SUPPORTED_MCLK_LRCK_RATIOS 6
+static const unsigned int supported_mclk_lrck_ratios[] = {
+        256, 384, 400, 512, 768, 1024
+};
+
+struct es8316_priv {
+        unsigned int sysclk;
+        unsigned int allowed_rates[NR_SUPPORTED_MCLK_LRCK_RATIOS];
+        struct snd_pcm_hw_constraint_list sysclk_constraints;
+};
+
+/*
+ * ES8316 controls
+ */
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(hpmixer_gain_tlv, -1200, 150, 0);
+
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(adc_pga_gain_tlv,
+        0, 0, TLV_DB_SCALE_ITEM(-350, 0, 0),
+        1, 1, TLV_DB_SCALE_ITEM(0, 0, 0),
+        2, 2, TLV_DB_SCALE_ITEM(250, 0, 0),
+        3, 3, TLV_DB_SCALE_ITEM(450, 0, 0),
+        4, 4, TLV_DB_SCALE_ITEM(700, 0, 0),
+        5, 5, TLV_DB_SCALE_ITEM(1000, 0, 0),
+        6, 6, TLV_DB_SCALE_ITEM(1300, 0, 0),
+        7, 7, TLV_DB_SCALE_ITEM(1600, 0, 0),
+        8, 8, TLV_DB_SCALE_ITEM(1800, 0, 0),
+        9, 9, TLV_DB_SCALE_ITEM(2100, 0, 0),
+        10, 10, TLV_DB_SCALE_ITEM(2400, 0, 0),
+);
+
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpout_vol_tlv,
+        0, 0, TLV_DB_SCALE_ITEM(-4800, 0, 0),
+        1, 3, TLV_DB_SCALE_ITEM(-2400, 1200, 0),
+);
+
+static const char * const ng_type_txt[] =
+        { "Constant PGA Gain", "Mute ADC Output" };
+static const struct soc_enum ng_type =
+        SOC_ENUM_SINGLE(ES8316_ADC_ALC_NG, 6, 2, ng_type_txt);
+
+static const char * const adcpol_txt[] = { "Normal", "Invert" };
+static const struct soc_enum adcpol =
+        SOC_ENUM_SINGLE(ES8316_ADC_MUTE, 1, 2, adcpol_txt);
+static const char *const dacpol_txt[] =
+        { "Normal", "R Invert", "L Invert", "L + R Invert" };
+static const struct soc_enum dacpol =
+        SOC_ENUM_SINGLE(ES8316_DAC_SET1, 0, 4, dacpol_txt);
+
+static const struct snd_kcontrol_new es8316_snd_controls[] = {
+        SOC_DOUBLE_TLV("Headphone Playback Volume", ES8316_CPHP_ICAL_VOL,
+                       4, 0, 3, 1, hpout_vol_tlv),
+        SOC_DOUBLE_TLV("Headphone Mixer Volume", ES8316_HPMIX_VOL,
+                       0, 4, 7, 0, hpmixer_gain_tlv),
+
+        SOC_ENUM("Playback Polarity", dacpol),
+        SOC_DOUBLE_R_TLV("DAC Playback Volume", ES8316_DAC_VOLL,
+                         ES8316_DAC_VOLR, 0, 0xc0, 1, dac_vol_tlv),
+        SOC_SINGLE("DAC Soft Ramp Switch", ES8316_DAC_SET1, 4, 1, 1),
+        SOC_SINGLE("DAC Soft Ramp Rate", ES8316_DAC_SET1, 2, 4, 0),
+        SOC_SINGLE("DAC Notch Filter Switch", ES8316_DAC_SET2, 6, 1, 0),
+        SOC_SINGLE("DAC Double Fs Switch", ES8316_DAC_SET2, 7, 1, 0),
+        SOC_SINGLE("DAC Stereo Enhancement", ES8316_DAC_SET3, 0, 7, 0),
+
+        SOC_ENUM("Capture Polarity", adcpol),
+        SOC_SINGLE("Mic Boost Switch", ES8316_ADC_D2SEPGA, 0, 1, 0),
+        SOC_SINGLE_TLV("ADC Capture Volume", ES8316_ADC_VOLUME,
+                       0, 0xc0, 1, adc_vol_tlv),
+        SOC_SINGLE_TLV("ADC PGA Gain Volume", ES8316_ADC_PGAGAIN,
+                       4, 10, 0, adc_pga_gain_tlv),
+        SOC_SINGLE("ADC Soft Ramp Switch", ES8316_ADC_MUTE, 4, 1, 0),
+        SOC_SINGLE("ADC Double Fs Switch", ES8316_ADC_DMIC, 4, 1, 0),
+
+        SOC_SINGLE("ALC Capture Switch", ES8316_ADC_ALC1, 6, 1, 0),
+        SOC_SINGLE_TLV("ALC Capture Max Volume", ES8316_ADC_ALC1, 0, 28, 0,
+                       alc_max_gain_tlv),
+        SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0,
+                       alc_min_gain_tlv),
+        SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0,
+                       alc_target_tlv),
+        SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0),
+        SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0),
+        SOC_SINGLE("ALC Capture Attack Time", ES8316_ADC_ALC4, 0, 10, 0),
+        SOC_SINGLE("ALC Capture Noise Gate Switch", ES8316_ADC_ALC_NG,
+                   5, 1, 0),
+        SOC_SINGLE("ALC Capture Noise Gate Threshold", ES8316_ADC_ALC_NG,
+                   0, 31, 0),
+        SOC_ENUM("ALC Capture Noise Gate Type", ng_type),
+};
+
+/* Analog Input Mux */
+static const char * const es8316_analog_in_txt[] = {
+                "lin1-rin1",
+                "lin2-rin2",
+                "lin1-rin1 with 20db Boost",
+                "lin2-rin2 with 20db Boost"
+};
+static const unsigned int es8316_analog_in_values[] = { 0, 1, 2, 3 };
+static const struct soc_enum es8316_analog_input_enum =
+        SOC_VALUE_ENUM_SINGLE(ES8316_ADC_PDN_LINSEL, 4, 3,
+                              ARRAY_SIZE(es8316_analog_in_txt),
+                              es8316_analog_in_txt,
+                              es8316_analog_in_values);
+static const struct snd_kcontrol_new es8316_analog_in_mux_controls =
+        SOC_DAPM_ENUM("Route", es8316_analog_input_enum);
+
+static const char * const es8316_dmic_txt[] = {
+                "dmic disable",
+                "dmic data at high level",
+                "dmic data at low level",
+};
+static const unsigned int es8316_dmic_values[] = { 0, 1, 2 };
+static const struct soc_enum es8316_dmic_src_enum =
+        SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3,
+                              ARRAY_SIZE(es8316_dmic_txt),
+                              es8316_dmic_txt,
+                              es8316_dmic_values);
+static const struct snd_kcontrol_new es8316_dmic_src_controls =
+        SOC_DAPM_ENUM("Route", es8316_dmic_src_enum);
+
+/* hp mixer mux */
+static const char * const es8316_hpmux_texts[] = {
+        "lin1-rin1",
+        "lin2-rin2",
+        "lin-rin with Boost",
+        "lin-rin with Boost and PGA"
+};
+
+static const unsigned int es8316_hpmux_values[] = { 0, 1, 2, 3 };
+
+static SOC_ENUM_SINGLE_DECL(es8316_left_hpmux_enum, ES8316_HPMIX_SEL,
+        4, es8316_hpmux_texts);
+
+static const struct snd_kcontrol_new es8316_left_hpmux_controls =
+        SOC_DAPM_ENUM("Route", es8316_left_hpmux_enum);
+
+static SOC_ENUM_SINGLE_DECL(es8316_right_hpmux_enum, ES8316_HPMIX_SEL,
+        0, es8316_hpmux_texts);
+
+static const struct snd_kcontrol_new es8316_right_hpmux_controls =
+        SOC_DAPM_ENUM("Route", es8316_right_hpmux_enum);
+
+/* headphone Output Mixer */
+static const struct snd_kcontrol_new es8316_out_left_mix[] = {
+        SOC_DAPM_SINGLE("LLIN Switch", ES8316_HPMIX_SWITCH, 6, 1, 0),
+        SOC_DAPM_SINGLE("Left DAC Switch", ES8316_HPMIX_SWITCH, 7, 1, 0),
+};
+static const struct snd_kcontrol_new es8316_out_right_mix[] = {
+        SOC_DAPM_SINGLE("RLIN Switch", ES8316_HPMIX_SWITCH, 2, 1, 0),
+        SOC_DAPM_SINGLE("Right DAC Switch", ES8316_HPMIX_SWITCH, 3, 1, 0),
+};
+
+/* DAC data source mux */
+static const char * const es8316_dacsrc_texts[] = {
+        "LDATA TO LDAC, RDATA TO RDAC",
+        "LDATA TO LDAC, LDATA TO RDAC",
+        "RDATA TO LDAC, RDATA TO RDAC",
+        "RDATA TO LDAC, LDATA TO RDAC",
+};
+
+static const unsigned int es8316_dacsrc_values[] = { 0, 1, 2, 3 };
+
+static SOC_ENUM_SINGLE_DECL(es8316_dacsrc_mux_enum, ES8316_DAC_SET1,
+        6, es8316_dacsrc_texts);
+
+static const struct snd_kcontrol_new es8316_dacsrc_mux_controls =
+        SOC_DAPM_ENUM("Route", es8316_dacsrc_mux_enum);
+
+static const struct snd_soc_dapm_widget es8316_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("Bias", ES8316_SYS_PDN, 3, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Analog power", ES8316_SYS_PDN, 4, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Mic Bias", ES8316_SYS_PDN, 5, 1, NULL, 0),
+
+        SND_SOC_DAPM_INPUT("DMIC"),
+        SND_SOC_DAPM_INPUT("MIC1"),
+        SND_SOC_DAPM_INPUT("MIC2"),
+
+        /* Input Mux */
+        SND_SOC_DAPM_MUX("Differential Mux", SND_SOC_NOPM, 0, 0,
+                         &es8316_analog_in_mux_controls),
+
+        SND_SOC_DAPM_SUPPLY("ADC Vref", ES8316_SYS_PDN, 1, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC bias", ES8316_SYS_PDN, 2, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC Clock", ES8316_CLKMGR_CLKSW, 3, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Line input PGA", ES8316_ADC_PDN_LINSEL,
+                         7, 1, NULL, 0),
+        SND_SOC_DAPM_ADC("Mono ADC", NULL, ES8316_ADC_PDN_LINSEL, 6, 1),
+        SND_SOC_DAPM_MUX("Digital Mic Mux", SND_SOC_NOPM, 0, 0,
+                         &es8316_dmic_src_controls),
+
+        /* Digital Interface */
+        SND_SOC_DAPM_AIF_OUT("I2S OUT", "I2S1 Capture",  1,
+                             ES8316_SERDATA_ADC, 6, 1),
+        SND_SOC_DAPM_AIF_IN("I2S IN", "I2S1 Playback", 0,
+                            SND_SOC_NOPM, 0, 0),
+
+        SND_SOC_DAPM_MUX("DAC Source Mux", SND_SOC_NOPM, 0, 0,
+                         &es8316_dacsrc_mux_controls),
+
+        SND_SOC_DAPM_SUPPLY("DAC Vref", ES8316_SYS_PDN, 0, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DAC Clock", ES8316_CLKMGR_CLKSW, 2, 0, NULL, 0),
+        SND_SOC_DAPM_DAC("Right DAC", NULL, ES8316_DAC_PDN, 0, 1),
+        SND_SOC_DAPM_DAC("Left DAC", NULL, ES8316_DAC_PDN, 4, 1),
+
+        /* Headphone Output Side */
+        SND_SOC_DAPM_MUX("Left Headphone Mux", SND_SOC_NOPM, 0, 0,
+                         &es8316_left_hpmux_controls),
+        SND_SOC_DAPM_MUX("Right Headphone Mux", SND_SOC_NOPM, 0, 0,
+                         &es8316_right_hpmux_controls),
+        SND_SOC_DAPM_MIXER("Left Headphone Mixer", ES8316_HPMIX_PDN,
+                           5, 1, &es8316_out_left_mix[0],
+                           ARRAY_SIZE(es8316_out_left_mix)),
+        SND_SOC_DAPM_MIXER("Right Headphone Mixer", ES8316_HPMIX_PDN,
+                           1, 1, &es8316_out_right_mix[0],
+                           ARRAY_SIZE(es8316_out_right_mix)),
+        SND_SOC_DAPM_PGA("Left Headphone Mixer Out", ES8316_HPMIX_PDN,
+                         4, 1, NULL, 0),
+        SND_SOC_DAPM_PGA("Right Headphone Mixer Out", ES8316_HPMIX_PDN,
+                         0, 1, NULL, 0),
+
+        SND_SOC_DAPM_OUT_DRV("Left Headphone Charge Pump", ES8316_CPHP_OUTEN,
+                             6, 0, NULL, 0),
+        SND_SOC_DAPM_OUT_DRV("Right Headphone Charge Pump", ES8316_CPHP_OUTEN,
+                             2, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Headphone Charge Pump", ES8316_CPHP_PDN2,
+                            5, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Headphone Charge Pump Clock", ES8316_CLKMGR_CLKSW,
+                            4, 0, NULL, 0),
+
+        SND_SOC_DAPM_OUT_DRV("Left Headphone Driver", ES8316_CPHP_OUTEN,
+                             5, 0, NULL, 0),
+        SND_SOC_DAPM_OUT_DRV("Right Headphone Driver", ES8316_CPHP_OUTEN,
+                             1, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Headphone Out", ES8316_CPHP_PDN1, 2, 1, NULL, 0),
+
+        /* pdn_Lical and pdn_Rical bits are documented as Reserved, but must
+         * be explicitly unset in order to enable HP output
+         */
+        SND_SOC_DAPM_SUPPLY("Left Headphone ical", ES8316_CPHP_ICAL_VOL,
+                            7, 1, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Right Headphone ical", ES8316_CPHP_ICAL_VOL,
+                            3, 1, NULL, 0),
+
+        SND_SOC_DAPM_OUTPUT("HPOL"),
+        SND_SOC_DAPM_OUTPUT("HPOR"),
+};
+
+static const struct snd_soc_dapm_route es8316_dapm_routes[] = {
+        /* Recording */
+        {"MIC1", NULL, "Mic Bias"},
+        {"MIC2", NULL, "Mic Bias"},
+        {"MIC1", NULL, "Bias"},
+        {"MIC2", NULL, "Bias"},
+        {"MIC1", NULL, "Analog power"},
+        {"MIC2", NULL, "Analog power"},
+
+        {"Differential Mux", "lin1-rin1", "MIC1"},
+        {"Differential Mux", "lin2-rin2", "MIC2"},
+        {"Line input PGA", NULL, "Differential Mux"},
+
+        {"Mono ADC", NULL, "ADC Clock"},
+        {"Mono ADC", NULL, "ADC Vref"},
+        {"Mono ADC", NULL, "ADC bias"},
+        {"Mono ADC", NULL, "Line input PGA"},
+
+        /* It's not clear why, but to avoid recording only silence,
+         * the DAC clock must be running for the ADC to work.
+         */
+        {"Mono ADC", NULL, "DAC Clock"},
+
+        {"Digital Mic Mux", "dmic disable", "Mono ADC"},
+
+        {"I2S OUT", NULL, "Digital Mic Mux"},
+
+        /* Playback */
+        {"DAC Source Mux", "LDATA TO LDAC, RDATA TO RDAC", "I2S IN"},
+
+        {"Left DAC", NULL, "DAC Clock"},
+        {"Right DAC", NULL, "DAC Clock"},
+
+        {"Left DAC", NULL, "DAC Vref"},
+        {"Right DAC", NULL, "DAC Vref"},
+
+        {"Left DAC", NULL, "DAC Source Mux"},
+        {"Right DAC", NULL, "DAC Source Mux"},
+
+        {"Left Headphone Mux", "lin-rin with Boost and PGA", "Line input PGA"},
+        {"Right Headphone Mux", "lin-rin with Boost and PGA", "Line input PGA"},
+
+        {"Left Headphone Mixer", "LLIN Switch", "Left Headphone Mux"},
+        {"Left Headphone Mixer", "Left DAC Switch", "Left DAC"},
+
+        {"Right Headphone Mixer", "RLIN Switch", "Right Headphone Mux"},
+        {"Right Headphone Mixer", "Right DAC Switch", "Right DAC"},
+
+        {"Left Headphone Mixer Out", NULL, "Left Headphone Mixer"},
+        {"Right Headphone Mixer Out", NULL, "Right Headphone Mixer"},
+
+        {"Left Headphone Charge Pump", NULL, "Left Headphone Mixer Out"},
+        {"Right Headphone Charge Pump", NULL, "Right Headphone Mixer Out"},
+
+        {"Left Headphone Charge Pump", NULL, "Headphone Charge Pump"},
+        {"Right Headphone Charge Pump", NULL, "Headphone Charge Pump"},
+
+        {"Left Headphone Charge Pump", NULL, "Headphone Charge Pump Clock"},
+        {"Right Headphone Charge Pump", NULL, "Headphone Charge Pump Clock"},
+
+        {"Left Headphone Driver", NULL, "Left Headphone Charge Pump"},
+        {"Right Headphone Driver", NULL, "Right Headphone Charge Pump"},
+
+        {"HPOL", NULL, "Left Headphone Driver"},
+        {"HPOR", NULL, "Right Headphone Driver"},
+
+        {"HPOL", NULL, "Left Headphone ical"},
+        {"HPOR", NULL, "Right Headphone ical"},
+
+        {"Headphone Out", NULL, "Bias"},
+        {"Headphone Out", NULL, "Analog power"},
+        {"HPOL", NULL, "Headphone Out"},
+        {"HPOR", NULL, "Headphone Out"},
+};
+
+static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai,
+                                 int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct es8316_priv *es8316 = snd_soc_codec_get_drvdata(codec);
+        int i;
+        int count = 0;
+
+        es8316->sysclk = freq;
+
+        if (freq == 0)
+                return 0;
+
+        /* Limit supported sample rates to ones that can be autodetected
+         * by the codec running in slave mode.
+         */
+        for (i = 0; i < NR_SUPPORTED_MCLK_LRCK_RATIOS; i++) {
+                const unsigned int ratio = supported_mclk_lrck_ratios[i];
+
+                if (freq % ratio == 0)
+                        es8316->allowed_rates[count++] = freq / ratio;
+        }
+
+        es8316->sysclk_constraints.list = es8316->allowed_rates;
+        es8316->sysclk_constraints.count = count;
+
+        return 0;
+}
+
+static int es8316_set_dai_fmt(struct snd_soc_dai *codec_dai,
+                              unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        u8 serdata1 = 0;
+        u8 serdata2 = 0;
+        u8 clksw;
+        u8 mask;
+
+        if ((fmt & SND_SOC_DAIFMT_MASTER_MASK) != SND_SOC_DAIFMT_CBS_CFS) {
+                dev_err(codec->dev, "Codec driver only supports slave mode\n");
+                return -EINVAL;
+        }
+
+        if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_I2S) {
+                dev_err(codec->dev, "Codec driver only supports I2S format\n");
+                return -EINVAL;
+        }
+
+        /* Clock inversion */
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                serdata1 |= ES8316_SERDATA1_BCLK_INV;
+                serdata2 |= ES8316_SERDATA2_ADCLRP;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                serdata1 |= ES8316_SERDATA1_BCLK_INV;
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                serdata2 |= ES8316_SERDATA2_ADCLRP;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        mask = ES8316_SERDATA1_MASTER | ES8316_SERDATA1_BCLK_INV;
+        snd_soc_update_bits(codec, ES8316_SERDATA1, mask, serdata1);
+
+        mask = ES8316_SERDATA2_FMT_MASK | ES8316_SERDATA2_ADCLRP;
+        snd_soc_update_bits(codec, ES8316_SERDATA_ADC, mask, serdata2);
+        snd_soc_update_bits(codec, ES8316_SERDATA_DAC, mask, serdata2);
+
+        /* Enable BCLK and MCLK inputs in slave mode */
+        clksw = ES8316_CLKMGR_CLKSW_MCLK_ON | ES8316_CLKMGR_CLKSW_BCLK_ON;
+        snd_soc_update_bits(codec, ES8316_CLKMGR_CLKSW, clksw, clksw);
+
+        return 0;
+}
+
+static int es8316_pcm_startup(struct snd_pcm_substream *substream,
+                              struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct es8316_priv *es8316 = snd_soc_codec_get_drvdata(codec);
+
+        if (es8316->sysclk == 0) {
+                dev_err(codec->dev, "No sysclk provided\n");
+                return -EINVAL;
+        }
+
+        /* The set of sample rates that can be supported depends on the
+         * MCLK supplied to the CODEC.
+         */
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                   SNDRV_PCM_HW_PARAM_RATE,
+                                   &es8316->sysclk_constraints);
+
+        return 0;
+}
+
+static int es8316_pcm_hw_params(struct snd_pcm_substream *substream,
+                                struct snd_pcm_hw_params *params,
+                                struct snd_soc_dai *dai)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_codec *codec = rtd->codec;
+        struct es8316_priv *es8316 = snd_soc_codec_get_drvdata(codec);
+        u8 wordlen = 0;
+
+        if (!es8316->sysclk) {
+                dev_err(codec->dev, "No MCLK configured\n");
+                return -EINVAL;
+        }
+
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_S16_LE:
+                wordlen = ES8316_SERDATA2_LEN_16;
+                break;
+        case SNDRV_PCM_FORMAT_S20_3LE:
+                wordlen = ES8316_SERDATA2_LEN_20;
+                break;
+        case SNDRV_PCM_FORMAT_S24_LE:
+                wordlen = ES8316_SERDATA2_LEN_24;
+                break;
+        case SNDRV_PCM_FORMAT_S32_LE:
+                wordlen = ES8316_SERDATA2_LEN_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, ES8316_SERDATA_DAC,
+                            ES8316_SERDATA2_LEN_MASK, wordlen);
+        snd_soc_update_bits(codec, ES8316_SERDATA_ADC,
+                            ES8316_SERDATA2_LEN_MASK, wordlen);
+        return 0;
+}
+
+static int es8316_mute(struct snd_soc_dai *dai, int mute)
+{
+        snd_soc_update_bits(dai->codec, ES8316_DAC_SET1, 0x20,
+                            mute ? 0x20 : 0);
+        return 0;
+}
+
+#define ES8316_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE)
+
+static struct snd_soc_dai_ops es8316_ops = {
+        .startup = es8316_pcm_startup,
+        .hw_params = es8316_pcm_hw_params,
+        .set_fmt = es8316_set_dai_fmt,
+        .set_sysclk = es8316_set_dai_sysclk,
+        .digital_mute = es8316_mute,
+};
+
+static struct snd_soc_dai_driver es8316_dai = {
+        .name = "ES8316 HiFi",
+        .playback = {
+                .stream_name = "Playback",
+                .channels_min = 1,
+                .channels_max = 2,
+                .rates = SNDRV_PCM_RATE_8000_48000,
+                .formats = ES8316_FORMATS,
+        },
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 1,
+                .channels_max = 2,
+                .rates = SNDRV_PCM_RATE_8000_48000,
+                .formats = ES8316_FORMATS,
+        },
+        .ops = &es8316_ops,
+        .symmetric_rates = 1,
+};
+
+static int es8316_probe(struct snd_soc_codec *codec)
+{
+        /* Reset codec and enable current state machine */
+        snd_soc_write(codec, ES8316_RESET, 0x3f);
+        usleep_range(5000, 5500);
+        snd_soc_write(codec, ES8316_RESET, ES8316_RESET_CSM_ON);
+        msleep(30);
+
+        /*
+         * Documentation is unclear, but this value from the vendor driver is
+         * needed otherwise audio output is silent.
+         */
+        snd_soc_write(codec, ES8316_SYS_VMIDSEL, 0xff);
+
+        /*
+         * Documentation for this register is unclear and incomplete,
+         * but here is a vendor-provided value that improves volume
+         * and quality for Intel CHT platforms.
+         */
+        snd_soc_write(codec, ES8316_CLKMGR_ADCOSR, 0x32);
+
+        return 0;
+}
+
+static struct snd_soc_codec_driver soc_codec_dev_es8316 = {
+        .probe          = es8316_probe,
+        .idle_bias_off  = true,
+
+        .component_driver = {
+                .controls               = es8316_snd_controls,
+                .num_controls           = ARRAY_SIZE(es8316_snd_controls),
+                .dapm_widgets           = es8316_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(es8316_dapm_widgets),
+                .dapm_routes            = es8316_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(es8316_dapm_routes),
+        },
+};
+
+static const struct regmap_config es8316_regmap = {
+        .reg_bits = 8,
+        .val_bits = 8,
+        .max_register = 0x53,
+        .cache_type = REGCACHE_RBTREE,
+};
+
+static int es8316_i2c_probe(struct i2c_client *i2c_client,
+                            const struct i2c_device_id *id)
+{
+        struct es8316_priv *es8316;
+        struct regmap *regmap;
+
+        es8316 = devm_kzalloc(&i2c_client->dev, sizeof(struct es8316_priv),
+                              GFP_KERNEL);
+        if (es8316 == NULL)
+                return -ENOMEM;
+
+        i2c_set_clientdata(i2c_client, es8316);
+
+        regmap = devm_regmap_init_i2c(i2c_client, &es8316_regmap);
+        if (IS_ERR(regmap))
+                return PTR_ERR(regmap);
+
+        return snd_soc_register_codec(&i2c_client->dev, &soc_codec_dev_es8316,
+                                      &es8316_dai, 1);
+}
+
+static int es8316_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct i2c_device_id es8316_i2c_id[] = {
+        {"es8316", 0 },
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, es8316_i2c_id);
+
+static const struct of_device_id es8316_of_match[] = {
+        { .compatible = "everest,es8316", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, es8316_of_match);
+
+static const struct acpi_device_id es8316_acpi_match[] = {
+        {"ESSX8316", 0},
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, es8316_acpi_match);
+
+static struct i2c_driver es8316_i2c_driver = {
+        .driver = {
+                .name                   = "es8316",
+                .acpi_match_table       = ACPI_PTR(es8316_acpi_match),
+                .of_match_table         = of_match_ptr(es8316_of_match),
+        },
+        .probe          = es8316_i2c_probe,
+        .remove         = es8316_i2c_remove,
+        .id_table       = es8316_i2c_id,
+};
+module_i2c_driver(es8316_i2c_driver);
+
+MODULE_DESCRIPTION("Everest Semi ES8316 ALSA SoC Codec Driver");
+MODULE_AUTHOR("David Yang <yangxiaohua@everest-semi.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/es8316.h b/sound/soc/codecs/es8316.h
new file mode 100644
index 000000000000..6bcdd63ea459
--- /dev/null
+++ b/sound/soc/codecs/es8316.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright Everest Semiconductor Co.,Ltd
+ *
+ * Author: David Yang <yangxiaohua@everest-semi.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef _ES8316_H
+#define _ES8316_H
+
+/*
+ * ES8316 register space
+ */
+
+/* Reset Control */
+#define ES8316_RESET            0x00
+
+/* Clock Management */
+#define ES8316_CLKMGR_CLKSW     0x01
+#define ES8316_CLKMGR_CLKSEL    0x02
+#define ES8316_CLKMGR_ADCOSR    0x03
+#define ES8316_CLKMGR_ADCDIV1   0x04
+#define ES8316_CLKMGR_ADCDIV2   0x05
+#define ES8316_CLKMGR_DACDIV1   0x06
+#define ES8316_CLKMGR_DACDIV2   0x07
+#define ES8316_CLKMGR_CPDIV     0x08
+
+/* Serial Data Port Control */
+#define ES8316_SERDATA1         0x09
+#define ES8316_SERDATA_ADC      0x0a
+#define ES8316_SERDATA_DAC      0x0b
+
+/* System Control */
+#define ES8316_SYS_VMIDSEL      0x0c
+#define ES8316_SYS_PDN          0x0d
+#define ES8316_SYS_LP1          0x0e
+#define ES8316_SYS_LP2          0x0f
+#define ES8316_SYS_VMIDLOW      0x10
+#define ES8316_SYS_VSEL         0x11
+#define ES8316_SYS_REF          0x12
+
+/* Headphone Mixer */
+#define ES8316_HPMIX_SEL        0x13
+#define ES8316_HPMIX_SWITCH     0x14
+#define ES8316_HPMIX_PDN        0x15
+#define ES8316_HPMIX_VOL        0x16
+
+/* Charge Pump Headphone driver */
+#define ES8316_CPHP_OUTEN       0x17
+#define ES8316_CPHP_ICAL_VOL    0x18
+#define ES8316_CPHP_PDN1        0x19
+#define ES8316_CPHP_PDN2        0x1a
+#define ES8316_CPHP_LDOCTL      0x1b
+
+/* Calibration */
+#define ES8316_CAL_TYPE         0x1c
+#define ES8316_CAL_SET          0x1d
+#define ES8316_CAL_HPLIV        0x1e
+#define ES8316_CAL_HPRIV        0x1f
+#define ES8316_CAL_HPLMV        0x20
+#define ES8316_CAL_HPRMV        0x21
+
+/* ADC Control */
+#define ES8316_ADC_PDN_LINSEL   0x22
+#define ES8316_ADC_PGAGAIN      0x23
+#define ES8316_ADC_D2SEPGA      0x24
+#define ES8316_ADC_DMIC         0x25
+#define ES8316_ADC_MUTE         0x26
+#define ES8316_ADC_VOLUME       0x27
+#define ES8316_ADC_ALC1         0x29
+#define ES8316_ADC_ALC2         0x2a
+#define ES8316_ADC_ALC3         0x2b
+#define ES8316_ADC_ALC4         0x2c
+#define ES8316_ADC_ALC5         0x2d
+#define ES8316_ADC_ALC_NG       0x2e
+
+/* DAC Control */
+#define ES8316_DAC_PDN          0x2f
+#define ES8316_DAC_SET1         0x30
+#define ES8316_DAC_SET2         0x31
+#define ES8316_DAC_SET3         0x32
+#define ES8316_DAC_VOLL         0x33
+#define ES8316_DAC_VOLR         0x34
+
+/* GPIO */
+#define ES8316_GPIO_SEL         0x4d
+#define ES8316_GPIO_DEBOUNCE    0x4e
+#define ES8316_GPIO_FLAG        0x4f
+
+/* Test mode */
+#define ES8316_TESTMODE         0x50
+#define ES8316_TEST1            0x51
+#define ES8316_TEST2            0x52
+#define ES8316_TEST3            0x53
+
+/*
+ * Field definitions
+ */
+
+/* ES8316_RESET */
+#define ES8316_RESET_CSM_ON             0x80
+
+/* ES8316_CLKMGR_CLKSW */
+#define ES8316_CLKMGR_CLKSW_MCLK_ON     0x40
+#define ES8316_CLKMGR_CLKSW_BCLK_ON     0x20
+
+/* ES8316_SERDATA1 */
+#define ES8316_SERDATA1_MASTER          0x80
+#define ES8316_SERDATA1_BCLK_INV        0x20
+
+/* ES8316_SERDATA_ADC and _DAC */
+#define ES8316_SERDATA2_FMT_MASK        0x3
+#define ES8316_SERDATA2_FMT_I2S         0x00
+#define ES8316_SERDATA2_FMT_LEFTJ       0x01
+#define ES8316_SERDATA2_FMT_RIGHTJ      0x02
+#define ES8316_SERDATA2_FMT_PCM         0x03
+#define ES8316_SERDATA2_ADCLRP          0x20
+#define ES8316_SERDATA2_LEN_MASK        0x1c
+#define ES8316_SERDATA2_LEN_24          0x00
+#define ES8316_SERDATA2_LEN_20          0x04
+#define ES8316_SERDATA2_LEN_18          0x08
+#define ES8316_SERDATA2_LEN_16          0x0c
+#define ES8316_SERDATA2_LEN_32          0x10
+
+#endif
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 8c5ae1fc23a9..22ed0dc88f0a 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -25,17 +25,6 @@
 
 #include <drm/drm_crtc.h> /* This is only to get MAX_ELD_BYTES */
 
-struct hdmi_device {
-        struct device *dev;
-        struct list_head list;
-        int cnt;
-};
-#define pos_to_hdmi_device(pos) container_of((pos), struct hdmi_device, list)
-LIST_HEAD(hdmi_device_list);
-static DEFINE_MUTEX(hdmi_mutex);
-
-#define DAI_NAME_SIZE 16
-
 #define HDMI_CODEC_CHMAP_IDX_UNKNOWN  -1
 
 struct hdmi_codec_channel_map_table {
@@ -293,7 +282,6 @@ struct hdmi_codec_priv {
         struct hdmi_codec_daifmt daifmt[2];
         struct mutex current_stream_lock;
         struct snd_pcm_substream *current_stream;
-        struct snd_pcm_hw_constraint_list ratec;
         uint8_t eld[MAX_ELD_BYTES];
         struct snd_pcm_chmap *chmap_info;
         unsigned int chmap_idx;
@@ -702,6 +690,7 @@ static int hdmi_codec_pcm_new(struct snd_soc_pcm_runtime *rtd,
 }
 
 static struct snd_soc_dai_driver hdmi_i2s_dai = {
+        .name = "i2s-hifi",
         .id = DAI_ID_I2S,
         .playback = {
                 .stream_name = "Playback",
@@ -716,6 +705,7 @@ static struct snd_soc_dai_driver hdmi_i2s_dai = {
 };
 
 static const struct snd_soc_dai_driver hdmi_spdif_dai = {
+        .name = "spdif-hifi",
         .id = DAI_ID_SPDIF,
         .playback = {
                 .stream_name = "Playback",
@@ -728,30 +718,16 @@ static const struct snd_soc_dai_driver hdmi_spdif_dai = {
         .pcm_new = hdmi_codec_pcm_new,
 };
 
-static char hdmi_dai_name[][DAI_NAME_SIZE] = {
-        "hdmi-hifi.0",
-        "hdmi-hifi.1",
-        "hdmi-hifi.2",
-        "hdmi-hifi.3",
-};
-
-static int hdmi_of_xlate_dai_name(struct snd_soc_component *component,
-                                  struct of_phandle_args *args,
-                                  const char **dai_name)
+static int hdmi_of_xlate_dai_id(struct snd_soc_component *component,
+                                 struct device_node *endpoint)
 {
-        int id;
+        struct hdmi_codec_priv *hcp = snd_soc_component_get_drvdata(component);
+        int ret = -ENOTSUPP; /* see snd_soc_get_dai_id() */
 
-        if (args->args_count)
-                id = args->args[0];
-        else
-                id = 0;
+        if (hcp->hcd.ops->get_dai_id)
+                ret = hcp->hcd.ops->get_dai_id(component, endpoint);
 
-        if (id < ARRAY_SIZE(hdmi_dai_name)) {
-                *dai_name = hdmi_dai_name[id];
-                return 0;
-        }
-
-        return -EAGAIN;
+        return ret;
 }
 
 static struct snd_soc_codec_driver hdmi_codec = {
@@ -762,7 +738,7 @@ static struct snd_soc_codec_driver hdmi_codec = {
                 .num_dapm_widgets       = ARRAY_SIZE(hdmi_widgets),
                 .dapm_routes            = hdmi_routes,
                 .num_dapm_routes        = ARRAY_SIZE(hdmi_routes),
-                .of_xlate_dai_name      = hdmi_of_xlate_dai_name,
+                .of_xlate_dai_id        = hdmi_of_xlate_dai_id,
         },
 };
 
@@ -771,8 +747,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         struct hdmi_codec_pdata *hcd = pdev->dev.platform_data;
         struct device *dev = &pdev->dev;
         struct hdmi_codec_priv *hcp;
-        struct hdmi_device *hd;
-        struct list_head *pos;
         int dai_count, i = 0;
         int ret;
 
@@ -794,35 +768,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         if (!hcp)
                 return -ENOMEM;
 
-        hd = NULL;
-        mutex_lock(&hdmi_mutex);
-        list_for_each(pos, &hdmi_device_list) {
-                struct hdmi_device *tmp = pos_to_hdmi_device(pos);
-
-                if (tmp->dev == dev->parent) {
-                        hd = tmp;
-                        break;
-                }
-        }
-
-        if (!hd) {
-                hd = devm_kzalloc(dev, sizeof(*hd), GFP_KERNEL);
-                if (!hd) {
-                        mutex_unlock(&hdmi_mutex);
-                        return -ENOMEM;
-                }
-
-                hd->dev = dev->parent;
-
-                list_add_tail(&hd->list, &hdmi_device_list);
-        }
-        mutex_unlock(&hdmi_mutex);
-
-        if (hd->cnt >= ARRAY_SIZE(hdmi_dai_name)) {
-                dev_err(dev, "too many hdmi codec are deteced\n");
-                return -EINVAL;
-        }
-
         hcp->hcd = *hcd;
         mutex_init(&hcp->current_stream_lock);
 
@@ -835,14 +780,11 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                 hcp->daidrv[i] = hdmi_i2s_dai;
                 hcp->daidrv[i].playback.channels_max =
                         hcd->max_i2s_channels;
-                hcp->daidrv[i].name = hdmi_dai_name[hd->cnt++];
                 i++;
         }
 
-        if (hcd->spdif) {
+        if (hcd->spdif)
                 hcp->daidrv[i] = hdmi_spdif_dai;
-                hcp->daidrv[i].name = hdmi_dai_name[hd->cnt++];
-        }
 
         ret = snd_soc_register_codec(dev, &hdmi_codec, hcp->daidrv,
                                      dai_count);
@@ -859,20 +801,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
 static int hdmi_codec_remove(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        struct list_head *pos;
         struct hdmi_codec_priv *hcp;
 
-        mutex_lock(&hdmi_mutex);
-        list_for_each(pos, &hdmi_device_list) {
-                struct hdmi_device *tmp = pos_to_hdmi_device(pos);
-
-                if (tmp->dev == dev->parent) {
-                        list_del(pos);
-                        break;
-                }
-        }
-        mutex_unlock(&hdmi_mutex);
-
         hcp = dev_get_drvdata(dev);
         kfree(hcp->chmap_info);
         snd_soc_unregister_codec(dev);
diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
index 0247edc9c84e..2a40a69a7513 100644
--- a/sound/soc/codecs/max9867.c
+++ b/sound/soc/codecs/max9867.c
@@ -132,7 +132,7 @@ enum rates {
         pcm_rate_48, max_pcm_rate,
 };
 
-struct ni_div_rates {
+static const struct ni_div_rates {
         u32 mclk;
         u16 ni[max_pcm_rate];
 } ni_div[] = {
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index d8e8590746af..a78802920c3c 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -223,8 +223,8 @@ struct pm8916_wcd_analog_priv {
         u16 codec_version;
         struct clk *mclk;
         struct regulator_bulk_data supplies[ARRAY_SIZE(supply_names)];
-        bool micbias1_cap_mode;
-        bool micbias2_cap_mode;
+        unsigned int micbias1_cap_mode;
+        unsigned int micbias2_cap_mode;
 };
 
 static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
@@ -285,7 +285,7 @@ static void pm8916_wcd_analog_micbias_enable(struct snd_soc_codec *codec)
 
 static int pm8916_wcd_analog_enable_micbias_ext(struct snd_soc_codec
                                                  *codec, int event,
-                                                 int reg, u32 cap_mode)
+                                                 int reg, unsigned int cap_mode)
 {
         switch (event) {
         case SND_SOC_DAPM_POST_PMU:
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
index cca974d26136..3a309b18035e 100644
--- a/sound/soc/codecs/nau8824.c
+++ b/sound/soc/codecs/nau8824.c
@@ -1125,6 +1125,57 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 }
 
 /**
+ * nau8824_set_tdm_slot - configure DAI TDM.
+ * @dai: DAI
+ * @tx_mask: Bitmask representing active TX slots. Ex.
+ *                 0xf for normal 4 channel TDM.
+ *                 0xf0 for shifted 4 channel TDM
+ * @rx_mask: Bitmask [0:1] representing active DACR RX slots.
+ *                 Bitmask [2:3] representing active DACL RX slots.
+ *                 00=CH0,01=CH1,10=CH2,11=CH3. Ex.
+ *                 0xf for DACL/R selecting TDM CH3.
+ *                 0xf0 for DACL/R selecting shifted TDM CH3.
+ * @slots: Number of slots in use.
+ * @slot_width: Width in bits for each slot.
+ *
+ * Configures a DAI for TDM operation. Only support 4 slots TDM.
+ */
+static int nau8824_set_tdm_slot(struct snd_soc_dai *dai,
+        unsigned int tx_mask, unsigned int rx_mask, int slots, int slot_width)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        unsigned int tslot_l = 0, ctrl_val = 0;
+
+        if (slots > 4 || ((tx_mask & 0xf0) && (tx_mask & 0xf)) ||
+                ((rx_mask & 0xf0) && (rx_mask & 0xf)) ||
+                ((rx_mask & 0xf0) && (tx_mask & 0xf)) ||
+                ((rx_mask & 0xf) && (tx_mask & 0xf0)))
+                return -EINVAL;
+
+        ctrl_val |= (NAU8824_TDM_MODE | NAU8824_TDM_OFFSET_EN);
+        if (tx_mask & 0xf0) {
+                tslot_l = 4 * slot_width;
+                ctrl_val |= (tx_mask >> 4);
+        } else {
+                ctrl_val |= tx_mask;
+        }
+        if (rx_mask & 0xf0)
+                ctrl_val |= ((rx_mask >> 4) << NAU8824_TDM_DACR_RX_SFT);
+        else
+                ctrl_val |= (rx_mask << NAU8824_TDM_DACR_RX_SFT);
+
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_TDM_CTRL,
+                NAU8824_TDM_MODE | NAU8824_TDM_OFFSET_EN |
+                NAU8824_TDM_DACL_RX_MASK | NAU8824_TDM_DACR_RX_MASK |
+                NAU8824_TDM_TX_MASK, ctrl_val);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_LEFT_TIME_SLOT,
+                NAU8824_TSLOT_L_MASK, tslot_l);
+
+        return 0;
+}
+
+/**
  * nau8824_calc_fll_param - Calculate FLL parameters.
  * @fll_in: external clock provided to codec.
  * @fs: sampling rate.
@@ -1440,6 +1491,7 @@ static struct snd_soc_codec_driver nau8824_codec_driver = {
 static const struct snd_soc_dai_ops nau8824_dai_ops = {
         .hw_params = nau8824_hw_params,
         .set_fmt = nau8824_set_fmt,
+        .set_tdm_slot = nau8824_set_tdm_slot,
 };
 
 #define NAU8824_RATES SNDRV_PCM_RATE_8000_192000
diff --git a/sound/soc/codecs/nau8824.h b/sound/soc/codecs/nau8824.h
index 87ac9a382aed..21eae2431c83 100644
--- a/sound/soc/codecs/nau8824.h
+++ b/sound/soc/codecs/nau8824.h
@@ -258,6 +258,18 @@
 #define NAU8824_I2S_MS_SLAVE            (0 << NAU8824_I2S_MS_SFT)
 #define NAU8824_I2S_BLK_DIV_MASK        0x7
 
+/* PORT0_LEFT_TIME_SLOT (0x1E) */
+#define NAU8824_TSLOT_L_MASK    0x3ff
+
+/* TDM_CTRL (0x20) */
+#define NAU8824_TDM_MODE                (0x1 << 15)
+#define NAU8824_TDM_OFFSET_EN           (0x1 << 14)
+#define NAU8824_TDM_DACL_RX_SFT 6
+#define NAU8824_TDM_DACL_RX_MASK        (0x3 << NAU8824_TDM_DACL_RX_SFT)
+#define NAU8824_TDM_DACR_RX_SFT 4
+#define NAU8824_TDM_DACR_RX_MASK        (0x3 << NAU8824_TDM_DACR_RX_SFT)
+#define NAU8824_TDM_TX_MASK             0xf
+
 /* ADC_FILTER_CTRL (0x24) */
 #define NAU8824_ADC_SYNC_DOWN_MASK      0x3
 #define NAU8824_ADC_SYNC_DOWN_32        0
diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
index 97fbeba9498f..46a30eaa7ace 100644
--- a/sound/soc/codecs/nau8825.c
+++ b/sound/soc/codecs/nau8825.c
@@ -1612,7 +1612,6 @@ static int nau8825_jack_insert(struct nau8825 *nau8825)
                 snd_soc_dapm_sync(dapm);
                 break;
         case 2:
-        case 3:
                 dev_dbg(nau8825->dev, "CTIA (micgnd2) mic connected\n");
                 type = SND_JACK_HEADSET;
 
@@ -1632,6 +1631,11 @@ static int nau8825_jack_insert(struct nau8825 *nau8825)
                 snd_soc_dapm_force_enable_pin(dapm, "SAR");
                 snd_soc_dapm_sync(dapm);
                 break;
+        case 3:
+                /* detect error case */
+                dev_err(nau8825->dev, "detection error; disable mic function\n");
+                type = SND_JACK_HEADPHONE;
+                break;
         }
 
         /* Leaving HPOL/R grounded after jack insert by default. They will be
@@ -1682,7 +1686,7 @@ static irqreturn_t nau8825_interrupt(int irq, void *data)
         } else if (active_irq & NAU8825_HEADSET_COMPLETION_IRQ) {
                 if (nau8825_is_jack_inserted(regmap)) {
                         event |= nau8825_jack_insert(nau8825);
-                        if (!nau8825->high_imped) {
+                        if (!nau8825->xtalk_bypass && !nau8825->high_imped) {
                                 /* Apply the cross talk suppression in the
                                  * headset without high impedance.
                                  */
@@ -2328,6 +2332,13 @@ static int nau8825_set_bias_level(struct snd_soc_codec *codec,
                 break;
 
         case SND_SOC_BIAS_OFF:
+                /* Reset the configuration of jack type for detection */
+                /* Detach 2kOhm Resistors from MICBIAS to MICGND1/2 */
+                regmap_update_bits(nau8825->regmap, NAU8825_REG_MIC_BIAS,
+                        NAU8825_MICBIAS_JKSLV | NAU8825_MICBIAS_JKR2, 0);
+                /* ground HPL/HPR, MICGRND1/2 */
+                regmap_update_bits(nau8825->regmap,
+                        NAU8825_REG_HSD_CTRL, 0xf, 0xf);
                 /* Cancel and reset cross talk detection funciton */
                 nau8825_xtalk_cancel(nau8825);
                 /* Turn off all interruptions before system shutdown. Keep the
@@ -2351,6 +2362,10 @@ static int __maybe_unused nau8825_suspend(struct snd_soc_codec *codec)
 
         disable_irq(nau8825->irq);
         snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_OFF);
+        /* Power down codec power; don't suppoet button wakeup */
+        snd_soc_dapm_disable_pin(nau8825->dapm, "SAR");
+        snd_soc_dapm_disable_pin(nau8825->dapm, "MICBIAS");
+        snd_soc_dapm_sync(nau8825->dapm);
         regcache_cache_only(nau8825->regmap, true);
         regcache_mark_dirty(nau8825->regmap);
 
@@ -2425,10 +2440,13 @@ static void nau8825_print_device_properties(struct nau8825 *nau8825)
                         nau8825->jack_insert_debounce);
         dev_dbg(dev, "jack-eject-debounce:  %d\n",
                         nau8825->jack_eject_debounce);
+        dev_dbg(dev, "crosstalk-bypass:     %d\n",
+                        nau8825->xtalk_bypass);
 }
 
 static int nau8825_read_device_properties(struct device *dev,
         struct nau8825 *nau8825) {
+        int ret;
 
         nau8825->jkdet_enable = device_property_read_bool(dev,
                 "nuvoton,jkdet-enable");
@@ -2436,30 +2454,60 @@ static int nau8825_read_device_properties(struct device *dev,
                 "nuvoton,jkdet-pull-enable");
         nau8825->jkdet_pull_up = device_property_read_bool(dev,
                 "nuvoton,jkdet-pull-up");
-        device_property_read_u32(dev, "nuvoton,jkdet-polarity",
+        ret = device_property_read_u32(dev, "nuvoton,jkdet-polarity",
                 &nau8825->jkdet_polarity);
-        device_property_read_u32(dev, "nuvoton,micbias-voltage",
+        if (ret)
+                nau8825->jkdet_polarity = 1;
+        ret = device_property_read_u32(dev, "nuvoton,micbias-voltage",
                 &nau8825->micbias_voltage);
-        device_property_read_u32(dev, "nuvoton,vref-impedance",
+        if (ret)
+                nau8825->micbias_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,vref-impedance",
                 &nau8825->vref_impedance);
-        device_property_read_u32(dev, "nuvoton,sar-threshold-num",
+        if (ret)
+                nau8825->vref_impedance = 2;
+        ret = device_property_read_u32(dev, "nuvoton,sar-threshold-num",
                 &nau8825->sar_threshold_num);
-        device_property_read_u32_array(dev, "nuvoton,sar-threshold",
+        if (ret)
+                nau8825->sar_threshold_num = 4;
+        ret = device_property_read_u32_array(dev, "nuvoton,sar-threshold",
                 nau8825->sar_threshold, nau8825->sar_threshold_num);
-        device_property_read_u32(dev, "nuvoton,sar-hysteresis",
+        if (ret) {
+                nau8825->sar_threshold[0] = 0x08;
+                nau8825->sar_threshold[1] = 0x12;
+                nau8825->sar_threshold[2] = 0x26;
+                nau8825->sar_threshold[3] = 0x73;
+        }
+        ret = device_property_read_u32(dev, "nuvoton,sar-hysteresis",
                 &nau8825->sar_hysteresis);
-        device_property_read_u32(dev, "nuvoton,sar-voltage",
+        if (ret)
+                nau8825->sar_hysteresis = 0;
+        ret = device_property_read_u32(dev, "nuvoton,sar-voltage",
                 &nau8825->sar_voltage);
-        device_property_read_u32(dev, "nuvoton,sar-compare-time",
+        if (ret)
+                nau8825->sar_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,sar-compare-time",
                 &nau8825->sar_compare_time);
-        device_property_read_u32(dev, "nuvoton,sar-sampling-time",
+        if (ret)
+                nau8825->sar_compare_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,sar-sampling-time",
                 &nau8825->sar_sampling_time);
-        device_property_read_u32(dev, "nuvoton,short-key-debounce",
+        if (ret)
+                nau8825->sar_sampling_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,short-key-debounce",
                 &nau8825->key_debounce);
-        device_property_read_u32(dev, "nuvoton,jack-insert-debounce",
+        if (ret)
+                nau8825->key_debounce = 3;
+        ret = device_property_read_u32(dev, "nuvoton,jack-insert-debounce",
                 &nau8825->jack_insert_debounce);
-        device_property_read_u32(dev, "nuvoton,jack-eject-debounce",
+        if (ret)
+                nau8825->jack_insert_debounce = 7;
+        ret = device_property_read_u32(dev, "nuvoton,jack-eject-debounce",
                 &nau8825->jack_eject_debounce);
+        if (ret)
+                nau8825->jack_eject_debounce = 0;
+        nau8825->xtalk_bypass = device_property_read_bool(dev,
+                "nuvoton,crosstalk-bypass");
 
         nau8825->mclk = devm_clk_get(dev, "mclk");
         if (PTR_ERR(nau8825->mclk) == -EPROBE_DEFER) {
diff --git a/sound/soc/codecs/nau8825.h b/sound/soc/codecs/nau8825.h
index 514fd13c2f46..8aee5c8647ae 100644
--- a/sound/soc/codecs/nau8825.h
+++ b/sound/soc/codecs/nau8825.h
@@ -476,6 +476,7 @@ struct nau8825 {
         int xtalk_event_mask;
         bool xtalk_protect;
         int imp_rms[NAU8825_XTALK_IMM];
+        int xtalk_bypass;
 };
 
 int nau8825_enable_jack_detect(struct snd_soc_codec *codec,
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index f91221b1ddf0..1b6796c4c471 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/acpi.h>
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -395,14 +396,14 @@ static const char * const rt5514_dmic_src[] = {
         "DMIC1", "DMIC2"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5514_stereo1_dmic_enum, RT5514_DIG_SOURCE_CTRL,
         RT5514_AD0_DMIC_INPUT_SEL_SFT, rt5514_dmic_src);
 
 static const struct snd_kcontrol_new rt5514_sto1_dmic_mux =
         SOC_DAPM_ENUM("Stereo1 DMIC Source", rt5514_stereo1_dmic_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5514_stereo2_dmic_enum, RT5514_DIG_SOURCE_CTRL,
         RT5514_AD1_DMIC_INPUT_SEL_SFT, rt5514_dmic_src);
 
@@ -906,9 +907,23 @@ static int rt5514_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
         if (rx_mask || tx_mask)
                 val |= RT5514_TDM_MODE;
 
-        if (slots == 4)
+        switch (slots) {
+        case 4:
                 val |= RT5514_TDMSLOT_SEL_RX_4CH | RT5514_TDMSLOT_SEL_TX_4CH;
+                break;
+
+        case 6:
+                val |= RT5514_TDMSLOT_SEL_RX_6CH | RT5514_TDMSLOT_SEL_TX_6CH;
+                break;
 
+        case 8:
+                val |= RT5514_TDMSLOT_SEL_RX_8CH | RT5514_TDMSLOT_SEL_TX_8CH;
+                break;
+
+        case 2:
+        default:
+                break;
+        }
 
         switch (slot_width) {
         case 20:
@@ -919,6 +934,10 @@ static int rt5514_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
                 val |= RT5514_CH_LEN_RX_24 | RT5514_CH_LEN_TX_24;
                 break;
 
+        case 25:
+                val |= RT5514_TDM_MODE2;
+                break;
+
         case 32:
                 val |= RT5514_CH_LEN_RX_32 | RT5514_CH_LEN_TX_32;
                 break;
@@ -930,7 +949,8 @@ static int rt5514_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
 
         regmap_update_bits(rt5514->regmap, RT5514_I2S_CTRL1, RT5514_TDM_MODE |
                 RT5514_TDMSLOT_SEL_RX_MASK | RT5514_TDMSLOT_SEL_TX_MASK |
-                RT5514_CH_LEN_RX_MASK | RT5514_CH_LEN_TX_MASK, val);
+                RT5514_CH_LEN_RX_MASK | RT5514_CH_LEN_TX_MASK |
+                RT5514_TDM_MODE2, val);
 
         return 0;
 }
@@ -1076,6 +1096,14 @@ static const struct of_device_id rt5514_of_match[] = {
 MODULE_DEVICE_TABLE(of, rt5514_of_match);
 #endif
 
+#ifdef CONFIG_ACPI
+static struct acpi_device_id rt5514_acpi_match[] = {
+        { "10EC5514", 0},
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, rt5514_acpi_match);
+#endif
+
 static int rt5514_parse_dt(struct rt5514_priv *rt5514, struct device *dev)
 {
         device_property_read_u32(dev, "realtek,dmic-init-delay-ms",
@@ -1179,6 +1207,7 @@ static const struct dev_pm_ops rt5514_i2_pm_ops = {
 static struct i2c_driver rt5514_i2c_driver = {
         .driver = {
                 .name = "rt5514",
+                .acpi_match_table = ACPI_PTR(rt5514_acpi_match),
                 .of_match_table = of_match_ptr(rt5514_of_match),
                 .pm = &rt5514_i2_pm_ops,
         },
diff --git a/sound/soc/codecs/rt5514.h b/sound/soc/codecs/rt5514.h
index 5d343fb6d125..02bc212a86d9 100644
--- a/sound/soc/codecs/rt5514.h
+++ b/sound/soc/codecs/rt5514.h
@@ -117,6 +117,8 @@
 #define RT5514_POW_ADCFEDL_BIT                  0
 
 /* RT5514_I2S_CTRL1 (0x2010) */
+#define RT5514_TDM_MODE2                        (0x1 << 30)
+#define RT5514_TDM_MODE2_SFT                    30
 #define RT5514_TDM_MODE                         (0x1 << 28)
 #define RT5514_TDM_MODE_SFT                     28
 #define RT5514_I2S_LR_MASK                      (0x1 << 26)
@@ -136,6 +138,8 @@
 #define RT5514_TDMSLOT_SEL_RX_MASK              (0x3 << 10)
 #define RT5514_TDMSLOT_SEL_RX_SFT               10
 #define RT5514_TDMSLOT_SEL_RX_4CH               (0x1 << 10)
+#define RT5514_TDMSLOT_SEL_RX_6CH               (0x2 << 10)
+#define RT5514_TDMSLOT_SEL_RX_8CH               (0x3 << 10)
 #define RT5514_CH_LEN_RX_MASK                   (0x3 << 8)
 #define RT5514_CH_LEN_RX_SFT                    8
 #define RT5514_CH_LEN_RX_16                     (0x0 << 8)
@@ -145,6 +149,8 @@
 #define RT5514_TDMSLOT_SEL_TX_MASK              (0x3 << 6)
 #define RT5514_TDMSLOT_SEL_TX_SFT               6
 #define RT5514_TDMSLOT_SEL_TX_4CH               (0x1 << 6)
+#define RT5514_TDMSLOT_SEL_TX_6CH               (0x2 << 6)
+#define RT5514_TDMSLOT_SEL_TX_8CH               (0x3 << 6)
 #define RT5514_CH_LEN_TX_MASK                   (0x3 << 4)
 #define RT5514_CH_LEN_TX_SFT                    4
 #define RT5514_CH_LEN_TX_16                     (0x0 << 4)
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 87844a45886a..9ec58166f7c4 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -34,6 +34,17 @@
 #include "rl6231.h"
 #include "rt5645.h"
 
+#define QUIRK_INV_JD1_1(q)      ((q) & 1)
+#define QUIRK_LEVEL_IRQ(q)      (((q) >> 1) & 1)
+#define QUIRK_IN2_DIFF(q)       (((q) >> 2) & 1)
+#define QUIRK_JD_MODE(q)        (((q) >> 4) & 7)
+#define QUIRK_DMIC1_DATA_PIN(q) (((q) >> 8) & 3)
+#define QUIRK_DMIC2_DATA_PIN(q) (((q) >> 12) & 3)
+
+static unsigned int quirk = -1;
+module_param(quirk, uint, 0444);
+MODULE_PARM_DESC(quirk, "RT5645 pdata quirk override");
+
 #define RT5645_DEVICE_ID 0x6308
 #define RT5650_DEVICE_ID 0x6419
 
@@ -59,7 +70,7 @@ static const struct regmap_range_cfg rt5645_ranges[] = {
 
 static const struct reg_sequence init_list[] = {
         {RT5645_PR_BASE + 0x3d, 0x3600},
-        {RT5645_PR_BASE + 0x1c, 0xfd20},
+        {RT5645_PR_BASE + 0x1c, 0xfd70},
         {RT5645_PR_BASE + 0x20, 0x611f},
         {RT5645_PR_BASE + 0x21, 0x4040},
         {RT5645_PR_BASE + 0x23, 0x0004},
@@ -3151,7 +3162,7 @@ static int rt5645_jack_detect(struct snd_soc_codec *codec, int jack_insert)
                         snd_soc_dapm_sync(dapm);
                         rt5645->jack_type = SND_JACK_HEADPHONE;
                 }
-                if (rt5645->pdata.jd_invert)
+                if (rt5645->pdata.level_trigger_irq)
                         regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
                                 RT5645_JD_1_1_MASK, RT5645_JD_1_1_NOR);
         } else { /* jack out */
@@ -3172,7 +3183,7 @@ static int rt5645_jack_detect(struct snd_soc_codec *codec, int jack_insert)
                         snd_soc_dapm_disable_pin(dapm, "LDO2");
                 snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
                 snd_soc_dapm_sync(dapm);
-                if (rt5645->pdata.jd_invert)
+                if (rt5645->pdata.level_trigger_irq)
                         regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
                                 RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
         }
@@ -3238,24 +3249,16 @@ static void rt5645_jack_detect_work(struct work_struct *work)
                 snd_soc_jack_report(rt5645->mic_jack,
                                     report, SND_JACK_MICROPHONE);
                 return;
-        case 1: /* 2 port */
-                val = snd_soc_read(rt5645->codec, RT5645_A_JD_CTRL1) & 0x0070;
-                break;
-        default: /* 1 port */
-                val = snd_soc_read(rt5645->codec, RT5645_A_JD_CTRL1) & 0x0020;
+        default: /* read rt5645 jd1_1 status */
+                val = snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x1000;
                 break;
 
         }
 
-        switch (val) {
-        /* jack in */
-        case 0x30: /* 2 port */
-        case 0x0: /* 1 port or 2 port */
-                if (rt5645->jack_type == 0) {
-                        report = rt5645_jack_detect(rt5645->codec, 1);
-                        /* for push button and jack out */
-                        break;
-                }
+        if (!val && (rt5645->jack_type == 0)) { /* jack in */
+                report = rt5645_jack_detect(rt5645->codec, 1);
+        } else if (!val && rt5645->jack_type != 0) {
+                /* for push button and jack out */
                 btn_type = 0;
                 if (snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x4) {
                         /* button pressed */
@@ -3302,19 +3305,12 @@ static void rt5645_jack_detect_work(struct work_struct *work)
                         mod_timer(&rt5645->btn_check_timer,
                                 msecs_to_jiffies(100));
                 }
-
-                break;
-        /* jack out */
-        case 0x70: /* 2 port */
-        case 0x10: /* 2 port */
-        case 0x20: /* 1 port */
+        } else {
+                /* jack out */
                 report = 0;
                 snd_soc_update_bits(rt5645->codec,
                                     RT5645_INT_IRQ_ST, 0x1, 0x0);
                 rt5645_jack_detect(rt5645->codec, 0);
-                break;
-        default:
-                break;
         }
 
         snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE);
@@ -3601,7 +3597,7 @@ static struct rt5645_platform_data buddy_platform_data = {
         .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5,
         .dmic2_data_pin = RT5645_DMIC_DATA_IN2P,
         .jd_mode = 3,
-        .jd_invert = true,
+        .level_trigger_irq = true,
 };
 
 static struct dmi_system_id dmi_platform_intel_broadwell[] = {
@@ -3614,6 +3610,33 @@ static struct dmi_system_id dmi_platform_intel_broadwell[] = {
         { }
 };
 
+static struct rt5645_platform_data gpd_win_platform_data = {
+        .jd_mode = 3,
+        .inv_jd1_1 = true,
+};
+
+static const struct dmi_system_id dmi_platform_gpd_win[] = {
+        {
+                /*
+                 * Match for the GPDwin which unfortunately uses somewhat
+                 * generic dmi strings, which is why we test for 4 strings.
+                 * Comparing against 23 other byt/cht boards, board_vendor
+                 * and board_name are unique to the GPDwin, where as only one
+                 * other board has the same board_serial and 3 others have
+                 * the same default product_name. Also the GPDwin is the
+                 * only device to have both board_ and product_name not set.
+                 */
+                .ident = "GPD Win",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+                        DMI_MATCH(DMI_BOARD_NAME, "Default string"),
+                        DMI_MATCH(DMI_BOARD_SERIAL, "Default string"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Default string"),
+                },
+        },
+        {}
+};
+
 static bool rt5645_check_dp(struct device *dev)
 {
         if (device_property_present(dev, "realtek,in2-differential") ||
@@ -3664,6 +3687,17 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
                 rt5645_parse_dt(rt5645, &i2c->dev);
         else if (dmi_check_system(dmi_platform_intel_braswell))
                 rt5645->pdata = general_platform_data;
+        else if (dmi_check_system(dmi_platform_gpd_win))
+                rt5645->pdata = gpd_win_platform_data;
+
+        if (quirk != -1) {
+                rt5645->pdata.in2_diff = QUIRK_IN2_DIFF(quirk);
+                rt5645->pdata.level_trigger_irq = QUIRK_LEVEL_IRQ(quirk);
+                rt5645->pdata.inv_jd1_1 = QUIRK_INV_JD1_1(quirk);
+                rt5645->pdata.jd_mode = QUIRK_JD_MODE(quirk);
+                rt5645->pdata.dmic1_data_pin = QUIRK_DMIC1_DATA_PIN(quirk);
+                rt5645->pdata.dmic2_data_pin = QUIRK_DMIC2_DATA_PIN(quirk);
+        }
 
         rt5645->gpiod_hp_det = devm_gpiod_get_optional(&i2c->dev, "hp-detect",
                                                        GPIOD_IN);
@@ -3745,6 +3779,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
                                            ret);
         }
 
+        regmap_update_bits(rt5645->regmap, RT5645_CLSD_OUT_CTRL, 0xc0, 0xc0);
+
         if (rt5645->pdata.in2_diff)
                 regmap_update_bits(rt5645->regmap, RT5645_IN2_CTRL,
                                         RT5645_IN_DF2, RT5645_IN_DF2);
@@ -3848,12 +3884,16 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
                 default:
                         break;
                 }
+                if (rt5645->pdata.inv_jd1_1) {
+                        regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
+                                RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
+                }
         }
 
         regmap_update_bits(rt5645->regmap, RT5645_ADDA_CLK1,
                 RT5645_I2S_PD1_MASK, RT5645_I2S_PD1_2);
 
-        if (rt5645->pdata.jd_invert) {
+        if (rt5645->pdata.level_trigger_irq) {
                 regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
                         RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
         }
@@ -3897,6 +3937,7 @@ static int rt5645_i2c_remove(struct i2c_client *i2c)
 
         cancel_delayed_work_sync(&rt5645->jack_detect_work);
         cancel_delayed_work_sync(&rt5645->rcclock_work);
+        del_timer_sync(&rt5645->btn_check_timer);
 
         snd_soc_unregister_codec(&i2c->dev);
         regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies);
diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index f5d34153e21f..db05b60d5002 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -586,44 +586,6 @@ static const struct snd_kcontrol_new hpo_r_mute_control =
         SOC_DAPM_SINGLE_AUTODISABLE("Switch", RT5651_HP_VOL,
                                     RT5651_R_MUTE_SFT, 1, 1);
 
-/* INL/R source */
-static const char * const rt5651_inl_src[] = {"IN2P", "HPOVOLLP"};
-
-static SOC_ENUM_SINGLE_DECL(
-        rt5651_inl_enum, RT5651_INL1_INR1_VOL,
-        RT5651_INL_SEL_SFT, rt5651_inl_src);
-
-static const struct snd_kcontrol_new rt5651_inl1_mux =
-        SOC_DAPM_ENUM("INL1 source", rt5651_inl_enum);
-
-static const char * const rt5651_inr1_src[] = {"IN2N", "HPOVOLRP"};
-
-static SOC_ENUM_SINGLE_DECL(
-        rt5651_inr1_enum, RT5651_INL1_INR1_VOL,
-        RT5651_INR_SEL_SFT, rt5651_inr1_src);
-
-static const struct snd_kcontrol_new rt5651_inr1_mux =
-        SOC_DAPM_ENUM("INR1 source", rt5651_inr1_enum);
-
-static const char * const rt5651_inl2_src[] = {"IN3P", "OUTVOLLP"};
-
-static SOC_ENUM_SINGLE_DECL(
-        rt5651_inl2_enum, RT5651_INL2_INR2_VOL,
-        RT5651_INL_SEL_SFT, rt5651_inl2_src);
-
-static const struct snd_kcontrol_new rt5651_inl2_mux =
-        SOC_DAPM_ENUM("INL2 source", rt5651_inl2_enum);
-
-static const char * const rt5651_inr2_src[] = {"IN3N", "OUTVOLRP"};
-
-static SOC_ENUM_SINGLE_DECL(
-        rt5651_inr2_enum, RT5651_INL2_INR2_VOL,
-        RT5651_INR_SEL_SFT, rt5651_inr2_src);
-
-static const struct snd_kcontrol_new rt5651_inr2_mux =
-        SOC_DAPM_ENUM("INR2 source", rt5651_inr2_enum);
-
-
 /* Stereo ADC source */
 static const char * const rt5651_stereo1_adc1_src[] = {"DD MIX", "ADC"};
 
@@ -955,11 +917,7 @@ static const struct snd_soc_dapm_widget rt5651_dapm_widgets[] = {
                          RT5651_PWR_IN2_L_BIT, 0, NULL, 0),
         SND_SOC_DAPM_PGA("INR2 VOL", RT5651_PWR_VOL,
                          RT5651_PWR_IN2_R_BIT, 0, NULL, 0),
-        /* IN Mux */
-        SND_SOC_DAPM_MUX("INL1 Mux", SND_SOC_NOPM, 0, 0, &rt5651_inl1_mux),
-        SND_SOC_DAPM_MUX("INR1 Mux", SND_SOC_NOPM, 0, 0, &rt5651_inr1_mux),
-        SND_SOC_DAPM_MUX("INL2 Mux", SND_SOC_NOPM, 0, 0, &rt5651_inl2_mux),
-        SND_SOC_DAPM_MUX("INR2 Mux", SND_SOC_NOPM, 0, 0, &rt5651_inr2_mux),
+
         /* REC Mixer */
         SND_SOC_DAPM_MIXER("RECMIXL", RT5651_PWR_MIXER, RT5651_PWR_RM_L_BIT, 0,
                            rt5651_rec_l_mix, ARRAY_SIZE(rt5651_rec_l_mix)),
diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
index a32508d7dcfd..a33202affeb1 100644
--- a/sound/soc/codecs/rt5663.c
+++ b/sound/soc/codecs/rt5663.c
@@ -2847,6 +2847,8 @@ static int rt5663_resume(struct snd_soc_codec *codec)
         regcache_cache_only(rt5663->regmap, false);
         regcache_sync(rt5663->regmap);
 
+        rt5663_irq(0, rt5663);
+
         return 0;
 }
 #else
@@ -3141,7 +3143,7 @@ static int rt5663_i2c_probe(struct i2c_client *i2c,
                 regmap_update_bits(rt5663->regmap, RT5663_DIG_MISC,
                         RT5663_DIG_GATE_CTRL_MASK, RT5663_DIG_GATE_CTRL_EN);
                 regmap_update_bits(rt5663->regmap, RT5663_AUTO_1MRC_CLK,
-                        RT5663_IRQ_POW_SAV_MASK, RT5663_IRQ_POW_SAV_EN);
+                        RT5663_IRQ_MANUAL_MASK, RT5663_IRQ_MANUAL_EN);
                 regmap_update_bits(rt5663->regmap, RT5663_IRQ_1,
                         RT5663_EN_IRQ_JD1_MASK, RT5663_EN_IRQ_JD1_EN);
                 regmap_update_bits(rt5663->regmap, RT5663_GPIO_1,
diff --git a/sound/soc/codecs/rt5663.h b/sound/soc/codecs/rt5663.h
index d77fae619f2f..4621812c94d8 100644
--- a/sound/soc/codecs/rt5663.h
+++ b/sound/soc/codecs/rt5663.h
@@ -590,6 +590,10 @@
 #define RT5663_IRQ_POW_SAV_JD1_SHIFT            14
 #define RT5663_IRQ_POW_SAV_JD1_DIS              (0x0 << 14)
 #define RT5663_IRQ_POW_SAV_JD1_EN               (0x1 << 14)
+#define RT5663_IRQ_MANUAL_MASK                  (0x1 << 8)
+#define RT5663_IRQ_MANUAL_SHIFT                 8
+#define RT5663_IRQ_MANUAL_DIS                   (0x0 << 8)
+#define RT5663_IRQ_MANUAL_EN                    (0x1 << 8)
 
 /* IRQ Control 1 (0x00b6) */
 #define RT5663_EN_CB_JD_MASK                    (0x1 << 3)
diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
index 8cd22307f5b6..370ed54d1e15 100644
--- a/sound/soc/codecs/rt5665.c
+++ b/sound/soc/codecs/rt5665.c
@@ -70,6 +70,7 @@ struct rt5665_priv {
         int jack_type;
         int irq_work_delay_time;
         unsigned int sar_adc_value;
+        bool calibration_done;
 };
 
 static const struct reg_default rt5665_reg[] = {
@@ -912,46 +913,46 @@ static const char * const rt5665_data_select[] = {
         "L/R", "R/L", "L/L", "R/R"
 };
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_1_01_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_1_01_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_1_DS_ADC_SLOT01_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_1_23_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_1_23_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_1_DS_ADC_SLOT23_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_1_45_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_1_45_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_1_DS_ADC_SLOT45_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_1_67_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_1_67_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_1_DS_ADC_SLOT67_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_2_01_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_2_01_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_2_DS_ADC_SLOT01_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_2_23_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_2_23_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_2_DS_ADC_SLOT23_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_2_45_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_2_45_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_2_DS_ADC_SLOT45_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if1_2_67_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if1_2_67_adc_enum,
         RT5665_TDM_CTRL_2, RT5665_I2S1_2_DS_ADC_SLOT67_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if2_1_dac_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if2_1_dac_enum,
         RT5665_DIG_INF2_DATA, RT5665_IF2_1_DAC_SEL_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if2_1_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if2_1_adc_enum,
         RT5665_DIG_INF2_DATA, RT5665_IF2_1_ADC_SEL_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if2_2_dac_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if2_2_dac_enum,
         RT5665_DIG_INF2_DATA, RT5665_IF2_2_DAC_SEL_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if2_2_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if2_2_adc_enum,
         RT5665_DIG_INF2_DATA, RT5665_IF2_2_ADC_SEL_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if3_dac_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if3_dac_enum,
         RT5665_DIG_INF3_DATA, RT5665_IF3_DAC_SEL_SFT, rt5665_data_select);
 
-static const SOC_ENUM_SINGLE_DECL(rt5665_if3_adc_enum,
+static SOC_ENUM_SINGLE_DECL(rt5665_if3_adc_enum,
         RT5665_DIG_INF3_DATA, RT5665_IF3_ADC_SEL_SFT, rt5665_data_select);
 
 static const struct snd_kcontrol_new rt5665_if1_1_01_adc_swap_mux =
@@ -1305,6 +1306,11 @@ static void rt5665_jack_detect_handler(struct work_struct *work)
                 usleep_range(10000, 15000);
         }
 
+        while (!rt5665->calibration_done) {
+                pr_debug("%s calibration not ready\n", __func__);
+                usleep_range(10000, 15000);
+        }
+
         mutex_lock(&rt5665->calibrate_mutex);
 
         val = snd_soc_read(rt5665->codec, RT5665_AJD1_CTRL) & 0x0010;
@@ -1819,14 +1825,14 @@ static const char * const rt5665_dac2_src[] = {
         "IF1 DAC2", "IF2_1 DAC", "IF2_2 DAC", "IF3 DAC", "Mono ADC MIX"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_l2_enum, RT5665_DAC2_CTRL,
         RT5665_DAC_L2_SEL_SFT, rt5665_dac2_src);
 
 static const struct snd_kcontrol_new rt5665_dac_l2_mux =
         SOC_DAPM_ENUM("Digital DAC L2 Source", rt5665_dac_l2_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_r2_enum, RT5665_DAC2_CTRL,
         RT5665_DAC_R2_SEL_SFT, rt5665_dac2_src);
 
@@ -1839,14 +1845,14 @@ static const char * const rt5665_dac3_src[] = {
         "IF1 DAC2", "IF2_1 DAC", "IF2_2 DAC", "IF3 DAC", "STO2 ADC MIX"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_l3_enum, RT5665_DAC3_CTRL,
         RT5665_DAC_L3_SEL_SFT, rt5665_dac3_src);
 
 static const struct snd_kcontrol_new rt5665_dac_l3_mux =
         SOC_DAPM_ENUM("Digital DAC L3 Source", rt5665_dac_l3_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_r3_enum, RT5665_DAC3_CTRL,
         RT5665_DAC_R3_SEL_SFT, rt5665_dac3_src);
 
@@ -1859,14 +1865,14 @@ static const char * const rt5665_sto1_adc1_src[] = {
         "DD Mux", "ADC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adc1l_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADC1L_SRC_SFT, rt5665_sto1_adc1_src);
 
 static const struct snd_kcontrol_new rt5665_sto1_adc1l_mux =
         SOC_DAPM_ENUM("Stereo1 ADC1L Source", rt5665_sto1_adc1l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adc1r_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADC1R_SRC_SFT, rt5665_sto1_adc1_src);
 
@@ -1879,14 +1885,14 @@ static const char * const rt5665_sto1_adc_src[] = {
         "ADC1 L", "ADC1 R", "ADC2 L", "ADC2 R"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adcl_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADCL_SRC_SFT, rt5665_sto1_adc_src);
 
 static const struct snd_kcontrol_new rt5665_sto1_adcl_mux =
         SOC_DAPM_ENUM("Stereo1 ADCL Source", rt5665_sto1_adcl_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adcr_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADCR_SRC_SFT, rt5665_sto1_adc_src);
 
@@ -1899,14 +1905,14 @@ static const char * const rt5665_sto1_adc2_src[] = {
         "DAC MIX", "DMIC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adc2l_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADC2L_SRC_SFT, rt5665_sto1_adc2_src);
 
 static const struct snd_kcontrol_new rt5665_sto1_adc2l_mux =
         SOC_DAPM_ENUM("Stereo1 ADC2L Source", rt5665_sto1_adc2l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_adc2r_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_ADC2R_SRC_SFT, rt5665_sto1_adc2_src);
 
@@ -1919,7 +1925,7 @@ static const char * const rt5665_sto1_dmic_src[] = {
         "DMIC1", "DMIC2"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_dmic_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_DMIC_SRC_SFT, rt5665_sto1_dmic_src);
 
@@ -1931,7 +1937,7 @@ static const char * const rt5665_sto1_dd_l_src[] = {
         "STO2 DAC", "MONO DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_dd_l_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_DD_L_SRC_SFT, rt5665_sto1_dd_l_src);
 
@@ -1943,7 +1949,7 @@ static const char * const rt5665_sto1_dd_r_src[] = {
         "STO2 DAC", "MONO DAC", "AEC REF"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto1_dd_r_enum, RT5665_STO1_ADC_MIXER,
         RT5665_STO1_DD_R_SRC_SFT, rt5665_sto1_dd_r_src);
 
@@ -1956,7 +1962,7 @@ static const char * const rt5665_mono_adc_l2_src[] = {
         "DAC MIXL", "DMIC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adc_l2_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_L2_SRC_SFT, rt5665_mono_adc_l2_src);
 
@@ -1970,7 +1976,7 @@ static const char * const rt5665_mono_adc_l1_src[] = {
         "DD Mux", "ADC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adc_l1_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_L1_SRC_SFT, rt5665_mono_adc_l1_src);
 
@@ -1982,14 +1988,14 @@ static const char * const rt5665_mono_dd_src[] = {
         "STO2 DAC", "MONO DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_dd_l_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_DD_L_SRC_SFT, rt5665_mono_dd_src);
 
 static const struct snd_kcontrol_new rt5665_mono_dd_l_mux =
         SOC_DAPM_ENUM("Mono DD L Source", rt5665_mono_dd_l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_dd_r_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_DD_R_SRC_SFT, rt5665_mono_dd_src);
 
@@ -2002,14 +2008,14 @@ static const char * const rt5665_mono_adc_src[] = {
         "ADC1 L", "ADC1 R", "ADC2 L", "ADC2 R"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adc_l_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_L_SRC_SFT, rt5665_mono_adc_src);
 
 static const struct snd_kcontrol_new rt5665_mono_adc_l_mux =
         SOC_DAPM_ENUM("Mono ADC L Source", rt5665_mono_adc_l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adcr_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_R_SRC_SFT, rt5665_mono_adc_src);
 
@@ -2022,7 +2028,7 @@ static const char * const rt5665_mono_dmic_l_src[] = {
         "DMIC1 L", "DMIC2 L"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_dmic_l_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_DMIC_L_SRC_SFT, rt5665_mono_dmic_l_src);
 
@@ -2035,7 +2041,7 @@ static const char * const rt5665_mono_adc_r2_src[] = {
         "DAC MIXR", "DMIC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adc_r2_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_R2_SRC_SFT, rt5665_mono_adc_r2_src);
 
@@ -2048,7 +2054,7 @@ static const char * const rt5665_mono_adc_r1_src[] = {
         "DD Mux", "ADC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_adc_r1_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_ADC_R1_SRC_SFT, rt5665_mono_adc_r1_src);
 
@@ -2061,7 +2067,7 @@ static const char * const rt5665_mono_dmic_r_src[] = {
         "DMIC1 R", "DMIC2 R"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_mono_dmic_r_enum, RT5665_MONO_ADC_MIXER,
         RT5665_MONO_DMIC_R_SRC_SFT, rt5665_mono_dmic_r_src);
 
@@ -2075,14 +2081,14 @@ static const char * const rt5665_sto2_adc1_src[] = {
         "DD Mux", "ADC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adc1l_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADC1L_SRC_SFT, rt5665_sto2_adc1_src);
 
 static const struct snd_kcontrol_new rt5665_sto2_adc1l_mux =
         SOC_DAPM_ENUM("Stereo2 ADC1L Source", rt5665_sto2_adc1l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adc1r_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADC1R_SRC_SFT, rt5665_sto2_adc1_src);
 
@@ -2095,14 +2101,14 @@ static const char * const rt5665_sto2_adc_src[] = {
         "ADC1 L", "ADC1 R", "ADC2 L"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adcl_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADCL_SRC_SFT, rt5665_sto2_adc_src);
 
 static const struct snd_kcontrol_new rt5665_sto2_adcl_mux =
         SOC_DAPM_ENUM("Stereo2 ADCL Source", rt5665_sto2_adcl_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adcr_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADCR_SRC_SFT, rt5665_sto2_adc_src);
 
@@ -2115,14 +2121,14 @@ static const char * const rt5665_sto2_adc2_src[] = {
         "DAC MIX", "DMIC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adc2l_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADC2L_SRC_SFT, rt5665_sto2_adc2_src);
 
 static const struct snd_kcontrol_new rt5665_sto2_adc2l_mux =
         SOC_DAPM_ENUM("Stereo2 ADC2L Source", rt5665_sto2_adc2l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_adc2r_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_ADC2R_SRC_SFT, rt5665_sto2_adc2_src);
 
@@ -2135,7 +2141,7 @@ static const char * const rt5665_sto2_dmic_src[] = {
         "DMIC1", "DMIC2"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_dmic_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_DMIC_SRC_SFT, rt5665_sto2_dmic_src);
 
@@ -2147,7 +2153,7 @@ static const char * const rt5665_sto2_dd_l_src[] = {
         "STO2 DAC", "MONO DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_dd_l_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_DD_L_SRC_SFT, rt5665_sto2_dd_l_src);
 
@@ -2159,7 +2165,7 @@ static const char * const rt5665_sto2_dd_r_src[] = {
         "STO2 DAC", "MONO DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_sto2_dd_r_enum, RT5665_STO2_ADC_MIXER,
         RT5665_STO2_DD_R_SRC_SFT, rt5665_sto2_dd_r_src);
 
@@ -2172,14 +2178,14 @@ static const char * const rt5665_dac1_src[] = {
         "IF1 DAC1", "IF2_1 DAC", "IF2_2 DAC", "IF3 DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_r1_enum, RT5665_AD_DA_MIXER,
         RT5665_DAC1_R_SEL_SFT, rt5665_dac1_src);
 
 static const struct snd_kcontrol_new rt5665_dac_r1_mux =
         SOC_DAPM_ENUM("DAC R1 Source", rt5665_dac_r1_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dac_l1_enum, RT5665_AD_DA_MIXER,
         RT5665_DAC1_L_SEL_SFT, rt5665_dac1_src);
 
@@ -2192,14 +2198,14 @@ static const char * const rt5665_dig_dac_mix_src[] = {
         "Stereo1 DAC Mixer", "Stereo2 DAC Mixer", "Mono DAC Mixer"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dig_dac_mixl_enum, RT5665_A_DAC1_MUX,
         RT5665_DAC_MIX_L_SFT, rt5665_dig_dac_mix_src);
 
 static const struct snd_kcontrol_new rt5665_dig_dac_mixl_mux =
         SOC_DAPM_ENUM("DAC Digital Mixer L Source", rt5665_dig_dac_mixl_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_dig_dac_mixr_enum, RT5665_A_DAC1_MUX,
         RT5665_DAC_MIX_R_SFT, rt5665_dig_dac_mix_src);
 
@@ -2212,14 +2218,14 @@ static const char * const rt5665_alg_dac1_src[] = {
         "Stereo1 DAC Mixer", "DAC1", "DMIC1"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_alg_dac_l1_enum, RT5665_A_DAC1_MUX,
         RT5665_A_DACL1_SFT, rt5665_alg_dac1_src);
 
 static const struct snd_kcontrol_new rt5665_alg_dac_l1_mux =
         SOC_DAPM_ENUM("Analog DAC L1 Source", rt5665_alg_dac_l1_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_alg_dac_r1_enum, RT5665_A_DAC1_MUX,
         RT5665_A_DACR1_SFT, rt5665_alg_dac1_src);
 
@@ -2232,14 +2238,14 @@ static const char * const rt5665_alg_dac2_src[] = {
         "Mono DAC Mixer", "DAC2"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_alg_dac_l2_enum, RT5665_A_DAC2_MUX,
         RT5665_A_DACL2_SFT, rt5665_alg_dac2_src);
 
 static const struct snd_kcontrol_new rt5665_alg_dac_l2_mux =
         SOC_DAPM_ENUM("Analog DAC L2 Source", rt5665_alg_dac_l2_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_alg_dac_r2_enum, RT5665_A_DAC2_MUX,
         RT5665_A_DACR2_SFT, rt5665_alg_dac2_src);
 
@@ -2253,7 +2259,7 @@ static const char * const rt5665_if2_1_adc_in_src[] = {
         "IF1 DAC2", "IF2_2 DAC", "IF3 DAC", "DAC1 MIX"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if2_1_adc_in_enum, RT5665_DIG_INF2_DATA,
         RT5665_IF2_1_ADC_IN_SFT, rt5665_if2_1_adc_in_src);
 
@@ -2266,7 +2272,7 @@ static const char * const rt5665_if2_2_adc_in_src[] = {
         "IF1 DAC2", "IF2_1 DAC", "IF3 DAC", "DAC1 MIX"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if2_2_adc_in_enum, RT5665_DIG_INF2_DATA,
         RT5665_IF2_2_ADC_IN_SFT, rt5665_if2_2_adc_in_src);
 
@@ -2280,7 +2286,7 @@ static const char * const rt5665_if3_adc_in_src[] = {
         "IF1 DAC2", "IF2_1 DAC", "IF2_2 DAC", "DAC1 MIX"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if3_adc_in_enum, RT5665_DIG_INF3_DATA,
         RT5665_IF3_ADC_IN_SFT, rt5665_if3_adc_in_src);
 
@@ -2293,14 +2299,14 @@ static const char * const rt5665_pdm_src[] = {
         "Stereo1 DAC", "Stereo2 DAC", "Mono DAC"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_pdm_l_enum, RT5665_PDM_OUT_CTRL,
         RT5665_PDM1_L_SFT, rt5665_pdm_src);
 
 static const struct snd_kcontrol_new rt5665_pdm_l_mux =
         SOC_DAPM_ENUM("PDM L Source", rt5665_pdm_l_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_pdm_r_enum, RT5665_PDM_OUT_CTRL,
         RT5665_PDM1_R_SFT, rt5665_pdm_src);
 
@@ -2314,7 +2320,7 @@ static const char * const rt5665_if1_1_adc1_data_src[] = {
         "STO1 ADC", "IF2_1 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_1_adc1_data_enum, RT5665_TDM_CTRL_3,
         RT5665_IF1_ADC1_SEL_SFT, rt5665_if1_1_adc1_data_src);
 
@@ -2326,7 +2332,7 @@ static const char * const rt5665_if1_1_adc2_data_src[] = {
         "STO2 ADC", "IF2_2 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_1_adc2_data_enum, RT5665_TDM_CTRL_3,
         RT5665_IF1_ADC2_SEL_SFT, rt5665_if1_1_adc2_data_src);
 
@@ -2338,7 +2344,7 @@ static const char * const rt5665_if1_1_adc3_data_src[] = {
         "MONO ADC", "IF3 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_1_adc3_data_enum, RT5665_TDM_CTRL_3,
         RT5665_IF1_ADC3_SEL_SFT, rt5665_if1_1_adc3_data_src);
 
@@ -2350,7 +2356,7 @@ static const char * const rt5665_if1_2_adc1_data_src[] = {
         "STO1 ADC", "IF1 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_2_adc1_data_enum, RT5665_TDM_CTRL_4,
         RT5665_IF1_ADC1_SEL_SFT, rt5665_if1_2_adc1_data_src);
 
@@ -2362,7 +2368,7 @@ static const char * const rt5665_if1_2_adc2_data_src[] = {
         "STO2 ADC", "IF2_1 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_2_adc2_data_enum, RT5665_TDM_CTRL_4,
         RT5665_IF1_ADC2_SEL_SFT, rt5665_if1_2_adc2_data_src);
 
@@ -2374,7 +2380,7 @@ static const char * const rt5665_if1_2_adc3_data_src[] = {
         "MONO ADC", "IF2_2 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_2_adc3_data_enum, RT5665_TDM_CTRL_4,
         RT5665_IF1_ADC3_SEL_SFT, rt5665_if1_2_adc3_data_src);
 
@@ -2386,7 +2392,7 @@ static const char * const rt5665_if1_2_adc4_data_src[] = {
         "DAC1", "IF3 DAC",
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_if1_2_adc4_data_enum, RT5665_TDM_CTRL_4,
         RT5665_IF1_ADC4_SEL_SFT, rt5665_if1_2_adc4_data_src);
 
@@ -2401,14 +2407,14 @@ static const char * const rt5665_tdm_adc_data_src[] = {
         "4123", "4132", "4213", "4231", "4312", "4321"
 };
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_tdm1_adc_data_enum, RT5665_TDM_CTRL_3,
         RT5665_TDM_ADC_SEL_SFT, rt5665_tdm_adc_data_src);
 
 static const struct snd_kcontrol_new rt5665_tdm1_adc_mux =
         SOC_DAPM_ENUM("TDM1 ADC Mux", rt5665_tdm1_adc_data_enum);
 
-static const SOC_ENUM_SINGLE_DECL(
+static SOC_ENUM_SINGLE_DECL(
         rt5665_tdm2_adc_data_enum, RT5665_TDM_CTRL_4,
         RT5665_TDM_ADC_SEL_SFT, rt5665_tdm_adc_data_src);
 
@@ -2607,7 +2613,7 @@ static int rt5665_i2s_pin_event(struct snd_soc_dapm_widget *w,
         struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
-        unsigned int val1, val2, mask1, mask2 = 0;
+        unsigned int val1, val2, mask1 = 0, mask2 = 0;
 
         switch (w->shift) {
         case RT5665_PWR_I2S2_1_BIT:
@@ -2635,13 +2641,17 @@ static int rt5665_i2s_pin_event(struct snd_soc_dapm_widget *w,
         }
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
-                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, val1);
+                if (mask1)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1,
+                                            mask1, val1);
                 if (mask2)
                         snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
                                             mask2, val2);
                 break;
         case SND_SOC_DAPM_POST_PMD:
-                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, 0);
+                if (mask1)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1,
+                                            mask1, 0);
                 if (mask2)
                         snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
                                             mask2, 0);
@@ -2684,6 +2694,8 @@ static const struct snd_soc_dapm_widget rt5665_dapm_widgets[] = {
                 RT5665_DAC_MONO_R_ASRC_SFT, 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY_S("ADC STO1 ASRC", 1, RT5665_ASRC_1,
                 RT5665_ADC_STO1_ASRC_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY_S("ADC STO2 ASRC", 1, RT5665_ASRC_1,
+                RT5665_ADC_STO2_ASRC_SFT, 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY_S("ADC Mono L ASRC", 1, RT5665_ASRC_1,
                 RT5665_ADC_MONO_L_ASRC_SFT, 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY_S("ADC Mono R ASRC", 1, RT5665_ASRC_1,
@@ -3227,6 +3239,7 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
 
         /*ASRC*/
         {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc},
+        {"ADC Stereo2 Filter", NULL, "ADC STO2 ASRC", is_using_asrc},
         {"ADC Mono Left Filter", NULL, "ADC Mono L ASRC", is_using_asrc},
         {"ADC Mono Right Filter", NULL, "ADC Mono R ASRC", is_using_asrc},
         {"DAC Mono Left Filter", NULL, "DAC Mono L ASRC", is_using_asrc},
@@ -4688,6 +4701,7 @@ static void rt5665_calibrate(struct rt5665_priv *rt5665)
         regmap_write(rt5665->regmap, RT5665_ASRC_8, 0x0120);
 
 out_unlock:
+        rt5665->calibration_done = true;
         mutex_unlock(&rt5665->calibrate_mutex);
 }
 
@@ -4922,7 +4936,7 @@ static struct acpi_device_id rt5665_acpi_match[] = {
 MODULE_DEVICE_TABLE(acpi, rt5665_acpi_match);
 #endif
 
-struct i2c_driver rt5665_i2c_driver = {
+static struct i2c_driver rt5665_i2c_driver = {
         .driver = {
                 .name = "rt5665",
                 .of_match_table = of_match_ptr(rt5665_of_match),
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index e27c5a4a0a15..0ec7985ed306 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -1717,7 +1717,6 @@ static const struct snd_soc_dapm_widget rt5670_dapm_widgets[] = {
         SND_SOC_DAPM_PGA("IF1_ADC1", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1_ADC2", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1_ADC3", SND_SOC_NOPM, 0, 0, NULL, 0),
-        SND_SOC_DAPM_PGA("IF1_ADC4", SND_SOC_NOPM, 0, 0, NULL, 0),
 
         /* DSP */
         SND_SOC_DAPM_PGA("TxDP_ADC", SND_SOC_NOPM, 0, 0, NULL, 0),
@@ -2023,7 +2022,6 @@ static const struct snd_soc_dapm_route rt5670_dapm_routes[] = {
 
         { "Stereo1 ADC MIXL", NULL, "Sto1 ADC MIXL" },
         { "Stereo1 ADC MIXL", NULL, "ADC Stereo1 Filter" },
-        { "ADC Stereo1 Filter", NULL, "PLL1", is_sys_clk_from_pll },
 
         { "Stereo1 ADC MIXR", NULL, "Sto1 ADC MIXR" },
         { "Stereo1 ADC MIXR", NULL, "ADC Stereo1 Filter" },
@@ -2062,7 +2060,6 @@ static const struct snd_soc_dapm_route rt5670_dapm_routes[] = {
 
         { "Stereo2 ADC MIXL", NULL, "Stereo2 ADC LR Mux" },
         { "Stereo2 ADC MIXL", NULL, "ADC Stereo2 Filter" },
-        { "ADC Stereo2 Filter", NULL, "PLL1", is_sys_clk_from_pll },
 
         { "Stereo2 ADC MIXR", NULL, "Sto2 ADC MIXR" },
         { "Stereo2 ADC MIXR", NULL, "ADC Stereo2 Filter" },
@@ -2086,13 +2083,13 @@ static const struct snd_soc_dapm_route rt5670_dapm_routes[] = {
         { "IF1 ADC1 IN1 Mux", "IF1_ADC3", "IF1_ADC3" },
 
         { "IF1 ADC1 IN2 Mux", "IF1_ADC1_IN1", "IF1 ADC1 IN1 Mux" },
-        { "IF1 ADC1 IN2 Mux", "IF1_ADC4", "IF1_ADC4" },
+        { "IF1 ADC1 IN2 Mux", "IF1_ADC4", "TxDP_ADC" },
 
         { "IF1 ADC2 IN Mux", "IF_ADC2", "IF_ADC2" },
         { "IF1 ADC2 IN Mux", "VAD_ADC", "VAD_ADC" },
 
         { "IF1 ADC2 IN1 Mux", "IF1_ADC2_IN", "IF1 ADC2 IN Mux" },
-        { "IF1 ADC2 IN1 Mux", "IF1_ADC4", "IF1_ADC4" },
+        { "IF1 ADC2 IN1 Mux", "IF1_ADC4", "TxDP_ADC" },
 
         { "IF1_ADC1" , NULL, "IF1 ADC1 IN2 Mux" },
         { "IF1_ADC2" , NULL, "IF1 ADC2 IN1 Mux" },
@@ -2445,10 +2442,9 @@ static int rt5670_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         return 0;
 }
 
-static int rt5670_set_dai_sysclk(struct snd_soc_dai *dai,
-                int clk_id, unsigned int freq, int dir)
+static int rt5670_set_codec_sysclk(struct snd_soc_codec *codec, int clk_id,
+                                   int source, unsigned int freq, int dir)
 {
-        struct snd_soc_codec *codec = dai->codec;
         struct rt5670_priv *rt5670 = snd_soc_codec_get_drvdata(codec);
         unsigned int reg_val = 0;
 
@@ -2472,7 +2468,7 @@ static int rt5670_set_dai_sysclk(struct snd_soc_dai *dai,
         if (clk_id != RT5670_SCLK_S_RCCLK)
                 rt5670->sysclk_src = clk_id;
 
-        dev_dbg(dai->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
+        dev_dbg(codec->dev, "Sysclk : %dHz clock id : %d\n", freq, clk_id);
 
         return 0;
 }
@@ -2724,7 +2720,6 @@ static int rt5670_resume(struct snd_soc_codec *codec)
 static const struct snd_soc_dai_ops rt5670_aif_dai_ops = {
         .hw_params = rt5670_hw_params,
         .set_fmt = rt5670_set_dai_fmt,
-        .set_sysclk = rt5670_set_dai_sysclk,
         .set_tdm_slot = rt5670_set_tdm_slot,
         .set_pll = rt5670_set_dai_pll,
 };
@@ -2777,6 +2772,7 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5670 = {
         .resume = rt5670_resume,
         .set_bias_level = rt5670_set_bias_level,
         .idle_bias_off = true,
+        .set_sysclk = rt5670_set_codec_sysclk,
         .component_driver = {
                 .controls               = rt5670_snd_controls,
                 .num_controls           = ARRAY_SIZE(rt5670_snd_controls),
@@ -2849,6 +2845,10 @@ static const struct dmi_system_id dmi_platform_intel_braswell[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Tablet B"),
                 },
         },
+        {}
+};
+
+static const struct dmi_system_id dmi_platform_intel_bytcht_jdmode2[] = {
         {
                 .ident = "Lenovo Thinkpad Tablet 10",
                 .matches = {
@@ -2883,6 +2883,11 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
                 rt5670->pdata.dmic1_data_pin = RT5670_DMIC_DATA_IN2P;
                 rt5670->pdata.dev_gpio = true;
                 rt5670->pdata.jd_mode = 1;
+        } else if (dmi_check_system(dmi_platform_intel_bytcht_jdmode2)) {
+                rt5670->pdata.dmic_en = true;
+                rt5670->pdata.dmic1_data_pin = RT5670_DMIC_DATA_IN2P;
+                rt5670->pdata.dev_gpio = true;
+                rt5670->pdata.jd_mode = 2;
         }
 
         rt5670->regmap = devm_regmap_init_i2c(i2c, &rt5670_regmap);
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 65ac4518ad06..36e530a36c82 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -41,15 +41,6 @@
 
 #define RT5677_PR_BASE (RT5677_PR_RANGE_BASE + (0 * RT5677_PR_SPACING))
 
-/* GPIO indexes defined by ACPI */
-enum {
-        RT5677_GPIO_PLUG_DET            = 0,
-        RT5677_GPIO_MIC_PRESENT_L       = 1,
-        RT5677_GPIO_HOTWORD_DET_L       = 2,
-        RT5677_GPIO_DSP_INT             = 3,
-        RT5677_GPIO_HP_AMP_SHDN_L       = 4,
-};
-
 static const struct regmap_range_cfg rt5677_ranges[] = {
         {
                 .name = "PR",
@@ -5030,7 +5021,6 @@ static const struct regmap_config rt5677_regmap = {
 static const struct i2c_device_id rt5677_i2c_id[] = {
         { "rt5677", RT5677 },
         { "rt5676", RT5676 },
-        { "RT5677CE:00", RT5677 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
@@ -5041,28 +5031,19 @@ static const struct of_device_id rt5677_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, rt5677_of_match);
 
-static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
-static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
-static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
-
-static const struct acpi_gpio_mapping bdw_rt5677_gpios[] = {
-        { "plug-det-gpios", &plug_det_gpio, 1 },
-        { "mic-present-gpios", &mic_present_gpio, 1 },
-        { "headphone-enable-gpios", &headphone_enable_gpio, 1 },
-        { NULL },
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id rt5677_acpi_match[] = {
+        { "RT5677CE", RT5677 },
+        { }
 };
+MODULE_DEVICE_TABLE(acpi, rt5677_acpi_match);
+#endif
 
 static void rt5677_read_acpi_properties(struct rt5677_priv *rt5677,
                 struct device *dev)
 {
-        int ret;
         u32 val;
 
-        ret = acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
-                        bdw_rt5677_gpios);
-        if (ret)
-                dev_warn(dev, "Failed to add driver gpios\n");
-
         if (!device_property_read_u32(dev, "DCLK", &val))
                 rt5677->pdata.dmic2_clk_pin = val;
 
@@ -5301,6 +5282,7 @@ static struct i2c_driver rt5677_i2c_driver = {
         .driver = {
                 .name = "rt5677",
                 .of_match_table = rt5677_of_match,
+                .acpi_match_table = ACPI_PTR(rt5677_acpi_match),
         },
         .probe = rt5677_i2c_probe,
         .remove   = rt5677_i2c_remove,
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 5a2702edeb77..8f6814c1eb6b 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -74,6 +74,20 @@ static const struct reg_default sgtl5000_reg_defaults[] = {
         { SGTL5000_DAP_AVC_DECAY,               0x0050 },
 };
 
+/* AVC: Threshold dB -> register: pre-calculated values */
+static const u16 avc_thr_db2reg[97] = {
+        0x5168, 0x488E, 0x40AA, 0x39A1, 0x335D, 0x2DC7, 0x28CC, 0x245D, 0x2068,
+        0x1CE2, 0x19BE, 0x16F1, 0x1472, 0x1239, 0x103E, 0x0E7A, 0x0CE6, 0x0B7F,
+        0x0A3F, 0x0922, 0x0824, 0x0741, 0x0677, 0x05C3, 0x0522, 0x0493, 0x0414,
+        0x03A2, 0x033D, 0x02E3, 0x0293, 0x024B, 0x020B, 0x01D2, 0x019F, 0x0172,
+        0x014A, 0x0126, 0x0106, 0x00E9, 0x00D0, 0x00B9, 0x00A5, 0x0093, 0x0083,
+        0x0075, 0x0068, 0x005D, 0x0052, 0x0049, 0x0041, 0x003A, 0x0034, 0x002E,
+        0x0029, 0x0025, 0x0021, 0x001D, 0x001A, 0x0017, 0x0014, 0x0012, 0x0010,
+        0x000E, 0x000D, 0x000B, 0x000A, 0x0009, 0x0008, 0x0007, 0x0006, 0x0005,
+        0x0005, 0x0004, 0x0004, 0x0003, 0x0003, 0x0002, 0x0002, 0x0002, 0x0002,
+        0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000};
+
 /* regulator supplies for sgtl5000, VDDD is an optional external supply */
 enum sgtl5000_regulator_supplies {
         VDDA,
@@ -382,6 +396,65 @@ static int dac_put_volsw(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+/*
+ * custom function to get AVC threshold
+ *
+ * The threshold dB is calculated by rearranging the calculation from the
+ * avc_put_threshold function: register_value = 10^(dB/20) * 0.636 * 2^15 ==>
+ * dB = ( fls(register_value) - 14.347 ) * 6.02
+ *
+ * As this calculation is expensive and the threshold dB values may not exeed
+ * 0 to 96 we use pre-calculated values.
+ */
+static int avc_get_threshold(struct snd_kcontrol *kcontrol,
+                             struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+        int db, i;
+        u16 reg = snd_soc_read(codec, SGTL5000_DAP_AVC_THRESHOLD);
+
+        /* register value 0 => -96dB */
+        if (!reg) {
+                ucontrol->value.integer.value[0] = 96;
+                ucontrol->value.integer.value[1] = 96;
+                return 0;
+        }
+
+        /* get dB from register value (rounded down) */
+        for (i = 0; avc_thr_db2reg[i] > reg; i++)
+                ;
+        db = i;
+
+        ucontrol->value.integer.value[0] = db;
+        ucontrol->value.integer.value[1] = db;
+
+        return 0;
+}
+
+/*
+ * custom function to put AVC threshold
+ *
+ * The register value is calculated by following formula:
+ *                                    register_value = 10^(dB/20) * 0.636 * 2^15
+ * As this calculation is expensive and the threshold dB values may not exeed
+ * 0 to 96 we use pre-calculated values.
+ */
+static int avc_put_threshold(struct snd_kcontrol *kcontrol,
+                             struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+        int db;
+        u16 reg;
+
+        db = (int)ucontrol->value.integer.value[0];
+        if (db < 0 || db > 96)
+                return -EINVAL;
+        reg = avc_thr_db2reg[db];
+        snd_soc_write(codec, SGTL5000_DAP_AVC_THRESHOLD, reg);
+
+        return 0;
+}
+
 static const DECLARE_TLV_DB_SCALE(capture_6db_attenuate, -600, 600, 0);
 
 /* tlv for mic gain, 0db 20db 30db 40db */
@@ -396,6 +469,12 @@ static const DECLARE_TLV_DB_SCALE(headphone_volume, -5150, 50, 0);
 /* tlv for lineout volume, 31 steps of .5db each */
 static const DECLARE_TLV_DB_SCALE(lineout_volume, -1550, 50, 0);
 
+/* tlv for dap avc max gain, 0db, 6db, 12db */
+static const DECLARE_TLV_DB_SCALE(avc_max_gain, 0, 600, 0);
+
+/* tlv for dap avc threshold, */
+static const DECLARE_TLV_DB_MINMAX(avc_threshold, 0, 9600);
+
 static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
         /* SOC_DOUBLE_S8_TLV with invert */
         {
@@ -434,6 +513,16 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
                         0x1f, 1,
                         lineout_volume),
         SOC_SINGLE("Lineout Playback Switch", SGTL5000_CHIP_ANA_CTRL, 8, 1, 1),
+
+        /* Automatic Volume Control (DAP AVC) */
+        SOC_SINGLE("AVC Switch", SGTL5000_DAP_AVC_CTRL, 0, 1, 0),
+        SOC_SINGLE("AVC Hard Limiter Switch", SGTL5000_DAP_AVC_CTRL, 5, 1, 0),
+        SOC_SINGLE_TLV("AVC Max Gain Volume", SGTL5000_DAP_AVC_CTRL, 12, 2, 0,
+                        avc_max_gain),
+        SOC_SINGLE("AVC Integrator Response", SGTL5000_DAP_AVC_CTRL, 8, 3, 0),
+        SOC_SINGLE_EXT_TLV("AVC Threshold Volume", SGTL5000_DAP_AVC_THRESHOLD,
+                        0, 96, 0, avc_get_threshold, avc_put_threshold,
+                        avc_threshold),
 };
 
 /* mute the codec used by alsa core */
diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
index f8a90ba8cd71..d7d03c92cb8a 100644
--- a/sound/soc/codecs/tlv320aic31xx.c
+++ b/sound/soc/codecs/tlv320aic31xx.c
@@ -1210,7 +1210,7 @@ static const struct snd_soc_dai_ops aic31xx_dai_ops = {
 
 static struct snd_soc_dai_driver dac31xx_dai_driver[] = {
         {
-                .name = "tlv32dac31xx-hifi",
+                .name = "tlv320dac31xx-hifi",
                 .playback = {
                         .stream_name     = "Playback",
                         .channels_min    = 2,
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 20695b691aff..65c059b5ffd7 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -482,8 +482,6 @@ struct wm_coeff_ctl_ops {
                     struct snd_ctl_elem_value *ucontrol);
         int (*xput)(struct snd_kcontrol *kcontrol,
                     struct snd_ctl_elem_value *ucontrol);
-        int (*xinfo)(struct snd_kcontrol *kcontrol,
-                     struct snd_ctl_elem_info *uinfo);
 };
 
 struct wm_coeff_ctl {
@@ -1890,7 +1888,7 @@ static void *wm_adsp_read_algs(struct wm_adsp *dsp, size_t n_algs,
         }
 
         if (be32_to_cpu(val) != 0xbedead)
-                adsp_warn(dsp, "Algorithm list end %x 0x%x != 0xbeadead\n",
+                adsp_warn(dsp, "Algorithm list end %x 0x%x != 0xbedead\n",
                           pos + len, be32_to_cpu(val));
 
         alg = kzalloc(len * 2, GFP_KERNEL | GFP_DMA);
@@ -2654,7 +2652,7 @@ int wm_adsp2_preloader_put(struct snd_kcontrol *kcontrol,
                 (struct soc_mixer_control *)kcontrol->private_value;
         char preload[32];
 
-        snprintf(preload, ARRAY_SIZE(preload), "DSP%d Preload", mc->shift);
+        snprintf(preload, ARRAY_SIZE(preload), "DSP%u Preload", mc->shift);
 
         dsp->preloaded = ucontrol->value.integer.value[0];
 
diff --git a/sound/soc/codecs/zx_aud96p22.c b/sound/soc/codecs/zx_aud96p22.c
new file mode 100644
index 000000000000..032fb7cf6cbd
--- /dev/null
+++ b/sound/soc/codecs/zx_aud96p22.c
@@ -0,0 +1,403 @@
+/*
+ * Copyright (C) 2017 Sanechips Technology Co., Ltd.
+ * Copyright 2017 Linaro Ltd.
+ *
+ * Author: Baoyou Xie <baoyou.xie@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/tlv.h>
+
+#define AUD96P22_RESET                  0x00
+#define RST_DAC_DPZ                     BIT(0)
+#define RST_ADC_DPZ                     BIT(1)
+#define AUD96P22_I2S1_CONFIG_0          0x03
+#define I2S1_MS_MODE                    BIT(3)
+#define I2S1_MODE_MASK                  0x7
+#define I2S1_MODE_RIGHT_J               0x0
+#define I2S1_MODE_I2S                   0x1
+#define I2S1_MODE_LEFT_J                0x2
+#define AUD96P22_PD_0                   0x15
+#define AUD96P22_PD_1                   0x16
+#define AUD96P22_PD_3                   0x18
+#define AUD96P22_PD_4                   0x19
+#define AUD96P22_MUTE_0                 0x1d
+#define AUD96P22_MUTE_2                 0x1f
+#define AUD96P22_MUTE_4                 0x21
+#define AUD96P22_RECVOL_0               0x24
+#define AUD96P22_RECVOL_1               0x25
+#define AUD96P22_PGA1VOL_0              0x26
+#define AUD96P22_PGA1VOL_1              0x27
+#define AUD96P22_LMVOL_0                0x34
+#define AUD96P22_LMVOL_1                0x35
+#define AUD96P22_HS1VOL_0               0x38
+#define AUD96P22_HS1VOL_1               0x39
+#define AUD96P22_PGA1SEL_0              0x47
+#define AUD96P22_PGA1SEL_1              0x48
+#define AUD96P22_LDR1SEL_0              0x59
+#define AUD96P22_LDR1SEL_1              0x60
+#define AUD96P22_LDR2SEL_0              0x5d
+#define AUD96P22_REG_MAX                0xfb
+
+struct aud96p22_priv {
+        struct regmap *regmap;
+};
+
+static int aud96p22_adc_event(struct snd_soc_dapm_widget *w,
+                              struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct aud96p22_priv *priv = snd_soc_codec_get_drvdata(codec);
+        struct regmap *regmap = priv->regmap;
+
+        if (event != SND_SOC_DAPM_POST_PMU)
+                return -EINVAL;
+
+        /* Assert/de-assert the bit to reset ADC data path  */
+        regmap_update_bits(regmap, AUD96P22_RESET, RST_ADC_DPZ, 0);
+        regmap_update_bits(regmap, AUD96P22_RESET, RST_ADC_DPZ, RST_ADC_DPZ);
+
+        return 0;
+}
+
+static int aud96p22_dac_event(struct snd_soc_dapm_widget *w,
+                              struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct aud96p22_priv *priv = snd_soc_codec_get_drvdata(codec);
+        struct regmap *regmap = priv->regmap;
+
+        if (event != SND_SOC_DAPM_POST_PMU)
+                return -EINVAL;
+
+        /* Assert/de-assert the bit to reset DAC data path  */
+        regmap_update_bits(regmap, AUD96P22_RESET, RST_DAC_DPZ, 0);
+        regmap_update_bits(regmap, AUD96P22_RESET, RST_DAC_DPZ, RST_DAC_DPZ);
+
+        return 0;
+}
+
+static const DECLARE_TLV_DB_SCALE(lm_tlv, -11550, 50, 0);
+static const DECLARE_TLV_DB_SCALE(hs_tlv, -3900, 300, 0);
+static const DECLARE_TLV_DB_SCALE(rec_tlv, -9550, 50, 0);
+static const DECLARE_TLV_DB_SCALE(pga_tlv, -1800, 100, 0);
+
+static const struct snd_kcontrol_new aud96p22_snd_controls[] = {
+        /* Volume control */
+        SOC_DOUBLE_R_TLV("Master Playback Volume", AUD96P22_LMVOL_0,
+                         AUD96P22_LMVOL_1, 0, 0xff, 0, lm_tlv),
+        SOC_DOUBLE_R_TLV("Headphone Volume", AUD96P22_HS1VOL_0,
+                         AUD96P22_HS1VOL_1, 0, 0xf, 0, hs_tlv),
+        SOC_DOUBLE_R_TLV("Master Capture Volume", AUD96P22_RECVOL_0,
+                         AUD96P22_RECVOL_1, 0, 0xff, 0, rec_tlv),
+        SOC_DOUBLE_R_TLV("Analogue Capture Volume", AUD96P22_PGA1VOL_0,
+                         AUD96P22_PGA1VOL_1, 0, 0x37, 0, pga_tlv),
+
+        /* Mute control */
+        SOC_DOUBLE("Master Playback Switch", AUD96P22_MUTE_2, 0, 1, 1, 1),
+        SOC_DOUBLE("Headphone Switch", AUD96P22_MUTE_2, 4, 5, 1, 1),
+        SOC_DOUBLE("Line Out Switch", AUD96P22_MUTE_4, 0, 1, 1, 1),
+        SOC_DOUBLE("Speaker Switch", AUD96P22_MUTE_4, 2, 3, 1, 1),
+        SOC_DOUBLE("Master Capture Switch", AUD96P22_MUTE_0, 0, 1, 1, 1),
+        SOC_DOUBLE("Analogue Capture Switch", AUD96P22_MUTE_0, 2, 3, 1, 1),
+};
+
+/* Input mux kcontrols */
+static const unsigned int ain_mux_values[] = {
+        0, 1, 3, 4, 5,
+};
+
+static const char * const ainl_mux_texts[] = {
+        "AINL1 differential",
+        "AINL1 single-ended",
+        "AINL3 single-ended",
+        "AINL2 differential",
+        "AINL2 single-ended",
+};
+
+static const char * const ainr_mux_texts[] = {
+        "AINR1 differential",
+        "AINR1 single-ended",
+        "AINR3 single-ended",
+        "AINR2 differential",
+        "AINR2 single-ended",
+};
+
+static SOC_VALUE_ENUM_SINGLE_DECL(ainl_mux_enum, AUD96P22_PGA1SEL_0,
+                                  0, 0x7, ainl_mux_texts, ain_mux_values);
+static SOC_VALUE_ENUM_SINGLE_DECL(ainr_mux_enum, AUD96P22_PGA1SEL_1,
+                                  0, 0x7, ainr_mux_texts, ain_mux_values);
+
+static const struct snd_kcontrol_new ainl_mux_kcontrol =
+                        SOC_DAPM_ENUM("AINL Mux", ainl_mux_enum);
+static const struct snd_kcontrol_new ainr_mux_kcontrol =
+                        SOC_DAPM_ENUM("AINR Mux", ainr_mux_enum);
+
+/* Output mixer kcontrols */
+static const struct snd_kcontrol_new ld1_left_kcontrols[] = {
+        SOC_DAPM_SINGLE("DACL LD1L Switch", AUD96P22_LDR1SEL_0, 0, 1, 0),
+        SOC_DAPM_SINGLE("AINL LD1L Switch", AUD96P22_LDR1SEL_0, 1, 1, 0),
+        SOC_DAPM_SINGLE("AINR LD1L Switch", AUD96P22_LDR1SEL_0, 2, 1, 0),
+};
+
+static const struct snd_kcontrol_new ld1_right_kcontrols[] = {
+        SOC_DAPM_SINGLE("DACR LD1R Switch", AUD96P22_LDR1SEL_1, 8, 1, 0),
+        SOC_DAPM_SINGLE("AINR LD1R Switch", AUD96P22_LDR1SEL_1, 9, 1, 0),
+        SOC_DAPM_SINGLE("AINL LD1R Switch", AUD96P22_LDR1SEL_1, 10, 1, 0),
+};
+
+static const struct snd_kcontrol_new ld2_kcontrols[] = {
+        SOC_DAPM_SINGLE("DACL LD2 Switch", AUD96P22_LDR2SEL_0, 0, 1, 0),
+        SOC_DAPM_SINGLE("AINL LD2 Switch", AUD96P22_LDR2SEL_0, 1, 1, 0),
+        SOC_DAPM_SINGLE("DACR LD2 Switch", AUD96P22_LDR2SEL_0, 2, 1, 0),
+};
+
+static const struct snd_soc_dapm_widget aud96p22_dapm_widgets[] = {
+        /* Overall power bit */
+        SND_SOC_DAPM_SUPPLY("POWER", AUD96P22_PD_0, 0, 0, NULL, 0),
+
+        /* Input pins */
+        SND_SOC_DAPM_INPUT("AINL1P"),
+        SND_SOC_DAPM_INPUT("AINL2P"),
+        SND_SOC_DAPM_INPUT("AINL3"),
+        SND_SOC_DAPM_INPUT("AINL1N"),
+        SND_SOC_DAPM_INPUT("AINL2N"),
+        SND_SOC_DAPM_INPUT("AINR2N"),
+        SND_SOC_DAPM_INPUT("AINR1N"),
+        SND_SOC_DAPM_INPUT("AINR3"),
+        SND_SOC_DAPM_INPUT("AINR2P"),
+        SND_SOC_DAPM_INPUT("AINR1P"),
+
+        /* Input muxes */
+        SND_SOC_DAPM_MUX("AINLMUX", AUD96P22_PD_1, 2, 0, &ainl_mux_kcontrol),
+        SND_SOC_DAPM_MUX("AINRMUX", AUD96P22_PD_1, 3, 0, &ainr_mux_kcontrol),
+
+        /* ADCs */
+        SND_SOC_DAPM_ADC_E("ADCL", "Capture Left", AUD96P22_PD_1, 0, 0,
+                           aud96p22_adc_event, SND_SOC_DAPM_POST_PMU),
+        SND_SOC_DAPM_ADC_E("ADCR", "Capture Right", AUD96P22_PD_1, 1, 0,
+                           aud96p22_adc_event, SND_SOC_DAPM_POST_PMU),
+
+        /* DACs */
+        SND_SOC_DAPM_DAC_E("DACL", "Playback Left", AUD96P22_PD_3, 0, 0,
+                           aud96p22_dac_event, SND_SOC_DAPM_POST_PMU),
+        SND_SOC_DAPM_DAC_E("DACR", "Playback Right", AUD96P22_PD_3, 1, 0,
+                           aud96p22_dac_event, SND_SOC_DAPM_POST_PMU),
+
+        /* Output mixers */
+        SND_SOC_DAPM_MIXER("LD1L", AUD96P22_PD_3, 6, 0, ld1_left_kcontrols,
+                           ARRAY_SIZE(ld1_left_kcontrols)),
+        SND_SOC_DAPM_MIXER("LD1R", AUD96P22_PD_3, 7, 0, ld1_right_kcontrols,
+                           ARRAY_SIZE(ld1_right_kcontrols)),
+        SND_SOC_DAPM_MIXER("LD2", AUD96P22_PD_4, 2, 0, ld2_kcontrols,
+                           ARRAY_SIZE(ld2_kcontrols)),
+
+        /* Headset power switch */
+        SND_SOC_DAPM_SUPPLY("HS1L", AUD96P22_PD_3, 4, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("HS1R", AUD96P22_PD_3, 5, 0, NULL, 0),
+
+        /* Output pins */
+        SND_SOC_DAPM_OUTPUT("HSOUTL"),
+        SND_SOC_DAPM_OUTPUT("LINEOUTL"),
+        SND_SOC_DAPM_OUTPUT("LINEOUTMP"),
+        SND_SOC_DAPM_OUTPUT("LINEOUTMN"),
+        SND_SOC_DAPM_OUTPUT("LINEOUTR"),
+        SND_SOC_DAPM_OUTPUT("HSOUTR"),
+};
+
+static const struct snd_soc_dapm_route aud96p22_dapm_routes[] = {
+        { "AINLMUX", "AINL1 differential", "AINL1N" },
+        { "AINLMUX", "AINL1 single-ended", "AINL1P" },
+        { "AINLMUX", "AINL3 single-ended", "AINL3" },
+        { "AINLMUX", "AINL2 differential", "AINL2N" },
+        { "AINLMUX", "AINL2 single-ended", "AINL2P" },
+
+        { "AINRMUX", "AINR1 differential", "AINR1N" },
+        { "AINRMUX", "AINR1 single-ended", "AINR1P" },
+        { "AINRMUX", "AINR3 single-ended", "AINR3" },
+        { "AINRMUX", "AINR2 differential", "AINR2N" },
+        { "AINRMUX", "AINR2 single-ended", "AINR2P" },
+
+        { "ADCL", NULL, "AINLMUX" },
+        { "ADCR", NULL, "AINRMUX" },
+
+        { "ADCL", NULL, "POWER" },
+        { "ADCR", NULL, "POWER" },
+        { "DACL", NULL, "POWER" },
+        { "DACR", NULL, "POWER" },
+
+        { "LD1L", "DACL LD1L Switch", "DACL" },
+        { "LD1L", "AINL LD1L Switch", "AINLMUX" },
+        { "LD1L", "AINR LD1L Switch", "AINRMUX" },
+
+        { "LD1R", "DACR LD1R Switch", "DACR" },
+        { "LD1R", "AINR LD1R Switch", "AINRMUX" },
+        { "LD1R", "AINL LD1R Switch", "AINLMUX" },
+
+        { "LD2", "DACL LD2 Switch", "DACL" },
+        { "LD2", "AINL LD2 Switch", "AINLMUX" },
+        { "LD2", "DACR LD2 Switch", "DACR" },
+
+        { "HSOUTL", NULL, "LD1L" },
+        { "HSOUTR", NULL, "LD1R" },
+        { "HSOUTL", NULL, "HS1L" },
+        { "HSOUTR", NULL, "HS1R" },
+
+        { "LINEOUTL", NULL, "LD1L" },
+        { "LINEOUTR", NULL, "LD1R" },
+
+        { "LINEOUTMP", NULL, "LD2" },
+        { "LINEOUTMN", NULL, "LD2" },
+};
+
+static struct snd_soc_codec_driver aud96p22_driver = {
+        .component_driver = {
+                .controls = aud96p22_snd_controls,
+                .num_controls = ARRAY_SIZE(aud96p22_snd_controls),
+                .dapm_widgets = aud96p22_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(aud96p22_dapm_widgets),
+                .dapm_routes = aud96p22_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(aud96p22_dapm_routes),
+        },
+};
+
+static int aud96p22_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+        struct aud96p22_priv *priv = snd_soc_codec_get_drvdata(dai->codec);
+        struct regmap *regmap = priv->regmap;
+        unsigned int val;
+
+        /* Master/slave mode */
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBS_CFS:
+                val = 0;
+                break;
+        case SND_SOC_DAIFMT_CBM_CFM:
+                val = I2S1_MS_MODE;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(regmap, AUD96P22_I2S1_CONFIG_0, I2S1_MS_MODE, val);
+
+        /* Audio format */
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_RIGHT_J:
+                val = I2S1_MODE_RIGHT_J;
+                break;
+        case SND_SOC_DAIFMT_I2S:
+                val = I2S1_MODE_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                val = I2S1_MODE_LEFT_J;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(regmap, AUD96P22_I2S1_CONFIG_0, I2S1_MODE_MASK, val);
+
+        return 0;
+}
+
+static struct snd_soc_dai_ops aud96p22_dai_ops = {
+        .set_fmt = aud96p22_set_fmt,
+};
+
+#define AUD96P22_RATES  SNDRV_PCM_RATE_8000_192000
+#define AUD96P22_FORMATS (\
+                SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S18_3LE | \
+                SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+static struct snd_soc_dai_driver aud96p22_dai = {
+        .name = "aud96p22-dai",
+        .playback = {
+                .stream_name = "Playback",
+                .channels_min = 1,
+                .channels_max = 2,
+                .rates = AUD96P22_RATES,
+                .formats = AUD96P22_FORMATS,
+        },
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 1,
+                .channels_max = 2,
+                .rates = AUD96P22_RATES,
+                .formats = AUD96P22_FORMATS,
+        },
+        .ops = &aud96p22_dai_ops,
+};
+
+static const struct regmap_config aud96p22_regmap = {
+        .reg_bits = 8,
+        .val_bits = 8,
+        .max_register = AUD96P22_REG_MAX,
+        .cache_type = REGCACHE_RBTREE,
+};
+
+static int aud96p22_i2c_probe(struct i2c_client *i2c,
+                              const struct i2c_device_id *id)
+{
+        struct device *dev = &i2c->dev;
+        struct aud96p22_priv *priv;
+        int ret;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (priv == NULL)
+                return -ENOMEM;
+
+        priv->regmap = devm_regmap_init_i2c(i2c, &aud96p22_regmap);
+        if (IS_ERR(priv->regmap)) {
+                ret = PTR_ERR(priv->regmap);
+                dev_err(dev, "failed to init i2c regmap: %d\n", ret);
+                return ret;
+        }
+
+        i2c_set_clientdata(i2c, priv);
+
+        ret = snd_soc_register_codec(dev, &aud96p22_driver, &aud96p22_dai, 1);
+        if (ret) {
+                dev_err(dev, "failed to register codec: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int aud96p22_i2c_remove(struct i2c_client *i2c)
+{
+        snd_soc_unregister_codec(&i2c->dev);
+        return 0;
+}
+
+const struct of_device_id aud96p22_dt_ids[] = {
+        { .compatible = "zte,zx-aud96p22", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, aud96p22_dt_ids);
+
+static struct i2c_driver aud96p22_i2c_driver = {
+        .driver = {
+                .name = "zx_aud96p22",
+                .of_match_table = aud96p22_dt_ids,
+        },
+        .probe = aud96p22_i2c_probe,
+        .remove = aud96p22_i2c_remove,
+};
+module_i2c_driver(aud96p22_i2c_driver);
+
+MODULE_DESCRIPTION("ZTE ASoC AUD96P22 CODEC driver");
+MODULE_AUTHOR("Baoyou Xie <baoyou.xie@linaro.org>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 3c5a9804d3f5..56ec1d301ac2 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -629,7 +629,7 @@ static int davinci_mcasp_ch_constraint(struct davinci_mcasp *mcasp, int stream,
         if (mcasp->tdm_mask[stream])
                 slots = hweight32(mcasp->tdm_mask[stream]);
 
-        for (i = 2; i <= slots; i++)
+        for (i = 1; i <= slots; i++)
                 list[count++] = i;
 
         for (i = 2; i <= serializers; i++)
@@ -1297,7 +1297,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
 
         snd_pcm_hw_constraint_minmax(substream->runtime,
                                      SNDRV_PCM_HW_PARAM_CHANNELS,
-                                     2, max_channels);
+                                     0, max_channels);
 
         snd_pcm_hw_constraint_list(substream->runtime,
                                    0, SNDRV_PCM_HW_PARAM_CHANNELS,
@@ -1459,13 +1459,13 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
                 .suspend        = davinci_mcasp_suspend,
                 .resume         = davinci_mcasp_resume,
                 .playback       = {
-                        .channels_min   = 2,
+                        .channels_min   = 1,
                         .channels_max   = 32 * 16,
                         .rates          = DAVINCI_MCASP_RATES,
                         .formats        = DAVINCI_MCASP_PCM_FMTS,
                 },
                 .capture        = {
-                        .channels_min   = 2,
+                        .channels_min   = 1,
                         .channels_max   = 32 * 16,
                         .rates          = DAVINCI_MCASP_RATES,
                         .formats        = DAVINCI_MCASP_PCM_FMTS,
@@ -1971,12 +1971,12 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
          */
         mcasp->chconstr[SNDRV_PCM_STREAM_PLAYBACK].list =
                 devm_kzalloc(mcasp->dev, sizeof(unsigned int) *
-                             (32 + mcasp->num_serializer - 2),
+                             (32 + mcasp->num_serializer - 1),
                              GFP_KERNEL);
 
         mcasp->chconstr[SNDRV_PCM_STREAM_CAPTURE].list =
                 devm_kzalloc(mcasp->dev, sizeof(unsigned int) *
-                             (32 + mcasp->num_serializer - 2),
+                             (32 + mcasp->num_serializer - 1),
                              GFP_KERNEL);
 
         if (!mcasp->chconstr[SNDRV_PCM_STREAM_PLAYBACK].list ||
diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c
index 9c46e4112026..916067638180 100644
--- a/sound/soc/dwc/dwc-i2s.c
+++ b/sound/soc/dwc/dwc-i2s.c
@@ -496,6 +496,8 @@ static int dw_configure_dai(struct dw_i2s_dev *dev,
                 idx = COMP1_TX_WORDSIZE_0(comp1);
                 if (WARN_ON(idx >= ARRAY_SIZE(formats)))
                         return -EINVAL;
+                if (dev->quirks & DW_I2S_QUIRK_16BIT_IDX_OVERRIDE)
+                        idx = 1;
                 dw_i2s_dai->playback.channels_min = MIN_CHANNEL_NUM;
                 dw_i2s_dai->playback.channels_max =
                                 1 << (COMP1_TX_CHANNELS(comp1) + 1);
@@ -508,6 +510,8 @@ static int dw_configure_dai(struct dw_i2s_dev *dev,
                 idx = COMP2_RX_WORDSIZE_0(comp2);
                 if (WARN_ON(idx >= ARRAY_SIZE(formats)))
                         return -EINVAL;
+                if (dev->quirks & DW_I2S_QUIRK_16BIT_IDX_OVERRIDE)
+                        idx = 1;
                 dw_i2s_dai->capture.channels_min = MIN_CHANNEL_NUM;
                 dw_i2s_dai->capture.channels_max =
                                 1 << (COMP1_RX_CHANNELS(comp1) + 1);
@@ -543,6 +547,8 @@ static int dw_configure_dai_by_pd(struct dw_i2s_dev *dev,
         if (ret < 0)
                 return ret;
 
+        if (dev->quirks & DW_I2S_QUIRK_16BIT_IDX_OVERRIDE)
+                idx = 1;
         /* Set DMA slaves info */
         dev->play_dma_data.pd.data = pdata->play_dma_data;
         dev->capture_dma_data.pd.data = pdata->capture_dma_data;
diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
index 0b82e209b6e3..1f7e70bfbd55 100644
--- a/sound/soc/fsl/mpc5200_dma.c
+++ b/sound/soc/fsl/mpc5200_dma.c
@@ -302,7 +302,6 @@ static int psc_dma_new(struct snd_soc_pcm_runtime *rtd)
         struct snd_card *card = rtd->card->snd_card;
         struct snd_soc_dai *dai = rtd->cpu_dai;
         struct snd_pcm *pcm = rtd->pcm;
-        struct psc_dma *psc_dma = snd_soc_dai_get_drvdata(rtd->cpu_dai);
         size_t size = psc_dma_hardware.buffer_bytes_max;
         int rc;
 
diff --git a/sound/soc/generic/Kconfig b/sound/soc/generic/Kconfig
index d023959b8cd6..c954be0a0f96 100644
--- a/sound/soc/generic/Kconfig
+++ b/sound/soc/generic/Kconfig
@@ -14,3 +14,20 @@ config SND_SIMPLE_SCU_CARD
         help
           This option enables generic simple SCU sound card support.
           It supports DPCM of multi CPU single Codec system.
+
+config SND_AUDIO_GRAPH_CARD
+        tristate "ASoC Audio Graph sound card support"
+        depends on OF
+        select SND_SIMPLE_CARD_UTILS
+        help
+          This option enables generic simple simple sound card support
+          with OF-graph DT bindings.
+
+config SND_AUDIO_GRAPH_SCU_CARD
+        tristate "ASoC Audio Graph SCU sound card support"
+        depends on OF
+        select SND_SIMPLE_CARD_UTILS
+        help
+          This option enables generic simple SCU sound card support
+          with OF-graph DT bindings.
+          It supports DPCM of multi CPU single Codec ststem.
diff --git a/sound/soc/generic/Makefile b/sound/soc/generic/Makefile
index ee750f3023ba..9e000523a3b4 100644
--- a/sound/soc/generic/Makefile
+++ b/sound/soc/generic/Makefile
@@ -1,7 +1,11 @@
 snd-soc-simple-card-utils-objs  := simple-card-utils.o
 snd-soc-simple-card-objs        := simple-card.o
 snd-soc-simple-scu-card-objs    := simple-scu-card.o
+snd-soc-audio-graph-card-objs   := audio-graph-card.o
+snd-soc-audio-graph-scu-card-objs       := audio-graph-scu-card.o
 
 obj-$(CONFIG_SND_SIMPLE_CARD_UTILS)     += snd-soc-simple-card-utils.o
 obj-$(CONFIG_SND_SIMPLE_CARD)           += snd-soc-simple-card.o
 obj-$(CONFIG_SND_SIMPLE_SCU_CARD)       += snd-soc-simple-scu-card.o
+obj-$(CONFIG_SND_AUDIO_GRAPH_CARD)      += snd-soc-audio-graph-card.o
+obj-$(CONFIG_SND_AUDIO_GRAPH_SCU_CARD)  += snd-soc-audio-graph-scu-card.o
diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
new file mode 100644
index 000000000000..105ec3a6e30d
--- /dev/null
+++ b/sound/soc/generic/audio-graph-card.c
@@ -0,0 +1,338 @@
+/*
+ * ASoC audio graph sound card support
+ *
+ * Copyright (C) 2016 Renesas Solutions Corp.
+ * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+ *
+ * based on ${LINUX}/sound/soc/generic/simple-card.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/of_graph.h>
+#include <linux/platform_device.h>
+#include <linux/string.h>
+#include <sound/jack.h>
+#include <sound/simple_card_utils.h>
+
+struct graph_card_data {
+        struct snd_soc_card snd_card;
+        struct graph_dai_props {
+                struct asoc_simple_dai cpu_dai;
+                struct asoc_simple_dai codec_dai;
+        } *dai_props;
+        struct snd_soc_dai_link *dai_link;
+        struct gpio_desc *pa_gpio;
+};
+
+static int asoc_graph_card_outdrv_event(struct snd_soc_dapm_widget *w,
+                                        struct snd_kcontrol *kcontrol,
+                                        int event)
+{
+        struct snd_soc_dapm_context *dapm = w->dapm;
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(dapm->card);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                gpiod_set_value_cansleep(priv->pa_gpio, 1);
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                gpiod_set_value_cansleep(priv->pa_gpio, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget asoc_graph_card_dapm_widgets[] = {
+        SND_SOC_DAPM_OUT_DRV_E("Amplifier", SND_SOC_NOPM,
+                               0, 0, NULL, 0, asoc_graph_card_outdrv_event,
+                               SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+};
+
+#define graph_priv_to_card(priv) (&(priv)->snd_card)
+#define graph_priv_to_props(priv, i) ((priv)->dai_props + (i))
+#define graph_priv_to_dev(priv) (graph_priv_to_card(priv)->dev)
+#define graph_priv_to_link(priv, i) (graph_priv_to_card(priv)->dai_link + (i))
+
+static int asoc_graph_card_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct graph_dai_props *dai_props = graph_priv_to_props(priv, rtd->num);
+        int ret;
+
+        ret = asoc_simple_card_clk_enable(&dai_props->cpu_dai);
+        if (ret)
+                return ret;
+
+        ret = asoc_simple_card_clk_enable(&dai_props->codec_dai);
+        if (ret)
+                asoc_simple_card_clk_disable(&dai_props->cpu_dai);
+
+        return ret;
+}
+
+static void asoc_graph_card_shutdown(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct graph_dai_props *dai_props = graph_priv_to_props(priv, rtd->num);
+
+        asoc_simple_card_clk_disable(&dai_props->cpu_dai);
+
+        asoc_simple_card_clk_disable(&dai_props->codec_dai);
+}
+
+static struct snd_soc_ops asoc_graph_card_ops = {
+        .startup = asoc_graph_card_startup,
+        .shutdown = asoc_graph_card_shutdown,
+};
+
+static int asoc_graph_card_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct graph_card_data *priv =  snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *codec = rtd->codec_dai;
+        struct snd_soc_dai *cpu = rtd->cpu_dai;
+        struct graph_dai_props *dai_props =
+                graph_priv_to_props(priv, rtd->num);
+        int ret;
+
+        ret = asoc_simple_card_init_dai(codec, &dai_props->codec_dai);
+        if (ret < 0)
+                return ret;
+
+        ret = asoc_simple_card_init_dai(cpu, &dai_props->cpu_dai);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int asoc_graph_card_dai_link_of(struct device_node *cpu_port,
+                                        struct graph_card_data *priv,
+                                        int idx)
+{
+        struct device *dev = graph_priv_to_dev(priv);
+        struct snd_soc_dai_link *dai_link = graph_priv_to_link(priv, idx);
+        struct graph_dai_props *dai_props = graph_priv_to_props(priv, idx);
+        struct asoc_simple_dai *cpu_dai = &dai_props->cpu_dai;
+        struct asoc_simple_dai *codec_dai = &dai_props->codec_dai;
+        struct device_node *cpu_ep    = of_get_next_child(cpu_port, NULL);
+        struct device_node *codec_ep = of_graph_get_remote_endpoint(cpu_ep);
+        struct device_node *rcpu_ep = of_graph_get_remote_endpoint(codec_ep);
+        int ret;
+
+        if (rcpu_ep != cpu_ep) {
+                dev_err(dev, "remote-endpoint mismatch (%s/%s/%s)\n",
+                        cpu_ep->name, codec_ep->name, rcpu_ep->name);
+                ret = -EINVAL;
+                goto dai_link_of_err;
+        }
+
+        ret = asoc_simple_card_parse_daifmt(dev, cpu_ep, codec_ep,
+                                            NULL, &dai_link->dai_fmt);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        /*
+         * we need to consider "mclk-fs" around here
+         * see simple-card
+         */
+
+        ret = asoc_simple_card_parse_graph_cpu(cpu_ep, dai_link);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_parse_graph_codec(codec_ep, dai_link);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_of_parse_tdm(cpu_ep, cpu_dai);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_of_parse_tdm(codec_ep, codec_dai);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_parse_clk_cpu(dev, cpu_ep, dai_link, cpu_dai);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_parse_clk_codec(dev, codec_ep, dai_link, codec_dai);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_canonicalize_dailink(dai_link);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_set_dailink_name(dev, dai_link,
+                                                "%s-%s",
+                                                dai_link->cpu_dai_name,
+                                                dai_link->codec_dai_name);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        dai_link->ops = &asoc_graph_card_ops;
+        dai_link->init = asoc_graph_card_dai_init;
+
+        asoc_simple_card_canonicalize_cpu(dai_link,
+                of_graph_get_endpoint_count(dai_link->cpu_of_node) == 1);
+
+dai_link_of_err:
+        of_node_put(cpu_ep);
+        of_node_put(rcpu_ep);
+        of_node_put(codec_ep);
+
+        return ret;
+}
+
+static int asoc_graph_card_parse_of(struct graph_card_data *priv)
+{
+        struct of_phandle_iterator it;
+        struct device *dev = graph_priv_to_dev(priv);
+        struct snd_soc_card *card = graph_priv_to_card(priv);
+        struct device_node *node = dev->of_node;
+        int rc, idx = 0;
+        int ret;
+
+        ret = asoc_simple_card_of_parse_widgets(card, NULL);
+        if (ret < 0)
+                return ret;
+
+        ret = asoc_simple_card_of_parse_routing(card, NULL, 1);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * we need to consider "mclk-fs" around here
+         * see simple-card
+         */
+
+        of_for_each_phandle(&it, rc, node, "dais", NULL, 0) {
+                ret = asoc_graph_card_dai_link_of(it.node, priv, idx++);
+                of_node_put(it.node);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return asoc_simple_card_parse_card_name(card, NULL);
+}
+
+static int asoc_graph_get_dais_count(struct device *dev)
+{
+        struct of_phandle_iterator it;
+        struct device_node *node = dev->of_node;
+        int count = 0;
+        int rc;
+
+        of_for_each_phandle(&it, rc, node, "dais", NULL, 0) {
+                count++;
+                of_node_put(it.node);
+        }
+
+        return count;
+}
+
+static int asoc_graph_card_probe(struct platform_device *pdev)
+{
+        struct graph_card_data *priv;
+        struct snd_soc_dai_link *dai_link;
+        struct graph_dai_props *dai_props;
+        struct device *dev = &pdev->dev;
+        struct snd_soc_card *card;
+        int num, ret;
+
+        /* Allocate the private data and the DAI link array */
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        num = asoc_graph_get_dais_count(dev);
+        if (num == 0)
+                return -EINVAL;
+
+        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
+        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        if (!dai_props || !dai_link)
+                return -ENOMEM;
+
+        priv->pa_gpio = devm_gpiod_get_optional(dev, "pa", GPIOD_OUT_LOW);
+        if (IS_ERR(priv->pa_gpio)) {
+                ret = PTR_ERR(priv->pa_gpio);
+                dev_err(dev, "failed to get amplifier gpio: %d\n", ret);
+                return ret;
+        }
+
+        priv->dai_props                 = dai_props;
+        priv->dai_link                  = dai_link;
+
+        /* Init snd_soc_card */
+        card = graph_priv_to_card(priv);
+        card->owner     = THIS_MODULE;
+        card->dev       = dev;
+        card->dai_link  = dai_link;
+        card->num_links = num;
+        card->dapm_widgets = asoc_graph_card_dapm_widgets;
+        card->num_dapm_widgets = ARRAY_SIZE(asoc_graph_card_dapm_widgets);
+
+        ret = asoc_graph_card_parse_of(priv);
+        if (ret < 0) {
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "parse error %d\n", ret);
+                goto err;
+        }
+
+        snd_soc_card_set_drvdata(card, priv);
+
+        ret = devm_snd_soc_register_card(dev, card);
+        if (ret < 0)
+                goto err;
+
+        return 0;
+err:
+        asoc_simple_card_clean_reference(card);
+
+        return ret;
+}
+
+static int asoc_graph_card_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+        return asoc_simple_card_clean_reference(card);
+}
+
+static const struct of_device_id asoc_graph_of_match[] = {
+        { .compatible = "audio-graph-card", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, asoc_graph_of_match);
+
+static struct platform_driver asoc_graph_card = {
+        .driver = {
+                .name = "asoc-audio-graph-card",
+                .of_match_table = asoc_graph_of_match,
+        },
+        .probe = asoc_graph_card_probe,
+        .remove = asoc_graph_card_remove,
+};
+module_platform_driver(asoc_graph_card);
+
+MODULE_ALIAS("platform:asoc-audio-graph-card");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ASoC Audio Graph Sound Card");
+MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/sound/soc/generic/audio-graph-scu-card.c b/sound/soc/generic/audio-graph-scu-card.c
new file mode 100644
index 000000000000..dcd2df37bc3b
--- /dev/null
+++ b/sound/soc/generic/audio-graph-scu-card.c
@@ -0,0 +1,411 @@
+/*
+ * ASoC audio graph SCU sound card support
+ *
+ * Copyright (C) 2017 Renesas Solutions Corp.
+ * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+ *
+ * based on
+ *      ${LINUX}/sound/soc/generic/simple-scu-card.c
+ *      ${LINUX}/sound/soc/generic/audio-graph-card.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/gpio.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/of_graph.h>
+#include <linux/platform_device.h>
+#include <linux/string.h>
+#include <sound/jack.h>
+#include <sound/simple_card_utils.h>
+
+struct graph_card_data {
+        struct snd_soc_card snd_card;
+        struct snd_soc_codec_conf codec_conf;
+        struct asoc_simple_dai *dai_props;
+        struct snd_soc_dai_link *dai_link;
+        struct asoc_simple_card_data adata;
+};
+
+#define graph_priv_to_card(priv) (&(priv)->snd_card)
+#define graph_priv_to_props(priv, i) ((priv)->dai_props + (i))
+#define graph_priv_to_dev(priv) (graph_priv_to_card(priv)->dev)
+#define graph_priv_to_link(priv, i) (graph_priv_to_card(priv)->dai_link + (i))
+
+static int asoc_graph_card_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct asoc_simple_dai *dai_props = graph_priv_to_props(priv, rtd->num);
+
+        return asoc_simple_card_clk_enable(dai_props);
+}
+
+static void asoc_graph_card_shutdown(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct asoc_simple_dai *dai_props = graph_priv_to_props(priv, rtd->num);
+
+        asoc_simple_card_clk_disable(dai_props);
+}
+
+static struct snd_soc_ops asoc_graph_card_ops = {
+        .startup = asoc_graph_card_startup,
+        .shutdown = asoc_graph_card_shutdown,
+};
+
+static int asoc_graph_card_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct graph_card_data *priv =  snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai;
+        struct snd_soc_dai_link *dai_link;
+        struct asoc_simple_dai *dai_props;
+        int num = rtd->num;
+
+        dai_link        = graph_priv_to_link(priv, num);
+        dai_props       = graph_priv_to_props(priv, num);
+        dai             = dai_link->dynamic ?
+                                rtd->cpu_dai :
+                                rtd->codec_dai;
+
+        return asoc_simple_card_init_dai(dai, dai_props);
+}
+
+static int asoc_graph_card_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+                                               struct snd_pcm_hw_params *params)
+{
+        struct graph_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
+
+        asoc_simple_card_convert_fixup(&priv->adata, params);
+
+        return 0;
+}
+
+static int asoc_graph_card_dai_link_of(struct device_node *ep,
+                                       struct graph_card_data *priv,
+                                       unsigned int daifmt,
+                                       int idx, int is_fe)
+{
+        struct device *dev = graph_priv_to_dev(priv);
+        struct snd_soc_dai_link *dai_link = graph_priv_to_link(priv, idx);
+        struct asoc_simple_dai *dai_props = graph_priv_to_props(priv, idx);
+        struct snd_soc_card *card = graph_priv_to_card(priv);
+        int ret;
+
+        if (is_fe) {
+                /* BE is dummy */
+                dai_link->codec_of_node         = NULL;
+                dai_link->codec_dai_name        = "snd-soc-dummy-dai";
+                dai_link->codec_name            = "snd-soc-dummy";
+
+                /* FE settings */
+                dai_link->dynamic               = 1;
+                dai_link->dpcm_merged_format    = 1;
+
+                ret = asoc_simple_card_parse_graph_cpu(ep, dai_link);
+                if (ret)
+                        return ret;
+
+                ret = asoc_simple_card_parse_clk_cpu(dev, ep, dai_link, dai_props);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
+                                                        "fe.%s",
+                                                        dai_link->cpu_dai_name);
+                if (ret < 0)
+                        return ret;
+
+                /* card->num_links includes Codec */
+                asoc_simple_card_canonicalize_cpu(dai_link,
+                        of_graph_get_endpoint_count(dai_link->cpu_of_node) == 1);
+        } else {
+                /* FE is dummy */
+                dai_link->cpu_of_node           = NULL;
+                dai_link->cpu_dai_name          = "snd-soc-dummy-dai";
+                dai_link->cpu_name              = "snd-soc-dummy";
+
+                /* BE settings */
+                dai_link->no_pcm                = 1;
+                dai_link->be_hw_params_fixup    = asoc_graph_card_be_hw_params_fixup;
+
+                ret = asoc_simple_card_parse_graph_codec(ep, dai_link);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_parse_clk_codec(dev, ep, dai_link, dai_props);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
+                                                        "be.%s",
+                                                        dai_link->codec_dai_name);
+                if (ret < 0)
+                        return ret;
+
+                snd_soc_of_parse_audio_prefix(card,
+                                              &priv->codec_conf,
+                                              dai_link->codec_of_node,
+                                              "prefix");
+        }
+
+        ret = asoc_simple_card_of_parse_tdm(ep, dai_props);
+        if (ret)
+                return ret;
+
+        ret = asoc_simple_card_canonicalize_dailink(dai_link);
+        if (ret < 0)
+                return ret;
+
+        dai_link->dai_fmt               = daifmt;
+        dai_link->dpcm_playback         = 1;
+        dai_link->dpcm_capture          = 1;
+        dai_link->ops                   = &asoc_graph_card_ops;
+        dai_link->init                  = asoc_graph_card_dai_init;
+
+        return 0;
+}
+
+static int asoc_graph_card_parse_of(struct graph_card_data *priv)
+{
+        struct of_phandle_iterator it;
+        struct device *dev = graph_priv_to_dev(priv);
+        struct snd_soc_card *card = graph_priv_to_card(priv);
+        struct device_node *node = dev->of_node;
+        struct device_node *cpu_port;
+        struct device_node *cpu_ep;
+        struct device_node *codec_ep;
+        struct device_node *rcpu_ep;
+        struct device_node *codec_port;
+        struct device_node *codec_port_old;
+        unsigned int daifmt = 0;
+        int dai_idx, ret;
+        int rc, codec;
+
+        if (!node)
+                return -EINVAL;
+
+        /*
+         * we need to consider "widgets", "mclk-fs" around here
+         * see simple-card
+         */
+
+        ret = asoc_simple_card_of_parse_routing(card, NULL, 0);
+        if (ret < 0)
+                return ret;
+
+        asoc_simple_card_parse_convert(dev, NULL, &priv->adata);
+
+        /*
+         * it supports multi CPU, single CODEC only here
+         * see asoc_graph_get_dais_count
+         */
+
+        /* find 1st codec */
+        of_for_each_phandle(&it, rc, node, "dais", NULL, 0) {
+                cpu_port = it.node;
+                cpu_ep   = of_get_next_child(cpu_port, NULL);
+                codec_ep = of_graph_get_remote_endpoint(cpu_ep);
+                rcpu_ep  = of_graph_get_remote_endpoint(codec_ep);
+
+                of_node_put(cpu_port);
+                of_node_put(cpu_ep);
+                of_node_put(codec_ep);
+                of_node_put(rcpu_ep);
+
+                if (!codec_ep)
+                        continue;
+
+                if (rcpu_ep != cpu_ep) {
+                        dev_err(dev, "remote-endpoint missmatch (%s/%s/%s)\n",
+                                cpu_ep->name, codec_ep->name, rcpu_ep->name);
+                        ret = -EINVAL;
+                        goto parse_of_err;
+                }
+
+                ret = asoc_simple_card_parse_daifmt(dev, cpu_ep, codec_ep,
+                                                            NULL, &daifmt);
+                if (ret < 0)
+                        goto parse_of_err;
+        }
+
+        dai_idx = 0;
+        codec_port_old = NULL;
+        for (codec = 0; codec < 2; codec++) {
+                /*
+                 * To listup valid sounds continuously,
+                 * detect all CPU-dummy first, and
+                 * detect all dummy-Codec second
+                 */
+                of_for_each_phandle(&it, rc, node, "dais", NULL, 0) {
+                        cpu_port = it.node;
+                        cpu_ep   = of_get_next_child(cpu_port, NULL);
+                        codec_ep = of_graph_get_remote_endpoint(cpu_ep);
+                        codec_port = of_graph_get_port_parent(codec_ep);
+
+                        of_node_put(cpu_port);
+                        of_node_put(cpu_ep);
+                        of_node_put(codec_ep);
+                        of_node_put(codec_port);
+
+                        if (codec) {
+                                if (!codec_port)
+                                        continue;
+
+                                if (codec_port_old == codec_port)
+                                        continue;
+
+                                codec_port_old = codec_port;
+
+                                /* Back-End (= Codec) */
+                                ret = asoc_graph_card_dai_link_of(codec_ep, priv, daifmt, dai_idx++, 0);
+                                if (ret < 0)
+                                        goto parse_of_err;
+                        } else {
+                                /* Front-End (= CPU) */
+                                ret = asoc_graph_card_dai_link_of(cpu_ep, priv, daifmt, dai_idx++, 1);
+                                if (ret < 0)
+                                        goto parse_of_err;
+                        }
+                }
+        }
+
+        ret = asoc_simple_card_parse_card_name(card, NULL);
+        if (ret)
+                goto parse_of_err;
+
+        ret = 0;
+
+parse_of_err:
+        return ret;
+}
+
+static int asoc_graph_get_dais_count(struct device *dev)
+{
+        struct of_phandle_iterator it;
+        struct device_node *node = dev->of_node;
+        struct device_node *cpu_port;
+        struct device_node *cpu_ep;
+        struct device_node *codec_ep;
+        struct device_node *codec_port;
+        struct device_node *codec_port_old;
+        int count = 0;
+        int rc;
+
+        codec_port_old = NULL;
+        of_for_each_phandle(&it, rc, node, "dais", NULL, 0) {
+                cpu_port = it.node;
+                cpu_ep   = of_get_next_child(cpu_port, NULL);
+                codec_ep = of_graph_get_remote_endpoint(cpu_ep);
+                codec_port = of_graph_get_port_parent(codec_ep);
+
+                of_node_put(cpu_port);
+                of_node_put(cpu_ep);
+                of_node_put(codec_ep);
+                of_node_put(codec_port);
+
+                if (cpu_ep)
+                        count++;
+
+                if (!codec_port)
+                        continue;
+
+                if (codec_port_old == codec_port)
+                        continue;
+
+                count++;
+                codec_port_old = codec_port;
+        }
+
+        return count;
+}
+
+static int asoc_graph_card_probe(struct platform_device *pdev)
+{
+        struct graph_card_data *priv;
+        struct snd_soc_dai_link *dai_link;
+        struct asoc_simple_dai *dai_props;
+        struct device *dev = &pdev->dev;
+        struct snd_soc_card *card;
+        int num, ret;
+
+        /* Allocate the private data and the DAI link array */
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        num = asoc_graph_get_dais_count(dev);
+        if (num == 0)
+                return -EINVAL;
+
+        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
+        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        if (!dai_props || !dai_link)
+                return -ENOMEM;
+
+        priv->dai_props                 = dai_props;
+        priv->dai_link                  = dai_link;
+
+        /* Init snd_soc_card */
+        card = graph_priv_to_card(priv);
+        card->owner             = THIS_MODULE;
+        card->dev               = dev;
+        card->dai_link          = priv->dai_link;
+        card->num_links         = num;
+        card->codec_conf        = &priv->codec_conf;
+        card->num_configs       = 1;
+
+        ret = asoc_graph_card_parse_of(priv);
+        if (ret < 0) {
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "parse error %d\n", ret);
+                goto err;
+        }
+
+        snd_soc_card_set_drvdata(card, priv);
+
+        ret = devm_snd_soc_register_card(dev, card);
+        if (ret < 0)
+                goto err;
+
+        return 0;
+err:
+        asoc_simple_card_clean_reference(card);
+
+        return ret;
+}
+
+static int asoc_graph_card_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+        return asoc_simple_card_clean_reference(card);
+}
+
+static const struct of_device_id asoc_graph_of_match[] = {
+        { .compatible = "audio-graph-scu-card", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, asoc_graph_of_match);
+
+static struct platform_driver asoc_graph_card = {
+        .driver = {
+                .name = "asoc-audio-graph-scu-card",
+                .of_match_table = asoc_graph_of_match,
+        },
+        .probe = asoc_graph_card_probe,
+        .remove = asoc_graph_card_remove,
+};
+module_platform_driver(asoc_graph_card);
+
+MODULE_ALIAS("platform:asoc-audio-graph-scu-card");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ASoC Audio Graph SCU Sound Card");
+MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index 343b291fc372..26d64fa40c9c 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -10,8 +10,49 @@
 #include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/of_graph.h>
 #include <sound/simple_card_utils.h>
 
+void asoc_simple_card_convert_fixup(struct asoc_simple_card_data *data,
+                                    struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        if (data->convert_rate)
+                rate->min =
+                rate->max = data->convert_rate;
+
+        if (data->convert_channels)
+                channels->min =
+                channels->max = data->convert_channels;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_convert_fixup);
+
+void asoc_simple_card_parse_convert(struct device *dev, char *prefix,
+                                    struct asoc_simple_card_data *data)
+{
+        struct device_node *np = dev->of_node;
+        char prop[128];
+
+        if (!prefix)
+                prefix = "";
+
+        /* sampling rate convert */
+        snprintf(prop, sizeof(prop), "%s%s", prefix, "convert-rate");
+        of_property_read_u32(np, prop, &data->convert_rate);
+
+        /* channels transfer */
+        snprintf(prop, sizeof(prop), "%s%s", prefix, "convert-channels");
+        of_property_read_u32(np, prop, &data->convert_channels);
+
+        dev_dbg(dev, "convert_rate     %d\n", data->convert_rate);
+        dev_dbg(dev, "convert_channels %d\n", data->convert_channels);
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_parse_convert);
+
 int asoc_simple_card_parse_daifmt(struct device *dev,
                                   struct device_node *node,
                                   struct device_node *codec,
@@ -20,14 +61,13 @@ int asoc_simple_card_parse_daifmt(struct device *dev,
 {
         struct device_node *bitclkmaster = NULL;
         struct device_node *framemaster = NULL;
-        int prefix_len = prefix ? strlen(prefix) : 0;
         unsigned int daifmt;
 
         daifmt = snd_soc_of_parse_daifmt(node, prefix,
                                          &bitclkmaster, &framemaster);
         daifmt &= ~SND_SOC_DAIFMT_MASTER_MASK;
 
-        if (prefix_len && !bitclkmaster && !framemaster) {
+        if (!bitclkmaster && !framemaster) {
                 /*
                  * No dai-link level and master setting was not found from
                  * sound node level, revert back to legacy DT parsing and
@@ -51,6 +91,8 @@ int asoc_simple_card_parse_daifmt(struct device *dev,
 
         *retfmt = daifmt;
 
+        dev_dbg(dev, "format : %04x\n", daifmt);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_daifmt);
@@ -72,6 +114,8 @@ int asoc_simple_card_set_dailink_name(struct device *dev,
 
                 dai_link->name          = name;
                 dai_link->stream_name   = name;
+
+                dev_dbg(dev, "name : %s\n", name);
         }
 
         return ret;
@@ -81,27 +125,54 @@ EXPORT_SYMBOL_GPL(asoc_simple_card_set_dailink_name);
 int asoc_simple_card_parse_card_name(struct snd_soc_card *card,
                                      char *prefix)
 {
-        char prop[128];
         int ret;
 
-        snprintf(prop, sizeof(prop), "%sname", prefix);
+        if (!prefix)
+                prefix = "";
 
         /* Parse the card name from DT */
-        ret = snd_soc_of_parse_card_name(card, prop);
-        if (ret < 0)
-                return ret;
+        ret = snd_soc_of_parse_card_name(card, "label");
+        if (ret < 0) {
+                char prop[128];
+
+                snprintf(prop, sizeof(prop), "%sname", prefix);
+                ret = snd_soc_of_parse_card_name(card, prop);
+                if (ret < 0)
+                        return ret;
+        }
 
         if (!card->name && card->dai_link)
                 card->name = card->dai_link->name;
 
+        dev_dbg(card->dev, "Card Name: %s\n", card->name ? card->name : "");
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_card_name);
 
+static void asoc_simple_card_clk_register(struct asoc_simple_dai *dai,
+                                          struct clk *clk)
+{
+        dai->clk = clk;
+}
+
+int asoc_simple_card_clk_enable(struct asoc_simple_dai *dai)
+{
+        return clk_prepare_enable(dai->clk);
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_clk_enable);
+
+void asoc_simple_card_clk_disable(struct asoc_simple_dai *dai)
+{
+        clk_disable_unprepare(dai->clk);
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_clk_disable);
+
 int asoc_simple_card_parse_clk(struct device *dev,
                                struct device_node *node,
                                struct device_node *dai_of_node,
-                               struct asoc_simple_dai *simple_dai)
+                               struct asoc_simple_dai *simple_dai,
+                               const char *name)
 {
         struct clk *clk;
         u32 val;
@@ -115,7 +186,8 @@ int asoc_simple_card_parse_clk(struct device *dev,
         clk = devm_get_clk_from_child(dev, node, NULL);
         if (!IS_ERR(clk)) {
                 simple_dai->sysclk = clk_get_rate(clk);
-                simple_dai->clk = clk;
+
+                asoc_simple_card_clk_register(simple_dai, clk);
         } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
                 simple_dai->sysclk = val;
         } else {
@@ -124,6 +196,8 @@ int asoc_simple_card_parse_clk(struct device *dev,
                         simple_dai->sysclk = clk_get_rate(clk);
         }
 
+        dev_dbg(dev, "%s : sysclk = %d\n", name, simple_dai->sysclk);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_clk);
@@ -165,6 +239,71 @@ int asoc_simple_card_parse_dai(struct device_node *node,
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_dai);
 
+static int asoc_simple_card_get_dai_id(struct device_node *ep)
+{
+        struct device_node *node;
+        struct device_node *endpoint;
+        int i, id;
+        int ret;
+
+        ret = snd_soc_get_dai_id(ep);
+        if (ret != -ENOTSUPP)
+                return ret;
+
+        node = of_graph_get_port_parent(ep);
+
+        /*
+         * Non HDMI sound case, counting port/endpoint on its DT
+         * is enough. Let's count it.
+         */
+        i = 0;
+        id = -1;
+        for_each_endpoint_of_node(node, endpoint) {
+                if (endpoint == ep)
+                        id = i;
+                i++;
+        }
+        if (id < 0)
+                return -ENODEV;
+
+        return id;
+}
+
+int asoc_simple_card_parse_graph_dai(struct device_node *ep,
+                                     struct device_node **dai_of_node,
+                                     const char **dai_name)
+{
+        struct device_node *node;
+        struct of_phandle_args args;
+        int ret;
+
+        if (!ep)
+                return 0;
+        if (!dai_name)
+                return 0;
+
+        /*
+         * of_graph_get_port_parent() will call
+         * of_node_put(). So, call of_node_get() here
+         */
+        of_node_get(ep);
+        node = of_graph_get_port_parent(ep);
+
+        /* Get dai->name */
+        args.np         = node;
+        args.args[0]    = asoc_simple_card_get_dai_id(ep);
+        args.args_count = (of_graph_get_endpoint_count(node) > 1);
+
+        ret = snd_soc_get_dai_name(&args, dai_name);
+        if (ret < 0)
+                return ret;
+
+        *dai_of_node = node;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_parse_graph_dai);
+
 int asoc_simple_card_init_dai(struct snd_soc_dai *dai,
                               struct asoc_simple_dai *simple_dai)
 {
@@ -236,6 +375,47 @@ int asoc_simple_card_clean_reference(struct snd_soc_card *card)
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_clean_reference);
 
+int asoc_simple_card_of_parse_routing(struct snd_soc_card *card,
+                                      char *prefix,
+                                      int optional)
+{
+        struct device_node *node = card->dev->of_node;
+        char prop[128];
+
+        if (!prefix)
+                prefix = "";
+
+        snprintf(prop, sizeof(prop), "%s%s", prefix, "routing");
+
+        if (!of_property_read_bool(node, prop)) {
+                if (optional)
+                        return 0;
+                return -EINVAL;
+        }
+
+        return snd_soc_of_parse_audio_routing(card, prop);
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_of_parse_routing);
+
+int asoc_simple_card_of_parse_widgets(struct snd_soc_card *card,
+                                      char *prefix)
+{
+        struct device_node *node = card->dev->of_node;
+        char prop[128];
+
+        if (!prefix)
+                prefix = "";
+
+        snprintf(prop, sizeof(prop), "%s%s", prefix, "widgets");
+
+        if (of_property_read_bool(node, prop))
+                return snd_soc_of_parse_audio_simple_widgets(card, prop);
+
+        /* no widgets is not error */
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_of_parse_widgets);
+
 /* Module information */
 MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
 MODULE_DESCRIPTION("ALSA SoC Simple Card Utils");
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index bc136d2bd7cd..dfaf48ff88b0 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -118,13 +118,13 @@ static int asoc_simple_card_startup(struct snd_pcm_substream *substream)
                 simple_priv_to_props(priv, rtd->num);
         int ret;
 
-        ret = clk_prepare_enable(dai_props->cpu_dai.clk);
+        ret = asoc_simple_card_clk_enable(&dai_props->cpu_dai);
         if (ret)
                 return ret;
 
-        ret = clk_prepare_enable(dai_props->codec_dai.clk);
+        ret = asoc_simple_card_clk_enable(&dai_props->codec_dai);
         if (ret)
-                clk_disable_unprepare(dai_props->cpu_dai.clk);
+                asoc_simple_card_clk_disable(&dai_props->cpu_dai);
 
         return ret;
 }
@@ -136,9 +136,9 @@ static void asoc_simple_card_shutdown(struct snd_pcm_substream *substream)
         struct simple_dai_props *dai_props =
                 simple_priv_to_props(priv, rtd->num);
 
-        clk_disable_unprepare(dai_props->cpu_dai.clk);
+        asoc_simple_card_clk_disable(&dai_props->cpu_dai);
 
-        clk_disable_unprepare(dai_props->codec_dai.clk);
+        asoc_simple_card_clk_disable(&dai_props->codec_dai);
 }
 
 static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream,
@@ -233,13 +233,19 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
         snprintf(prop, sizeof(prop), "%scpu", prefix);
         cpu = of_get_child_by_name(node, prop);
 
+        if (!cpu) {
+                ret = -EINVAL;
+                dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop);
+                goto dai_link_of_err;
+        }
+
         snprintf(prop, sizeof(prop), "%splat", prefix);
         plat = of_get_child_by_name(node, prop);
 
         snprintf(prop, sizeof(prop), "%scodec", prefix);
         codec = of_get_child_by_name(node, prop);
 
-        if (!cpu || !codec) {
+        if (!codec) {
                 ret = -EINVAL;
                 dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop);
                 goto dai_link_of_err;
@@ -265,17 +271,11 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
         if (ret < 0)
                 goto dai_link_of_err;
 
-        ret = snd_soc_of_parse_tdm_slot(cpu,    &cpu_dai->tx_slot_mask,
-                                                &cpu_dai->rx_slot_mask,
-                                                &cpu_dai->slots,
-                                                &cpu_dai->slot_width);
+        ret = asoc_simple_card_of_parse_tdm(cpu, cpu_dai);
         if (ret < 0)
                 goto dai_link_of_err;
 
-        ret = snd_soc_of_parse_tdm_slot(codec,  &codec_dai->tx_slot_mask,
-                                                &codec_dai->rx_slot_mask,
-                                                &codec_dai->slots,
-                                                &codec_dai->slot_width);
+        ret = asoc_simple_card_of_parse_tdm(codec, codec_dai);
         if (ret < 0)
                 goto dai_link_of_err;
 
@@ -301,15 +301,6 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
         dai_link->ops = &asoc_simple_card_ops;
         dai_link->init = asoc_simple_card_dai_init;
 
-        dev_dbg(dev, "\tname : %s\n", dai_link->stream_name);
-        dev_dbg(dev, "\tformat : %04x\n", dai_link->dai_fmt);
-        dev_dbg(dev, "\tcpu : %s / %d\n",
-                dai_link->cpu_dai_name,
-                dai_props->cpu_dai.sysclk);
-        dev_dbg(dev, "\tcodec : %s / %d\n",
-                dai_link->codec_dai_name,
-                dai_props->codec_dai.sysclk);
-
         asoc_simple_card_canonicalize_cpu(dai_link, single_cpu);
 
 dai_link_of_err:
@@ -350,12 +341,12 @@ static int asoc_simple_card_parse_aux_devs(struct device_node *node,
         return 0;
 }
 
-static int asoc_simple_card_parse_of(struct device_node *node,
-                                     struct simple_card_data *priv)
+static int asoc_simple_card_parse_of(struct simple_card_data *priv)
 {
         struct device *dev = simple_priv_to_dev(priv);
         struct snd_soc_card *card = simple_priv_to_card(priv);
         struct device_node *dai_link;
+        struct device_node *node = dev->of_node;
         int ret;
 
         if (!node)
@@ -363,21 +354,13 @@ static int asoc_simple_card_parse_of(struct device_node *node,
 
         dai_link = of_get_child_by_name(node, PREFIX "dai-link");
 
-        /* The off-codec widgets */
-        if (of_property_read_bool(node, PREFIX "widgets")) {
-                ret = snd_soc_of_parse_audio_simple_widgets(card,
-                                        PREFIX "widgets");
-                if (ret)
-                        goto card_parse_end;
-        }
+        ret = asoc_simple_card_of_parse_widgets(card, PREFIX);
+        if (ret < 0)
+                goto card_parse_end;
 
-        /* DAPM routes */
-        if (of_property_read_bool(node, PREFIX "routing")) {
-                ret = snd_soc_of_parse_audio_routing(card,
-                                        PREFIX "routing");
-                if (ret)
-                        goto card_parse_end;
-        }
+        ret = asoc_simple_card_of_parse_routing(card, PREFIX, 1);
+        if (ret < 0)
+                goto card_parse_end;
 
         /* Factor to mclk, used in hw_params() */
         of_property_read_u32(node, PREFIX "mclk-fs", &priv->mclk_fs);
@@ -454,7 +437,7 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
 
         if (np && of_device_is_available(np)) {
 
-                ret = asoc_simple_card_parse_of(np, priv);
+                ret = asoc_simple_card_parse_of(priv);
                 if (ret < 0) {
                         if (ret != -EPROBE_DEFER)
                                 dev_err(dev, "parse error %d\n", ret);
@@ -497,8 +480,10 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         snd_soc_card_set_drvdata(card, priv);
 
         ret = devm_snd_soc_register_card(dev, card);
-        if (ret >= 0)
-                return ret;
+        if (ret < 0)
+                goto err;
+
+        return 0;
 err:
         asoc_simple_card_clean_reference(card);
 
diff --git a/sound/soc/generic/simple-scu-card.c b/sound/soc/generic/simple-scu-card.c
index dcbcab230d1b..a75b385455c4 100644
--- a/sound/soc/generic/simple-scu-card.c
+++ b/sound/soc/generic/simple-scu-card.c
@@ -27,8 +27,7 @@ struct simple_card_data {
         struct snd_soc_codec_conf codec_conf;
         struct asoc_simple_dai *dai_props;
         struct snd_soc_dai_link *dai_link;
-        u32 convert_rate;
-        u32 convert_channels;
+        struct asoc_simple_card_data adata;
 };
 
 #define simple_priv_to_card(priv) (&(priv)->snd_card)
@@ -47,7 +46,7 @@ static int asoc_simple_card_startup(struct snd_pcm_substream *substream)
         struct asoc_simple_dai *dai_props =
                 simple_priv_to_props(priv, rtd->num);
 
-        return clk_prepare_enable(dai_props->clk);
+        return asoc_simple_card_clk_enable(dai_props);
 }
 
 static void asoc_simple_card_shutdown(struct snd_pcm_substream *substream)
@@ -57,7 +56,7 @@ static void asoc_simple_card_shutdown(struct snd_pcm_substream *substream)
         struct asoc_simple_dai *dai_props =
                 simple_priv_to_props(priv, rtd->num);
 
-        clk_disable_unprepare(dai_props->clk);
+        asoc_simple_card_clk_disable(dai_props);
 }
 
 static const struct snd_soc_ops asoc_simple_card_ops = {
@@ -86,18 +85,8 @@ static int asoc_simple_card_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
                                         struct snd_pcm_hw_params *params)
 {
         struct simple_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
-        struct snd_interval *rate = hw_param_interval(params,
-                                                      SNDRV_PCM_HW_PARAM_RATE);
-        struct snd_interval *channels = hw_param_interval(params,
-                                                SNDRV_PCM_HW_PARAM_CHANNELS);
 
-        if (priv->convert_rate)
-                rate->min =
-                rate->max = priv->convert_rate;
-
-        if (priv->convert_channels)
-                channels->min =
-                channels->max = priv->convert_channels;
+        asoc_simple_card_convert_fixup(&priv->adata, params);
 
         return 0;
 }
@@ -171,11 +160,7 @@ static int asoc_simple_card_dai_link_of(struct device_node *np,
                                               PREFIX "prefix");
         }
 
-        ret = snd_soc_of_parse_tdm_slot(np,
-                                        &dai_props->tx_slot_mask,
-                                        &dai_props->rx_slot_mask,
-                                        &dai_props->slots,
-                                        &dai_props->slot_width);
+        ret = asoc_simple_card_of_parse_tdm(np, dai_props);
         if (ret)
                 return ret;
 
@@ -189,21 +174,16 @@ static int asoc_simple_card_dai_link_of(struct device_node *np,
         dai_link->ops                   = &asoc_simple_card_ops;
         dai_link->init                  = asoc_simple_card_dai_init;
 
-        dev_dbg(dev, "\t%s / %04x / %d\n",
-                dai_link->name,
-                dai_link->dai_fmt,
-                dai_props->sysclk);
-
         return 0;
 }
 
-static int asoc_simple_card_parse_of(struct device_node *node,
-                                     struct simple_card_data *priv)
+static int asoc_simple_card_parse_of(struct simple_card_data *priv)
 
 {
         struct device *dev = simple_priv_to_dev(priv);
         struct device_node *np;
         struct snd_soc_card *card = simple_priv_to_card(priv);
+        struct device_node *node = dev->of_node;
         unsigned int daifmt = 0;
         bool is_fe;
         int ret, i;
@@ -211,15 +191,11 @@ static int asoc_simple_card_parse_of(struct device_node *node,
         if (!node)
                 return -EINVAL;
 
-        ret = snd_soc_of_parse_audio_routing(card, PREFIX "routing");
+        ret = asoc_simple_card_of_parse_routing(card, PREFIX, 0);
         if (ret < 0)
                 return ret;
 
-        /* sampling rate convert */
-        of_property_read_u32(node, PREFIX "convert-rate", &priv->convert_rate);
-
-        /* channels transfer */
-        of_property_read_u32(node, PREFIX "convert-channels", &priv->convert_channels);
+        asoc_simple_card_parse_convert(dev, PREFIX, &priv->adata);
 
         /* find 1st codec */
         np = of_get_child_by_name(node, PREFIX "codec");
@@ -246,11 +222,6 @@ static int asoc_simple_card_parse_of(struct device_node *node,
         if (ret < 0)
                 return ret;
 
-        dev_dbg(dev, "New card: %s\n",
-                card->name ? card->name : "");
-        dev_dbg(dev, "convert_rate     %d\n", priv->convert_rate);
-        dev_dbg(dev, "convert_channels %d\n", priv->convert_channels);
-
         return 0;
 }
 
@@ -288,7 +259,7 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         card->codec_conf        = &priv->codec_conf;
         card->num_configs       = 1;
 
-        ret = asoc_simple_card_parse_of(np, priv);
+        ret = asoc_simple_card_parse_of(priv);
         if (ret < 0) {
                 if (ret != -EPROBE_DEFER)
                         dev_err(dev, "parse error %d\n", ret);
@@ -298,8 +269,10 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         snd_soc_card_set_drvdata(card, priv);
 
         ret = devm_snd_soc_register_card(dev, card);
-        if (ret >= 0)
-                return ret;
+        if (ret < 0)
+                goto err;
+
+        return 0;
 err:
         asoc_simple_card_clean_reference(card);
 
diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c
index 45163e5202f5..b193d3beb253 100644
--- a/sound/soc/hisilicon/hi6210-i2s.c
+++ b/sound/soc/hisilicon/hi6210-i2s.c
@@ -97,8 +97,8 @@ static inline u32 hi6210_read_reg(struct hi6210_i2s *i2s, int reg)
         return readl(i2s->base + reg);
 }
 
-int hi6210_i2s_startup(struct snd_pcm_substream *substream,
-                     struct snd_soc_dai *cpu_dai)
+static int hi6210_i2s_startup(struct snd_pcm_substream *substream,
+                              struct snd_soc_dai *cpu_dai)
 {
         struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
         int ret, n;
@@ -175,8 +175,9 @@ int hi6210_i2s_startup(struct snd_pcm_substream *substream,
 
         return 0;
 }
-void hi6210_i2s_shutdown(struct snd_pcm_substream *substream,
-                       struct snd_soc_dai *cpu_dai)
+
+static void hi6210_i2s_shutdown(struct snd_pcm_substream *substream,
+                                struct snd_soc_dai *cpu_dai)
 {
         struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
         int n;
@@ -524,7 +525,7 @@ static struct snd_soc_dai_ops hi6210_i2s_dai_ops = {
         .shutdown       = hi6210_i2s_shutdown,
 };
 
-struct snd_soc_dai_driver hi6210_i2s_dai_init = {
+static const struct snd_soc_dai_driver hi6210_i2s_dai_init = {
         .probe          = hi6210_i2s_dai_probe,
         .playback = {
                 .channels_min = 2,
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 67968ef3bbda..b301bfff1c09 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -214,6 +214,18 @@ config SND_SOC_INTEL_BYT_CHT_DA7213_MACH
           platforms with DA7212/7213 audio codec.
           If unsure select "N".
 
+config SND_SOC_INTEL_BYT_CHT_ES8316_MACH
+        tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail with ES8316 codec"
+        depends on X86_INTEL_LPSS && I2C && ACPI
+        select SND_SOC_ES8316
+        select SND_SST_ATOM_HIFI2_PLATFORM
+        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
+        help
+          This adds support for ASoC machine driver for Intel(R) Baytrail &
+          Cherrytrail platforms with ES8316 audio codec.
+          If unsure select "N".
+
 config SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH
         tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail platform with no codec (MinnowBoard MAX, Up)"
         depends on X86_INTEL_LPSS && I2C && ACPI
@@ -226,6 +238,36 @@ config SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH
           connector
           If unsure select "N".
 
+config SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH
+        tristate "ASoC Audio driver for KBL with RT5663 and MAX98927 in I2S Mode"
+        depends on X86_INTEL_LPSS && I2C
+        select SND_SOC_INTEL_SST
+        select SND_SOC_INTEL_SKYLAKE
+        select SND_SOC_RT5663
+        select SND_SOC_MAX98927
+        select SND_SOC_DMIC
+        select SND_SOC_HDAC_HDMI
+        help
+          This adds support for ASoC Onboard Codec I2S machine driver. This will
+          create an alsa sound card for RT5663 + MAX98927.
+          Say Y if you have such a device.
+          If unsure select "N".
+
+config SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH
+        tristate "ASoC Audio driver for KBL with RT5663, RT5514 and MAX98927 in I2S Mode"
+        depends on X86_INTEL_LPSS && I2C
+        select SND_SOC_INTEL_SST
+        select SND_SOC_INTEL_SKYLAKE
+        select SND_SOC_RT5663
+        select SND_SOC_RT5514
+        select SND_SOC_MAX98927
+        select SND_SOC_HDAC_HDMI
+        help
+          This adds support for ASoC Onboard Codec I2S machine driver. This will
+          create an alsa sound card for RT5663 + RT5514 + MAX98927.
+          Say Y if you have such a device.
+          If unsure select "N".
+
 config SND_SOC_INTEL_SKYLAKE
         tristate
         select SND_HDA_EXT_CORE
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 21cac1c8dd4c..b082b31023d5 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -690,7 +690,7 @@ static int sst_pcm_new(struct snd_soc_pcm_runtime *rtd)
                         snd_dma_continuous_data(GFP_DMA),
                         SST_MIN_BUFFER, SST_MAX_BUFFER);
                 if (retval) {
-                        dev_err(rtd->dev, "dma buffer allocationf fail\n");
+                        dev_err(rtd->dev, "dma buffer allocation failure\n");
                         return retval;
                 }
         }
diff --git a/sound/soc/intel/atom/sst/sst.c b/sound/soc/intel/atom/sst/sst.c
index f9ba71315e33..8afdff457579 100644
--- a/sound/soc/intel/atom/sst/sst.c
+++ b/sound/soc/intel/atom/sst/sst.c
@@ -258,7 +258,7 @@ static ssize_t firmware_version_show(struct device *dev,
 
 }
 
-DEVICE_ATTR_RO(firmware_version);
+static DEVICE_ATTR_RO(firmware_version);
 
 static const struct attribute *sst_fw_version_attrs[] = {
         &dev_attr_firmware_version.attr,
@@ -382,37 +382,6 @@ void sst_context_cleanup(struct intel_sst_drv *ctx)
 }
 EXPORT_SYMBOL_GPL(sst_context_cleanup);
 
-static inline void sst_save_shim64(struct intel_sst_drv *ctx,
-                            void __iomem *shim,
-                            struct sst_shim_regs64 *shim_regs)
-{
-        unsigned long irq_flags;
-
-        spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
-
-        shim_regs->imrx = sst_shim_read64(shim, SST_IMRX);
-        shim_regs->csr = sst_shim_read64(shim, SST_CSR);
-
-
-        spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
-}
-
-static inline void sst_restore_shim64(struct intel_sst_drv *ctx,
-                                      void __iomem *shim,
-                                      struct sst_shim_regs64 *shim_regs)
-{
-        unsigned long irq_flags;
-
-        /*
-         * we only need to restore IMRX for this case, rest will be
-         * initialize by FW or driver when firmware is loaded
-         */
-        spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
-        sst_shim_write64(shim, SST_IMRX, shim_regs->imrx);
-        sst_shim_write64(shim, SST_CSR, shim_regs->csr);
-        spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
-}
-
 void sst_configure_runtime_pm(struct intel_sst_drv *ctx)
 {
         pm_runtime_set_autosuspend_delay(ctx->dev, SST_SUSPEND_DELAY);
@@ -432,8 +401,6 @@ void sst_configure_runtime_pm(struct intel_sst_drv *ctx)
                 pm_runtime_set_active(ctx->dev);
         else
                 pm_runtime_put_noidle(ctx->dev);
-
-        sst_save_shim64(ctx, ctx->shim, ctx->shim_regs64);
 }
 EXPORT_SYMBOL_GPL(sst_configure_runtime_pm);
 
@@ -457,8 +424,6 @@ static int intel_sst_runtime_suspend(struct device *dev)
         flush_workqueue(ctx->post_msg_wq);
 
         ctx->ops->reset(ctx);
-        /* save the shim registers because PMC doesn't save state */
-        sst_save_shim64(ctx, ctx->shim, ctx->shim_regs64);
 
         return ret;
 }
@@ -499,23 +464,23 @@ static int intel_sst_suspend(struct device *dev)
         fw_save = kzalloc(sizeof(*fw_save), GFP_KERNEL);
         if (!fw_save)
                 return -ENOMEM;
-        fw_save->iram = kzalloc(ctx->iram_end - ctx->iram_base, GFP_KERNEL);
+        fw_save->iram = kvzalloc(ctx->iram_end - ctx->iram_base, GFP_KERNEL);
         if (!fw_save->iram) {
                 ret = -ENOMEM;
                 goto iram;
         }
-        fw_save->dram = kzalloc(ctx->dram_end - ctx->dram_base, GFP_KERNEL);
+        fw_save->dram = kvzalloc(ctx->dram_end - ctx->dram_base, GFP_KERNEL);
         if (!fw_save->dram) {
                 ret = -ENOMEM;
                 goto dram;
         }
-        fw_save->sram = kzalloc(SST_MAILBOX_SIZE, GFP_KERNEL);
+        fw_save->sram = kvzalloc(SST_MAILBOX_SIZE, GFP_KERNEL);
         if (!fw_save->sram) {
                 ret = -ENOMEM;
                 goto sram;
         }
 
-        fw_save->ddr = kzalloc(ctx->ddr_end - ctx->ddr_base, GFP_KERNEL);
+        fw_save->ddr = kvzalloc(ctx->ddr_end - ctx->ddr_base, GFP_KERNEL);
         if (!fw_save->ddr) {
                 ret = -ENOMEM;
                 goto ddr;
@@ -530,11 +495,11 @@ static int intel_sst_suspend(struct device *dev)
         ctx->ops->reset(ctx);
         return 0;
 ddr:
-        kfree(fw_save->sram);
+        kvfree(fw_save->sram);
 sram:
-        kfree(fw_save->dram);
+        kvfree(fw_save->dram);
 dram:
-        kfree(fw_save->iram);
+        kvfree(fw_save->iram);
 iram:
         kfree(fw_save);
         return ret;
@@ -562,10 +527,10 @@ static int intel_sst_resume(struct device *dev)
         memcpy32_toio(ctx->mailbox, fw_save->sram, SST_MAILBOX_SIZE);
         memcpy32_toio(ctx->ddr, fw_save->ddr, ctx->ddr_end - ctx->ddr_base);
 
-        kfree(fw_save->sram);
-        kfree(fw_save->dram);
-        kfree(fw_save->iram);
-        kfree(fw_save->ddr);
+        kvfree(fw_save->sram);
+        kvfree(fw_save->dram);
+        kvfree(fw_save->iram);
+        kvfree(fw_save->ddr);
         kfree(fw_save);
 
         block = sst_create_block(ctx, 0, FW_DWNL_ID);
diff --git a/sound/soc/intel/atom/sst/sst.h b/sound/soc/intel/atom/sst/sst.h
index 5c9a51cc77aa..e02e2b4cc08f 100644
--- a/sound/soc/intel/atom/sst/sst.h
+++ b/sound/soc/intel/atom/sst/sst.h
@@ -317,31 +317,11 @@ struct sst_ipc_reg {
         int ipcd;
 };
 
-struct sst_shim_regs64 {
-        u64 csr;
-        u64 pisr;
-        u64 pimr;
-        u64 isrx;
-        u64 isrd;
-        u64 imrx;
-        u64 imrd;
-        u64 ipcx;
-        u64 ipcd;
-        u64 isrsc;
-        u64 isrlpesc;
-        u64 imrsc;
-        u64 imrlpesc;
-        u64 ipcsc;
-        u64 ipclpesc;
-        u64 clkctl;
-        u64 csr2;
-};
-
 struct sst_fw_save {
-        void *iram;
-        void *dram;
-        void *sram;
-        void *ddr;
+        void *iram;     /* allocated via kvmalloc() */
+        void *dram;     /* allocated via kvmalloc() */
+        void *sram;     /* allocated via kvmalloc() */
+        void *ddr;      /* allocated via kvmalloc() */
 };
 
 /**
@@ -356,7 +336,6 @@ struct sst_fw_save {
  * @dram : SST DRAM pointer
  * @pdata : SST info passed as a part of pci platform data
  * @shim_phy_add : SST shim phy addr
- * @shim_regs64: Struct to save shim registers
  * @ipc_dispatch_list : ipc messages dispatched
  * @rx_list : to copy the process_reply/process_msg from DSP
  * @ipc_post_msg_wq : wq to post IPC messages context
@@ -398,7 +377,6 @@ struct intel_sst_drv {
         unsigned int            ddr_end;
         unsigned int            ddr_base;
         unsigned int            mailbox_recv_offset;
-        struct sst_shim_regs64  *shim_regs64;
         struct list_head        block_list;
         struct list_head        ipc_dispatch_list;
         struct sst_platform_info *pdata;
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index dd250b8b26f2..0e928d54305d 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -303,8 +303,6 @@ static int sst_acpi_probe(struct platform_device *pdev)
                 dev_err(dev, "No matching machine driver found\n");
                 return -ENODEV;
         }
-        if (mach->machine_quirk)
-                mach = mach->machine_quirk(mach);
 
         pdata = mach->pdata;
 
@@ -360,23 +358,9 @@ static int sst_acpi_probe(struct platform_device *pdev)
         if (ret < 0)
                 return ret;
 
-        /* need to save shim registers in BYT */
-        ctx->shim_regs64 = devm_kzalloc(ctx->dev, sizeof(*ctx->shim_regs64),
-                                        GFP_KERNEL);
-        if (!ctx->shim_regs64) {
-                ret = -ENOMEM;
-                goto do_sst_cleanup;
-        }
-
         sst_configure_runtime_pm(ctx);
         platform_set_drvdata(pdev, ctx);
         return ret;
-
-do_sst_cleanup:
-        sst_context_cleanup(ctx);
-        platform_set_drvdata(pdev, NULL);
-        dev_err(ctx->dev, "failed with %d\n", ret);
-        return ret;
 }
 
 /**
@@ -453,12 +437,20 @@ static const struct dmi_system_id cht_table[] = {
 
 
 static struct sst_acpi_mach cht_surface_mach = {
-        "10EC5640", "cht-bsw-rt5645", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                                &chv_platform_data };
+        .id = "10EC5640",
+        .drv_name = "cht-bsw-rt5645",
+        .fw_filename = "intel/fw_sst_22a8.bin",
+        .board = "cht-bsw",
+        .pdata = &chv_platform_data,
+};
 
 static struct sst_acpi_mach byt_thinkpad_10 = {
-        "10EC5640", "cht-bsw-rt5672", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
-                                                                &byt_rvp_platform_data };
+        .id = "10EC5640",
+        .drv_name = "cht-bsw-rt5672",
+        .fw_filename = "intel/fw_sst_0f28.bin",
+        .board = "cht-bsw",
+        .pdata = &byt_rvp_platform_data,
+};
 
 static struct sst_acpi_mach *cht_quirk(void *arg)
 {
@@ -486,68 +478,182 @@ static struct sst_acpi_mach *byt_quirk(void *arg)
 
 
 static struct sst_acpi_mach sst_acpi_bytcr[] = {
-        {"10EC5640", "bytcr_rt5640", "intel/fw_sst_0f28.bin", "bytcr_rt5640", byt_quirk,
-                                                &byt_rvp_platform_data },
-        {"10EC5642", "bytcr_rt5640", "intel/fw_sst_0f28.bin", "bytcr_rt5640", NULL,
-                                                &byt_rvp_platform_data },
-        {"INTCCFFD", "bytcr_rt5640", "intel/fw_sst_0f28.bin", "bytcr_rt5640", NULL,
-                                                &byt_rvp_platform_data },
-        {"10EC5651", "bytcr_rt5651", "intel/fw_sst_0f28.bin", "bytcr_rt5651", NULL,
-                                                &byt_rvp_platform_data },
-        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
-                                                &byt_rvp_platform_data },
-        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
-                                                &byt_rvp_platform_data },
+        {
+                .id = "10EC5640",
+                .drv_name = "bytcr_rt5640",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcr_rt5640",
+                .machine_quirk = byt_quirk,
+                .pdata = &byt_rvp_platform_data,
+        },
+        {
+                .id = "10EC5642",
+                .drv_name = "bytcr_rt5640",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcr_rt5640",
+                .pdata = &byt_rvp_platform_data
+        },
+        {
+                .id = "INTCCFFD",
+                .drv_name = "bytcr_rt5640",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcr_rt5640",
+                .pdata = &byt_rvp_platform_data
+        },
+        {
+                .id = "10EC5651",
+                .drv_name = "bytcr_rt5651",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcr_rt5651",
+                .pdata = &byt_rvp_platform_data
+        },
+        {
+                .id = "DLGS7212",
+                .drv_name = "bytcht_da7213",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcht_da7213",
+                .pdata = &byt_rvp_platform_data
+        },
+        {
+                .id = "DLGS7213",
+                .drv_name = "bytcht_da7213",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcht_da7213",
+                .pdata = &byt_rvp_platform_data
+        },
         /* some Baytrail platforms rely on RT5645, use CHT machine driver */
-        {"10EC5645", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
-                                                &byt_rvp_platform_data },
-        {"10EC5648", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
-                                                &byt_rvp_platform_data },
+        {
+                .id = "10EC5645",
+                .drv_name = "cht-bsw-rt5645",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "cht-bsw",
+                .pdata = &byt_rvp_platform_data
+        },
+        {
+                .id = "10EC5648",
+                .drv_name = "cht-bsw-rt5645",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "cht-bsw",
+                .pdata = &byt_rvp_platform_data
+        },
 #if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
         /*
          * This is always last in the table so that it is selected only when
          * enabled explicitly and there is no codec-related information in SSDT
          */
-        {"80860F28", "bytcht_nocodec", "intel/fw_sst_0f28.bin", "bytcht_nocodec", NULL,
-                                                &byt_rvp_platform_data },
+        {
+                .id = "80860F28",
+                .drv_name = "bytcht_nocodec",
+                .fw_filename = "intel/fw_sst_0f28.bin",
+                .board = "bytcht_nocodec",
+                .pdata = &byt_rvp_platform_data
+        },
 #endif
         {},
 };
 
 /* Cherryview-based platforms: CherryTrail and Braswell */
 static struct sst_acpi_mach sst_acpi_chv[] = {
-        {"10EC5670", "cht-bsw-rt5672", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-        {"10EC5672", "cht-bsw-rt5672", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-        {"10EC5645", "cht-bsw-rt5645", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-        {"10EC5650", "cht-bsw-rt5645", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-        {"10EC3270", "cht-bsw-rt5645", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-
-        {"193C9890", "cht-bsw-max98090", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
-                                                &chv_platform_data },
-        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
-                                                &chv_platform_data },
-        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
-                                                &chv_platform_data },
+        {
+                .id = "10EC5670",
+                .drv_name = "cht-bsw-rt5672",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "10EC5672",
+                .drv_name = "cht-bsw-rt5672",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "10EC5645",
+                .drv_name = "cht-bsw-rt5645",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "10EC5650",
+                .drv_name = "cht-bsw-rt5645",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "10EC3270",
+                .drv_name = "cht-bsw-rt5645",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+
+        {
+                .id = "193C9890",
+                .drv_name = "cht-bsw-max98090",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "cht-bsw",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "DLGS7212",
+                .drv_name = "bytcht_da7213",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcht_da7213",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "DLGS7213",
+                .drv_name = "bytcht_da7213",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcht_da7213",
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "ESSX8316",
+                .drv_name = "bytcht_es8316",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcht_es8316",
+                .pdata = &chv_platform_data
+        },
         /* some CHT-T platforms rely on RT5640, use Baytrail machine driver */
-        {"10EC5640", "bytcr_rt5640", "intel/fw_sst_22a8.bin", "bytcr_rt5640", cht_quirk,
-                                                &chv_platform_data },
-        {"10EC3276", "bytcr_rt5640", "intel/fw_sst_22a8.bin", "bytcr_rt5640", NULL,
-                                                &chv_platform_data },
+        {
+                .id = "10EC5640",
+                .drv_name = "bytcr_rt5640",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcr_rt5640",
+                .machine_quirk = cht_quirk,
+                .pdata = &chv_platform_data
+        },
+        {
+                .id = "10EC3276",
+                .drv_name = "bytcr_rt5640",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcr_rt5640",
+                .pdata = &chv_platform_data
+        },
         /* some CHT-T platforms rely on RT5651, use Baytrail machine driver */
-        {"10EC5651", "bytcr_rt5651", "intel/fw_sst_22a8.bin", "bytcr_rt5651", NULL,
-                                                &chv_platform_data },
+        {
+                .id = "10EC5651",
+                .drv_name = "bytcr_rt5651",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcr_rt5651",
+                .pdata = &chv_platform_data
+        },
 #if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
         /*
          * This is always last in the table so that it is selected only when
          * enabled explicitly and there is no codec-related information in SSDT
          */
-        {"808622A8", "bytcht_nocodec", "intel/fw_sst_22a8.bin", "bytcht_nocodec", NULL,
-                                                &chv_platform_data },
+        {
+                .id = "808622A8",
+                .drv_name = "bytcht_nocodec",
+                .fw_filename = "intel/fw_sst_22a8.bin",
+                .board = "bytcht_nocodec",
+                .pdata = &chv_platform_data
+        },
 #endif
         {},
 };
diff --git a/sound/soc/intel/boards/Makefile b/sound/soc/intel/boards/Makefile
index 56896e09445d..a5c5bc5732a2 100644
--- a/sound/soc/intel/boards/Makefile
+++ b/sound/soc/intel/boards/Makefile
@@ -11,7 +11,10 @@ snd-soc-sst-cht-bsw-rt5672-objs := cht_bsw_rt5672.o
 snd-soc-sst-cht-bsw-rt5645-objs := cht_bsw_rt5645.o
 snd-soc-sst-cht-bsw-max98090_ti-objs := cht_bsw_max98090_ti.o
 snd-soc-sst-byt-cht-da7213-objs := bytcht_da7213.o
+snd-soc-sst-byt-cht-es8316-objs := bytcht_es8316.o
 snd-soc-sst-byt-cht-nocodec-objs := bytcht_nocodec.o
+snd-soc-kbl_rt5663_max98927-objs := kbl_rt5663_max98927.o
+snd-soc-kbl_rt5663_rt5514_max98927-objs := kbl_rt5663_rt5514_max98927.o
 snd-soc-skl_rt286-objs := skl_rt286.o
 snd-skl_nau88l25_max98357a-objs := skl_nau88l25_max98357a.o
 snd-soc-skl_nau88l25_ssm4567-objs := skl_nau88l25_ssm4567.o
@@ -29,7 +32,10 @@ obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH) += snd-soc-sst-cht-bsw-rt5672.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH) += snd-soc-sst-cht-bsw-rt5645.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH) += snd-soc-sst-cht-bsw-max98090_ti.o
 obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH) += snd-soc-sst-byt-cht-da7213.o
+obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_ES8316_MACH) += snd-soc-sst-byt-cht-es8316.o
 obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH) += snd-soc-sst-byt-cht-nocodec.o
+obj-$(CONFIG_SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH) += snd-soc-kbl_rt5663_max98927.o
+obj-$(CONFIG_SND_SOC_INTEL_KBL_RT5663_RT5514_MAX98927_MACH) += snd-soc-kbl_rt5663_rt5514_max98927.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_RT286_MACH) += snd-soc-skl_rt286.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH) += snd-skl_nau88l25_max98357a.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH) += snd-soc-skl_nau88l25_ssm4567.o
diff --git a/sound/soc/intel/boards/bdw-rt5677.c b/sound/soc/intel/boards/bdw-rt5677.c
index 14d9693c1641..058b8ccedf02 100644
--- a/sound/soc/intel/boards/bdw-rt5677.c
+++ b/sound/soc/intel/boards/bdw-rt5677.c
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/acpi.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/gpio/consumer.h>
@@ -120,6 +121,26 @@ static struct snd_soc_jack_gpio mic_jack_gpio = {
         .invert                 = 1,
 };
 
+/* GPIO indexes defined by ACPI */
+enum {
+        RT5677_GPIO_PLUG_DET            = 0,
+        RT5677_GPIO_MIC_PRESENT_L       = 1,
+        RT5677_GPIO_HOTWORD_DET_L       = 2,
+        RT5677_GPIO_DSP_INT             = 3,
+        RT5677_GPIO_HP_AMP_SHDN_L       = 4,
+};
+
+static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
+static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
+static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
+
+static const struct acpi_gpio_mapping bdw_rt5677_gpios[] = {
+        { "plug-det-gpios", &plug_det_gpio, 1 },
+        { "mic-present-gpios", &mic_present_gpio, 1 },
+        { "headphone-enable-gpios", &headphone_enable_gpio, 1 },
+        { NULL },
+};
+
 static int broadwell_ssp0_fixup(struct snd_soc_pcm_runtime *rtd,
                         struct snd_pcm_hw_params *params)
 {
@@ -184,6 +205,11 @@ static int bdw_rt5677_init(struct snd_soc_pcm_runtime *rtd)
                         snd_soc_card_get_drvdata(rtd->card);
         struct snd_soc_codec *codec = rtd->codec;
         struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+        int ret;
+
+        ret = devm_acpi_dev_add_driver_gpios(codec->dev, bdw_rt5677_gpios);
+        if (ret)
+                dev_warn(codec->dev, "Failed to add driver gpios\n");
 
         /* Enable codec ASRC function for Stereo DAC/Stereo1 ADC/DMIC/I2S1.
          * The ASRC clock source is clk_i2s1_asrc.
diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
index 3a8c4d954a91..ce35ec7884d1 100644
--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -89,11 +89,6 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
                 if (ret)
                         dev_err(card->dev, "failed to stop PLL: %d\n", ret);
         } else if(SND_SOC_DAPM_EVENT_ON(event)) {
-                ret = snd_soc_dai_set_sysclk(codec_dai,
-                        DA7219_CLKSRC_MCLK, 19200000, SND_SOC_CLOCK_IN);
-                if (ret)
-                        dev_err(card->dev, "can't set codec sysclk configuration\n");
-
                 ret = snd_soc_dai_set_pll(codec_dai, 0,
                         DA7219_SYSCLK_PLL_SRM, 0, DA7219_PLL_FREQ_OUT_98304);
                 if (ret)
@@ -187,8 +182,17 @@ static int broxton_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
 static int broxton_da7219_codec_init(struct snd_soc_pcm_runtime *rtd)
 {
         int ret;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
         struct snd_soc_codec *codec = rtd->codec;
 
+        /* Configure sysclk for codec */
+        ret = snd_soc_dai_set_sysclk(codec_dai, DA7219_CLKSRC_MCLK, 19200000,
+                                     SND_SOC_CLOCK_IN);
+        if (ret) {
+                dev_err(rtd->dev, "can't set codec sysclk configuration\n");
+                return ret;
+        }
+
         /*
          * Headset buttons map to the google Reference headset.
          * These can be configured by userspace.
@@ -238,31 +242,31 @@ static int broxton_da7219_fe_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static unsigned int rates[] = {
+static const unsigned int rates[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_rates = {
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
         .count = ARRAY_SIZE(rates),
         .list  = rates,
         .mask = 0,
 };
 
-static unsigned int channels[] = {
+static const unsigned int channels[] = {
         DUAL_CHANNEL,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
         .count = ARRAY_SIZE(channels),
         .list = channels,
         .mask = 0,
 };
 
-static unsigned int channels_quad[] = {
+static const unsigned int channels_quad[] = {
         QUAD_CHANNEL,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels_quad = {
+static const struct snd_pcm_hw_constraint_list constraints_channels_quad = {
         .count = ARRAY_SIZE(channels_quad),
         .list = channels_quad,
         .mask = 0,
diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
index 1a68d043c803..0c3a3cbcb884 100644
--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -207,11 +207,11 @@ static const struct snd_soc_ops broxton_rt298_ops = {
         .hw_params = broxton_rt298_hw_params,
 };
 
-static unsigned int rates[] = {
+static const unsigned int rates[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_rates = {
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
         .count = ARRAY_SIZE(rates),
         .list  = rates,
         .mask = 0,
@@ -222,19 +222,16 @@ static int broxton_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
 {
         struct snd_interval *channels = hw_param_interval(params,
                                                 SNDRV_PCM_HW_PARAM_CHANNELS);
-        if (params_channels(params) == 2)
-                channels->min = channels->max = 2;
-        else
-                channels->min = channels->max = 4;
+        channels->min = channels->max = 4;
 
         return 0;
 }
 
-static unsigned int channels_dmic[] = {
-        2, 4,
+static const unsigned int channels_dmic[] = {
+        1, 2, 3, 4,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
         .count = ARRAY_SIZE(channels_dmic),
         .list = channels_dmic,
         .mask = 0,
@@ -256,11 +253,11 @@ static const struct snd_soc_ops broxton_dmic_ops = {
         .startup = broxton_dmic_startup,
 };
 
-static unsigned int channels[] = {
+static const unsigned int channels[] = {
         2,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
         .count = ARRAY_SIZE(channels),
         .list = channels,
         .mask = 0,
diff --git a/sound/soc/intel/boards/byt-max98090.c b/sound/soc/intel/boards/byt-max98090.c
index d9f81b8d915d..047be7fa0ce9 100644
--- a/sound/soc/intel/boards/byt-max98090.c
+++ b/sound/soc/intel/boards/byt-max98090.c
@@ -67,20 +67,27 @@ static struct snd_soc_jack_pin hs_jack_pins[] = {
 
 static struct snd_soc_jack_gpio hs_jack_gpios[] = {
         {
-                .name           = "hp-gpio",
-                .idx            = 0,
+                .name           = "hp",
                 .report         = SND_JACK_HEADPHONE | SND_JACK_LINEOUT,
                 .debounce_time  = 200,
         },
         {
-                .name           = "mic-gpio",
-                .idx            = 1,
+                .name           = "mic",
                 .invert         = 1,
                 .report         = SND_JACK_MICROPHONE,
                 .debounce_time  = 200,
         },
 };
 
+static const struct acpi_gpio_params hp_gpios = { 0, 0, false };
+static const struct acpi_gpio_params mic_gpios = { 1, 0, false };
+
+static const struct acpi_gpio_mapping acpi_byt_max98090_gpios[] = {
+        { "hp-gpios", &hp_gpios, 1 },
+        { "mic-gpios", &mic_gpios, 1 },
+        {},
+};
+
 static int byt_max98090_init(struct snd_soc_pcm_runtime *runtime)
 {
         int ret;
@@ -140,8 +147,9 @@ static struct snd_soc_card byt_max98090_card = {
 
 static int byt_max98090_probe(struct platform_device *pdev)
 {
-        int ret_val = 0;
+        struct device *dev = &pdev->dev;
         struct byt_max98090_private *priv;
+        int ret_val;
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_ATOMIC);
         if (!priv) {
@@ -149,6 +157,10 @@ static int byt_max98090_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
+        ret_val = devm_acpi_dev_add_driver_gpios(dev->parent, acpi_byt_max98090_gpios);
+        if (ret_val)
+                dev_dbg(dev, "Unable to add GPIO mapping table\n");
+
         byt_max98090_card.dev = &pdev->dev;
         snd_soc_card_set_drvdata(&byt_max98090_card, priv);
         ret_val = devm_snd_soc_register_card(&pdev->dev, &byt_max98090_card);
@@ -158,7 +170,7 @@ static int byt_max98090_probe(struct platform_device *pdev)
                 return ret_val;
         }
 
-        return ret_val;
+        return 0;
 }
 
 static int byt_max98090_remove(struct platform_device *pdev)
diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
new file mode 100644
index 000000000000..52635462dac6
--- /dev/null
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -0,0 +1,300 @@
+/*
+ *  bytcht_es8316.c - ASoc Machine driver for Intel Baytrail/Cherrytrail
+ *                    platforms with Everest ES8316 SoC
+ *
+ *  Copyright (C) 2017 Endless Mobile, Inc.
+ *  Authors: David Yang <yangxiaohua@everest-semi.com>,
+ *           Daniel Drake <drake@endlessm.com>
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <asm/platform_sst_audio.h>
+#include <linux/clk.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../atom/sst-atom-controls.h"
+#include "../common/sst-acpi.h"
+#include "../common/sst-dsp.h"
+
+struct byt_cht_es8316_private {
+        struct clk *mclk;
+};
+
+#define CODEC_DAI1      "ES8316 HiFi"
+
+static inline struct snd_soc_dai *get_codec_dai(struct snd_soc_card *card)
+{
+        struct snd_soc_pcm_runtime *rtd;
+
+        list_for_each_entry(rtd, &card->rtd_list, list) {
+                if (!strncmp(rtd->codec_dai->name, CODEC_DAI1,
+                             strlen(CODEC_DAI1)))
+                        return rtd->codec_dai;
+        }
+        return NULL;
+}
+
+static const struct snd_soc_dapm_widget byt_cht_es8316_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone", NULL),
+
+        /*
+         * The codec supports two analog microphone inputs. I have only
+         * tested MIC1. A DMIC route could also potentially be added
+         * if such functionality is found on another platform.
+         */
+        SND_SOC_DAPM_MIC("Microphone 1", NULL),
+        SND_SOC_DAPM_MIC("Microphone 2", NULL),
+};
+
+static const struct snd_soc_dapm_route byt_cht_es8316_audio_map[] = {
+        {"MIC1", NULL, "Microphone 1"},
+        {"MIC2", NULL, "Microphone 2"},
+
+        {"Headphone", NULL, "HPOL"},
+        {"Headphone", NULL, "HPOR"},
+
+        {"Playback", NULL, "ssp2 Tx"},
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx" },
+        {"codec_in1", NULL, "ssp2 Rx" },
+        {"ssp2 Rx", NULL, "Capture"},
+};
+
+static const struct snd_kcontrol_new byt_cht_es8316_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone"),
+        SOC_DAPM_PIN_SWITCH("Microphone 1"),
+        SOC_DAPM_PIN_SWITCH("Microphone 2"),
+};
+
+static int byt_cht_es8316_init(struct snd_soc_pcm_runtime *runtime)
+{
+        struct snd_soc_card *card = runtime->card;
+        struct byt_cht_es8316_private *priv = snd_soc_card_get_drvdata(card);
+        int ret;
+
+        card->dapm.idle_bias_off = true;
+
+        /*
+         * The firmware might enable the clock at boot (this information
+         * may or may not be reflected in the enable clock register).
+         * To change the rate we must disable the clock first to cover these
+         * cases. Due to common clock framework restrictions that do not allow
+         * to disable a clock that has not been enabled, we need to enable
+         * the clock first.
+         */
+        ret = clk_prepare_enable(priv->mclk);
+        if (!ret)
+                clk_disable_unprepare(priv->mclk);
+
+        ret = clk_set_rate(priv->mclk, 19200000);
+        if (ret)
+                dev_err(card->dev, "unable to set MCLK rate\n");
+
+        ret = clk_prepare_enable(priv->mclk);
+        if (ret)
+                dev_err(card->dev, "unable to enable MCLK\n");
+
+        ret = snd_soc_dai_set_sysclk(runtime->codec_dai, 0, 19200000,
+                                     SND_SOC_CLOCK_IN);
+        if (ret < 0) {
+                dev_err(card->dev, "can't set codec clock %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_pcm_stream byt_cht_es8316_dai_params = {
+        .formats = SNDRV_PCM_FMTBIT_S24_LE,
+        .rate_min = 48000,
+        .rate_max = 48000,
+        .channels_min = 2,
+        .channels_max = 2,
+};
+
+static int byt_cht_es8316_codec_fixup(struct snd_soc_pcm_runtime *rtd,
+                            struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+        int ret;
+
+        /* The DSP will covert the FE rate to 48k, stereo */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP2 to 24-bit */
+        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+        /*
+         * Default mode for SSP configuration is TDM 4 slot, override config
+         * with explicit setting to I2S 2ch 24-bit. The word length is set with
+         * dai_set_tdm_slot() since there is no other API exposed
+         */
+        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                SND_SOC_DAIFMT_I2S     |
+                                SND_SOC_DAIFMT_NB_NF   |
+                                SND_SOC_DAIFMT_CBS_CFS
+                );
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int byt_cht_es8316_aif1_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_single(substream->runtime,
+                        SNDRV_PCM_HW_PARAM_RATE, 48000);
+}
+
+static const struct snd_soc_ops byt_cht_es8316_aif1_ops = {
+        .startup = byt_cht_es8316_aif1_startup,
+};
+
+static struct snd_soc_dai_link byt_cht_es8316_dais[] = {
+        [MERR_DPCM_AUDIO] = {
+                .name = "Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "media-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &byt_cht_es8316_aif1_ops,
+        },
+
+        [MERR_DPCM_DEEP_BUFFER] = {
+                .name = "Deep-Buffer Audio Port",
+                .stream_name = "Deep-Buffer Audio",
+                .cpu_dai_name = "deepbuffer-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .ops = &byt_cht_es8316_aif1_ops,
+        },
+
+        [MERR_DPCM_COMPR] = {
+                .name = "Compressed Port",
+                .stream_name = "Compress",
+                .cpu_dai_name = "compress-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+        },
+
+                /* back ends */
+        {
+                /* Only SSP2 has been tested here, so BYT-CR platforms that
+                 * require SSP0 will not work.
+                 */
+                .name = "SSP2-Codec",
+                .id = 1,
+                .cpu_dai_name = "ssp2-port",
+                .platform_name = "sst-mfld-platform",
+                .no_pcm = 1,
+                .codec_dai_name = "ES8316 HiFi",
+                .codec_name = "i2c-ESSX8316:00",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+                                                | SND_SOC_DAIFMT_CBS_CFS,
+                .be_hw_params_fixup = byt_cht_es8316_codec_fixup,
+                .nonatomic = true,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .init = byt_cht_es8316_init,
+        },
+};
+
+
+/* SoC card */
+static struct snd_soc_card byt_cht_es8316_card = {
+        .name = "bytcht-es8316",
+        .owner = THIS_MODULE,
+        .dai_link = byt_cht_es8316_dais,
+        .num_links = ARRAY_SIZE(byt_cht_es8316_dais),
+        .dapm_widgets = byt_cht_es8316_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(byt_cht_es8316_widgets),
+        .dapm_routes = byt_cht_es8316_audio_map,
+        .num_dapm_routes = ARRAY_SIZE(byt_cht_es8316_audio_map),
+        .controls = byt_cht_es8316_controls,
+        .num_controls = ARRAY_SIZE(byt_cht_es8316_controls),
+        .fully_routed = true,
+};
+
+static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+{
+        int ret = 0;
+        struct byt_cht_es8316_private *priv;
+
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_ATOMIC);
+        if (!priv)
+                return -ENOMEM;
+
+        /* register the soc card */
+        byt_cht_es8316_card.dev = &pdev->dev;
+        snd_soc_card_set_drvdata(&byt_cht_es8316_card, priv);
+
+        priv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+        if (IS_ERR(priv->mclk)) {
+                ret = PTR_ERR(priv->mclk);
+                dev_err(&pdev->dev,
+                        "Failed to get MCLK from pmc_plt_clk_3: %d\n",
+                        ret);
+                return ret;
+        }
+
+        ret = devm_snd_soc_register_card(&pdev->dev, &byt_cht_es8316_card);
+        if (ret) {
+                dev_err(&pdev->dev, "snd_soc_register_card failed %d\n", ret);
+                return ret;
+        }
+        platform_set_drvdata(pdev, &byt_cht_es8316_card);
+        return ret;
+}
+
+static struct platform_driver snd_byt_cht_es8316_mc_driver = {
+        .driver = {
+                .name = "bytcht_es8316",
+        },
+        .probe = snd_byt_cht_es8316_mc_probe,
+};
+
+module_platform_driver(snd_byt_cht_es8316_mc_driver);
+MODULE_DESCRIPTION("ASoC Intel(R) Baytrail/Cherrytrail Machine driver");
+MODULE_AUTHOR("David Yang <yangxiaohua@everest-semi.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bytcht_es8316");
diff --git a/sound/soc/intel/boards/bytcht_nocodec.c b/sound/soc/intel/boards/bytcht_nocodec.c
index 89853eeaaf9d..1dd9441806fa 100644
--- a/sound/soc/intel/boards/bytcht_nocodec.c
+++ b/sound/soc/intel/boards/bytcht_nocodec.c
@@ -85,11 +85,11 @@ static int codec_fixup(struct snd_soc_pcm_runtime *rtd,
         return 0;
 }
 
-static unsigned int rates_48000[] = {
+static const unsigned int rates_48000[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_48000 = {
+static const struct snd_pcm_hw_constraint_list constraints_48000 = {
         .count = ARRAY_SIZE(rates_48000),
         .list  = rates_48000,
 };
diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 8164bec63bf1..4a3516b38c2c 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -203,11 +203,11 @@ static int byt_rt5651_codec_fixup(struct snd_soc_pcm_runtime *rtd,
         return 0;
 }
 
-static unsigned int rates_48000[] = {
+static const unsigned int rates_48000[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_48000 = {
+static const struct snd_pcm_hw_constraint_list constraints_48000 = {
         .count = ARRAY_SIZE(rates_48000),
         .list  = rates_48000,
 };
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index 742bc0d4e681..20755ecc7f9e 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -39,18 +39,6 @@ struct cht_mc_private {
         bool ts3a227e_present;
 };
 
-static inline struct snd_soc_dai *cht_get_codec_dai(struct snd_soc_card *card)
-{
-        struct snd_soc_pcm_runtime *rtd;
-
-        list_for_each_entry(rtd, &card->rtd_list, list) {
-                if (!strncmp(rtd->codec_dai->name, CHT_CODEC_DAI,
-                             strlen(CHT_CODEC_DAI)))
-                        return rtd->codec_dai;
-        }
-        return NULL;
-}
-
 static const struct snd_soc_dapm_widget cht_dapm_widgets[] = {
         SND_SOC_DAPM_HP("Headphone", NULL),
         SND_SOC_DAPM_MIC("Headset Mic", NULL),
diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c
index e4d46d4360d7..bc2a52de06a3 100644
--- a/sound/soc/intel/boards/cht_bsw_rt5672.c
+++ b/sound/soc/intel/boards/cht_bsw_rt5672.c
@@ -19,6 +19,8 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/clk.h>
+#include <asm/cpu_device_id.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
@@ -31,8 +33,11 @@
 #define CHT_PLAT_CLK_3_HZ       19200000
 #define CHT_CODEC_DAI   "rt5670-aif1"
 
-static struct snd_soc_jack cht_bsw_headset;
-static char cht_bsw_codec_name[16];
+struct cht_mc_private {
+        struct snd_soc_jack headset;
+        char codec_name[16];
+        struct clk *mclk;
+};
 
 /* Headset jack detection DAPM pins */
 static struct snd_soc_jack_pin cht_bsw_headset_pins[] = {
@@ -64,6 +69,7 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
         struct snd_soc_dapm_context *dapm = w->dapm;
         struct snd_soc_card *card = dapm->card;
         struct snd_soc_dai *codec_dai;
+        struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
         int ret;
 
         codec_dai = cht_get_codec_dai(card);
@@ -73,6 +79,15 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
         }
 
         if (SND_SOC_DAPM_EVENT_ON(event)) {
+                if (ctx->mclk) {
+                        ret = clk_prepare_enable(ctx->mclk);
+                        if (ret < 0) {
+                                dev_err(card->dev,
+                                        "could not configure MCLK state");
+                                return ret;
+                        }
+                }
+
                 /* set codec PLL source to the 19.2MHz platform clock (MCLK) */
                 ret = snd_soc_dai_set_pll(codec_dai, 0, RT5670_PLL1_S_MCLK,
                                 CHT_PLAT_CLK_3_HZ, 48000 * 512);
@@ -96,6 +111,9 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
                  */
                 snd_soc_dai_set_sysclk(codec_dai, RT5670_SCLK_S_RCCLK,
                                        48000 * 512, SND_SOC_CLOCK_IN);
+
+                if (ctx->mclk)
+                        clk_disable_unprepare(ctx->mclk);
         }
         return 0;
 }
@@ -171,6 +189,7 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
         int ret;
         struct snd_soc_dai *codec_dai = runtime->codec_dai;
         struct snd_soc_codec *codec = codec_dai->codec;
+        struct cht_mc_private *ctx = snd_soc_card_get_drvdata(runtime->card);
 
         /* TDM 4 slots 24 bit, set Rx & Tx bitmask to 4 active slots */
         ret = snd_soc_dai_set_tdm_slot(codec_dai, 0xF, 0xF, 4, 24);
@@ -194,13 +213,37 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
                                 RT5670_CLK_SEL_I2S1_ASRC);
 
         ret = snd_soc_card_jack_new(runtime->card, "Headset",
-                SND_JACK_HEADSET | SND_JACK_BTN_0 |
-                SND_JACK_BTN_1 | SND_JACK_BTN_2, &cht_bsw_headset,
-                cht_bsw_headset_pins, ARRAY_SIZE(cht_bsw_headset_pins));
+                                    SND_JACK_HEADSET | SND_JACK_BTN_0 |
+                                    SND_JACK_BTN_1 | SND_JACK_BTN_2,
+                                    &ctx->headset,
+                                    cht_bsw_headset_pins,
+                                    ARRAY_SIZE(cht_bsw_headset_pins));
         if (ret)
                 return ret;
 
-        rt5670_set_jack_detect(codec, &cht_bsw_headset);
+        rt5670_set_jack_detect(codec, &ctx->headset);
+        if (ctx->mclk) {
+                /*
+                 * The firmware might enable the clock at
+                 * boot (this information may or may not
+                 * be reflected in the enable clock register).
+                 * To change the rate we must disable the clock
+                 * first to cover these cases. Due to common
+                 * clock framework restrictions that do not allow
+                 * to disable a clock that has not been enabled,
+                 * we need to enable the clock first.
+                 */
+                ret = clk_prepare_enable(ctx->mclk);
+                if (!ret)
+                        clk_disable_unprepare(ctx->mclk);
+
+                ret = clk_set_rate(ctx->mclk, CHT_PLAT_CLK_3_HZ);
+
+                if (ret) {
+                        dev_err(runtime->dev, "unable to set MCLK rate\n");
+                        return ret;
+                }
+        }
         return 0;
 }
 
@@ -341,34 +384,62 @@ static struct snd_soc_card snd_soc_card_cht = {
         .resume_post = cht_resume_post,
 };
 
+static bool is_valleyview(void)
+{
+        static const struct x86_cpu_id cpu_ids[] = {
+                { X86_VENDOR_INTEL, 6, 55 }, /* Valleyview, Bay Trail */
+                {}
+        };
+
+        if (!x86_match_cpu(cpu_ids))
+                return false;
+        return true;
+}
+
 #define RT5672_I2C_DEFAULT      "i2c-10EC5670:00"
 
 static int snd_cht_mc_probe(struct platform_device *pdev)
 {
         int ret_val = 0;
+        struct cht_mc_private *drv;
         struct sst_acpi_mach *mach = pdev->dev.platform_data;
         const char *i2c_name;
         int i;
 
-        strcpy(cht_bsw_codec_name, RT5672_I2C_DEFAULT);
+        drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_ATOMIC);
+        if (!drv)
+                return -ENOMEM;
+
+        strcpy(drv->codec_name, RT5672_I2C_DEFAULT);
 
         /* fixup codec name based on HID */
         if (mach) {
                 i2c_name = sst_acpi_find_name_from_hid(mach->id);
                 if (i2c_name) {
-                        snprintf(cht_bsw_codec_name, sizeof(cht_bsw_codec_name),
+                        snprintf(drv->codec_name, sizeof(drv->codec_name),
                                  "i2c-%s", i2c_name);
                         for (i = 0; i < ARRAY_SIZE(cht_dailink); i++) {
                                 if (!strcmp(cht_dailink[i].codec_name,
                                             RT5672_I2C_DEFAULT)) {
                                         cht_dailink[i].codec_name =
-                                                cht_bsw_codec_name;
+                                                drv->codec_name;
                                         break;
                                 }
                         }
                 }
         }
 
+        if (is_valleyview()) {
+                drv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+                if (IS_ERR(drv->mclk)) {
+                        dev_err(&pdev->dev,
+                                "Failed to get MCLK from pmc_plt_clk_3: %ld\n",
+                                PTR_ERR(drv->mclk));
+                        return PTR_ERR(drv->mclk);
+                }
+        }
+        snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
         /* register the soc card */
         snd_soc_card_cht.dev = &pdev->dev;
         ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
diff --git a/sound/soc/intel/boards/kbl_rt5663_max98927.c b/sound/soc/intel/boards/kbl_rt5663_max98927.c
new file mode 100644
index 000000000000..f9ba97788157
--- /dev/null
+++ b/sound/soc/intel/boards/kbl_rt5663_max98927.c
@@ -0,0 +1,687 @@
+/*
+ * Intel Kabylake I2S Machine Driver with MAXIM98927
+ * and RT5663 Codecs
+ *
+ * Copyright (C) 2017, Intel Corporation. All rights reserved.
+ *
+ * Modified from:
+ *   Intel Skylake I2S Machine driver
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <sound/core.h>
+#include <sound/jack.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../../codecs/rt5663.h"
+#include "../../codecs/hdac_hdmi.h"
+#include "../skylake/skl.h"
+
+#define KBL_REALTEK_CODEC_DAI "rt5663-aif"
+#define KBL_MAXIM_CODEC_DAI "max98927-aif1"
+#define DMIC_CH(p) p->list[p->count-1]
+#define MAXIM_DEV0_NAME "i2c-MX98927:00"
+#define MAXIM_DEV1_NAME "i2c-MX98927:01"
+
+static struct snd_soc_card kabylake_audio_card;
+static const struct snd_pcm_hw_constraint_list *dmic_constraints;
+static struct snd_soc_jack skylake_hdmi[3];
+
+struct kbl_hdmi_pcm {
+        struct list_head head;
+        struct snd_soc_dai *codec_dai;
+        int device;
+};
+
+struct kbl_rt5663_private {
+        struct snd_soc_jack kabylake_headset;
+        struct list_head hdmi_pcm_list;
+};
+
+enum {
+        KBL_DPCM_AUDIO_PB = 0,
+        KBL_DPCM_AUDIO_CP,
+        KBL_DPCM_AUDIO_REF_CP,
+        KBL_DPCM_AUDIO_DMIC_CP,
+        KBL_DPCM_AUDIO_HDMI1_PB,
+        KBL_DPCM_AUDIO_HDMI2_PB,
+        KBL_DPCM_AUDIO_HDMI3_PB,
+};
+
+static const struct snd_kcontrol_new kabylake_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Left Spk"),
+        SOC_DAPM_PIN_SWITCH("Right Spk"),
+};
+
+static const struct snd_soc_dapm_widget kabylake_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone Jack", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_SPK("Left Spk", NULL),
+        SND_SOC_DAPM_SPK("Right Spk", NULL),
+        SND_SOC_DAPM_MIC("SoC DMIC", NULL),
+        SND_SOC_DAPM_SPK("DP", NULL),
+        SND_SOC_DAPM_SPK("HDMI", NULL),
+
+};
+
+static const struct snd_soc_dapm_route kabylake_map[] = {
+        /* HP jack connectors - unknown if we have jack detection */
+        { "Headphone Jack", NULL, "HPOL" },
+        { "Headphone Jack", NULL, "HPOR" },
+
+        /* speaker */
+        { "Left Spk", NULL, "Left BE_OUT" },
+        { "Right Spk", NULL, "Right BE_OUT" },
+
+        /* other jacks */
+        { "IN1P", NULL, "Headset Mic" },
+        { "IN1N", NULL, "Headset Mic" },
+        { "DMic", NULL, "SoC DMIC" },
+
+        { "HDMI", NULL, "hif5 Output" },
+        { "DP", NULL, "hif6 Output" },
+
+        /* CODEC BE connections */
+        { "Left HiFi Playback", NULL, "ssp0 Tx" },
+        { "Right HiFi Playback", NULL, "ssp0 Tx" },
+        { "ssp0 Tx", NULL, "codec0_out" },
+
+        { "AIF Playback", NULL, "ssp1 Tx" },
+        { "ssp1 Tx", NULL, "codec1_out" },
+
+        { "codec0_in", NULL, "ssp1 Rx" },
+        { "ssp1 Rx", NULL, "AIF Capture" },
+
+        /* DMIC */
+        { "dmic01_hifi", NULL, "DMIC01 Rx" },
+        { "DMIC01 Rx", NULL, "DMIC AIF" },
+
+        { "hifi3", NULL, "iDisp3 Tx"},
+        { "iDisp3 Tx", NULL, "iDisp3_out"},
+        { "hifi2", NULL, "iDisp2 Tx"},
+        { "iDisp2 Tx", NULL, "iDisp2_out"},
+        { "hifi1", NULL, "iDisp1 Tx"},
+        { "iDisp1 Tx", NULL, "iDisp1_out"},
+};
+
+static struct snd_soc_codec_conf max98927_codec_conf[] = {
+        {
+                .dev_name = MAXIM_DEV0_NAME,
+                .name_prefix = "Right",
+        },
+        {
+                .dev_name = MAXIM_DEV1_NAME,
+                .name_prefix = "Left",
+        },
+};
+
+static struct snd_soc_dai_link_component max98927_codec_components[] = {
+        { /* Left */
+                .name = MAXIM_DEV0_NAME,
+                .dai_name = KBL_MAXIM_CODEC_DAI,
+        },
+        { /* Right */
+                .name = MAXIM_DEV1_NAME,
+                .dai_name = KBL_MAXIM_CODEC_DAI,
+        },
+};
+
+static int kabylake_rt5663_fe_init(struct snd_soc_pcm_runtime *rtd)
+{
+        int ret;
+        struct snd_soc_dapm_context *dapm;
+        struct snd_soc_component *component = rtd->cpu_dai->component;
+
+        dapm = snd_soc_component_get_dapm(component);
+        ret = snd_soc_dapm_ignore_suspend(dapm, "Reference Capture");
+        if (ret) {
+                dev_err(rtd->dev, "Ref Cap ignore suspend failed %d\n", ret);
+                return ret;
+        }
+
+        return ret;
+}
+
+static int kabylake_rt5663_codec_init(struct snd_soc_pcm_runtime *rtd)
+{
+        int ret;
+        struct kbl_rt5663_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_codec *codec = rtd->codec;
+
+        /*
+         * Headset buttons map to the google Reference headset.
+         * These can be configured by userspace.
+         */
+        ret = snd_soc_card_jack_new(&kabylake_audio_card, "Headset Jack",
+                        SND_JACK_HEADSET | SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+                        SND_JACK_BTN_2 | SND_JACK_BTN_3, &ctx->kabylake_headset,
+                        NULL, 0);
+        if (ret) {
+                dev_err(rtd->dev, "Headset Jack creation failed %d\n", ret);
+                return ret;
+        }
+
+        rt5663_set_jack_detect(codec, &ctx->kabylake_headset);
+        ret = snd_soc_dapm_ignore_suspend(&rtd->card->dapm, "SoC DMIC");
+        if (ret) {
+                dev_err(rtd->dev, "SoC DMIC ignore suspend failed %d\n", ret);
+                return ret;
+        }
+
+        return ret;
+}
+
+static int kabylake_hdmi1_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct kbl_rt5663_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai = rtd->codec_dai;
+        struct kbl_hdmi_pcm *pcm;
+
+        pcm = devm_kzalloc(rtd->card->dev, sizeof(*pcm), GFP_KERNEL);
+        if (!pcm)
+                return -ENOMEM;
+
+        pcm->device = KBL_DPCM_AUDIO_HDMI1_PB;
+        pcm->codec_dai = dai;
+
+        list_add_tail(&pcm->head, &ctx->hdmi_pcm_list);
+
+        return 0;
+}
+
+static int kabylake_hdmi2_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct kbl_rt5663_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai = rtd->codec_dai;
+        struct kbl_hdmi_pcm *pcm;
+
+        pcm = devm_kzalloc(rtd->card->dev, sizeof(*pcm), GFP_KERNEL);
+        if (!pcm)
+                return -ENOMEM;
+
+        pcm->device = KBL_DPCM_AUDIO_HDMI2_PB;
+        pcm->codec_dai = dai;
+
+        list_add_tail(&pcm->head, &ctx->hdmi_pcm_list);
+
+        return 0;
+}
+
+static int kabylake_hdmi3_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct kbl_rt5663_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai = rtd->codec_dai;
+        struct kbl_hdmi_pcm *pcm;
+
+        pcm = devm_kzalloc(rtd->card->dev, sizeof(*pcm), GFP_KERNEL);
+        if (!pcm)
+                return -ENOMEM;
+
+        pcm->device = KBL_DPCM_AUDIO_HDMI3_PB;
+        pcm->codec_dai = dai;
+
+        list_add_tail(&pcm->head, &ctx->hdmi_pcm_list);
+
+        return 0;
+}
+
+static unsigned int rates[] = {
+        48000,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_rates = {
+        .count = ARRAY_SIZE(rates),
+        .list  = rates,
+        .mask = 0,
+};
+
+static unsigned int channels[] = {
+        2,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_channels = {
+        .count = ARRAY_SIZE(channels),
+        .list = channels,
+        .mask = 0,
+};
+
+static int kbl_fe_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        /*
+         * On this platform for PCM device we support,
+         * 48Khz
+         * stereo
+         * 16 bit audio
+         */
+
+        runtime->hw.channels_max = 2;
+        snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                                           &constraints_channels);
+
+        runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+        snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
+
+        snd_pcm_hw_constraint_list(runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+
+        return 0;
+}
+
+static const struct snd_soc_ops kabylake_rt5663_fe_ops = {
+        .startup = kbl_fe_startup,
+};
+
+static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_CHANNELS);
+        struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+
+        /* The ADSP will convert the FE rate to 48k, stereo */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+        /* set SSP1 to 24 bit */
+        snd_mask_none(fmt);
+        snd_mask_set(fmt, SNDRV_PCM_FORMAT_S24_LE);
+
+        return 0;
+}
+
+static int kabylake_rt5663_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_sysclk(codec_dai,
+                        RT5663_SCLK_S_MCLK, 24576000, SND_SOC_CLOCK_IN);
+        /* use ASRC for internal clocks, as PLL rate isn't multiple of BCLK */
+        rt5663_sel_asrc_clk_src(codec_dai->codec, RT5663_DA_STEREO_FILTER, 1);
+
+        if (ret < 0)
+                dev_err(rtd->dev, "snd_soc_dai_set_sysclk err = %d\n", ret);
+
+        return ret;
+}
+
+static struct snd_soc_ops kabylake_rt5663_ops = {
+        .hw_params = kabylake_rt5663_hw_params,
+};
+
+static int kabylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
+                struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *channels = hw_param_interval(params,
+                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        if (params_channels(params) == 2 || DMIC_CH(dmic_constraints) == 2)
+                channels->min = channels->max = 2;
+        else
+                channels->min = channels->max = 4;
+
+        return 0;
+}
+
+static unsigned int channels_dmic[] = {
+        2, 4,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+        .count = ARRAY_SIZE(channels_dmic),
+        .list = channels_dmic,
+        .mask = 0,
+};
+
+static const unsigned int dmic_2ch[] = {
+        2,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
+        .count = ARRAY_SIZE(dmic_2ch),
+        .list = dmic_2ch,
+        .mask = 0,
+};
+
+static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        runtime->hw.channels_max = DMIC_CH(dmic_constraints);
+        snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                        dmic_constraints);
+
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+}
+
+static struct snd_soc_ops kabylake_dmic_ops = {
+        .startup = kabylake_dmic_startup,
+};
+
+static unsigned int rates_16000[] = {
+        16000,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_16000 = {
+        .count = ARRAY_SIZE(rates_16000),
+        .list  = rates_16000,
+};
+
+static const unsigned int ch_mono[] = {
+        1,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_refcap = {
+        .count = ARRAY_SIZE(ch_mono),
+        .list  = ch_mono,
+};
+
+static int kabylake_refcap_startup(struct snd_pcm_substream *substream)
+{
+        substream->runtime->hw.channels_max = 1;
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                        SNDRV_PCM_HW_PARAM_CHANNELS,
+                                        &constraints_refcap);
+
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE,
+                                &constraints_16000);
+}
+
+static struct snd_soc_ops skylaye_refcap_ops = {
+        .startup = kabylake_refcap_startup,
+};
+
+/* kabylake digital audio interface glue - connects codec <--> CPU */
+static struct snd_soc_dai_link kabylake_dais[] = {
+        /* Front End DAI links */
+        [KBL_DPCM_AUDIO_PB] = {
+                .name = "Kbl Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "System Pin",
+                .platform_name = "0000:00:1f.3",
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .nonatomic = 1,
+                .init = kabylake_rt5663_fe_init,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .dpcm_playback = 1,
+                .ops = &kabylake_rt5663_fe_ops,
+        },
+        [KBL_DPCM_AUDIO_CP] = {
+                .name = "Kbl Audio Capture Port",
+                .stream_name = "Audio Record",
+                .cpu_dai_name = "System Pin",
+                .platform_name = "0000:00:1f.3",
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .nonatomic = 1,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .dpcm_capture = 1,
+                .ops = &kabylake_rt5663_fe_ops,
+        },
+        [KBL_DPCM_AUDIO_REF_CP] = {
+                .name = "Kbl Audio Reference cap",
+                .stream_name = "Wake on Voice",
+                .cpu_dai_name = "Reference Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .init = NULL,
+                .dpcm_capture = 1,
+                .nonatomic = 1,
+                .dynamic = 1,
+                .ops = &skylaye_refcap_ops,
+        },
+        [KBL_DPCM_AUDIO_DMIC_CP] = {
+                .name = "Kbl Audio DMIC cap",
+                .stream_name = "dmiccap",
+                .cpu_dai_name = "DMIC Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .init = NULL,
+                .dpcm_capture = 1,
+                .nonatomic = 1,
+                .dynamic = 1,
+                .ops = &kabylake_dmic_ops,
+        },
+        [KBL_DPCM_AUDIO_HDMI1_PB] = {
+                .name = "Kbl HDMI Port1",
+                .stream_name = "Hdmi1",
+                .cpu_dai_name = "HDMI1 Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = NULL,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .nonatomic = 1,
+                .dynamic = 1,
+        },
+        [KBL_DPCM_AUDIO_HDMI2_PB] = {
+                .name = "Kbl HDMI Port2",
+                .stream_name = "Hdmi2",
+                .cpu_dai_name = "HDMI2 Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = NULL,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .nonatomic = 1,
+                .dynamic = 1,
+        },
+        [KBL_DPCM_AUDIO_HDMI3_PB] = {
+                .name = "Kbl HDMI Port3",
+                .stream_name = "Hdmi3",
+                .cpu_dai_name = "HDMI3 Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .dpcm_playback = 1,
+                .init = NULL,
+                .nonatomic = 1,
+                .dynamic = 1,
+        },
+
+        /* Back End DAI links */
+        {
+                /* SSP0 - Codec */
+                .name = "SSP0-Codec",
+                .id = 0,
+                .cpu_dai_name = "SSP0 Pin",
+                .platform_name = "0000:00:1f.3",
+                .no_pcm = 1,
+                .codecs = max98927_codec_components,
+                .num_codecs = ARRAY_SIZE(max98927_codec_components),
+                .dai_fmt = SND_SOC_DAIFMT_I2S |
+                        SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+                .ignore_pmdown_time = 1,
+                .be_hw_params_fixup = kabylake_ssp_fixup,
+                .dpcm_playback = 1,
+        },
+        {
+                /* SSP1 - Codec */
+                .name = "SSP1-Codec",
+                .id = 1,
+                .cpu_dai_name = "SSP1 Pin",
+                .platform_name = "0000:00:1f.3",
+                .no_pcm = 1,
+                .codec_name = "i2c-10EC5663:00",
+                .codec_dai_name = KBL_REALTEK_CODEC_DAI,
+                .init = kabylake_rt5663_codec_init,
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+                .ignore_pmdown_time = 1,
+                .be_hw_params_fixup = kabylake_ssp_fixup,
+                .ops = &kabylake_rt5663_ops,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+        {
+                .name = "dmic01",
+                .id = 2,
+                .cpu_dai_name = "DMIC01 Pin",
+                .codec_name = "dmic-codec",
+                .codec_dai_name = "dmic-hifi",
+                .platform_name = "0000:00:1f.3",
+                .be_hw_params_fixup = kabylake_dmic_fixup,
+                .ignore_suspend = 1,
+                .dpcm_capture = 1,
+                .no_pcm = 1,
+        },
+        {
+                .name = "iDisp1",
+                .id = 3,
+                .cpu_dai_name = "iDisp1 Pin",
+                .codec_name = "ehdaudio0D2",
+                .codec_dai_name = "intel-hdmi-hifi1",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = kabylake_hdmi1_init,
+                .no_pcm = 1,
+        },
+        {
+                .name = "iDisp2",
+                .id = 4,
+                .cpu_dai_name = "iDisp2 Pin",
+                .codec_name = "ehdaudio0D2",
+                .codec_dai_name = "intel-hdmi-hifi2",
+                .platform_name = "0000:00:1f.3",
+                .init = kabylake_hdmi2_init,
+                .dpcm_playback = 1,
+                .no_pcm = 1,
+        },
+        {
+                .name = "iDisp3",
+                .id = 5,
+                .cpu_dai_name = "iDisp3 Pin",
+                .codec_name = "ehdaudio0D2",
+                .codec_dai_name = "intel-hdmi-hifi3",
+                .platform_name = "0000:00:1f.3",
+                .init = kabylake_hdmi3_init,
+                .dpcm_playback = 1,
+                .no_pcm = 1,
+        },
+};
+
+#define NAME_SIZE       32
+static int kabylake_card_late_probe(struct snd_soc_card *card)
+{
+        struct kbl_rt5663_private *ctx = snd_soc_card_get_drvdata(card);
+        struct kbl_hdmi_pcm *pcm;
+        int err, i = 0;
+        char jack_name[NAME_SIZE];
+
+        list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+                snprintf(jack_name, sizeof(jack_name),
+                        "HDMI/DP, pcm=%d Jack", pcm->device);
+                err = snd_soc_card_jack_new(card, jack_name,
+                                        SND_JACK_AVOUT, &skylake_hdmi[i],
+                                        NULL, 0);
+
+                if (err)
+                        return err;
+
+                err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,
+                                                &skylake_hdmi[i]);
+                if (err < 0)
+                        return err;
+
+                i++;
+        }
+
+        return 0;
+}
+
+/* kabylake audio machine driver for SPT + RT5663 */
+static struct snd_soc_card kabylake_audio_card = {
+        .name = "kblrt5663max",
+        .owner = THIS_MODULE,
+        .dai_link = kabylake_dais,
+        .num_links = ARRAY_SIZE(kabylake_dais),
+        .controls = kabylake_controls,
+        .num_controls = ARRAY_SIZE(kabylake_controls),
+        .dapm_widgets = kabylake_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(kabylake_widgets),
+        .dapm_routes = kabylake_map,
+        .num_dapm_routes = ARRAY_SIZE(kabylake_map),
+        .codec_conf = max98927_codec_conf,
+        .num_configs = ARRAY_SIZE(max98927_codec_conf),
+        .fully_routed = true,
+        .late_probe = kabylake_card_late_probe,
+};
+
+static int kabylake_audio_probe(struct platform_device *pdev)
+{
+        struct kbl_rt5663_private *ctx;
+        struct skl_machine_pdata *pdata;
+
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_ATOMIC);
+        if (!ctx)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&ctx->hdmi_pcm_list);
+
+        kabylake_audio_card.dev = &pdev->dev;
+        snd_soc_card_set_drvdata(&kabylake_audio_card, ctx);
+
+        pdata = dev_get_drvdata(&pdev->dev);
+        if (pdata)
+                dmic_constraints = pdata->dmic_num == 2 ?
+                        &constraints_dmic_2ch : &constraints_dmic_channels;
+
+        return devm_snd_soc_register_card(&pdev->dev, &kabylake_audio_card);
+}
+
+static const struct platform_device_id kbl_board_ids[] = {
+        { .name = "kbl_rt5663_m98927" },
+        { }
+};
+
+static struct platform_driver kabylake_audio = {
+        .probe = kabylake_audio_probe,
+        .driver = {
+                .name = "kbl_rt5663_m98927",
+                .pm = &snd_soc_pm_ops,
+        },
+        .id_table = kbl_board_ids,
+};
+
+module_platform_driver(kabylake_audio)
+
+/* Module information */
+MODULE_DESCRIPTION("Audio Machine driver-RT5663 & MAX98927 in I2S mode");
+MODULE_AUTHOR("Naveen M <naveen.m@intel.com>");
+MODULE_AUTHOR("Harsha Priya <harshapriya.n@intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:kbl_rt5663_m98927");
diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
new file mode 100644
index 000000000000..3fe4a0807095
--- /dev/null
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -0,0 +1,640 @@
+/*
+ * Intel Kabylake I2S Machine Driver with MAXIM98927
+ * RT5514 and RT5663 Codecs
+ *
+ * Copyright (C) 2017, Intel Corporation. All rights reserved.
+ *
+ * Modified from:
+ *   Intel Kabylake I2S Machine driver supporting MAXIM98927 and
+ *   RT5663 codecs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <sound/core.h>
+#include <sound/jack.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../../codecs/rt5514.h"
+#include "../../codecs/rt5663.h"
+#include "../../codecs/hdac_hdmi.h"
+#include "../skylake/skl.h"
+
+#define KBL_REALTEK_CODEC_DAI "rt5663-aif"
+#define KBL_REALTEK_DMIC_CODEC_DAI "rt5514-aif1"
+#define KBL_MAXIM_CODEC_DAI "max98927-aif1"
+#define MAXIM_DEV0_NAME "i2c-MX98927:00"
+#define MAXIM_DEV1_NAME "i2c-MX98927:01"
+#define RT5514_DEV_NAME "i2c-10EC5514:00"
+#define RT5663_DEV_NAME "i2c-10EC5663:00"
+#define RT5514_AIF1_BCLK_FREQ (48000 * 8 * 16)
+#define RT5514_AIF1_SYSCLK_FREQ 12288000
+#define NAME_SIZE 32
+
+#define DMIC_CH(p) p->list[p->count-1]
+
+
+static struct snd_soc_card kabylake_audio_card;
+static const struct snd_pcm_hw_constraint_list *dmic_constraints;
+
+struct kbl_hdmi_pcm {
+        struct list_head head;
+        struct snd_soc_dai *codec_dai;
+        int device;
+};
+
+struct kbl_codec_private {
+        struct snd_soc_jack kabylake_headset;
+        struct list_head hdmi_pcm_list;
+        struct snd_soc_jack kabylake_hdmi[2];
+};
+
+enum {
+        KBL_DPCM_AUDIO_PB = 0,
+        KBL_DPCM_AUDIO_CP,
+        KBL_DPCM_AUDIO_DMIC_CP,
+        KBL_DPCM_AUDIO_HDMI1_PB,
+        KBL_DPCM_AUDIO_HDMI2_PB,
+};
+
+static const struct snd_kcontrol_new kabylake_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Left Spk"),
+        SOC_DAPM_PIN_SWITCH("Right Spk"),
+        SOC_DAPM_PIN_SWITCH("DMIC"),
+};
+
+static const struct snd_soc_dapm_widget kabylake_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone Jack", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_SPK("Left Spk", NULL),
+        SND_SOC_DAPM_SPK("Right Spk", NULL),
+        SND_SOC_DAPM_MIC("DMIC", NULL),
+        SND_SOC_DAPM_SPK("DP", NULL),
+        SND_SOC_DAPM_SPK("HDMI", NULL),
+
+};
+
+static const struct snd_soc_dapm_route kabylake_map[] = {
+        /* Headphones */
+        { "Headphone Jack", NULL, "HPOL" },
+        { "Headphone Jack", NULL, "HPOR" },
+
+        /* speaker */
+        { "Left Spk", NULL, "Left BE_OUT" },
+        { "Right Spk", NULL, "Right BE_OUT" },
+
+        /* other jacks */
+        { "IN1P", NULL, "Headset Mic" },
+        { "IN1N", NULL, "Headset Mic" },
+
+        { "HDMI", NULL, "hif5 Output" },
+        { "DP", NULL, "hif6 Output" },
+
+        /* CODEC BE connections */
+        { "Left HiFi Playback", NULL, "ssp0 Tx" },
+        { "Right HiFi Playback", NULL, "ssp0 Tx" },
+        { "ssp0 Tx", NULL, "codec0_out" },
+
+        { "AIF Playback", NULL, "ssp1 Tx" },
+        { "ssp1 Tx", NULL, "codec1_out" },
+
+        { "codec0_in", NULL, "ssp1 Rx" },
+        { "ssp1 Rx", NULL, "AIF Capture" },
+
+        { "codec1_in", NULL, "ssp0 Rx" },
+        { "ssp0 Rx", NULL, "AIF1 Capture" },
+
+        /* DMIC */
+        { "DMIC1L", NULL, "DMIC" },
+        { "DMIC1R", NULL, "DMIC" },
+        { "DMIC2L", NULL, "DMIC" },
+        { "DMIC2R", NULL, "DMIC" },
+
+        { "hifi2", NULL, "iDisp2 Tx" },
+        { "iDisp2 Tx", NULL, "iDisp2_out" },
+        { "hifi1", NULL, "iDisp1 Tx" },
+        { "iDisp1 Tx", NULL, "iDisp1_out" },
+};
+
+static struct snd_soc_codec_conf max98927_codec_conf[] = {
+        {
+                .dev_name = MAXIM_DEV0_NAME,
+                .name_prefix = "Right",
+        },
+        {
+                .dev_name = MAXIM_DEV1_NAME,
+                .name_prefix = "Left",
+        },
+};
+
+static struct snd_soc_dai_link_component ssp0_codec_components[] = {
+        { /* Left */
+                .name = MAXIM_DEV0_NAME,
+                .dai_name = KBL_MAXIM_CODEC_DAI,
+        },
+        { /* Right */
+                .name = MAXIM_DEV1_NAME,
+                .dai_name = KBL_MAXIM_CODEC_DAI,
+        },
+        { /*dmic */
+                .name = RT5514_DEV_NAME,
+                .dai_name = KBL_REALTEK_DMIC_CODEC_DAI,
+        },
+};
+
+static int kabylake_rt5663_fe_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct snd_soc_dapm_context *dapm;
+        struct snd_soc_component *component = rtd->cpu_dai->component;
+        int ret;
+
+        dapm = snd_soc_component_get_dapm(component);
+        ret = snd_soc_dapm_ignore_suspend(dapm, "Reference Capture");
+        if (ret)
+                dev_err(rtd->dev, "Ref Cap -Ignore suspend failed = %d\n", ret);
+
+        return ret;
+}
+
+static int kabylake_rt5663_codec_init(struct snd_soc_pcm_runtime *rtd)
+{
+        int ret;
+        struct kbl_codec_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_codec *codec = rtd->codec;
+
+        /*
+         * Headset buttons map to the google Reference headset.
+         * These can be configured by userspace.
+         */
+        ret = snd_soc_card_jack_new(&kabylake_audio_card, "Headset Jack",
+                        SND_JACK_HEADSET | SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+                        SND_JACK_BTN_2 | SND_JACK_BTN_3, &ctx->kabylake_headset,
+                        NULL, 0);
+        if (ret) {
+                dev_err(rtd->dev, "Headset Jack creation failed %d\n", ret);
+                return ret;
+        }
+
+        rt5663_set_jack_detect(codec, &ctx->kabylake_headset);
+
+        ret = snd_soc_dapm_ignore_suspend(&rtd->card->dapm, "DMIC");
+        if (ret)
+                dev_err(rtd->dev, "DMIC - Ignore suspend failed = %d\n", ret);
+
+        return ret;
+}
+
+static int kabylake_hdmi_init(struct snd_soc_pcm_runtime *rtd, int device)
+{
+        struct kbl_codec_private *ctx = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai = rtd->codec_dai;
+        struct kbl_hdmi_pcm *pcm;
+
+        pcm = devm_kzalloc(rtd->card->dev, sizeof(*pcm), GFP_KERNEL);
+        if (!pcm)
+                return -ENOMEM;
+
+        pcm->device = device;
+        pcm->codec_dai = dai;
+
+        list_add_tail(&pcm->head, &ctx->hdmi_pcm_list);
+
+        return 0;
+}
+
+static int kabylake_hdmi1_init(struct snd_soc_pcm_runtime *rtd)
+{
+        return kabylake_hdmi_init(rtd, KBL_DPCM_AUDIO_HDMI1_PB);
+}
+
+static int kabylake_hdmi2_init(struct snd_soc_pcm_runtime *rtd)
+{
+        return kabylake_hdmi_init(rtd, KBL_DPCM_AUDIO_HDMI2_PB);
+}
+
+static const unsigned int rates[] = {
+        48000,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
+        .count = ARRAY_SIZE(rates),
+        .list  = rates,
+        .mask = 0,
+};
+
+static const unsigned int channels[] = {
+        2,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
+        .count = ARRAY_SIZE(channels),
+        .list = channels,
+        .mask = 0,
+};
+
+static int kbl_fe_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        /*
+         * On this platform for PCM device we support,
+         * 48Khz
+         * stereo
+         * 16 bit audio
+         */
+
+        runtime->hw.channels_max = 2;
+        snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                                           &constraints_channels);
+
+        runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+        snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
+
+        snd_pcm_hw_constraint_list(runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+
+        return 0;
+}
+
+static const struct snd_soc_ops kabylake_rt5663_fe_ops = {
+        .startup = kbl_fe_startup,
+};
+
+static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
+                                        struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_CHANNELS);
+        struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+        struct snd_soc_dpcm *dpcm = container_of(
+                        params, struct snd_soc_dpcm, hw_params);
+        struct snd_soc_dai_link *fe_dai_link = dpcm->fe->dai_link;
+        struct snd_soc_dai_link *be_dai_link = dpcm->be->dai_link;
+
+        /*
+         * The ADSP will convert the FE rate to 48k, stereo, 24 bit
+         */
+        if (!strcmp(fe_dai_link->name, "Kbl Audio Port") ||
+            !strcmp(fe_dai_link->name, "Kbl Audio Capture Port")) {
+                rate->min = rate->max = 48000;
+                channels->min = channels->max = 2;
+                snd_mask_none(fmt);
+                snd_mask_set(fmt, SNDRV_PCM_FORMAT_S24_LE);
+        } else if (!strcmp(fe_dai_link->name, "Kbl Audio DMIC cap")) {
+                if (params_channels(params) == 2 ||
+                                DMIC_CH(dmic_constraints) == 2)
+                        channels->min = channels->max = 2;
+                else
+                        channels->min = channels->max = 4;
+        }
+        /*
+         * The speaker on the SSP0 supports S16_LE and not S24_LE.
+         * thus changing the mask here
+         */
+        if (!strcmp(be_dai_link->name, "SSP0-Codec"))
+                snd_mask_set(fmt, SNDRV_PCM_FORMAT_S16_LE);
+
+        return 0;
+}
+
+static int kabylake_rt5663_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        /* use ASRC for internal clocks, as PLL rate isn't multiple of BCLK */
+        rt5663_sel_asrc_clk_src(codec_dai->codec, RT5663_DA_STEREO_FILTER, 1);
+
+        ret = snd_soc_dai_set_sysclk(codec_dai,
+                        RT5663_SCLK_S_MCLK, 24576000, SND_SOC_CLOCK_IN);
+        if (ret < 0)
+                dev_err(rtd->dev, "snd_soc_dai_set_sysclk err = %d\n", ret);
+
+        return ret;
+}
+
+static struct snd_soc_ops kabylake_rt5663_ops = {
+        .hw_params = kabylake_rt5663_hw_params,
+};
+
+static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        int ret = 0, j;
+
+        for (j = 0; j < rtd->num_codecs; j++) {
+                struct snd_soc_dai *codec_dai = rtd->codec_dais[j];
+
+                if (!strcmp(codec_dai->component->name, RT5514_DEV_NAME)) {
+                        ret = snd_soc_dai_set_tdm_slot(codec_dai, 0xF, 0, 8, 16);
+                        if (ret < 0) {
+                                dev_err(rtd->dev, "set TDM slot err:%d\n", ret);
+                                return ret;
+                        }
+
+                        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                RT5514_PLL1_S_BCLK, RT5514_AIF1_BCLK_FREQ,
+                                                RT5514_AIF1_SYSCLK_FREQ);
+                        if (ret < 0) {
+                                dev_err(rtd->dev, "set bclk err: %d\n", ret);
+                                return ret;
+                        }
+
+                        ret = snd_soc_dai_set_sysclk(codec_dai,
+                                RT5514_SCLK_S_PLL1, RT5514_AIF1_SYSCLK_FREQ,
+                                                        SND_SOC_CLOCK_IN);
+                        if (ret < 0) {
+                                dev_err(rtd->dev, "set sclk err: %d\n", ret);
+                                return ret;
+                        }
+                }
+                if (!strcmp(codec_dai->component->name, MAXIM_DEV0_NAME) ||
+                        !strcmp(codec_dai->component->name, MAXIM_DEV1_NAME)) {
+                        ret = snd_soc_dai_set_tdm_slot(codec_dai, 0xF0, 3, 8, 16);
+                        if (ret < 0) {
+                                dev_err(rtd->dev, "set TDM slot err:%d\n", ret);
+                                return ret;
+                        }
+                }
+        }
+        return ret;
+}
+
+static struct snd_soc_ops kabylake_ssp0_ops = {
+        .hw_params = kabylake_ssp0_hw_params,
+};
+
+static const unsigned int channels_dmic[] = {
+        4,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+        .count = ARRAY_SIZE(channels_dmic),
+        .list = channels_dmic,
+        .mask = 0,
+};
+
+static const unsigned int dmic_2ch[] = {
+        4,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
+        .count = ARRAY_SIZE(dmic_2ch),
+        .list = dmic_2ch,
+        .mask = 0,
+};
+
+static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        runtime->hw.channels_max = DMIC_CH(dmic_constraints);
+        snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                        dmic_constraints);
+
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+}
+
+static struct snd_soc_ops kabylake_dmic_ops = {
+        .startup = kabylake_dmic_startup,
+};
+
+/* kabylake digital audio interface glue - connects codec <--> CPU */
+static struct snd_soc_dai_link kabylake_dais[] = {
+        /* Front End DAI links */
+        [KBL_DPCM_AUDIO_PB] = {
+                .name = "Kbl Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "System Pin",
+                .platform_name = "0000:00:1f.3",
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .nonatomic = 1,
+                .init = kabylake_rt5663_fe_init,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .dpcm_playback = 1,
+                .ops = &kabylake_rt5663_fe_ops,
+        },
+        [KBL_DPCM_AUDIO_CP] = {
+                .name = "Kbl Audio Capture Port",
+                .stream_name = "Audio Record",
+                .cpu_dai_name = "System Pin",
+                .platform_name = "0000:00:1f.3",
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .nonatomic = 1,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .dpcm_capture = 1,
+                .ops = &kabylake_rt5663_fe_ops,
+        },
+        [KBL_DPCM_AUDIO_DMIC_CP] = {
+                .name = "Kbl Audio DMIC cap",
+                .stream_name = "dmiccap",
+                .cpu_dai_name = "DMIC Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .init = NULL,
+                .dpcm_capture = 1,
+                .nonatomic = 1,
+                .dynamic = 1,
+                .ops = &kabylake_dmic_ops,
+        },
+        [KBL_DPCM_AUDIO_HDMI1_PB] = {
+                .name = "Kbl HDMI Port1",
+                .stream_name = "Hdmi1",
+                .cpu_dai_name = "HDMI1 Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = NULL,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .nonatomic = 1,
+                .dynamic = 1,
+        },
+        [KBL_DPCM_AUDIO_HDMI2_PB] = {
+                .name = "Kbl HDMI Port2",
+                .stream_name = "Hdmi2",
+                .cpu_dai_name = "HDMI2 Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = NULL,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+                .nonatomic = 1,
+                .dynamic = 1,
+        },
+        /* Back End DAI links */
+        /* single Back end dai for both max speakers and dmic */
+        {
+                /* SSP0 - Codec */
+                .name = "SSP0-Codec",
+                .id = 0,
+                .cpu_dai_name = "SSP0 Pin",
+                .platform_name = "0000:00:1f.3",
+                .no_pcm = 1,
+                .codecs = ssp0_codec_components,
+                .num_codecs = ARRAY_SIZE(ssp0_codec_components),
+                .dai_fmt = SND_SOC_DAIFMT_DSP_B |
+                        SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+                .ignore_pmdown_time = 1,
+                .be_hw_params_fixup = kabylake_ssp_fixup,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &kabylake_ssp0_ops,
+        },
+        {
+                .name = "SSP1-Codec",
+                .id = 1,
+                .cpu_dai_name = "SSP1 Pin",
+                .platform_name = "0000:00:1f.3",
+                .no_pcm = 1,
+                .codec_name = RT5663_DEV_NAME,
+                .codec_dai_name = KBL_REALTEK_CODEC_DAI,
+                .init = kabylake_rt5663_codec_init,
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+                .ignore_pmdown_time = 1,
+                .be_hw_params_fixup = kabylake_ssp_fixup,
+                .ops = &kabylake_rt5663_ops,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+        {
+                .name = "iDisp1",
+                .id = 3,
+                .cpu_dai_name = "iDisp1 Pin",
+                .codec_name = "ehdaudio0D2",
+                .codec_dai_name = "intel-hdmi-hifi1",
+                .platform_name = "0000:00:1f.3",
+                .dpcm_playback = 1,
+                .init = kabylake_hdmi1_init,
+                .no_pcm = 1,
+        },
+        {
+                .name = "iDisp2",
+                .id = 4,
+                .cpu_dai_name = "iDisp2 Pin",
+                .codec_name = "ehdaudio0D2",
+                .codec_dai_name = "intel-hdmi-hifi2",
+                .platform_name = "0000:00:1f.3",
+                .init = kabylake_hdmi2_init,
+                .dpcm_playback = 1,
+                .no_pcm = 1,
+        },
+};
+
+static int kabylake_card_late_probe(struct snd_soc_card *card)
+{
+        struct kbl_codec_private *ctx = snd_soc_card_get_drvdata(card);
+        struct kbl_hdmi_pcm *pcm;
+        int err, i = 0;
+        char jack_name[NAME_SIZE];
+
+        list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+                err = snd_soc_card_jack_new(card, jack_name,
+                                SND_JACK_AVOUT, &ctx->kabylake_hdmi[i],
+                                NULL, 0);
+
+                if (err)
+                        return err;
+                err = hdac_hdmi_jack_init(pcm->codec_dai, pcm->device,
+                                                &ctx->kabylake_hdmi[i]);
+                if (err < 0)
+                        return err;
+                i++;
+        }
+
+        return 0;
+}
+
+/*
+ * kabylake audio machine driver for  MAX98927 + RT5514 + RT5663
+ */
+static struct snd_soc_card kabylake_audio_card = {
+        .name = "kbl_r5514_5663_max",
+        .owner = THIS_MODULE,
+        .dai_link = kabylake_dais,
+        .num_links = ARRAY_SIZE(kabylake_dais),
+        .controls = kabylake_controls,
+        .num_controls = ARRAY_SIZE(kabylake_controls),
+        .dapm_widgets = kabylake_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(kabylake_widgets),
+        .dapm_routes = kabylake_map,
+        .num_dapm_routes = ARRAY_SIZE(kabylake_map),
+        .codec_conf = max98927_codec_conf,
+        .num_configs = ARRAY_SIZE(max98927_codec_conf),
+        .fully_routed = true,
+        .late_probe = kabylake_card_late_probe,
+};
+
+static int kabylake_audio_probe(struct platform_device *pdev)
+{
+        struct kbl_codec_private *ctx;
+        struct skl_machine_pdata *pdata;
+
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_ATOMIC);
+        if (!ctx)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&ctx->hdmi_pcm_list);
+
+        kabylake_audio_card.dev = &pdev->dev;
+        snd_soc_card_set_drvdata(&kabylake_audio_card, ctx);
+
+        pdata = dev_get_drvdata(&pdev->dev);
+        if (pdata)
+                dmic_constraints = pdata->dmic_num == 2 ?
+                        &constraints_dmic_2ch : &constraints_dmic_channels;
+
+        return devm_snd_soc_register_card(&pdev->dev, &kabylake_audio_card);
+}
+
+static const struct platform_device_id kbl_board_ids[] = {
+        { .name = "kbl_r5514_5663_max" },
+        { }
+};
+
+static struct platform_driver kabylake_audio = {
+        .probe = kabylake_audio_probe,
+        .driver = {
+                .name = "kbl_r5514_5663_max",
+                .pm = &snd_soc_pm_ops,
+        },
+        .id_table = kbl_board_ids,
+};
+
+module_platform_driver(kabylake_audio)
+
+/* Module information */
+MODULE_DESCRIPTION("Audio Machine driver-RT5663 RT5514 & MAX98927");
+MODULE_AUTHOR("Harsha Priya <harshapriya.n@intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:kbl_r5514_5663_max");
diff --git a/sound/soc/intel/boards/skl_nau88l25_max98357a.c b/sound/soc/intel/boards/skl_nau88l25_max98357a.c
index 3b12bc1fa518..5ed0aa27b467 100644
--- a/sound/soc/intel/boards/skl_nau88l25_max98357a.c
+++ b/sound/soc/intel/boards/skl_nau88l25_max98357a.c
@@ -266,21 +266,21 @@ static int skylake_nau8825_fe_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static unsigned int rates[] = {
+static const unsigned int rates[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_rates = {
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
         .count = ARRAY_SIZE(rates),
         .list  = rates,
         .mask = 0,
 };
 
-static unsigned int channels[] = {
+static const unsigned int channels[] = {
         2,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
         .count = ARRAY_SIZE(channels),
         .list = channels,
         .mask = 0,
@@ -348,11 +348,11 @@ static int skylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
         return 0;
 }
 
-static unsigned int channels_dmic[] = {
+static const unsigned int channels_dmic[] = {
         2, 4,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
         .count = ARRAY_SIZE(channels_dmic),
         .list = channels_dmic,
         .mask = 0,
@@ -384,11 +384,11 @@ static const struct snd_soc_ops skylake_dmic_ops = {
         .startup = skylake_dmic_startup,
 };
 
-static unsigned int rates_16000[] = {
+static const unsigned int rates_16000[] = {
         16000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_16000 = {
+static const struct snd_pcm_hw_constraint_list constraints_16000 = {
         .count = ARRAY_SIZE(rates_16000),
         .list  = rates_16000,
 };
diff --git a/sound/soc/intel/boards/skl_nau88l25_ssm4567.c b/sound/soc/intel/boards/skl_nau88l25_ssm4567.c
index eb7751b0599b..01b8b140bb08 100644
--- a/sound/soc/intel/boards/skl_nau88l25_ssm4567.c
+++ b/sound/soc/intel/boards/skl_nau88l25_ssm4567.c
@@ -297,21 +297,21 @@ static int skylake_nau8825_fe_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static unsigned int rates[] = {
+static const unsigned int rates[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_rates = {
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
         .count = ARRAY_SIZE(rates),
         .list  = rates,
         .mask = 0,
 };
 
-static unsigned int channels[] = {
+static const unsigned int channels[] = {
         2,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
         .count = ARRAY_SIZE(channels),
         .list = channels,
         .mask = 0,
@@ -397,11 +397,11 @@ static const struct snd_soc_ops skylake_nau8825_ops = {
         .hw_params = skylake_nau8825_hw_params,
 };
 
-static unsigned int channels_dmic[] = {
+static const unsigned int channels_dmic[] = {
         2, 4,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
         .count = ARRAY_SIZE(channels_dmic),
         .list = channels_dmic,
         .mask = 0,
@@ -433,11 +433,11 @@ static const struct snd_soc_ops skylake_dmic_ops = {
         .startup = skylake_dmic_startup,
 };
 
-static unsigned int rates_16000[] = {
+static const unsigned int rates_16000[] = {
         16000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_16000 = {
+static const struct snd_pcm_hw_constraint_list constraints_16000 = {
         .count = ARRAY_SIZE(rates_16000),
         .list  = rates_16000,
 };
diff --git a/sound/soc/intel/boards/skl_rt286.c b/sound/soc/intel/boards/skl_rt286.c
index f5ab7b8d51d1..2bc4cfca594e 100644
--- a/sound/soc/intel/boards/skl_rt286.c
+++ b/sound/soc/intel/boards/skl_rt286.c
@@ -43,6 +43,7 @@ struct skl_rt286_private {
 
 enum {
         SKL_DPCM_AUDIO_PB = 0,
+        SKL_DPCM_AUDIO_DB_PB,
         SKL_DPCM_AUDIO_CP,
         SKL_DPCM_AUDIO_REF_CP,
         SKL_DPCM_AUDIO_DMIC_CP,
@@ -165,21 +166,21 @@ static int skylake_hdmi_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static unsigned int rates[] = {
+static const unsigned int rates[] = {
         48000,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_rates = {
+static const struct snd_pcm_hw_constraint_list constraints_rates = {
         .count = ARRAY_SIZE(rates),
         .list  = rates,
         .mask = 0,
 };
 
-static unsigned int channels[] = {
+static const unsigned int channels[] = {
         2,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_channels = {
         .count = ARRAY_SIZE(channels),
         .list = channels,
         .mask = 0,
@@ -264,11 +265,11 @@ static int skylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
         return 0;
 }
 
-static unsigned int channels_dmic[] = {
+static const unsigned int channels_dmic[] = {
         2, 4,
 };
 
-static struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
         .count = ARRAY_SIZE(channels_dmic),
         .list = channels_dmic,
         .mask = 0,
@@ -310,6 +311,23 @@ static struct snd_soc_dai_link skylake_rt286_dais[] = {
                 .dpcm_playback = 1,
                 .ops = &skylake_rt286_fe_ops,
         },
+        [SKL_DPCM_AUDIO_DB_PB] = {
+                .name = "Skl Deepbuffer Port",
+                .stream_name = "Deep Buffer Audio",
+                .cpu_dai_name = "Deepbuffer Pin",
+                .platform_name = "0000:00:1f.3",
+                .nonatomic = 1,
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST,
+                        SND_SOC_DPCM_TRIGGER_POST
+                },
+                .dpcm_playback = 1,
+                .ops = &skylake_rt286_fe_ops,
+
+        },
         [SKL_DPCM_AUDIO_CP] = {
                 .name = "Skl Audio Capture Port",
                 .stream_name = "Audio Record",
diff --git a/sound/soc/intel/common/sst-acpi.h b/sound/soc/intel/common/sst-acpi.h
index 214e000667ae..afe9b87b8bd5 100644
--- a/sound/soc/intel/common/sst-acpi.h
+++ b/sound/soc/intel/common/sst-acpi.h
@@ -43,6 +43,9 @@ static inline bool sst_acpi_find_package_from_hid(const u8 hid[ACPI_ID_LEN],
 /* acpi match */
 struct sst_acpi_mach *sst_acpi_find_machine(struct sst_acpi_mach *machines);
 
+/* acpi check hid */
+bool sst_acpi_check_hid(const u8 hid[ACPI_ID_LEN]);
+
 /* Descriptor for SST ASoC machine driver */
 struct sst_acpi_mach {
         /* ACPI ID for the matching machine driver. Audio codec for instance */
@@ -55,5 +58,25 @@ struct sst_acpi_mach {
         /* board name */
         const char *board;
         struct sst_acpi_mach * (*machine_quirk)(void *arg);
+        const void *quirk_data;
         void *pdata;
 };
+
+#define SST_ACPI_MAX_CODECS 3
+
+/**
+ * struct sst_codecs: Structure to hold secondary codec information apart from
+ * the matched one, this data will be passed to the quirk function to match
+ * with the ACPI detected devices
+ *
+ * @num_codecs: number of secondary codecs used in the platform
+ * @codecs: holds the codec IDs
+ *
+ */
+struct sst_codecs {
+        int num_codecs;
+        u8 codecs[SST_ACPI_MAX_CODECS][ACPI_ID_LEN];
+};
+
+/* check all codecs */
+struct sst_acpi_mach *sst_acpi_codec_list(void *arg);
diff --git a/sound/soc/intel/common/sst-dsp-priv.h b/sound/soc/intel/common/sst-dsp-priv.h
index d13c84364c3c..8734040d64d3 100644
--- a/sound/soc/intel/common/sst-dsp-priv.h
+++ b/sound/soc/intel/common/sst-dsp-priv.h
@@ -77,6 +77,10 @@ struct sst_addr {
         u32 dram_offset;
         u32 dsp_iram_offset;
         u32 dsp_dram_offset;
+        u32 sram0_base;
+        u32 sram1_base;
+        u32 w0_stat_sz;
+        u32 w0_up_sz;
         void __iomem *lpe;
         void __iomem *shim;
         void __iomem *pci_cfg;
diff --git a/sound/soc/intel/common/sst-match-acpi.c b/sound/soc/intel/common/sst-match-acpi.c
index 1070f3ad23e5..56d26f36a3cb 100644
--- a/sound/soc/intel/common/sst-match-acpi.c
+++ b/sound/soc/intel/common/sst-match-acpi.c
@@ -63,16 +63,33 @@ static acpi_status sst_acpi_mach_match(acpi_handle handle, u32 level,
         return AE_OK;
 }
 
+bool sst_acpi_check_hid(const u8 hid[ACPI_ID_LEN])
+{
+        acpi_status status;
+        bool found = false;
+
+        status = acpi_get_devices(hid, sst_acpi_mach_match, &found, NULL);
+
+        if (ACPI_FAILURE(status))
+                return false;
+
+        return found;
+}
+EXPORT_SYMBOL_GPL(sst_acpi_check_hid);
+
 struct sst_acpi_mach *sst_acpi_find_machine(struct sst_acpi_mach *machines)
 {
         struct sst_acpi_mach *mach;
-        bool found = false;
 
-        for (mach = machines; mach->id[0]; mach++)
-                if (ACPI_SUCCESS(acpi_get_devices(mach->id,
-                                                  sst_acpi_mach_match,
-                                                  &found, NULL)) && found)
-                        return mach;
+        for (mach = machines; mach->id[0]; mach++) {
+                if (sst_acpi_check_hid(mach->id) == true) {
+                        if (mach->machine_quirk == NULL)
+                                return mach;
+
+                        if (mach->machine_quirk(mach) != NULL)
+                                return mach;
+                }
+        }
         return NULL;
 }
 EXPORT_SYMBOL_GPL(sst_acpi_find_machine);
@@ -134,5 +151,23 @@ bool sst_acpi_find_package_from_hid(const u8 hid[ACPI_ID_LEN],
 }
 EXPORT_SYMBOL_GPL(sst_acpi_find_package_from_hid);
 
+struct sst_acpi_mach *sst_acpi_codec_list(void *arg)
+{
+        struct sst_acpi_mach *mach = arg;
+        struct sst_codecs *codec_list = (struct sst_codecs *) mach->quirk_data;
+        int i;
+
+        if (mach->quirk_data == NULL)
+                return mach;
+
+        for (i = 0; i < codec_list->num_codecs; i++) {
+                if (sst_acpi_check_hid(codec_list->codecs[i]) != true)
+                        return NULL;
+        }
+
+        return mach;
+}
+EXPORT_SYMBOL_GPL(sst_acpi_codec_list);
+
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Intel Common ACPI Match module");
diff --git a/sound/soc/intel/skylake/Makefile b/sound/soc/intel/skylake/Makefile
index 60fbc9bbe473..e7d77722d560 100644
--- a/sound/soc/intel/skylake/Makefile
+++ b/sound/soc/intel/skylake/Makefile
@@ -1,6 +1,10 @@
 snd-soc-skl-objs := skl.o skl-pcm.o skl-nhlt.o skl-messages.o \
 skl-topology.o
 
+ifdef CONFIG_DEBUG_FS
+  snd-soc-skl-objs += skl-debug.o
+endif
+
 obj-$(CONFIG_SND_SOC_INTEL_SKYLAKE) += snd-soc-skl.o
 
 # Skylake IPC Support
diff --git a/sound/soc/intel/skylake/bxt-sst.c b/sound/soc/intel/skylake/bxt-sst.c
index f5e7dbb1ba39..cf11b84888b9 100644
--- a/sound/soc/intel/skylake/bxt-sst.c
+++ b/sound/soc/intel/skylake/bxt-sst.c
@@ -573,6 +573,10 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         sst->fw_ops = bxt_fw_ops;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
+        sst->addr.sram0_base = BXT_ADSP_SRAM0_BASE;
+        sst->addr.sram1_base = BXT_ADSP_SRAM1_BASE;
+        sst->addr.w0_stat_sz = SKL_ADSP_W0_STAT_SZ;
+        sst->addr.w0_up_sz = SKL_ADSP_W0_UP_SZ;
 
         sst_dsp_mailbox_init(sst, (BXT_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, BXT_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
diff --git a/sound/soc/intel/skylake/skl-debug.c b/sound/soc/intel/skylake/skl-debug.c
new file mode 100644
index 000000000000..dc20d91f62e6
--- /dev/null
+++ b/sound/soc/intel/skylake/skl-debug.c
@@ -0,0 +1,261 @@
+/*
+ *  skl-debug.c - Debugfs for skl driver
+ *
+ *  Copyright (C) 2016-17 Intel Corp
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ */
+
+#include <linux/pci.h>
+#include <linux/debugfs.h>
+#include "skl.h"
+#include "skl-sst-dsp.h"
+#include "skl-sst-ipc.h"
+#include "skl-tplg-interface.h"
+#include "skl-topology.h"
+#include "../common/sst-dsp.h"
+#include "../common/sst-dsp-priv.h"
+
+#define MOD_BUF         PAGE_SIZE
+#define FW_REG_BUF      PAGE_SIZE
+#define FW_REG_SIZE     0x60
+
+struct skl_debug {
+        struct skl *skl;
+        struct device *dev;
+
+        struct dentry *fs;
+        struct dentry *modules;
+        u8 fw_read_buff[FW_REG_BUF];
+};
+
+static ssize_t skl_print_pins(struct skl_module_pin *m_pin, char *buf,
+                                int max_pin, ssize_t size, bool direction)
+{
+        int i;
+        ssize_t ret = 0;
+
+        for (i = 0; i < max_pin; i++)
+                ret += snprintf(buf + size, MOD_BUF - size,
+                                "%s %d\n\tModule %d\n\tInstance %d\n\t"
+                                "In-used %s\n\tType %s\n"
+                                "\tState %d\n\tIndex %d\n",
+                                direction ? "Input Pin:" : "Output Pin:",
+                                i, m_pin[i].id.module_id,
+                                m_pin[i].id.instance_id,
+                                m_pin[i].in_use ? "Used" : "Unused",
+                                m_pin[i].is_dynamic ? "Dynamic" : "Static",
+                                m_pin[i].pin_state, i);
+        return ret;
+}
+
+static ssize_t skl_print_fmt(struct skl_module_fmt *fmt, char *buf,
+                                        ssize_t size, bool direction)
+{
+        return snprintf(buf + size, MOD_BUF - size,
+                        "%s\n\tCh %d\n\tFreq %d\n\tBit depth %d\n\t"
+                        "Valid bit depth %d\n\tCh config %#x\n\tInterleaving %d\n\t"
+                        "Sample Type %d\n\tCh Map %#x\n",
+                        direction ? "Input Format:" : "Output Format:",
+                        fmt->channels, fmt->s_freq, fmt->bit_depth,
+                        fmt->valid_bit_depth, fmt->ch_cfg,
+                        fmt->interleaving_style, fmt->sample_type,
+                        fmt->ch_map);
+}
+
+static ssize_t module_read(struct file *file, char __user *user_buf,
+                           size_t count, loff_t *ppos)
+{
+        struct skl_module_cfg *mconfig = file->private_data;
+        char *buf;
+        ssize_t ret;
+
+        buf = kzalloc(MOD_BUF, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = snprintf(buf, MOD_BUF, "Module:\n\tUUID %pUL\n\tModule id %d\n"
+                        "\tInstance id %d\n\tPvt_id %d\n", mconfig->guid,
+                        mconfig->id.module_id, mconfig->id.instance_id,
+                        mconfig->id.pvt_id);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Resources:\n\tMCPS %#x\n\tIBS %#x\n\tOBS %#x\t\n",
+                        mconfig->mcps, mconfig->ibs, mconfig->obs);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Module data:\n\tCore %d\n\tIn queue %d\n\t"
+                        "Out queue %d\n\tType %s\n",
+                        mconfig->core_id, mconfig->max_in_queue,
+                        mconfig->max_out_queue,
+                        mconfig->is_loadable ? "loadable" : "inbuilt");
+
+        ret += skl_print_fmt(mconfig->in_fmt, buf, ret, true);
+        ret += skl_print_fmt(mconfig->out_fmt, buf, ret, false);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Fixup:\n\tParams %#x\n\tConverter %#x\n",
+                        mconfig->params_fixup, mconfig->converter);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Module Gateway:\n\tType %#x\n\tVbus %#x\n\tHW conn %#x\n\tSlot %#x\n",
+                        mconfig->dev_type, mconfig->vbus_id,
+                        mconfig->hw_conn_type, mconfig->time_slot);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Pipeline:\n\tID %d\n\tPriority %d\n\tConn Type %d\n\t"
+                        "Pages %#x\n", mconfig->pipe->ppl_id,
+                        mconfig->pipe->pipe_priority, mconfig->pipe->conn_type,
+                        mconfig->pipe->memory_pages);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "\tParams:\n\t\tHost DMA %d\n\t\tLink DMA %d\n",
+                        mconfig->pipe->p_params->host_dma_id,
+                        mconfig->pipe->p_params->link_dma_id);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "\tPCM params:\n\t\tCh %d\n\t\tFreq %d\n\t\tFormat %d\n",
+                        mconfig->pipe->p_params->ch,
+                        mconfig->pipe->p_params->s_freq,
+                        mconfig->pipe->p_params->s_fmt);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "\tLink %#x\n\tStream %#x\n",
+                        mconfig->pipe->p_params->linktype,
+                        mconfig->pipe->p_params->stream);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "\tState %d\n\tPassthru %s\n",
+                        mconfig->pipe->state,
+                        mconfig->pipe->passthru ? "true" : "false");
+
+        ret += skl_print_pins(mconfig->m_in_pin, buf,
+                        mconfig->max_in_queue, ret, true);
+        ret += skl_print_pins(mconfig->m_out_pin, buf,
+                        mconfig->max_out_queue, ret, false);
+
+        ret += snprintf(buf + ret, MOD_BUF - ret,
+                        "Other:\n\tDomain %d\n\tHomogenous Input %s\n\t"
+                        "Homogenous Output %s\n\tIn Queue Mask %d\n\t"
+                        "Out Queue Mask %d\n\tDMA ID %d\n\tMem Pages %d\n\t"
+                        "Module Type %d\n\tModule State %d\n",
+                        mconfig->domain,
+                        mconfig->homogenous_inputs ? "true" : "false",
+                        mconfig->homogenous_outputs ? "true" : "false",
+                        mconfig->in_queue_mask, mconfig->out_queue_mask,
+                        mconfig->dma_id, mconfig->mem_pages, mconfig->m_state,
+                        mconfig->m_type);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
+
+        kfree(buf);
+        return ret;
+}
+
+static const struct file_operations mcfg_fops = {
+        .open = simple_open,
+        .read = module_read,
+        .llseek = default_llseek,
+};
+
+
+void skl_debug_init_module(struct skl_debug *d,
+                        struct snd_soc_dapm_widget *w,
+                        struct skl_module_cfg *mconfig)
+{
+        if (!debugfs_create_file(w->name, 0444,
+                                d->modules, mconfig,
+                                &mcfg_fops))
+                dev_err(d->dev, "%s: module debugfs init failed\n", w->name);
+}
+
+static ssize_t fw_softreg_read(struct file *file, char __user *user_buf,
+                               size_t count, loff_t *ppos)
+{
+        struct skl_debug *d = file->private_data;
+        struct sst_dsp *sst = d->skl->skl_sst->dsp;
+        size_t w0_stat_sz = sst->addr.w0_stat_sz;
+        void __iomem *in_base = sst->mailbox.in_base;
+        void __iomem *fw_reg_addr;
+        unsigned int offset;
+        char *tmp;
+        ssize_t ret = 0;
+
+        tmp = kzalloc(FW_REG_BUF, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
+        fw_reg_addr = in_base - w0_stat_sz;
+        memset(d->fw_read_buff, 0, FW_REG_BUF);
+
+        if (w0_stat_sz > 0)
+                __iowrite32_copy(d->fw_read_buff, fw_reg_addr, w0_stat_sz >> 2);
+
+        for (offset = 0; offset < FW_REG_SIZE; offset += 16) {
+                ret += snprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
+                hex_dump_to_buffer(d->fw_read_buff + offset, 16, 16, 4,
+                                   tmp + ret, FW_REG_BUF - ret, 0);
+                ret += strlen(tmp + ret);
+
+                /* print newline for each offset */
+                if (FW_REG_BUF - ret > 0)
+                        tmp[ret++] = '\n';
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, tmp, ret);
+        kfree(tmp);
+
+        return ret;
+}
+
+static const struct file_operations soft_regs_ctrl_fops = {
+        .open = simple_open,
+        .read = fw_softreg_read,
+        .llseek = default_llseek,
+};
+
+struct skl_debug *skl_debugfs_init(struct skl *skl)
+{
+        struct skl_debug *d;
+
+        d = devm_kzalloc(&skl->pci->dev, sizeof(*d), GFP_KERNEL);
+        if (!d)
+                return NULL;
+
+        /* create the debugfs dir with platform component's debugfs as parent */
+        d->fs = debugfs_create_dir("dsp",
+                                   skl->platform->component.debugfs_root);
+        if (IS_ERR(d->fs) || !d->fs) {
+                dev_err(&skl->pci->dev, "debugfs root creation failed\n");
+                return NULL;
+        }
+
+        d->skl = skl;
+        d->dev = &skl->pci->dev;
+
+        /* now create the module dir */
+        d->modules = debugfs_create_dir("modules", d->fs);
+        if (IS_ERR(d->modules) || !d->modules) {
+                dev_err(&skl->pci->dev, "modules debugfs create failed\n");
+                goto err;
+        }
+
+        if (!debugfs_create_file("fw_soft_regs_rd", 0444, d->fs, d,
+                                 &soft_regs_ctrl_fops)) {
+                dev_err(d->dev, "fw soft regs control debugfs init failed\n");
+                goto err;
+        }
+
+        return d;
+
+err:
+        debugfs_remove_recursive(d->fs);
+        return NULL;
+}
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index ab1adc0c9cc3..eca85827dbd2 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -507,6 +507,8 @@ static void skl_setup_cpr_gateway_cfg(struct skl_sst *ctx,
                         struct skl_module_cfg *mconfig,
                         struct skl_cpr_cfg *cpr_mconfig)
 {
+        u32 dma_io_buf;
+
         cpr_mconfig->gtw_cfg.node_id = skl_get_node_id(ctx, mconfig);
 
         if (cpr_mconfig->gtw_cfg.node_id == SKL_NON_GATEWAY_CPR_NODE_ID) {
@@ -514,10 +516,29 @@ static void skl_setup_cpr_gateway_cfg(struct skl_sst *ctx,
                 return;
         }
 
-        if (SKL_CONN_SOURCE == mconfig->hw_conn_type)
-                cpr_mconfig->gtw_cfg.dma_buffer_size = 2 * mconfig->obs;
-        else
-                cpr_mconfig->gtw_cfg.dma_buffer_size = 2 * mconfig->ibs;
+        switch (mconfig->hw_conn_type) {
+        case SKL_CONN_SOURCE:
+                if (mconfig->dev_type == SKL_DEVICE_HDAHOST)
+                        dma_io_buf =  mconfig->ibs;
+                else
+                        dma_io_buf =  mconfig->obs;
+                break;
+
+        case SKL_CONN_SINK:
+                if (mconfig->dev_type == SKL_DEVICE_HDAHOST)
+                        dma_io_buf =  mconfig->obs;
+                else
+                        dma_io_buf =  mconfig->ibs;
+                break;
+
+        default:
+                dev_warn(ctx->dev, "wrong connection type: %d\n",
+                                mconfig->hw_conn_type);
+                return;
+        }
+
+        cpr_mconfig->gtw_cfg.dma_buffer_size =
+                                mconfig->dma_buffer_size * dma_io_buf;
 
         cpr_mconfig->cpr_feature_mask = 0;
         cpr_mconfig->gtw_cfg.config_length  = 0;
@@ -707,6 +728,7 @@ static u16 skl_get_module_param_size(struct skl_sst *ctx,
                 return param_size;
 
         case SKL_MODULE_TYPE_BASE_OUTFMT:
+        case SKL_MODULE_TYPE_MIC_SELECT:
         case SKL_MODULE_TYPE_KPB:
                 return sizeof(struct skl_base_outfmt_cfg);
 
@@ -761,6 +783,7 @@ static int skl_set_module_format(struct skl_sst *ctx,
                 break;
 
         case SKL_MODULE_TYPE_BASE_OUTFMT:
+        case SKL_MODULE_TYPE_MIC_SELECT:
         case SKL_MODULE_TYPE_KPB:
                 skl_set_base_outfmt_format(ctx, module_config, *param_data);
                 break;
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index e91bbcffc856..0ebea34a4988 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1249,12 +1249,16 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform)
 
         pm_runtime_get_sync(platform->dev);
         if ((ebus_to_hbus(ebus))->ppcap) {
+                skl->platform = platform;
+
+                /* init debugfs */
+                skl->debugfs = skl_debugfs_init(skl);
+
                 ret = skl_tplg_init(platform, ebus);
                 if (ret < 0) {
                         dev_err(platform->dev, "Failed to init topology!\n");
                         return ret;
                 }
-                skl->platform = platform;
 
                 /* load the firmwares, since all is set */
                 ops = skl_get_dsp_ops(skl->pci->device);
diff --git a/sound/soc/intel/skylake/skl-sst.c b/sound/soc/intel/skylake/skl-sst.c
index 155e456b7a3a..aba9ea11ac74 100644
--- a/sound/soc/intel/skylake/skl-sst.c
+++ b/sound/soc/intel/skylake/skl-sst.c
@@ -553,6 +553,11 @@ int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         sst = skl->dsp;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
+        sst->addr.sram0_base = SKL_ADSP_SRAM0_BASE;
+        sst->addr.sram1_base = SKL_ADSP_SRAM1_BASE;
+        sst->addr.w0_stat_sz = SKL_ADSP_W0_STAT_SZ;
+        sst->addr.w0_up_sz = SKL_ADSP_W0_UP_SZ;
+
         sst_dsp_mailbox_init(sst, (SKL_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, SKL_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
 
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 64a0f8ed33e1..68c3f121efc3 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -36,6 +36,19 @@
 #define SKL_IN_DIR_BIT_MASK             BIT(0)
 #define SKL_PIN_COUNT_MASK              GENMASK(7, 4)
 
+static const int mic_mono_list[] = {
+0, 1, 2, 3,
+};
+static const int mic_stereo_list[][SKL_CH_STEREO] = {
+{0, 1}, {0, 2}, {0, 3}, {1, 2}, {1, 3}, {2, 3},
+};
+static const int mic_trio_list[][SKL_CH_TRIO] = {
+{0, 1, 2}, {0, 1, 3}, {0, 2, 3}, {1, 2, 3},
+};
+static const int mic_quatro_list[][SKL_CH_QUATRO] = {
+{0, 1, 2, 3},
+};
+
 void skl_tplg_d0i3_get(struct skl *skl, enum d0i3_capability caps)
 {
         struct skl_d0i3_data *d0i3 =  &skl->skl_sst->d0i3;
@@ -1314,6 +1327,111 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+static int skl_tplg_mic_control_get(struct snd_kcontrol *kcontrol,
+                struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_dapm_widget *w = snd_soc_dapm_kcontrol_widget(kcontrol);
+        struct skl_module_cfg *mconfig = w->priv;
+        struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value;
+        u32 ch_type = *((u32 *)ec->dobj.private);
+
+        if (mconfig->dmic_ch_type == ch_type)
+                ucontrol->value.enumerated.item[0] =
+                                        mconfig->dmic_ch_combo_index;
+        else
+                ucontrol->value.enumerated.item[0] = 0;
+
+        return 0;
+}
+
+static int skl_fill_mic_sel_params(struct skl_module_cfg *mconfig,
+        struct skl_mic_sel_config *mic_cfg, struct device *dev)
+{
+        struct skl_specific_cfg *sp_cfg = &mconfig->formats_config;
+
+        sp_cfg->caps_size = sizeof(struct skl_mic_sel_config);
+        sp_cfg->set_params = SKL_PARAM_SET;
+        sp_cfg->param_id = 0x00;
+        if (!sp_cfg->caps) {
+                sp_cfg->caps = devm_kzalloc(dev, sp_cfg->caps_size, GFP_KERNEL);
+                if (!sp_cfg->caps)
+                        return -ENOMEM;
+        }
+
+        mic_cfg->mic_switch = SKL_MIC_SEL_SWITCH;
+        mic_cfg->flags = 0;
+        memcpy(sp_cfg->caps, mic_cfg, sp_cfg->caps_size);
+
+        return 0;
+}
+
+static int skl_tplg_mic_control_set(struct snd_kcontrol *kcontrol,
+                        struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_dapm_widget *w = snd_soc_dapm_kcontrol_widget(kcontrol);
+        struct skl_module_cfg *mconfig = w->priv;
+        struct skl_mic_sel_config mic_cfg = {0};
+        struct soc_enum *ec = (struct soc_enum *)kcontrol->private_value;
+        u32 ch_type = *((u32 *)ec->dobj.private);
+        const int *list;
+        u8 in_ch, out_ch, index;
+
+        mconfig->dmic_ch_type = ch_type;
+        mconfig->dmic_ch_combo_index = ucontrol->value.enumerated.item[0];
+
+        /* enum control index 0 is INVALID, so no channels to be set */
+        if (mconfig->dmic_ch_combo_index == 0)
+                return 0;
+
+        /* No valid channel selection map for index 0, so offset by 1 */
+        index = mconfig->dmic_ch_combo_index - 1;
+
+        switch (ch_type) {
+        case SKL_CH_MONO:
+                if (mconfig->dmic_ch_combo_index > ARRAY_SIZE(mic_mono_list))
+                        return -EINVAL;
+
+                list = &mic_mono_list[index];
+                break;
+
+        case SKL_CH_STEREO:
+                if (mconfig->dmic_ch_combo_index > ARRAY_SIZE(mic_stereo_list))
+                        return -EINVAL;
+
+                list = mic_stereo_list[index];
+                break;
+
+        case SKL_CH_TRIO:
+                if (mconfig->dmic_ch_combo_index > ARRAY_SIZE(mic_trio_list))
+                        return -EINVAL;
+
+                list = mic_trio_list[index];
+                break;
+
+        case SKL_CH_QUATRO:
+                if (mconfig->dmic_ch_combo_index > ARRAY_SIZE(mic_quatro_list))
+                        return -EINVAL;
+
+                list = mic_quatro_list[index];
+                break;
+
+        default:
+                dev_err(w->dapm->dev,
+                                "Invalid channel %d for mic_select module\n",
+                                ch_type);
+                return -EINVAL;
+
+        }
+
+        /* channel type enum map to number of chanels for that type */
+        for (out_ch = 0; out_ch < ch_type; out_ch++) {
+                in_ch = list[out_ch];
+                mic_cfg.blob[out_ch][in_ch] = SKL_DEFAULT_MIC_SEL_GAIN;
+        }
+
+        return skl_fill_mic_sel_params(mconfig, &mic_cfg, w->dapm->dev);
+}
+
 /*
  * Fill the dma id for host and link. In case of passthrough
  * pipeline, this will both host and link in the same
@@ -1666,6 +1784,14 @@ static const struct snd_soc_tplg_bytes_ext_ops skl_tlv_ops[] = {
                                         skl_tplg_tlv_control_set},
 };
 
+static const struct snd_soc_tplg_kcontrol_ops skl_tplg_kcontrol_ops[] = {
+        {
+                .id = SKL_CONTROL_TYPE_MIC_SELECT,
+                .get = skl_tplg_mic_control_get,
+                .put = skl_tplg_mic_control_set,
+        },
+};
+
 static int skl_tplg_fill_pipe_tkn(struct device *dev,
                         struct skl_pipe *pipe, u32 tkn,
                         u32 tkn_val)
@@ -1995,7 +2121,7 @@ static int skl_tplg_get_token(struct device *dev,
                 mconfig->converter = tkn_elem->value;
                 break;
 
-        case SKL_TKL_U32_D0I3_CAPS:
+        case SKL_TKN_U32_D0I3_CAPS:
                 mconfig->d0i3_caps = tkn_elem->value;
                 break;
 
@@ -2070,12 +2196,26 @@ static int skl_tplg_get_token(struct device *dev,
 
                 break;
 
+        case SKL_TKN_U32_CAPS_SET_PARAMS:
+                mconfig->formats_config.set_params =
+                                tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_CAPS_PARAMS_ID:
+                mconfig->formats_config.param_id =
+                                tkn_elem->value;
+                break;
+
         case SKL_TKN_U32_PROC_DOMAIN:
                 mconfig->domain =
                         tkn_elem->value;
 
                 break;
 
+        case SKL_TKN_U32_DMA_BUF_SIZE:
+                mconfig->dma_buffer_size = tkn_elem->value;
+                break;
+
         case SKL_TKN_U8_IN_PIN_TYPE:
         case SKL_TKN_U8_OUT_PIN_TYPE:
         case SKL_TKN_U8_CONN_TYPE:
@@ -2147,7 +2287,7 @@ static int skl_tplg_get_tokens(struct device *dev,
                 tuple_size += tkn_count * sizeof(*tkn_elem);
         }
 
-        return 0;
+        return off;
 }
 
 /*
@@ -2198,10 +2338,11 @@ static int skl_tplg_get_pvt_data(struct snd_soc_tplg_dapm_widget *tplg_w,
         num_blocks = ret;
 
         off += array->size;
-        array = (struct snd_soc_tplg_vendor_array *)(tplg_w->priv.data + off);
-
         /* Read the BLOCK_TYPE and BLOCK_SIZE descriptor */
         while (num_blocks > 0) {
+                array = (struct snd_soc_tplg_vendor_array *)
+                                (tplg_w->priv.data + off);
+
                 ret = skl_tplg_get_desc_blocks(dev, array);
 
                 if (ret < 0)
@@ -2237,7 +2378,9 @@ static int skl_tplg_get_pvt_data(struct snd_soc_tplg_dapm_widget *tplg_w,
                                 memcpy(mconfig->formats_config.caps, data,
                                         mconfig->formats_config.caps_size);
                         --num_blocks;
+                        ret = mconfig->formats_config.caps_size;
                 }
+                off += ret;
         }
 
         return 0;
@@ -2329,6 +2472,9 @@ static int skl_tplg_widget_load(struct snd_soc_component *cmpnt,
         ret = skl_tplg_get_pvt_data(tplg_w, skl, bus->dev, mconfig);
         if (ret < 0)
                 return ret;
+
+        skl_debug_init_module(skl->debugfs, w, mconfig);
+
 bind_event:
         if (tplg_w->event_type == 0) {
                 dev_dbg(bus->dev, "ASoC: No event handler required\n");
@@ -2377,14 +2523,34 @@ static int skl_init_algo_data(struct device *dev, struct soc_bytes_ext *be,
         return 0;
 }
 
+static int skl_init_enum_data(struct device *dev, struct soc_enum *se,
+                                struct snd_soc_tplg_enum_control *ec)
+{
+
+        void *data;
+
+        if (ec->priv.size) {
+                data = devm_kzalloc(dev, sizeof(ec->priv.size), GFP_KERNEL);
+                if (!data)
+                        return -ENOMEM;
+                memcpy(data, ec->priv.data, ec->priv.size);
+                se->dobj.private = data;
+        }
+
+        return 0;
+
+}
+
 static int skl_tplg_control_load(struct snd_soc_component *cmpnt,
                                 struct snd_kcontrol_new *kctl,
                                 struct snd_soc_tplg_ctl_hdr *hdr)
 {
         struct soc_bytes_ext *sb;
         struct snd_soc_tplg_bytes_control *tplg_bc;
+        struct snd_soc_tplg_enum_control *tplg_ec;
         struct hdac_ext_bus *ebus  = snd_soc_component_get_drvdata(cmpnt);
         struct hdac_bus *bus = ebus_to_hbus(ebus);
+        struct soc_enum *se;
 
         switch (hdr->ops.info) {
         case SND_SOC_TPLG_CTL_BYTES:
@@ -2398,6 +2564,17 @@ static int skl_tplg_control_load(struct snd_soc_component *cmpnt,
                 }
                 break;
 
+        case SND_SOC_TPLG_CTL_ENUM:
+                tplg_ec = container_of(hdr,
+                                struct snd_soc_tplg_enum_control, hdr);
+                if (kctl->access & SNDRV_CTL_ELEM_ACCESS_READWRITE) {
+                        se = (struct soc_enum *)kctl->private_value;
+                        if (tplg_ec->priv.size)
+                                return skl_init_enum_data(bus->dev, se,
+                                                tplg_ec);
+                }
+                break;
+
         default:
                 dev_warn(bus->dev, "Control load not supported %d:%d:%d\n",
                         hdr->ops.get, hdr->ops.put, hdr->ops.info);
@@ -2626,6 +2803,8 @@ static struct snd_soc_tplg_ops skl_tplg_ops  = {
         .control_load = skl_tplg_control_load,
         .bytes_ext_ops = skl_tlv_ops,
         .bytes_ext_ops_count = ARRAY_SIZE(skl_tlv_ops),
+        .io_ops = skl_tplg_kcontrol_ops,
+        .io_ops_count = ARRAY_SIZE(skl_tplg_kcontrol_ops),
         .manifest = skl_manifest_load,
 };
 
diff --git a/sound/soc/intel/skylake/skl-topology.h b/sound/soc/intel/skylake/skl-topology.h
index cc64d6bdb4f6..c25e8868b84e 100644
--- a/sound/soc/intel/skylake/skl-topology.h
+++ b/sound/soc/intel/skylake/skl-topology.h
@@ -39,6 +39,11 @@
 #define MODULE_MAX_IN_PINS      8
 #define MODULE_MAX_OUT_PINS     8
 
+#define SKL_MIC_CH_SUPPORT      4
+#define SKL_MIC_MAX_CH_SUPPORT  8
+#define SKL_DEFAULT_MIC_SEL_GAIN        0x3FF
+#define SKL_MIC_SEL_SWITCH      0x3
+
 enum skl_channel_index {
         SKL_CHANNEL_LEFT = 0,
         SKL_CHANNEL_RIGHT = 1,
@@ -309,11 +314,14 @@ struct skl_module_cfg {
         u8 dev_type;
         u8 dma_id;
         u8 time_slot;
+        u8 dmic_ch_combo_index;
+        u32 dmic_ch_type;
         u32 params_fixup;
         u32 converter;
         u32 vbus_id;
         u32 mem_pages;
         enum d0i3_capability d0i3_caps;
+        u32 dma_buffer_size; /* in milli seconds */
         struct skl_module_pin *m_in_pin;
         struct skl_module_pin *m_out_pin;
         enum skl_module_type m_type;
@@ -342,6 +350,19 @@ struct skl_module_deferred_bind {
         struct list_head node;
 };
 
+struct skl_mic_sel_config {
+        u16 mic_switch;
+        u16 flags;
+        u16 blob[SKL_MIC_MAX_CH_SUPPORT][SKL_MIC_MAX_CH_SUPPORT];
+} __packed;
+
+enum skl_channel {
+        SKL_CH_MONO = 1,
+        SKL_CH_STEREO = 2,
+        SKL_CH_TRIO = 3,
+        SKL_CH_QUATRO = 4,
+};
+
 static inline struct skl *get_skl_ctx(struct device *dev)
 {
         struct hdac_ext_bus *ebus = dev_get_drvdata(dev);
diff --git a/sound/soc/intel/skylake/skl-tplg-interface.h b/sound/soc/intel/skylake/skl-tplg-interface.h
index 7a2febf99019..f8d1749a2e0c 100644
--- a/sound/soc/intel/skylake/skl-tplg-interface.h
+++ b/sound/soc/intel/skylake/skl-tplg-interface.h
@@ -24,6 +24,7 @@
  * SST types start at higher to avoid any overlapping in future
  */
 #define SKL_CONTROL_TYPE_BYTE_TLV       0x100
+#define SKL_CONTROL_TYPE_MIC_SELECT     0x102
 
 #define HDA_SST_CFG_MAX 900 /* size of copier cfg*/
 #define MAX_IN_QUEUE 8
@@ -82,6 +83,7 @@ enum skl_module_type {
         SKL_MODULE_TYPE_ALGO,
         SKL_MODULE_TYPE_BASE_OUTFMT,
         SKL_MODULE_TYPE_KPB,
+        SKL_MODULE_TYPE_MIC_SELECT,
 };
 
 enum skl_core_affinity {
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 4c9b5781282b..334917ee41cf 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -866,6 +866,7 @@ static void skl_remove(struct pci_dev *pci)
         /* codec removal, invoke bus_device_remove */
         snd_hdac_ext_bus_device_remove(ebus);
 
+        skl->debugfs = NULL;
         skl_platform_unregister(&pci->dev);
         skl_free_dsp(skl);
         skl_machine_device_unregister(skl);
@@ -876,29 +877,120 @@ static void skl_remove(struct pci_dev *pci)
         dev_set_drvdata(&pci->dev, NULL);
 }
 
+static struct sst_codecs skl_codecs = {
+        .num_codecs = 1,
+        .codecs = {"NAU88L25"}
+};
+
+static struct sst_codecs kbl_codecs = {
+        .num_codecs = 1,
+        .codecs = {"NAU88L25"}
+};
+
+static struct sst_codecs bxt_codecs = {
+        .num_codecs = 1,
+        .codecs = {"MX98357A"}
+};
+
+static struct sst_codecs kbl_poppy_codecs = {
+        .num_codecs = 1,
+        .codecs = {"10EC5663"}
+};
+
+static struct sst_codecs kbl_5663_5514_codecs = {
+        .num_codecs = 2,
+        .codecs = {"10EC5663", "10EC5514"}
+};
+
+
 static struct sst_acpi_mach sst_skl_devdata[] = {
-        { "INT343A", "skl_alc286s_i2s", "intel/dsp_fw_release.bin", NULL, NULL, NULL },
-        { "INT343B", "skl_n88l25_s4567", "intel/dsp_fw_release.bin",
-                                NULL, NULL, &skl_dmic_data },
-        { "MX98357A", "skl_n88l25_m98357a", "intel/dsp_fw_release.bin",
-                                NULL, NULL, &skl_dmic_data },
+        {
+                .id = "INT343A",
+                .drv_name = "skl_alc286s_i2s",
+                .fw_filename = "intel/dsp_fw_release.bin",
+        },
+        {
+                .id = "INT343B",
+                .drv_name = "skl_n88l25_s4567",
+                .fw_filename = "intel/dsp_fw_release.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &skl_codecs,
+                .pdata = &skl_dmic_data
+        },
+        {
+                .id = "MX98357A",
+                .drv_name = "skl_n88l25_m98357a",
+                .fw_filename = "intel/dsp_fw_release.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &skl_codecs,
+                .pdata = &skl_dmic_data
+        },
         {}
 };
 
 static struct sst_acpi_mach sst_bxtp_devdata[] = {
-        { "INT343A", "bxt_alc298s_i2s", "intel/dsp_fw_bxtn.bin", NULL, NULL, NULL },
-        { "DLGS7219", "bxt_da7219_max98357a_i2s", "intel/dsp_fw_bxtn.bin", NULL, NULL, NULL },
+        {
+                .id = "INT343A",
+                .drv_name = "bxt_alc298s_i2s",
+                .fw_filename = "intel/dsp_fw_bxtn.bin",
+        },
+        {
+                .id = "DLGS7219",
+                .drv_name = "bxt_da7219_max98357a_i2s",
+                .fw_filename = "intel/dsp_fw_bxtn.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &bxt_codecs,
+        },
 };
 
 static struct sst_acpi_mach sst_kbl_devdata[] = {
-        { "INT343A", "kbl_alc286s_i2s", "intel/dsp_fw_kbl.bin", NULL, NULL, NULL },
-        { "INT343B", "kbl_n88l25_s4567", "intel/dsp_fw_kbl.bin", NULL, NULL, &skl_dmic_data },
-        { "MX98357A", "kbl_n88l25_m98357a", "intel/dsp_fw_kbl.bin", NULL, NULL, &skl_dmic_data },
+        {
+                .id = "INT343A",
+                .drv_name = "kbl_alc286s_i2s",
+                .fw_filename = "intel/dsp_fw_kbl.bin",
+        },
+        {
+                .id = "INT343B",
+                .drv_name = "kbl_n88l25_s4567",
+                .fw_filename = "intel/dsp_fw_kbl.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &kbl_codecs,
+                .pdata = &skl_dmic_data
+        },
+        {
+                .id = "MX98357A",
+                .drv_name = "kbl_n88l25_m98357a",
+                .fw_filename = "intel/dsp_fw_kbl.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &kbl_codecs,
+                .pdata = &skl_dmic_data
+        },
+        {
+                .id = "MX98927",
+                .drv_name = "kbl_r5514_5663_max",
+                .fw_filename = "intel/dsp_fw_kbl.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &kbl_5663_5514_codecs,
+                .pdata = &skl_dmic_data
+        },
+        {
+                .id = "MX98927",
+                .drv_name = "kbl_rt5663_m98927",
+                .fw_filename = "intel/dsp_fw_kbl.bin",
+                .machine_quirk = sst_acpi_codec_list,
+                .quirk_data = &kbl_poppy_codecs,
+                .pdata = &skl_dmic_data
+        },
+
         {}
 };
 
 static struct sst_acpi_mach sst_glk_devdata[] = {
-        { "INT343A", "glk_alc298s_i2s", "intel/dsp_fw_glk.bin", NULL, NULL, NULL },
+        {
+                .id = "INT343A",
+                .drv_name = "glk_alc298s_i2s",
+                .fw_filename = "intel/dsp_fw_glk.bin",
+        },
 };
 
 /* PCI IDs */
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index 2a630fcb7f08..a6b134b4c037 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -23,6 +23,7 @@
 
 #include <sound/hda_register.h>
 #include <sound/hdaudio_ext.h>
+#include <sound/soc.h>
 #include "skl-nhlt.h"
 
 #define SKL_SUSPEND_DELAY 2000
@@ -42,6 +43,8 @@ struct skl_dsp_resource {
         u32 mem;
 };
 
+struct skl_debug;
+
 struct skl {
         struct hdac_ext_bus ebus;
         struct pci_dev *pci;
@@ -66,6 +69,8 @@ struct skl {
         int supend_active;
 
         struct work_struct probe_work;
+
+        struct skl_debug *debugfs;
 };
 
 #define skl_to_ebus(s)  (&(s)->ebus)
@@ -116,4 +121,22 @@ void skl_update_d0i3c(struct device *dev, bool enable);
 int skl_nhlt_create_sysfs(struct skl *skl);
 void skl_nhlt_remove_sysfs(struct skl *skl);
 
+struct skl_module_cfg;
+
+#ifdef CONFIG_DEBUG_FS
+struct skl_debug *skl_debugfs_init(struct skl *skl);
+void skl_debug_init_module(struct skl_debug *d,
+                        struct snd_soc_dapm_widget *w,
+                        struct skl_module_cfg *mconfig);
+#else
+static inline struct skl_debug *skl_debugfs_init(struct skl *skl)
+{
+        return NULL;
+}
+static inline void skl_debug_init_module(struct skl_debug *d,
+                                         struct snd_soc_dapm_widget *w,
+                                         struct skl_module_cfg *mconfig)
+{}
+#endif
+
 #endif /* __SOUND_SOC_SKL_H */
diff --git a/sound/soc/mediatek/mt2701/mt2701-cs42448.c b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
index aa5b31b121e3..70f61d53fe05 100644
--- a/sound/soc/mediatek/mt2701/mt2701-cs42448.c
+++ b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
@@ -107,7 +107,7 @@ static const struct snd_kcontrol_new mt2701_cs42448_controls[] = {
 
 static const unsigned int mt2701_cs42448_sampling_rates[] = {48000};
 
-static struct snd_pcm_hw_constraint_list mt2701_cs42448_constraints_rates = {
+static const struct snd_pcm_hw_constraint_list mt2701_cs42448_constraints_rates = {
                 .count = ARRAY_SIZE(mt2701_cs42448_sampling_rates),
                 .list = mt2701_cs42448_sampling_rates,
                 .mask = 0,
diff --git a/sound/soc/omap/mcbsp.c b/sound/soc/omap/mcbsp.c
index 06fec5699cc8..7a54e3083203 100644
--- a/sound/soc/omap/mcbsp.c
+++ b/sound/soc/omap/mcbsp.c
@@ -835,15 +835,11 @@ static ssize_t dma_op_mode_store(struct device *dev,
                                 const char *buf, size_t size)
 {
         struct omap_mcbsp *mcbsp = dev_get_drvdata(dev);
-        const char * const *s;
-        int i = 0;
-
-        for (s = &dma_op_modes[i]; i < ARRAY_SIZE(dma_op_modes); s++, i++)
-                if (sysfs_streq(buf, *s))
-                        break;
+        int i;
 
-        if (i == ARRAY_SIZE(dma_op_modes))
-                return -EINVAL;
+        i = sysfs_match_string(dma_op_modes, buf);
+        if (i < 0)
+                return i;
 
         spin_lock_irq(&mcbsp->lock);
         if (!mcbsp->free) {
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index 823b5a236d8d..960744e46edc 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -1,6 +1,6 @@
 config SND_PXA2XX_SOC
         tristate "SoC Audio for the Intel PXA2xx chip"
-        depends on ARCH_PXA
+        depends on ARCH_PXA || COMPILE_TEST
         select SND_PXA2XX_LIB
         help
           Say Y or M if you want to add support for codecs attached to
diff --git a/sound/soc/rockchip/Kconfig b/sound/soc/rockchip/Kconfig
index e3ca1e973de5..c84487805876 100644
--- a/sound/soc/rockchip/Kconfig
+++ b/sound/soc/rockchip/Kconfig
@@ -15,6 +15,15 @@ config SND_SOC_ROCKCHIP_I2S
           Rockchip I2S device. The device supports upto maximum of
           8 channels each for play and record.
 
+config SND_SOC_ROCKCHIP_PDM
+        tristate "Rockchip PDM Controller Driver"
+        depends on CLKDEV_LOOKUP && SND_SOC_ROCKCHIP
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        help
+          Say Y or M if you want to add support for PDM driver for
+          Rockchip PDM Controller. The Controller supports up to maximum of
+          8 channels record.
+
 config SND_SOC_ROCKCHIP_SPDIF
         tristate "Rockchip SPDIF Device Driver"
         depends on CLKDEV_LOOKUP && SND_SOC_ROCKCHIP
diff --git a/sound/soc/rockchip/Makefile b/sound/soc/rockchip/Makefile
index 991f91bea9f9..105f0e14a4ab 100644
--- a/sound/soc/rockchip/Makefile
+++ b/sound/soc/rockchip/Makefile
@@ -1,8 +1,10 @@
 # ROCKCHIP Platform Support
 snd-soc-rockchip-i2s-objs := rockchip_i2s.o
+snd-soc-rockchip-pdm-objs := rockchip_pdm.o
 snd-soc-rockchip-spdif-objs := rockchip_spdif.o
 
 obj-$(CONFIG_SND_SOC_ROCKCHIP_I2S) += snd-soc-rockchip-i2s.o
+obj-$(CONFIG_SND_SOC_ROCKCHIP_PDM) += snd-soc-rockchip-pdm.o
 obj-$(CONFIG_SND_SOC_ROCKCHIP_SPDIF) += snd-soc-rockchip-spdif.o
 
 snd-soc-rockchip-max98090-objs := rockchip_max98090.o
diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 974915cb4c4f..199338fdeda0 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -116,6 +116,7 @@ static void rockchip_snd_txctrl(struct rk_i2s_dev *i2s, int on)
                                            I2S_XFER_TXS_STOP |
                                            I2S_XFER_RXS_STOP);
 
+                        udelay(150);
                         regmap_update_bits(i2s->regmap, I2S_CLR,
                                            I2S_CLR_TXC | I2S_CLR_RXC,
                                            I2S_CLR_TXC | I2S_CLR_RXC);
@@ -162,6 +163,7 @@ static void rockchip_snd_rxctrl(struct rk_i2s_dev *i2s, int on)
                                            I2S_XFER_TXS_STOP |
                                            I2S_XFER_RXS_STOP);
 
+                        udelay(150);
                         regmap_update_bits(i2s->regmap, I2S_CLR,
                                            I2S_CLR_TXC | I2S_CLR_RXC,
                                            I2S_CLR_TXC | I2S_CLR_RXC);
@@ -204,7 +206,21 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 
         regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
 
-        mask = I2S_TXCR_IBM_MASK;
+        mask = I2S_CKR_CKP_MASK;
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                val = I2S_CKR_CKP_NEG;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                val = I2S_CKR_CKP_POS;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
+
+        mask = I2S_TXCR_IBM_MASK | I2S_TXCR_TFS_MASK | I2S_TXCR_PBM_MASK;
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_RIGHT_J:
                 val = I2S_TXCR_IBM_RSJM;
@@ -215,13 +231,19 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
         case SND_SOC_DAIFMT_I2S:
                 val = I2S_TXCR_IBM_NORMAL;
                 break;
+        case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+                val = I2S_TXCR_TFS_PCM;
+                break;
+        case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
+                val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
+                break;
         default:
                 return -EINVAL;
         }
 
         regmap_update_bits(i2s->regmap, I2S_TXCR, mask, val);
 
-        mask = I2S_RXCR_IBM_MASK;
+        mask = I2S_RXCR_IBM_MASK | I2S_RXCR_TFS_MASK | I2S_RXCR_PBM_MASK;
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_RIGHT_J:
                 val = I2S_RXCR_IBM_RSJM;
@@ -232,6 +254,12 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
         case SND_SOC_DAIFMT_I2S:
                 val = I2S_RXCR_IBM_NORMAL;
                 break;
+        case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+                val = I2S_RXCR_TFS_PCM;
+                break;
+        case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
+                val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
+                break;
         default:
                 return -EINVAL;
         }
@@ -615,12 +643,13 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
                         goto err_pm_disable;
         }
 
-        soc_dai = devm_kzalloc(&pdev->dev,
+        soc_dai = devm_kmemdup(&pdev->dev, &rockchip_i2s_dai,
                                sizeof(*soc_dai), GFP_KERNEL);
-        if (!soc_dai)
-                return -ENOMEM;
+        if (!soc_dai) {
+                ret = -ENOMEM;
+                goto err_pm_disable;
+        }
 
-        memcpy(soc_dai, &rockchip_i2s_dai, sizeof(*soc_dai));
         if (!of_property_read_u32(node, "rockchip,playback-channels", &val)) {
                 if (val >= 2 && val <= 8)
                         soc_dai->playback.channels_max = val;
diff --git a/sound/soc/rockchip/rockchip_i2s.h b/sound/soc/rockchip/rockchip_i2s.h
index 31f11fd25393..a7b8527d8a73 100644
--- a/sound/soc/rockchip/rockchip_i2s.h
+++ b/sound/soc/rockchip/rockchip_i2s.h
@@ -41,6 +41,7 @@
 #define I2S_TXCR_TFS_SHIFT      5
 #define I2S_TXCR_TFS_I2S        (0 << I2S_TXCR_TFS_SHIFT)
 #define I2S_TXCR_TFS_PCM        (1 << I2S_TXCR_TFS_SHIFT)
+#define I2S_TXCR_TFS_MASK       (1 << I2S_TXCR_TFS_SHIFT)
 #define I2S_TXCR_VDW_SHIFT      0
 #define I2S_TXCR_VDW(x)         ((x - 1) << I2S_TXCR_VDW_SHIFT)
 #define I2S_TXCR_VDW_MASK       (0x1f << I2S_TXCR_VDW_SHIFT)
@@ -70,6 +71,7 @@
 #define I2S_RXCR_TFS_SHIFT      5
 #define I2S_RXCR_TFS_I2S        (0 << I2S_RXCR_TFS_SHIFT)
 #define I2S_RXCR_TFS_PCM        (1 << I2S_RXCR_TFS_SHIFT)
+#define I2S_RXCR_TFS_MASK       (1 << I2S_RXCR_TFS_SHIFT)
 #define I2S_RXCR_VDW_SHIFT      0
 #define I2S_RXCR_VDW(x)         ((x - 1) << I2S_RXCR_VDW_SHIFT)
 #define I2S_RXCR_VDW_MASK       (0x1f << I2S_RXCR_VDW_SHIFT)
@@ -91,6 +93,7 @@
 #define I2S_CKR_CKP_SHIFT       26
 #define I2S_CKR_CKP_NEG         (0 << I2S_CKR_CKP_SHIFT)
 #define I2S_CKR_CKP_POS         (1 << I2S_CKR_CKP_SHIFT)
+#define I2S_CKR_CKP_MASK        (1 << I2S_CKR_CKP_SHIFT)
 #define I2S_CKR_RLP_SHIFT       25
 #define I2S_CKR_RLP_NORMAL      (0 << I2S_CKR_RLP_SHIFT)
 #define I2S_CKR_RLP_OPPSITE     (1 << I2S_CKR_RLP_SHIFT)
diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
new file mode 100644
index 000000000000..c5ddeed97260
--- /dev/null
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -0,0 +1,516 @@
+/*
+ * Rockchip PDM ALSA SoC Digital Audio Interface(DAI)  driver
+ *
+ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <sound/dmaengine_pcm.h>
+#include <sound/pcm_params.h>
+
+#include "rockchip_pdm.h"
+
+#define PDM_DMA_BURST_SIZE      (16) /* size * width: 16*4 = 64 bytes */
+
+struct rk_pdm_dev {
+        struct device *dev;
+        struct clk *clk;
+        struct clk *hclk;
+        struct regmap *regmap;
+        struct snd_dmaengine_dai_dma_data capture_dma_data;
+};
+
+struct rk_pdm_clkref {
+        unsigned int sr;
+        unsigned int clk;
+};
+
+static struct rk_pdm_clkref clkref[] = {
+        { 8000, 40960000 },
+        { 11025, 56448000 },
+        { 12000, 61440000 },
+};
+
+static unsigned int get_pdm_clk(unsigned int sr)
+{
+        unsigned int i, count, clk, div;
+
+        clk = 0;
+        if (!sr)
+                return clk;
+
+        count = ARRAY_SIZE(clkref);
+        for (i = 0; i < count; i++) {
+                if (sr % clkref[i].sr)
+                        continue;
+                div = sr / clkref[i].sr;
+                if ((div & (div - 1)) == 0) {
+                        clk = clkref[i].clk;
+                        break;
+                }
+        }
+
+        return clk;
+}
+
+static inline struct rk_pdm_dev *to_info(struct snd_soc_dai *dai)
+{
+        return snd_soc_dai_get_drvdata(dai);
+}
+
+static void rockchip_pdm_rxctrl(struct rk_pdm_dev *pdm, int on)
+{
+        if (on) {
+                regmap_update_bits(pdm->regmap, PDM_DMA_CTRL,
+                                   PDM_DMA_RD_MSK, PDM_DMA_RD_EN);
+                regmap_update_bits(pdm->regmap, PDM_SYSCONFIG,
+                                   PDM_RX_MASK, PDM_RX_START);
+        } else {
+                regmap_update_bits(pdm->regmap, PDM_DMA_CTRL,
+                                   PDM_DMA_RD_MSK, PDM_DMA_RD_DIS);
+                regmap_update_bits(pdm->regmap, PDM_SYSCONFIG,
+                                   PDM_RX_MASK | PDM_RX_CLR_MASK,
+                                   PDM_RX_STOP | PDM_RX_CLR_WR);
+        }
+}
+
+static int rockchip_pdm_hw_params(struct snd_pcm_substream *substream,
+                                  struct snd_pcm_hw_params *params,
+                                  struct snd_soc_dai *dai)
+{
+        struct rk_pdm_dev *pdm = to_info(dai);
+        unsigned int val = 0;
+        unsigned int clk_rate, clk_div, samplerate;
+        int ret;
+
+        samplerate = params_rate(params);
+        clk_rate = get_pdm_clk(samplerate);
+        if (!clk_rate)
+                return -EINVAL;
+
+        ret = clk_set_rate(pdm->clk, clk_rate);
+        if (ret)
+                return -EINVAL;
+
+        clk_div = DIV_ROUND_CLOSEST(clk_rate, samplerate);
+
+        switch (clk_div) {
+        case 320:
+                val = PDM_CLK_320FS;
+                break;
+        case 640:
+                val = PDM_CLK_640FS;
+                break;
+        case 1280:
+                val = PDM_CLK_1280FS;
+                break;
+        case 2560:
+                val = PDM_CLK_2560FS;
+                break;
+        case 5120:
+                val = PDM_CLK_5120FS;
+                break;
+        default:
+                dev_err(pdm->dev, "unsupported div: %d\n", clk_div);
+                return -EINVAL;
+        }
+
+        regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, PDM_DS_RATIO_MSK, val);
+        regmap_update_bits(pdm->regmap, PDM_HPF_CTRL,
+                           PDM_HPF_CF_MSK, PDM_HPF_60HZ);
+        regmap_update_bits(pdm->regmap, PDM_HPF_CTRL,
+                           PDM_HPF_LE | PDM_HPF_RE, PDM_HPF_LE | PDM_HPF_RE);
+        regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, PDM_CLK_EN, PDM_CLK_EN);
+
+        val = 0;
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_S8:
+                val |= PDM_VDW(8);
+                break;
+        case SNDRV_PCM_FORMAT_S16_LE:
+                val |= PDM_VDW(16);
+                break;
+        case SNDRV_PCM_FORMAT_S20_3LE:
+                val |= PDM_VDW(20);
+                break;
+        case SNDRV_PCM_FORMAT_S24_LE:
+                val |= PDM_VDW(24);
+                break;
+        case SNDRV_PCM_FORMAT_S32_LE:
+                val |= PDM_VDW(32);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (params_channels(params)) {
+        case 8:
+                val |= PDM_PATH3_EN;
+                /* fallthrough */
+        case 6:
+                val |= PDM_PATH2_EN;
+                /* fallthrough */
+        case 4:
+                val |= PDM_PATH1_EN;
+                /* fallthrough */
+        case 2:
+                val |= PDM_PATH0_EN;
+                break;
+        default:
+                dev_err(pdm->dev, "invalid channel: %d\n",
+                        params_channels(params));
+                return -EINVAL;
+        }
+
+        if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
+                regmap_update_bits(pdm->regmap, PDM_CTRL0,
+                                   PDM_PATH_MSK | PDM_VDW_MSK,
+                                   val);
+                regmap_update_bits(pdm->regmap, PDM_DMA_CTRL, PDM_DMA_RDL_MSK,
+                                   PDM_DMA_RDL(16));
+                regmap_update_bits(pdm->regmap, PDM_SYSCONFIG,
+                                   PDM_RX_MASK | PDM_RX_CLR_MASK,
+                                   PDM_RX_STOP | PDM_RX_CLR_WR);
+        }
+
+        return 0;
+}
+
+static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
+                                unsigned int fmt)
+{
+        struct rk_pdm_dev *pdm = to_info(cpu_dai);
+        unsigned int mask = 0, val = 0;
+
+        mask = PDM_CKP_MSK;
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                val = PDM_CKP_NORMAL;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                val = PDM_CKP_INVERTED;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
+
+        return 0;
+}
+
+static int rockchip_pdm_trigger(struct snd_pcm_substream *substream, int cmd,
+                                struct snd_soc_dai *dai)
+{
+        struct rk_pdm_dev *pdm = to_info(dai);
+        int ret = 0;
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        rockchip_pdm_rxctrl(pdm, 1);
+                break;
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        rockchip_pdm_rxctrl(pdm, 0);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        return ret;
+}
+
+static int rockchip_pdm_dai_probe(struct snd_soc_dai *dai)
+{
+        struct rk_pdm_dev *pdm = to_info(dai);
+
+        dai->capture_dma_data = &pdm->capture_dma_data;
+
+        return 0;
+}
+
+static struct snd_soc_dai_ops rockchip_pdm_dai_ops = {
+        .set_fmt = rockchip_pdm_set_fmt,
+        .trigger = rockchip_pdm_trigger,
+        .hw_params = rockchip_pdm_hw_params,
+};
+
+#define ROCKCHIP_PDM_RATES SNDRV_PCM_RATE_8000_192000
+#define ROCKCHIP_PDM_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
+                              SNDRV_PCM_FMTBIT_S20_3LE | \
+                              SNDRV_PCM_FMTBIT_S24_LE | \
+                              SNDRV_PCM_FMTBIT_S32_LE)
+
+static struct snd_soc_dai_driver rockchip_pdm_dai = {
+        .probe = rockchip_pdm_dai_probe,
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 2,
+                .channels_max = 8,
+                .rates = ROCKCHIP_PDM_RATES,
+                .formats = ROCKCHIP_PDM_FORMATS,
+        },
+        .ops = &rockchip_pdm_dai_ops,
+        .symmetric_rates = 1,
+};
+
+static const struct snd_soc_component_driver rockchip_pdm_component = {
+        .name = "rockchip-pdm",
+};
+
+static int rockchip_pdm_runtime_suspend(struct device *dev)
+{
+        struct rk_pdm_dev *pdm = dev_get_drvdata(dev);
+
+        clk_disable_unprepare(pdm->clk);
+        clk_disable_unprepare(pdm->hclk);
+
+        return 0;
+}
+
+static int rockchip_pdm_runtime_resume(struct device *dev)
+{
+        struct rk_pdm_dev *pdm = dev_get_drvdata(dev);
+        int ret;
+
+        ret = clk_prepare_enable(pdm->clk);
+        if (ret) {
+                dev_err(pdm->dev, "clock enable failed %d\n", ret);
+                return ret;
+        }
+
+        ret = clk_prepare_enable(pdm->hclk);
+        if (ret) {
+                dev_err(pdm->dev, "hclock enable failed %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static bool rockchip_pdm_wr_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case PDM_SYSCONFIG:
+        case PDM_CTRL0:
+        case PDM_CTRL1:
+        case PDM_CLK_CTRL:
+        case PDM_HPF_CTRL:
+        case PDM_FIFO_CTRL:
+        case PDM_DMA_CTRL:
+        case PDM_INT_EN:
+        case PDM_INT_CLR:
+        case PDM_DATA_VALID:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rockchip_pdm_rd_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case PDM_SYSCONFIG:
+        case PDM_CTRL0:
+        case PDM_CTRL1:
+        case PDM_CLK_CTRL:
+        case PDM_HPF_CTRL:
+        case PDM_FIFO_CTRL:
+        case PDM_DMA_CTRL:
+        case PDM_INT_EN:
+        case PDM_INT_CLR:
+        case PDM_INT_ST:
+        case PDM_DATA_VALID:
+        case PDM_VERSION:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rockchip_pdm_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case PDM_SYSCONFIG:
+        case PDM_INT_CLR:
+        case PDM_INT_ST:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const struct regmap_config rockchip_pdm_regmap_config = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = PDM_VERSION,
+        .writeable_reg = rockchip_pdm_wr_reg,
+        .readable_reg = rockchip_pdm_rd_reg,
+        .volatile_reg = rockchip_pdm_volatile_reg,
+        .cache_type = REGCACHE_FLAT,
+};
+
+static int rockchip_pdm_probe(struct platform_device *pdev)
+{
+        struct rk_pdm_dev *pdm;
+        struct resource *res;
+        void __iomem *regs;
+        int ret;
+
+        pdm = devm_kzalloc(&pdev->dev, sizeof(*pdm), GFP_KERNEL);
+        if (!pdm)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(regs))
+                return PTR_ERR(regs);
+
+        pdm->regmap = devm_regmap_init_mmio(&pdev->dev, regs,
+                                            &rockchip_pdm_regmap_config);
+        if (IS_ERR(pdm->regmap))
+                return PTR_ERR(pdm->regmap);
+
+        pdm->capture_dma_data.addr = res->start + PDM_RXFIFO_DATA;
+        pdm->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        pdm->capture_dma_data.maxburst = PDM_DMA_BURST_SIZE;
+
+        pdm->dev = &pdev->dev;
+        dev_set_drvdata(&pdev->dev, pdm);
+
+        pdm->clk = devm_clk_get(&pdev->dev, "pdm_clk");
+        if (IS_ERR(pdm->clk))
+                return PTR_ERR(pdm->clk);
+
+        pdm->hclk = devm_clk_get(&pdev->dev, "pdm_hclk");
+        if (IS_ERR(pdm->hclk))
+                return PTR_ERR(pdm->hclk);
+
+        ret = clk_prepare_enable(pdm->hclk);
+        if (ret)
+                return ret;
+
+        pm_runtime_enable(&pdev->dev);
+        if (!pm_runtime_enabled(&pdev->dev)) {
+                ret = rockchip_pdm_runtime_resume(&pdev->dev);
+                if (ret)
+                        goto err_pm_disable;
+        }
+
+        ret = devm_snd_soc_register_component(&pdev->dev,
+                                              &rockchip_pdm_component,
+                                              &rockchip_pdm_dai, 1);
+
+        if (ret) {
+                dev_err(&pdev->dev, "could not register dai: %d\n", ret);
+                goto err_suspend;
+        }
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+        if (ret) {
+                dev_err(&pdev->dev, "could not register pcm: %d\n", ret);
+                goto err_suspend;
+        }
+
+        return 0;
+
+err_suspend:
+        if (!pm_runtime_status_suspended(&pdev->dev))
+                rockchip_pdm_runtime_suspend(&pdev->dev);
+err_pm_disable:
+        pm_runtime_disable(&pdev->dev);
+
+        clk_disable_unprepare(pdm->hclk);
+
+        return ret;
+}
+
+static int rockchip_pdm_remove(struct platform_device *pdev)
+{
+        struct rk_pdm_dev *pdm = dev_get_drvdata(&pdev->dev);
+
+        pm_runtime_disable(&pdev->dev);
+        if (!pm_runtime_status_suspended(&pdev->dev))
+                rockchip_pdm_runtime_suspend(&pdev->dev);
+
+        clk_disable_unprepare(pdm->clk);
+        clk_disable_unprepare(pdm->hclk);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int rockchip_pdm_suspend(struct device *dev)
+{
+        struct rk_pdm_dev *pdm = dev_get_drvdata(dev);
+
+        regcache_mark_dirty(pdm->regmap);
+
+        return 0;
+}
+
+static int rockchip_pdm_resume(struct device *dev)
+{
+        struct rk_pdm_dev *pdm = dev_get_drvdata(dev);
+        int ret;
+
+        ret = pm_runtime_get_sync(dev);
+        if (ret < 0)
+                return ret;
+
+        ret = regcache_sync(pdm->regmap);
+
+        pm_runtime_put(dev);
+
+        return ret;
+}
+#endif
+
+static const struct dev_pm_ops rockchip_pdm_pm_ops = {
+        SET_RUNTIME_PM_OPS(rockchip_pdm_runtime_suspend,
+                           rockchip_pdm_runtime_resume, NULL)
+        SET_SYSTEM_SLEEP_PM_OPS(rockchip_pdm_suspend, rockchip_pdm_resume)
+};
+
+static const struct of_device_id rockchip_pdm_match[] = {
+        { .compatible = "rockchip,pdm", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, rockchip_pdm_match);
+
+static struct platform_driver rockchip_pdm_driver = {
+        .probe  = rockchip_pdm_probe,
+        .remove = rockchip_pdm_remove,
+        .driver = {
+                .name = "rockchip-pdm",
+                .of_match_table = of_match_ptr(rockchip_pdm_match),
+                .pm = &rockchip_pdm_pm_ops,
+        },
+};
+
+module_platform_driver(rockchip_pdm_driver);
+
+MODULE_AUTHOR("Sugar <sugar.zhang@rock-chips.com>");
+MODULE_DESCRIPTION("Rockchip PDM Controller Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/rockchip/rockchip_pdm.h b/sound/soc/rockchip/rockchip_pdm.h
new file mode 100644
index 000000000000..886b48d128fd
--- /dev/null
+++ b/sound/soc/rockchip/rockchip_pdm.h
@@ -0,0 +1,83 @@
+/*
+ * Rockchip PDM ALSA SoC Digital Audio Interface(DAI)  driver
+ *
+ * Copyright (C) 2017 Fuzhou Rockchip Electronics Co., Ltd
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef _ROCKCHIP_PDM_H
+#define _ROCKCHIP_PDM_H
+
+/* PDM REGS */
+#define PDM_SYSCONFIG   (0x0000)
+#define PDM_CTRL0       (0x0004)
+#define PDM_CTRL1       (0x0008)
+#define PDM_CLK_CTRL    (0x000c)
+#define PDM_HPF_CTRL    (0x0010)
+#define PDM_FIFO_CTRL   (0x0014)
+#define PDM_DMA_CTRL    (0x0018)
+#define PDM_INT_EN      (0x001c)
+#define PDM_INT_CLR     (0x0020)
+#define PDM_INT_ST      (0x0024)
+#define PDM_RXFIFO_DATA (0x0030)
+#define PDM_DATA_VALID  (0x0054)
+#define PDM_VERSION     (0x0058)
+
+/* PDM_SYSCONFIG */
+#define PDM_RX_MASK             (0x1 << 2)
+#define PDM_RX_START            (0x1 << 2)
+#define PDM_RX_STOP             (0x0 << 2)
+#define PDM_RX_CLR_MASK         (0x1 << 0)
+#define PDM_RX_CLR_WR           (0x1 << 0)
+#define PDM_RX_CLR_DONE         (0x0 << 0)
+
+/* PDM CTRL0 */
+#define PDM_PATH_MSK            (0xf << 27)
+#define PDM_PATH3_EN            BIT(30)
+#define PDM_PATH2_EN            BIT(29)
+#define PDM_PATH1_EN            BIT(28)
+#define PDM_PATH0_EN            BIT(27)
+#define PDM_HWT_EN              BIT(26)
+#define PDM_VDW_MSK             (0x1f << 0)
+#define PDM_VDW(X)              ((X - 1) << 0)
+
+/* PDM CLK CTRL */
+#define PDM_CLK_MSK             BIT(5)
+#define PDM_CLK_EN              BIT(5)
+#define PDM_CLK_DIS             (0x0 << 5)
+#define PDM_CKP_MSK             BIT(3)
+#define PDM_CKP_NORMAL          (0x0 << 3)
+#define PDM_CKP_INVERTED        BIT(3)
+#define PDM_DS_RATIO_MSK        (0x7 << 0)
+#define PDM_CLK_320FS           (0x0 << 0)
+#define PDM_CLK_640FS           (0x1 << 0)
+#define PDM_CLK_1280FS          (0x2 << 0)
+#define PDM_CLK_2560FS          (0x3 << 0)
+#define PDM_CLK_5120FS          (0x4 << 0)
+
+/* PDM HPF CTRL */
+#define PDM_HPF_LE              BIT(3)
+#define PDM_HPF_RE              BIT(2)
+#define PDM_HPF_CF_MSK          (0x3 << 0)
+#define PDM_HPF_3P79HZ          (0x0 << 0)
+#define PDM_HPF_60HZ            (0x1 << 0)
+#define PDM_HPF_243HZ           (0x2 << 0)
+#define PDM_HPF_493HZ           (0x3 << 0)
+
+/* PDM DMA CTRL */
+#define PDM_DMA_RD_MSK          BIT(8)
+#define PDM_DMA_RD_EN           BIT(8)
+#define PDM_DMA_RD_DIS          (0x0 << 8)
+#define PDM_DMA_RDL_MSK         (0x7f << 0)
+#define PDM_DMA_RDL(X)          ((X - 1) << 0)
+
+#endif /* _ROCKCHIP_PDM_H */
diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
index fa8101d1e16f..ee5055d47d13 100644
--- a/sound/soc/rockchip/rockchip_spdif.c
+++ b/sound/soc/rockchip/rockchip_spdif.c
@@ -49,8 +49,12 @@ static const struct of_device_id rk_spdif_match[] = {
           .data = (void *)RK_SPDIF_RK3066 },
         { .compatible = "rockchip,rk3188-spdif",
           .data = (void *)RK_SPDIF_RK3188 },
+        { .compatible = "rockchip,rk3228-spdif",
+          .data = (void *)RK_SPDIF_RK3366 },
         { .compatible = "rockchip,rk3288-spdif",
           .data = (void *)RK_SPDIF_RK3288 },
+        { .compatible = "rockchip,rk3328-spdif",
+          .data = (void *)RK_SPDIF_RK3366 },
         { .compatible = "rockchip,rk3366-spdif",
           .data = (void *)RK_SPDIF_RK3366 },
         { .compatible = "rockchip,rk3368-spdif",
diff --git a/sound/soc/samsung/s3c24xx_uda134x.c b/sound/soc/samsung/s3c24xx_uda134x.c
index 81a78940967c..55538e333cc8 100644
--- a/sound/soc/samsung/s3c24xx_uda134x.c
+++ b/sound/soc/samsung/s3c24xx_uda134x.c
@@ -44,7 +44,7 @@ struct s3c24xx_uda134x {
 
 static unsigned int rates[33 * 2];
 #ifdef ENFORCE_RATES
-static struct snd_pcm_hw_constraint_list hw_constraints_rates = {
+static const struct snd_pcm_hw_constraint_list hw_constraints_rates = {
         .count  = ARRAY_SIZE(rates),
         .list   = rates,
         .mask   = 0,
diff --git a/sound/soc/sh/Kconfig b/sound/soc/sh/Kconfig
index 147ebecfed94..1aa5cd77ca24 100644
--- a/sound/soc/sh/Kconfig
+++ b/sound/soc/sh/Kconfig
@@ -38,7 +38,7 @@ config SND_SOC_RCAR
         tristate "R-Car series SRU/SCU/SSIU/SSI support"
         depends on COMMON_CLK
         depends on OF || COMPILE_TEST
-        select SND_SIMPLE_CARD
+        select SND_SIMPLE_CARD_UTILS
         select REGMAP_MMIO
         help
           This option enables R-Car SRU/SCU/SSIU/SSI sound support
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index ead520182e26..7c4bdd82bb95 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -301,7 +301,12 @@ struct fsi_master {
         spinlock_t lock;
 };
 
-static int fsi_stream_is_play(struct fsi_priv *fsi, struct fsi_stream *io);
+static inline int fsi_stream_is_play(struct fsi_priv *fsi,
+                                     struct fsi_stream *io)
+{
+        return &fsi->playback == io;
+}
+
 
 /*
  *              basic read write function
@@ -489,12 +494,6 @@ static void fsi_count_fifo_err(struct fsi_priv *fsi)
 /*
  *              fsi_stream_xx() function
  */
-static inline int fsi_stream_is_play(struct fsi_priv *fsi,
-                                     struct fsi_stream *io)
-{
-        return &fsi->playback == io;
-}
-
 static inline struct fsi_stream *fsi_stream_get(struct fsi_priv *fsi,
                                         struct snd_pcm_substream *substream)
 {
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index d3b0dc145a56..197cb3ec075f 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -308,23 +308,12 @@ static void rsnd_adg_set_ssi_clk(struct rsnd_mod *ssi_mod, u32 val)
         }
 }
 
-int rsnd_adg_ssi_clk_stop(struct rsnd_mod *ssi_mod)
-{
-        rsnd_adg_set_ssi_clk(ssi_mod, 0);
-
-        return 0;
-}
-
-int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *ssi_mod, unsigned int rate)
+int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate)
 {
-        struct rsnd_priv *priv = rsnd_mod_to_priv(ssi_mod);
         struct rsnd_adg *adg = rsnd_priv_to_adg(priv);
         struct device *dev = rsnd_priv_to_dev(priv);
-        struct rsnd_mod *adg_mod = rsnd_mod_get(adg);
         struct clk *clk;
         int i;
-        u32 data;
-        u32 ckr = 0;
         int sel_table[] = {
                 [CLKA] = 0x1,
                 [CLKB] = 0x2,
@@ -338,30 +327,42 @@ int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *ssi_mod, unsigned int rate)
          * find suitable clock from
          * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI.
          */
-        data = 0;
         for_each_rsnd_clk(clk, adg, i) {
-                if (rate == clk_get_rate(clk)) {
-                        data = sel_table[i];
-                        goto found_clock;
-                }
+                if (rate == clk_get_rate(clk))
+                        return sel_table[i];
         }
 
         /*
          * find divided clock from BRGA/BRGB
          */
-        if (rate  == adg->rbga_rate_for_441khz) {
-                data = 0x10;
-                goto found_clock;
-        }
+        if (rate == adg->rbga_rate_for_441khz)
+                return 0x10;
 
-        if (rate == adg->rbgb_rate_for_48khz) {
-                data = 0x20;
-                goto found_clock;
-        }
+        if (rate == adg->rbgb_rate_for_48khz)
+                return 0x20;
 
         return -EIO;
+}
 
-found_clock:
+int rsnd_adg_ssi_clk_stop(struct rsnd_mod *ssi_mod)
+{
+        rsnd_adg_set_ssi_clk(ssi_mod, 0);
+
+        return 0;
+}
+
+int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *ssi_mod, unsigned int rate)
+{
+        struct rsnd_priv *priv = rsnd_mod_to_priv(ssi_mod);
+        struct rsnd_adg *adg = rsnd_priv_to_adg(priv);
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct rsnd_mod *adg_mod = rsnd_mod_get(adg);
+        int data;
+        u32 ckr = 0;
+
+        data = rsnd_adg_clk_query(priv, rate);
+        if (data < 0)
+                return data;
 
         rsnd_adg_set_ssi_clk(ssi_mod, data);
 
@@ -480,6 +481,9 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
         if (req_rate[0] % 48000 == 0)
                 adg->flags = AUDIO_OUT_48;
 
+        if (of_get_property(np, "clkout-lr-asynchronous", NULL))
+                adg->flags = LRCLK_ASYNC;
+
         /*
          * This driver is assuming that AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC
          * have 44.1kHz or 48kHz base clocks for now.
@@ -555,7 +559,6 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                         clk = clk_register_fixed_rate(dev, clkout_name[i],
                                                       parent_clk_name, 0,
                                                       req_rate[0]);
-                        adg->clkout[i] = ERR_PTR(-ENOENT);
                         if (!IS_ERR(clk))
                                 adg->clkout[i] = clk;
                 }
@@ -580,7 +583,6 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
 {
         struct rsnd_adg *adg;
         struct device *dev = rsnd_priv_to_dev(priv);
-        struct device_node *np = dev->of_node;
         int ret;
 
         adg = devm_kzalloc(dev, sizeof(*adg), GFP_KERNEL);
@@ -597,9 +599,6 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
         rsnd_adg_get_clkin(priv, adg);
         rsnd_adg_get_clkout(priv, adg);
 
-        if (of_get_property(np, "clkout-lr-asynchronous", NULL))
-                adg->flags = LRCLK_ASYNC;
-
         priv->adg = adg;
 
         rsnd_adg_clk_enable(priv);
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index d879c010cf03..f1d4fb566892 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -31,7 +31,7 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         struct rsnd_mod *mix = rsnd_io_to_mod_mix(io);
         struct device *dev = rsnd_priv_to_dev(priv);
         u32 data;
-        u32 path[] = {
+        static const u32 path[] = {
                 [1] = 1 << 0,
                 [5] = 1 << 8,
                 [6] = 1 << 12,
@@ -71,7 +71,7 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         } else {
                 struct rsnd_mod *src = rsnd_io_to_mod_src(io);
 
-                u8 cmd_case[] = {
+                static const u8 cmd_case[] = {
                         [0] = 0x3,
                         [1] = 0x3,
                         [2] = 0x4,
@@ -82,6 +82,9 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
                         [9] = 0x2,
                 };
 
+                if (unlikely(!src))
+                        return -EIO;
+
                 data = path[rsnd_mod_id(src)] |
                         cmd_case[rsnd_mod_id(src)] << 16;
         }
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 8c1f4e2e0c4f..3f2ced26ed37 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -203,27 +203,6 @@ int rsnd_io_is_working(struct rsnd_dai_stream *io)
         return !!io->substream;
 }
 
-void rsnd_set_slot(struct rsnd_dai *rdai,
-                   int slots, int num)
-{
-        rdai->slots     = slots;
-        rdai->slots_num = num;
-}
-
-int rsnd_get_slot(struct rsnd_dai_stream *io)
-{
-        struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
-
-        return rdai->slots;
-}
-
-int rsnd_get_slot_num(struct rsnd_dai_stream *io)
-{
-        struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
-
-        return rdai->slots_num;
-}
-
 int rsnd_runtime_channel_original(struct rsnd_dai_stream *io)
 {
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
@@ -248,13 +227,14 @@ int rsnd_runtime_channel_after_ctu(struct rsnd_dai_stream *io)
 
 int rsnd_runtime_channel_for_ssi(struct rsnd_dai_stream *io)
 {
+        struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
         int chan = rsnd_io_is_play(io) ?
                 rsnd_runtime_channel_after_ctu(io) :
                 rsnd_runtime_channel_original(io);
 
         /* Use Multi SSI */
         if (rsnd_runtime_is_ssi_multi(io))
-                chan /= rsnd_get_slot_num(io);
+                chan /= rsnd_rdai_ssi_lane_get(rdai);
 
         /* TDM Extend Mode needs 8ch */
         if (chan == 6)
@@ -265,12 +245,13 @@ int rsnd_runtime_channel_for_ssi(struct rsnd_dai_stream *io)
 
 int rsnd_runtime_is_ssi_multi(struct rsnd_dai_stream *io)
 {
-        int slots = rsnd_get_slot_num(io);
+        struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
+        int lane = rsnd_rdai_ssi_lane_get(rdai);
         int chan = rsnd_io_is_play(io) ?
                 rsnd_runtime_channel_after_ctu(io) :
                 rsnd_runtime_channel_original(io);
 
-        return (chan >= 6) && (slots > 1);
+        return (chan > 2) && (lane > 1);
 }
 
 int rsnd_runtime_is_ssi_tdm(struct rsnd_dai_stream *io)
@@ -310,6 +291,24 @@ u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io)
         u32 val = 0x76543210;
         u32 mask = ~0;
 
+        /*
+         * *Hardware* L/R and *Software* L/R are inverted.
+         * We need to care about inversion timing to control
+         * Playback/Capture correctly.
+         * The point is [DVC] needs *Hardware* L/R, [MEM] needs *Software* L/R
+         *
+         * sL/R : software L/R
+         * hL/R : hardware L/R
+         * (*)  : conversion timing
+         *
+         * Playback
+         *           sL/R (*) hL/R     hL/R     hL/R      hL/R     hL/R
+         *      [MEM] -> [SRC] -> [DVC] -> [CMD] -> [SSIU] -> [SSI] -> codec
+         *
+         * Capture
+         *           hL/R     hL/R      hL/R     hL/R     hL/R (*) sL/R
+         *      codec -> [SSI] -> [SSIU] -> [SRC] -> [DVC] -> [CMD] -> [MEM]
+         */
         if (rsnd_io_is_play(io)) {
                 struct rsnd_mod *src = rsnd_io_to_mod_src(io);
 
@@ -470,8 +469,7 @@ static int rsnd_status_update(u32 *status,
 
 #define rsnd_dai_call(fn, io, param...)                                 \
 ({                                                                      \
-        struct rsnd_priv *priv = rsnd_io_to_priv(io);                   \
-        struct device *dev = rsnd_priv_to_dev(priv);                    \
+        struct device *dev = rsnd_priv_to_dev(rsnd_io_to_priv(io));     \
         struct rsnd_mod *mod;                                           \
         int is_play = rsnd_io_is_play(io);                              \
         int ret = 0, i;                                                 \
@@ -532,6 +530,24 @@ static void rsnd_dai_disconnect(struct rsnd_mod *mod,
         io->mod[type] = NULL;
 }
 
+int rsnd_rdai_channels_ctrl(struct rsnd_dai *rdai,
+                            int max_channels)
+{
+        if (max_channels > 0)
+                rdai->max_channels = max_channels;
+
+        return rdai->max_channels;
+}
+
+int rsnd_rdai_ssi_lane_ctrl(struct rsnd_dai *rdai,
+                            int ssi_lane)
+{
+        if (ssi_lane > 0)
+                rdai->ssi_lane = ssi_lane;
+
+        return rdai->ssi_lane;
+}
+
 struct rsnd_dai *rsnd_rdai_get(struct rsnd_priv *priv, int id)
 {
         if ((id < 0) || (id >= rsnd_rdai_nr(priv)))
@@ -551,40 +567,6 @@ static struct rsnd_dai *rsnd_dai_to_rdai(struct snd_soc_dai *dai)
 /*
  *      rsnd_soc_dai functions
  */
-int rsnd_dai_pointer_offset(struct rsnd_dai_stream *io, int additional)
-{
-        struct snd_pcm_substream *substream = io->substream;
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        int pos = io->byte_pos + additional;
-
-        pos %= (runtime->periods * io->byte_per_period);
-
-        return pos;
-}
-
-bool rsnd_dai_pointer_update(struct rsnd_dai_stream *io, int byte)
-{
-        io->byte_pos += byte;
-
-        if (io->byte_pos >= io->next_period_byte) {
-                struct snd_pcm_substream *substream = io->substream;
-                struct snd_pcm_runtime *runtime = substream->runtime;
-
-                io->period_pos++;
-                io->next_period_byte += io->byte_per_period;
-
-                if (io->period_pos >= runtime->periods) {
-                        io->byte_pos = 0;
-                        io->period_pos = 0;
-                        io->next_period_byte = io->byte_per_period;
-                }
-
-                return true;
-        }
-
-        return false;
-}
-
 void rsnd_dai_period_elapsed(struct rsnd_dai_stream *io)
 {
         struct snd_pcm_substream *substream = io->substream;
@@ -602,15 +584,7 @@ void rsnd_dai_period_elapsed(struct rsnd_dai_stream *io)
 static void rsnd_dai_stream_init(struct rsnd_dai_stream *io,
                                 struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime = substream->runtime;
-
         io->substream           = substream;
-        io->byte_pos            = 0;
-        io->period_pos          = 0;
-        io->byte_per_period     = runtime->period_size *
-                                  runtime->channels *
-                                  samples_to_bytes(runtime, 1);
-        io->next_period_byte    = io->byte_per_period;
 }
 
 static void rsnd_dai_stream_quit(struct rsnd_dai_stream *io)
@@ -749,9 +723,13 @@ static int rsnd_soc_set_dai_tdm_slot(struct snd_soc_dai *dai,
         struct device *dev = rsnd_priv_to_dev(priv);
 
         switch (slots) {
+        case 2:
         case 6:
+        case 8:
+        case 16:
                 /* TDM Extend Mode */
-                rsnd_set_slot(rdai, slots, 1);
+                rsnd_rdai_channels_set(rdai, slots);
+                rsnd_rdai_ssi_lane_set(rdai, 1);
                 break;
         default:
                 dev_err(dev, "unsupported TDM slots (%d)\n", slots);
@@ -761,22 +739,177 @@ static int rsnd_soc_set_dai_tdm_slot(struct snd_soc_dai *dai,
         return 0;
 }
 
+static unsigned int rsnd_soc_hw_channels_list[] = {
+        2, 6, 8, 16,
+};
+
+static unsigned int rsnd_soc_hw_rate_list[] = {
+          8000,
+         11025,
+         16000,
+         22050,
+         32000,
+         44100,
+         48000,
+         64000,
+         88200,
+         96000,
+        176400,
+        192000,
+};
+
+static int rsnd_soc_hw_rule(struct rsnd_priv *priv,
+                            unsigned int *list, int list_num,
+                            struct snd_interval *baseline, struct snd_interval *iv)
+{
+        struct snd_interval p;
+        unsigned int rate;
+        int i;
+
+        snd_interval_any(&p);
+        p.min = UINT_MAX;
+        p.max = 0;
+
+        for (i = 0; i < list_num; i++) {
+
+                if (!snd_interval_test(iv, list[i]))
+                        continue;
+
+                rate = rsnd_ssi_clk_query(priv,
+                                          baseline->min, list[i], NULL);
+                if (rate > 0) {
+                        p.min = min(p.min, list[i]);
+                        p.max = max(p.max, list[i]);
+                }
+
+                rate = rsnd_ssi_clk_query(priv,
+                                          baseline->max, list[i], NULL);
+                if (rate > 0) {
+                        p.min = min(p.min, list[i]);
+                        p.max = max(p.max, list[i]);
+                }
+        }
+
+        return snd_interval_refine(iv, &p);
+}
+
+static int rsnd_soc_hw_rule_rate(struct snd_pcm_hw_params *params,
+                                 struct snd_pcm_hw_rule *rule)
+{
+        struct snd_interval *ic_ = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
+        struct snd_interval *ir = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval ic;
+        struct snd_soc_dai *dai = rule->private;
+        struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
+        struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai);
+
+        /*
+         * possible sampling rate limitation is same as
+         * 2ch if it supports multi ssi
+         */
+        ic = *ic_;
+        if (1 < rsnd_rdai_ssi_lane_get(rdai)) {
+                ic.min = 2;
+                ic.max = 2;
+        }
+
+        return rsnd_soc_hw_rule(priv, rsnd_soc_hw_rate_list,
+                                ARRAY_SIZE(rsnd_soc_hw_rate_list),
+                                &ic, ir);
+}
+
+
+static int rsnd_soc_hw_rule_channels(struct snd_pcm_hw_params *params,
+                                     struct snd_pcm_hw_rule *rule)
+{
+        struct snd_interval *ic_ = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
+        struct snd_interval *ir = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval ic;
+        struct snd_soc_dai *dai = rule->private;
+        struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
+        struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai);
+
+        /*
+         * possible sampling rate limitation is same as
+         * 2ch if it supports multi ssi
+         */
+        ic = *ic_;
+        if (1 < rsnd_rdai_ssi_lane_get(rdai)) {
+                ic.min = 2;
+                ic.max = 2;
+        }
+
+        return rsnd_soc_hw_rule(priv, rsnd_soc_hw_channels_list,
+                                ARRAY_SIZE(rsnd_soc_hw_channels_list),
+                                ir, &ic);
+}
+
+static void rsnd_soc_hw_constraint(struct snd_pcm_runtime *runtime,
+                                   struct snd_soc_dai *dai)
+{
+        struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
+        struct snd_pcm_hw_constraint_list *constraint = &rdai->constraint;
+        unsigned int max_channels = rsnd_rdai_channels_get(rdai);
+        int i;
+
+        /*
+         * Channel Limitation
+         * It depends on Platform design
+         */
+        constraint->list        = rsnd_soc_hw_channels_list;
+        constraint->count       = 0;
+        constraint->mask        = 0;
+
+        for (i = 0; i < ARRAY_SIZE(rsnd_soc_hw_channels_list); i++) {
+                if (rsnd_soc_hw_channels_list[i] > max_channels)
+                        break;
+                constraint->count = i + 1;
+        }
+
+        snd_pcm_hw_constraint_list(runtime, 0,
+                                   SNDRV_PCM_HW_PARAM_CHANNELS, constraint);
+
+        /*
+         * Sampling Rate / Channel Limitation
+         * It depends on Clock Master Mode
+         */
+        if (!rsnd_rdai_is_clk_master(rdai))
+                return;
+
+        snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
+                            rsnd_soc_hw_rule_rate, dai,
+                            SNDRV_PCM_HW_PARAM_CHANNELS, -1);
+        snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                            rsnd_soc_hw_rule_channels, dai,
+                            SNDRV_PCM_HW_PARAM_RATE, -1);
+}
+
 static int rsnd_soc_dai_startup(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai)
 {
         struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
+        struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai);
         struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream);
+        int ret;
+
+        /* rsnd_io_to_runtime() is not yet enabled here */
+        rsnd_soc_hw_constraint(substream->runtime, dai);
 
         /*
          * call rsnd_dai_call without spinlock
          */
-        return rsnd_dai_call(nolock_start, io, priv);
+        ret = rsnd_dai_call(nolock_start, io, priv);
+        if (ret < 0)
+                rsnd_dai_call(nolock_stop, io, priv);
+
+        return ret;
 }
 
 static void rsnd_soc_dai_shutdown(struct snd_pcm_substream *substream,
                                   struct snd_soc_dai *dai)
 {
         struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
+        struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai);
         struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream);
 
         /*
@@ -820,32 +953,132 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai,
         of_node_put(node);
 }
 
-static int rsnd_dai_probe(struct rsnd_priv *priv)
+static struct device_node *rsnd_dai_of_node(struct rsnd_priv *priv,
+                                            int *is_graph)
 {
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct device_node *np = dev->of_node;
         struct device_node *dai_node;
-        struct device_node *dai_np;
+        struct device_node *ret;
+
+        *is_graph = 0;
+
+        /*
+         * parse both previous dai (= rcar_sound,dai), and
+         * graph dai (= ports/port)
+         */
+        dai_node = of_get_child_by_name(np, RSND_NODE_DAI);
+        if (dai_node) {
+                ret = dai_node;
+                goto of_node_compatible;
+        }
+
+        ret = np;
+
+        dai_node = of_graph_get_next_endpoint(np, NULL);
+        if (dai_node)
+                goto of_node_graph;
+
+        return NULL;
+
+of_node_graph:
+        *is_graph = 1;
+of_node_compatible:
+        of_node_put(dai_node);
+
+        return ret;
+}
+
+static void __rsnd_dai_probe(struct rsnd_priv *priv,
+                             struct device_node *dai_np,
+                             int dai_i, int is_graph)
+{
         struct device_node *playback, *capture;
         struct rsnd_dai_stream *io_playback;
         struct rsnd_dai_stream *io_capture;
-        struct snd_soc_dai_driver *rdrv, *drv;
+        struct snd_soc_dai_driver *drv;
         struct rsnd_dai *rdai;
         struct device *dev = rsnd_priv_to_dev(priv);
-        int nr, dai_i, io_i;
-        int ret;
+        int io_i;
+
+        rdai            = rsnd_rdai_get(priv, dai_i);
+        drv             = priv->daidrv + dai_i;
+        io_playback     = &rdai->playback;
+        io_capture      = &rdai->capture;
+
+        snprintf(rdai->name, RSND_DAI_NAME_SIZE, "rsnd-dai.%d", dai_i);
+
+        rdai->priv      = priv;
+        drv->name       = rdai->name;
+        drv->ops        = &rsnd_soc_dai_ops;
+
+        snprintf(rdai->playback.name, RSND_DAI_NAME_SIZE,
+                 "DAI%d Playback", dai_i);
+        drv->playback.rates             = RSND_RATES;
+        drv->playback.formats           = RSND_FMTS;
+        drv->playback.channels_min      = 2;
+        drv->playback.channels_max      = 16;
+        drv->playback.stream_name       = rdai->playback.name;
+
+        snprintf(rdai->capture.name, RSND_DAI_NAME_SIZE,
+                 "DAI%d Capture", dai_i);
+        drv->capture.rates              = RSND_RATES;
+        drv->capture.formats            = RSND_FMTS;
+        drv->capture.channels_min       = 2;
+        drv->capture.channels_max       = 16;
+        drv->capture.stream_name        = rdai->capture.name;
+
+        rdai->playback.rdai             = rdai;
+        rdai->capture.rdai              = rdai;
+        rsnd_rdai_channels_set(rdai, 2); /* default 2ch */
+        rsnd_rdai_ssi_lane_set(rdai, 1); /* default 1lane */
+
+        for (io_i = 0;; io_i++) {
+                playback = of_parse_phandle(dai_np, "playback", io_i);
+                capture  = of_parse_phandle(dai_np, "capture", io_i);
+
+                if (!playback && !capture)
+                        break;
 
-        dai_node = rsnd_dai_of_node(priv);
-        nr = of_get_child_count(dai_node);
-        if (!nr) {
-                ret = -EINVAL;
-                goto rsnd_dai_probe_done;
+                rsnd_parse_connect_ssi(rdai, playback, capture);
+                rsnd_parse_connect_src(rdai, playback, capture);
+                rsnd_parse_connect_ctu(rdai, playback, capture);
+                rsnd_parse_connect_mix(rdai, playback, capture);
+                rsnd_parse_connect_dvc(rdai, playback, capture);
+
+                of_node_put(playback);
+                of_node_put(capture);
         }
 
+        dev_dbg(dev, "%s (%s/%s)\n", rdai->name,
+                rsnd_io_to_mod_ssi(io_playback) ? "play"    : " -- ",
+                rsnd_io_to_mod_ssi(io_capture) ? "capture" : "  --   ");
+}
+
+static int rsnd_dai_probe(struct rsnd_priv *priv)
+{
+        struct device_node *dai_node;
+        struct device_node *dai_np;
+        struct snd_soc_dai_driver *rdrv;
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct rsnd_dai *rdai;
+        int nr;
+        int is_graph;
+        int dai_i;
+
+        dai_node = rsnd_dai_of_node(priv, &is_graph);
+        if (is_graph)
+                nr = of_graph_get_endpoint_count(dai_node);
+        else
+                nr = of_get_child_count(dai_node);
+
+        if (!nr)
+                return -EINVAL;
+
         rdrv = devm_kzalloc(dev, sizeof(*rdrv) * nr, GFP_KERNEL);
         rdai = devm_kzalloc(dev, sizeof(*rdai) * nr, GFP_KERNEL);
-        if (!rdrv || !rdai) {
-                ret = -ENOMEM;
-                goto rsnd_dai_probe_done;
-        }
+        if (!rdrv || !rdai)
+                return -ENOMEM;
 
         priv->rdai_nr   = nr;
         priv->daidrv    = rdrv;
@@ -855,68 +1088,18 @@ static int rsnd_dai_probe(struct rsnd_priv *priv)
          * parse all dai
          */
         dai_i = 0;
-        for_each_child_of_node(dai_node, dai_np) {
-                rdai            = rsnd_rdai_get(priv, dai_i);
-                drv             = rdrv + dai_i;
-                io_playback     = &rdai->playback;
-                io_capture      = &rdai->capture;
-
-                snprintf(rdai->name, RSND_DAI_NAME_SIZE, "rsnd-dai.%d", dai_i);
-
-                rdai->priv      = priv;
-                drv->name       = rdai->name;
-                drv->ops        = &rsnd_soc_dai_ops;
-
-                snprintf(rdai->playback.name, RSND_DAI_NAME_SIZE,
-                         "DAI%d Playback", dai_i);
-                drv->playback.rates             = RSND_RATES;
-                drv->playback.formats           = RSND_FMTS;
-                drv->playback.channels_min      = 2;
-                drv->playback.channels_max      = 6;
-                drv->playback.stream_name       = rdai->playback.name;
-
-                snprintf(rdai->capture.name, RSND_DAI_NAME_SIZE,
-                         "DAI%d Capture", dai_i);
-                drv->capture.rates              = RSND_RATES;
-                drv->capture.formats            = RSND_FMTS;
-                drv->capture.channels_min       = 2;
-                drv->capture.channels_max       = 6;
-                drv->capture.stream_name        = rdai->capture.name;
-
-                rdai->playback.rdai             = rdai;
-                rdai->capture.rdai              = rdai;
-                rsnd_set_slot(rdai, 2, 1); /* default */
-
-                for (io_i = 0;; io_i++) {
-                        playback = of_parse_phandle(dai_np, "playback", io_i);
-                        capture  = of_parse_phandle(dai_np, "capture", io_i);
-
-                        if (!playback && !capture)
-                                break;
-
-                        rsnd_parse_connect_ssi(rdai, playback, capture);
-                        rsnd_parse_connect_src(rdai, playback, capture);
-                        rsnd_parse_connect_ctu(rdai, playback, capture);
-                        rsnd_parse_connect_mix(rdai, playback, capture);
-                        rsnd_parse_connect_dvc(rdai, playback, capture);
-
-                        of_node_put(playback);
-                        of_node_put(capture);
+        if (is_graph) {
+                for_each_endpoint_of_node(dai_node, dai_np) {
+                        __rsnd_dai_probe(priv, dai_np, dai_i, is_graph);
+                        rsnd_ssi_parse_hdmi_connection(priv, dai_np, dai_i);
+                        dai_i++;
                 }
-
-                dai_i++;
-
-                dev_dbg(dev, "%s (%s/%s)\n", rdai->name,
-                        rsnd_io_to_mod_ssi(io_playback) ? "play"    : " -- ",
-                        rsnd_io_to_mod_ssi(io_capture) ? "capture" : "  --   ");
+        } else {
+                for_each_child_of_node(dai_node, dai_np)
+                        __rsnd_dai_probe(priv, dai_np, dai_i++, is_graph);
         }
 
-        ret = 0;
-
-rsnd_dai_probe_done:
-        of_node_put(dai_node);
-
-        return ret;
+        return 0;
 }
 
 /*
@@ -965,12 +1148,14 @@ static int rsnd_hw_params(struct snd_pcm_substream *substream,
 
 static snd_pcm_uframes_t rsnd_pointer(struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime = substream->runtime;
         struct snd_soc_dai *dai = rsnd_substream_to_dai(substream);
         struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
         struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream);
+        snd_pcm_uframes_t pointer = 0;
+
+        rsnd_dai_call(pointer, io, &pointer);
 
-        return bytes_to_frames(runtime, io->byte_pos);
+        return pointer;
 }
 
 static struct snd_pcm_ops rsnd_pcm_ops = {
@@ -1033,6 +1218,9 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl,
         struct rsnd_kctrl_cfg *cfg = kcontrol_to_cfg(kctrl);
         int i, change = 0;
 
+        if (!cfg->accept(cfg->io))
+                return 0;
+
         for (i = 0; i < cfg->size; i++) {
                 if (cfg->texts) {
                         change |= (uc->value.enumerated.item[i] != cfg->val[i]);
@@ -1049,6 +1237,18 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl,
         return change;
 }
 
+int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io)
+{
+        return 1;
+}
+
+int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io)
+{
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+        return !!runtime;
+}
+
 struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg)
 {
         cfg->cfg.val = cfg->val;
@@ -1067,6 +1267,7 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
                    struct rsnd_dai_stream *io,
                    struct snd_soc_pcm_runtime *rtd,
                    const unsigned char *name,
+                   int (*accept)(struct rsnd_dai_stream *io),
                    void (*update)(struct rsnd_dai_stream *io,
                                   struct rsnd_mod *mod),
                    struct rsnd_kctrl_cfg *cfg,
@@ -1101,6 +1302,7 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
         cfg->texts      = texts;
         cfg->max        = max;
         cfg->size       = size;
+        cfg->accept     = accept;
         cfg->update     = update;
         cfg->card       = card;
         cfg->kctrl      = kctrl;
@@ -1332,7 +1534,7 @@ static int rsnd_resume(struct device *dev)
         return 0;
 }
 
-static struct dev_pm_ops rsnd_pm_ops = {
+static const struct dev_pm_ops rsnd_pm_ops = {
         .suspend                = rsnd_suspend,
         .resume                 = rsnd_resume,
 };
diff --git a/sound/soc/sh/rcar/ctu.c b/sound/soc/sh/rcar/ctu.c
index 9dcc1f9db026..4ba8f2fe7a4c 100644
--- a/sound/soc/sh/rcar/ctu.c
+++ b/sound/soc/sh/rcar/ctu.c
@@ -279,12 +279,14 @@ static int rsnd_ctu_pcm_new(struct rsnd_mod *mod,
 
         /* CTU Pass */
         ret = rsnd_kctrl_new_m(mod, io, rtd, "CTU Pass",
+                               rsnd_kctrl_accept_anytime,
                                NULL,
                                &ctu->pass, RSND_MAX_CHANNELS,
                                0xC);
 
         /* ROW0 */
         ret = rsnd_kctrl_new_m(mod, io, rtd, "CTU SV0",
+                               rsnd_kctrl_accept_anytime,
                                NULL,
                                &ctu->sv0, RSND_MAX_CHANNELS,
                                0x00FFFFFF);
@@ -293,6 +295,7 @@ static int rsnd_ctu_pcm_new(struct rsnd_mod *mod,
 
         /* ROW1 */
         ret = rsnd_kctrl_new_m(mod, io, rtd, "CTU SV1",
+                               rsnd_kctrl_accept_anytime,
                                NULL,
                                &ctu->sv1, RSND_MAX_CHANNELS,
                                0x00FFFFFF);
@@ -301,6 +304,7 @@ static int rsnd_ctu_pcm_new(struct rsnd_mod *mod,
 
         /* ROW2 */
         ret = rsnd_kctrl_new_m(mod, io, rtd, "CTU SV2",
+                               rsnd_kctrl_accept_anytime,
                                NULL,
                                &ctu->sv2, RSND_MAX_CHANNELS,
                                0x00FFFFFF);
@@ -309,6 +313,7 @@ static int rsnd_ctu_pcm_new(struct rsnd_mod *mod,
 
         /* ROW3 */
         ret = rsnd_kctrl_new_m(mod, io, rtd, "CTU SV3",
+                               rsnd_kctrl_accept_anytime,
                                NULL,
                                &ctu->sv3, RSND_MAX_CHANNELS,
                                0x00FFFFFF);
@@ -317,6 +322,7 @@ static int rsnd_ctu_pcm_new(struct rsnd_mod *mod,
 
         /* Reset */
         ret = rsnd_kctrl_new_s(mod, io, rtd, "CTU Reset",
+                               rsnd_kctrl_accept_anytime,
                                rsnd_ctu_value_reset,
                                &ctu->reset, 1);
 
diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c
index 241cb3b08a07..60aa5e96a49f 100644
--- a/sound/soc/sh/rcar/dma.c
+++ b/sound/soc/sh/rcar/dma.c
@@ -25,6 +25,7 @@
 
 struct rsnd_dmaen {
         struct dma_chan         *chan;
+        dma_cookie_t            cookie;
         dma_addr_t              dma_buf;
         unsigned int            dma_len;
         unsigned int            dma_period;
@@ -103,10 +104,6 @@ static void __rsnd_dmaen_complete(struct rsnd_mod *mod,
          * In Gen2 case, it are Audio-DMAC, and Audio-DMAC-peri-peri.
          * But, Audio-DMAC-peri-peri doesn't have interrupt,
          * and this driver is assuming that here.
-         *
-         * If Audio-DMAC-peri-peri has interrpt,
-         * rsnd_dai_pointer_update() will be called twice,
-         * ant it will breaks io->byte_pos
          */
         spin_lock_irqsave(&priv->lock, flags);
 
@@ -121,7 +118,7 @@ static void __rsnd_dmaen_complete(struct rsnd_mod *mod,
                  */
                 rsnd_dmaen_sync(dmaen, io, dmaen->dma_cnt + 2);
 
-                elapsed = rsnd_dai_pointer_update(io, io->byte_per_period);
+                elapsed = true;
 
                 dmaen->dma_cnt++;
         }
@@ -292,7 +289,8 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod,
         for (i = 0; i < 2; i++)
                 rsnd_dmaen_sync(dmaen, io, i);
 
-        if (dmaengine_submit(desc) < 0) {
+        dmaen->cookie = dmaengine_submit(desc);
+        if (dmaen->cookie < 0) {
                 dev_err(dev, "dmaengine_submit() fail\n");
                 return -EIO;
         }
@@ -348,12 +346,34 @@ static int rsnd_dmaen_attach(struct rsnd_dai_stream *io,
         return 0;
 }
 
+static int rsnd_dmaen_pointer(struct rsnd_mod *mod,
+                              struct rsnd_dai_stream *io,
+                              snd_pcm_uframes_t *pointer)
+{
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        struct rsnd_dma *dma = rsnd_mod_to_dma(mod);
+        struct rsnd_dmaen *dmaen = rsnd_dma_to_dmaen(dma);
+        struct dma_tx_state state;
+        enum dma_status status;
+        unsigned int pos = 0;
+
+        status = dmaengine_tx_status(dmaen->chan, dmaen->cookie, &state);
+        if (status == DMA_IN_PROGRESS || status == DMA_PAUSED) {
+                if (state.residue > 0 && state.residue <= dmaen->dma_len)
+                        pos = dmaen->dma_len - state.residue;
+        }
+        *pointer = bytes_to_frames(runtime, pos);
+
+        return 0;
+}
+
 static struct rsnd_mod_ops rsnd_dmaen_ops = {
         .name   = "audmac",
         .nolock_start = rsnd_dmaen_nolock_start,
         .nolock_stop  = rsnd_dmaen_nolock_stop,
         .start  = rsnd_dmaen_start,
         .stop   = rsnd_dmaen_stop,
+        .pointer= rsnd_dmaen_pointer,
 };
 
 /*
diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
index 463de8360985..99d2d9459e75 100644
--- a/sound/soc/sh/rcar/dvc.c
+++ b/sound/soc/sh/rcar/dvc.c
@@ -249,16 +249,18 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
                             struct snd_soc_pcm_runtime *rtd)
 {
         struct rsnd_dvc *dvc = rsnd_mod_to_dvc(mod);
+        struct rsnd_dai *rdai = rsnd_io_to_rdai(io);
         int is_play = rsnd_io_is_play(io);
-        int slots = rsnd_get_slot(io);
+        int channels = rsnd_rdai_channels_get(rdai);
         int ret;
 
         /* Volume */
         ret = rsnd_kctrl_new_m(mod, io, rtd,
                         is_play ?
                         "DVC Out Playback Volume" : "DVC In Capture Volume",
+                        rsnd_kctrl_accept_anytime,
                         rsnd_dvc_volume_update,
-                        &dvc->volume, slots,
+                        &dvc->volume, channels,
                         0x00800000 - 1);
         if (ret < 0)
                 return ret;
@@ -267,8 +269,9 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_m(mod, io, rtd,
                         is_play ?
                         "DVC Out Mute Switch" : "DVC In Mute Switch",
+                        rsnd_kctrl_accept_anytime,
                         rsnd_dvc_volume_update,
-                        &dvc->mute,  slots,
+                        &dvc->mute, channels,
                         1);
         if (ret < 0)
                 return ret;
@@ -277,6 +280,7 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_s(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Switch" : "DVC In Ramp Switch",
+                        rsnd_kctrl_accept_anytime,
                         rsnd_dvc_volume_update,
                         &dvc->ren, 1);
         if (ret < 0)
@@ -285,6 +289,7 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Up Rate" : "DVC In Ramp Up Rate",
+                        rsnd_kctrl_accept_anytime,
                         rsnd_dvc_volume_update,
                         &dvc->rup,
                         dvc_ramp_rate);
@@ -294,6 +299,7 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Down Rate" : "DVC In Ramp Down Rate",
+                        rsnd_kctrl_accept_anytime,
                         rsnd_dvc_volume_update,
                         &dvc->rdown,
                         dvc_ramp_rate);
diff --git a/sound/soc/sh/rcar/gen.c b/sound/soc/sh/rcar/gen.c
index 4b0980728e13..ee00e3516911 100644
--- a/sound/soc/sh/rcar/gen.c
+++ b/sound/soc/sh/rcar/gen.c
@@ -219,6 +219,8 @@ static int rsnd_gen2_probe(struct rsnd_priv *priv)
                 RSND_GEN_S_REG(SSI_SYS_STATUS5, 0x884),
                 RSND_GEN_S_REG(SSI_SYS_STATUS6, 0x888),
                 RSND_GEN_S_REG(SSI_SYS_STATUS7, 0x88c),
+                RSND_GEN_S_REG(HDMI0_SEL,       0x9e0),
+                RSND_GEN_S_REG(HDMI1_SEL,       0x9e4),
 
                 /* FIXME: it needs SSI_MODE2/3 in the future */
                 RSND_GEN_M_REG(SSI_BUSIF_MODE,  0x0,    0x80),
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 323af41ecfcb..99c57611df88 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -18,6 +18,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/of_device.h>
+#include <linux/of_graph.h>
 #include <linux/of_irq.h>
 #include <linux/sh_dma.h>
 #include <linux/workqueue.h>
@@ -170,6 +171,8 @@ enum rsnd_reg {
         RSND_REG_SSI_SYS_STATUS5,
         RSND_REG_SSI_SYS_STATUS6,
         RSND_REG_SSI_SYS_STATUS7,
+        RSND_REG_HDMI0_SEL,
+        RSND_REG_HDMI1_SEL,
 
         /* SSI */
         RSND_REG_SSICR,
@@ -268,6 +271,9 @@ struct rsnd_mod_ops {
                          struct rsnd_dai_stream *io,
                          struct snd_pcm_substream *substream,
                          struct snd_pcm_hw_params *hw_params);
+        int (*pointer)(struct rsnd_mod *mod,
+                       struct rsnd_dai_stream *io,
+                       snd_pcm_uframes_t *pointer);
         int (*fallback)(struct rsnd_mod *mod,
                         struct rsnd_dai_stream *io,
                         struct rsnd_priv *priv);
@@ -305,6 +311,7 @@ struct rsnd_mod {
  * H    0: pcm_new
  * H    0: fallback
  * H    0: hw_params
+ * H    0: pointer
  */
 #define __rsnd_mod_shift_nolock_start   0
 #define __rsnd_mod_shift_nolock_stop    0
@@ -318,6 +325,7 @@ struct rsnd_mod {
 #define __rsnd_mod_shift_pcm_new        28 /* always called */
 #define __rsnd_mod_shift_fallback       28 /* always called */
 #define __rsnd_mod_shift_hw_params      28 /* always called */
+#define __rsnd_mod_shift_pointer        28 /* always called */
 
 #define __rsnd_mod_add_probe            0
 #define __rsnd_mod_add_remove           0
@@ -331,6 +339,7 @@ struct rsnd_mod {
 #define __rsnd_mod_add_pcm_new          0
 #define __rsnd_mod_add_fallback         0
 #define __rsnd_mod_add_hw_params        0
+#define __rsnd_mod_add_pointer          0
 
 #define __rsnd_mod_call_probe           0
 #define __rsnd_mod_call_remove          0
@@ -342,6 +351,7 @@ struct rsnd_mod {
 #define __rsnd_mod_call_pcm_new         0
 #define __rsnd_mod_call_fallback        0
 #define __rsnd_mod_call_hw_params       0
+#define __rsnd_mod_call_pointer         0
 #define __rsnd_mod_call_nolock_start    0
 #define __rsnd_mod_call_nolock_stop     1
 
@@ -389,11 +399,6 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai,
                 struct device_node *playback,
                 struct device_node *capture);
 
-void rsnd_set_slot(struct rsnd_dai *rdai,
-                   int slots, int slots_total);
-int rsnd_get_slot(struct rsnd_dai_stream *io);
-int rsnd_get_slot_num(struct rsnd_dai_stream *io);
-
 int rsnd_runtime_channel_original(struct rsnd_dai_stream *io);
 int rsnd_runtime_channel_after_ctu(struct rsnd_dai_stream *io);
 int rsnd_runtime_channel_for_ssi(struct rsnd_dai_stream *io);
@@ -420,13 +425,8 @@ struct rsnd_dai_stream {
         char name[RSND_DAI_NAME_SIZE];
         struct snd_pcm_substream *substream;
         struct rsnd_mod *mod[RSND_MOD_MAX];
-        struct rsnd_dai_path_info *info; /* rcar_snd.h */
         struct rsnd_dai *rdai;
         u32 parent_ssi_status;
-        int byte_pos;
-        int period_pos;
-        int byte_per_period;
-        int next_period_byte;
 };
 #define rsnd_io_to_mod(io, i)   ((i) < RSND_MOD_MAX ? (io)->mod[(i)] : NULL)
 #define rsnd_io_to_mod_ssi(io)  rsnd_io_to_mod((io), RSND_MOD_SSI)
@@ -449,9 +449,10 @@ struct rsnd_dai {
         struct rsnd_dai_stream playback;
         struct rsnd_dai_stream capture;
         struct rsnd_priv *priv;
+        struct snd_pcm_hw_constraint_list constraint;
 
-        int slots;
-        int slots_num;
+        int max_channels;       /* 2ch - 16ch */
+        int ssi_lane;           /* 1lane - 4lane */
 
         unsigned int clk_master:1;
         unsigned int bit_clk_inv:1;
@@ -471,13 +472,24 @@ struct rsnd_dai {
 
 struct rsnd_dai *rsnd_rdai_get(struct rsnd_priv *priv, int id);
 
-bool rsnd_dai_pointer_update(struct rsnd_dai_stream *io, int cnt);
+#define rsnd_rdai_channels_set(rdai, max_channels) \
+        rsnd_rdai_channels_ctrl(rdai, max_channels)
+#define rsnd_rdai_channels_get(rdai) \
+        rsnd_rdai_channels_ctrl(rdai, 0)
+int rsnd_rdai_channels_ctrl(struct rsnd_dai *rdai,
+                            int max_channels);
+
+#define rsnd_rdai_ssi_lane_set(rdai, ssi_lane) \
+        rsnd_rdai_ssi_lane_ctrl(rdai, ssi_lane)
+#define rsnd_rdai_ssi_lane_get(rdai) \
+        rsnd_rdai_ssi_lane_ctrl(rdai, 0)
+int rsnd_rdai_ssi_lane_ctrl(struct rsnd_dai *rdai,
+                            int ssi_lane);
+
 void rsnd_dai_period_elapsed(struct rsnd_dai_stream *io);
-int rsnd_dai_pointer_offset(struct rsnd_dai_stream *io, int additional);
 int rsnd_dai_connect(struct rsnd_mod *mod,
                      struct rsnd_dai_stream *io,
                      enum rsnd_mod_type type);
-#define rsnd_dai_of_node(priv) rsnd_parse_of_node(priv, RSND_NODE_DAI)
 
 /*
  *      R-Car Gen1/Gen2
@@ -491,6 +503,7 @@ phys_addr_t rsnd_gen_get_phy_addr(struct rsnd_priv *priv, int reg_id);
 /*
  *      R-Car ADG
  */
+int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate);
 int rsnd_adg_ssi_clk_stop(struct rsnd_mod *mod);
 int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *mod, unsigned int rate);
 int rsnd_adg_probe(struct rsnd_priv *priv);
@@ -596,6 +609,7 @@ struct rsnd_kctrl_cfg {
         unsigned int size;
         u32 *val;
         const char * const *texts;
+        int (*accept)(struct rsnd_dai_stream *io);
         void (*update)(struct rsnd_dai_stream *io, struct rsnd_mod *mod);
         struct rsnd_dai_stream *io;
         struct snd_card *card;
@@ -613,12 +627,15 @@ struct rsnd_kctrl_cfg_s {
         u32 val;
 };
 
+int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io);
+int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io);
 struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg);
 struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg);
 int rsnd_kctrl_new(struct rsnd_mod *mod,
                    struct rsnd_dai_stream *io,
                    struct snd_soc_pcm_runtime *rtd,
                    const unsigned char *name,
+                   int (*accept)(struct rsnd_dai_stream *io),
                    void (*update)(struct rsnd_dai_stream *io,
                                   struct rsnd_mod *mod),
                    struct rsnd_kctrl_cfg *cfg,
@@ -626,16 +643,16 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
                    int size,
                    u32 max);
 
-#define rsnd_kctrl_new_m(mod, io, rtd, name, update, cfg, size, max) \
-        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_m(cfg), \
+#define rsnd_kctrl_new_m(mod, io, rtd, name, accept, update, cfg, size, max) \
+        rsnd_kctrl_new(mod, io, rtd, name, accept, update, rsnd_kctrl_init_m(cfg), \
                        NULL, size, max)
 
-#define rsnd_kctrl_new_s(mod, io, rtd, name, update, cfg, max)  \
-        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+#define rsnd_kctrl_new_s(mod, io, rtd, name, accept, update, cfg, max)  \
+        rsnd_kctrl_new(mod, io, rtd, name, accept, update, rsnd_kctrl_init_s(cfg), \
                        NULL, 1, max)
 
-#define rsnd_kctrl_new_e(mod, io, rtd, name, update, cfg, texts)        \
-        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+#define rsnd_kctrl_new_e(mod, io, rtd, name, accept, update, cfg, texts)        \
+        rsnd_kctrl_new(mod, io, rtd, name, accept, update, rsnd_kctrl_init_s(cfg), \
                        texts, 1, ARRAY_SIZE(texts))
 
 /*
@@ -648,6 +665,13 @@ int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod);
 int rsnd_ssi_use_busif(struct rsnd_dai_stream *io);
 u32 rsnd_ssi_multi_slaves_runtime(struct rsnd_dai_stream *io);
 
+#define RSND_SSI_HDMI_PORT0     0xf0
+#define RSND_SSI_HDMI_PORT1     0xf1
+int rsnd_ssi_hdmi_port(struct rsnd_dai_stream *io);
+void rsnd_ssi_parse_hdmi_connection(struct rsnd_priv *priv,
+                                    struct device_node *endpoint,
+                                    int dai_i);
+
 #define rsnd_ssi_is_pin_sharing(io)     \
         __rsnd_ssi_is_pin_sharing(rsnd_io_to_mod_ssi(io))
 int __rsnd_ssi_is_pin_sharing(struct rsnd_mod *mod);
@@ -656,6 +680,8 @@ int __rsnd_ssi_is_pin_sharing(struct rsnd_mod *mod);
 void rsnd_parse_connect_ssi(struct rsnd_dai *rdai,
                             struct device_node *playback,
                             struct device_node *capture);
+unsigned int rsnd_ssi_clk_query(struct rsnd_priv *priv,
+                       int param1, int param2, int *idx);
 
 /*
  *      R-Car SSIU
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 76a477a3ccb5..7aa239e28491 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -12,10 +12,6 @@
 
 #define SRC_NAME "src"
 
-/* SRCx_STATUS */
-#define OUF_SRCO        ((1 << 12) | (1 << 13))
-#define OUF_SRCI        ((1 <<  9) | (1 <<  8))
-
 /* SCU_SYSTEM_STATUS0/1 */
 #define OUF_SRC(id)     ((1 << (id + 16)) | (1 << id))
 
@@ -55,20 +51,6 @@ struct rsnd_src {
  *
  */
 
-/*
- * src.c is caring...
- *
- * Gen1
- *
- * [mem] -> [SRU] -> [SSI]
- *        |--------|
- *
- * Gen2
- *
- * [mem] -> [SRC] -> [SSIU] -> [SSI]
- *        |-----------------|
- */
-
 static void rsnd_src_activation(struct rsnd_mod *mod)
 {
         rsnd_mod_write(mod, SRC_SWRSR, 0);
@@ -515,6 +497,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,
                                rsnd_io_is_play(io) ?
                                "SRC Out Rate Switch" :
                                "SRC In Rate Switch",
+                               rsnd_kctrl_accept_anytime,
                                rsnd_src_set_convert_rate,
                                &src->sen, 1);
         if (ret < 0)
@@ -524,6 +507,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,
                                rsnd_io_is_play(io) ?
                                "SRC Out Rate" :
                                "SRC In Rate",
+                               rsnd_kctrl_accept_runtime,
                                rsnd_src_set_convert_rate,
                                &src->sync, 192000);
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 91e5c07911b4..46feddd78ee2 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -11,6 +11,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <sound/simple_card_utils.h>
 #include <linux/delay.h>
 #include "rsnd.h"
 #define RSND_SSI_NAME_SIZE 16
@@ -76,11 +77,18 @@ struct rsnd_ssi {
         int rate;
         int irq;
         unsigned int usrcnt;
+
+        int byte_pos;
+        int period_pos;
+        int byte_per_period;
+        int next_period_byte;
 };
 
 /* flags */
 #define RSND_SSI_CLK_PIN_SHARE          (1 << 0)
 #define RSND_SSI_NO_BUSIF               (1 << 1) /* SSI+DMA without BUSIF */
+#define RSND_SSI_HDMI0                  (1 << 2) /* for HDMI0 */
+#define RSND_SSI_HDMI1                  (1 << 3) /* for HDMI1 */
 
 #define for_each_rsnd_ssi(pos, priv, i)                                 \
         for (i = 0;                                                     \
@@ -99,6 +107,20 @@ struct rsnd_ssi {
 #define rsnd_ssi_is_run_mods(mod, io) \
         (rsnd_ssi_run_mods(io) & (1 << rsnd_mod_id(mod)))
 
+int rsnd_ssi_hdmi_port(struct rsnd_dai_stream *io)
+{
+        struct rsnd_mod *mod = rsnd_io_to_mod_ssi(io);
+        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+
+        if (rsnd_ssi_mode_flags(ssi) & RSND_SSI_HDMI0)
+                return RSND_SSI_HDMI_PORT0;
+
+        if (rsnd_ssi_mode_flags(ssi) & RSND_SSI_HDMI1)
+                return RSND_SSI_HDMI_PORT1;
+
+        return 0;
+}
+
 int rsnd_ssi_use_busif(struct rsnd_dai_stream *io)
 {
         struct rsnd_mod *mod = rsnd_io_to_mod_ssi(io);
@@ -186,6 +208,46 @@ u32 rsnd_ssi_multi_slaves_runtime(struct rsnd_dai_stream *io)
         return 0;
 }
 
+unsigned int rsnd_ssi_clk_query(struct rsnd_priv *priv,
+                       int param1, int param2, int *idx)
+{
+        int ssi_clk_mul_table[] = {
+                1, 2, 4, 8, 16, 6, 12,
+        };
+        int j, ret;
+        unsigned int main_rate;
+
+        for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) {
+
+                /*
+                 * It will set SSIWSR.CONT here, but SSICR.CKDV = 000
+                 * with it is not allowed. (SSIWSR.WS_MODE with
+                 * SSICR.CKDV = 000 is not allowed either).
+                 * Skip it. See SSICR.CKDV
+                 */
+                if (j == 0)
+                        continue;
+
+                /*
+                 * this driver is assuming that
+                 * system word is 32bit x chan
+                 * see rsnd_ssi_init()
+                 */
+                main_rate = 32 * param1 * param2 * ssi_clk_mul_table[j];
+
+                ret = rsnd_adg_clk_query(priv, main_rate);
+                if (ret < 0)
+                        continue;
+
+                if (idx)
+                        *idx = j;
+
+                return main_rate;
+        }
+
+        return 0;
+}
+
 static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
                                      struct rsnd_dai_stream *io)
 {
@@ -195,10 +257,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
         struct rsnd_mod *ssi_parent_mod = rsnd_io_to_mod_ssip(io);
         int chan = rsnd_runtime_channel_for_ssi(io);
-        int j, ret;
-        int ssi_clk_mul_table[] = {
-                1, 2, 4, 8, 16, 6, 12,
-        };
+        int idx, ret;
         unsigned int main_rate;
         unsigned int rate = rsnd_io_is_play(io) ?
                 rsnd_src_get_out_rate(priv, io) :
@@ -222,45 +281,25 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
                 return 0;
         }
 
-        /*
-         * Find best clock, and try to start ADG
-         */
-        for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) {
-
-                /*
-                 * It will set SSIWSR.CONT here, but SSICR.CKDV = 000
-                 * with it is not allowed. (SSIWSR.WS_MODE with
-                 * SSICR.CKDV = 000 is not allowed either).
-                 * Skip it. See SSICR.CKDV
-                 */
-                if (j == 0)
-                        continue;
-
-                /*
-                 * this driver is assuming that
-                 * system word is 32bit x chan
-                 * see rsnd_ssi_init()
-                 */
-                main_rate = rate * 32 * chan * ssi_clk_mul_table[j];
-
-                ret = rsnd_adg_ssi_clk_try_start(mod, main_rate);
-                if (0 == ret) {
-                        ssi->cr_clk     = FORCE | SWL_32 |
-                                SCKD | SWSD | CKDV(j);
-                        ssi->wsr = CONT;
+        main_rate = rsnd_ssi_clk_query(priv, rate, chan, &idx);
+        if (!main_rate) {
+                dev_err(dev, "unsupported clock rate\n");
+                return -EIO;
+        }
 
-                        ssi->rate = rate;
+        ret = rsnd_adg_ssi_clk_try_start(mod, main_rate);
+        if (ret < 0)
+                return ret;
 
-                        dev_dbg(dev, "%s[%d] outputs %u Hz\n",
-                                rsnd_mod_name(mod),
-                                rsnd_mod_id(mod), rate);
+        ssi->cr_clk = FORCE | SWL_32 | SCKD | SWSD | CKDV(idx);
+        ssi->wsr = CONT;
+        ssi->rate = rate;
 
-                        return 0;
-                }
-        }
+        dev_dbg(dev, "%s[%d] outputs %u Hz\n",
+                rsnd_mod_name(mod),
+                rsnd_mod_id(mod), rate);
 
-        dev_err(dev, "unsupported clock rate\n");
-        return -EIO;
+        return 0;
 }
 
 static void rsnd_ssi_master_clk_stop(struct rsnd_mod *mod,
@@ -357,6 +396,59 @@ static void rsnd_ssi_register_setup(struct rsnd_mod *mod)
                                         ssi->cr_mode); /* without EN */
 }
 
+static void rsnd_ssi_pointer_init(struct rsnd_mod *mod,
+                                  struct rsnd_dai_stream *io)
+{
+        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+        ssi->byte_pos           = 0;
+        ssi->period_pos         = 0;
+        ssi->byte_per_period    = runtime->period_size *
+                                  runtime->channels *
+                                  samples_to_bytes(runtime, 1);
+        ssi->next_period_byte   = ssi->byte_per_period;
+}
+
+static int rsnd_ssi_pointer_offset(struct rsnd_mod *mod,
+                                   struct rsnd_dai_stream *io,
+                                   int additional)
+{
+        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        int pos = ssi->byte_pos + additional;
+
+        pos %= (runtime->periods * ssi->byte_per_period);
+
+        return pos;
+}
+
+static bool rsnd_ssi_pointer_update(struct rsnd_mod *mod,
+                                    struct rsnd_dai_stream *io,
+                                    int byte)
+{
+        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+
+        ssi->byte_pos += byte;
+
+        if (ssi->byte_pos >= ssi->next_period_byte) {
+                struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+                ssi->period_pos++;
+                ssi->next_period_byte += ssi->byte_per_period;
+
+                if (ssi->period_pos >= runtime->periods) {
+                        ssi->byte_pos = 0;
+                        ssi->period_pos = 0;
+                        ssi->next_period_byte = ssi->byte_per_period;
+                }
+
+                return true;
+        }
+
+        return false;
+}
+
 /*
  *      SSI mod common functions
  */
@@ -370,6 +462,8 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
         if (!rsnd_ssi_is_run_mods(mod, io))
                 return 0;
 
+        rsnd_ssi_pointer_init(mod, io);
+
         ssi->usrcnt++;
 
         rsnd_mod_power_on(mod);
@@ -549,7 +643,7 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
         if (!is_dma && (status & DIRQ)) {
                 struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
                 u32 *buf = (u32 *)(runtime->dma_area +
-                                   rsnd_dai_pointer_offset(io, 0));
+                                   rsnd_ssi_pointer_offset(mod, io, 0));
                 int shift = 0;
 
                 switch (runtime->sample_bits) {
@@ -568,7 +662,7 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                 else
                         *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
 
-                elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
+                elapsed = rsnd_ssi_pointer_update(mod, io, sizeof(*buf));
         }
 
         /* DMA only */
@@ -675,6 +769,18 @@ static int rsnd_ssi_common_probe(struct rsnd_mod *mod,
         return ret;
 }
 
+static int rsnd_ssi_pointer(struct rsnd_mod *mod,
+                            struct rsnd_dai_stream *io,
+                            snd_pcm_uframes_t *pointer)
+{
+        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+        *pointer = bytes_to_frames(runtime, ssi->byte_pos);
+
+        return 0;
+}
+
 static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
         .name   = SSI_NAME,
         .probe  = rsnd_ssi_common_probe,
@@ -683,6 +789,7 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
         .start  = rsnd_ssi_start,
         .stop   = rsnd_ssi_stop,
         .irq    = rsnd_ssi_irq,
+        .pointer= rsnd_ssi_pointer,
         .pcm_new = rsnd_ssi_pcm_new,
         .hw_params = rsnd_ssi_hw_params,
 };
@@ -787,13 +894,6 @@ int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod)
 
 
 /*
- *              Non SSI
- */
-static struct rsnd_mod_ops rsnd_ssi_non_ops = {
-        .name   = SSI_NAME,
-};
-
-/*
  *              ssi mod function
  */
 static void rsnd_ssi_connect(struct rsnd_mod *mod,
@@ -814,7 +914,8 @@ static void rsnd_ssi_connect(struct rsnd_mod *mod,
                 type = types[i];
                 if (!rsnd_io_to_mod(io, type)) {
                         rsnd_dai_connect(mod, io, type);
-                        rsnd_set_slot(rdai, 2 * (i + 1), (i + 1));
+                        rsnd_rdai_channels_set(rdai, (i + 1) * 2);
+                        rsnd_rdai_ssi_lane_set(rdai, (i + 1));
                         return;
                 }
         }
@@ -847,6 +948,47 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai,
         of_node_put(node);
 }
 
+static void __rsnd_ssi_parse_hdmi_connection(struct rsnd_priv *priv,
+                                             struct rsnd_dai_stream *io,
+                                             struct device_node *remote_ep)
+{
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct rsnd_mod *mod = rsnd_io_to_mod_ssi(io);
+        struct rsnd_ssi *ssi;
+
+        if (!mod)
+                return;
+
+        ssi  = rsnd_mod_to_ssi(mod);
+
+        if (strstr(remote_ep->full_name, "hdmi0")) {
+                ssi->flags |= RSND_SSI_HDMI0;
+                dev_dbg(dev, "%s[%d] connected to HDMI0\n",
+                         rsnd_mod_name(mod), rsnd_mod_id(mod));
+        }
+
+        if (strstr(remote_ep->full_name, "hdmi1")) {
+                ssi->flags |= RSND_SSI_HDMI1;
+                dev_dbg(dev, "%s[%d] connected to HDMI1\n",
+                        rsnd_mod_name(mod), rsnd_mod_id(mod));
+        }
+}
+
+void rsnd_ssi_parse_hdmi_connection(struct rsnd_priv *priv,
+                                    struct device_node *endpoint,
+                                    int dai_i)
+{
+        struct rsnd_dai *rdai = rsnd_rdai_get(priv, dai_i);
+        struct device_node *remote_ep;
+
+        remote_ep = of_graph_get_remote_endpoint(endpoint);
+        if (!remote_ep)
+                return;
+
+        __rsnd_ssi_parse_hdmi_connection(priv, &rdai->playback, remote_ep);
+        __rsnd_ssi_parse_hdmi_connection(priv, &rdai->capture,  remote_ep);
+}
+
 struct rsnd_mod *rsnd_ssi_mod_get(struct rsnd_priv *priv, int id)
 {
         if (WARN_ON(id < 0 || id >= rsnd_ssi_nr(priv)))
@@ -952,7 +1094,6 @@ int rsnd_ssi_probe(struct rsnd_priv *priv)
                         goto rsnd_ssi_probe_done;
                 }
 
-                ops = &rsnd_ssi_non_ops;
                 if (of_property_read_bool(np, "pio-transfer"))
                         ops = &rsnd_ssi_pio_ops;
                 else
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 512d238b79e2..bed2c9c0004b 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -123,6 +123,7 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                                struct rsnd_dai_stream *io,
                                struct rsnd_priv *priv)
 {
+        int hdmi = rsnd_ssi_hdmi_port(io);
         int ret;
 
         ret = rsnd_ssiu_init(mod, io, priv);
@@ -150,6 +151,42 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                                rsnd_get_dalign(mod, io));
         }
 
+        if (hdmi) {
+                enum rsnd_mod_type rsnd_ssi_array[] = {
+                        RSND_MOD_SSIM1,
+                        RSND_MOD_SSIM2,
+                        RSND_MOD_SSIM3,
+                };
+                struct rsnd_mod *ssi_mod = rsnd_io_to_mod_ssi(io);
+                struct rsnd_mod *pos;
+                u32 val;
+                int i, shift;
+
+                i = rsnd_mod_id(ssi_mod);
+
+                /* output all same SSI as default */
+                val =   i << 16 |
+                        i << 20 |
+                        i << 24 |
+                        i << 28 |
+                        i;
+
+                for_each_rsnd_mod_array(i, pos, io, rsnd_ssi_array) {
+                        shift   = (i * 4) + 16;
+                        val     = (val & ~(0xF << shift)) |
+                                rsnd_mod_id(pos) << shift;
+                }
+
+                switch (hdmi) {
+                case RSND_SSI_HDMI_PORT0:
+                        rsnd_mod_write(mod, HDMI0_SEL, val);
+                        break;
+                case RSND_SSI_HDMI_PORT1:
+                        rsnd_mod_write(mod, HDMI1_SEL, val);
+                        break;
+                }
+        }
+
         return 0;
 }
 
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index bfd71b873ca2..206f36bf43e8 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -81,7 +81,8 @@ out:
 static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 {
         struct snd_soc_pcm_runtime *fe = cstream->private_data;
-        struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+        struct snd_pcm_substream *fe_substream =
+                 fe->pcm->streams[cstream->direction].substream;
         struct snd_soc_platform *platform = fe->platform;
         struct snd_soc_dai *cpu_dai = fe->cpu_dai;
         struct snd_soc_dpcm *dpcm;
@@ -467,7 +468,8 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream,
                                         struct snd_compr_params *params)
 {
         struct snd_soc_pcm_runtime *fe = cstream->private_data;
-        struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+        struct snd_pcm_substream *fe_substream =
+                 fe->pcm->streams[cstream->direction].substream;
         struct snd_soc_platform *platform = fe->platform;
         struct snd_soc_dai *cpu_dai = fe->cpu_dai;
         int ret = 0, stream;
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 754e3ef8d7ae..921622a01944 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -34,6 +34,7 @@
 #include <linux/ctype.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/of_graph.h>
 #include <linux/dmi.h>
 #include <sound/core.h>
 #include <sound/jack.h>
@@ -68,6 +69,20 @@ static int pmdown_time = 5000;
 module_param(pmdown_time, int, 0);
 MODULE_PARM_DESC(pmdown_time, "DAPM stream powerdown time (msecs)");
 
+/* If a DMI filed contain strings in this blacklist (e.g.
+ * "Type2 - Board Manufacturer" or  "Type1 - TBD by OEM"), it will be taken
+ * as invalid and dropped when setting the card long name from DMI info.
+ */
+static const char * const dmi_blacklist[] = {
+        "To be filled by OEM",
+        "TBD by OEM",
+        "Default String",
+        "Board Manufacturer",
+        "Board Vendor Name",
+        "Board Product Name",
+        NULL,   /* terminator */
+};
+
 /* returns the minimum number of bytes needed to represent
  * a particular given value */
 static int min_bytes_needed(unsigned long val)
@@ -1933,6 +1948,22 @@ static void cleanup_dmi_name(char *name)
         name[j] = '\0';
 }
 
+/* Check if a DMI field is valid, i.e. not containing any string
+ * in the black list.
+ */
+static int is_dmi_valid(const char *field)
+{
+        int i = 0;
+
+        while (dmi_blacklist[i]) {
+                if (strstr(field, dmi_blacklist[i]))
+                        return 0;
+                i++;
+        }
+
+        return 1;
+}
+
 /**
  * snd_soc_set_dmi_name() - Register DMI names to card
  * @card: The card to register DMI names
@@ -1975,17 +2006,18 @@ int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour)
 
         /* make up dmi long name as: vendor.product.version.board */
         vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
-        if (!vendor) {
+        if (!vendor || !is_dmi_valid(vendor)) {
                 dev_warn(card->dev, "ASoC: no DMI vendor name!\n");
                 return 0;
         }
 
+
         snprintf(card->dmi_longname, sizeof(card->snd_card->longname),
                          "%s", vendor);
         cleanup_dmi_name(card->dmi_longname);
 
         product = dmi_get_system_info(DMI_PRODUCT_NAME);
-        if (product) {
+        if (product && is_dmi_valid(product)) {
                 len = strlen(card->dmi_longname);
                 snprintf(card->dmi_longname + len,
                          longname_buf_size - len,
@@ -1999,7 +2031,7 @@ int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour)
                  * name in the product version field
                  */
                 product_version = dmi_get_system_info(DMI_PRODUCT_VERSION);
-                if (product_version) {
+                if (product_version && is_dmi_valid(product_version)) {
                         len = strlen(card->dmi_longname);
                         snprintf(card->dmi_longname + len,
                                  longname_buf_size - len,
@@ -2012,7 +2044,7 @@ int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour)
         }
 
         board = dmi_get_system_info(DMI_BOARD_NAME);
-        if (board) {
+        if (board && is_dmi_valid(board)) {
                 len = strlen(card->dmi_longname);
                 snprintf(card->dmi_longname + len,
                          longname_buf_size - len,
@@ -3961,11 +3993,15 @@ unsigned int snd_soc_of_parse_daifmt(struct device_node *np,
                 prefix = "";
 
         /*
-         * check "[prefix]format = xxx"
+         * check "dai-format = xxx"
+         * or    "[prefix]format = xxx"
          * SND_SOC_DAIFMT_FORMAT_MASK area
          */
-        snprintf(prop, sizeof(prop), "%sformat", prefix);
-        ret = of_property_read_string(np, prop, &str);
+        ret = of_property_read_string(np, "dai-format", &str);
+        if (ret < 0) {
+                snprintf(prop, sizeof(prop), "%sformat", prefix);
+                ret = of_property_read_string(np, prop, &str);
+        }
         if (ret == 0) {
                 for (i = 0; i < ARRAY_SIZE(of_fmt_table); i++) {
                         if (strcmp(str, of_fmt_table[i].name) == 0) {
@@ -4045,6 +4081,42 @@ unsigned int snd_soc_of_parse_daifmt(struct device_node *np,
 }
 EXPORT_SYMBOL_GPL(snd_soc_of_parse_daifmt);
 
+int snd_soc_get_dai_id(struct device_node *ep)
+{
+        struct snd_soc_component *pos;
+        struct device_node *node;
+        int ret;
+
+        node = of_graph_get_port_parent(ep);
+
+        /*
+         * For example HDMI case, HDMI has video/sound port,
+         * but ALSA SoC needs sound port number only.
+         * Thus counting HDMI DT port/endpoint doesn't work.
+         * Then, it should have .of_xlate_dai_id
+         */
+        ret = -ENOTSUPP;
+        mutex_lock(&client_mutex);
+        list_for_each_entry(pos, &component_list, list) {
+                struct device_node *component_of_node = pos->dev->of_node;
+
+                if (!component_of_node && pos->dev->parent)
+                        component_of_node = pos->dev->parent->of_node;
+
+                if (component_of_node != node)
+                        continue;
+
+                if (pos->driver->of_xlate_dai_id)
+                        ret = pos->driver->of_xlate_dai_id(pos, ep);
+
+                break;
+        }
+        mutex_unlock(&client_mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(snd_soc_get_dai_id);
+
 int snd_soc_get_dai_name(struct of_phandle_args *args,
                                 const char **dai_name)
 {
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 002772e3ba2c..dd471d2c0266 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -242,6 +242,14 @@ static const struct soc_tplg_map dapm_map[] = {
         {SND_SOC_TPLG_DAPM_DAI_IN, snd_soc_dapm_dai_in},
         {SND_SOC_TPLG_DAPM_DAI_OUT, snd_soc_dapm_dai_out},
         {SND_SOC_TPLG_DAPM_DAI_LINK, snd_soc_dapm_dai_link},
+        {SND_SOC_TPLG_DAPM_BUFFER, snd_soc_dapm_buffer},
+        {SND_SOC_TPLG_DAPM_SCHEDULER, snd_soc_dapm_scheduler},
+        {SND_SOC_TPLG_DAPM_EFFECT, snd_soc_dapm_effect},
+        {SND_SOC_TPLG_DAPM_SIGGEN, snd_soc_dapm_siggen},
+        {SND_SOC_TPLG_DAPM_SRC, snd_soc_dapm_src},
+        {SND_SOC_TPLG_DAPM_ASRC, snd_soc_dapm_asrc},
+        {SND_SOC_TPLG_DAPM_ENCODER, snd_soc_dapm_encoder},
+        {SND_SOC_TPLG_DAPM_DECODER, snd_soc_dapm_decoder},
 };
 
 static int tplc_chan_get_reg(struct soc_tplg *tplg,
@@ -344,6 +352,17 @@ static int soc_tplg_widget_load(struct soc_tplg *tplg,
         return 0;
 }
 
+/* optionally pass new dynamic widget to component driver. This is mainly for
+ * external widgets where we can assign private data/ops */
+static int soc_tplg_widget_ready(struct soc_tplg *tplg,
+        struct snd_soc_dapm_widget *w, struct snd_soc_tplg_dapm_widget *tplg_w)
+{
+        if (tplg->comp && tplg->ops && tplg->ops->widget_ready)
+                return tplg->ops->widget_ready(tplg->comp, w, tplg_w);
+
+        return 0;
+}
+
 /* pass DAI configurations to component driver for extra initialization */
 static int soc_tplg_dai_load(struct soc_tplg *tplg,
         struct snd_soc_dai_driver *dai_drv)
@@ -1152,7 +1171,8 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg,
                 return -EINVAL;
         }
 
-        dev_dbg(tplg->dev, "ASoC: adding %d DAPM routes\n", count);
+        dev_dbg(tplg->dev, "ASoC: adding %d DAPM routes for index %d\n", count,
+                hdr->index);
 
         for (i = 0; i < count; i++) {
                 elem = (struct snd_soc_tplg_dapm_graph_elem *)tplg->pos;
@@ -1465,6 +1485,7 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
         if (template.id < 0)
                 return template.id;
 
+        /* strings are allocated here, but used and freed by the widget */
         template.name = kstrdup(w->name, GFP_KERNEL);
         if (!template.name)
                 return -ENOMEM;
@@ -1577,11 +1598,17 @@ widget:
         widget->dobj.widget.kcontrol_type = kcontrol_type;
         widget->dobj.ops = tplg->ops;
         widget->dobj.index = tplg->index;
-        kfree(template.sname);
-        kfree(template.name);
         list_add(&widget->dobj.list, &tplg->comp->dobj_list);
+
+        ret = soc_tplg_widget_ready(tplg, widget, w);
+        if (ret < 0)
+                goto ready_err;
+
         return 0;
 
+ready_err:
+        snd_soc_tplg_widget_remove(widget);
+        snd_soc_dapm_free_widget(widget);
 hdr_err:
         kfree(template.sname);
 err:
@@ -1628,7 +1655,7 @@ static int soc_tplg_dapm_complete(struct soc_tplg *tplg)
         */
         if (!card || !card->instantiated) {
                 dev_warn(tplg->dev, "ASoC: Parent card not yet available,"
-                                "Do not add new widgets now\n");
+                        " widget card binding deferred\n");
                 return 0;
         }
 
@@ -2363,7 +2390,7 @@ static int soc_tplg_load_header(struct soc_tplg *tplg,
 
         /* check for matching ID */
         if (hdr->index != tplg->req_index &&
-                hdr->index != SND_SOC_TPLG_INDEX_ALL)
+                tplg->req_index != SND_SOC_TPLG_INDEX_ALL)
                 return 0;
 
         tplg->index = hdr->index;
diff --git a/sound/soc/stm/Kconfig b/sound/soc/stm/Kconfig
index 972970f0890a..3398e6c57f37 100644
--- a/sound/soc/stm/Kconfig
+++ b/sound/soc/stm/Kconfig
@@ -1,8 +1,31 @@
-menuconfig SND_SOC_STM32
-        tristate "STMicroelectronics STM32 SOC audio support"
+menu "STMicroelectronics STM32 SOC audio support"
+
+config SND_SOC_STM32_SAI
+        tristate "STM32 SAI interface (Serial Audio Interface) support"
         depends on ARCH_STM32 || COMPILE_TEST
         depends on SND_SOC
         select SND_SOC_GENERIC_DMAENGINE_PCM
         select REGMAP_MMIO
         help
-          Say Y if you want to enable ASoC-support for STM32
+          Say Y if you want to enable SAI for STM32
+
+config SND_SOC_STM32_I2S
+        tristate "STM32 I2S interface (SPI/I2S block) support"
+        depends on ARCH_STM32 || COMPILE_TEST
+        depends on SND_SOC
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        select REGMAP_MMIO
+        help
+          Say Y if you want to enable I2S for STM32
+
+config SND_SOC_STM32_SPDIFRX
+        tristate "STM32 S/PDIF receiver (SPDIFRX) support"
+        depends on ARCH_STM32 || COMPILE_TEST
+        depends on SND_SOC
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        select REGMAP_MMIO
+        select SND_SOC_SPDIF
+        help
+          Say Y if you want to enable S/PDIF capture for STM32
+
+endmenu
diff --git a/sound/soc/stm/Makefile b/sound/soc/stm/Makefile
index e466a4759698..4ed22e648a9a 100644
--- a/sound/soc/stm/Makefile
+++ b/sound/soc/stm/Makefile
@@ -1,6 +1,14 @@
 # SAI
 snd-soc-stm32-sai-sub-objs := stm32_sai_sub.o
-obj-$(CONFIG_SND_SOC_STM32) += snd-soc-stm32-sai-sub.o
+obj-$(CONFIG_SND_SOC_STM32_SAI) += snd-soc-stm32-sai-sub.o
 
 snd-soc-stm32-sai-objs := stm32_sai.o
-obj-$(CONFIG_SND_SOC_STM32) += snd-soc-stm32-sai.o
+obj-$(CONFIG_SND_SOC_STM32_SAI) += snd-soc-stm32-sai.o
+
+# I2S
+snd-soc-stm32-i2s-objs := stm32_i2s.o
+obj-$(CONFIG_SND_SOC_STM32_I2S) += snd-soc-stm32-i2s.o
+
+# SPDIFRX
+snd-soc-stm32-spdifrx-objs := stm32_spdifrx.o
+obj-$(CONFIG_SND_SOC_STM32_SPDIFRX) += snd-soc-stm32-spdifrx.o
diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c
new file mode 100644
index 000000000000..8052629a89df
--- /dev/null
+++ b/sound/soc/stm/stm32_i2s.c
@@ -0,0 +1,946 @@
+/*
+ *  STM32 ALSA SoC Digital Audio Interface (I2S) driver.
+ *
+ * Copyright (C) 2017, STMicroelectronics - All Rights Reserved
+ * Author(s): Olivier Moysan <olivier.moysan@st.com> for STMicroelectronics.
+ *
+ * License terms: GPL V2.0.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/regmap.h>
+#include <linux/reset.h>
+#include <linux/spinlock.h>
+
+#include <sound/dmaengine_pcm.h>
+#include <sound/pcm_params.h>
+
+#define STM32_I2S_CR1_REG       0x0
+#define STM32_I2S_CFG1_REG      0x08
+#define STM32_I2S_CFG2_REG      0x0C
+#define STM32_I2S_IER_REG       0x10
+#define STM32_I2S_SR_REG        0x14
+#define STM32_I2S_IFCR_REG      0x18
+#define STM32_I2S_TXDR_REG      0X20
+#define STM32_I2S_RXDR_REG      0x30
+#define STM32_I2S_CGFR_REG      0X50
+
+/* Bit definition for SPI2S_CR1 register */
+#define I2S_CR1_SPE             BIT(0)
+#define I2S_CR1_CSTART          BIT(9)
+#define I2S_CR1_CSUSP           BIT(10)
+#define I2S_CR1_HDDIR           BIT(11)
+#define I2S_CR1_SSI             BIT(12)
+#define I2S_CR1_CRC33_17        BIT(13)
+#define I2S_CR1_RCRCI           BIT(14)
+#define I2S_CR1_TCRCI           BIT(15)
+
+/* Bit definition for SPI_CFG2 register */
+#define I2S_CFG2_IOSWP_SHIFT    15
+#define I2S_CFG2_IOSWP          BIT(I2S_CFG2_IOSWP_SHIFT)
+#define I2S_CFG2_LSBFRST        BIT(23)
+#define I2S_CFG2_AFCNTR         BIT(31)
+
+/* Bit definition for SPI_CFG1 register */
+#define I2S_CFG1_FTHVL_SHIFT    5
+#define I2S_CFG1_FTHVL_MASK     GENMASK(8, I2S_CFG1_FTHVL_SHIFT)
+#define I2S_CFG1_FTHVL_SET(x)   ((x) << I2S_CFG1_FTHVL_SHIFT)
+
+#define I2S_CFG1_TXDMAEN        BIT(15)
+#define I2S_CFG1_RXDMAEN        BIT(14)
+
+/* Bit definition for SPI2S_IER register */
+#define I2S_IER_RXPIE           BIT(0)
+#define I2S_IER_TXPIE           BIT(1)
+#define I2S_IER_DPXPIE          BIT(2)
+#define I2S_IER_EOTIE           BIT(3)
+#define I2S_IER_TXTFIE          BIT(4)
+#define I2S_IER_UDRIE           BIT(5)
+#define I2S_IER_OVRIE           BIT(6)
+#define I2S_IER_CRCEIE          BIT(7)
+#define I2S_IER_TIFREIE         BIT(8)
+#define I2S_IER_MODFIE          BIT(9)
+#define I2S_IER_TSERFIE         BIT(10)
+
+/* Bit definition for SPI2S_SR register */
+#define I2S_SR_RXP              BIT(0)
+#define I2S_SR_TXP              BIT(1)
+#define I2S_SR_DPXP             BIT(2)
+#define I2S_SR_EOT              BIT(3)
+#define I2S_SR_TXTF             BIT(4)
+#define I2S_SR_UDR              BIT(5)
+#define I2S_SR_OVR              BIT(6)
+#define I2S_SR_CRCERR           BIT(7)
+#define I2S_SR_TIFRE            BIT(8)
+#define I2S_SR_MODF             BIT(9)
+#define I2S_SR_TSERF            BIT(10)
+#define I2S_SR_SUSP             BIT(11)
+#define I2S_SR_TXC              BIT(12)
+#define I2S_SR_RXPLVL           GENMASK(14, 13)
+#define I2S_SR_RXWNE            BIT(15)
+
+#define I2S_SR_MASK             GENMASK(15, 0)
+
+/* Bit definition for SPI_IFCR register */
+#define I2S_IFCR_EOTC           BIT(3)
+#define I2S_IFCR_TXTFC          BIT(4)
+#define I2S_IFCR_UDRC           BIT(5)
+#define I2S_IFCR_OVRC           BIT(6)
+#define I2S_IFCR_CRCEC          BIT(7)
+#define I2S_IFCR_TIFREC         BIT(8)
+#define I2S_IFCR_MODFC          BIT(9)
+#define I2S_IFCR_TSERFC         BIT(10)
+#define I2S_IFCR_SUSPC          BIT(11)
+
+#define I2S_IFCR_MASK           GENMASK(11, 3)
+
+/* Bit definition for SPI_I2SCGFR register */
+#define I2S_CGFR_I2SMOD         BIT(0)
+
+#define I2S_CGFR_I2SCFG_SHIFT   1
+#define I2S_CGFR_I2SCFG_MASK    GENMASK(3, I2S_CGFR_I2SCFG_SHIFT)
+#define I2S_CGFR_I2SCFG_SET(x)  ((x) << I2S_CGFR_I2SCFG_SHIFT)
+
+#define I2S_CGFR_I2SSTD_SHIFT   4
+#define I2S_CGFR_I2SSTD_MASK    GENMASK(5, I2S_CGFR_I2SSTD_SHIFT)
+#define I2S_CGFR_I2SSTD_SET(x)  ((x) << I2S_CGFR_I2SSTD_SHIFT)
+
+#define I2S_CGFR_PCMSYNC        BIT(7)
+
+#define I2S_CGFR_DATLEN_SHIFT   8
+#define I2S_CGFR_DATLEN_MASK    GENMASK(9, I2S_CGFR_DATLEN_SHIFT)
+#define I2S_CGFR_DATLEN_SET(x)  ((x) << I2S_CGFR_DATLEN_SHIFT)
+
+#define I2S_CGFR_CHLEN_SHIFT    10
+#define I2S_CGFR_CHLEN          BIT(I2S_CGFR_CHLEN_SHIFT)
+#define I2S_CGFR_CKPOL          BIT(11)
+#define I2S_CGFR_FIXCH          BIT(12)
+#define I2S_CGFR_WSINV          BIT(13)
+#define I2S_CGFR_DATFMT         BIT(14)
+
+#define I2S_CGFR_I2SDIV_SHIFT   16
+#define I2S_CGFR_I2SDIV_BIT_H   23
+#define I2S_CGFR_I2SDIV_MASK    GENMASK(I2S_CGFR_I2SDIV_BIT_H,\
+                                I2S_CGFR_I2SDIV_SHIFT)
+#define I2S_CGFR_I2SDIV_SET(x)  ((x) << I2S_CGFR_I2SDIV_SHIFT)
+#define I2S_CGFR_I2SDIV_MAX     ((1 << (I2S_CGFR_I2SDIV_BIT_H -\
+                                I2S_CGFR_I2SDIV_SHIFT)) - 1)
+
+#define I2S_CGFR_ODD_SHIFT      24
+#define I2S_CGFR_ODD            BIT(I2S_CGFR_ODD_SHIFT)
+#define I2S_CGFR_MCKOE          BIT(25)
+
+enum i2s_master_mode {
+        I2S_MS_NOT_SET,
+        I2S_MS_MASTER,
+        I2S_MS_SLAVE,
+};
+
+enum i2s_mode {
+        I2S_I2SMOD_TX_SLAVE,
+        I2S_I2SMOD_RX_SLAVE,
+        I2S_I2SMOD_TX_MASTER,
+        I2S_I2SMOD_RX_MASTER,
+        I2S_I2SMOD_FD_SLAVE,
+        I2S_I2SMOD_FD_MASTER,
+};
+
+enum i2s_fifo_th {
+        I2S_FIFO_TH_NONE,
+        I2S_FIFO_TH_ONE_QUARTER,
+        I2S_FIFO_TH_HALF,
+        I2S_FIFO_TH_THREE_QUARTER,
+        I2S_FIFO_TH_FULL,
+};
+
+enum i2s_std {
+        I2S_STD_I2S,
+        I2S_STD_LEFT_J,
+        I2S_STD_RIGHT_J,
+        I2S_STD_DSP,
+};
+
+enum i2s_datlen {
+        I2S_I2SMOD_DATLEN_16,
+        I2S_I2SMOD_DATLEN_24,
+        I2S_I2SMOD_DATLEN_32,
+};
+
+#define STM32_I2S_DAI_NAME_SIZE         20
+#define STM32_I2S_FIFO_SIZE             16
+
+#define STM32_I2S_IS_MASTER(x)          ((x)->ms_flg == I2S_MS_MASTER)
+#define STM32_I2S_IS_SLAVE(x)           ((x)->ms_flg == I2S_MS_SLAVE)
+
+/**
+ * @regmap_conf: I2S register map configuration pointer
+ * @egmap: I2S register map pointer
+ * @pdev: device data pointer
+ * @dai_drv: DAI driver pointer
+ * @dma_data_tx: dma configuration data for tx channel
+ * @dma_data_rx: dma configuration data for tx channel
+ * @substream: PCM substream data pointer
+ * @i2sclk: kernel clock feeding the I2S clock generator
+ * @pclk: peripheral clock driving bus interface
+ * @x8kclk: I2S parent clock for sampling frequencies multiple of 8kHz
+ * @x11kclk: I2S parent clock for sampling frequencies multiple of 11kHz
+ * @base:  mmio register base virtual address
+ * @phys_addr: I2S registers physical base address
+ * @lock_fd: lock to manage race conditions in full duplex mode
+ * @dais_name: DAI name
+ * @mclk_rate: master clock frequency (Hz)
+ * @fmt: DAI protocol
+ * @refcount: keep count of opened streams on I2S
+ * @ms_flg: master mode flag.
+ */
+struct stm32_i2s_data {
+        const struct regmap_config *regmap_conf;
+        struct regmap *regmap;
+        struct platform_device *pdev;
+        struct snd_soc_dai_driver *dai_drv;
+        struct snd_dmaengine_dai_dma_data dma_data_tx;
+        struct snd_dmaengine_dai_dma_data dma_data_rx;
+        struct snd_pcm_substream *substream;
+        struct clk *i2sclk;
+        struct clk *pclk;
+        struct clk *x8kclk;
+        struct clk *x11kclk;
+        void __iomem *base;
+        dma_addr_t phys_addr;
+        spinlock_t lock_fd; /* Manage race conditions for full duplex */
+        char dais_name[STM32_I2S_DAI_NAME_SIZE];
+        unsigned int mclk_rate;
+        unsigned int fmt;
+        int refcount;
+        int ms_flg;
+};
+
+static irqreturn_t stm32_i2s_isr(int irq, void *devid)
+{
+        struct stm32_i2s_data *i2s = (struct stm32_i2s_data *)devid;
+        struct platform_device *pdev = i2s->pdev;
+        u32 sr, ier;
+        unsigned long flags;
+        int err = 0;
+
+        regmap_read(i2s->regmap, STM32_I2S_SR_REG, &sr);
+        regmap_read(i2s->regmap, STM32_I2S_IER_REG, &ier);
+
+        flags = sr & ier;
+        if (!flags) {
+                dev_dbg(&pdev->dev, "Spurious IRQ sr=0x%08x, ier=0x%08x\n",
+                        sr, ier);
+                return IRQ_NONE;
+        }
+
+        regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+                           I2S_IFCR_MASK, flags);
+
+        if (flags & I2S_SR_OVR) {
+                dev_dbg(&pdev->dev, "Overrun\n");
+                err = 1;
+        }
+
+        if (flags & I2S_SR_UDR) {
+                dev_dbg(&pdev->dev, "Underrun\n");
+                err = 1;
+        }
+
+        if (flags & I2S_SR_TIFRE)
+                dev_dbg(&pdev->dev, "Frame error\n");
+
+        if (err)
+                snd_pcm_stop_xrun(i2s->substream);
+
+        return IRQ_HANDLED;
+}
+
+static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM32_I2S_CR1_REG:
+        case STM32_I2S_CFG1_REG:
+        case STM32_I2S_CFG2_REG:
+        case STM32_I2S_IER_REG:
+        case STM32_I2S_SR_REG:
+        case STM32_I2S_IFCR_REG:
+        case STM32_I2S_TXDR_REG:
+        case STM32_I2S_RXDR_REG:
+        case STM32_I2S_CGFR_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool stm32_i2s_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM32_I2S_TXDR_REG:
+        case STM32_I2S_RXDR_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool stm32_i2s_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM32_I2S_CR1_REG:
+        case STM32_I2S_CFG1_REG:
+        case STM32_I2S_CFG2_REG:
+        case STM32_I2S_IER_REG:
+        case STM32_I2S_IFCR_REG:
+        case STM32_I2S_TXDR_REG:
+        case STM32_I2S_CGFR_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static int stm32_i2s_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+        u32 cgfr;
+        u32 cgfr_mask =  I2S_CGFR_I2SSTD_MASK | I2S_CGFR_CKPOL |
+                         I2S_CGFR_WSINV | I2S_CGFR_I2SCFG_MASK;
+
+        dev_dbg(cpu_dai->dev, "fmt %x\n", fmt);
+
+        /*
+         * winv = 0 : default behavior (high/low) for all standards
+         * ckpol = 0 for all standards.
+         */
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                cgfr = I2S_CGFR_I2SSTD_SET(I2S_STD_I2S);
+                break;
+        case SND_SOC_DAIFMT_MSB:
+                cgfr = I2S_CGFR_I2SSTD_SET(I2S_STD_LEFT_J);
+                break;
+        case SND_SOC_DAIFMT_LSB:
+                cgfr = I2S_CGFR_I2SSTD_SET(I2S_STD_RIGHT_J);
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                cgfr = I2S_CGFR_I2SSTD_SET(I2S_STD_DSP);
+                break;
+        /* DSP_B not mapped on I2S PCM long format. 1 bit offset does not fit */
+        default:
+                dev_err(cpu_dai->dev, "Unsupported protocol %#x\n",
+                        fmt & SND_SOC_DAIFMT_FORMAT_MASK);
+                return -EINVAL;
+        }
+
+        /* DAI clock strobing */
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                cgfr |= I2S_CGFR_CKPOL;
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                cgfr |= I2S_CGFR_WSINV;
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                cgfr |= I2S_CGFR_CKPOL;
+                cgfr |= I2S_CGFR_WSINV;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unsupported strobing %#x\n",
+                        fmt & SND_SOC_DAIFMT_INV_MASK);
+                return -EINVAL;
+        }
+
+        /* DAI clock master masks */
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                i2s->ms_flg = I2S_MS_SLAVE;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                i2s->ms_flg = I2S_MS_MASTER;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unsupported mode %#x\n",
+                        fmt & SND_SOC_DAIFMT_MASTER_MASK);
+                return -EINVAL;
+        }
+
+        i2s->fmt = fmt;
+        return regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                                  cgfr_mask, cgfr);
+}
+
+static int stm32_i2s_set_sysclk(struct snd_soc_dai *cpu_dai,
+                                int clk_id, unsigned int freq, int dir)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+
+        dev_dbg(cpu_dai->dev, "I2S MCLK frequency is %uHz\n", freq);
+
+        if ((dir == SND_SOC_CLOCK_OUT) && STM32_I2S_IS_MASTER(i2s)) {
+                i2s->mclk_rate = freq;
+
+                /* Enable master clock if master mode and mclk-fs are set */
+                return regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                                          I2S_CGFR_MCKOE, I2S_CGFR_MCKOE);
+        }
+
+        return 0;
+}
+
+static int stm32_i2s_configure_clock(struct snd_soc_dai *cpu_dai,
+                                     struct snd_pcm_hw_params *params)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+        unsigned long i2s_clock_rate;
+        unsigned int tmp, div, real_div, nb_bits, frame_len;
+        unsigned int rate = params_rate(params);
+        int ret;
+        u32 cgfr, cgfr_mask;
+        bool odd;
+
+        if (!(rate % 11025))
+                clk_set_parent(i2s->i2sclk, i2s->x11kclk);
+        else
+                clk_set_parent(i2s->i2sclk, i2s->x8kclk);
+        i2s_clock_rate = clk_get_rate(i2s->i2sclk);
+
+        /*
+         * mckl = mclk_ratio x ws
+         *   i2s mode : mclk_ratio = 256
+         *   dsp mode : mclk_ratio = 128
+         *
+         * mclk on
+         *   i2s mode : div = i2s_clk / (mclk_ratio * ws)
+         *   dsp mode : div = i2s_clk / (mclk_ratio * ws)
+         * mclk off
+         *   i2s mode : div = i2s_clk / (nb_bits x ws)
+         *   dsp mode : div = i2s_clk / (nb_bits x ws)
+         */
+        if (i2s->mclk_rate) {
+                tmp = DIV_ROUND_CLOSEST(i2s_clock_rate, i2s->mclk_rate);
+        } else {
+                frame_len = 32;
+                if ((i2s->fmt & SND_SOC_DAIFMT_FORMAT_MASK) ==
+                    SND_SOC_DAIFMT_DSP_A)
+                        frame_len = 16;
+
+                /* master clock not enabled */
+                ret = regmap_read(i2s->regmap, STM32_I2S_CGFR_REG, &cgfr);
+                if (ret < 0)
+                        return ret;
+
+                nb_bits = frame_len * ((cgfr & I2S_CGFR_CHLEN) + 1);
+                tmp = DIV_ROUND_CLOSEST(i2s_clock_rate, (nb_bits * rate));
+        }
+
+        /* Check the parity of the divider */
+        odd = tmp & 0x1;
+
+        /* Compute the div prescaler */
+        div = tmp >> 1;
+
+        cgfr = I2S_CGFR_I2SDIV_SET(div) | (odd << I2S_CGFR_ODD_SHIFT);
+        cgfr_mask = I2S_CGFR_I2SDIV_MASK | I2S_CGFR_ODD;
+
+        real_div = ((2 * div) + odd);
+        dev_dbg(cpu_dai->dev, "I2S clk: %ld, SCLK: %d\n",
+                i2s_clock_rate, rate);
+        dev_dbg(cpu_dai->dev, "Divider: 2*%d(div)+%d(odd) = %d\n",
+                div, odd, real_div);
+
+        if (((div == 1) && odd) || (div > I2S_CGFR_I2SDIV_MAX)) {
+                dev_err(cpu_dai->dev, "Wrong divider setting\n");
+                return -EINVAL;
+        }
+
+        if (!div && !odd)
+                dev_warn(cpu_dai->dev, "real divider forced to 1\n");
+
+        ret = regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                                 cgfr_mask, cgfr);
+        if (ret < 0)
+                return ret;
+
+        /* Set bitclock and frameclock to their inactive state */
+        return regmap_update_bits(i2s->regmap, STM32_I2S_CFG2_REG,
+                                  I2S_CFG2_AFCNTR, I2S_CFG2_AFCNTR);
+}
+
+static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai,
+                               struct snd_pcm_hw_params *params,
+                               struct snd_pcm_substream *substream)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+        int format = params_width(params);
+        u32 cfgr, cfgr_mask, cfg1, cfg1_mask;
+        unsigned int fthlv;
+        int ret;
+
+        if ((params_channels(params) == 1) &&
+            ((i2s->fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_DSP_A)) {
+                dev_err(cpu_dai->dev, "Mono mode supported only by DSP_A\n");
+                return -EINVAL;
+        }
+
+        switch (format) {
+        case 16:
+                cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_16);
+                cfgr_mask = I2S_CGFR_DATLEN_MASK;
+                break;
+        case 32:
+                cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_32) |
+                                           I2S_CGFR_CHLEN;
+                cfgr_mask = I2S_CGFR_DATLEN_MASK | I2S_CGFR_CHLEN;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unexpected format %d", format);
+                return -EINVAL;
+        }
+
+        if (STM32_I2S_IS_SLAVE(i2s)) {
+                cfgr |= I2S_CGFR_I2SCFG_SET(I2S_I2SMOD_FD_SLAVE);
+
+                /* As data length is either 16 or 32 bits, fixch always set */
+                cfgr |= I2S_CGFR_FIXCH;
+                cfgr_mask |= I2S_CGFR_FIXCH;
+        } else {
+                cfgr |= I2S_CGFR_I2SCFG_SET(I2S_I2SMOD_FD_MASTER);
+        }
+        cfgr_mask |= I2S_CGFR_I2SCFG_MASK;
+
+        ret = regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                                 cfgr_mask, cfgr);
+        if (ret < 0)
+                return ret;
+
+        cfg1 = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN;
+        cfg1_mask = cfg1;
+
+        fthlv = STM32_I2S_FIFO_SIZE * I2S_FIFO_TH_ONE_QUARTER / 4;
+        cfg1 |= I2S_CFG1_FTHVL_SET(fthlv - 1);
+        cfg1_mask |= I2S_CFG1_FTHVL_MASK;
+
+        return regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG,
+                                  cfg1_mask, cfg1);
+}
+
+static int stm32_i2s_startup(struct snd_pcm_substream *substream,
+                             struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+
+        i2s->substream = substream;
+
+        spin_lock(&i2s->lock_fd);
+        i2s->refcount++;
+        spin_unlock(&i2s->lock_fd);
+
+        return regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+                                  I2S_IFCR_MASK, I2S_IFCR_MASK);
+}
+
+static int stm32_i2s_hw_params(struct snd_pcm_substream *substream,
+                               struct snd_pcm_hw_params *params,
+                               struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret;
+
+        ret = stm32_i2s_configure(cpu_dai, params, substream);
+        if (ret < 0) {
+                dev_err(cpu_dai->dev, "Configuration returned error %d\n", ret);
+                return ret;
+        }
+
+        if (STM32_I2S_IS_MASTER(i2s))
+                ret = stm32_i2s_configure_clock(cpu_dai, params);
+
+        return ret;
+}
+
+static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+                             struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+        bool playback_flg = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+        u32 cfg1_mask, ier;
+        int ret;
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                /* Enable i2s */
+                dev_dbg(cpu_dai->dev, "start I2S\n");
+
+                ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG,
+                                         I2S_CR1_SPE, I2S_CR1_SPE);
+                if (ret < 0) {
+                        dev_err(cpu_dai->dev, "Error %d enabling I2S\n", ret);
+                        return ret;
+                }
+
+                ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG,
+                                         I2S_CR1_CSTART, I2S_CR1_CSTART);
+                if (ret < 0) {
+                        dev_err(cpu_dai->dev, "Error %d starting I2S\n", ret);
+                        return ret;
+                }
+
+                regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+                                   I2S_IFCR_MASK, I2S_IFCR_MASK);
+
+                if (playback_flg) {
+                        ier = I2S_IER_UDRIE;
+                } else {
+                        ier = I2S_IER_OVRIE;
+
+                        spin_lock(&i2s->lock_fd);
+                        if (i2s->refcount == 1)
+                                /* dummy write to trigger capture */
+                                regmap_write(i2s->regmap,
+                                             STM32_I2S_TXDR_REG, 0);
+                        spin_unlock(&i2s->lock_fd);
+                }
+
+                if (STM32_I2S_IS_SLAVE(i2s))
+                        ier |= I2S_IER_TIFREIE;
+
+                regmap_update_bits(i2s->regmap, STM32_I2S_IER_REG, ier, ier);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (playback_flg)
+                        regmap_update_bits(i2s->regmap, STM32_I2S_IER_REG,
+                                           I2S_IER_UDRIE,
+                                           (unsigned int)~I2S_IER_UDRIE);
+                else
+                        regmap_update_bits(i2s->regmap, STM32_I2S_IER_REG,
+                                           I2S_IER_OVRIE,
+                                           (unsigned int)~I2S_IER_OVRIE);
+
+                spin_lock(&i2s->lock_fd);
+                i2s->refcount--;
+                if (i2s->refcount) {
+                        spin_unlock(&i2s->lock_fd);
+                        break;
+                }
+                spin_unlock(&i2s->lock_fd);
+
+                dev_dbg(cpu_dai->dev, "stop I2S\n");
+
+                ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG,
+                                         I2S_CR1_SPE, 0);
+                if (ret < 0) {
+                        dev_err(cpu_dai->dev, "Error %d disabling I2S\n", ret);
+                        return ret;
+                }
+
+                cfg1_mask = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN;
+                regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG,
+                                   cfg1_mask, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void stm32_i2s_shutdown(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+
+        i2s->substream = NULL;
+
+        regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                           I2S_CGFR_MCKOE, (unsigned int)~I2S_CGFR_MCKOE);
+}
+
+static int stm32_i2s_dai_probe(struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_i2s_data *i2s = dev_get_drvdata(cpu_dai->dev);
+        struct snd_dmaengine_dai_dma_data *dma_data_tx = &i2s->dma_data_tx;
+        struct snd_dmaengine_dai_dma_data *dma_data_rx = &i2s->dma_data_rx;
+
+        /* Buswidth will be set by framework */
+        dma_data_tx->addr_width = DMA_SLAVE_BUSWIDTH_UNDEFINED;
+        dma_data_tx->addr = (dma_addr_t)(i2s->phys_addr) + STM32_I2S_TXDR_REG;
+        dma_data_tx->maxburst = 1;
+        dma_data_rx->addr_width = DMA_SLAVE_BUSWIDTH_UNDEFINED;
+        dma_data_rx->addr = (dma_addr_t)(i2s->phys_addr) + STM32_I2S_RXDR_REG;
+        dma_data_rx->maxburst = 1;
+
+        snd_soc_dai_init_dma_data(cpu_dai, dma_data_tx, dma_data_rx);
+
+        return 0;
+}
+
+static const struct regmap_config stm32_h7_i2s_regmap_conf = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = STM32_I2S_CGFR_REG,
+        .readable_reg = stm32_i2s_readable_reg,
+        .volatile_reg = stm32_i2s_volatile_reg,
+        .writeable_reg = stm32_i2s_writeable_reg,
+        .fast_io = true,
+};
+
+static const struct snd_soc_dai_ops stm32_i2s_pcm_dai_ops = {
+        .set_sysclk     = stm32_i2s_set_sysclk,
+        .set_fmt        = stm32_i2s_set_dai_fmt,
+        .startup        = stm32_i2s_startup,
+        .hw_params      = stm32_i2s_hw_params,
+        .trigger        = stm32_i2s_trigger,
+        .shutdown       = stm32_i2s_shutdown,
+};
+
+static const struct snd_pcm_hardware stm32_i2s_pcm_hw = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+        .buffer_bytes_max = 8 * PAGE_SIZE,
+        .period_bytes_max = 2048,
+        .periods_min = 2,
+        .periods_max = 8,
+};
+
+static const struct snd_dmaengine_pcm_config stm32_i2s_pcm_config = {
+        .pcm_hardware   = &stm32_i2s_pcm_hw,
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+        .prealloc_buffer_size = PAGE_SIZE * 8,
+};
+
+static const struct snd_soc_component_driver stm32_i2s_component = {
+        .name = "stm32-i2s",
+};
+
+static void stm32_i2s_dai_init(struct snd_soc_pcm_stream *stream,
+                               char *stream_name)
+{
+        stream->stream_name = stream_name;
+        stream->channels_min = 1;
+        stream->channels_max = 2;
+        stream->rates = SNDRV_PCM_RATE_8000_192000;
+        stream->formats = SNDRV_PCM_FMTBIT_S16_LE |
+                                   SNDRV_PCM_FMTBIT_S32_LE;
+}
+
+static int stm32_i2s_dais_init(struct platform_device *pdev,
+                               struct stm32_i2s_data *i2s)
+{
+        struct snd_soc_dai_driver *dai_ptr;
+
+        dai_ptr = devm_kzalloc(&pdev->dev, sizeof(struct snd_soc_dai_driver),
+                               GFP_KERNEL);
+        if (!dai_ptr)
+                return -ENOMEM;
+
+        snprintf(i2s->dais_name, STM32_I2S_DAI_NAME_SIZE,
+                 "%s", dev_name(&pdev->dev));
+
+        dai_ptr->probe = stm32_i2s_dai_probe;
+        dai_ptr->ops = &stm32_i2s_pcm_dai_ops;
+        dai_ptr->name = i2s->dais_name;
+        dai_ptr->id = 1;
+        stm32_i2s_dai_init(&dai_ptr->playback, "playback");
+        stm32_i2s_dai_init(&dai_ptr->capture, "capture");
+        i2s->dai_drv = dai_ptr;
+
+        return 0;
+}
+
+static const struct of_device_id stm32_i2s_ids[] = {
+        {
+                .compatible = "st,stm32h7-i2s",
+                .data = &stm32_h7_i2s_regmap_conf
+        },
+        {},
+};
+
+static int stm32_i2s_parse_dt(struct platform_device *pdev,
+                              struct stm32_i2s_data *i2s)
+{
+        struct device_node *np = pdev->dev.of_node;
+        const struct of_device_id *of_id;
+        struct reset_control *rst;
+        struct resource *res;
+        int irq, ret;
+
+        if (!np)
+                return -ENODEV;
+
+        of_id = of_match_device(stm32_i2s_ids, &pdev->dev);
+        if (of_id)
+                i2s->regmap_conf = (const struct regmap_config *)of_id->data;
+        else
+                return -EINVAL;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        i2s->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(i2s->base))
+                return PTR_ERR(i2s->base);
+
+        i2s->phys_addr = res->start;
+
+        /* Get clocks */
+        i2s->pclk = devm_clk_get(&pdev->dev, "pclk");
+        if (IS_ERR(i2s->pclk)) {
+                dev_err(&pdev->dev, "Could not get pclk\n");
+                return PTR_ERR(i2s->pclk);
+        }
+
+        i2s->i2sclk = devm_clk_get(&pdev->dev, "i2sclk");
+        if (IS_ERR(i2s->i2sclk)) {
+                dev_err(&pdev->dev, "Could not get i2sclk\n");
+                return PTR_ERR(i2s->i2sclk);
+        }
+
+        i2s->x8kclk = devm_clk_get(&pdev->dev, "x8k");
+        if (IS_ERR(i2s->x8kclk)) {
+                dev_err(&pdev->dev, "missing x8k parent clock\n");
+                return PTR_ERR(i2s->x8kclk);
+        }
+
+        i2s->x11kclk = devm_clk_get(&pdev->dev, "x11k");
+        if (IS_ERR(i2s->x11kclk)) {
+                dev_err(&pdev->dev, "missing x11k parent clock\n");
+                return PTR_ERR(i2s->x11kclk);
+        }
+
+        /* Get irqs */
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "no irq for node %s\n", pdev->name);
+                return -ENOENT;
+        }
+
+        ret = devm_request_irq(&pdev->dev, irq, stm32_i2s_isr, IRQF_ONESHOT,
+                               dev_name(&pdev->dev), i2s);
+        if (ret) {
+                dev_err(&pdev->dev, "irq request returned %d\n", ret);
+                return ret;
+        }
+
+        /* Reset */
+        rst = devm_reset_control_get(&pdev->dev, NULL);
+        if (!IS_ERR(rst)) {
+                reset_control_assert(rst);
+                udelay(2);
+                reset_control_deassert(rst);
+        }
+
+        return 0;
+}
+
+static int stm32_i2s_probe(struct platform_device *pdev)
+{
+        struct stm32_i2s_data *i2s;
+        int ret;
+
+        i2s = devm_kzalloc(&pdev->dev, sizeof(*i2s), GFP_KERNEL);
+        if (!i2s)
+                return -ENOMEM;
+
+        ret = stm32_i2s_parse_dt(pdev, i2s);
+        if (ret)
+                return ret;
+
+        i2s->pdev = pdev;
+        i2s->ms_flg = I2S_MS_NOT_SET;
+        spin_lock_init(&i2s->lock_fd);
+        platform_set_drvdata(pdev, i2s);
+
+        ret = stm32_i2s_dais_init(pdev, i2s);
+        if (ret)
+                return ret;
+
+        i2s->regmap = devm_regmap_init_mmio(&pdev->dev, i2s->base,
+                                            i2s->regmap_conf);
+        if (IS_ERR(i2s->regmap)) {
+                dev_err(&pdev->dev, "regmap init failed\n");
+                return PTR_ERR(i2s->regmap);
+        }
+
+        ret = clk_prepare_enable(i2s->pclk);
+        if (ret) {
+                dev_err(&pdev->dev, "Enable pclk failed: %d\n", ret);
+                return ret;
+        }
+
+        ret = clk_prepare_enable(i2s->i2sclk);
+        if (ret) {
+                dev_err(&pdev->dev, "Enable i2sclk failed: %d\n", ret);
+                goto err_pclk_disable;
+        }
+
+        ret = devm_snd_soc_register_component(&pdev->dev, &stm32_i2s_component,
+                                              i2s->dai_drv, 1);
+        if (ret)
+                goto err_clocks_disable;
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev,
+                                              &stm32_i2s_pcm_config, 0);
+        if (ret)
+                goto err_clocks_disable;
+
+        /* Set SPI/I2S in i2s mode */
+        ret = regmap_update_bits(i2s->regmap, STM32_I2S_CGFR_REG,
+                                 I2S_CGFR_I2SMOD, I2S_CGFR_I2SMOD);
+        if (ret)
+                goto err_clocks_disable;
+
+        return ret;
+
+err_clocks_disable:
+        clk_disable_unprepare(i2s->i2sclk);
+err_pclk_disable:
+        clk_disable_unprepare(i2s->pclk);
+
+        return ret;
+}
+
+static int stm32_i2s_remove(struct platform_device *pdev)
+{
+        struct stm32_i2s_data *i2s = platform_get_drvdata(pdev);
+
+        clk_disable_unprepare(i2s->i2sclk);
+        clk_disable_unprepare(i2s->pclk);
+
+        return 0;
+}
+
+MODULE_DEVICE_TABLE(of, stm32_i2s_ids);
+
+static struct platform_driver stm32_i2s_driver = {
+        .driver = {
+                .name = "st,stm32-i2s",
+                .of_match_table = stm32_i2s_ids,
+        },
+        .probe = stm32_i2s_probe,
+        .remove = stm32_i2s_remove,
+};
+
+module_platform_driver(stm32_i2s_driver);
+
+MODULE_DESCRIPTION("STM32 Soc i2s Interface");
+MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_ALIAS("platform:stm32-i2s");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
index 2a27a26bf7a1..f7713314913b 100644
--- a/sound/soc/stm/stm32_sai.c
+++ b/sound/soc/stm/stm32_sai.c
@@ -27,8 +27,17 @@
 
 #include "stm32_sai.h"
 
+static const struct stm32_sai_conf stm32_sai_conf_f4 = {
+        .version = SAI_STM32F4,
+};
+
+static const struct stm32_sai_conf stm32_sai_conf_h7 = {
+        .version = SAI_STM32H7,
+};
+
 static const struct of_device_id stm32_sai_ids[] = {
-        { .compatible = "st,stm32f4-sai", .data = (void *)SAI_STM32F4 },
+        { .compatible = "st,stm32f4-sai", .data = (void *)&stm32_sai_conf_f4 },
+        { .compatible = "st,stm32h7-sai", .data = (void *)&stm32_sai_conf_h7 },
         {}
 };
 
@@ -52,7 +61,7 @@ static int stm32_sai_probe(struct platform_device *pdev)
 
         of_id = of_match_device(stm32_sai_ids, &pdev->dev);
         if (of_id)
-                sai->version = (enum stm32_sai_version)of_id->data;
+                sai->conf = (struct stm32_sai_conf *)of_id->data;
         else
                 return -EINVAL;
 
@@ -110,6 +119,6 @@ static struct platform_driver stm32_sai_driver = {
 module_platform_driver(stm32_sai_driver);
 
 MODULE_DESCRIPTION("STM32 Soc SAI Interface");
-MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_AUTHOR("Olivier Moysan <olivier.moysan@st.com>");
 MODULE_ALIAS("platform:st,stm32-sai");
 MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/stm/stm32_sai.h b/sound/soc/stm/stm32_sai.h
index a801fda5066f..889974dc62d9 100644
--- a/sound/soc/stm/stm32_sai.h
+++ b/sound/soc/stm/stm32_sai.h
@@ -31,6 +31,10 @@
 #define STM_SAI_CLRFR_REGX      0x18
 #define STM_SAI_DR_REGX         0x1C
 
+/* Sub-block A registers, relative to sub-block A address */
+#define STM_SAI_PDMCR_REGX      0x40
+#define STM_SAI_PDMLY_REGX      0x44
+
 /******************** Bit definition for SAI_GCR register *******************/
 #define SAI_GCR_SYNCIN_SHIFT    0
 #define SAI_GCR_SYNCIN_MASK     GENMASK(1, SAI_GCR_SYNCIN_SHIFT)
@@ -75,10 +79,11 @@
 #define SAI_XCR1_NODIV          BIT(SAI_XCR1_NODIV_SHIFT)
 
 #define SAI_XCR1_MCKDIV_SHIFT   20
-#define SAI_XCR1_MCKDIV_WIDTH   4
-#define SAI_XCR1_MCKDIV_MASK    GENMASK(24, SAI_XCR1_MCKDIV_SHIFT)
+#define SAI_XCR1_MCKDIV_WIDTH(x)        (((x) == SAI_STM32F4) ? 4 : 6)
+#define SAI_XCR1_MCKDIV_MASK(x) GENMASK((SAI_XCR1_MCKDIV_SHIFT + (x) - 1),\
+                                SAI_XCR1_MCKDIV_SHIFT)
 #define SAI_XCR1_MCKDIV_SET(x)  ((x) << SAI_XCR1_MCKDIV_SHIFT)
-#define SAI_XCR1_MCKDIV_MAX     ((1 << SAI_XCR1_MCKDIV_WIDTH) - 1)
+#define SAI_XCR1_MCKDIV_MAX(x)  ((1 << SAI_XCR1_MCKDIV_WIDTH(x)) - 1)
 
 #define SAI_XCR1_OSR_SHIFT      26
 #define SAI_XCR1_OSR            BIT(SAI_XCR1_OSR_SHIFT)
@@ -125,7 +130,6 @@
 #define SAI_XFRCR_FSOFF         BIT(SAI_XFRCR_FSOFF_SHIFT)
 
 /****************** Bit definition for SAI_XSLOTR register ******************/
-
 #define SAI_XSLOTR_FBOFF_SHIFT  0
 #define SAI_XSLOTR_FBOFF_MASK   GENMASK(4, SAI_XSLOTR_FBOFF_SHIFT)
 #define SAI_XSLOTR_FBOFF_SET(x) ((x) << SAI_XSLOTR_FBOFF_SHIFT)
@@ -179,8 +183,65 @@
 #define SAI_XCLRFR_SHIFT        0
 #define SAI_XCLRFR_MASK         GENMASK(6, SAI_XCLRFR_SHIFT)
 
+/****************** Bit definition for SAI_PDMCR register ******************/
+#define SAI_PDMCR_PDMEN         BIT(0)
+
+#define SAI_PDMCR_MICNBR_SHIFT  4
+#define SAI_PDMCR_MICNBR_MASK   GENMASK(5, SAI_PDMCR_MICNBR_SHIFT)
+#define SAI_PDMCR_MICNBR_SET(x) ((x) << SAI_PDMCR_MICNBR_SHIFT)
+
+#define SAI_PDMCR_CKEN1         BIT(8)
+#define SAI_PDMCR_CKEN2         BIT(9)
+#define SAI_PDMCR_CKEN3         BIT(10)
+#define SAI_PDMCR_CKEN4         BIT(11)
+
+/****************** Bit definition for (SAI_PDMDLY register ****************/
+#define SAI_PDMDLY_1L_SHIFT     0
+#define SAI_PDMDLY_1L_MASK      GENMASK(2, SAI_PDMDLY_1L_SHIFT)
+#define SAI_PDMDLY_1L_WIDTH     3
+
+#define SAI_PDMDLY_1R_SHIFT     4
+#define SAI_PDMDLY_1R_MASK      GENMASK(6, SAI_PDMDLY_1R_SHIFT)
+#define SAI_PDMDLY_1R_WIDTH     3
+
+#define SAI_PDMDLY_2L_SHIFT     8
+#define SAI_PDMDLY_2L_MASK      GENMASK(10, SAI_PDMDLY_2L_SHIFT)
+#define SAI_PDMDLY_2L_WIDTH     3
+
+#define SAI_PDMDLY_2R_SHIFT     12
+#define SAI_PDMDLY_2R_MASK      GENMASK(14, SAI_PDMDLY_2R_SHIFT)
+#define SAI_PDMDLY_2R_WIDTH     3
+
+#define SAI_PDMDLY_3L_SHIFT     16
+#define SAI_PDMDLY_3L_MASK      GENMASK(18, SAI_PDMDLY_3L_SHIFT)
+#define SAI_PDMDLY_3L_WIDTH     3
+
+#define SAI_PDMDLY_3R_SHIFT     20
+#define SAI_PDMDLY_3R_MASK      GENMASK(22, SAI_PDMDLY_3R_SHIFT)
+#define SAI_PDMDLY_3R_WIDTH     3
+
+#define SAI_PDMDLY_4L_SHIFT     24
+#define SAI_PDMDLY_4L_MASK      GENMASK(26, SAI_PDMDLY_4L_SHIFT)
+#define SAI_PDMDLY_4L_WIDTH     3
+
+#define SAI_PDMDLY_4R_SHIFT     28
+#define SAI_PDMDLY_4R_MASK      GENMASK(30, SAI_PDMDLY_4R_SHIFT)
+#define SAI_PDMDLY_4R_WIDTH     3
+
+#define STM_SAI_IS_F4(ip)       ((ip)->conf->version == SAI_STM32F4)
+#define STM_SAI_IS_H7(ip)       ((ip)->conf->version == SAI_STM32H7)
+
 enum stm32_sai_version {
-        SAI_STM32F4
+        SAI_STM32F4,
+        SAI_STM32H7
+};
+
+/**
+ * struct stm32_sai_conf - SAI configuration
+ * @version: SAI version
+ */
+struct stm32_sai_conf {
+        int version;
 };
 
 /**
@@ -195,6 +256,6 @@ struct stm32_sai_data {
         struct platform_device *pdev;
         struct clk *clk_x8k;
         struct clk *clk_x11k;
-        int version;
+        struct stm32_sai_conf *conf;
         int irq;
 };
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index ae4706ca265b..90d439613899 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -51,12 +51,15 @@
 #define STM_SAI_A_ID            0x0
 #define STM_SAI_B_ID            0x1
 
+#define STM_SAI_IS_SUB_A(x)     ((x)->id == STM_SAI_A_ID)
+#define STM_SAI_IS_SUB_B(x)     ((x)->id == STM_SAI_B_ID)
 #define STM_SAI_BLOCK_NAME(x)   (((x)->id == STM_SAI_A_ID) ? "A" : "B")
 
 /**
  * struct stm32_sai_sub_data - private data of SAI sub block (block A or B)
  * @pdev: device data pointer
  * @regmap: SAI register map pointer
+ * @regmap_config: SAI sub block register map configuration pointer
  * @dma_params: dma configuration data for rx or tx channel
  * @cpu_dai_drv: DAI driver data pointer
  * @cpu_dai: DAI runtime data pointer
@@ -79,6 +82,7 @@
 struct stm32_sai_sub_data {
         struct platform_device *pdev;
         struct regmap *regmap;
+        const struct regmap_config *regmap_config;
         struct snd_dmaengine_dai_dma_data dma_params;
         struct snd_soc_dai_driver *cpu_dai_drv;
         struct snd_soc_dai *cpu_dai;
@@ -118,6 +122,8 @@ static bool stm32_sai_sub_readable_reg(struct device *dev, unsigned int reg)
         case STM_SAI_SR_REGX:
         case STM_SAI_CLRFR_REGX:
         case STM_SAI_DR_REGX:
+        case STM_SAI_PDMCR_REGX:
+        case STM_SAI_PDMLY_REGX:
                 return true;
         default:
                 return false;
@@ -145,13 +151,15 @@ static bool stm32_sai_sub_writeable_reg(struct device *dev, unsigned int reg)
         case STM_SAI_SR_REGX:
         case STM_SAI_CLRFR_REGX:
         case STM_SAI_DR_REGX:
+        case STM_SAI_PDMCR_REGX:
+        case STM_SAI_PDMLY_REGX:
                 return true;
         default:
                 return false;
         }
 }
 
-static const struct regmap_config stm32_sai_sub_regmap_config = {
+static const struct regmap_config stm32_sai_sub_regmap_config_f4 = {
         .reg_bits = 32,
         .reg_stride = 4,
         .val_bits = 32,
@@ -162,6 +170,17 @@ static const struct regmap_config stm32_sai_sub_regmap_config = {
         .fast_io = true,
 };
 
+static const struct regmap_config stm32_sai_sub_regmap_config_h7 = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = STM_SAI_PDMLY_REGX,
+        .readable_reg = stm32_sai_sub_readable_reg,
+        .volatile_reg = stm32_sai_sub_volatile_reg,
+        .writeable_reg = stm32_sai_sub_writeable_reg,
+        .fast_io = true,
+};
+
 static irqreturn_t stm32_sai_isr(int irq, void *devid)
 {
         struct stm32_sai_sub_data *sai = (struct stm32_sai_sub_data *)devid;
@@ -181,29 +200,29 @@ static irqreturn_t stm32_sai_isr(int irq, void *devid)
                            SAI_XCLRFR_MASK);
 
         if (flags & SAI_XIMR_OVRUDRIE) {
-                dev_err(&pdev->dev, "IT %s\n",
+                dev_err(&pdev->dev, "IRQ %s\n",
                         STM_SAI_IS_PLAYBACK(sai) ? "underrun" : "overrun");
                 status = SNDRV_PCM_STATE_XRUN;
         }
 
         if (flags & SAI_XIMR_MUTEDETIE)
-                dev_dbg(&pdev->dev, "IT mute detected\n");
+                dev_dbg(&pdev->dev, "IRQ mute detected\n");
 
         if (flags & SAI_XIMR_WCKCFGIE) {
-                dev_err(&pdev->dev, "IT wrong clock configuration\n");
+                dev_err(&pdev->dev, "IRQ wrong clock configuration\n");
                 status = SNDRV_PCM_STATE_DISCONNECTED;
         }
 
         if (flags & SAI_XIMR_CNRDYIE)
-                dev_warn(&pdev->dev, "IT Codec not ready\n");
+                dev_err(&pdev->dev, "IRQ Codec not ready\n");
 
         if (flags & SAI_XIMR_AFSDETIE) {
-                dev_warn(&pdev->dev, "IT Anticipated frame synchro\n");
+                dev_err(&pdev->dev, "IRQ Anticipated frame synchro\n");
                 status = SNDRV_PCM_STATE_XRUN;
         }
 
         if (flags & SAI_XIMR_LFSDETIE) {
-                dev_warn(&pdev->dev, "IT Late frame synchro\n");
+                dev_err(&pdev->dev, "IRQ Late frame synchro\n");
                 status = SNDRV_PCM_STATE_XRUN;
         }
 
@@ -220,8 +239,15 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
                                 int clk_id, unsigned int freq, int dir)
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret;
 
         if ((dir == SND_SOC_CLOCK_OUT) && sai->master) {
+                ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
+                                         SAI_XCR1_NODIV,
+                                         (unsigned int)~SAI_XCR1_NODIV);
+                if (ret < 0)
+                        return ret;
+
                 sai->mclk_rate = freq;
                 dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
         }
@@ -235,7 +261,7 @@ static int stm32_sai_set_dai_tdm_slot(struct snd_soc_dai *cpu_dai, u32 tx_mask,
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int slotr, slotr_mask, slot_size;
 
-        dev_dbg(cpu_dai->dev, "masks tx/rx:%#x/%#x, slots:%d, width:%d\n",
+        dev_dbg(cpu_dai->dev, "Masks tx/rx:%#x/%#x, slots:%d, width:%d\n",
                 tx_mask, rx_mask, slots, slot_width);
 
         switch (slot_width) {
@@ -356,6 +382,10 @@ static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
         }
         cr1_mask |= SAI_XCR1_SLAVE;
 
+        /* do not generate master by default */
+        cr1 |= SAI_XCR1_NODIV;
+        cr1_mask |= SAI_XCR1_NODIV;
+
         ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, cr1_mask, cr1);
         if (ret < 0) {
                 dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
@@ -377,7 +407,7 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream,
 
         ret = clk_prepare_enable(sai->sai_ck);
         if (ret < 0) {
-                dev_err(cpu_dai->dev, "failed to enable clock: %d\n", ret);
+                dev_err(cpu_dai->dev, "Failed to enable clock: %d\n", ret);
                 return ret;
         }
 
@@ -497,7 +527,7 @@ static int stm32_sai_set_slots(struct snd_soc_dai *cpu_dai)
                                    SAI_XSLOTR_SLOTEN_SET(sai->slot_mask));
         }
 
-        dev_dbg(cpu_dai->dev, "slots %d, slot width %d\n",
+        dev_dbg(cpu_dai->dev, "Slots %d, slot width %d\n",
                 sai->slots, sai->slot_width);
 
         return 0;
@@ -521,7 +551,7 @@ static void stm32_sai_set_frame(struct snd_soc_dai *cpu_dai)
         frcr |= SAI_XFRCR_FSALL_SET((fs_active - 1));
         frcr_mask = SAI_XFRCR_FRL_MASK | SAI_XFRCR_FSALL_MASK;
 
-        dev_dbg(cpu_dai->dev, "frame length %d, frame active %d\n",
+        dev_dbg(cpu_dai->dev, "Frame length %d, frame active %d\n",
                 sai->fs_length, fs_active);
 
         regmap_update_bits(sai->regmap, STM_SAI_FRCR_REGX, frcr_mask, frcr);
@@ -540,7 +570,8 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int cr1, mask, div = 0;
-        int sai_clk_rate, ret;
+        int sai_clk_rate, mclk_ratio, den, ret;
+        int version = sai->pdata->conf->version;
 
         if (!sai->mclk_rate) {
                 dev_err(cpu_dai->dev, "Mclk rate is null\n");
@@ -553,21 +584,53 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
                 clk_set_parent(sai->sai_ck, sai->pdata->clk_x8k);
         sai_clk_rate = clk_get_rate(sai->sai_ck);
 
-        /*
-         * mclk_rate = 256 * fs
-         * MCKDIV = 0 if sai_ck < 3/2 * mclk_rate
-         * MCKDIV = sai_ck / (2 * mclk_rate) otherwise
-         */
-        if (2 * sai_clk_rate >= 3 * sai->mclk_rate)
-                div = DIV_ROUND_CLOSEST(sai_clk_rate, 2 * sai->mclk_rate);
-
-        if (div > SAI_XCR1_MCKDIV_MAX) {
+        if (STM_SAI_IS_F4(sai->pdata)) {
+                /*
+                 * mclk_rate = 256 * fs
+                 * MCKDIV = 0 if sai_ck < 3/2 * mclk_rate
+                 * MCKDIV = sai_ck / (2 * mclk_rate) otherwise
+                 */
+                if (2 * sai_clk_rate >= 3 * sai->mclk_rate)
+                        div = DIV_ROUND_CLOSEST(sai_clk_rate,
+                                                2 * sai->mclk_rate);
+        } else {
+                /*
+                 * TDM mode :
+                 *   mclk on
+                 *      MCKDIV = sai_ck / (ws x 256)    (NOMCK=0. OSR=0)
+                 *      MCKDIV = sai_ck / (ws x 512)    (NOMCK=0. OSR=1)
+                 *   mclk off
+                 *      MCKDIV = sai_ck / (frl x ws)    (NOMCK=1)
+                 * Note: NOMCK/NODIV correspond to same bit.
+                 */
+                if (sai->mclk_rate) {
+                        mclk_ratio = sai->mclk_rate / params_rate(params);
+                        if (mclk_ratio != 256) {
+                                if (mclk_ratio == 512) {
+                                        mask = SAI_XCR1_OSR;
+                                        cr1 = SAI_XCR1_OSR;
+                                } else {
+                                        dev_err(cpu_dai->dev,
+                                                "Wrong mclk ratio %d\n",
+                                                mclk_ratio);
+                                        return -EINVAL;
+                                }
+                        }
+                        div = DIV_ROUND_CLOSEST(sai_clk_rate, sai->mclk_rate);
+                } else {
+                        /* mclk-fs not set, master clock not active. NOMCK=1 */
+                        den = sai->fs_length * params_rate(params);
+                        div = DIV_ROUND_CLOSEST(sai_clk_rate, den);
+                }
+        }
+
+        if (div > SAI_XCR1_MCKDIV_MAX(version)) {
                 dev_err(cpu_dai->dev, "Divider %d out of range\n", div);
                 return -EINVAL;
         }
         dev_dbg(cpu_dai->dev, "SAI clock %d, divider %d\n", sai_clk_rate, div);
 
-        mask = SAI_XCR1_MCKDIV_MASK;
+        mask = SAI_XCR1_MCKDIV_MASK(SAI_XCR1_MCKDIV_WIDTH(version));
         cr1 = SAI_XCR1_MCKDIV_SET(div);
         ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, mask, cr1);
         if (ret < 0) {
@@ -629,12 +692,12 @@ static int stm32_sai_trigger(struct snd_pcm_substream *substream, int cmd,
                 dev_dbg(cpu_dai->dev, "Disable DMA and SAI\n");
 
                 regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
-                                   SAI_XCR1_DMAEN,
-                                   (unsigned int)~SAI_XCR1_DMAEN);
+                                   SAI_XCR1_SAIEN,
+                                   (unsigned int)~SAI_XCR1_SAIEN);
 
                 ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
-                                         SAI_XCR1_SAIEN,
-                                         (unsigned int)~SAI_XCR1_SAIEN);
+                                         SAI_XCR1_DMAEN,
+                                         (unsigned int)~SAI_XCR1_DMAEN);
                 if (ret < 0)
                         dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
                 break;
@@ -652,6 +715,9 @@ static void stm32_sai_shutdown(struct snd_pcm_substream *substream,
 
         regmap_update_bits(sai->regmap, STM_SAI_IMR_REGX, SAI_XIMR_MASK, 0);
 
+        regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, SAI_XCR1_NODIV,
+                           SAI_XCR1_NODIV);
+
         clk_disable_unprepare(sai->sai_ck);
         sai->substream = NULL;
 }
@@ -761,16 +827,23 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
                 return -ENODEV;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-
-        dev_err(&pdev->dev, "res %pr\n", res);
-
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
                 return PTR_ERR(base);
 
         sai->phys_addr = res->start;
-        sai->regmap = devm_regmap_init_mmio(&pdev->dev, base,
-                                            &stm32_sai_sub_regmap_config);
+
+        sai->regmap_config = &stm32_sai_sub_regmap_config_f4;
+        /* Note: PDM registers not available for H7 sub-block B */
+        if (STM_SAI_IS_H7(sai->pdata) && STM_SAI_IS_SUB_A(sai))
+                sai->regmap_config = &stm32_sai_sub_regmap_config_h7;
+
+        sai->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "sai_ck",
+                                                base, sai->regmap_config);
+        if (IS_ERR(sai->regmap)) {
+                dev_err(&pdev->dev, "Failed to initialize MMIO\n");
+                return PTR_ERR(sai->regmap);
+        }
 
         /* Get direction property */
         if (of_property_match_string(np, "dma-names", "tx") >= 0) {
@@ -784,7 +857,7 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev,
 
         sai->sai_ck = devm_clk_get(&pdev->dev, "sai_ck");
         if (IS_ERR(sai->sai_ck)) {
-                dev_err(&pdev->dev, "missing kernel clock sai_ck\n");
+                dev_err(&pdev->dev, "Missing kernel clock sai_ck\n");
                 return PTR_ERR(sai->sai_ck);
         }
 
@@ -849,7 +922,7 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
         ret = devm_request_irq(&pdev->dev, sai->pdata->irq, stm32_sai_isr,
                                IRQF_SHARED, dev_name(&pdev->dev), sai);
         if (ret) {
-                dev_err(&pdev->dev, "irq request returned %d\n", ret);
+                dev_err(&pdev->dev, "IRQ request returned %d\n", ret);
                 return ret;
         }
 
@@ -861,7 +934,7 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
         ret = devm_snd_dmaengine_pcm_register(&pdev->dev,
                                               &stm32_sai_pcm_config, 0);
         if (ret) {
-                dev_err(&pdev->dev, "could not register pcm dma\n");
+                dev_err(&pdev->dev, "Could not register pcm dma\n");
                 return ret;
         }
 
@@ -879,6 +952,6 @@ static struct platform_driver stm32_sai_sub_driver = {
 module_platform_driver(stm32_sai_sub_driver);
 
 MODULE_DESCRIPTION("STM32 Soc SAI sub-block Interface");
-MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_AUTHOR("Olivier Moysan <olivier.moysan@st.com>");
 MODULE_ALIAS("platform:st,stm32-sai-sub");
 MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c
new file mode 100644
index 000000000000..4e4250bdb75a
--- /dev/null
+++ b/sound/soc/stm/stm32_spdifrx.c
@@ -0,0 +1,998 @@
+/*
+ * STM32 ALSA SoC Digital Audio Interface (SPDIF-rx) driver.
+ *
+ * Copyright (C) 2017, STMicroelectronics - All Rights Reserved
+ * Author(s): Olivier Moysan <olivier.moysan@st.com> for STMicroelectronics.
+ *
+ * License terms: GPL V2.0.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ */
+
+#include <linux/clk.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/regmap.h>
+#include <linux/reset.h>
+
+#include <sound/dmaengine_pcm.h>
+#include <sound/pcm_params.h>
+
+/* SPDIF-rx Register Map */
+#define STM32_SPDIFRX_CR        0x00
+#define STM32_SPDIFRX_IMR       0x04
+#define STM32_SPDIFRX_SR        0x08
+#define STM32_SPDIFRX_IFCR      0x0C
+#define STM32_SPDIFRX_DR        0x10
+#define STM32_SPDIFRX_CSR       0x14
+#define STM32_SPDIFRX_DIR       0x18
+
+/* Bit definition for SPDIF_CR register */
+#define SPDIFRX_CR_SPDIFEN_SHIFT        0
+#define SPDIFRX_CR_SPDIFEN_MASK GENMASK(1, SPDIFRX_CR_SPDIFEN_SHIFT)
+#define SPDIFRX_CR_SPDIFENSET(x)        ((x) << SPDIFRX_CR_SPDIFEN_SHIFT)
+
+#define SPDIFRX_CR_RXDMAEN      BIT(2)
+#define SPDIFRX_CR_RXSTEO       BIT(3)
+
+#define SPDIFRX_CR_DRFMT_SHIFT  4
+#define SPDIFRX_CR_DRFMT_MASK   GENMASK(5, SPDIFRX_CR_DRFMT_SHIFT)
+#define SPDIFRX_CR_DRFMTSET(x)  ((x) << SPDIFRX_CR_DRFMT_SHIFT)
+
+#define SPDIFRX_CR_PMSK         BIT(6)
+#define SPDIFRX_CR_VMSK         BIT(7)
+#define SPDIFRX_CR_CUMSK        BIT(8)
+#define SPDIFRX_CR_PTMSK        BIT(9)
+#define SPDIFRX_CR_CBDMAEN      BIT(10)
+#define SPDIFRX_CR_CHSEL_SHIFT  11
+#define SPDIFRX_CR_CHSEL        BIT(SPDIFRX_CR_CHSEL_SHIFT)
+
+#define SPDIFRX_CR_NBTR_SHIFT   12
+#define SPDIFRX_CR_NBTR_MASK    GENMASK(13, SPDIFRX_CR_NBTR_SHIFT)
+#define SPDIFRX_CR_NBTRSET(x)   ((x) << SPDIFRX_CR_NBTR_SHIFT)
+
+#define SPDIFRX_CR_WFA          BIT(14)
+
+#define SPDIFRX_CR_INSEL_SHIFT  16
+#define SPDIFRX_CR_INSEL_MASK   GENMASK(18, PDIFRX_CR_INSEL_SHIFT)
+#define SPDIFRX_CR_INSELSET(x)  ((x) << SPDIFRX_CR_INSEL_SHIFT)
+
+#define SPDIFRX_CR_CKSEN_SHIFT  20
+#define SPDIFRX_CR_CKSEN        BIT(20)
+#define SPDIFRX_CR_CKSBKPEN     BIT(21)
+
+/* Bit definition for SPDIFRX_IMR register */
+#define SPDIFRX_IMR_RXNEI       BIT(0)
+#define SPDIFRX_IMR_CSRNEIE     BIT(1)
+#define SPDIFRX_IMR_PERRIE      BIT(2)
+#define SPDIFRX_IMR_OVRIE       BIT(3)
+#define SPDIFRX_IMR_SBLKIE      BIT(4)
+#define SPDIFRX_IMR_SYNCDIE     BIT(5)
+#define SPDIFRX_IMR_IFEIE       BIT(6)
+
+#define SPDIFRX_XIMR_MASK       GENMASK(6, 0)
+
+/* Bit definition for SPDIFRX_SR register */
+#define SPDIFRX_SR_RXNE         BIT(0)
+#define SPDIFRX_SR_CSRNE        BIT(1)
+#define SPDIFRX_SR_PERR         BIT(2)
+#define SPDIFRX_SR_OVR          BIT(3)
+#define SPDIFRX_SR_SBD          BIT(4)
+#define SPDIFRX_SR_SYNCD        BIT(5)
+#define SPDIFRX_SR_FERR         BIT(6)
+#define SPDIFRX_SR_SERR         BIT(7)
+#define SPDIFRX_SR_TERR         BIT(8)
+
+#define SPDIFRX_SR_WIDTH5_SHIFT 16
+#define SPDIFRX_SR_WIDTH5_MASK  GENMASK(30, PDIFRX_SR_WIDTH5_SHIFT)
+#define SPDIFRX_SR_WIDTH5SET(x) ((x) << SPDIFRX_SR_WIDTH5_SHIFT)
+
+/* Bit definition for SPDIFRX_IFCR register */
+#define SPDIFRX_IFCR_PERRCF     BIT(2)
+#define SPDIFRX_IFCR_OVRCF      BIT(3)
+#define SPDIFRX_IFCR_SBDCF      BIT(4)
+#define SPDIFRX_IFCR_SYNCDCF    BIT(5)
+
+#define SPDIFRX_XIFCR_MASK      GENMASK(5, 2)
+
+/* Bit definition for SPDIFRX_DR register (DRFMT = 0b00) */
+#define SPDIFRX_DR0_DR_SHIFT    0
+#define SPDIFRX_DR0_DR_MASK     GENMASK(23, SPDIFRX_DR0_DR_SHIFT)
+#define SPDIFRX_DR0_DRSET(x)    ((x) << SPDIFRX_DR0_DR_SHIFT)
+
+#define SPDIFRX_DR0_PE          BIT(24)
+
+#define SPDIFRX_DR0_V           BIT(25)
+#define SPDIFRX_DR0_U           BIT(26)
+#define SPDIFRX_DR0_C           BIT(27)
+
+#define SPDIFRX_DR0_PT_SHIFT    28
+#define SPDIFRX_DR0_PT_MASK     GENMASK(29, SPDIFRX_DR0_PT_SHIFT)
+#define SPDIFRX_DR0_PTSET(x)    ((x) << SPDIFRX_DR0_PT_SHIFT)
+
+/* Bit definition for SPDIFRX_DR register (DRFMT = 0b01) */
+#define  SPDIFRX_DR1_PE         BIT(0)
+#define  SPDIFRX_DR1_V          BIT(1)
+#define  SPDIFRX_DR1_U          BIT(2)
+#define  SPDIFRX_DR1_C          BIT(3)
+
+#define  SPDIFRX_DR1_PT_SHIFT   4
+#define  SPDIFRX_DR1_PT_MASK    GENMASK(5, SPDIFRX_DR1_PT_SHIFT)
+#define  SPDIFRX_DR1_PTSET(x)   ((x) << SPDIFRX_DR1_PT_SHIFT)
+
+#define SPDIFRX_DR1_DR_SHIFT    8
+#define SPDIFRX_DR1_DR_MASK     GENMASK(31, SPDIFRX_DR1_DR_SHIFT)
+#define SPDIFRX_DR1_DRSET(x)    ((x) << SPDIFRX_DR1_DR_SHIFT)
+
+/* Bit definition for SPDIFRX_DR register (DRFMT = 0b10) */
+#define SPDIFRX_DR1_DRNL1_SHIFT 0
+#define SPDIFRX_DR1_DRNL1_MASK  GENMASK(15, SPDIFRX_DR1_DRNL1_SHIFT)
+#define SPDIFRX_DR1_DRNL1SET(x) ((x) << SPDIFRX_DR1_DRNL1_SHIFT)
+
+#define SPDIFRX_DR1_DRNL2_SHIFT 16
+#define SPDIFRX_DR1_DRNL2_MASK  GENMASK(31, SPDIFRX_DR1_DRNL2_SHIFT)
+#define SPDIFRX_DR1_DRNL2SET(x) ((x) << SPDIFRX_DR1_DRNL2_SHIFT)
+
+/* Bit definition for SPDIFRX_CSR register */
+#define SPDIFRX_CSR_USR_SHIFT   0
+#define SPDIFRX_CSR_USR_MASK    GENMASK(15, SPDIFRX_CSR_USR_SHIFT)
+#define SPDIFRX_CSR_USRGET(x)   (((x) & SPDIFRX_CSR_USR_MASK)\
+                                >> SPDIFRX_CSR_USR_SHIFT)
+
+#define SPDIFRX_CSR_CS_SHIFT    16
+#define SPDIFRX_CSR_CS_MASK     GENMASK(23, SPDIFRX_CSR_CS_SHIFT)
+#define SPDIFRX_CSR_CSGET(x)    (((x) & SPDIFRX_CSR_CS_MASK)\
+                                >> SPDIFRX_CSR_CS_SHIFT)
+
+#define SPDIFRX_CSR_SOB         BIT(24)
+
+/* Bit definition for SPDIFRX_DIR register */
+#define SPDIFRX_DIR_THI_SHIFT   0
+#define SPDIFRX_DIR_THI_MASK    GENMASK(12, SPDIFRX_DIR_THI_SHIFT)
+#define SPDIFRX_DIR_THI_SET(x)  ((x) << SPDIFRX_DIR_THI_SHIFT)
+
+#define SPDIFRX_DIR_TLO_SHIFT   16
+#define SPDIFRX_DIR_TLO_MASK    GENMASK(28, SPDIFRX_DIR_TLO_SHIFT)
+#define SPDIFRX_DIR_TLO_SET(x)  ((x) << SPDIFRX_DIR_TLO_SHIFT)
+
+#define SPDIFRX_SPDIFEN_DISABLE 0x0
+#define SPDIFRX_SPDIFEN_SYNC    0x1
+#define SPDIFRX_SPDIFEN_ENABLE  0x3
+
+#define SPDIFRX_IN1             0x1
+#define SPDIFRX_IN2             0x2
+#define SPDIFRX_IN3             0x3
+#define SPDIFRX_IN4             0x4
+#define SPDIFRX_IN5             0x5
+#define SPDIFRX_IN6             0x6
+#define SPDIFRX_IN7             0x7
+#define SPDIFRX_IN8             0x8
+
+#define SPDIFRX_NBTR_NONE       0x0
+#define SPDIFRX_NBTR_3          0x1
+#define SPDIFRX_NBTR_15         0x2
+#define SPDIFRX_NBTR_63         0x3
+
+#define SPDIFRX_DRFMT_RIGHT     0x0
+#define SPDIFRX_DRFMT_LEFT      0x1
+#define SPDIFRX_DRFMT_PACKED    0x2
+
+/* 192 CS bits in S/PDIF frame. i.e 24 CS bytes */
+#define SPDIFRX_CS_BYTES_NB     24
+#define SPDIFRX_UB_BYTES_NB     48
+
+/*
+ * CSR register is retrieved as a 32 bits word
+ * It contains 1 channel status byte and 2 user data bytes
+ * 2 S/PDIF frames are acquired to get all CS/UB bits
+ */
+#define SPDIFRX_CSR_BUF_LENGTH  (SPDIFRX_CS_BYTES_NB * 4 * 2)
+
+/**
+ * struct stm32_spdifrx_data - private data of SPDIFRX
+ * @pdev: device data pointer
+ * @base: mmio register base virtual address
+ * @regmap: SPDIFRX register map pointer
+ * @regmap_conf: SPDIFRX register map configuration pointer
+ * @cs_completion: channel status retrieving completion
+ * @kclk: kernel clock feeding the SPDIFRX clock generator
+ * @dma_params: dma configuration data for rx channel
+ * @substream: PCM substream data pointer
+ * @dmab: dma buffer info pointer
+ * @ctrl_chan: dma channel for S/PDIF control bits
+ * @desc:dma async transaction descriptor
+ * @slave_config: dma slave channel runtime config pointer
+ * @phys_addr: SPDIFRX registers physical base address
+ * @lock: synchronization enabling lock
+ * @cs: channel status buffer
+ * @ub: user data buffer
+ * @irq: SPDIFRX interrupt line
+ * @refcount: keep count of opened DMA channels
+ */
+struct stm32_spdifrx_data {
+        struct platform_device *pdev;
+        void __iomem *base;
+        struct regmap *regmap;
+        const struct regmap_config *regmap_conf;
+        struct completion cs_completion;
+        struct clk *kclk;
+        struct snd_dmaengine_dai_dma_data dma_params;
+        struct snd_pcm_substream *substream;
+        struct snd_dma_buffer *dmab;
+        struct dma_chan *ctrl_chan;
+        struct dma_async_tx_descriptor *desc;
+        struct dma_slave_config slave_config;
+        dma_addr_t phys_addr;
+        spinlock_t lock;  /* Sync enabling lock */
+        unsigned char cs[SPDIFRX_CS_BYTES_NB];
+        unsigned char ub[SPDIFRX_UB_BYTES_NB];
+        int irq;
+        int refcount;
+};
+
+static void stm32_spdifrx_dma_complete(void *data)
+{
+        struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)data;
+        struct platform_device *pdev = spdifrx->pdev;
+        u32 *p_start = (u32 *)spdifrx->dmab->area;
+        u32 *p_end = p_start + (2 * SPDIFRX_CS_BYTES_NB) - 1;
+        u32 *ptr = p_start;
+        u16 *ub_ptr = (short *)spdifrx->ub;
+        int i = 0;
+
+        regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                           SPDIFRX_CR_CBDMAEN,
+                           (unsigned int)~SPDIFRX_CR_CBDMAEN);
+
+        if (!spdifrx->dmab->area)
+                return;
+
+        while (ptr <= p_end) {
+                if (*ptr & SPDIFRX_CSR_SOB)
+                        break;
+                ptr++;
+        }
+
+        if (ptr > p_end) {
+                dev_err(&pdev->dev, "Start of S/PDIF block not found\n");
+                return;
+        }
+
+        while (i < SPDIFRX_CS_BYTES_NB) {
+                spdifrx->cs[i] = (unsigned char)SPDIFRX_CSR_CSGET(*ptr);
+                *ub_ptr++ = SPDIFRX_CSR_USRGET(*ptr++);
+                if (ptr > p_end) {
+                        dev_err(&pdev->dev, "Failed to get channel status\n");
+                        return;
+                }
+                i++;
+        }
+
+        complete(&spdifrx->cs_completion);
+}
+
+static int stm32_spdifrx_dma_ctrl_start(struct stm32_spdifrx_data *spdifrx)
+{
+        dma_cookie_t cookie;
+        int err;
+
+        spdifrx->desc = dmaengine_prep_slave_single(spdifrx->ctrl_chan,
+                                                    spdifrx->dmab->addr,
+                                                    SPDIFRX_CSR_BUF_LENGTH,
+                                                    DMA_DEV_TO_MEM,
+                                                    DMA_CTRL_ACK);
+        if (!spdifrx->desc)
+                return -EINVAL;
+
+        spdifrx->desc->callback = stm32_spdifrx_dma_complete;
+        spdifrx->desc->callback_param = spdifrx;
+        cookie = dmaengine_submit(spdifrx->desc);
+        err = dma_submit_error(cookie);
+        if (err)
+                return -EINVAL;
+
+        dma_async_issue_pending(spdifrx->ctrl_chan);
+
+        return 0;
+}
+
+static void stm32_spdifrx_dma_ctrl_stop(struct stm32_spdifrx_data *spdifrx)
+{
+        dmaengine_terminate_async(spdifrx->ctrl_chan);
+}
+
+static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+{
+        int cr, cr_mask, imr, ret;
+
+        /* Enable IRQs */
+        imr = SPDIFRX_IMR_IFEIE | SPDIFRX_IMR_SYNCDIE | SPDIFRX_IMR_PERRIE;
+        ret = regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_IMR, imr, imr);
+        if (ret)
+                return ret;
+
+        spin_lock(&spdifrx->lock);
+
+        spdifrx->refcount++;
+
+        regmap_read(spdifrx->regmap, STM32_SPDIFRX_CR, &cr);
+
+        if (!(cr & SPDIFRX_CR_SPDIFEN_MASK)) {
+                /*
+                 * Start sync if SPDIFRX is still in idle state.
+                 * SPDIFRX reception enabled when sync done
+                 */
+                dev_dbg(&spdifrx->pdev->dev, "start synchronization\n");
+
+                /*
+                 * SPDIFRX configuration:
+                 * Wait for activity before starting sync process. This avoid
+                 * to issue sync errors when spdif signal is missing on input.
+                 * Preamble, CS, user, validity and parity error bits not copied
+                 * to DR register.
+                 */
+                cr = SPDIFRX_CR_WFA | SPDIFRX_CR_PMSK | SPDIFRX_CR_VMSK |
+                     SPDIFRX_CR_CUMSK | SPDIFRX_CR_PTMSK | SPDIFRX_CR_RXSTEO;
+                cr_mask = cr;
+
+                cr |= SPDIFRX_CR_SPDIFENSET(SPDIFRX_SPDIFEN_SYNC);
+                cr_mask |= SPDIFRX_CR_SPDIFEN_MASK;
+                ret = regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                         cr_mask, cr);
+                if (ret < 0)
+                        dev_err(&spdifrx->pdev->dev,
+                                "Failed to start synchronization\n");
+        }
+
+        spin_unlock(&spdifrx->lock);
+
+        return ret;
+}
+
+static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
+{
+        int cr, cr_mask, reg;
+
+        spin_lock(&spdifrx->lock);
+
+        if (--spdifrx->refcount) {
+                spin_unlock(&spdifrx->lock);
+                return;
+        }
+
+        cr = SPDIFRX_CR_SPDIFENSET(SPDIFRX_SPDIFEN_DISABLE);
+        cr_mask = SPDIFRX_CR_SPDIFEN_MASK | SPDIFRX_CR_RXDMAEN;
+
+        regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR, cr_mask, cr);
+
+        regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_IMR,
+                           SPDIFRX_XIMR_MASK, 0);
+
+        regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_IFCR,
+                           SPDIFRX_XIFCR_MASK, SPDIFRX_XIFCR_MASK);
+
+        /* dummy read to clear CSRNE and RXNE in status register */
+        regmap_read(spdifrx->regmap, STM32_SPDIFRX_DR, &reg);
+        regmap_read(spdifrx->regmap, STM32_SPDIFRX_CSR, &reg);
+
+        spin_unlock(&spdifrx->lock);
+}
+
+static int stm32_spdifrx_dma_ctrl_register(struct device *dev,
+                                           struct stm32_spdifrx_data *spdifrx)
+{
+        int ret;
+
+        spdifrx->dmab = devm_kzalloc(dev, sizeof(struct snd_dma_buffer),
+                                     GFP_KERNEL);
+        if (!spdifrx->dmab)
+                return -ENOMEM;
+
+        spdifrx->dmab->dev.type = SNDRV_DMA_TYPE_DEV_IRAM;
+        spdifrx->dmab->dev.dev = dev;
+        ret = snd_dma_alloc_pages(spdifrx->dmab->dev.type, dev,
+                                  SPDIFRX_CSR_BUF_LENGTH, spdifrx->dmab);
+        if (ret < 0) {
+                dev_err(dev, "snd_dma_alloc_pages returned error %d\n", ret);
+                return ret;
+        }
+
+        spdifrx->ctrl_chan = dma_request_chan(dev, "rx-ctrl");
+        if (!spdifrx->ctrl_chan) {
+                dev_err(dev, "dma_request_slave_channel failed\n");
+                return -EINVAL;
+        }
+
+        spdifrx->slave_config.direction = DMA_DEV_TO_MEM;
+        spdifrx->slave_config.src_addr = (dma_addr_t)(spdifrx->phys_addr +
+                                         STM32_SPDIFRX_CSR);
+        spdifrx->slave_config.dst_addr = spdifrx->dmab->addr;
+        spdifrx->slave_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        spdifrx->slave_config.src_maxburst = 1;
+
+        ret = dmaengine_slave_config(spdifrx->ctrl_chan,
+                                     &spdifrx->slave_config);
+        if (ret < 0) {
+                dev_err(dev, "dmaengine_slave_config returned error %d\n", ret);
+                dma_release_channel(spdifrx->ctrl_chan);
+                spdifrx->ctrl_chan = NULL;
+        }
+
+        return ret;
+};
+
+static const char * const spdifrx_enum_input[] = {
+        "in0", "in1", "in2", "in3"
+};
+
+/*  By default CS bits are retrieved from channel A */
+static const char * const spdifrx_enum_cs_channel[] = {
+        "A", "B"
+};
+
+static SOC_ENUM_SINGLE_DECL(ctrl_enum_input,
+                            STM32_SPDIFRX_CR, SPDIFRX_CR_INSEL_SHIFT,
+                            spdifrx_enum_input);
+
+static SOC_ENUM_SINGLE_DECL(ctrl_enum_cs_channel,
+                            STM32_SPDIFRX_CR, SPDIFRX_CR_CHSEL_SHIFT,
+                            spdifrx_enum_cs_channel);
+
+static int stm32_spdifrx_info(struct snd_kcontrol *kcontrol,
+                              struct snd_ctl_elem_info *uinfo)
+{
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
+        uinfo->count = 1;
+
+        return 0;
+}
+
+static int stm32_spdifrx_ub_info(struct snd_kcontrol *kcontrol,
+                                 struct snd_ctl_elem_info *uinfo)
+{
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
+        uinfo->count = 1;
+
+        return 0;
+}
+
+static int stm32_spdifrx_get_ctrl_data(struct stm32_spdifrx_data *spdifrx)
+{
+        int ret = 0;
+
+        memset(spdifrx->cs, 0, SPDIFRX_CS_BYTES_NB);
+        memset(spdifrx->ub, 0, SPDIFRX_UB_BYTES_NB);
+
+        ret = stm32_spdifrx_dma_ctrl_start(spdifrx);
+        if (ret < 0)
+                return ret;
+
+        ret = clk_prepare_enable(spdifrx->kclk);
+        if (ret) {
+                dev_err(&spdifrx->pdev->dev, "Enable kclk failed: %d\n", ret);
+                return ret;
+        }
+
+        ret = regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                 SPDIFRX_CR_CBDMAEN, SPDIFRX_CR_CBDMAEN);
+        if (ret < 0)
+                goto end;
+
+        ret = stm32_spdifrx_start_sync(spdifrx);
+        if (ret < 0)
+                goto end;
+
+        if (wait_for_completion_interruptible_timeout(&spdifrx->cs_completion,
+                                                      msecs_to_jiffies(100))
+                                                      <= 0) {
+                dev_err(&spdifrx->pdev->dev, "Failed to get control data\n");
+                ret = -EAGAIN;
+        }
+
+        stm32_spdifrx_stop(spdifrx);
+        stm32_spdifrx_dma_ctrl_stop(spdifrx);
+
+end:
+        clk_disable_unprepare(spdifrx->kclk);
+
+        return ret;
+}
+
+static int stm32_spdifrx_capture_get(struct snd_kcontrol *kcontrol,
+                                     struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_dai *cpu_dai = snd_kcontrol_chip(kcontrol);
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+
+        stm32_spdifrx_get_ctrl_data(spdifrx);
+
+        ucontrol->value.iec958.status[0] = spdifrx->cs[0];
+        ucontrol->value.iec958.status[1] = spdifrx->cs[1];
+        ucontrol->value.iec958.status[2] = spdifrx->cs[2];
+        ucontrol->value.iec958.status[3] = spdifrx->cs[3];
+        ucontrol->value.iec958.status[4] = spdifrx->cs[4];
+
+        return 0;
+}
+
+static int stm32_spdif_user_bits_get(struct snd_kcontrol *kcontrol,
+                                     struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_dai *cpu_dai = snd_kcontrol_chip(kcontrol);
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+
+        stm32_spdifrx_get_ctrl_data(spdifrx);
+
+        ucontrol->value.iec958.status[0] = spdifrx->ub[0];
+        ucontrol->value.iec958.status[1] = spdifrx->ub[1];
+        ucontrol->value.iec958.status[2] = spdifrx->ub[2];
+        ucontrol->value.iec958.status[3] = spdifrx->ub[3];
+        ucontrol->value.iec958.status[4] = spdifrx->ub[4];
+
+        return 0;
+}
+
+static struct snd_kcontrol_new stm32_spdifrx_iec_ctrls[] = {
+        /* Channel status control */
+        {
+                .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+                .name = SNDRV_CTL_NAME_IEC958("", CAPTURE, DEFAULT),
+                .access = SNDRV_CTL_ELEM_ACCESS_READ |
+                          SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+                .info = stm32_spdifrx_info,
+                .get = stm32_spdifrx_capture_get,
+        },
+        /* User bits control */
+        {
+                .iface = SNDRV_CTL_ELEM_IFACE_PCM,
+                .name = "IEC958 User Bit Capture Default",
+                .access = SNDRV_CTL_ELEM_ACCESS_READ |
+                          SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+                .info = stm32_spdifrx_ub_info,
+                .get = stm32_spdif_user_bits_get,
+        },
+};
+
+static struct snd_kcontrol_new stm32_spdifrx_ctrls[] = {
+        SOC_ENUM("SPDIFRX input", ctrl_enum_input),
+        SOC_ENUM("SPDIFRX CS channel", ctrl_enum_cs_channel),
+};
+
+static int stm32_spdifrx_dai_register_ctrls(struct snd_soc_dai *cpu_dai)
+{
+        int ret;
+
+        ret = snd_soc_add_dai_controls(cpu_dai, stm32_spdifrx_iec_ctrls,
+                                       ARRAY_SIZE(stm32_spdifrx_iec_ctrls));
+        if (ret < 0)
+                return ret;
+
+        return snd_soc_add_component_controls(cpu_dai->component,
+                                              stm32_spdifrx_ctrls,
+                                              ARRAY_SIZE(stm32_spdifrx_ctrls));
+}
+
+static int stm32_spdifrx_dai_probe(struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_spdifrx_data *spdifrx = dev_get_drvdata(cpu_dai->dev);
+
+        spdifrx->dma_params.addr = (dma_addr_t)(spdifrx->phys_addr +
+                                   STM32_SPDIFRX_DR);
+        spdifrx->dma_params.maxburst = 1;
+
+        snd_soc_dai_init_dma_data(cpu_dai, NULL, &spdifrx->dma_params);
+
+        return stm32_spdifrx_dai_register_ctrls(cpu_dai);
+}
+
+static bool stm32_spdifrx_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM32_SPDIFRX_CR:
+        case STM32_SPDIFRX_IMR:
+        case STM32_SPDIFRX_SR:
+        case STM32_SPDIFRX_IFCR:
+        case STM32_SPDIFRX_DR:
+        case STM32_SPDIFRX_CSR:
+        case STM32_SPDIFRX_DIR:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool stm32_spdifrx_volatile_reg(struct device *dev, unsigned int reg)
+{
+        if (reg == STM32_SPDIFRX_DR)
+                return true;
+
+        return false;
+}
+
+static bool stm32_spdifrx_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM32_SPDIFRX_CR:
+        case STM32_SPDIFRX_IMR:
+        case STM32_SPDIFRX_IFCR:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const struct regmap_config stm32_h7_spdifrx_regmap_conf = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = STM32_SPDIFRX_DIR,
+        .readable_reg = stm32_spdifrx_readable_reg,
+        .volatile_reg = stm32_spdifrx_volatile_reg,
+        .writeable_reg = stm32_spdifrx_writeable_reg,
+        .fast_io = true,
+};
+
+static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
+{
+        struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)devid;
+        struct snd_pcm_substream *substream = spdifrx->substream;
+        struct platform_device *pdev = spdifrx->pdev;
+        unsigned int cr, mask, sr, imr;
+        unsigned int flags;
+        int err = 0, err_xrun = 0;
+
+        regmap_read(spdifrx->regmap, STM32_SPDIFRX_SR, &sr);
+        regmap_read(spdifrx->regmap, STM32_SPDIFRX_IMR, &imr);
+
+        mask = imr & SPDIFRX_XIMR_MASK;
+        /* SERR, TERR, FERR IRQs are generated if IFEIE is set */
+        if (mask & SPDIFRX_IMR_IFEIE)
+                mask |= (SPDIFRX_IMR_IFEIE << 1) | (SPDIFRX_IMR_IFEIE << 2);
+
+        flags = sr & mask;
+        if (!flags) {
+                dev_err(&pdev->dev, "Unexpected IRQ. rflags=%#x, imr=%#x\n",
+                        sr, imr);
+                return IRQ_NONE;
+        }
+
+        /* Clear IRQs */
+        regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_IFCR,
+                           SPDIFRX_XIFCR_MASK, flags);
+
+        if (flags & SPDIFRX_SR_PERR) {
+                dev_dbg(&pdev->dev, "Parity error\n");
+                err_xrun = 1;
+        }
+
+        if (flags & SPDIFRX_SR_OVR) {
+                dev_dbg(&pdev->dev, "Overrun error\n");
+                err_xrun = 1;
+        }
+
+        if (flags & SPDIFRX_SR_SBD)
+                dev_dbg(&pdev->dev, "Synchronization block detected\n");
+
+        if (flags & SPDIFRX_SR_SYNCD) {
+                dev_dbg(&pdev->dev, "Synchronization done\n");
+
+                /* Enable spdifrx */
+                cr = SPDIFRX_CR_SPDIFENSET(SPDIFRX_SPDIFEN_ENABLE);
+                regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                   SPDIFRX_CR_SPDIFEN_MASK, cr);
+        }
+
+        if (flags & SPDIFRX_SR_FERR) {
+                dev_dbg(&pdev->dev, "Frame error\n");
+                err = 1;
+        }
+
+        if (flags & SPDIFRX_SR_SERR) {
+                dev_dbg(&pdev->dev, "Synchronization error\n");
+                err = 1;
+        }
+
+        if (flags & SPDIFRX_SR_TERR) {
+                dev_dbg(&pdev->dev, "Timeout error\n");
+                err = 1;
+        }
+
+        if (err) {
+                /* SPDIFRX in STATE_STOP. Disable SPDIFRX to clear errors */
+                cr = SPDIFRX_CR_SPDIFENSET(SPDIFRX_SPDIFEN_DISABLE);
+                regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                   SPDIFRX_CR_SPDIFEN_MASK, cr);
+
+                if (substream)
+                        snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
+
+                return IRQ_HANDLED;
+        }
+
+        if (err_xrun && substream)
+                snd_pcm_stop_xrun(substream);
+
+        return IRQ_HANDLED;
+}
+
+static int stm32_spdifrx_startup(struct snd_pcm_substream *substream,
+                                 struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret;
+
+        spdifrx->substream = substream;
+
+        ret = clk_prepare_enable(spdifrx->kclk);
+        if (ret)
+                dev_err(&spdifrx->pdev->dev, "Enable kclk failed: %d\n", ret);
+
+        return ret;
+}
+
+static int stm32_spdifrx_hw_params(struct snd_pcm_substream *substream,
+                                   struct snd_pcm_hw_params *params,
+                                   struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+        int data_size = params_width(params);
+        int fmt;
+
+        switch (data_size) {
+        case 16:
+                fmt = SPDIFRX_DRFMT_PACKED;
+                spdifrx->dma_params.addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
+                break;
+        case 32:
+                fmt = SPDIFRX_DRFMT_LEFT;
+                spdifrx->dma_params.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+                break;
+        default:
+                dev_err(&spdifrx->pdev->dev, "Unexpected data format\n");
+                return -EINVAL;
+        }
+
+        snd_soc_dai_init_dma_data(cpu_dai, NULL, &spdifrx->dma_params);
+
+        return regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                  SPDIFRX_CR_DRFMT_MASK,
+                                  SPDIFRX_CR_DRFMTSET(fmt));
+}
+
+static int stm32_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd,
+                                 struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret = 0;
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_IMR,
+                                   SPDIFRX_IMR_OVRIE, SPDIFRX_IMR_OVRIE);
+
+                regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+                                   SPDIFRX_CR_RXDMAEN, SPDIFRX_CR_RXDMAEN);
+
+                ret = stm32_spdifrx_start_sync(spdifrx);
+                break;
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+        case SNDRV_PCM_TRIGGER_STOP:
+                stm32_spdifrx_stop(spdifrx);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return ret;
+}
+
+static void stm32_spdifrx_shutdown(struct snd_pcm_substream *substream,
+                                   struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
+
+        spdifrx->substream = NULL;
+        clk_disable_unprepare(spdifrx->kclk);
+}
+
+static const struct snd_soc_dai_ops stm32_spdifrx_pcm_dai_ops = {
+        .startup        = stm32_spdifrx_startup,
+        .hw_params      = stm32_spdifrx_hw_params,
+        .trigger        = stm32_spdifrx_trigger,
+        .shutdown       = stm32_spdifrx_shutdown,
+};
+
+static struct snd_soc_dai_driver stm32_spdifrx_dai[] = {
+        {
+                .name = "spdifrx-capture-cpu-dai",
+                .probe = stm32_spdifrx_dai_probe,
+                .capture = {
+                        .stream_name = "CPU-Capture",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = SNDRV_PCM_RATE_8000_192000,
+                        .formats = SNDRV_PCM_FMTBIT_S32_LE |
+                                   SNDRV_PCM_FMTBIT_S16_LE,
+                },
+                .ops = &stm32_spdifrx_pcm_dai_ops,
+        }
+};
+
+static const struct snd_pcm_hardware stm32_spdifrx_pcm_hw = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+        .buffer_bytes_max = 8 * PAGE_SIZE,
+        .period_bytes_max = 2048, /* MDMA constraint */
+        .periods_min = 2,
+        .periods_max = 8,
+};
+
+static const struct snd_soc_component_driver stm32_spdifrx_component = {
+        .name = "stm32-spdifrx",
+};
+
+static const struct snd_dmaengine_pcm_config stm32_spdifrx_pcm_config = {
+        .pcm_hardware = &stm32_spdifrx_pcm_hw,
+        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+};
+
+static const struct of_device_id stm32_spdifrx_ids[] = {
+        {
+                .compatible = "st,stm32h7-spdifrx",
+                .data = &stm32_h7_spdifrx_regmap_conf
+        },
+        {}
+};
+
+static int stm_spdifrx_parse_of(struct platform_device *pdev,
+                                struct stm32_spdifrx_data *spdifrx)
+{
+        struct device_node *np = pdev->dev.of_node;
+        const struct of_device_id *of_id;
+        struct resource *res;
+
+        if (!np)
+                return -ENODEV;
+
+        of_id = of_match_device(stm32_spdifrx_ids, &pdev->dev);
+        if (of_id)
+                spdifrx->regmap_conf =
+                        (const struct regmap_config *)of_id->data;
+        else
+                return -EINVAL;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        spdifrx->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(spdifrx->base))
+                return PTR_ERR(spdifrx->base);
+
+        spdifrx->phys_addr = res->start;
+
+        spdifrx->kclk = devm_clk_get(&pdev->dev, "kclk");
+        if (IS_ERR(spdifrx->kclk)) {
+                dev_err(&pdev->dev, "Could not get kclk\n");
+                return PTR_ERR(spdifrx->kclk);
+        }
+
+        spdifrx->irq = platform_get_irq(pdev, 0);
+        if (spdifrx->irq < 0) {
+                dev_err(&pdev->dev, "No irq for node %s\n", pdev->name);
+                return spdifrx->irq;
+        }
+
+        return 0;
+}
+
+static int stm32_spdifrx_probe(struct platform_device *pdev)
+{
+        struct stm32_spdifrx_data *spdifrx;
+        struct reset_control *rst;
+        const struct snd_dmaengine_pcm_config *pcm_config = NULL;
+        int ret;
+
+        spdifrx = devm_kzalloc(&pdev->dev, sizeof(*spdifrx), GFP_KERNEL);
+        if (!spdifrx)
+                return -ENOMEM;
+
+        spdifrx->pdev = pdev;
+        init_completion(&spdifrx->cs_completion);
+        spin_lock_init(&spdifrx->lock);
+
+        platform_set_drvdata(pdev, spdifrx);
+
+        ret = stm_spdifrx_parse_of(pdev, spdifrx);
+        if (ret)
+                return ret;
+
+        spdifrx->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "kclk",
+                                                    spdifrx->base,
+                                                    spdifrx->regmap_conf);
+        if (IS_ERR(spdifrx->regmap)) {
+                dev_err(&pdev->dev, "Regmap init failed\n");
+                return PTR_ERR(spdifrx->regmap);
+        }
+
+        ret = devm_request_irq(&pdev->dev, spdifrx->irq, stm32_spdifrx_isr, 0,
+                               dev_name(&pdev->dev), spdifrx);
+        if (ret) {
+                dev_err(&pdev->dev, "IRQ request returned %d\n", ret);
+                return ret;
+        }
+
+        rst = devm_reset_control_get(&pdev->dev, NULL);
+        if (!IS_ERR(rst)) {
+                reset_control_assert(rst);
+                udelay(2);
+                reset_control_deassert(rst);
+        }
+
+        ret = devm_snd_soc_register_component(&pdev->dev,
+                                              &stm32_spdifrx_component,
+                                              stm32_spdifrx_dai,
+                                              ARRAY_SIZE(stm32_spdifrx_dai));
+        if (ret)
+                return ret;
+
+        ret = stm32_spdifrx_dma_ctrl_register(&pdev->dev, spdifrx);
+        if (ret)
+                goto error;
+
+        pcm_config = &stm32_spdifrx_pcm_config;
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev, pcm_config, 0);
+        if (ret) {
+                dev_err(&pdev->dev, "PCM DMA register returned %d\n", ret);
+                goto error;
+        }
+
+        return 0;
+
+error:
+        if (spdifrx->ctrl_chan)
+                dma_release_channel(spdifrx->ctrl_chan);
+        if (spdifrx->dmab)
+                snd_dma_free_pages(spdifrx->dmab);
+
+        return ret;
+}
+
+static int stm32_spdifrx_remove(struct platform_device *pdev)
+{
+        struct stm32_spdifrx_data *spdifrx = platform_get_drvdata(pdev);
+
+        if (spdifrx->ctrl_chan)
+                dma_release_channel(spdifrx->ctrl_chan);
+
+        if (spdifrx->dmab)
+                snd_dma_free_pages(spdifrx->dmab);
+
+        return 0;
+}
+
+MODULE_DEVICE_TABLE(of, stm32_spdifrx_ids);
+
+static struct platform_driver stm32_spdifrx_driver = {
+        .driver = {
+                .name = "st,stm32-spdifrx",
+                .of_match_table = stm32_spdifrx_ids,
+        },
+        .probe = stm32_spdifrx_probe,
+        .remove = stm32_spdifrx_remove,
+};
+
+module_platform_driver(stm32_spdifrx_driver);
+
+MODULE_DESCRIPTION("STM32 Soc spdifrx Interface");
+MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_ALIAS("platform:stm32-spdifrx");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
index c3aab10fa085..150069987c0c 100644
--- a/sound/soc/sunxi/sun4i-codec.c
+++ b/sound/soc/sunxi/sun4i-codec.c
@@ -1339,6 +1339,44 @@ static struct snd_soc_card *sun8i_h3_codec_create_card(struct device *dev)
         return card;
 };
 
+static struct snd_soc_card *sun8i_v3s_codec_create_card(struct device *dev)
+{
+        struct snd_soc_card *card;
+        int ret;
+
+        card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL);
+        if (!card)
+                return ERR_PTR(-ENOMEM);
+
+        aux_dev.codec_of_node = of_parse_phandle(dev->of_node,
+                                                 "allwinner,codec-analog-controls",
+                                                 0);
+        if (!aux_dev.codec_of_node) {
+                dev_err(dev, "Can't find analog controls for codec.\n");
+                return ERR_PTR(-EINVAL);
+        };
+
+        card->dai_link = sun4i_codec_create_link(dev, &card->num_links);
+        if (!card->dai_link)
+                return ERR_PTR(-ENOMEM);
+
+        card->dev               = dev;
+        card->name              = "V3s Audio Codec";
+        card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
+        card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+        card->dapm_routes       = sun8i_codec_card_routes;
+        card->num_dapm_routes   = ARRAY_SIZE(sun8i_codec_card_routes);
+        card->aux_dev           = &aux_dev;
+        card->num_aux_devs      = 1;
+        card->fully_routed      = true;
+
+        ret = snd_soc_of_parse_audio_routing(card, "allwinner,audio-routing");
+        if (ret)
+                dev_warn(dev, "failed to parse audio-routing: %d\n", ret);
+
+        return card;
+};
+
 static const struct regmap_config sun4i_codec_regmap_config = {
         .reg_bits       = 32,
         .reg_stride     = 4,
@@ -1374,6 +1412,13 @@ static const struct regmap_config sun8i_h3_codec_regmap_config = {
         .max_register   = SUN8I_H3_CODEC_ADC_DBG,
 };
 
+static const struct regmap_config sun8i_v3s_codec_regmap_config = {
+        .reg_bits       = 32,
+        .reg_stride     = 4,
+        .val_bits       = 32,
+        .max_register   = SUN8I_H3_CODEC_ADC_DBG,
+};
+
 struct sun4i_codec_quirks {
         const struct regmap_config *regmap_config;
         const struct snd_soc_codec_driver *codec;
@@ -1437,6 +1482,20 @@ static const struct sun4i_codec_quirks sun8i_h3_codec_quirks = {
         .has_reset      = true,
 };
 
+static const struct sun4i_codec_quirks sun8i_v3s_codec_quirks = {
+        .regmap_config  = &sun8i_v3s_codec_regmap_config,
+        /*
+         * TODO The codec structure should be split out, like
+         * H3, when adding digital audio processing support.
+         */
+        .codec          = &sun8i_a23_codec_codec,
+        .create_card    = sun8i_v3s_codec_create_card,
+        .reg_adc_fifoc  = REG_FIELD(SUN6I_CODEC_ADC_FIFOC, 0, 31),
+        .reg_dac_txdata = SUN8I_H3_CODEC_DAC_TXDATA,
+        .reg_adc_rxdata = SUN6I_CODEC_ADC_RXDATA,
+        .has_reset      = true,
+};
+
 static const struct of_device_id sun4i_codec_of_match[] = {
         {
                 .compatible = "allwinner,sun4i-a10-codec",
@@ -1458,6 +1517,10 @@ static const struct of_device_id sun4i_codec_of_match[] = {
                 .compatible = "allwinner,sun8i-h3-codec",
                 .data = &sun8i_h3_codec_quirks,
         },
+        {
+                .compatible = "allwinner,sun8i-v3s-codec",
+                .data = &sun8i_v3s_codec_quirks,
+        },
         {}
 };
 MODULE_DEVICE_TABLE(of, sun4i_codec_of_match);
diff --git a/sound/soc/sunxi/sun8i-codec-analog.c b/sound/soc/sunxi/sun8i-codec-analog.c
index 6c17c99c2c8d..485e79f292c4 100644
--- a/sound/soc/sunxi/sun8i-codec-analog.c
+++ b/sound/soc/sunxi/sun8i-codec-analog.c
@@ -219,6 +219,22 @@ static const struct snd_kcontrol_new sun8i_codec_mixer_controls[] = {
                           SUN8I_ADDA_LOMIXSC_MIC2, 1, 0),
 };
 
+/* mixer controls */
+static const struct snd_kcontrol_new sun8i_v3s_codec_mixer_controls[] = {
+        SOC_DAPM_DOUBLE_R("DAC Playback Switch",
+                          SUN8I_ADDA_LOMIXSC,
+                          SUN8I_ADDA_ROMIXSC,
+                          SUN8I_ADDA_LOMIXSC_DACL, 1, 0),
+        SOC_DAPM_DOUBLE_R("DAC Reversed Playback Switch",
+                          SUN8I_ADDA_LOMIXSC,
+                          SUN8I_ADDA_ROMIXSC,
+                          SUN8I_ADDA_LOMIXSC_DACR, 1, 0),
+        SOC_DAPM_DOUBLE_R("Mic1 Playback Switch",
+                          SUN8I_ADDA_LOMIXSC,
+                          SUN8I_ADDA_ROMIXSC,
+                          SUN8I_ADDA_LOMIXSC_MIC1, 1, 0),
+};
+
 /* ADC mixer controls */
 static const struct snd_kcontrol_new sun8i_codec_adc_mixer_controls[] = {
         SOC_DAPM_DOUBLE_R("Mixer Capture Switch",
@@ -243,6 +259,22 @@ static const struct snd_kcontrol_new sun8i_codec_adc_mixer_controls[] = {
                           SUN8I_ADDA_LADCMIXSC_MIC2, 1, 0),
 };
 
+/* ADC mixer controls */
+static const struct snd_kcontrol_new sun8i_v3s_codec_adc_mixer_controls[] = {
+        SOC_DAPM_DOUBLE_R("Mixer Capture Switch",
+                          SUN8I_ADDA_LADCMIXSC,
+                          SUN8I_ADDA_RADCMIXSC,
+                          SUN8I_ADDA_LADCMIXSC_OMIXRL, 1, 0),
+        SOC_DAPM_DOUBLE_R("Mixer Reversed Capture Switch",
+                          SUN8I_ADDA_LADCMIXSC,
+                          SUN8I_ADDA_RADCMIXSC,
+                          SUN8I_ADDA_LADCMIXSC_OMIXRR, 1, 0),
+        SOC_DAPM_DOUBLE_R("Mic1 Capture Switch",
+                          SUN8I_ADDA_LADCMIXSC,
+                          SUN8I_ADDA_RADCMIXSC,
+                          SUN8I_ADDA_LADCMIXSC_MIC1, 1, 0),
+};
+
 /* volume / mute controls */
 static const DECLARE_TLV_DB_SCALE(sun8i_codec_out_mixer_pregain_scale,
                                   -450, 150, 0);
@@ -289,16 +321,12 @@ static const struct snd_soc_dapm_widget sun8i_codec_common_widgets[] = {
         /* Microphone input */
         SND_SOC_DAPM_INPUT("MIC1"),
 
-        /* Microphone Bias */
-        SND_SOC_DAPM_SUPPLY("MBIAS", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
-                            SUN8I_ADDA_MIC1G_MICBIAS_CTRL_MMICBIASEN,
-                            0, NULL, 0),
-
         /* Mic input path */
         SND_SOC_DAPM_PGA("Mic1 Amplifier", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
                          SUN8I_ADDA_MIC1G_MICBIAS_CTRL_MIC1AMPEN, 0, NULL, 0),
+};
 
-        /* Mixers */
+static const struct snd_soc_dapm_widget sun8i_codec_mixer_widgets[] = {
         SND_SOC_DAPM_MIXER("Left Mixer", SUN8I_ADDA_DAC_PA_SRC,
                            SUN8I_ADDA_DAC_PA_SRC_LMIXEN, 0,
                            sun8i_codec_mixer_controls,
@@ -317,10 +345,31 @@ static const struct snd_soc_dapm_widget sun8i_codec_common_widgets[] = {
                            ARRAY_SIZE(sun8i_codec_adc_mixer_controls)),
 };
 
+static const struct snd_soc_dapm_widget sun8i_v3s_codec_mixer_widgets[] = {
+        SND_SOC_DAPM_MIXER("Left Mixer", SUN8I_ADDA_DAC_PA_SRC,
+                           SUN8I_ADDA_DAC_PA_SRC_LMIXEN, 0,
+                           sun8i_v3s_codec_mixer_controls,
+                           ARRAY_SIZE(sun8i_v3s_codec_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Right Mixer", SUN8I_ADDA_DAC_PA_SRC,
+                           SUN8I_ADDA_DAC_PA_SRC_RMIXEN, 0,
+                           sun8i_v3s_codec_mixer_controls,
+                           ARRAY_SIZE(sun8i_v3s_codec_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Left ADC Mixer", SUN8I_ADDA_ADC_AP_EN,
+                           SUN8I_ADDA_ADC_AP_EN_ADCLEN, 0,
+                           sun8i_v3s_codec_adc_mixer_controls,
+                           ARRAY_SIZE(sun8i_v3s_codec_adc_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Right ADC Mixer", SUN8I_ADDA_ADC_AP_EN,
+                           SUN8I_ADDA_ADC_AP_EN_ADCREN, 0,
+                           sun8i_v3s_codec_adc_mixer_controls,
+                           ARRAY_SIZE(sun8i_v3s_codec_adc_mixer_controls)),
+};
+
 static const struct snd_soc_dapm_route sun8i_codec_common_routes[] = {
         /* Microphone Routes */
         { "Mic1 Amplifier", NULL, "MIC1"},
+};
 
+static const struct snd_soc_dapm_route sun8i_codec_mixer_routes[] = {
         /* Left Mixer Routes */
         { "Left Mixer", "DAC Playback Switch", "Left DAC" },
         { "Left Mixer", "DAC Reversed Playback Switch", "Right DAC" },
@@ -453,6 +502,27 @@ static int sun8i_codec_add_headphone(struct snd_soc_component *cmpnt)
         return 0;
 }
 
+/* mbias specific widget */
+static const struct snd_soc_dapm_widget sun8i_codec_mbias_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("MBIAS", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
+                            SUN8I_ADDA_MIC1G_MICBIAS_CTRL_MMICBIASEN,
+                            0, NULL, 0),
+};
+
+static int sun8i_codec_add_mbias(struct snd_soc_component *cmpnt)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(cmpnt);
+        struct device *dev = cmpnt->dev;
+        int ret;
+
+        ret = snd_soc_dapm_new_controls(dapm, sun8i_codec_mbias_widgets,
+                                        ARRAY_SIZE(sun8i_codec_mbias_widgets));
+        if (ret)
+                dev_err(dev, "Failed to add MBIAS DAPM widgets: %d\n", ret);
+
+        return ret;
+}
+
 /* hmic specific widget */
 static const struct snd_soc_dapm_widget sun8i_codec_hmic_widgets[] = {
         SND_SOC_DAPM_SUPPLY("HBIAS", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
@@ -679,6 +749,7 @@ struct sun8i_codec_analog_quirks {
         bool has_hmic;
         bool has_linein;
         bool has_lineout;
+        bool has_mbias;
         bool has_mic2;
 };
 
@@ -686,15 +757,64 @@ static const struct sun8i_codec_analog_quirks sun8i_a23_quirks = {
         .has_headphone  = true,
         .has_hmic       = true,
         .has_linein     = true,
+        .has_mbias      = true,
         .has_mic2       = true,
 };
 
 static const struct sun8i_codec_analog_quirks sun8i_h3_quirks = {
         .has_linein     = true,
         .has_lineout    = true,
+        .has_mbias      = true,
         .has_mic2       = true,
 };
 
+static int sun8i_codec_analog_add_mixer(struct snd_soc_component *cmpnt,
+                                        const struct sun8i_codec_analog_quirks *quirks)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(cmpnt);
+        struct device *dev = cmpnt->dev;
+        int ret;
+
+        if (!quirks->has_mic2 && !quirks->has_linein) {
+                /*
+                 * Apply the special widget set which has uses a control
+                 * without MIC2 and Line In, for SoCs without these.
+                 * TODO: not all special cases are supported now, this case
+                 * is present because it's the case of V3s.
+                 */
+                ret = snd_soc_dapm_new_controls(dapm,
+                                                sun8i_v3s_codec_mixer_widgets,
+                                                ARRAY_SIZE(sun8i_v3s_codec_mixer_widgets));
+                if (ret) {
+                        dev_err(dev, "Failed to add V3s Mixer DAPM widgets: %d\n", ret);
+                        return ret;
+                }
+        } else {
+                /* Apply the generic mixer widget set. */
+                ret = snd_soc_dapm_new_controls(dapm,
+                                                sun8i_codec_mixer_widgets,
+                                                ARRAY_SIZE(sun8i_codec_mixer_widgets));
+                if (ret) {
+                        dev_err(dev, "Failed to add Mixer DAPM widgets: %d\n", ret);
+                        return ret;
+                }
+        }
+
+        ret = snd_soc_dapm_add_routes(dapm, sun8i_codec_mixer_routes,
+                                      ARRAY_SIZE(sun8i_codec_mixer_routes));
+        if (ret) {
+                dev_err(dev, "Failed to add Mixer DAPM routes: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static const struct sun8i_codec_analog_quirks sun8i_v3s_quirks = {
+        .has_headphone  = true,
+        .has_hmic       = true,
+};
+
 static int sun8i_codec_analog_cmpnt_probe(struct snd_soc_component *cmpnt)
 {
         struct device *dev = cmpnt->dev;
@@ -709,6 +829,9 @@ static int sun8i_codec_analog_cmpnt_probe(struct snd_soc_component *cmpnt)
         quirks = of_device_get_match_data(dev);
 
         /* Add controls, widgets, and routes for individual features */
+        ret = sun8i_codec_analog_add_mixer(cmpnt, quirks);
+        if (ret)
+                return ret;
 
         if (quirks->has_headphone) {
                 ret = sun8i_codec_add_headphone(cmpnt);
@@ -734,6 +857,12 @@ static int sun8i_codec_analog_cmpnt_probe(struct snd_soc_component *cmpnt)
                         return ret;
         }
 
+        if (quirks->has_mbias) {
+                ret = sun8i_codec_add_mbias(cmpnt);
+                if (ret)
+                        return ret;
+        }
+
         if (quirks->has_mic2) {
                 ret = sun8i_codec_add_mic2(cmpnt);
                 if (ret)
@@ -762,6 +891,10 @@ static const struct of_device_id sun8i_codec_analog_of_match[] = {
                 .compatible = "allwinner,sun8i-h3-codec-analog",
                 .data = &sun8i_h3_quirks,
         },
+        {
+                .compatible = "allwinner,sun8i-v3s-codec-analog",
+                .data = &sun8i_v3s_quirks,
+        },
         {}
 };
 MODULE_DEVICE_TABLE(of, sun8i_codec_analog_of_match);
diff --git a/sound/soc/zte/zx-i2s.c b/sound/soc/zte/zx-i2s.c
index a865f37c2a56..8bbad1d72bc5 100644
--- a/sound/soc/zte/zx-i2s.c
+++ b/sound/soc/zte/zx-i2s.c
@@ -203,13 +203,15 @@ static int zx_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
 
         switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
         case SND_SOC_DAIFMT_CBM_CFM:
-                i2s->master = 1;
-                val |= ZX_I2S_TIMING_MAST;
-                break;
-        case SND_SOC_DAIFMT_CBS_CFS:
+                /* Codec is master, and I2S is slave. */
                 i2s->master = 0;
                 val |= ZX_I2S_TIMING_SLAVE;
                 break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                /* Codec is slave, and I2S is master. */
+                i2s->master = 1;
+                val |= ZX_I2S_TIMING_MAST;
+                break;
         default:
                 dev_err(cpu_dai->dev, "Unknown master/slave format\n");
                 return -EINVAL;
@@ -226,11 +228,12 @@ static int zx_i2s_hw_params(struct snd_pcm_substream *substream,
         struct zx_i2s_info *i2s = snd_soc_dai_get_drvdata(socdai);
         struct snd_dmaengine_dai_dma_data *dma_data;
         unsigned int lane, ch_num, len, ret = 0;
+        unsigned int ts_width = 32;
         unsigned long val;
         unsigned long chn_cfg;
 
         dma_data = snd_soc_dai_get_dma_data(socdai, substream);
-        dma_data->addr_width = params_width(params) >> 3;
+        dma_data->addr_width = ts_width >> 3;
 
         val = readl_relaxed(i2s->reg_base + ZX_I2S_TIMING_CTRL);
         val &= ~(ZX_I2S_TIMING_TS_WIDTH_MASK | ZX_I2S_TIMING_DATA_SIZE_MASK |
@@ -251,7 +254,7 @@ static int zx_i2s_hw_params(struct snd_pcm_substream *substream,
                 dev_err(socdai->dev, "Unknown data format\n");
                 return -EINVAL;
         }
-        val |= ZX_I2S_TIMING_TS_WIDTH(len) | ZX_I2S_TIMING_DATA_SIZE(len);
+        val |= ZX_I2S_TIMING_TS_WIDTH(ts_width) | ZX_I2S_TIMING_DATA_SIZE(len);
 
         ch_num = params_channels(params);
         switch (ch_num) {
diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index 6ebd3e6a1fd1..5e3c673fa3f4 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -27,6 +27,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -114,6 +116,8 @@ struct kvm_debug_exit_arch {
 };
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -192,13 +196,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS   8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK 0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* KVM_IRQ_LINE irq field index values */
 #define KVM_ARM_IRQ_TYPE_SHIFT          24
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index c2860358ae3e..70eea2ecc663 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -39,6 +39,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -143,6 +145,8 @@ struct kvm_debug_exit_arch {
 #define KVM_GUESTDBG_USE_HW             (1 << 17)
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -212,13 +216,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS 8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK  0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* Device Control API on vcpu fd */
 #define KVM_ARM_VCPU_PMU_V3_CTRL        0
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 4edbe4bb0e8b..07fbeb927834 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -29,6 +29,9 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_GUEST_DEBUG
 
+/* Not always available, but if it is, this is the correct offset.  */
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 struct kvm_regs {
         __u64 pc;
         __u64 cr;
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 7f4fd65e9208..3dd2a1d308dd 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -26,6 +26,8 @@
 #define KVM_DEV_FLIC_ADAPTER_REGISTER   6
 #define KVM_DEV_FLIC_ADAPTER_MODIFY     7
 #define KVM_DEV_FLIC_CLEAR_IO_IRQ       8
+#define KVM_DEV_FLIC_AISM               9
+#define KVM_DEV_FLIC_AIRQ_INJECT        10
 /*
  * We can have up to 4*64k pending subchannels + 8 adapter interrupts,
  * as well as up  to ASYNC_PF_PER_VCPU*KVM_MAX_VCPUS pfault done interrupts.
@@ -41,7 +43,14 @@ struct kvm_s390_io_adapter {
         __u8 isc;
         __u8 maskable;
         __u8 swap;
-        __u8 pad;
+        __u8 flags;
+};
+
+#define KVM_S390_ADAPTER_SUPPRESSIBLE 0x01
+
+struct kvm_s390_ais_req {
+        __u8 isc;
+        __u16 mode;
 };
 
 #define KVM_S390_IO_ADAPTER_MASK 1
@@ -110,6 +119,7 @@ struct kvm_s390_vm_cpu_machine {
 #define KVM_S390_VM_CPU_FEAT_CMMA       10
 #define KVM_S390_VM_CPU_FEAT_PFMFI      11
 #define KVM_S390_VM_CPU_FEAT_SIGPIF     12
+#define KVM_S390_VM_CPU_FEAT_KSS        13
 struct kvm_s390_vm_cpu_feat {
         __u64 feat[16];
 };
@@ -198,6 +208,10 @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_VRS    (1UL << 6)
 #define KVM_SYNC_RICCB  (1UL << 7)
 #define KVM_SYNC_FPRS   (1UL << 8)
+#define KVM_SYNC_GSCB   (1UL << 9)
+/* length and alignment of the sdnx as a power of two */
+#define SDNXC 8
+#define SDNXL (1UL << SDNXC)
 /* definition of registers in kvm_run */
 struct kvm_sync_regs {
         __u64 prefix;   /* prefix register */
@@ -218,8 +232,16 @@ struct kvm_sync_regs {
         };
         __u8  reserved[512];    /* for future vector expansion */
         __u32 fpc;              /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */
-        __u8 padding[52];       /* riccb needs to be 64byte aligned */
+        __u8 padding1[52];      /* riccb needs to be 64byte aligned */
         __u8 riccb[64];         /* runtime instrumentation controls block */
+        __u8 padding2[192];     /* sdnx needs to be 256byte aligned */
+        union {
+                __u8 sdnx[SDNXL];  /* state description annex */
+                struct {
+                        __u64 reserved1[2];
+                        __u64 gscb[4];
+                };
+        };
 };
 
 #define KVM_REG_S390_TODPR      (KVM_REG_S390 | KVM_REG_SIZE_U32 | 0x1)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 0fe00446f9ca..2701e5f8145b 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -202,6 +202,8 @@
 #define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */
 
+#define X86_FEATURE_MBA         ( 7*32+18) /* Memory Bandwidth Allocation */
+
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW  ( 8*32+ 0) /* Intel TPR Shadow */
 #define X86_FEATURE_VNMI        ( 8*32+ 1) /* Intel Virtual NMI */
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 85599ad4d024..5dff775af7cd 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -36,6 +36,12 @@
 # define DISABLE_OSPKE          (1<<(X86_FEATURE_OSPKE & 31))
 #endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */
 
+#ifdef CONFIG_X86_5LEVEL
+# define DISABLE_LA57   0
+#else
+# define DISABLE_LA57   (1<<(X86_FEATURE_LA57 & 31))
+#endif
+
 /*
  * Make sure to add features to the correct mask
  */
@@ -55,7 +61,7 @@
 #define DISABLED_MASK13 0
 #define DISABLED_MASK14 0
 #define DISABLED_MASK15 0
-#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE)
+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57)
 #define DISABLED_MASK17 0
 #define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h
index fac9a5c0abe9..d91ba04dd007 100644
--- a/tools/arch/x86/include/asm/required-features.h
+++ b/tools/arch/x86/include/asm/required-features.h
@@ -53,6 +53,12 @@
 # define NEED_MOVBE     0
 #endif
 
+#ifdef CONFIG_X86_5LEVEL
+# define NEED_LA57      (1<<(X86_FEATURE_LA57 & 31))
+#else
+# define NEED_LA57      0
+#endif
+
 #ifdef CONFIG_X86_64
 #ifdef CONFIG_PARAVIRT
 /* Paravirtualized systems may not have PSE or PGE available */
@@ -98,7 +104,7 @@
 #define REQUIRED_MASK13 0
 #define REQUIRED_MASK14 0
 #define REQUIRED_MASK15 0
-#define REQUIRED_MASK16 0
+#define REQUIRED_MASK16 (NEED_LA57)
 #define REQUIRED_MASK17 0
 #define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/uapi/asm/kvm.h b/tools/arch/x86/include/uapi/asm/kvm.h
index 739c0c594022..c2824d02ba37 100644
--- a/tools/arch/x86/include/uapi/asm/kvm.h
+++ b/tools/arch/x86/include/uapi/asm/kvm.h
@@ -9,6 +9,9 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
 
+#define KVM_PIO_PAGE_OFFSET 1
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 2
+
 #define DE_VECTOR 0
 #define DB_VECTOR 1
 #define BP_VECTOR 3
diff --git a/tools/arch/x86/include/uapi/asm/vmx.h b/tools/arch/x86/include/uapi/asm/vmx.h
index 14458658e988..690a2dcf4078 100644
--- a/tools/arch/x86/include/uapi/asm/vmx.h
+++ b/tools/arch/x86/include/uapi/asm/vmx.h
@@ -76,7 +76,11 @@
 #define EXIT_REASON_WBINVD              54
 #define EXIT_REASON_XSETBV              55
 #define EXIT_REASON_APIC_WRITE          56
+#define EXIT_REASON_RDRAND              57
 #define EXIT_REASON_INVPCID             58
+#define EXIT_REASON_VMFUNC              59
+#define EXIT_REASON_ENCLS               60
+#define EXIT_REASON_RDSEED              61
 #define EXIT_REASON_PML_FULL            62
 #define EXIT_REASON_XSAVES              63
 #define EXIT_REASON_XRSTORS             64
@@ -90,6 +94,7 @@
         { EXIT_REASON_TASK_SWITCH,           "TASK_SWITCH" }, \
         { EXIT_REASON_CPUID,                 "CPUID" }, \
         { EXIT_REASON_HLT,                   "HLT" }, \
+        { EXIT_REASON_INVD,                  "INVD" }, \
         { EXIT_REASON_INVLPG,                "INVLPG" }, \
         { EXIT_REASON_RDPMC,                 "RDPMC" }, \
         { EXIT_REASON_RDTSC,                 "RDTSC" }, \
@@ -108,6 +113,8 @@
         { EXIT_REASON_IO_INSTRUCTION,        "IO_INSTRUCTION" }, \
         { EXIT_REASON_MSR_READ,              "MSR_READ" }, \
         { EXIT_REASON_MSR_WRITE,             "MSR_WRITE" }, \
+        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
+        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
         { EXIT_REASON_MWAIT_INSTRUCTION,     "MWAIT_INSTRUCTION" }, \
         { EXIT_REASON_MONITOR_TRAP_FLAG,     "MONITOR_TRAP_FLAG" }, \
         { EXIT_REASON_MONITOR_INSTRUCTION,   "MONITOR_INSTRUCTION" }, \
@@ -115,20 +122,24 @@
         { EXIT_REASON_MCE_DURING_VMENTRY,    "MCE_DURING_VMENTRY" }, \
         { EXIT_REASON_TPR_BELOW_THRESHOLD,   "TPR_BELOW_THRESHOLD" }, \
         { EXIT_REASON_APIC_ACCESS,           "APIC_ACCESS" }, \
-        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
-        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
+        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
+        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
+        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
         { EXIT_REASON_EPT_VIOLATION,         "EPT_VIOLATION" }, \
         { EXIT_REASON_EPT_MISCONFIG,         "EPT_MISCONFIG" }, \
         { EXIT_REASON_INVEPT,                "INVEPT" }, \
+        { EXIT_REASON_RDTSCP,                "RDTSCP" }, \
         { EXIT_REASON_PREEMPTION_TIMER,      "PREEMPTION_TIMER" }, \
+        { EXIT_REASON_INVVPID,               "INVVPID" }, \
         { EXIT_REASON_WBINVD,                "WBINVD" }, \
+        { EXIT_REASON_XSETBV,                "XSETBV" }, \
         { EXIT_REASON_APIC_WRITE,            "APIC_WRITE" }, \
-        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
-        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
-        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
-        { EXIT_REASON_INVD,                  "INVD" }, \
-        { EXIT_REASON_INVVPID,               "INVVPID" }, \
+        { EXIT_REASON_RDRAND,                "RDRAND" }, \
         { EXIT_REASON_INVPCID,               "INVPCID" }, \
+        { EXIT_REASON_VMFUNC,                "VMFUNC" }, \
+        { EXIT_REASON_ENCLS,                 "ENCLS" }, \
+        { EXIT_REASON_RDSEED,                "RDSEED" }, \
+        { EXIT_REASON_PML_FULL,              "PML_FULL" }, \
         { EXIT_REASON_XSAVES,                "XSAVES" }, \
         { EXIT_REASON_XRSTORS,               "XRSTORS" }
 
diff --git a/tools/include/linux/filter.h b/tools/include/linux/filter.h
index 390d7c9685fd..4ce25d43e8e3 100644
--- a/tools/include/linux/filter.h
+++ b/tools/include/linux/filter.h
@@ -208,6 +208,16 @@
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/tools/include/uapi/linux/stat.h b/tools/include/uapi/linux/stat.h
index d538897b8e08..17b10304c393 100644
--- a/tools/include/uapi/linux/stat.h
+++ b/tools/include/uapi/linux/stat.h
@@ -48,17 +48,13 @@
  * tv_sec holds the number of seconds before (negative) or after (positive)
  * 00:00:00 1st January 1970 UTC.
  *
- * tv_nsec holds a number of nanoseconds before (0..-999,999,999 if tv_sec is
- * negative) or after (0..999,999,999 if tv_sec is positive) the tv_sec time.
- *
- * Note that if both tv_sec and tv_nsec are non-zero, then the two values must
- * either be both positive or both negative.
+ * tv_nsec holds a number of nanoseconds (0..999,999,999) after the tv_sec time.
  *
  * __reserved is held in case we need a yet finer resolution.
  */
 struct statx_timestamp {
         __s64   tv_sec;
-        __s32   tv_nsec;
+        __u32   tv_nsec;
         __s32   __reserved;
 };
 
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 282a60368b14..5f66697fe1e0 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -192,7 +192,8 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                 "complete_and_exit",
                 "kvm_spurious_fault",
                 "__reiserfs_panic",
-                "lbug_with_loc"
+                "lbug_with_loc",
+                "fortify_panic",
         };
 
         if (func->bind == STB_WEAK)
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index e6c9902c6d82..165c2b1d4317 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -240,9 +240,13 @@ Add a probe on schedule() function 12th line with recording cpu local variable:
  or
  ./perf probe --add='schedule:12 cpu'
 
- this will add one or more probes which has the name start with "schedule".
+Add one or more probes which has the name start with "schedule".
 
- Add probes on lines in schedule() function which calls update_rq_clock().
+ ./perf probe schedule*
+ or
+ ./perf probe --add='schedule*'
+
+Add probes on lines in schedule() function which calls update_rq_clock().
 
  ./perf probe 'schedule;update_rq_clock*'
  or
diff --git a/tools/perf/Documentation/perf-script-perl.txt b/tools/perf/Documentation/perf-script-perl.txt
index dfbb506d2c34..142606c0ec9c 100644
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -39,7 +39,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
diff --git a/tools/perf/Documentation/perf-script-python.txt b/tools/perf/Documentation/perf-script-python.txt
index 54acba221558..51ec2d20068a 100644
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -149,10 +149,8 @@ def raw_syscalls__sys_enter(event_name, context, common_cpu,
                 print "id=%d, args=%s\n" % \
                 (id, args),
 
-def trace_unhandled(event_name, context, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm):
-                print_header(event_name, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm)
+def trace_unhandled(event_name, context, event_fields_dict):
+                print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
 
 def print_header(event_name, cpu, secs, nsecs, pid, comm):
         print "%-20s %5u %05u.%09u %8u %-20s " % \
@@ -321,7 +319,7 @@ So those are the essential steps in writing and running a script.  The
 process can be generalized to any tracepoint or set of tracepoints
 you're interested in - basically find the tracepoint(s) you're
 interested in by looking at the list of available events shown by
-'perf list' and/or look in /sys/kernel/debug/tracing events for
+'perf list' and/or look in /sys/kernel/debug/tracing/events/ for
 detailed event and field info, record the corresponding trace data
 using 'perf record', passing it the list of interesting events,
 generate a skeleton script using 'perf script -g python' and modify the
@@ -334,7 +332,7 @@ right place, you can have your script listed alongside the other
 scripts listed by the 'perf script -l' command e.g.:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -383,8 +381,6 @@ source tree:
 
 ----
 # ls -al kernel-source/tools/perf/scripts/python
-
-root@tropicana:/home/trz/src/tip# ls -al tools/perf/scripts/python
 total 32
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
@@ -399,7 +395,7 @@ otherwise your script won't show up at run-time), 'perf script -l'
 should show a new entry for your script:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -437,7 +433,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
@@ -532,7 +528,7 @@ can implement a set of optional functions:
 gives scripts a chance to do setup tasks:
 
 ----
-def trace_begin:
+def trace_begin():
     pass
 ----
 
@@ -541,7 +537,7 @@ def trace_begin:
  as display results:
 
 ----
-def trace_end:
+def trace_end():
     pass
 ----
 
@@ -550,8 +546,7 @@ def trace_end:
  of common arguments are passed into it:
 
 ----
-def trace_unhandled(event_name, context, common_cpu, common_secs,
-        common_nsecs, common_pid, common_comm):
+def trace_unhandled(event_name, context, event_fields_dict):
     pass
 ----
 
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index cb0eda3925e6..3517e204a2b3 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -311,6 +311,10 @@ include::itrace.txt[]
         Set the maximum number of program blocks to print with brstackasm for
         each sample.
 
+--inline::
+        If a callgraph address belongs to an inlined function, the inline stack
+        will be printed. Each entry has function name and file/line.
+
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 8354d04b392f..1f4fbc9a3292 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -19,18 +19,18 @@ CFLAGS := $(EXTRA_CFLAGS) $(EXTRA_WARNINGS)
 
 include $(srctree)/tools/scripts/Makefile.arch
 
-$(call detected_var,ARCH)
+$(call detected_var,SRCARCH)
 
 NO_PERF_REGS := 1
 
 # Additional ARCH settings for ppc
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS := -lunwind -lunwind-ppc64
 endif
 
 # Additional ARCH settings for x86
-ifeq ($(ARCH),x86)
+ifeq ($(SRCARCH),x86)
   $(call detected,CONFIG_X86)
   ifeq (${IS_64_BIT}, 1)
     CFLAGS += -DHAVE_ARCH_X86_64_SUPPORT -DHAVE_SYSCALL_TABLE -I$(OUTPUT)arch/x86/include/generated
@@ -43,12 +43,12 @@ ifeq ($(ARCH),x86)
   NO_PERF_REGS := 0
 endif
 
-ifeq ($(ARCH),arm)
+ifeq ($(SRCARCH),arm)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-arm
 endif
 
-ifeq ($(ARCH),arm64)
+ifeq ($(SRCARCH),arm64)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-aarch64
 endif
@@ -61,7 +61,7 @@ endif
 # Disable it on all other architectures in case libdw unwind
 # support is detected in system. Add supported architectures
 # to the check.
-ifneq ($(ARCH),$(filter $(ARCH),x86 arm))
+ifneq ($(SRCARCH),$(filter $(SRCARCH),x86 arm))
   NO_LIBDW_DWARF_UNWIND := 1
 endif
 
@@ -115,9 +115,9 @@ endif
 FEATURE_CHECK_CFLAGS-libbabeltrace := $(LIBBABELTRACE_CFLAGS)
 FEATURE_CHECK_LDFLAGS-libbabeltrace := $(LIBBABELTRACE_LDFLAGS) -lbabeltrace-ctf
 
-FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(ARCH)/include/uapi -I$(srctree)/tools/include/uapi
+FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi -I$(srctree)/tools/include/uapi
 # include ARCH specific config
--include $(src-perf)/arch/$(ARCH)/Makefile
+-include $(src-perf)/arch/$(SRCARCH)/Makefile
 
 ifdef PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
   CFLAGS += -DHAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
@@ -228,12 +228,12 @@ ifeq ($(DEBUG),0)
 endif
 
 INC_FLAGS += -I$(src-perf)/util/include
-INC_FLAGS += -I$(src-perf)/arch/$(ARCH)/include
+INC_FLAGS += -I$(src-perf)/arch/$(SRCARCH)/include
 INC_FLAGS += -I$(srctree)/tools/include/uapi
 INC_FLAGS += -I$(srctree)/tools/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/uapi
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/
 
 # $(obj-perf)      for generated common-cmds.h
 # $(obj-perf)/util for generated bison/flex headers
@@ -355,7 +355,7 @@ ifndef NO_LIBELF
 
   ifndef NO_DWARF
     ifeq ($(origin PERF_HAVE_DWARF_REGS), undefined)
-      msg := $(warning DWARF register mappings have not been defined for architecture $(ARCH), DWARF support disabled);
+      msg := $(warning DWARF register mappings have not been defined for architecture $(SRCARCH), DWARF support disabled);
       NO_DWARF := 1
     else
       CFLAGS += -DHAVE_DWARF_SUPPORT $(LIBDW_CFLAGS)
@@ -380,7 +380,7 @@ ifndef NO_LIBELF
         CFLAGS += -DHAVE_BPF_PROLOGUE
         $(call detected,CONFIG_BPF_PROLOGUE)
       else
-        msg := $(warning BPF prologue is not supported by architecture $(ARCH), missing regs_query_register_offset());
+        msg := $(warning BPF prologue is not supported by architecture $(SRCARCH), missing regs_query_register_offset());
       endif
     else
       msg := $(warning DWARF support is off, BPF prologue is disabled);
@@ -406,7 +406,7 @@ ifdef PERF_HAVE_JITDUMP
   endif
 endif
 
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   ifndef NO_DWARF
     CFLAGS += -DHAVE_SKIP_CALLCHAIN_IDX
   endif
@@ -487,7 +487,7 @@ else
 endif
 
 ifndef NO_LOCAL_LIBUNWIND
-  ifeq ($(ARCH),$(filter $(ARCH),arm arm64))
+  ifeq ($(SRCARCH),$(filter $(SRCARCH),arm arm64))
     $(call feature_check,libunwind-debug-frame)
     ifneq ($(feature-libunwind-debug-frame), 1)
       msg := $(warning No debug_frame support found in libunwind);
@@ -740,7 +740,7 @@ ifeq (${IS_64_BIT}, 1)
       NO_PERF_READ_VDSO32 := 1
     endif
   endif
-  ifneq ($(ARCH), x86)
+  ifneq ($(SRCARCH), x86)
     NO_PERF_READ_VDSOX32 := 1
   endif
   ifndef NO_PERF_READ_VDSOX32
@@ -769,7 +769,7 @@ ifdef LIBBABELTRACE
 endif
 
 ifndef NO_AUXTRACE
-  ifeq ($(ARCH),x86)
+  ifeq ($(SRCARCH),x86)
     ifeq ($(feature-get_cpuid), 0)
       msg := $(warning Your gcc lacks the __get_cpuid() builtin, disables support for auxtrace/Intel PT, please install a newer gcc);
       NO_AUXTRACE := 1
@@ -872,7 +872,7 @@ sysconfdir = $(prefix)/etc
 ETC_PERFCONFIG = etc/perfconfig
 endif
 ifndef lib
-ifeq ($(ARCH)$(IS_64_BIT), x861)
+ifeq ($(SRCARCH)$(IS_64_BIT), x861)
 lib = lib64
 else
 lib = lib
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 79fe31f20a17..5008f51a08a2 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -226,7 +226,7 @@ endif
 
 ifeq ($(config),0)
 include $(srctree)/tools/scripts/Makefile.arch
--include arch/$(ARCH)/Makefile
+-include arch/$(SRCARCH)/Makefile
 endif
 
 # The FEATURE_DUMP_EXPORT holds location of the actual
diff --git a/tools/perf/arch/Build b/tools/perf/arch/Build
index 109eb75cf7de..d9b6af837c7d 100644
--- a/tools/perf/arch/Build
+++ b/tools/perf/arch/Build
@@ -1,2 +1,2 @@
 libperf-y += common.o
-libperf-y += $(ARCH)/
+libperf-y += $(SRCARCH)/
diff --git a/tools/perf/arch/common.c b/tools/perf/arch/common.c
index 837067f48a4c..6b40e9f01740 100644
--- a/tools/perf/arch/common.c
+++ b/tools/perf/arch/common.c
@@ -26,6 +26,7 @@ const char *const arm64_triplets[] = {
 
 const char *const powerpc_triplets[] = {
         "powerpc-unknown-linux-gnu-",
+        "powerpc-linux-gnu-",
         "powerpc64-unknown-linux-gnu-",
         "powerpc64-linux-gnu-",
         "powerpc64le-linux-gnu-",
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d05aec491cff..4761b0d7fcb5 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2494,6 +2494,8 @@ int cmd_script(int argc, const char **argv)
                         "Enable kernel symbol demangling"),
         OPT_STRING(0, "time", &script.time_str, "str",
                    "Time span of interest (start,stop)"),
+        OPT_BOOLEAN(0, "inline", &symbol_conf.inline_name,
+                    "Show inline function"),
         OPT_END()
         };
         const char * const script_subcommands[] = { "record", "report", NULL };
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index a935b5023732..ad9324d1daf9 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1578,6 +1578,7 @@ static void print_header(int argc, const char **argv)
 static void print_footer(void)
 {
         FILE *output = stat_config.output;
+        int n;
 
         if (!null_run)
                 fprintf(output, "\n");
@@ -1590,7 +1591,9 @@ static void print_footer(void)
         }
         fprintf(output, "\n\n");
 
-        if (print_free_counters_hint)
+        if (print_free_counters_hint &&
+            sysctl__read_int("kernel/nmi_watchdog", &n) >= 0 &&
+            n > 0)
                 fprintf(output,
 "Some events weren't counted. Try disabling the NMI watchdog:\n"
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index d014350adc52..4b2a5d298197 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -681,6 +681,10 @@ static struct syscall_fmt {
         { .name     = "mlockall",   .errmsg = true,
           .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
         { .name     = "mmap",       .hexret = true,
+/* The standard mmap maps to old_mmap on s390x */
+#if defined(__s390x__)
+        .alias = "old_mmap",
+#endif
           .arg_scnprintf = { [0] = SCA_HEX,       /* addr */
                              [2] = SCA_MMAP_PROT, /* prot */
                              [3] = SCA_MMAP_FLAGS, /* flags */ }, },
diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
index 9213a1273697..999a4e878162 100644
--- a/tools/perf/pmu-events/Build
+++ b/tools/perf/pmu-events/Build
@@ -2,7 +2,7 @@ hostprogs := jevents
 
 jevents-y       += json.o jsmn.o jevents.o
 pmu-events-y    += pmu-events.o
-JDIR            =  pmu-events/arch/$(ARCH)
+JDIR            =  pmu-events/arch/$(SRCARCH)
 JSON            =  $(shell [ -d $(JDIR) ] &&                            \
                         find $(JDIR) -name '*.json' -o -name 'mapfile.csv')
 #
@@ -10,4 +10,4 @@ JSON		=  $(shell [ -d $(JDIR) ] &&				\
 # directory and create tables in pmu-events.c.
 #
 $(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JEVENTS)
-        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(ARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
+        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(SRCARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build
index af58ebc243ef..84222bdb8689 100644
--- a/tools/perf/tests/Build
+++ b/tools/perf/tests/Build
@@ -75,7 +75,7 @@ $(OUTPUT)tests/llvm-src-relocation.c: tests/bpf-script-test-relocation.c tests/B
         $(Q)sed -e 's/"/\\"/g' -e 's/\(.*\)/"\1\\n"/g' $< >> $@
         $(Q)echo ';' >> $@
 
-ifeq ($(ARCH),$(filter $(ARCH),x86 arm arm64 powerpc))
+ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc))
 perf-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
 endif
 
diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
index e7664fe3bd33..8ba2c4618fe9 100644
--- a/tools/perf/tests/bp_signal.c
+++ b/tools/perf/tests/bp_signal.c
@@ -288,3 +288,17 @@ int test__bp_signal(int subtest __maybe_unused)
         return count1 == 1 && overflows == 3 && count2 == 3 && overflows_2 == 3 && count3 == 2 ?
                 TEST_OK : TEST_FAIL;
 }
+
+bool test__bp_signal_is_supported(void)
+{
+/*
+ * The powerpc so far does not have support to even create
+ * instruction breakpoint using the perf event interface.
+ * Once it's there we can release this.
+ */
+#ifdef __powerpc__
+        return false;
+#else
+        return true;
+#endif
+}
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 9e08d297f1a9..3ccfd58a8c3c 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -97,10 +97,12 @@ static struct test generic_tests[] = {
         {
                 .desc = "Breakpoint overflow signal handler",
                 .func = test__bp_signal,
+                .is_supported = test__bp_signal_is_supported,
         },
         {
                 .desc = "Breakpoint overflow sampling",
                 .func = test__bp_signal_overflow,
+                .is_supported = test__bp_signal_is_supported,
         },
         {
                 .desc = "Number of exit events of a simple workload",
@@ -401,6 +403,11 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist)
                 if (!perf_test__matches(t, curr, argc, argv))
                         continue;
 
+                if (t->is_supported && !t->is_supported()) {
+                        pr_debug("%2d: %-*s: Disabled\n", i, width, t->desc);
+                        continue;
+                }
+
                 pr_info("%2d: %-*s:", i, width, t->desc);
 
                 if (intlist__find(skiplist, i)) {
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 1f14e7612cbb..94b7c7b02bde 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -229,6 +229,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
         unsigned char buf2[BUFSZ];
         size_t ret_len;
         u64 objdump_addr;
+        const char *objdump_name;
+        char decomp_name[KMOD_DECOMP_LEN];
         int ret;
 
         pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
@@ -289,9 +291,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
                 state->done[state->done_cnt++] = al.map->start;
         }
 
+        objdump_name = al.map->dso->long_name;
+        if (dso__needs_decompress(al.map->dso)) {
+                if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
+                                                 decomp_name,
+                                                 sizeof(decomp_name)) < 0) {
+                        pr_debug("decompression failed\n");
+                        return -1;
+                }
+
+                objdump_name = decomp_name;
+        }
+
         /* Read the object code using objdump */
         objdump_addr = map__rip_2objdump(al.map, al.addr);
-        ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
+        ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
+
+        if (dso__needs_decompress(al.map->dso))
+                unlink(objdump_name);
+
         if (ret > 0) {
                 /*
                  * The kernel maps are inaccurate - assume objdump is right in
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 32873ec91a4e..cf00ebad2ef5 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -83,7 +83,7 @@ int test__task_exit(int subtest __maybe_unused)
 
         evsel = perf_evlist__first(evlist);
         evsel->attr.task = 1;
-        evsel->attr.sample_freq = 0;
+        evsel->attr.sample_freq = 1;
         evsel->attr.inherit = 0;
         evsel->attr.watermark = 0;
         evsel->attr.wakeup_events = 1;
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 631859629403..577363809c9b 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -34,6 +34,7 @@ struct test {
                 int (*get_nr)(void);
                 const char *(*get_desc)(int subtest);
         } subtest;
+        bool (*is_supported)(void);
 };
 
 /* Tests */
@@ -99,6 +100,8 @@ const char *test__clang_subtest_get_desc(int subtest);
 int test__clang_subtest_get_nr(void);
 int test__unit_number__scnprint(int subtest);
 
+bool test__bp_signal_is_supported(void);
+
 #if defined(__arm__) || defined(__aarch64__)
 #ifdef HAVE_DWARF_UNWIND_SUPPORT
 struct thread;
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 59addd52d9cd..ddb2c6fbdf91 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -210,6 +210,8 @@ static int __hpp__sort_acc(struct hist_entry *a, struct hist_entry *b,
                         return 0;
 
                 ret = b->callchain->max_depth - a->callchain->max_depth;
+                if (callchain_param.order == ORDER_CALLER)
+                        ret = -ret;
         }
         return ret;
 }
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 683f8340460c..ddbd56df9187 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -239,10 +239,20 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
         const char *s = strchr(ops->raw, '+');
         const char *c = strchr(ops->raw, ',');
 
-        if (c++ != NULL)
+        /*
+         * skip over possible up to 2 operands to get to address, e.g.:
+         * tbnz  w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
+         */
+        if (c++ != NULL) {
                 ops->target.addr = strtoull(c, NULL, 16);
-        else
+                if (!ops->target.addr) {
+                        c = strchr(c, ',');
+                        if (c++ != NULL)
+                                ops->target.addr = strtoull(c, NULL, 16);
+                }
+        } else {
                 ops->target.addr = strtoull(ops->raw, NULL, 16);
+        }
 
         if (s++ != NULL) {
                 ops->target.offset = strtoull(s, NULL, 16);
@@ -257,10 +267,27 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
 static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
+        const char *c = strchr(ops->raw, ',');
+
         if (!ops->target.addr || ops->target.offset < 0)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
-        return scnprintf(bf, size, "%-6.6s %" PRIx64, ins->name, ops->target.offset);
+        if (c != NULL) {
+                const char *c2 = strchr(c + 1, ',');
+
+                /* check for 3-op insn */
+                if (c2 != NULL)
+                        c = c2;
+                c++;
+
+                /* mirror arch objdump's space-after-comma style */
+                if (*c == ' ')
+                        c++;
+        }
+
+        return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
+                         ins->name, c ? c - ops->raw : 0, ops->raw,
+                         ops->target.offset);
 }
 
 static struct ins_ops jump_ops = {
@@ -1294,6 +1321,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         char linkname[PATH_MAX];
         char *build_id_filename;
         char *build_id_path = NULL;
+        char *pos;
 
         if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS &&
             !dso__is_kcore(dso))
@@ -1313,7 +1341,14 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         if (!build_id_path)
                 return -1;
 
-        dirname(build_id_path);
+        /*
+         * old style build-id cache has name of XX/XXXXXXX.. while
+         * new style has XX/XXXXXXX../{elf,kallsyms,vdso}.
+         * extract the build-id part of dirname in the new style only.
+         */
+        pos = strrchr(build_id_path, '/');
+        if (pos && strlen(pos) < SBUILD_ID_SIZE - 2)
+                dirname(build_id_path);
 
         if (dso__is_kcore(dso) ||
             readlink(build_id_path, linkname, sizeof(linkname)) < 0 ||
@@ -1396,31 +1431,10 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
                                 sizeof(symfs_filename));
                 }
         } else if (dso__needs_decompress(dso)) {
-                char tmp[PATH_MAX];
-                struct kmod_path m;
-                int fd;
-                bool ret;
-
-                if (kmod_path__parse_ext(&m, symfs_filename))
-                        goto out;
-
-                snprintf(tmp, PATH_MAX, "/tmp/perf-kmod-XXXXXX");
-
-                fd = mkstemp(tmp);
-                if (fd < 0) {
-                        free(m.ext);
-                        goto out;
-                }
-
-                ret = decompress_to_file(m.ext, symfs_filename, fd);
-
-                if (ret)
-                        pr_err("Cannot decompress %s %s\n", m.ext, symfs_filename);
-
-                free(m.ext);
-                close(fd);
+                char tmp[KMOD_DECOMP_LEN];
 
-                if (!ret)
+                if (dso__decompress_kmodule_path(dso, symfs_filename,
+                                                 tmp, sizeof(tmp)) < 0)
                         goto out;
 
                 strcpy(symfs_filename, tmp);
@@ -1429,7 +1443,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
         snprintf(command, sizeof(command),
                  "%s %s%s --start-address=0x%016" PRIx64
                  " --stop-address=0x%016" PRIx64
-                 " -l -d %s %s -C %s 2>/dev/null|grep -v %s:|expand",
+                 " -l -d %s %s -C \"%s\" 2>/dev/null|grep -v \"%s:\"|expand",
                  objdump_path ? objdump_path : "objdump",
                  disassembler_style ? "-M " : "",
                  disassembler_style ? disassembler_style : "",
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index 168cc49654e7..e0148b081bdf 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -278,51 +278,6 @@ char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size)
         return bf;
 }
 
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size)
-{
-        char *id_name = NULL, *ch;
-        struct stat sb;
-        char sbuild_id[SBUILD_ID_SIZE];
-
-        if (!dso->has_build_id)
-                goto err;
-
-        build_id__sprintf(dso->build_id, sizeof(dso->build_id), sbuild_id);
-        id_name = build_id_cache__linkname(sbuild_id, NULL, 0);
-        if (!id_name)
-                goto err;
-        if (access(id_name, F_OK))
-                goto err;
-        if (lstat(id_name, &sb) == -1)
-                goto err;
-        if ((size_t)sb.st_size > size - 1)
-                goto err;
-        if (readlink(id_name, bf, size - 1) < 0)
-                goto err;
-
-        bf[sb.st_size] = '\0';
-
-        /*
-         * link should be:
-         * ../../lib/modules/4.4.0-rc4/kernel/net/ipv4/netfilter/nf_nat_ipv4.ko/a09fe3eb3147dafa4e3b31dbd6257e4d696bdc92
-         */
-        ch = strrchr(bf, '/');
-        if (!ch)
-                goto err;
-        if (ch - 3 < bf)
-                goto err;
-
-        free(id_name);
-        return strncmp(".ko", ch - 3, 3) == 0;
-err:
-        pr_err("Invalid build id: %s\n", id_name ? :
-                                         dso->long_name ? :
-                                         dso->short_name ? :
-                                         "[unknown]");
-        free(id_name);
-        return false;
-}
-
 #define dsos__for_each_with_build_id(pos, head) \
         list_for_each_entry(pos, head, node)    \
                 if (!pos->has_build_id)         \
diff --git a/tools/perf/util/build-id.h b/tools/perf/util/build-id.h
index 8a89b195c1fc..96690a55c62c 100644
--- a/tools/perf/util/build-id.h
+++ b/tools/perf/util/build-id.h
@@ -17,7 +17,6 @@ char *build_id_cache__kallsyms_path(const char *sbuild_id, char *bf,
                                     size_t size);
 
 char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size);
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size);
 
 int build_id__mark_dso_hit(struct perf_tool *tool, union perf_event *event,
                            struct perf_sample *sample, struct perf_evsel *evsel,
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 81fc29ac798f..b4204b43ed58 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -621,14 +621,19 @@ enum match_result {
 static enum match_result match_chain_srcline(struct callchain_cursor_node *node,
                                              struct callchain_list *cnode)
 {
-        char *left = get_srcline(cnode->ms.map->dso,
+        char *left = NULL;
+        char *right = NULL;
+        enum match_result ret = MATCH_EQ;
+        int cmp;
+
+        if (cnode->ms.map)
+                left = get_srcline(cnode->ms.map->dso,
                                  map__rip_2objdump(cnode->ms.map, cnode->ip),
                                  cnode->ms.sym, true, false);
-        char *right = get_srcline(node->map->dso,
+        if (node->map)
+                right = get_srcline(node->map->dso,
                                   map__rip_2objdump(node->map, node->ip),
                                   node->sym, true, false);
-        enum match_result ret = MATCH_EQ;
-        int cmp;
 
         if (left && right)
                 cmp = strcmp(left, right);
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index a96a99d2369f..4e7ab611377a 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -248,6 +248,64 @@ bool dso__needs_decompress(struct dso *dso)
                 dso->symtab_type == DSO_BINARY_TYPE__GUEST_KMODULE_COMP;
 }
 
+static int decompress_kmodule(struct dso *dso, const char *name, char *tmpbuf)
+{
+        int fd = -1;
+        struct kmod_path m;
+
+        if (!dso__needs_decompress(dso))
+                return -1;
+
+        if (kmod_path__parse_ext(&m, dso->long_name))
+                return -1;
+
+        if (!m.comp)
+                goto out;
+
+        fd = mkstemp(tmpbuf);
+        if (fd < 0) {
+                dso->load_errno = errno;
+                goto out;
+        }
+
+        if (!decompress_to_file(m.ext, name, fd)) {
+                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
+                close(fd);
+                fd = -1;
+        }
+
+out:
+        free(m.ext);
+        return fd;
+}
+
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        unlink(tmpbuf);
+        return fd;
+}
+
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        if (fd < 0) {
+                unlink(tmpbuf);
+                return -1;
+        }
+
+        strncpy(pathname, tmpbuf, len);
+        close(fd);
+        return 0;
+}
+
 /*
  * Parses kernel module specified in @path and updates
  * @m argument like:
@@ -335,6 +393,21 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
         return 0;
 }
 
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine)
+{
+        if (machine__is_host(machine))
+                dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
+        else
+                dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
+
+        /* _KMODULE_COMP should be next to _KMODULE */
+        if (m->kmod && m->comp)
+                dso->symtab_type++;
+
+        dso__set_short_name(dso, strdup(m->name), true);
+}
+
 /*
  * Global list of open DSOs and the counter.
  */
@@ -381,7 +454,7 @@ static int do_open(char *name)
 
 static int __open_dso(struct dso *dso, struct machine *machine)
 {
-        int fd;
+        int fd = -EINVAL;
         char *root_dir = (char *)"";
         char *name = malloc(PATH_MAX);
 
@@ -392,15 +465,30 @@ static int __open_dso(struct dso *dso, struct machine *machine)
                 root_dir = machine->root_dir;
 
         if (dso__read_binary_type_filename(dso, dso->binary_type,
-                                            root_dir, name, PATH_MAX)) {
-                free(name);
-                return -EINVAL;
-        }
+                                            root_dir, name, PATH_MAX))
+                goto out;
 
         if (!is_regular_file(name))
-                return -EINVAL;
+                goto out;
+
+        if (dso__needs_decompress(dso)) {
+                char newpath[KMOD_DECOMP_LEN];
+                size_t len = sizeof(newpath);
+
+                if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+                        fd = -dso->load_errno;
+                        goto out;
+                }
+
+                strcpy(name, newpath);
+        }
 
         fd = do_open(name);
+
+        if (dso__needs_decompress(dso))
+                unlink(name);
+
+out:
         free(name);
         return fd;
 }
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 12350b171727..bd061ba7b47c 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -244,6 +244,12 @@ bool is_supported_compression(const char *ext);
 bool is_kernel_module(const char *pathname, int cpumode);
 bool decompress_to_file(const char *ext, const char *filename, int output_fd);
 bool dso__needs_decompress(struct dso *dso);
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len);
+
+#define KMOD_DECOMP_NAME  "/tmp/perf-kmod-XXXXXX"
+#define KMOD_DECOMP_LEN   sizeof(KMOD_DECOMP_NAME)
 
 struct kmod_path {
         char *name;
@@ -259,6 +265,9 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
 #define kmod_path__parse_name(__m, __p) __kmod_path__parse(__m, __p, true , false)
 #define kmod_path__parse_ext(__m, __p)  __kmod_path__parse(__m, __p, false, true)
 
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine);
+
 /*
  * The dso__data_* external interface provides following functions:
  *   dso__data_get_fd
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index e4f7902d5afa..cda44b0e821c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -273,8 +273,20 @@ struct perf_evsel *perf_evsel__new_cycles(void)
         struct perf_evsel *evsel;
 
         event_attr_init(&attr);
+        /*
+         * Unnamed union member, not supported as struct member named
+         * initializer in older compilers such as gcc 4.4.7
+         *
+         * Just for probing the precise_ip:
+         */
+        attr.sample_period = 1;
 
         perf_event_attr__set_max_precise_ip(&attr);
+        /*
+         * Now let the usual logic to set up the perf_event_attr defaults
+         * to kick in when we return and before perf_evsel__open() is called.
+         */
+        attr.sample_period = 0;
 
         evsel = perf_evsel__new(&attr);
         if (evsel == NULL)
diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
index e415aee6a245..583f3a602506 100644
--- a/tools/perf/util/evsel_fprintf.c
+++ b/tools/perf/util/evsel_fprintf.c
@@ -7,6 +7,7 @@
 #include "map.h"
 #include "strlist.h"
 #include "symbol.h"
+#include "srcline.h"
 
 static int comma_fprintf(FILE *fp, bool *first, const char *fmt, ...)
 {
@@ -168,6 +169,38 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
                         if (!print_oneline)
                                 printed += fprintf(fp, "\n");
 
+                        if (symbol_conf.inline_name && node->map) {
+                                struct inline_node *inode;
+
+                                addr = map__rip_2objdump(node->map, node->ip),
+                                inode = dso__parse_addr_inlines(node->map->dso, addr);
+
+                                if (inode) {
+                                        struct inline_list *ilist;
+
+                                        list_for_each_entry(ilist, &inode->val, list) {
+                                                if (print_arrow)
+                                                        printed += fprintf(fp, " <-");
+
+                                                /* IP is same, just skip it */
+                                                if (print_ip)
+                                                        printed += fprintf(fp, "%c%16s",
+                                                                           s, "");
+                                                if (print_sym)
+                                                        printed += fprintf(fp, " %s",
+                                                                           ilist->funcname);
+                                                if (print_srcline)
+                                                        printed += fprintf(fp, "\n  %s:%d",
+                                                                           ilist->filename,
+                                                                           ilist->line_nr);
+                                                if (!print_oneline)
+                                                        printed += fprintf(fp, "\n");
+                                        }
+
+                                        inline_node__delete(inode);
+                                }
+                        }
+
                         if (symbol_conf.bt_stop_list &&
                             node->sym &&
                             strlist__has_entry(symbol_conf.bt_stop_list,
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 314a07151fb7..b5baff3007bb 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -841,7 +841,7 @@ static int write_group_desc(int fd, struct perf_header *h __maybe_unused,
 
 /*
  * default get_cpuid(): nothing gets recorded
- * actual implementation must be in arch/$(ARCH)/util/header.c
+ * actual implementation must be in arch/$(SRCARCH)/util/header.c
  */
 int __weak get_cpuid(char *buffer __maybe_unused, size_t sz __maybe_unused)
 {
@@ -1469,8 +1469,16 @@ static int __event_process_build_id(struct build_id_event *bev,
 
                 dso__set_build_id(dso, &bev->build_id);
 
-                if (!is_kernel_module(filename, cpumode))
-                        dso->kernel = dso_type;
+                if (dso_type != DSO_TYPE_USER) {
+                        struct kmod_path m = { .name = NULL, };
+
+                        if (!kmod_path__parse_name(&m, filename) && m.kmod)
+                                dso__set_module_info(dso, &m, machine);
+                        else
+                                dso->kernel = dso_type;
+
+                        free(m.name);
+                }
 
                 build_id__sprintf(dso->build_id, sizeof(dso->build_id),
                                   sbuild_id);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index d97e014c3df3..5de2b86b9880 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -572,16 +572,7 @@ static struct dso *machine__findnew_module_dso(struct machine *machine,
                 if (dso == NULL)
                         goto out_unlock;
 
-                if (machine__is_host(machine))
-                        dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
-                else
-                        dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
-
-                /* _KMODULE_COMP should be next to _KMODULE */
-                if (m->kmod && m->comp)
-                        dso->symtab_type++;
-
-                dso__set_short_name(dso, strdup(m->name), true);
+                dso__set_module_info(dso, m, machine);
                 dso__set_long_name(dso, strdup(filename), true);
         }
 
@@ -1218,10 +1209,12 @@ int machine__create_kernel_maps(struct machine *machine)
          */
         map_groups__fixup_end(&machine->kmaps);
 
-        if (machine__get_running_kernel_start(machine, &name, &addr)) {
-        } else if (maps__set_kallsyms_ref_reloc_sym(machine->vmlinux_maps, name, addr)) {
-                machine__destroy_kernel_maps(machine);
-                return -1;
+        if (!machine__get_running_kernel_start(machine, &name, &addr)) {
+                if (name &&
+                    maps__set_kallsyms_ref_reloc_sym(machine->vmlinux_maps, name, addr)) {
+                        machine__destroy_kernel_maps(machine);
+                        return -1;
+                }
         }
 
         return 0;
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 84e7e698411e..a2670e9d652d 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -619,7 +619,7 @@ static int post_process_probe_trace_point(struct probe_trace_point *tp,
                                            struct map *map, unsigned long offs)
 {
         struct symbol *sym;
-        u64 addr = tp->address + tp->offset - offs;
+        u64 addr = tp->address - offs;
 
         sym = map__find_symbol(map, addr);
         if (!sym)
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 9d92af7d0718..40de3cb40d21 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1219,7 +1219,7 @@ static int python_generate_script(struct pevent *pevent, const char *outfile)
         fprintf(ofp, "# be retrieved using Python functions of the form "
                 "common_*(context).\n");
 
-        fprintf(ofp, "# See the perf-trace-python Documentation for the list "
+        fprintf(ofp, "# See the perf-script-python Documentation for the list "
                 "of available functions.\n\n");
 
         fprintf(ofp, "import os\n");
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index df051a52393c..ebc88a74e67b 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -56,7 +56,10 @@ static int inline_list__append(char *filename, char *funcname, int line_nr,
                 }
         }
 
-        list_add_tail(&ilist->list, &node->val);
+        if (callchain_param.order == ORDER_CALLEE)
+                list_add_tail(&ilist->list, &node->val);
+        else
+                list_add(&ilist->list, &node->val);
 
         return 0;
 }
@@ -200,12 +203,14 @@ static void addr2line_cleanup(struct a2l_data *a2l)
 
 #define MAX_INLINE_NEST 1024
 
-static void inline_list__reverse(struct inline_node *node)
+static int inline_list__append_dso_a2l(struct dso *dso,
+                                       struct inline_node *node)
 {
-        struct inline_list *ilist, *n;
+        struct a2l_data *a2l = dso->a2l;
+        char *funcname = a2l->funcname ? strdup(a2l->funcname) : NULL;
+        char *filename = a2l->filename ? strdup(a2l->filename) : NULL;
 
-        list_for_each_entry_safe_reverse(ilist, n, &node->val, list)
-                list_move_tail(&ilist->list, &node->val);
+        return inline_list__append(filename, funcname, a2l->line, node, dso);
 }
 
 static int addr2line(const char *dso_name, u64 addr,
@@ -230,36 +235,36 @@ static int addr2line(const char *dso_name, u64 addr,
 
         bfd_map_over_sections(a2l->abfd, find_address_in_section, a2l);
 
-        if (a2l->found && unwind_inlines) {
+        if (!a2l->found)
+                return 0;
+
+        if (unwind_inlines) {
                 int cnt = 0;
 
+                if (node && inline_list__append_dso_a2l(dso, node))
+                        return 0;
+
                 while (bfd_find_inliner_info(a2l->abfd, &a2l->filename,
                                              &a2l->funcname, &a2l->line) &&
                        cnt++ < MAX_INLINE_NEST) {
 
                         if (node != NULL) {
-                                if (inline_list__append(strdup(a2l->filename),
-                                                        strdup(a2l->funcname),
-                                                        a2l->line, node,
-                                                        dso) != 0)
+                                if (inline_list__append_dso_a2l(dso, node))
                                         return 0;
+                                // found at least one inline frame
+                                ret = 1;
                         }
                 }
+        }
 
-                if ((node != NULL) &&
-                    (callchain_param.order != ORDER_CALLEE)) {
-                        inline_list__reverse(node);
-                }
+        if (file) {
+                *file = a2l->filename ? strdup(a2l->filename) : NULL;
+                ret = *file ? 1 : 0;
         }
 
-        if (a2l->found && a2l->filename) {
-                *file = strdup(a2l->filename);
+        if (line)
                 *line = a2l->line;
 
-                if (*file)
-                        ret = 1;
-        }
-
         return ret;
 }
 
@@ -278,8 +283,6 @@ void dso__free_a2l(struct dso *dso)
 static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         struct dso *dso)
 {
-        char *file = NULL;
-        unsigned int line = 0;
         struct inline_node *node;
 
         node = zalloc(sizeof(*node));
@@ -291,7 +294,7 @@ static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         INIT_LIST_HEAD(&node->val);
         node->addr = addr;
 
-        if (!addr2line(dso_name, addr, &file, &line, dso, TRUE, node))
+        if (!addr2line(dso_name, addr, NULL, NULL, dso, TRUE, node))
                 goto out_free_inline_node;
 
         if (list_empty(&node->val))
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index e7ee47f7377a..502505cf236a 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -637,43 +637,6 @@ static int dso__swap_init(struct dso *dso, unsigned char eidata)
         return 0;
 }
 
-static int decompress_kmodule(struct dso *dso, const char *name,
-                              enum dso_binary_type type)
-{
-        int fd = -1;
-        char tmpbuf[] = "/tmp/perf-kmod-XXXXXX";
-        struct kmod_path m;
-
-        if (type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                return -1;
-
-        if (type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                name = dso->long_name;
-
-        if (kmod_path__parse_ext(&m, name) || !m.comp)
-                return -1;
-
-        fd = mkstemp(tmpbuf);
-        if (fd < 0) {
-                dso->load_errno = errno;
-                goto out;
-        }
-
-        if (!decompress_to_file(m.ext, name, fd)) {
-                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
-                close(fd);
-                fd = -1;
-        }
-
-        unlink(tmpbuf);
-
-out:
-        free(m.ext);
-        return fd;
-}
-
 bool symsrc__possibly_runtime(struct symsrc *ss)
 {
         return ss->dynsym || ss->opdsec;
@@ -705,9 +668,11 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
         int fd;
 
         if (dso__needs_decompress(dso)) {
-                fd = decompress_kmodule(dso, name, type);
+                fd = dso__decompress_kmodule_fd(dso, name);
                 if (fd < 0)
                         return -1;
+
+                type = dso->symtab_type;
         } else {
                 fd = open(name, O_RDONLY);
                 if (fd < 0) {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 8f2b068ff756..e7a98dbd2aed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1562,10 +1562,6 @@ int dso__load(struct dso *dso, struct map *map)
         if (!runtime_ss && syms_ss)
                 runtime_ss = syms_ss;
 
-        if (syms_ss && syms_ss->type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                if (dso__build_id_is_kmod(dso, name, PATH_MAX))
-                        kmod = true;
-
         if (syms_ss)
                 ret = dso__load_sym(dso, map, syms_ss, runtime_ss, kmod);
         else
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index f90e11a555b2..7755a5e0fe5e 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -39,6 +39,14 @@ static int __report_module(struct addr_location *al, u64 ip,
                 return 0;
 
         mod = dwfl_addrmodule(ui->dwfl, ip);
+        if (mod) {
+                Dwarf_Addr s;
+
+                dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+                if (s != al->map->start)
+                        mod = 0;
+        }
+
         if (!mod)
                 mod = dwfl_report_elf(ui->dwfl, dso->short_name,
                                       dso->long_name, -1, al->map->start,
@@ -168,12 +176,24 @@ frame_callback(Dwfl_Frame *state, void *arg)
 {
         struct unwind_info *ui = arg;
         Dwarf_Addr pc;
+        bool isactivation;
 
         if (!dwfl_frame_pc(state, &pc, NULL)) {
                 pr_err("%s", dwfl_errmsg(-1));
                 return DWARF_CB_ABORT;
         }
 
+        // report the module before we query for isactivation
+        report_module(pc, ui);
+
+        if (!dwfl_frame_pc(state, &pc, &isactivation)) {
+                pr_err("%s", dwfl_errmsg(-1));
+                return DWARF_CB_ABORT;
+        }
+
+        if (!isactivation)
+                --pc;
+
         return entry(pc, ui) || !(--ui->max_stack) ?
                DWARF_CB_ABORT : DWARF_CB_OK;
 }
@@ -220,7 +240,7 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
 
         err = dwfl_getthread_frames(ui->dwfl, thread->tid, frame_callback, ui);
 
-        if (err && !ui->max_stack)
+        if (err && ui->max_stack != max_stack)
                 err = 0;
 
         /*
diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
index f8455bed6e65..672c2ada9357 100644
--- a/tools/perf/util/unwind-libunwind-local.c
+++ b/tools/perf/util/unwind-libunwind-local.c
@@ -692,6 +692,17 @@ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
 
                 while (!ret && (unw_step(&c) > 0) && i < max_stack) {
                         unw_get_reg(&c, UNW_REG_IP, &ips[i]);
+
+                        /*
+                         * Decrement the IP for any non-activation frames.
+                         * this is required to properly find the srcline
+                         * for caller frames.
+                         * See also the documentation for dwfl_frame_pc(),
+                         * which this code tries to replicate.
+                         */
+                        if (unw_is_signal_frame(&c) <= 0)
+                                --ips[i];
+
                         ++i;
                 }
 
diff --git a/tools/power/acpi/.gitignore b/tools/power/acpi/.gitignore
new file mode 100644
index 000000000000..cba3d994995c
--- /dev/null
+++ b/tools/power/acpi/.gitignore
@@ -0,0 +1,4 @@
+acpidbg
+acpidump
+ec
+include
diff --git a/tools/testing/selftests/bpf/bpf_endian.h b/tools/testing/selftests/bpf/bpf_endian.h
index 19d0604f8694..487cbfb89beb 100644
--- a/tools/testing/selftests/bpf/bpf_endian.h
+++ b/tools/testing/selftests/bpf/bpf_endian.h
@@ -1,23 +1,42 @@
 #ifndef __BPF_ENDIAN__
 #define __BPF_ENDIAN__
 
-#include <asm/byteorder.h>
+#include <linux/swab.h>
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-# define __bpf_ntohs(x)         __builtin_bswap16(x)
-# define __bpf_htons(x)         __builtin_bswap16(x)
-#elif __BYTE_ORDER == __BIG_ENDIAN
-# define __bpf_ntohs(x)         (x)
-# define __bpf_htons(x)         (x)
+/* LLVM's BPF target selects the endianness of the CPU
+ * it compiles on, or the user specifies (bpfel/bpfeb),
+ * respectively. The used __BYTE_ORDER__ is defined by
+ * the compiler, we cannot rely on __BYTE_ORDER from
+ * libc headers, since it doesn't reflect the actual
+ * requested byte order.
+ *
+ * Note, LLVM's BPF target has different __builtin_bswapX()
+ * semantics. It does map to BPF_ALU | BPF_END | BPF_TO_BE
+ * in bpfel and bpfeb case, which means below, that we map
+ * to cpu_to_be16(). We could use it unconditionally in BPF
+ * case, but better not rely on it, so that this header here
+ * can be used from application and BPF program side, which
+ * use different targets.
+ */
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+# define __bpf_ntohs(x)                 __builtin_bswap16(x)
+# define __bpf_htons(x)                 __builtin_bswap16(x)
+# define __bpf_constant_ntohs(x)        ___constant_swab16(x)
+# define __bpf_constant_htons(x)        ___constant_swab16(x)
+#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+# define __bpf_ntohs(x)                 (x)
+# define __bpf_htons(x)                 (x)
+# define __bpf_constant_ntohs(x)        (x)
+# define __bpf_constant_htons(x)        (x)
 #else
-# error "Fix your __BYTE_ORDER?!"
+# error "Fix your compiler's __BYTE_ORDER__?!"
 #endif
 
 #define bpf_htons(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_htons(x) : __bpf_htons(x))
+         __bpf_constant_htons(x) : __bpf_htons(x))
 #define bpf_ntohs(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_ntohs(x) : __bpf_ntohs(x))
+         __bpf_constant_ntohs(x) : __bpf_ntohs(x))
 
-#endif
+#endif /* __BPF_ENDIAN__ */
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3773562056da..0ff8c55c0464 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -49,6 +49,7 @@
 #define MAX_NR_MAPS     4
 
 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
+#define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
 
 struct bpf_test {
         const char *descr;
@@ -2615,6 +2616,30 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "direct packet access: test17 (pruning, alignment)",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
+                        BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+                        BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+                        BPF_JMP_A(-6),
+                },
+                .errstr = "misaligned packet access off 2+15+-4 size 4",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+        },
+        {
                 "helper access to packet: test1, valid packet_ptr range",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -3341,6 +3366,70 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
         {
+                "alu ops on ptr_to_map_value_or_null, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
                 "invalid memory access with multiple map_lookup_elem calls",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_1, 10),
@@ -3660,6 +3749,72 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid bpf_context access",
         },
         {
+                "leak pointer into ctx 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 2 },
+                .errstr_unpriv = "R2 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into ctx 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr_unpriv = "R10 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into ctx 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 1 },
+                .errstr_unpriv = "R2 leaks addr into ctx",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into map val",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr_unpriv = "R6 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
                 "helper access to map: full range",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
@@ -4937,7 +5092,149 @@ static struct bpf_test tests[] = {
                 .fixup_map_in_map = { 3 },
                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
                 .result = REJECT,
-        }
+        },
+        {
+                "ld_abs: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "ld_ind: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
@@ -5059,9 +5356,9 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
 
         do_test_fixup(test, prog, map_fds);
 
-        fd_prog = bpf_load_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
-                                   prog, prog_len, "GPL", 0, bpf_vlog,
-                                   sizeof(bpf_vlog));
+        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+                                     prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
+                                     "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
 
         expected_ret = unpriv && test->result_unpriv != UNDEF ?
                        test->result_unpriv : test->result;
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
new file mode 100644
index 000000000000..f4d1ff785d67
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
@@ -0,0 +1,21 @@
+#!/bin/sh
+# description: Register/unregister many kprobe events
+
+# ftrace fentry skip size depends on the machine architecture.
+# Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc
+case `uname -m` in
+  x86_64|i[3456]86) OFFS=5;;
+  ppc*) OFFS=4;;
+  *) OFFS=0;;
+esac
+
+echo "Setup up to 256 kprobes"
+grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
+head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||:
+
+echo 1 > events/kprobes/enable
+echo 0 > events/kprobes/enable
+echo > kprobe_events
+echo "Waiting for unoptimizing & freeing"
+sleep 5
+echo "Done"
diff --git a/tools/testing/selftests/ntb/ntb_test.sh b/tools/testing/selftests/ntb/ntb_test.sh
index a676d3eefefb..13f5198ba0ee 100755
--- a/tools/testing/selftests/ntb/ntb_test.sh
+++ b/tools/testing/selftests/ntb/ntb_test.sh
@@ -305,7 +305,7 @@ function perf_test()
         echo "Running remote perf test $WITH DMA"
         write_file "" $REMOTE_PERF/run
         echo -n "  "
-        read_file $LOCAL_PERF/run
+        read_file $REMOTE_PERF/run
         echo "  Passed"
 
         _modprobe -r ntb_perf
diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
index d9c49f41515e..e79ccd6aada1 100644
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -42,12 +42,12 @@ int test_body(void)
         printf("Check DSCR TM context switch: ");
         fflush(stdout);
         for (;;) {
-                rv = 1;
                 asm __volatile__ (
                         /* set a known value into the DSCR */
                         "ld      3, %[dscr1];"
                         "mtspr   %[sprn_dscr], 3;"
 
+                        "li      %[rv], 1;"
                         /* start and suspend a transaction */
                         "tbegin.;"
                         "beq     1f;"
diff --git a/usr/Kconfig b/usr/Kconfig
index c0c48507e44e..ad0543e21760 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -220,6 +220,7 @@ config INITRAMFS_COMPRESSION_LZ4
 endchoice
 
 config INITRAMFS_COMPRESSION
+        depends on INITRAMFS_SOURCE!=""
         string
         default ""      if INITRAMFS_COMPRESSION_NONE
         default ".gz"   if INITRAMFS_COMPRESSION_GZIP
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index 32c3295929b0..87940364570b 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -22,7 +22,7 @@
 #include <asm/kvm_hyp.h>
 
 #define vtr_to_max_lr_idx(v)            ((v) & 0xf)
-#define vtr_to_nr_pre_bits(v)           (((u32)(v) >> 26) + 1)
+#define vtr_to_nr_pre_bits(v)           ((((u32)(v) >> 26) & 7) + 1)
 
 static u64 __hyp_text __gic_v3_get_lr(unsigned int lr)
 {
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index a2d63247d1bb..e2e5effba2a9 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -879,6 +879,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pmd_t *pmd;
 
         pud = stage2_get_pud(kvm, cache, addr);
+        if (!pud)
+                return NULL;
+
         if (stage2_pud_none(*pud)) {
                 if (!cache)
                         return NULL;
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index 0a4283ed9aa7..63e0bbdcddcc 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -226,7 +226,13 @@ static unsigned long vgic_mmio_read_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                val = vmcr.ctlr;
+                val = vmcr.grpen0 << GIC_CPU_CTRL_EnableGrp0_SHIFT;
+                val |= vmcr.grpen1 << GIC_CPU_CTRL_EnableGrp1_SHIFT;
+                val |= vmcr.ackctl << GIC_CPU_CTRL_AckCtl_SHIFT;
+                val |= vmcr.fiqen << GIC_CPU_CTRL_FIQEn_SHIFT;
+                val |= vmcr.cbpr << GIC_CPU_CTRL_CBPR_SHIFT;
+                val |= vmcr.eoim << GIC_CPU_CTRL_EOImodeNS_SHIFT;
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
@@ -267,7 +273,13 @@ static void vgic_mmio_write_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                vmcr.ctlr = val;
+                vmcr.grpen0 = !!(val & GIC_CPU_CTRL_EnableGrp0);
+                vmcr.grpen1 = !!(val & GIC_CPU_CTRL_EnableGrp1);
+                vmcr.ackctl = !!(val & GIC_CPU_CTRL_AckCtl);
+                vmcr.fiqen = !!(val & GIC_CPU_CTRL_FIQEn);
+                vmcr.cbpr = !!(val & GIC_CPU_CTRL_CBPR);
+                vmcr.eoim = !!(val & GIC_CPU_CTRL_EOImodeNS);
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 504b4bd0d651..e4187e52bb26 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -177,7 +177,18 @@ void vgic_v2_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
         struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
         u32 vmcr;
 
-        vmcr  = (vmcrp->ctlr << GICH_VMCR_CTRL_SHIFT) & GICH_VMCR_CTRL_MASK;
+        vmcr = (vmcrp->grpen0 << GICH_VMCR_ENABLE_GRP0_SHIFT) &
+                GICH_VMCR_ENABLE_GRP0_MASK;
+        vmcr |= (vmcrp->grpen1 << GICH_VMCR_ENABLE_GRP1_SHIFT) &
+                GICH_VMCR_ENABLE_GRP1_MASK;
+        vmcr |= (vmcrp->ackctl << GICH_VMCR_ACK_CTL_SHIFT) &
+                GICH_VMCR_ACK_CTL_MASK;
+        vmcr |= (vmcrp->fiqen << GICH_VMCR_FIQ_EN_SHIFT) &
+                GICH_VMCR_FIQ_EN_MASK;
+        vmcr |= (vmcrp->cbpr << GICH_VMCR_CBPR_SHIFT) &
+                GICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << GICH_VMCR_EOI_MODE_SHIFT) &
+                GICH_VMCR_EOI_MODE_MASK;
         vmcr |= (vmcrp->abpr << GICH_VMCR_ALIAS_BINPOINT_SHIFT) &
                 GICH_VMCR_ALIAS_BINPOINT_MASK;
         vmcr |= (vmcrp->bpr << GICH_VMCR_BINPOINT_SHIFT) &
@@ -195,8 +206,19 @@ void vgic_v2_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 
         vmcr = cpu_if->vgic_vmcr;
 
-        vmcrp->ctlr = (vmcr & GICH_VMCR_CTRL_MASK) >>
-                        GICH_VMCR_CTRL_SHIFT;
+        vmcrp->grpen0 = (vmcr & GICH_VMCR_ENABLE_GRP0_MASK) >>
+                GICH_VMCR_ENABLE_GRP0_SHIFT;
+        vmcrp->grpen1 = (vmcr & GICH_VMCR_ENABLE_GRP1_MASK) >>
+                GICH_VMCR_ENABLE_GRP1_SHIFT;
+        vmcrp->ackctl = (vmcr & GICH_VMCR_ACK_CTL_MASK) >>
+                GICH_VMCR_ACK_CTL_SHIFT;
+        vmcrp->fiqen = (vmcr & GICH_VMCR_FIQ_EN_MASK) >>
+                GICH_VMCR_FIQ_EN_SHIFT;
+        vmcrp->cbpr = (vmcr & GICH_VMCR_CBPR_MASK) >>
+                GICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & GICH_VMCR_EOI_MODE_MASK) >>
+                GICH_VMCR_EOI_MODE_SHIFT;
+
         vmcrp->abpr = (vmcr & GICH_VMCR_ALIAS_BINPOINT_MASK) >>
                         GICH_VMCR_ALIAS_BINPOINT_SHIFT;
         vmcrp->bpr  = (vmcr & GICH_VMCR_BINPOINT_MASK) >>
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 6fe3f003636a..030248e669f6 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -159,15 +159,24 @@ void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr)
 void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcr = ((vmcrp->ctlr >> ICC_CTLR_EL1_EOImode_SHIFT) <<
-                 ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
-        vmcr |= (vmcrp->ctlr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcr = (vmcrp->ackctl << ICH_VMCR_ACK_CTL_SHIFT) &
+                        ICH_VMCR_ACK_CTL_MASK;
+                vmcr |= (vmcrp->fiqen << ICH_VMCR_FIQ_EN_SHIFT) &
+                        ICH_VMCR_FIQ_EN_MASK;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcr = ICH_VMCR_FIQ_EN_MASK;
+        }
+
+        vmcr |= (vmcrp->cbpr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
         vmcr |= (vmcrp->abpr << ICH_VMCR_BPR1_SHIFT) & ICH_VMCR_BPR1_MASK;
         vmcr |= (vmcrp->bpr << ICH_VMCR_BPR0_SHIFT) & ICH_VMCR_BPR0_MASK;
         vmcr |= (vmcrp->pmr << ICH_VMCR_PMR_SHIFT) & ICH_VMCR_PMR_MASK;
@@ -180,17 +189,27 @@ void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
         vmcr = cpu_if->vgic_vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcrp->ctlr = ((vmcr >> ICH_VMCR_EOIM_SHIFT) <<
-                        ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
-        vmcrp->ctlr |= (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcrp->ackctl = (vmcr & ICH_VMCR_ACK_CTL_MASK) >>
+                        ICH_VMCR_ACK_CTL_SHIFT;
+                vmcrp->fiqen = (vmcr & ICH_VMCR_FIQ_EN_MASK) >>
+                        ICH_VMCR_FIQ_EN_SHIFT;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcrp->fiqen = 1;
+                vmcrp->ackctl = 0;
+        }
+
+        vmcrp->cbpr = (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & ICH_VMCR_EOIM_MASK) >> ICH_VMCR_EOIM_SHIFT;
         vmcrp->abpr = (vmcr & ICH_VMCR_BPR1_MASK) >> ICH_VMCR_BPR1_SHIFT;
         vmcrp->bpr  = (vmcr & ICH_VMCR_BPR0_MASK) >> ICH_VMCR_BPR0_SHIFT;
         vmcrp->pmr  = (vmcr & ICH_VMCR_PMR_MASK) >> ICH_VMCR_PMR_SHIFT;
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index da83e4caa272..bba7fa22a7f7 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -111,14 +111,18 @@ static inline bool irq_is_pending(struct vgic_irq *irq)
  * registers regardless of the hardware backed GIC used.
  */
 struct vgic_vmcr {
-        u32     ctlr;
+        u32     grpen0;
+        u32     grpen1;
+
+        u32     ackctl;
+        u32     fiqen;
+        u32     cbpr;
+        u32     eoim;
+
         u32     abpr;
         u32     bpr;
         u32     pmr;  /* Priority mask field in the GICC_PMR and
                        * ICC_PMR_EL1 priority field format */
-        /* Below member variable are valid only for GICv3 */
-        u32     grpen0;
-        u32     grpen1;
 };
 
 struct vgic_reg_attr {