Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Several cases of bug fixes in 'net' overlapping other changes in
'net-next-.

Signed-off-by: David S. Miller <davem@davemloft.net>

580 files changed, 7286 insertions, 4003 deletions

diff --git a/Documentation/ABI/testing/sysfs-devices-system-ibm-rtl b/Documentation/ABI/testing/sysfs-devices-system-ibm-rtl
index b82deeaec314..470def06ab0a 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-ibm-rtl
+++ b/Documentation/ABI/testing/sysfs-devices-system-ibm-rtl
@@ -1,4 +1,4 @@
-What:           state
+What:           /sys/devices/system/ibm_rtl/state
 Date:           Sep 2010
 KernelVersion:  2.6.37
 Contact:        Vernon Mauery <vernux@us.ibm.com>
@@ -10,7 +10,7 @@ Description:    The state file allows a means by which to change in and
 Users:          The ibm-prtm userspace daemon uses this interface.
 
 
-What:           version
+What:           /sys/devices/system/ibm_rtl/version
 Date:           Sep 2010
 KernelVersion:  2.6.37
 Contact:        Vernon Mauery <vernux@us.ibm.com>
diff --git a/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt
index 4e00e859e885..bfa461aaac99 100644
--- a/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt
@@ -43,6 +43,9 @@ Optional properties:
   reset signal present internally in some host controller IC designs.
   See Documentation/devicetree/bindings/reset/reset.txt for details.
 
+* reset-names: request name for using "resets" property. Must be "reset".
+        (It will be used together with "resets" property.)
+
 * clocks: from common clock binding: handle to biu and ciu clocks for the
   bus interface unit clock and the card interface unit clock.
 
@@ -103,6 +106,8 @@ board specific portions as listed below.
                 interrupts = <0 75 0>;
                 #address-cells = <1>;
                 #size-cells = <0>;
+                resets = <&rst 20>;
+                reset-names = "reset";
         };
 
 [board specific internal DMA resources]
diff --git a/Documentation/devicetree/bindings/pci/rockchip-pcie.txt b/Documentation/devicetree/bindings/pci/rockchip-pcie.txt
index ba67b39939c1..71aeda1ca055 100644
--- a/Documentation/devicetree/bindings/pci/rockchip-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/rockchip-pcie.txt
@@ -26,13 +26,16 @@ Required properties:
         - "sys"
         - "legacy"
         - "client"
-- resets: Must contain five entries for each entry in reset-names.
+- resets: Must contain seven entries for each entry in reset-names.
            See ../reset/reset.txt for details.
 - reset-names: Must include the following names
         - "core"
         - "mgmt"
         - "mgmt-sticky"
         - "pipe"
+        - "pm"
+        - "aclk"
+        - "pclk"
 - pinctrl-names : The pin control state names
 - pinctrl-0: The "default" pinctrl state
 - #interrupt-cells: specifies the number of cells needed to encode an
@@ -86,8 +89,10 @@ pcie0: pcie@f8000000 {
         reg = <0x0 0xf8000000 0x0 0x2000000>, <0x0 0xfd000000 0x0 0x1000000>;
         reg-names = "axi-base", "apb-base";
         resets = <&cru SRST_PCIE_CORE>, <&cru SRST_PCIE_MGMT>,
-                 <&cru SRST_PCIE_MGMT_STICKY>, <&cru SRST_PCIE_PIPE>;
-        reset-names = "core", "mgmt", "mgmt-sticky", "pipe";
+                 <&cru SRST_PCIE_MGMT_STICKY>, <&cru SRST_PCIE_PIPE> ,
+                 <&cru SRST_PCIE_PM>, <&cru SRST_P_PCIE>, <&cru SRST_A_PCIE>;
+        reset-names = "core", "mgmt", "mgmt-sticky", "pipe",
+                      "pm", "pclk", "aclk";
         phys = <&pcie_phy>;
         phy-names = "pcie-phy";
         pinctrl-names = "default";
diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt
index f9753c416974..b24583aa34c3 100644
--- a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt
@@ -14,11 +14,6 @@ Required properies:
  - #size-cells  : The value of this property must be 1
  - ranges       : defines mapping between pin controller node (parent) to
    gpio-bank node (children).
- - interrupt-parent: phandle of the interrupt parent to which the external
-   GPIO interrupts are forwarded to.
- - st,syscfg: Should be phandle/offset pair. The phandle to the syscon node
-   which includes IRQ mux selection register, and the offset of the IRQ mux
-   selection register.
  - pins-are-numbered: Specify the subnodes are using numbered pinmux to
    specify pins.
 
@@ -37,6 +32,11 @@ Required properties:
 
 Optional properties:
  - reset:         : Reference to the reset controller
+ - interrupt-parent: phandle of the interrupt parent to which the external
+   GPIO interrupts are forwarded to.
+ - st,syscfg: Should be phandle/offset pair. The phandle to the syscon node
+   which includes IRQ mux selection register, and the offset of the IRQ mux
+   selection register.
 
 Example:
 #include <dt-bindings/pinctrl/stm32f429-pinfunc.h>
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index 14cdc101d165..1b5f15653b1b 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -447,7 +447,6 @@ prototypes:
         int (*flush) (struct file *);
         int (*release) (struct inode *, struct file *);
         int (*fsync) (struct file *, loff_t start, loff_t end, int datasync);
-        int (*aio_fsync) (struct kiocb *, int datasync);
         int (*fasync) (int, struct file *, int);
         int (*lock) (struct file *, int, struct file_lock *);
         ssize_t (*readv) (struct file *, const struct iovec *, unsigned long,
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index d619c8d71966..b5039a00caaf 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -828,7 +828,6 @@ struct file_operations {
         int (*flush) (struct file *, fl_owner_t id);
         int (*release) (struct inode *, struct file *);
         int (*fsync) (struct file *, loff_t, loff_t, int datasync);
-        int (*aio_fsync) (struct kiocb *, int datasync);
         int (*fasync) (int, struct file *, int);
         int (*lock) (struct file *, int, struct file_lock *);
         ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int);
diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 6d6c07cf1a9a..63912ef34606 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -67,13 +67,14 @@ Note that DSA does not currently create network interfaces for the "cpu" and
 Switch tagging protocols
 ------------------------
 
-DSA currently supports 4 different tagging protocols, and a tag-less mode as
+DSA currently supports 5 different tagging protocols, and a tag-less mode as
 well. The different protocols are implemented in:
 
 net/dsa/tag_trailer.c: Marvell's 4 trailer tag mode (legacy)
 net/dsa/tag_dsa.c: Marvell's original DSA tag
 net/dsa/tag_edsa.c: Marvell's enhanced DSA tag
 net/dsa/tag_brcm.c: Broadcom's 4 bytes tag
+net/dsa/tag_qca.c: Qualcomm's 2 bytes tag
 
 The exact format of the tag protocol is vendor specific, but in general, they
 all contain something which:
diff --git a/Documentation/virtual/kvm/locking.txt b/Documentation/virtual/kvm/locking.txt
index f2491a8c68b4..e5dd9f4d6100 100644
--- a/Documentation/virtual/kvm/locking.txt
+++ b/Documentation/virtual/kvm/locking.txt
@@ -4,7 +4,17 @@ KVM Lock Overview
 1. Acquisition Orders
 ---------------------
 
-(to be written)
+The acquisition orders for mutexes are as follows:
+
+- kvm->lock is taken outside vcpu->mutex
+
+- kvm->lock is taken outside kvm->slots_lock and kvm->irq_lock
+
+- kvm->slots_lock is taken outside kvm->irq_lock, though acquiring
+  them together is quite rare.
+
+For spinlocks, kvm_lock is taken outside kvm->mmu_lock.  Everything
+else is a leaf: no other lock is taken inside the critical sections.
 
 2: Exception
 ------------
diff --git a/MAINTAINERS b/MAINTAINERS
index e5c17a951b7d..987081272e25 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7927,6 +7927,10 @@ F:	mm/
 MEMORY TECHNOLOGY DEVICES (MTD)
 M:      David Woodhouse <dwmw2@infradead.org>
 M:      Brian Norris <computersforpeace@gmail.com>
+M:      Boris Brezillon <boris.brezillon@free-electrons.com>
+M:      Marek Vasut <marek.vasut@gmail.com>
+M:      Richard Weinberger <richard@nod.at>
+M:      Cyrille Pitchen <cyrille.pitchen@atmel.com>
 L:      linux-mtd@lists.infradead.org
 W:      http://www.linux-mtd.infradead.org/
 Q:      http://patchwork.ozlabs.org/project/linux-mtd/list/
@@ -8055,6 +8059,7 @@ F:	drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
 
 MELLANOX MLX5 core VPI driver
+M:      Saeed Mahameed <saeedm@mellanox.com>
 M:      Matan Barak <matanb@mellanox.com>
 M:      Leon Romanovsky <leonro@mellanox.com>
 L:      netdev@vger.kernel.org
@@ -9332,7 +9337,7 @@ PCI DRIVER FOR INTEL VOLUME MANAGEMENT DEVICE (VMD)
 M:      Keith Busch <keith.busch@intel.com>
 L:      linux-pci@vger.kernel.org
 S:      Supported
-F:      arch/x86/pci/vmd.c
+F:      drivers/pci/host/vmd.c
 
 PCIE DRIVER FOR ST SPEAR13XX
 M:      Pratyush Anand <pratyush.anand@gmail.com>
@@ -11405,6 +11410,17 @@ W:	http://www.st.com/spear
 S:      Maintained
 F:      drivers/clk/spear/
 
+SPI NOR SUBSYSTEM
+M:      Cyrille Pitchen <cyrille.pitchen@atmel.com>
+M:      Marek Vasut <marek.vasut@gmail.com>
+L:      linux-mtd@lists.infradead.org
+W:      http://www.linux-mtd.infradead.org/
+Q:      http://patchwork.ozlabs.org/project/linux-mtd/list/
+T:      git git://github.com/spi-nor/linux.git
+S:      Maintained
+F:      drivers/mtd/spi-nor/
+F:      include/linux/mtd/spi-nor.h
+
 SPI SUBSYSTEM
 M:      Mark Brown <broonie@kernel.org>
 L:      linux-spi@vger.kernel.org
@@ -12784,6 +12800,7 @@ F:	include/uapi/linux/virtio_console.h
 
 VIRTIO CORE, NET AND BLOCK DRIVERS
 M:      "Michael S. Tsirkin" <mst@redhat.com>
+M:      Jason Wang <jasowang@redhat.com>
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/virtio/
@@ -12814,6 +12831,7 @@ F:	include/uapi/linux/virtio_gpu.h
 
 VIRTIO HOST (VHOST)
 M:      "Michael S. Tsirkin" <mst@redhat.com>
+M:      Jason Wang <jasowang@redhat.com>
 L:      kvm@vger.kernel.org
 L:      virtualization@lists.linux-foundation.org
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index a2650f9c6a25..247430abfc73 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc5
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
@@ -370,7 +370,7 @@ LDFLAGS_MODULE  =
 CFLAGS_KERNEL   =
 AFLAGS_KERNEL   =
 LDFLAGS_vmlinux =
-CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im
+CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
 CFLAGS_KCOV     := $(call cc-option,-fsanitize-coverage=trace-pc,)
 
 
@@ -620,7 +620,6 @@ ARCH_CFLAGS :=
 include arch/$(SRCARCH)/Makefile
 
 KBUILD_CFLAGS   += $(call cc-option,-fno-delete-null-pointer-checks,)
-KBUILD_CFLAGS   += $(call cc-disable-warning,maybe-uninitialized,)
 KBUILD_CFLAGS   += $(call cc-disable-warning,frame-address,)
 
 ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
@@ -629,15 +628,18 @@ KBUILD_CFLAGS	+= $(call cc-option,-fdata-sections,)
 endif
 
 ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
-KBUILD_CFLAGS   += -Os
+KBUILD_CFLAGS   += -Os $(call cc-disable-warning,maybe-uninitialized,)
 else
 ifdef CONFIG_PROFILE_ALL_BRANCHES
-KBUILD_CFLAGS   += -O2
+KBUILD_CFLAGS   += -O2 $(call cc-disable-warning,maybe-uninitialized,)
 else
 KBUILD_CFLAGS   += -O2
 endif
 endif
 
+KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
+                        $(call cc-disable-warning,maybe-uninitialized,))
+
 # Tell gcc to never replace conditional load with a non-conditional one
 KBUILD_CFLAGS   += $(call cc-option,--param=allow-store-data-races=0)
 
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 864adad52280..19cce226d1a8 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -50,6 +50,9 @@ atleast_gcc44 :=  $(call cc-ifversion, -ge, 0404, y)
 
 cflags-$(atleast_gcc44)                 += -fsection-anchors
 
+cflags-$(CONFIG_ARC_HAS_LLSC)           += -mlock
+cflags-$(CONFIG_ARC_HAS_SWAPE)          += -mswape
+
 ifdef CONFIG_ISA_ARCV2
 
 ifndef CONFIG_ARC_HAS_LL64
@@ -68,7 +71,9 @@ cflags-$(CONFIG_ARC_DW2_UNWIND)		+= -fasynchronous-unwind-tables $(cfi)
 ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
 # Generic build system uses -O2, we want -O3
 # Note: No need to add to cflags-y as that happens anyways
-ARCH_CFLAGS += -O3
+#
+# Disable the false maybe-uninitialized warings gcc spits out at -O3
+ARCH_CFLAGS += -O3 $(call cc-disable-warning,maybe-uninitialized,)
 endif
 
 # small data is default for elf32 tool-chain. If not usable, disable it
diff --git a/arch/arc/boot/dts/axc001.dtsi b/arch/arc/boot/dts/axc001.dtsi
index 6ae2c476ad82..53ce226f77a5 100644
--- a/arch/arc/boot/dts/axc001.dtsi
+++ b/arch/arc/boot/dts/axc001.dtsi
@@ -71,7 +71,7 @@
                         reg-io-width = <4>;
                 };
 
-                arcpmu0: pmu {
+                arcpct0: pct {
                         compatible = "snps,arc700-pct";
                 };
         };
diff --git a/arch/arc/boot/dts/nsim_700.dts b/arch/arc/boot/dts/nsim_700.dts
index ce0ccd20b5bf..5ee96b067c08 100644
--- a/arch/arc/boot/dts/nsim_700.dts
+++ b/arch/arc/boot/dts/nsim_700.dts
@@ -69,7 +69,7 @@
                         };
                 };
 
-                arcpmu0: pmu {
+                arcpct0: pct {
                         compatible = "snps,arc700-pct";
                 };
         };
diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
index bcf603142a33..3c391ba565ed 100644
--- a/arch/arc/boot/dts/nsimosci.dts
+++ b/arch/arc/boot/dts/nsimosci.dts
@@ -83,5 +83,9 @@
                         reg = <0xf0003000 0x44>;
                         interrupts = <7>;
                 };
+
+                arcpct0: pct {
+                        compatible = "snps,arc700-pct";
+                };
         };
 };
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 7314f538847b..b0066a749d4c 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -14,6 +14,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index 65ab9fbf83f2..ebe9ebb92933 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -14,6 +14,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index 3b3990cddbe1..4bde43278be6 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -12,6 +12,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index 98cf20933bbb..f6fb3d26557e 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -14,6 +14,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index ddf8b96d494e..b9f0fe00044b 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -14,6 +14,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index ceb90745326e..6da71ba253a9 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -10,6 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
+CONFIG_PERF_EVENTS=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
@@ -34,7 +35,6 @@ CONFIG_INET=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
 # CONFIG_IPV6 is not set
 # CONFIG_WIRELESS is not set
 CONFIG_DEVTMPFS=y
@@ -72,7 +72,6 @@ CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HWMON is not set
 CONFIG_DRM=y
 CONFIG_DRM_ARCPGU=y
-CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 # CONFIG_HID is not set
 # CONFIG_USB_SUPPORT is not set
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 7f3f9f63708c..1bd24ec3e350 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -43,12 +43,14 @@
 #define STATUS_AE_BIT           5       /* Exception active */
 #define STATUS_DE_BIT           6       /* PC is in delay slot */
 #define STATUS_U_BIT            7       /* User/Kernel mode */
+#define STATUS_Z_BIT            11
 #define STATUS_L_BIT            12      /* Loop inhibit */
 
 /* These masks correspond to the status word(STATUS_32) bits */
 #define STATUS_AE_MASK          (1<<STATUS_AE_BIT)
 #define STATUS_DE_MASK          (1<<STATUS_DE_BIT)
 #define STATUS_U_MASK           (1<<STATUS_U_BIT)
+#define STATUS_Z_MASK           (1<<STATUS_Z_BIT)
 #define STATUS_L_MASK           (1<<STATUS_L_BIT)
 
 /*
diff --git a/arch/arc/include/asm/smp.h b/arch/arc/include/asm/smp.h
index 89fdd1b0a76e..0861007d9ef3 100644
--- a/arch/arc/include/asm/smp.h
+++ b/arch/arc/include/asm/smp.h
@@ -37,9 +37,9 @@ extern const char *arc_platform_smp_cpuinfo(void);
  * API expected BY platform smp code (FROM arch smp code)
  *
  * smp_ipi_irq_setup:
- *      Takes @cpu and @irq to which the arch-common ISR is hooked up
+ *      Takes @cpu and @hwirq to which the arch-common ISR is hooked up
  */
-extern int smp_ipi_irq_setup(int cpu, int irq);
+extern int smp_ipi_irq_setup(int cpu, irq_hw_number_t hwirq);
 
 /*
  * struct plat_smp_ops  - SMP callbacks provided by platform to ARC SMP
diff --git a/arch/arc/kernel/devtree.c b/arch/arc/kernel/devtree.c
index f1e07c2344f8..3b67f538f142 100644
--- a/arch/arc/kernel/devtree.c
+++ b/arch/arc/kernel/devtree.c
@@ -31,6 +31,8 @@ static void __init arc_set_early_base_baud(unsigned long dt_root)
                 arc_base_baud = 166666666;      /* Fixed 166.6MHz clk (TB10x) */
         else if (of_flat_dt_is_compatible(dt_root, "snps,arc-sdp"))
                 arc_base_baud = 33333333;       /* Fixed 33MHz clk (AXS10x) */
+        else if (of_flat_dt_is_compatible(dt_root, "ezchip,arc-nps"))
+                arc_base_baud = 800000000;      /* Fixed 800MHz clk (NPS) */
         else
                 arc_base_baud = 50000000;       /* Fixed default 50MHz */
 }
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index c424d5abc318..f39142acc89e 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -181,6 +181,8 @@ idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
 {
         unsigned long flags;
         cpumask_t online;
+        unsigned int destination_bits;
+        unsigned int distribution_mode;
 
         /* errout if no online cpu per @cpumask */
         if (!cpumask_and(&online, cpumask, cpu_online_mask))
@@ -188,8 +190,15 @@ idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
 
         raw_spin_lock_irqsave(&mcip_lock, flags);
 
-        idu_set_dest(data->hwirq, cpumask_bits(&online)[0]);
-        idu_set_mode(data->hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_RR);
+        destination_bits = cpumask_bits(&online)[0];
+        idu_set_dest(data->hwirq, destination_bits);
+
+        if (ffs(destination_bits) == fls(destination_bits))
+                distribution_mode = IDU_M_DISTRI_DEST;
+        else
+                distribution_mode = IDU_M_DISTRI_RR;
+
+        idu_set_mode(data->hwirq, IDU_M_TRIG_LEVEL, distribution_mode);
 
         raw_spin_unlock_irqrestore(&mcip_lock, flags);
 
@@ -207,16 +216,15 @@ static struct irq_chip idu_irq_chip = {
 
 };
 
-static int idu_first_irq;
+static irq_hw_number_t idu_first_hwirq;
 
 static void idu_cascade_isr(struct irq_desc *desc)
 {
-        struct irq_domain *domain = irq_desc_get_handler_data(desc);
-        unsigned int core_irq = irq_desc_get_irq(desc);
-        unsigned int idu_irq;
+        struct irq_domain *idu_domain = irq_desc_get_handler_data(desc);
+        irq_hw_number_t core_hwirq = irqd_to_hwirq(irq_desc_get_irq_data(desc));
+        irq_hw_number_t idu_hwirq = core_hwirq - idu_first_hwirq;
 
-        idu_irq = core_irq - idu_first_irq;
-        generic_handle_irq(irq_find_mapping(domain, idu_irq));
+        generic_handle_irq(irq_find_mapping(idu_domain, idu_hwirq));
 }
 
 static int idu_irq_map(struct irq_domain *d, unsigned int virq, irq_hw_number_t hwirq)
@@ -282,7 +290,7 @@ idu_of_init(struct device_node *intc, struct device_node *parent)
         struct irq_domain *domain;
         /* Read IDU BCR to confirm nr_irqs */
         int nr_irqs = of_irq_count(intc);
-        int i, irq;
+        int i, virq;
         struct mcip_bcr mp;
 
         READ_BCR(ARC_REG_MCIP_BCR, mp);
@@ -303,11 +311,11 @@ idu_of_init(struct device_node *intc, struct device_node *parent)
                  * however we need it to get the parent virq and set IDU handler
                  * as first level isr
                  */
-                irq = irq_of_parse_and_map(intc, i);
+                virq = irq_of_parse_and_map(intc, i);
                 if (!i)
-                        idu_first_irq = irq;
+                        idu_first_hwirq = irqd_to_hwirq(irq_get_irq_data(virq));
 
-                irq_set_chained_handler_and_data(irq, idu_cascade_isr, domain);
+                irq_set_chained_handler_and_data(virq, idu_cascade_isr, domain);
         }
 
         __mcip_cmd(CMD_IDU_ENABLE, 0);
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 59aa43cb146e..a41a79a4f4fe 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -43,8 +43,8 @@ SYSCALL_DEFINE0(arc_gettls)
 
 SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
 {
-        int uval;
-        int ret;
+        struct pt_regs *regs = current_pt_regs();
+        int uval = -EFAULT;
 
         /*
          * This is only for old cores lacking LLOCK/SCOND, which by defintion
@@ -54,24 +54,26 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
          */
         WARN_ON_ONCE(IS_ENABLED(CONFIG_SMP));
 
+        /* Z indicates to userspace if operation succeded */
+        regs->status32 &= ~STATUS_Z_MASK;
+
         if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
                 return -EFAULT;
 
         preempt_disable();
 
-        ret = __get_user(uval, uaddr);
-        if (ret)
+        if (__get_user(uval, uaddr))
                 goto done;
 
-        if (uval != expected)
-                ret = -EAGAIN;
-        else
-                ret = __put_user(new, uaddr);
+        if (uval == expected) {
+                if (!__put_user(new, uaddr))
+                        regs->status32 |= STATUS_Z_MASK;
+        }
 
 done:
         preempt_enable();
 
-        return ret;
+        return uval;
 }
 
 void arch_cpu_idle(void)
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index f183cc648851..88674d972c9d 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -22,6 +22,7 @@
 #include <linux/atomic.h>
 #include <linux/cpumask.h>
 #include <linux/reboot.h>
+#include <linux/irqdomain.h>
 #include <asm/processor.h>
 #include <asm/setup.h>
 #include <asm/mach_desc.h>
@@ -67,11 +68,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         int i;
 
         /*
-         * Initialise the present map, which describes the set of CPUs
-         * actually populated at the present time.
+         * if platform didn't set the present map already, do it now
+         * boot cpu is set to present already by init/main.c
          */
-        for (i = 0; i < max_cpus; i++)
-                set_cpu_present(i, true);
+        if (num_present_cpus() <= 1) {
+                for (i = 0; i < max_cpus; i++)
+                        set_cpu_present(i, true);
+        }
 }
 
 void __init smp_cpus_done(unsigned int max_cpus)
@@ -351,20 +354,24 @@ irqreturn_t do_IPI(int irq, void *dev_id)
  */
 static DEFINE_PER_CPU(int, ipi_dev);
 
-int smp_ipi_irq_setup(int cpu, int irq)
+int smp_ipi_irq_setup(int cpu, irq_hw_number_t hwirq)
 {
         int *dev = per_cpu_ptr(&ipi_dev, cpu);
+        unsigned int virq = irq_find_mapping(NULL, hwirq);
+
+        if (!virq)
+                panic("Cannot find virq for root domain and hwirq=%lu", hwirq);
 
         /* Boot cpu calls request, all call enable */
         if (!cpu) {
                 int rc;
 
-                rc = request_percpu_irq(irq, do_IPI, "IPI Interrupt", dev);
+                rc = request_percpu_irq(virq, do_IPI, "IPI Interrupt", dev);
                 if (rc)
-                        panic("Percpu IRQ request failed for %d\n", irq);
+                        panic("Percpu IRQ request failed for %u\n", virq);
         }
 
-        enable_percpu_irq(irq, 0);
+        enable_percpu_irq(virq, 0);
 
         return 0;
 }
diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c
index f927b8dc6edd..c10390d1ddb6 100644
--- a/arch/arc/kernel/time.c
+++ b/arch/arc/kernel/time.c
@@ -152,14 +152,17 @@ static cycle_t arc_read_rtc(struct clocksource *cs)
                 cycle_t  full;
         } stamp;
 
-
-        __asm__ __volatile(
-        "1:                                             \n"
-        "       lr              %0, [AUX_RTC_LOW]       \n"
-        "       lr              %1, [AUX_RTC_HIGH]      \n"
-        "       lr              %2, [AUX_RTC_CTRL]      \n"
-        "       bbit0.nt        %2, 31, 1b              \n"
-        : "=r" (stamp.low), "=r" (stamp.high), "=r" (status));
+        /*
+         * hardware has an internal state machine which tracks readout of
+         * low/high and updates the CTRL.status if
+         *  - interrupt/exception taken between the two reads
+         *  - high increments after low has been read
+         */
+        do {
+                stamp.low = read_aux_reg(AUX_RTC_LOW);
+                stamp.high = read_aux_reg(AUX_RTC_HIGH);
+                status = read_aux_reg(AUX_RTC_CTRL);
+        } while (!(status & _BITUL(31)));
 
         return stamp.full;
 }
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 60aab5a7522b..cd8aad8226dd 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -105,6 +105,31 @@ static void arc_dma_free(struct device *dev, size_t size, void *vaddr,
         __free_pages(page, get_order(size));
 }
 
+static int arc_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                        void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                        unsigned long attrs)
+{
+        unsigned long user_count = vma_pages(vma);
+        unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        unsigned long pfn = __phys_to_pfn(plat_dma_to_phys(dev, dma_addr));
+        unsigned long off = vma->vm_pgoff;
+        int ret = -ENXIO;
+
+        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+        if (dma_mmap_from_coherent(dev, vma, cpu_addr, size, &ret))
+                return ret;
+
+        if (off < count && user_count <= (count - off)) {
+                ret = remap_pfn_range(vma, vma->vm_start,
+                                      pfn + off,
+                                      user_count << PAGE_SHIFT,
+                                      vma->vm_page_prot);
+        }
+
+        return ret;
+}
+
 /*
  * streaming DMA Mapping API...
  * CPU accesses page via normal paddr, thus needs to explicitly made
@@ -193,6 +218,7 @@ static int arc_dma_supported(struct device *dev, u64 dma_mask)
 struct dma_map_ops arc_dma_ops = {
         .alloc                  = arc_dma_alloc,
         .free                   = arc_dma_free,
+        .mmap                   = arc_dma_mmap,
         .map_page               = arc_dma_map_page,
         .map_sg                 = arc_dma_map_sg,
         .sync_single_for_device = arc_dma_sync_single_for_device,
diff --git a/arch/arc/plat-eznps/smp.c b/arch/arc/plat-eznps/smp.c
index 5e901f86e4bd..56a4c8522f11 100644
--- a/arch/arc/plat-eznps/smp.c
+++ b/arch/arc/plat-eznps/smp.c
@@ -140,16 +140,10 @@ static void eznps_init_per_cpu(int cpu)
         mtm_enable_core(cpu);
 }
 
-static void eznps_ipi_clear(int irq)
-{
-        write_aux_reg(CTOP_AUX_IACK, 1 << irq);
-}
-
 struct plat_smp_ops plat_smp_ops = {
         .info           = smp_cpuinfo_buf,
         .init_early_smp = eznps_init_cpumasks,
         .cpu_kick       = eznps_smp_wakeup_cpu,
         .ipi_send       = eznps_ipi_send,
         .init_per_cpu   = eznps_init_per_cpu,
-        .ipi_clear      = eznps_ipi_clear,
 };
diff --git a/arch/arm/include/asm/kvm_asm.h b/arch/arm/include/asm/kvm_asm.h
index d7ea6bcb29bf..8ef05381984b 100644
--- a/arch/arm/include/asm/kvm_asm.h
+++ b/arch/arm/include/asm/kvm_asm.h
@@ -66,6 +66,7 @@ extern char __kvm_hyp_vector[];
 extern void __kvm_flush_vm_context(void);
 extern void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
 extern void __kvm_tlb_flush_vmid(struct kvm *kvm);
+extern void __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu);
 
 extern int __kvm_vcpu_run(struct kvm_vcpu *vcpu);
 
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 2d19e02d03fd..d5423ab15ed5 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -57,6 +57,9 @@ struct kvm_arch {
         /* VTTBR value associated with below pgd and vmid */
         u64    vttbr;
 
+        /* The last vcpu id that ran on each physical CPU */
+        int __percpu *last_vcpu_ran;
+
         /* Timer */
         struct arch_timer_kvm   timer;
 
diff --git a/arch/arm/include/asm/kvm_hyp.h b/arch/arm/include/asm/kvm_hyp.h
index 343135ede5fa..58508900c4bb 100644
--- a/arch/arm/include/asm/kvm_hyp.h
+++ b/arch/arm/include/asm/kvm_hyp.h
@@ -71,6 +71,7 @@
 #define ICIALLUIS       __ACCESS_CP15(c7, 0, c1, 0)
 #define ATS1CPR         __ACCESS_CP15(c7, 0, c8, 0)
 #define TLBIALLIS       __ACCESS_CP15(c8, 0, c3, 0)
+#define TLBIALL         __ACCESS_CP15(c8, 0, c7, 0)
 #define TLBIALLNSNHIS   __ACCESS_CP15(c8, 4, c3, 4)
 #define PRRR            __ACCESS_CP15(c10, 0, c2, 0)
 #define NMRR            __ACCESS_CP15(c10, 0, c2, 1)
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 194b69923389..ada0d29a660f 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -19,7 +19,7 @@
  * This may need to be greater than __NR_last_syscall+1 in order to
  * account for the padding in the syscall table
  */
-#define __NR_syscalls  (396)
+#define __NR_syscalls  (400)
 
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 2cb9dc770e1d..314100a06ccb 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -420,6 +420,9 @@
 #define __NR_copy_file_range            (__NR_SYSCALL_BASE+391)
 #define __NR_preadv2                    (__NR_SYSCALL_BASE+392)
 #define __NR_pwritev2                   (__NR_SYSCALL_BASE+393)
+#define __NR_pkey_mprotect              (__NR_SYSCALL_BASE+394)
+#define __NR_pkey_alloc                 (__NR_SYSCALL_BASE+395)
+#define __NR_pkey_free                  (__NR_SYSCALL_BASE+396)
 
 /*
  * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 703fa0f3cd8f..08030b18f10a 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -403,6 +403,9 @@
                 CALL(sys_copy_file_range)
                 CALL(sys_preadv2)
                 CALL(sys_pwritev2)
+                CALL(sys_pkey_mprotect)
+/* 395 */       CALL(sys_pkey_alloc)
+                CALL(sys_pkey_free)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 08bb84f2ad58..19b5f5c1c0ff 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -114,11 +114,18 @@ void kvm_arch_check_processor_compat(void *rtn)
  */
 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 {
-        int ret = 0;
+        int ret, cpu;
 
         if (type)
                 return -EINVAL;
 
+        kvm->arch.last_vcpu_ran = alloc_percpu(typeof(*kvm->arch.last_vcpu_ran));
+        if (!kvm->arch.last_vcpu_ran)
+                return -ENOMEM;
+
+        for_each_possible_cpu(cpu)
+                *per_cpu_ptr(kvm->arch.last_vcpu_ran, cpu) = -1;
+
         ret = kvm_alloc_stage2_pgd(kvm);
         if (ret)
                 goto out_fail_alloc;
@@ -141,6 +148,8 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 out_free_stage2_pgd:
         kvm_free_stage2_pgd(kvm);
 out_fail_alloc:
+        free_percpu(kvm->arch.last_vcpu_ran);
+        kvm->arch.last_vcpu_ran = NULL;
         return ret;
 }
 
@@ -168,6 +177,9 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
 {
         int i;
 
+        free_percpu(kvm->arch.last_vcpu_ran);
+        kvm->arch.last_vcpu_ran = NULL;
+
         for (i = 0; i < KVM_MAX_VCPUS; ++i) {
                 if (kvm->vcpus[i]) {
                         kvm_arch_vcpu_free(kvm->vcpus[i]);
@@ -312,6 +324,19 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
 
 void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
+        int *last_ran;
+
+        last_ran = this_cpu_ptr(vcpu->kvm->arch.last_vcpu_ran);
+
+        /*
+         * We might get preempted before the vCPU actually runs, but
+         * over-invalidation doesn't affect correctness.
+         */
+        if (*last_ran != vcpu->vcpu_id) {
+                kvm_call_hyp(__kvm_tlb_flush_local_vmid, vcpu);
+                *last_ran = vcpu->vcpu_id;
+        }
+
         vcpu->cpu = cpu;
         vcpu->arch.host_cpu_context = this_cpu_ptr(kvm_host_cpu_state);
 
diff --git a/arch/arm/kvm/hyp/tlb.c b/arch/arm/kvm/hyp/tlb.c
index 729652854f90..6d810af2d9fd 100644
--- a/arch/arm/kvm/hyp/tlb.c
+++ b/arch/arm/kvm/hyp/tlb.c
@@ -55,6 +55,21 @@ void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
         __kvm_tlb_flush_vmid(kvm);
 }
 
+void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
+{
+        struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
+
+        /* Switch to requested VMID */
+        write_sysreg(kvm->arch.vttbr, VTTBR);
+        isb();
+
+        write_sysreg(0, TLBIALL);
+        dsb(nsh);
+        isb();
+
+        write_sysreg(0, VTTBR);
+}
+
 void __hyp_text __kvm_flush_vm_context(void)
 {
         write_sysreg(0, TLBIALLNSNHIS);
diff --git a/arch/arm/mm/abort-lv4t.S b/arch/arm/mm/abort-lv4t.S
index 6d8e8e3365d1..4cdfab31a0b6 100644
--- a/arch/arm/mm/abort-lv4t.S
+++ b/arch/arm/mm/abort-lv4t.S
@@ -7,7 +7,7 @@
  *         : r4 = aborted context pc
  *         : r5 = aborted context psr
  *
- * Returns : r4-r5, r10-r11, r13 preserved
+ * Returns : r4-r5, r9-r11, r13 preserved
  *
  * Purpose : obtain information about current aborted instruction.
  * Note: we read user space.  This means we might cause a data
@@ -48,7 +48,10 @@ ENTRY(v4t_late_abort)
 /* c */ b       do_DataAbort                    @ ldc   rd, [rn], #m    @ Same as ldr   rd, [rn], #m
 /* d */ b       do_DataAbort                    @ ldc   rd, [rn, #m]
 /* e */ b       .data_unknown
-/* f */
+/* f */ b       .data_unknown
+
+.data_unknown_r9:
+        ldr     r9, [sp], #4
 .data_unknown:  @ Part of jumptable
         mov     r0, r4
         mov     r1, r8
@@ -57,6 +60,7 @@ ENTRY(v4t_late_abort)
 .data_arm_ldmstm:
         tst     r8, #1 << 21                    @ check writeback bit
         beq     do_DataAbort                    @ no writeback -> no fixup
+        str     r9, [sp, #-4]!
         mov     r7, #0x11
         orr     r7, r7, #0x1100
         and     r6, r8, r7
@@ -75,12 +79,14 @@ ENTRY(v4t_late_abort)
         subne   r7, r7, r6, lsl #2              @ Undo increment
         addeq   r7, r7, r6, lsl #2              @ Undo decrement
         str     r7, [r2, r9, lsr #14]           @ Put register 'Rn'
+        ldr     r9, [sp], #4
         b       do_DataAbort
 
 .data_arm_lateldrhpre:
         tst     r8, #1 << 21                    @ Check writeback bit
         beq     do_DataAbort                    @ No writeback -> no fixup
 .data_arm_lateldrhpost:
+        str     r9, [sp, #-4]!
         and     r9, r8, #0x00f                  @ get Rm / low nibble of immediate value
         tst     r8, #1 << 22                    @ if (immediate offset)
         andne   r6, r8, #0xf00                  @ { immediate high nibble
@@ -93,6 +99,7 @@ ENTRY(v4t_late_abort)
         subne   r7, r7, r6                      @ Undo incrmenet
         addeq   r7, r7, r6                      @ Undo decrement
         str     r7, [r2, r9, lsr #14]           @ Put register 'Rn'
+        ldr     r9, [sp], #4
         b       do_DataAbort
 
 .data_arm_lateldrpreconst:
@@ -101,12 +108,14 @@ ENTRY(v4t_late_abort)
 .data_arm_lateldrpostconst:
         movs    r6, r8, lsl #20                 @ Get offset
         beq     do_DataAbort                    @ zero -> no fixup
+        str     r9, [sp, #-4]!
         and     r9, r8, #15 << 16               @ Extract 'n' from instruction
         ldr     r7, [r2, r9, lsr #14]           @ Get register 'Rn'
         tst     r8, #1 << 23                    @ Check U bit
         subne   r7, r7, r6, lsr #20             @ Undo increment
         addeq   r7, r7, r6, lsr #20             @ Undo decrement
         str     r7, [r2, r9, lsr #14]           @ Put register 'Rn'
+        ldr     r9, [sp], #4
         b       do_DataAbort
 
 .data_arm_lateldrprereg:
@@ -115,6 +124,7 @@ ENTRY(v4t_late_abort)
 .data_arm_lateldrpostreg:
         and     r7, r8, #15                     @ Extract 'm' from instruction
         ldr     r6, [r2, r7, lsl #2]            @ Get register 'Rm'
+        str     r9, [sp, #-4]!
         mov     r9, r8, lsr #7                  @ get shift count
         ands    r9, r9, #31
         and     r7, r8, #0x70                   @ get shift type
@@ -126,33 +136,33 @@ ENTRY(v4t_late_abort)
         b       .data_arm_apply_r6_and_rn
         b       .data_arm_apply_r6_and_rn       @ 1: LSL #0
         nop
-        b       .data_unknown                   @ 2: MUL?
+        b       .data_unknown_r9                @ 2: MUL?
         nop
-        b       .data_unknown                   @ 3: MUL?
+        b       .data_unknown_r9                @ 3: MUL?
         nop
         mov     r6, r6, lsr r9                  @ 4: LSR #!0
         b       .data_arm_apply_r6_and_rn
         mov     r6, r6, lsr #32                 @ 5: LSR #32
         b       .data_arm_apply_r6_and_rn
-        b       .data_unknown                   @ 6: MUL?
+        b       .data_unknown_r9                @ 6: MUL?
         nop
-        b       .data_unknown                   @ 7: MUL?
+        b       .data_unknown_r9                @ 7: MUL?
         nop
         mov     r6, r6, asr r9                  @ 8: ASR #!0
         b       .data_arm_apply_r6_and_rn
         mov     r6, r6, asr #32                 @ 9: ASR #32
         b       .data_arm_apply_r6_and_rn
-        b       .data_unknown                   @ A: MUL?
+        b       .data_unknown_r9                @ A: MUL?
         nop
-        b       .data_unknown                   @ B: MUL?
+        b       .data_unknown_r9                @ B: MUL?
         nop
         mov     r6, r6, ror r9                  @ C: ROR #!0
         b       .data_arm_apply_r6_and_rn
         mov     r6, r6, rrx                     @ D: RRX
         b       .data_arm_apply_r6_and_rn
-        b       .data_unknown                   @ E: MUL?
+        b       .data_unknown_r9                @ E: MUL?
         nop
-        b       .data_unknown                   @ F: MUL?
+        b       .data_unknown_r9                @ F: MUL?
 
 .data_thumb_abort:
         ldrh    r8, [r4]                        @ read instruction
@@ -190,6 +200,7 @@ ENTRY(v4t_late_abort)
 .data_thumb_pushpop:
         tst     r8, #1 << 10
         beq     .data_unknown
+        str     r9, [sp, #-4]!
         and     r6, r8, #0x55                   @ hweight8(r8) + R bit
         and     r9, r8, #0xaa
         add     r6, r6, r9, lsr #1
@@ -204,9 +215,11 @@ ENTRY(v4t_late_abort)
         addeq   r7, r7, r6, lsl #2              @ increment SP if PUSH
         subne   r7, r7, r6, lsl #2              @ decrement SP if POP
         str     r7, [r2, #13 << 2]
+        ldr     r9, [sp], #4
         b       do_DataAbort
 
 .data_thumb_ldmstm:
+        str     r9, [sp, #-4]!
         and     r6, r8, #0x55                   @ hweight8(r8)
         and     r9, r8, #0xaa
         add     r6, r6, r9, lsr #1
@@ -219,4 +232,5 @@ ENTRY(v4t_late_abort)
         and     r6, r6, #15                     @ number of regs to transfer
         sub     r7, r7, r6, lsl #2              @ always decrement
         str     r7, [r2, r9, lsr #6]
+        ldr     r9, [sp], #4
         b       do_DataAbort
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index b65c193dc64e..7afbfb0f96a3 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -300,8 +300,11 @@
                 ranges = <0x83000000 0x0 0xfa000000 0x0 0xfa000000 0x0 0x600000
                           0x81000000 0x0 0xfa600000 0x0 0xfa600000 0x0 0x100000>;
                 resets = <&cru SRST_PCIE_CORE>, <&cru SRST_PCIE_MGMT>,
-                         <&cru SRST_PCIE_MGMT_STICKY>, <&cru SRST_PCIE_PIPE>;
-                reset-names = "core", "mgmt", "mgmt-sticky", "pipe";
+                         <&cru SRST_PCIE_MGMT_STICKY>, <&cru SRST_PCIE_PIPE>,
+                         <&cru SRST_PCIE_PM>, <&cru SRST_P_PCIE>,
+                         <&cru SRST_A_PCIE>;
+                reset-names = "core", "mgmt", "mgmt-sticky", "pipe",
+                              "pm", "pclk", "aclk";
                 status = "disabled";
 
                 pcie0_intc: interrupt-controller {
diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
index 39feb85a6931..6e1cb8c5af4d 100644
--- a/arch/arm64/include/asm/alternative.h
+++ b/arch/arm64/include/asm/alternative.h
@@ -1,7 +1,7 @@
 #ifndef __ASM_ALTERNATIVE_H
 #define __ASM_ALTERNATIVE_H
 
-#include <asm/cpufeature.h>
+#include <asm/cpucaps.h>
 #include <asm/insn.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
new file mode 100644
index 000000000000..87b446535185
--- /dev/null
+++ b/arch/arm64/include/asm/cpucaps.h
@@ -0,0 +1,40 @@
+/*
+ * arch/arm64/include/asm/cpucaps.h
+ *
+ * Copyright (C) 2016 ARM Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_CPUCAPS_H
+#define __ASM_CPUCAPS_H
+
+#define ARM64_WORKAROUND_CLEAN_CACHE            0
+#define ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE    1
+#define ARM64_WORKAROUND_845719                 2
+#define ARM64_HAS_SYSREG_GIC_CPUIF              3
+#define ARM64_HAS_PAN                           4
+#define ARM64_HAS_LSE_ATOMICS                   5
+#define ARM64_WORKAROUND_CAVIUM_23154           6
+#define ARM64_WORKAROUND_834220                 7
+#define ARM64_HAS_NO_HW_PREFETCH                8
+#define ARM64_HAS_UAO                           9
+#define ARM64_ALT_PAN_NOT_UAO                   10
+#define ARM64_HAS_VIRT_HOST_EXTN                11
+#define ARM64_WORKAROUND_CAVIUM_27456           12
+#define ARM64_HAS_32BIT_EL0                     13
+#define ARM64_HYP_OFFSET_LOW                    14
+#define ARM64_MISMATCHED_CACHE_LINE_SIZE        15
+
+#define ARM64_NCAPS                             16
+
+#endif /* __ASM_CPUCAPS_H */
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index a27c3245ba21..0bc0b1de90c4 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -11,6 +11,7 @@
 
 #include <linux/jump_label.h>
 
+#include <asm/cpucaps.h>
 #include <asm/hwcap.h>
 #include <asm/sysreg.h>
 
@@ -24,25 +25,6 @@
 #define MAX_CPU_FEATURES        (8 * sizeof(elf_hwcap))
 #define cpu_feature(x)          ilog2(HWCAP_ ## x)
 
-#define ARM64_WORKAROUND_CLEAN_CACHE            0
-#define ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE    1
-#define ARM64_WORKAROUND_845719                 2
-#define ARM64_HAS_SYSREG_GIC_CPUIF              3
-#define ARM64_HAS_PAN                           4
-#define ARM64_HAS_LSE_ATOMICS                   5
-#define ARM64_WORKAROUND_CAVIUM_23154           6
-#define ARM64_WORKAROUND_834220                 7
-#define ARM64_HAS_NO_HW_PREFETCH                8
-#define ARM64_HAS_UAO                           9
-#define ARM64_ALT_PAN_NOT_UAO                   10
-#define ARM64_HAS_VIRT_HOST_EXTN                11
-#define ARM64_WORKAROUND_CAVIUM_27456           12
-#define ARM64_HAS_32BIT_EL0                     13
-#define ARM64_HYP_OFFSET_LOW                    14
-#define ARM64_MISMATCHED_CACHE_LINE_SIZE        15
-
-#define ARM64_NCAPS                             16
-
 #ifndef __ASSEMBLY__
 
 #include <linux/kernel.h>
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index 18f746551bf6..ec3553eb9349 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -54,6 +54,7 @@ extern char __kvm_hyp_vector[];
 extern void __kvm_flush_vm_context(void);
 extern void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
 extern void __kvm_tlb_flush_vmid(struct kvm *kvm);
+extern void __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu);
 
 extern int __kvm_vcpu_run(struct kvm_vcpu *vcpu);
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index bd94e6766759..e5050388e062 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -62,6 +62,9 @@ struct kvm_arch {
         /* VTTBR value associated with above pgd and vmid */
         u64    vttbr;
 
+        /* The last vcpu id that ran on each physical CPU */
+        int __percpu *last_vcpu_ran;
+
         /* The maximum number of vCPUs depends on the used GIC model */
         int max_vcpus;
 
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index a79b969c26fc..6f72fe8b0e3e 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -128,7 +128,7 @@ static inline unsigned long __kern_hyp_va(unsigned long v)
         return v;
 }
 
-#define kern_hyp_va(v)  (typeof(v))(__kern_hyp_va((unsigned long)(v)))
+#define kern_hyp_va(v)  ((typeof(v))(__kern_hyp_va((unsigned long)(v))))
 
 /*
  * We currently only support a 40bit IPA.
diff --git a/arch/arm64/include/asm/lse.h b/arch/arm64/include/asm/lse.h
index 23acc00be32d..fc756e22c84c 100644
--- a/arch/arm64/include/asm/lse.h
+++ b/arch/arm64/include/asm/lse.h
@@ -5,7 +5,6 @@
 
 #include <linux/stringify.h>
 #include <asm/alternative.h>
-#include <asm/cpufeature.h>
 
 #ifdef __ASSEMBLER__
 
diff --git a/arch/arm64/kvm/hyp/tlb.c b/arch/arm64/kvm/hyp/tlb.c
index 9cc0ea784ae6..88e2f2b938f0 100644
--- a/arch/arm64/kvm/hyp/tlb.c
+++ b/arch/arm64/kvm/hyp/tlb.c
@@ -64,6 +64,21 @@ void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
         write_sysreg(0, vttbr_el2);
 }
 
+void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
+{
+        struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
+
+        /* Switch to requested VMID */
+        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        isb();
+
+        asm volatile("tlbi vmalle1" : : );
+        dsb(nsh);
+        isb();
+
+        write_sysreg(0, vttbr_el2);
+}
+
 void __hyp_text __kvm_flush_vm_context(void)
 {
         dsb(ishst);
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index fbf40d3c8123..1a6bac7b076f 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -263,7 +263,7 @@ KBUILD_CPPFLAGS += -DDATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)
 
 bootvars-y      = VMLINUX_LOAD_ADDRESS=$(load-y) \
                   VMLINUX_ENTRY_ADDRESS=$(entry-y) \
-                  PLATFORM=$(platform-y)
+                  PLATFORM="$(platform-y)"
 ifdef CONFIG_32BIT
 bootvars-y      += ADDR_BITS=32
 endif
diff --git a/arch/mips/boot/dts/mti/malta.dts b/arch/mips/boot/dts/mti/malta.dts
index f604a272d91d..ffe3a1508e72 100644
--- a/arch/mips/boot/dts/mti/malta.dts
+++ b/arch/mips/boot/dts/mti/malta.dts
@@ -84,12 +84,13 @@
         fpga_regs: system-controller@1f000000 {
                 compatible = "mti,malta-fpga", "syscon", "simple-mfd";
                 reg = <0x1f000000 0x1000>;
+                native-endian;
 
                 reboot {
                         compatible = "syscon-reboot";
                         regmap = <&fpga_regs>;
                         offset = <0x500>;
-                        mask = <0x4d>;
+                        mask = <0x42>;
                 };
         };
 
diff --git a/arch/mips/generic/init.c b/arch/mips/generic/init.c
index 0ea73e845440..d493ccbf274a 100644
--- a/arch/mips/generic/init.c
+++ b/arch/mips/generic/init.c
@@ -30,9 +30,19 @@ static __initdata const void *mach_match_data;
 
 void __init prom_init(void)
 {
+        plat_get_fdt();
+        BUG_ON(!fdt);
+}
+
+void __init *plat_get_fdt(void)
+{
         const struct mips_machine *check_mach;
         const struct of_device_id *match;
 
+        if (fdt)
+                /* Already set up */
+                return (void *)fdt;
+
         if ((fw_arg0 == -2) && !fdt_check_header((void *)fw_arg1)) {
                 /*
                  * We booted using the UHI boot protocol, so we have been
@@ -75,12 +85,6 @@ void __init prom_init(void)
                 /* Retrieve the machine's FDT */
                 fdt = mach->fdt;
         }
-
-        BUG_ON(!fdt);
-}
-
-void __init *plat_get_fdt(void)
-{
         return (void *)fdt;
 }
 
diff --git a/arch/mips/include/asm/fpu_emulator.h b/arch/mips/include/asm/fpu_emulator.h
index 355dc25172e7..c05369e0b8d6 100644
--- a/arch/mips/include/asm/fpu_emulator.h
+++ b/arch/mips/include/asm/fpu_emulator.h
@@ -63,6 +63,8 @@ do {									\
 extern int fpu_emulator_cop1Handler(struct pt_regs *xcp,
                                     struct mips_fpu_struct *ctx, int has_fpu,
                                     void *__user *fault_addr);
+void force_fcr31_sig(unsigned long fcr31, void __user *fault_addr,
+                     struct task_struct *tsk);
 int process_fpemu_return(int sig, void __user *fault_addr,
                          unsigned long fcr31);
 int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
@@ -81,4 +83,15 @@ static inline void fpu_emulator_init_fpu(void)
                 set_fpr64(&t->thread.fpu.fpr[i], 0, SIGNALLING_NAN);
 }
 
+/*
+ * Mask the FCSR Cause bits according to the Enable bits, observing
+ * that Unimplemented is always enabled.
+ */
+static inline unsigned long mask_fcr31_x(unsigned long fcr31)
+{
+        return fcr31 & (FPU_CSR_UNI_X |
+                        ((fcr31 & FPU_CSR_ALL_E) <<
+                         (ffs(FPU_CSR_ALL_X) - ffs(FPU_CSR_ALL_E))));
+}
+
 #endif /* _ASM_FPU_EMULATOR_H */
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index 07f58cfc1ab9..bebec370324f 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -293,7 +293,10 @@ struct kvm_vcpu_arch {
         /* Host KSEG0 address of the EI/DI offset */
         void *kseg0_commpage;
 
-        u32 io_gpr;             /* GPR used as IO source/target */
+        /* Resume PC after MMIO completion */
+        unsigned long io_pc;
+        /* GPR used as IO source/target */
+        u32 io_gpr;
 
         struct hrtimer comparecount_timer;
         /* Count timer control KVM register */
@@ -315,8 +318,6 @@ struct kvm_vcpu_arch {
         /* Bitmask of pending exceptions to be cleared */
         unsigned long pending_exceptions_clr;
 
-        u32 pending_load_cause;
-
         /* Save/Restore the entryhi register when are are preempted/scheduled back in */
         unsigned long preempt_entryhi;
 
diff --git a/arch/mips/include/asm/switch_to.h b/arch/mips/include/asm/switch_to.h
index ebb5c0f2f90d..c0ae27971e31 100644
--- a/arch/mips/include/asm/switch_to.h
+++ b/arch/mips/include/asm/switch_to.h
@@ -76,6 +76,22 @@ do {	if (cpu_has_rw_llb) {						\
 } while (0)
 
 /*
+ * Check FCSR for any unmasked exceptions pending set with `ptrace',
+ * clear them and send a signal.
+ */
+#define __sanitize_fcr31(next)                                          \
+do {                                                                    \
+        unsigned long fcr31 = mask_fcr31_x(next->thread.fpu.fcr31);     \
+        void __user *pc;                                                \
+                                                                        \
+        if (unlikely(fcr31)) {                                          \
+                pc = (void __user *)task_pt_regs(next)->cp0_epc;        \
+                next->thread.fpu.fcr31 &= ~fcr31;                       \
+                force_fcr31_sig(fcr31, pc, next);                       \
+        }                                                               \
+} while (0)
+
+/*
  * For newly created kernel threads switch_to() will return to
  * ret_from_kernel_thread, newly created user threads to ret_from_fork.
  * That is, everything following resume() will be skipped for new threads.
@@ -85,6 +101,8 @@ do {	if (cpu_has_rw_llb) {						\
 do {                                                                    \
         __mips_mt_fpaff_switch_to(prev);                                \
         lose_fpu_inatomic(1, prev);                                     \
+        if (tsk_used_math(next))                                        \
+                __sanitize_fcr31(next);                                 \
         if (cpu_has_dsp) {                                              \
                 __save_dsp(prev);                                       \
                 __restore_dsp(next);                                    \
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index 2a45867d3b4f..a4964c334cab 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -21,6 +21,11 @@ static DEFINE_PER_CPU_ALIGNED(spinlock_t, cpc_core_lock);
 
 static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags);
 
+phys_addr_t __weak mips_cpc_default_phys_base(void)
+{
+        return 0;
+}
+
 /**
  * mips_cpc_phys_base - retrieve the physical base address of the CPC
  *
@@ -43,8 +48,12 @@ static phys_addr_t mips_cpc_phys_base(void)
         if (cpc_base & CM_GCR_CPC_BASE_CPCEN_MSK)
                 return cpc_base & CM_GCR_CPC_BASE_CPCBASE_MSK;
 
-        /* Otherwise, give it the default address & enable it */
+        /* Otherwise, use the default address */
         cpc_base = mips_cpc_default_phys_base();
+        if (!cpc_base)
+                return cpc_base;
+
+        /* Enable the CPC, mapped at the default address */
         write_gcr_cpc_base(cpc_base | CM_GCR_CPC_BASE_CPCEN_MSK);
         return cpc_base;
 }
diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c
index 22dedd62818a..bd09853aecdf 100644
--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
+++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
@@ -899,7 +899,7 @@ static inline int mipsr2_find_op_func(struct pt_regs *regs, u32 inst,
  * mipsr2_decoder: Decode and emulate a MIPS R2 instruction
  * @regs: Process register set
  * @inst: Instruction to decode and emulate
- * @fcr31: Floating Point Control and Status Register returned
+ * @fcr31: Floating Point Control and Status Register Cause bits returned
  */
 int mipsr2_decoder(struct pt_regs *regs, u32 inst, unsigned long *fcr31)
 {
@@ -1172,13 +1172,13 @@ fpu_emul:
 
                 err = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 0,
                                                &fault_addr);
-                *fcr31 = current->thread.fpu.fcr31;
 
                 /*
-                 * We can't allow the emulated instruction to leave any of
-                 * the cause bits set in $fcr31.
+                 * We can't allow the emulated instruction to leave any
+                 * enabled Cause bits set in $fcr31.
                  */
-                current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+                *fcr31 = res = mask_fcr31_x(current->thread.fpu.fcr31);
+                current->thread.fpu.fcr31 &= ~res;
 
                 /*
                  * this is a tricky issue - lose_fpu() uses LL/SC atomics
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 6103b24d1bfc..a92994d60e91 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -79,16 +79,15 @@ void ptrace_disable(struct task_struct *child)
 }
 
 /*
- * Poke at FCSR according to its mask.  Don't set the cause bits as
- * this is currently not handled correctly in FP context restoration
- * and will cause an oops if a corresponding enable bit is set.
+ * Poke at FCSR according to its mask.  Set the Cause bits even
+ * if a corresponding Enable bit is set.  This will be noticed at
+ * the time the thread is switched to and SIGFPE thrown accordingly.
  */
 static void ptrace_setfcr31(struct task_struct *child, u32 value)
 {
         u32 fcr31;
         u32 mask;
 
-        value &= ~FPU_CSR_ALL_X;
         fcr31 = child->thread.fpu.fcr31;
         mask = boot_cpu_data.fpu_msk31;
         child->thread.fpu.fcr31 = (value & ~mask) | (fcr31 & mask);
@@ -817,6 +816,7 @@ long arch_ptrace(struct task_struct *child, long request,
                         break;
 #endif
                 case FPC_CSR:
+                        init_fp_ctx(child);
                         ptrace_setfcr31(child, data);
                         break;
                 case DSP_BASE ... DSP_BASE + 5: {
diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S
index b4ac6374a38f..918f2f6d3861 100644
--- a/arch/mips/kernel/r2300_fpu.S
+++ b/arch/mips/kernel/r2300_fpu.S
@@ -21,106 +21,84 @@
 #define EX(a,b)                                                 \
 9:      a,##b;                                                  \
         .section __ex_table,"a";                                \
+        PTR     9b,fault;                                       \
+        .previous
+
+#define EX2(a,b)                                                \
+9:      a,##b;                                                  \
+        .section __ex_table,"a";                                \
         PTR     9b,bad_stack;                                   \
+        PTR     9b+4,bad_stack;                                 \
         .previous
 
         .set    noreorder
         .set    mips1
-        /* Save floating point context */
+
+/**
+ * _save_fp_context() - save FP context from the FPU
+ * @a0 - pointer to fpregs field of sigcontext
+ * @a1 - pointer to fpc_csr field of sigcontext
+ *
+ * Save FP context, including the 32 FP data registers and the FP
+ * control & status register, from the FPU to signal context.
+ */
 LEAF(_save_fp_context)
         .set    push
         SET_HARDFLOAT
         li      v0, 0                                   # assume success
-        cfc1    t1,fcr31
-        EX(swc1 $f0,(SC_FPREGS+0)(a0))
-        EX(swc1 $f1,(SC_FPREGS+8)(a0))
-        EX(swc1 $f2,(SC_FPREGS+16)(a0))
-        EX(swc1 $f3,(SC_FPREGS+24)(a0))
-        EX(swc1 $f4,(SC_FPREGS+32)(a0))
-        EX(swc1 $f5,(SC_FPREGS+40)(a0))
-        EX(swc1 $f6,(SC_FPREGS+48)(a0))
-        EX(swc1 $f7,(SC_FPREGS+56)(a0))
-        EX(swc1 $f8,(SC_FPREGS+64)(a0))
-        EX(swc1 $f9,(SC_FPREGS+72)(a0))
-        EX(swc1 $f10,(SC_FPREGS+80)(a0))
-        EX(swc1 $f11,(SC_FPREGS+88)(a0))
-        EX(swc1 $f12,(SC_FPREGS+96)(a0))
-        EX(swc1 $f13,(SC_FPREGS+104)(a0))
-        EX(swc1 $f14,(SC_FPREGS+112)(a0))
-        EX(swc1 $f15,(SC_FPREGS+120)(a0))
-        EX(swc1 $f16,(SC_FPREGS+128)(a0))
-        EX(swc1 $f17,(SC_FPREGS+136)(a0))
-        EX(swc1 $f18,(SC_FPREGS+144)(a0))
-        EX(swc1 $f19,(SC_FPREGS+152)(a0))
-        EX(swc1 $f20,(SC_FPREGS+160)(a0))
-        EX(swc1 $f21,(SC_FPREGS+168)(a0))
-        EX(swc1 $f22,(SC_FPREGS+176)(a0))
-        EX(swc1 $f23,(SC_FPREGS+184)(a0))
-        EX(swc1 $f24,(SC_FPREGS+192)(a0))
-        EX(swc1 $f25,(SC_FPREGS+200)(a0))
-        EX(swc1 $f26,(SC_FPREGS+208)(a0))
-        EX(swc1 $f27,(SC_FPREGS+216)(a0))
-        EX(swc1 $f28,(SC_FPREGS+224)(a0))
-        EX(swc1 $f29,(SC_FPREGS+232)(a0))
-        EX(swc1 $f30,(SC_FPREGS+240)(a0))
-        EX(swc1 $f31,(SC_FPREGS+248)(a0))
-        EX(sw   t1,(SC_FPC_CSR)(a0))
-        cfc1    t0,$0                           # implementation/version
+        cfc1    t1, fcr31
+        EX2(s.d $f0, 0(a0))
+        EX2(s.d $f2, 16(a0))
+        EX2(s.d $f4, 32(a0))
+        EX2(s.d $f6, 48(a0))
+        EX2(s.d $f8, 64(a0))
+        EX2(s.d $f10, 80(a0))
+        EX2(s.d $f12, 96(a0))
+        EX2(s.d $f14, 112(a0))
+        EX2(s.d $f16, 128(a0))
+        EX2(s.d $f18, 144(a0))
+        EX2(s.d $f20, 160(a0))
+        EX2(s.d $f22, 176(a0))
+        EX2(s.d $f24, 192(a0))
+        EX2(s.d $f26, 208(a0))
+        EX2(s.d $f28, 224(a0))
+        EX2(s.d $f30, 240(a0))
         jr      ra
+         EX(sw  t1, (a1))
         .set    pop
-        .set    nomacro
-         EX(sw  t0,(SC_FPC_EIR)(a0))
-        .set    macro
         END(_save_fp_context)
 
-/*
- * Restore FPU state:
- *  - fp gp registers
- *  - cp1 status/control register
+/**
+ * _restore_fp_context() - restore FP context to the FPU
+ * @a0 - pointer to fpregs field of sigcontext
+ * @a1 - pointer to fpc_csr field of sigcontext
  *
- * We base the decision which registers to restore from the signal stack
- * frame on the current content of c0_status, not on the content of the
- * stack frame which might have been changed by the user.
+ * Restore FP context, including the 32 FP data registers and the FP
+ * control & status register, from signal context to the FPU.
  */
 LEAF(_restore_fp_context)
         .set    push
         SET_HARDFLOAT
         li      v0, 0                                   # assume success
-        EX(lw t0,(SC_FPC_CSR)(a0))
-        EX(lwc1 $f0,(SC_FPREGS+0)(a0))
-        EX(lwc1 $f1,(SC_FPREGS+8)(a0))
-        EX(lwc1 $f2,(SC_FPREGS+16)(a0))
-        EX(lwc1 $f3,(SC_FPREGS+24)(a0))
-        EX(lwc1 $f4,(SC_FPREGS+32)(a0))
-        EX(lwc1 $f5,(SC_FPREGS+40)(a0))
-        EX(lwc1 $f6,(SC_FPREGS+48)(a0))
-        EX(lwc1 $f7,(SC_FPREGS+56)(a0))
-        EX(lwc1 $f8,(SC_FPREGS+64)(a0))
-        EX(lwc1 $f9,(SC_FPREGS+72)(a0))
-        EX(lwc1 $f10,(SC_FPREGS+80)(a0))
-        EX(lwc1 $f11,(SC_FPREGS+88)(a0))
-        EX(lwc1 $f12,(SC_FPREGS+96)(a0))
-        EX(lwc1 $f13,(SC_FPREGS+104)(a0))
-        EX(lwc1 $f14,(SC_FPREGS+112)(a0))
-        EX(lwc1 $f15,(SC_FPREGS+120)(a0))
-        EX(lwc1 $f16,(SC_FPREGS+128)(a0))
-        EX(lwc1 $f17,(SC_FPREGS+136)(a0))
-        EX(lwc1 $f18,(SC_FPREGS+144)(a0))
-        EX(lwc1 $f19,(SC_FPREGS+152)(a0))
-        EX(lwc1 $f20,(SC_FPREGS+160)(a0))
-        EX(lwc1 $f21,(SC_FPREGS+168)(a0))
-        EX(lwc1 $f22,(SC_FPREGS+176)(a0))
-        EX(lwc1 $f23,(SC_FPREGS+184)(a0))
-        EX(lwc1 $f24,(SC_FPREGS+192)(a0))
-        EX(lwc1 $f25,(SC_FPREGS+200)(a0))
-        EX(lwc1 $f26,(SC_FPREGS+208)(a0))
-        EX(lwc1 $f27,(SC_FPREGS+216)(a0))
-        EX(lwc1 $f28,(SC_FPREGS+224)(a0))
-        EX(lwc1 $f29,(SC_FPREGS+232)(a0))
-        EX(lwc1 $f30,(SC_FPREGS+240)(a0))
-        EX(lwc1 $f31,(SC_FPREGS+248)(a0))
+        EX(lw t0, (a1))
+        EX2(l.d $f0, 0(a0))
+        EX2(l.d $f2, 16(a0))
+        EX2(l.d $f4, 32(a0))
+        EX2(l.d $f6, 48(a0))
+        EX2(l.d $f8, 64(a0))
+        EX2(l.d $f10, 80(a0))
+        EX2(l.d $f12, 96(a0))
+        EX2(l.d $f14, 112(a0))
+        EX2(l.d $f16, 128(a0))
+        EX2(l.d $f18, 144(a0))
+        EX2(l.d $f20, 160(a0))
+        EX2(l.d $f22, 176(a0))
+        EX2(l.d $f24, 192(a0))
+        EX2(l.d $f26, 208(a0))
+        EX2(l.d $f28, 224(a0))
+        EX2(l.d $f30, 240(a0))
         jr      ra
-         ctc1   t0,fcr31
+         ctc1   t0, fcr31
         .set    pop
         END(_restore_fp_context)
         .set    reorder
diff --git a/arch/mips/kernel/r6000_fpu.S b/arch/mips/kernel/r6000_fpu.S
index 47077380c15c..9cc7bfab3419 100644
--- a/arch/mips/kernel/r6000_fpu.S
+++ b/arch/mips/kernel/r6000_fpu.S
@@ -21,7 +21,14 @@
         .set    push
         SET_HARDFLOAT
 
-        /* Save floating point context */
+/**
+ * _save_fp_context() - save FP context from the FPU
+ * @a0 - pointer to fpregs field of sigcontext
+ * @a1 - pointer to fpc_csr field of sigcontext
+ *
+ * Save FP context, including the 32 FP data registers and the FP
+ * control & status register, from the FPU to signal context.
+ */
         LEAF(_save_fp_context)
         mfc0    t0,CP0_STATUS
         sll     t0,t0,2
@@ -30,59 +37,59 @@
 
         cfc1    t1,fcr31
         /* Store the 16 double precision registers */
-        sdc1    $f0,(SC_FPREGS+0)(a0)
-        sdc1    $f2,(SC_FPREGS+16)(a0)
-        sdc1    $f4,(SC_FPREGS+32)(a0)
-        sdc1    $f6,(SC_FPREGS+48)(a0)
-        sdc1    $f8,(SC_FPREGS+64)(a0)
-        sdc1    $f10,(SC_FPREGS+80)(a0)
-        sdc1    $f12,(SC_FPREGS+96)(a0)
-        sdc1    $f14,(SC_FPREGS+112)(a0)
-        sdc1    $f16,(SC_FPREGS+128)(a0)
-        sdc1    $f18,(SC_FPREGS+144)(a0)
-        sdc1    $f20,(SC_FPREGS+160)(a0)
-        sdc1    $f22,(SC_FPREGS+176)(a0)
-        sdc1    $f24,(SC_FPREGS+192)(a0)
-        sdc1    $f26,(SC_FPREGS+208)(a0)
-        sdc1    $f28,(SC_FPREGS+224)(a0)
-        sdc1    $f30,(SC_FPREGS+240)(a0)
+        sdc1    $f0,0(a0)
+        sdc1    $f2,16(a0)
+        sdc1    $f4,32(a0)
+        sdc1    $f6,48(a0)
+        sdc1    $f8,64(a0)
+        sdc1    $f10,80(a0)
+        sdc1    $f12,96(a0)
+        sdc1    $f14,112(a0)
+        sdc1    $f16,128(a0)
+        sdc1    $f18,144(a0)
+        sdc1    $f20,160(a0)
+        sdc1    $f22,176(a0)
+        sdc1    $f24,192(a0)
+        sdc1    $f26,208(a0)
+        sdc1    $f28,224(a0)
+        sdc1    $f30,240(a0)
         jr      ra
-         sw     t0,SC_FPC_CSR(a0)
+         sw     t0,(a1)
 1:      jr      ra
          nop
         END(_save_fp_context)
 
-/* Restore FPU state:
- *  - fp gp registers
- *  - cp1 status/control register
+/**
+ * _restore_fp_context() - restore FP context to the FPU
+ * @a0 - pointer to fpregs field of sigcontext
+ * @a1 - pointer to fpc_csr field of sigcontext
  *
- * We base the decision which registers to restore from the signal stack
- * frame on the current content of c0_status, not on the content of the
- * stack frame which might have been changed by the user.
+ * Restore FP context, including the 32 FP data registers and the FP
+ * control & status register, from signal context to the FPU.
  */
         LEAF(_restore_fp_context)
         mfc0    t0,CP0_STATUS
         sll     t0,t0,2
 
         bgez    t0,1f
-         lw     t0,SC_FPC_CSR(a0)
+         lw     t0,(a1)
         /* Restore the 16 double precision registers */
-        ldc1    $f0,(SC_FPREGS+0)(a0)
-        ldc1    $f2,(SC_FPREGS+16)(a0)
-        ldc1    $f4,(SC_FPREGS+32)(a0)
-        ldc1    $f6,(SC_FPREGS+48)(a0)
-        ldc1    $f8,(SC_FPREGS+64)(a0)
-        ldc1    $f10,(SC_FPREGS+80)(a0)
-        ldc1    $f12,(SC_FPREGS+96)(a0)
-        ldc1    $f14,(SC_FPREGS+112)(a0)
-        ldc1    $f16,(SC_FPREGS+128)(a0)
-        ldc1    $f18,(SC_FPREGS+144)(a0)
-        ldc1    $f20,(SC_FPREGS+160)(a0)
-        ldc1    $f22,(SC_FPREGS+176)(a0)
-        ldc1    $f24,(SC_FPREGS+192)(a0)
-        ldc1    $f26,(SC_FPREGS+208)(a0)
-        ldc1    $f28,(SC_FPREGS+224)(a0)
-        ldc1    $f30,(SC_FPREGS+240)(a0)
+        ldc1    $f0,0(a0)
+        ldc1    $f2,16(a0)
+        ldc1    $f4,32(a0)
+        ldc1    $f6,48(a0)
+        ldc1    $f8,64(a0)
+        ldc1    $f10,80(a0)
+        ldc1    $f12,96(a0)
+        ldc1    $f14,112(a0)
+        ldc1    $f16,128(a0)
+        ldc1    $f18,144(a0)
+        ldc1    $f20,160(a0)
+        ldc1    $f22,176(a0)
+        ldc1    $f24,192(a0)
+        ldc1    $f26,208(a0)
+        ldc1    $f28,224(a0)
+        ldc1    $f30,240(a0)
         jr      ra
          ctc1   t0,fcr31
 1:      jr      ra
diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
index ca1cc30c0891..1958910b75c0 100644
--- a/arch/mips/kernel/relocate.c
+++ b/arch/mips/kernel/relocate.c
@@ -200,7 +200,7 @@ static inline __init unsigned long get_random_boot(void)
 
 #if defined(CONFIG_USE_OF)
         /* Get any additional entropy passed in device tree */
-        {
+        if (initial_boot_params) {
                 int node, len;
                 u64 *prop;
 
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 0d57909d9026..f66e5ce505b2 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -368,6 +368,19 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
+#ifndef CONFIG_HIGHMEM
+                /*
+                 * Skip highmem here so we get an accurate max_low_pfn if low
+                 * memory stops short of high memory.
+                 * If the region overlaps HIGHMEM_START, end is clipped so
+                 * max_pfn excludes the highmem portion.
+                 */
+                if (start >= PFN_DOWN(HIGHMEM_START))
+                        continue;
+                if (end > PFN_DOWN(HIGHMEM_START))
+                        end = PFN_DOWN(HIGHMEM_START);
+#endif
+
                 if (end > max_low_pfn)
                         max_low_pfn = end;
                 if (start < min_low_pfn)
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 1f5fdee1dfc3..3905003dfe2b 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -156,7 +156,7 @@ static void show_backtrace(struct task_struct *task, const struct pt_regs *regs)
                 print_ip_sym(pc);
                 pc = unwind_stack(task, &sp, pc, &ra);
         } while (pc);
-        printk("\n");
+        pr_cont("\n");
 }
 
 /*
@@ -174,22 +174,24 @@ static void show_stacktrace(struct task_struct *task,
         printk("Stack :");
         i = 0;
         while ((unsigned long) sp & (PAGE_SIZE - 1)) {
-                if (i && ((i % (64 / field)) == 0))
-                        printk("\n       ");
+                if (i && ((i % (64 / field)) == 0)) {
+                        pr_cont("\n");
+                        printk("       ");
+                }
                 if (i > 39) {
-                        printk(" ...");
+                        pr_cont(" ...");
                         break;
                 }
 
                 if (__get_user(stackdata, sp++)) {
-                        printk(" (Bad stack address)");
+                        pr_cont(" (Bad stack address)");
                         break;
                 }
 
-                printk(" %0*lx", field, stackdata);
+                pr_cont(" %0*lx", field, stackdata);
                 i++;
         }
-        printk("\n");
+        pr_cont("\n");
         show_backtrace(task, regs);
 }
 
@@ -229,18 +231,19 @@ static void show_code(unsigned int __user *pc)
         long i;
         unsigned short __user *pc16 = NULL;
 
-        printk("\nCode:");
+        printk("Code:");
 
         if ((unsigned long)pc & 1)
                 pc16 = (unsigned short __user *)((unsigned long)pc & ~1);
         for(i = -3 ; i < 6 ; i++) {
                 unsigned int insn;
                 if (pc16 ? __get_user(insn, pc16 + i) : __get_user(insn, pc + i)) {
-                        printk(" (Bad address in epc)\n");
+                        pr_cont(" (Bad address in epc)\n");
                         break;
                 }
-                printk("%c%0*x%c", (i?' ':'<'), pc16 ? 4 : 8, insn, (i?' ':'>'));
+                pr_cont("%c%0*x%c", (i?' ':'<'), pc16 ? 4 : 8, insn, (i?' ':'>'));
         }
+        pr_cont("\n");
 }
 
 static void __show_regs(const struct pt_regs *regs)
@@ -259,15 +262,15 @@ static void __show_regs(const struct pt_regs *regs)
                 if ((i % 4) == 0)
                         printk("$%2d   :", i);
                 if (i == 0)
-                        printk(" %0*lx", field, 0UL);
+                        pr_cont(" %0*lx", field, 0UL);
                 else if (i == 26 || i == 27)
-                        printk(" %*s", field, "");
+                        pr_cont(" %*s", field, "");
                 else
-                        printk(" %0*lx", field, regs->regs[i]);
+                        pr_cont(" %0*lx", field, regs->regs[i]);
 
                 i++;
                 if ((i % 4) == 0)
-                        printk("\n");
+                        pr_cont("\n");
         }
 
 #ifdef CONFIG_CPU_HAS_SMARTMIPS
@@ -288,46 +291,46 @@ static void __show_regs(const struct pt_regs *regs)
 
         if (cpu_has_3kex) {
                 if (regs->cp0_status & ST0_KUO)
-                        printk("KUo ");
+                        pr_cont("KUo ");
                 if (regs->cp0_status & ST0_IEO)
-                        printk("IEo ");
+                        pr_cont("IEo ");
                 if (regs->cp0_status & ST0_KUP)
-                        printk("KUp ");
+                        pr_cont("KUp ");
                 if (regs->cp0_status & ST0_IEP)
-                        printk("IEp ");
+                        pr_cont("IEp ");
                 if (regs->cp0_status & ST0_KUC)
-                        printk("KUc ");
+                        pr_cont("KUc ");
                 if (regs->cp0_status & ST0_IEC)
-                        printk("IEc ");
+                        pr_cont("IEc ");
         } else if (cpu_has_4kex) {
                 if (regs->cp0_status & ST0_KX)
-                        printk("KX ");
+                        pr_cont("KX ");
                 if (regs->cp0_status & ST0_SX)
-                        printk("SX ");
+                        pr_cont("SX ");
                 if (regs->cp0_status & ST0_UX)
-                        printk("UX ");
+                        pr_cont("UX ");
                 switch (regs->cp0_status & ST0_KSU) {
                 case KSU_USER:
-                        printk("USER ");
+                        pr_cont("USER ");
                         break;
                 case KSU_SUPERVISOR:
-                        printk("SUPERVISOR ");
+                        pr_cont("SUPERVISOR ");
                         break;
                 case KSU_KERNEL:
-                        printk("KERNEL ");
+                        pr_cont("KERNEL ");
                         break;
                 default:
-                        printk("BAD_MODE ");
+                        pr_cont("BAD_MODE ");
                         break;
                 }
                 if (regs->cp0_status & ST0_ERL)
-                        printk("ERL ");
+                        pr_cont("ERL ");
                 if (regs->cp0_status & ST0_EXL)
-                        printk("EXL ");
+                        pr_cont("EXL ");
                 if (regs->cp0_status & ST0_IE)
-                        printk("IE ");
+                        pr_cont("IE ");
         }
-        printk("\n");
+        pr_cont("\n");
 
         exccode = (cause & CAUSEF_EXCCODE) >> CAUSEB_EXCCODE;
         printk("Cause : %08x (ExcCode %02x)\n", cause, exccode);
@@ -705,6 +708,32 @@ asmlinkage void do_ov(struct pt_regs *regs)
         exception_exit(prev_state);
 }
 
+/*
+ * Send SIGFPE according to FCSR Cause bits, which must have already
+ * been masked against Enable bits.  This is impotant as Inexact can
+ * happen together with Overflow or Underflow, and `ptrace' can set
+ * any bits.
+ */
+void force_fcr31_sig(unsigned long fcr31, void __user *fault_addr,
+                     struct task_struct *tsk)
+{
+        struct siginfo si = { .si_addr = fault_addr, .si_signo = SIGFPE };
+
+        if (fcr31 & FPU_CSR_INV_X)
+                si.si_code = FPE_FLTINV;
+        else if (fcr31 & FPU_CSR_DIV_X)
+                si.si_code = FPE_FLTDIV;
+        else if (fcr31 & FPU_CSR_OVF_X)
+                si.si_code = FPE_FLTOVF;
+        else if (fcr31 & FPU_CSR_UDF_X)
+                si.si_code = FPE_FLTUND;
+        else if (fcr31 & FPU_CSR_INE_X)
+                si.si_code = FPE_FLTRES;
+        else
+                si.si_code = __SI_FAULT;
+        force_sig_info(SIGFPE, &si, tsk);
+}
+
 int process_fpemu_return(int sig, void __user *fault_addr, unsigned long fcr31)
 {
         struct siginfo si = { 0 };
@@ -715,27 +744,7 @@ int process_fpemu_return(int sig, void __user *fault_addr, unsigned long fcr31)
                 return 0;
 
         case SIGFPE:
-                si.si_addr = fault_addr;
-                si.si_signo = sig;
-                /*
-                 * Inexact can happen together with Overflow or Underflow.
-                 * Respect the mask to deliver the correct exception.
-                 */
-                fcr31 &= (fcr31 & FPU_CSR_ALL_E) <<
-                         (ffs(FPU_CSR_ALL_X) - ffs(FPU_CSR_ALL_E));
-                if (fcr31 & FPU_CSR_INV_X)
-                        si.si_code = FPE_FLTINV;
-                else if (fcr31 & FPU_CSR_DIV_X)
-                        si.si_code = FPE_FLTDIV;
-                else if (fcr31 & FPU_CSR_OVF_X)
-                        si.si_code = FPE_FLTOVF;
-                else if (fcr31 & FPU_CSR_UDF_X)
-                        si.si_code = FPE_FLTUND;
-                else if (fcr31 & FPU_CSR_INE_X)
-                        si.si_code = FPE_FLTRES;
-                else
-                        si.si_code = __SI_FAULT;
-                force_sig_info(sig, &si, current);
+                force_fcr31_sig(fcr31, fault_addr, current);
                 return 1;
 
         case SIGBUS:
@@ -799,13 +808,13 @@ static int simulate_fp(struct pt_regs *regs, unsigned int opcode,
         /* Run the emulator */
         sig = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 1,
                                        &fault_addr);
-        fcr31 = current->thread.fpu.fcr31;
 
         /*
-         * We can't allow the emulated instruction to leave any of
-         * the cause bits set in $fcr31.
+         * We can't allow the emulated instruction to leave any
+         * enabled Cause bits set in $fcr31.
          */
-        current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+        fcr31 = mask_fcr31_x(current->thread.fpu.fcr31);
+        current->thread.fpu.fcr31 &= ~fcr31;
 
         /* Restore the hardware register state */
         own_fpu(1);
@@ -831,7 +840,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 goto out;
 
         /* Clear FCSR.Cause before enabling interrupts */
-        write_32bit_cp1_register(CP1_STATUS, fcr31 & ~FPU_CSR_ALL_X);
+        write_32bit_cp1_register(CP1_STATUS, fcr31 & ~mask_fcr31_x(fcr31));
         local_irq_enable();
 
         die_if_kernel("FP exception in kernel code", regs);
@@ -853,13 +862,13 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 /* Run the emulator */
                 sig = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 1,
                                                &fault_addr);
-                fcr31 = current->thread.fpu.fcr31;
 
                 /*
-                 * We can't allow the emulated instruction to leave any of
-                 * the cause bits set in $fcr31.
+                 * We can't allow the emulated instruction to leave any
+                 * enabled Cause bits set in $fcr31.
                  */
-                current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+                fcr31 = mask_fcr31_x(current->thread.fpu.fcr31);
+                current->thread.fpu.fcr31 &= ~fcr31;
 
                 /* Restore the hardware register state */
                 own_fpu(1);     /* Using the FPU again.  */
@@ -1424,13 +1433,13 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
                 sig = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 0,
                                                &fault_addr);
-                fcr31 = current->thread.fpu.fcr31;
 
                 /*
                  * We can't allow the emulated instruction to leave
-                 * any of the cause bits set in $fcr31.
+                 * any enabled Cause bits set in $fcr31.
                  */
-                current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+                fcr31 = mask_fcr31_x(current->thread.fpu.fcr31);
+                current->thread.fpu.fcr31 &= ~fcr31;
 
                 /* Send a signal if required.  */
                 if (!process_fpemu_return(sig, fault_addr, fcr31) && !err)
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index 8770f32c9e0b..aa0937423e28 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -790,15 +790,15 @@ enum emulation_result kvm_mips_emul_eret(struct kvm_vcpu *vcpu)
         struct mips_coproc *cop0 = vcpu->arch.cop0;
         enum emulation_result er = EMULATE_DONE;
 
-        if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
+        if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
+                kvm_clear_c0_guest_status(cop0, ST0_ERL);
+                vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
+        } else if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
                 kvm_debug("[%#lx] ERET to %#lx\n", vcpu->arch.pc,
                           kvm_read_c0_guest_epc(cop0));
                 kvm_clear_c0_guest_status(cop0, ST0_EXL);
                 vcpu->arch.pc = kvm_read_c0_guest_epc(cop0);
 
-        } else if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
-                kvm_clear_c0_guest_status(cop0, ST0_ERL);
-                vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
         } else {
                 kvm_err("[%#lx] ERET when MIPS_SR_EXL|MIPS_SR_ERL == 0\n",
                         vcpu->arch.pc);
@@ -1528,13 +1528,25 @@ enum emulation_result kvm_mips_emulate_load(union mips_instruction inst,
                                             struct kvm_vcpu *vcpu)
 {
         enum emulation_result er = EMULATE_DO_MMIO;
+        unsigned long curr_pc;
         u32 op, rt;
         u32 bytes;
 
         rt = inst.i_format.rt;
         op = inst.i_format.opcode;
 
-        vcpu->arch.pending_load_cause = cause;
+        /*
+         * Find the resume PC now while we have safe and easy access to the
+         * prior branch instruction, and save it for
+         * kvm_mips_complete_mmio_load() to restore later.
+         */
+        curr_pc = vcpu->arch.pc;
+        er = update_pc(vcpu, cause);
+        if (er == EMULATE_FAIL)
+                return er;
+        vcpu->arch.io_pc = vcpu->arch.pc;
+        vcpu->arch.pc = curr_pc;
+
         vcpu->arch.io_gpr = rt;
 
         switch (op) {
@@ -2494,9 +2506,8 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
                 goto done;
         }
 
-        er = update_pc(vcpu, vcpu->arch.pending_load_cause);
-        if (er == EMULATE_FAIL)
-                return er;
+        /* Restore saved resume PC */
+        vcpu->arch.pc = vcpu->arch.io_pc;
 
         switch (run->mmio.len) {
         case 4:
@@ -2518,11 +2529,6 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
                 break;
         }
 
-        if (vcpu->arch.pending_load_cause & CAUSEF_BD)
-                kvm_debug("[%#lx] Completing %d byte BD Load to gpr %d (0x%08lx) type %d\n",
-                          vcpu->arch.pc, run->mmio.len, vcpu->arch.io_gpr, *gpr,
-                          vcpu->mmio_needed);
-
 done:
         return er;
 }
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index 622037d851a3..06a60b19acfb 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -426,7 +426,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
 static void kvm_mips_check_asids(struct kvm_vcpu *vcpu)
 {
         struct mips_coproc *cop0 = vcpu->arch.cop0;
-        int cpu = smp_processor_id();
+        int i, cpu = smp_processor_id();
         unsigned int gasid;
 
         /*
@@ -442,6 +442,9 @@ static void kvm_mips_check_asids(struct kvm_vcpu *vcpu)
                                                 vcpu);
                         vcpu->arch.guest_user_asid[cpu] =
                                 vcpu->arch.guest_user_mm.context.asid[cpu];
+                        for_each_possible_cpu(i)
+                                if (i != cpu)
+                                        vcpu->arch.guest_user_asid[cpu] = 0;
                         vcpu->arch.last_user_gasid = gasid;
                 }
         }
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 03883ba806e2..3b677c851be0 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -260,13 +260,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 
         if ((vcpu->arch.guest_user_asid[cpu] ^ asid_cache(cpu)) &
                                                 asid_version_mask(cpu)) {
-                u32 gasid = kvm_read_c0_guest_entryhi(vcpu->arch.cop0) &
-                                KVM_ENTRYHI_ASID;
-
                 kvm_get_new_mmu_context(&vcpu->arch.guest_user_mm, cpu, vcpu);
                 vcpu->arch.guest_user_asid[cpu] =
                     vcpu->arch.guest_user_mm.context.asid[cpu];
-                vcpu->arch.last_user_gasid = gasid;
                 newasid++;
 
                 kvm_debug("[%d]: cpu_context: %#lx\n", cpu,
diff --git a/arch/mips/lib/dump_tlb.c b/arch/mips/lib/dump_tlb.c
index 0f80b936e75e..6eb50a7137db 100644
--- a/arch/mips/lib/dump_tlb.c
+++ b/arch/mips/lib/dump_tlb.c
@@ -135,42 +135,42 @@ static void dump_tlb(int first, int last)
                 c0 = (entrylo0 & ENTRYLO_C) >> ENTRYLO_C_SHIFT;
                 c1 = (entrylo1 & ENTRYLO_C) >> ENTRYLO_C_SHIFT;
 
-                printk("va=%0*lx asid=%0*lx",
-                       vwidth, (entryhi & ~0x1fffUL),
-                       asidwidth, entryhi & asidmask);
+                pr_cont("va=%0*lx asid=%0*lx",
+                        vwidth, (entryhi & ~0x1fffUL),
+                        asidwidth, entryhi & asidmask);
                 if (cpu_has_guestid)
-                        printk(" gid=%02lx",
-                               (guestctl1 & MIPS_GCTL1_RID)
+                        pr_cont(" gid=%02lx",
+                                (guestctl1 & MIPS_GCTL1_RID)
                                         >> MIPS_GCTL1_RID_SHIFT);
                 /* RI/XI are in awkward places, so mask them off separately */
                 pa = entrylo0 & ~(MIPS_ENTRYLO_RI | MIPS_ENTRYLO_XI);
                 if (xpa)
                         pa |= (unsigned long long)readx_c0_entrylo0() << 30;
                 pa = (pa << 6) & PAGE_MASK;
-                printk("\n\t[");
+                pr_cont("\n\t[");
                 if (cpu_has_rixi)
-                        printk("ri=%d xi=%d ",
-                               (entrylo0 & MIPS_ENTRYLO_RI) ? 1 : 0,
-                               (entrylo0 & MIPS_ENTRYLO_XI) ? 1 : 0);
-                printk("pa=%0*llx c=%d d=%d v=%d g=%d] [",
-                       pwidth, pa, c0,
-                       (entrylo0 & ENTRYLO_D) ? 1 : 0,
-                       (entrylo0 & ENTRYLO_V) ? 1 : 0,
-                       (entrylo0 & ENTRYLO_G) ? 1 : 0);
+                        pr_cont("ri=%d xi=%d ",
+                                (entrylo0 & MIPS_ENTRYLO_RI) ? 1 : 0,
+                                (entrylo0 & MIPS_ENTRYLO_XI) ? 1 : 0);
+                pr_cont("pa=%0*llx c=%d d=%d v=%d g=%d] [",
+                        pwidth, pa, c0,
+                        (entrylo0 & ENTRYLO_D) ? 1 : 0,
+                        (entrylo0 & ENTRYLO_V) ? 1 : 0,
+                        (entrylo0 & ENTRYLO_G) ? 1 : 0);
                 /* RI/XI are in awkward places, so mask them off separately */
                 pa = entrylo1 & ~(MIPS_ENTRYLO_RI | MIPS_ENTRYLO_XI);
                 if (xpa)
                         pa |= (unsigned long long)readx_c0_entrylo1() << 30;
                 pa = (pa << 6) & PAGE_MASK;
                 if (cpu_has_rixi)
-                        printk("ri=%d xi=%d ",
-                               (entrylo1 & MIPS_ENTRYLO_RI) ? 1 : 0,
-                               (entrylo1 & MIPS_ENTRYLO_XI) ? 1 : 0);
-                printk("pa=%0*llx c=%d d=%d v=%d g=%d]\n",
-                       pwidth, pa, c1,
-                       (entrylo1 & ENTRYLO_D) ? 1 : 0,
-                       (entrylo1 & ENTRYLO_V) ? 1 : 0,
-                       (entrylo1 & ENTRYLO_G) ? 1 : 0);
+                        pr_cont("ri=%d xi=%d ",
+                                (entrylo1 & MIPS_ENTRYLO_RI) ? 1 : 0,
+                                (entrylo1 & MIPS_ENTRYLO_XI) ? 1 : 0);
+                pr_cont("pa=%0*llx c=%d d=%d v=%d g=%d]\n",
+                        pwidth, pa, c1,
+                        (entrylo1 & ENTRYLO_D) ? 1 : 0,
+                        (entrylo1 & ENTRYLO_V) ? 1 : 0,
+                        (entrylo1 & ENTRYLO_G) ? 1 : 0);
         }
         printk("\n");
 
diff --git a/arch/mips/lib/r3k_dump_tlb.c b/arch/mips/lib/r3k_dump_tlb.c
index 744f4a7bc49d..85b4086e553e 100644
--- a/arch/mips/lib/r3k_dump_tlb.c
+++ b/arch/mips/lib/r3k_dump_tlb.c
@@ -53,15 +53,15 @@ static void dump_tlb(int first, int last)
                          */
                         printk("Index: %2d ", i);
 
-                        printk("va=%08lx asid=%08lx"
-                               "  [pa=%06lx n=%d d=%d v=%d g=%d]",
-                               entryhi & PAGE_MASK,
-                               entryhi & asid_mask,
-                               entrylo0 & PAGE_MASK,
-                               (entrylo0 & R3K_ENTRYLO_N) ? 1 : 0,
-                               (entrylo0 & R3K_ENTRYLO_D) ? 1 : 0,
-                               (entrylo0 & R3K_ENTRYLO_V) ? 1 : 0,
-                               (entrylo0 & R3K_ENTRYLO_G) ? 1 : 0);
+                        pr_cont("va=%08lx asid=%08lx"
+                                "  [pa=%06lx n=%d d=%d v=%d g=%d]",
+                                entryhi & PAGE_MASK,
+                                entryhi & asid_mask,
+                                entrylo0 & PAGE_MASK,
+                                (entrylo0 & R3K_ENTRYLO_N) ? 1 : 0,
+                                (entrylo0 & R3K_ENTRYLO_D) ? 1 : 0,
+                                (entrylo0 & R3K_ENTRYLO_V) ? 1 : 0,
+                                (entrylo0 & R3K_ENTRYLO_G) ? 1 : 0);
                 }
         }
         printk("\n");
diff --git a/arch/nios2/kernel/time.c b/arch/nios2/kernel/time.c
index d9563ddb337e..746bf5caaffc 100644
--- a/arch/nios2/kernel/time.c
+++ b/arch/nios2/kernel/time.c
@@ -324,6 +324,7 @@ static int __init nios2_time_init(struct device_node *timer)
                 ret = nios2_clocksource_init(timer);
                 break;
         default:
+                ret = 0;
                 break;
         }
 
diff --git a/arch/openrisc/include/asm/cache.h b/arch/openrisc/include/asm/cache.h
index 4ce7a01a252d..5f55da9cbfd5 100644
--- a/arch/openrisc/include/asm/cache.h
+++ b/arch/openrisc/include/asm/cache.h
@@ -23,6 +23,8 @@
  * they shouldn't be hard-coded!
  */
 
+#define __ro_after_init __read_mostly
+
 #define L1_CACHE_BYTES 16
 #define L1_CACHE_SHIFT 4
 
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index a9b9407f38f7..6b0741e7a7ed 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -368,7 +368,9 @@
 
 #define __IGNORE_select         /* newselect */
 #define __IGNORE_fadvise64      /* fadvise64_64 */
-
+#define __IGNORE_pkey_mprotect
+#define __IGNORE_pkey_alloc
+#define __IGNORE_pkey_free
 
 #define LINUX_GATEWAY_ADDR      0x100
 
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index f8150669b8c6..700e2d2da096 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -873,11 +873,11 @@ static void print_parisc_device(struct parisc_device *dev)
 
         if (dev->num_addrs) {
                 int k;
-                printk(", additional addresses: ");
+                pr_cont(", additional addresses: ");
                 for (k = 0; k < dev->num_addrs; k++)
-                        printk("0x%lx ", dev->addr[k]);
+                        pr_cont("0x%lx ", dev->addr[k]);
         }
-        printk("\n");
+        pr_cont("\n");
 }
 
 /**
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index d03422e5f188..23de307c3052 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -100,14 +100,12 @@ set_thread_pointer:
         .endr
 
 /* This address must remain fixed at 0x100 for glibc's syscalls to work */
-        .align 256
+        .align LINUX_GATEWAY_ADDR
 linux_gateway_entry:
         gate    .+8, %r0                        /* become privileged */
         mtsp    %r0,%sr4                        /* get kernel space into sr4 */
         mtsp    %r0,%sr5                        /* get kernel space into sr5 */
         mtsp    %r0,%sr6                        /* get kernel space into sr6 */
-        mfsp    %sr7,%r1                        /* save user sr7 */
-        mtsp    %r1,%sr3                        /* and store it in sr3 */
 
 #ifdef CONFIG_64BIT
         /* for now we can *always* set the W bit on entry to the syscall
@@ -133,6 +131,14 @@ linux_gateway_entry:
         depdi   0, 31, 32, %r21
 1:      
 #endif
+
+        /* We use a rsm/ssm pair to prevent sr3 from being clobbered
+         * by external interrupts.
+         */
+        mfsp    %sr7,%r1                        /* save user sr7 */
+        rsm     PSW_SM_I, %r0                   /* disable interrupts */
+        mtsp    %r1,%sr3                        /* and store it in sr3 */
+
         mfctl   %cr30,%r1
         xor     %r1,%r30,%r30                   /* ye olde xor trick */
         xor     %r1,%r30,%r1
@@ -147,6 +153,7 @@ linux_gateway_entry:
          */
 
         mtsp    %r0,%sr7                        /* get kernel space into sr7 */
+        ssm     PSW_SM_I, %r0                   /* enable interrupts */
         STREGM  %r1,FRAME_SIZE(%r30)            /* save r1 (usp) here for now */
         mfctl   %cr30,%r1                       /* get task ptr in %r1 */
         LDREG   TI_TASK(%r1),%r1
@@ -474,11 +481,6 @@ lws_start:
         comiclr,>>      __NR_lws_entries, %r20, %r0
         b,n     lws_exit_nosys
 
-        /* WARNING: Trashing sr2 and sr3 */
-        mfsp    %sr7,%r1                        /* get userspace into sr3 */
-        mtsp    %r1,%sr3
-        mtsp    %r0,%sr2                        /* get kernel space into sr2 */
-
         /* Load table start */
         ldil    L%lws_table, %r1
         ldo     R%lws_table(%r1), %r28  /* Scratch use of r28 */
@@ -627,9 +629,9 @@ cas_action:
         stw     %r1, 4(%sr2,%r20)
 #endif
         /* The load and store could fail */
-1:      ldw,ma  0(%sr3,%r26), %r28
+1:      ldw,ma  0(%r26), %r28
         sub,<>  %r28, %r25, %r0
-2:      stw,ma  %r24, 0(%sr3,%r26)
+2:      stw,ma  %r24, 0(%r26)
         /* Free lock */
         stw,ma  %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
@@ -706,9 +708,9 @@ lws_compare_and_swap_2:
         nop
 
         /* 8bit load */
-4:      ldb     0(%sr3,%r25), %r25
+4:      ldb     0(%r25), %r25
         b       cas2_lock_start
-5:      ldb     0(%sr3,%r24), %r24
+5:      ldb     0(%r24), %r24
         nop
         nop
         nop
@@ -716,9 +718,9 @@ lws_compare_and_swap_2:
         nop
 
         /* 16bit load */
-6:      ldh     0(%sr3,%r25), %r25
+6:      ldh     0(%r25), %r25
         b       cas2_lock_start
-7:      ldh     0(%sr3,%r24), %r24
+7:      ldh     0(%r24), %r24
         nop
         nop
         nop
@@ -726,9 +728,9 @@ lws_compare_and_swap_2:
         nop
 
         /* 32bit load */
-8:      ldw     0(%sr3,%r25), %r25
+8:      ldw     0(%r25), %r25
         b       cas2_lock_start
-9:      ldw     0(%sr3,%r24), %r24
+9:      ldw     0(%r24), %r24
         nop
         nop
         nop
@@ -737,14 +739,14 @@ lws_compare_and_swap_2:
 
         /* 64bit load */
 #ifdef CONFIG_64BIT
-10:     ldd     0(%sr3,%r25), %r25
-11:     ldd     0(%sr3,%r24), %r24
+10:     ldd     0(%r25), %r25
+11:     ldd     0(%r24), %r24
 #else
         /* Load new value into r22/r23 - high/low */
-10:     ldw     0(%sr3,%r25), %r22
-11:     ldw     4(%sr3,%r25), %r23
+10:     ldw     0(%r25), %r22
+11:     ldw     4(%r25), %r23
         /* Load new value into fr4 for atomic store later */
-12:     flddx   0(%sr3,%r24), %fr4
+12:     flddx   0(%r24), %fr4
 #endif
 
 cas2_lock_start:
@@ -794,30 +796,30 @@ cas2_action:
         ldo     1(%r0),%r28
 
         /* 8bit CAS */
-13:     ldb,ma  0(%sr3,%r26), %r29
+13:     ldb,ma  0(%r26), %r29
         sub,=   %r29, %r25, %r0
         b,n     cas2_end
-14:     stb,ma  %r24, 0(%sr3,%r26)
+14:     stb,ma  %r24, 0(%r26)
         b       cas2_end
         copy    %r0, %r28
         nop
         nop
 
         /* 16bit CAS */
-15:     ldh,ma  0(%sr3,%r26), %r29
+15:     ldh,ma  0(%r26), %r29
         sub,=   %r29, %r25, %r0
         b,n     cas2_end
-16:     sth,ma  %r24, 0(%sr3,%r26)
+16:     sth,ma  %r24, 0(%r26)
         b       cas2_end
         copy    %r0, %r28
         nop
         nop
 
         /* 32bit CAS */
-17:     ldw,ma  0(%sr3,%r26), %r29
+17:     ldw,ma  0(%r26), %r29
         sub,=   %r29, %r25, %r0
         b,n     cas2_end
-18:     stw,ma  %r24, 0(%sr3,%r26)
+18:     stw,ma  %r24, 0(%r26)
         b       cas2_end
         copy    %r0, %r28
         nop
@@ -825,22 +827,22 @@ cas2_action:
 
         /* 64bit CAS */
 #ifdef CONFIG_64BIT
-19:     ldd,ma  0(%sr3,%r26), %r29
+19:     ldd,ma  0(%r26), %r29
         sub,*=  %r29, %r25, %r0
         b,n     cas2_end
-20:     std,ma  %r24, 0(%sr3,%r26)
+20:     std,ma  %r24, 0(%r26)
         copy    %r0, %r28
 #else
         /* Compare first word */
-19:     ldw,ma  0(%sr3,%r26), %r29
+19:     ldw,ma  0(%r26), %r29
         sub,=   %r29, %r22, %r0
         b,n     cas2_end
         /* Compare second word */
-20:     ldw,ma  4(%sr3,%r26), %r29
+20:     ldw,ma  4(%r26), %r29
         sub,=   %r29, %r23, %r0
         b,n     cas2_end
         /* Perform the store */
-21:     fstdx   %fr4, 0(%sr3,%r26)
+21:     fstdx   %fr4, 0(%r26)
         copy    %r0, %r28
 #endif
 
diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
index 28f03ca60100..794bebb43d23 100644
--- a/arch/s390/hypfs/hypfs_diag.c
+++ b/arch/s390/hypfs/hypfs_diag.c
@@ -363,11 +363,11 @@ out:
 static int diag224_get_name_table(void)
 {
         /* memory must be below 2GB */
-        diag224_cpu_names = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
+        diag224_cpu_names = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
         if (!diag224_cpu_names)
                 return -ENOMEM;
         if (diag224(diag224_cpu_names)) {
-                kfree(diag224_cpu_names);
+                free_page((unsigned long) diag224_cpu_names);
                 return -EOPNOTSUPP;
         }
         EBCASC(diag224_cpu_names + 16, (*diag224_cpu_names + 1) * 16);
@@ -376,7 +376,7 @@ static int diag224_get_name_table(void)
 
 static void diag224_delete_name_table(void)
 {
-        kfree(diag224_cpu_names);
+        free_page((unsigned long) diag224_cpu_names);
 }
 
 static int diag224_idx2name(int index, char *name)
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 000e6e91f6a0..3667d20e997f 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -62,9 +62,11 @@ SECTIONS
 
         . = ALIGN(PAGE_SIZE);
         __start_ro_after_init = .;
+        __start_data_ro_after_init = .;
         .data..ro_after_init : {
                  *(.data..ro_after_init)
         }
+        __end_data_ro_after_init = .;
         EXCEPTION_TABLE(16)
         . = ALIGN(PAGE_SIZE);
         __end_ro_after_init = .;
diff --git a/arch/s390/kvm/sthyi.c b/arch/s390/kvm/sthyi.c
index bd98b7d25200..05c98bb853cf 100644
--- a/arch/s390/kvm/sthyi.c
+++ b/arch/s390/kvm/sthyi.c
@@ -315,7 +315,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
         if (r < 0)
                 goto out;
 
-        diag224_buf = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
+        diag224_buf = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
         if (!diag224_buf || diag224(diag224_buf))
                 goto out;
 
@@ -378,7 +378,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
         sctns->par.infpval1 |= PAR_WGHT_VLD;
 
 out:
-        kfree(diag224_buf);
+        free_page((unsigned long)diag224_buf);
         vfree(diag204_buf);
 }
 
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 7350c8bc13a2..6b2f72f523b9 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -423,7 +423,7 @@ static int __s390_dma_map_sg(struct device *dev, struct scatterlist *sg,
         dma_addr_t dma_addr_base, dma_addr;
         int flags = ZPCI_PTE_VALID;
         struct scatterlist *s;
-        unsigned long pa;
+        unsigned long pa = 0;
         int ret;
 
         size = PAGE_ALIGN(size);
diff --git a/arch/sparc/include/asm/cpudata_64.h b/arch/sparc/include/asm/cpudata_64.h
index a6cfdabb6054..5b0ed48e5b0c 100644
--- a/arch/sparc/include/asm/cpudata_64.h
+++ b/arch/sparc/include/asm/cpudata_64.h
@@ -24,9 +24,10 @@ typedef struct {
         unsigned int    icache_line_size;
         unsigned int    ecache_size;
         unsigned int    ecache_line_size;
-        unsigned short  sock_id;
+        unsigned short  sock_id;        /* physical package */
         unsigned short  core_id;
-        int             proc_id;
+        unsigned short  max_cache_id;   /* groupings of highest shared cache */
+        unsigned short  proc_id;        /* strand (aka HW thread) id */
 } cpuinfo_sparc;
 
 DECLARE_PER_CPU(cpuinfo_sparc, __cpu_data);
diff --git a/arch/sparc/include/asm/spinlock_32.h b/arch/sparc/include/asm/spinlock_32.h
index d9c5876c6121..8011e79f59c9 100644
--- a/arch/sparc/include/asm/spinlock_32.h
+++ b/arch/sparc/include/asm/spinlock_32.h
@@ -134,7 +134,7 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
         *(volatile __u32 *)&lp->lock = ~0U;
 }
 
-static void inline arch_write_unlock(arch_rwlock_t *lock)
+static inline void arch_write_unlock(arch_rwlock_t *lock)
 {
         __asm__ __volatile__(
 "       st              %%g0, [%0]"
diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
index 87990b7c6b0d..07c9f2e9bf57 100644
--- a/arch/sparc/include/asm/spinlock_64.h
+++ b/arch/sparc/include/asm/spinlock_64.h
@@ -96,7 +96,7 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
 
 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
 
-static void inline arch_read_lock(arch_rwlock_t *lock)
+static inline void arch_read_lock(arch_rwlock_t *lock)
 {
         unsigned long tmp1, tmp2;
 
@@ -119,7 +119,7 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
         : "memory");
 }
 
-static int inline arch_read_trylock(arch_rwlock_t *lock)
+static inline int arch_read_trylock(arch_rwlock_t *lock)
 {
         int tmp1, tmp2;
 
@@ -140,7 +140,7 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
         return tmp1;
 }
 
-static void inline arch_read_unlock(arch_rwlock_t *lock)
+static inline void arch_read_unlock(arch_rwlock_t *lock)
 {
         unsigned long tmp1, tmp2;
 
@@ -156,7 +156,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
         : "memory");
 }
 
-static void inline arch_write_lock(arch_rwlock_t *lock)
+static inline void arch_write_lock(arch_rwlock_t *lock)
 {
         unsigned long mask, tmp1, tmp2;
 
@@ -181,7 +181,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
         : "memory");
 }
 
-static void inline arch_write_unlock(arch_rwlock_t *lock)
+static inline void arch_write_unlock(arch_rwlock_t *lock)
 {
         __asm__ __volatile__(
 "       stw             %%g0, [%0]"
@@ -190,7 +190,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
         : "memory");
 }
 
-static int inline arch_write_trylock(arch_rwlock_t *lock)
+static inline int arch_write_trylock(arch_rwlock_t *lock)
 {
         unsigned long mask, tmp1, tmp2, result;
 
diff --git a/arch/sparc/include/asm/topology_64.h b/arch/sparc/include/asm/topology_64.h
index bec481aaca16..7b4898a36eee 100644
--- a/arch/sparc/include/asm/topology_64.h
+++ b/arch/sparc/include/asm/topology_64.h
@@ -44,14 +44,20 @@ int __node_distance(int, int);
 #define topology_physical_package_id(cpu)       (cpu_data(cpu).proc_id)
 #define topology_core_id(cpu)                   (cpu_data(cpu).core_id)
 #define topology_core_cpumask(cpu)              (&cpu_core_sib_map[cpu])
+#define topology_core_cache_cpumask(cpu)        (&cpu_core_sib_cache_map[cpu])
 #define topology_sibling_cpumask(cpu)           (&per_cpu(cpu_sibling_map, cpu))
 #endif /* CONFIG_SMP */
 
 extern cpumask_t cpu_core_map[NR_CPUS];
 extern cpumask_t cpu_core_sib_map[NR_CPUS];
+extern cpumask_t cpu_core_sib_cache_map[NR_CPUS];
+
+/**
+ * Return cores that shares the last level cache.
+ */
 static inline const struct cpumask *cpu_coregroup_mask(int cpu)
 {
-        return &cpu_core_map[cpu];
+        return &cpu_core_sib_cache_map[cpu];
 }
 
 #endif /* _ASM_SPARC64_TOPOLOGY_H */
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index b68acc563235..5373136c412b 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -82,7 +82,6 @@ static inline int access_ok(int type, const void __user * addr, unsigned long si
         return 1;
 }
 
-void __ret_efault(void);
 void __retl_efault(void);
 
 /* Uh, these should become the main single-value transfer routines..
@@ -189,55 +188,34 @@ int __get_user_bad(void);
 unsigned long __must_check ___copy_from_user(void *to,
                                              const void __user *from,
                                              unsigned long size);
-unsigned long copy_from_user_fixup(void *to, const void __user *from,
-                                   unsigned long size);
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long size)
 {
-        unsigned long ret;
-
         check_object_size(to, size, false);
 
-        ret = ___copy_from_user(to, from, size);
-        if (unlikely(ret))
-                ret = copy_from_user_fixup(to, from, size);
-
-        return ret;
+        return ___copy_from_user(to, from, size);
 }
 #define __copy_from_user copy_from_user
 
 unsigned long __must_check ___copy_to_user(void __user *to,
                                            const void *from,
                                            unsigned long size);
-unsigned long copy_to_user_fixup(void __user *to, const void *from,
-                                 unsigned long size);
 static inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long size)
 {
-        unsigned long ret;
-
         check_object_size(from, size, true);
 
-        ret = ___copy_to_user(to, from, size);
-        if (unlikely(ret))
-                ret = copy_to_user_fixup(to, from, size);
-        return ret;
+        return ___copy_to_user(to, from, size);
 }
 #define __copy_to_user copy_to_user
 
 unsigned long __must_check ___copy_in_user(void __user *to,
                                            const void __user *from,
                                            unsigned long size);
-unsigned long copy_in_user_fixup(void __user *to, void __user *from,
-                                 unsigned long size);
 static inline unsigned long __must_check
 copy_in_user(void __user *to, void __user *from, unsigned long size)
 {
-        unsigned long ret = ___copy_in_user(to, from, size);
-
-        if (unlikely(ret))
-                ret = copy_in_user_fixup(to, from, size);
-        return ret;
+        return ___copy_in_user(to, from, size);
 }
 #define __copy_in_user copy_in_user
 
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index beba6c11554c..6aa3da152c20 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -926,48 +926,11 @@ tlb_type:	.word	0	/* Must NOT end up in BSS */
 EXPORT_SYMBOL(tlb_type)
         .section        ".fixup",#alloc,#execinstr
 
-        .globl  __ret_efault, __retl_efault, __ret_one, __retl_one
-ENTRY(__ret_efault)
-        ret
-         restore %g0, -EFAULT, %o0
-ENDPROC(__ret_efault)
-EXPORT_SYMBOL(__ret_efault)
-
 ENTRY(__retl_efault)
         retl
          mov    -EFAULT, %o0
 ENDPROC(__retl_efault)
 
-ENTRY(__retl_one)
-        retl
-         mov    1, %o0
-ENDPROC(__retl_one)
-
-ENTRY(__retl_one_fp)
-        VISExitHalf
-        retl
-         mov    1, %o0
-ENDPROC(__retl_one_fp)
-
-ENTRY(__ret_one_asi)
-        wr      %g0, ASI_AIUS, %asi
-        ret
-         restore %g0, 1, %o0
-ENDPROC(__ret_one_asi)
-
-ENTRY(__retl_one_asi)
-        wr      %g0, ASI_AIUS, %asi
-        retl
-         mov    1, %o0
-ENDPROC(__retl_one_asi)
-
-ENTRY(__retl_one_asi_fp)
-        wr      %g0, ASI_AIUS, %asi
-        VISExitHalf
-        retl
-         mov    1, %o0
-ENDPROC(__retl_one_asi_fp)
-
 ENTRY(__retl_o1)
         retl
          mov    %o1, %o0
diff --git a/arch/sparc/kernel/jump_label.c b/arch/sparc/kernel/jump_label.c
index 59bbeff55024..07933b9e9ce0 100644
--- a/arch/sparc/kernel/jump_label.c
+++ b/arch/sparc/kernel/jump_label.c
@@ -13,19 +13,30 @@
 void arch_jump_label_transform(struct jump_entry *entry,
                                enum jump_label_type type)
 {
-        u32 val;
         u32 *insn = (u32 *) (unsigned long) entry->code;
+        u32 val;
 
         if (type == JUMP_LABEL_JMP) {
                 s32 off = (s32)entry->target - (s32)entry->code;
+                bool use_v9_branch = false;
+
+                BUG_ON(off & 3);
 
 #ifdef CONFIG_SPARC64
-                /* ba,pt %xcc, . + (off << 2) */
-                val = 0x10680000 | ((u32) off >> 2);
-#else
-                /* ba . + (off << 2) */
-                val = 0x10800000 | ((u32) off >> 2);
+                if (off <= 0xfffff && off >= -0x100000)
+                        use_v9_branch = true;
 #endif
+                if (use_v9_branch) {
+                        /* WDISP19 - target is . + immed << 2 */
+                        /* ba,pt %xcc, . + off */
+                        val = 0x10680000 | (((u32) off >> 2) & 0x7ffff);
+                } else {
+                        /* WDISP22 - target is . + immed << 2 */
+                        BUG_ON(off > 0x7fffff);
+                        BUG_ON(off < -0x800000);
+                        /* ba . + off */
+                        val = 0x10800000 | (((u32) off >> 2) & 0x3fffff);
+                }
         } else {
                 val = 0x01000000;
         }
diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
index 11228861d9b4..8a6982dfd733 100644
--- a/arch/sparc/kernel/mdesc.c
+++ b/arch/sparc/kernel/mdesc.c
@@ -645,13 +645,20 @@ static void __mark_core_id(struct mdesc_handle *hp, u64 node,
                 cpu_data(*id).core_id = core_id;
 }
 
-static void __mark_sock_id(struct mdesc_handle *hp, u64 node,
-                           int sock_id)
+static void __mark_max_cache_id(struct mdesc_handle *hp, u64 node,
+                                int max_cache_id)
 {
         const u64 *id = mdesc_get_property(hp, node, "id", NULL);
 
-        if (*id < num_possible_cpus())
-                cpu_data(*id).sock_id = sock_id;
+        if (*id < num_possible_cpus()) {
+                cpu_data(*id).max_cache_id = max_cache_id;
+
+                /**
+                 * On systems without explicit socket descriptions socket
+                 * is max_cache_id
+                 */
+                cpu_data(*id).sock_id = max_cache_id;
+        }
 }
 
 static void mark_core_ids(struct mdesc_handle *hp, u64 mp,
@@ -660,10 +667,11 @@ static void mark_core_ids(struct mdesc_handle *hp, u64 mp,
         find_back_node_value(hp, mp, "cpu", __mark_core_id, core_id, 10);
 }
 
-static void mark_sock_ids(struct mdesc_handle *hp, u64 mp,
-                          int sock_id)
+static void mark_max_cache_ids(struct mdesc_handle *hp, u64 mp,
+                               int max_cache_id)
 {
-        find_back_node_value(hp, mp, "cpu", __mark_sock_id, sock_id, 10);
+        find_back_node_value(hp, mp, "cpu", __mark_max_cache_id,
+                             max_cache_id, 10);
 }
 
 static void set_core_ids(struct mdesc_handle *hp)
@@ -694,14 +702,15 @@ static void set_core_ids(struct mdesc_handle *hp)
         }
 }
 
-static int set_sock_ids_by_cache(struct mdesc_handle *hp, int level)
+static int set_max_cache_ids_by_cache(struct mdesc_handle *hp, int level)
 {
         u64 mp;
         int idx = 1;
         int fnd = 0;
 
-        /* Identify unique sockets by looking for cpus backpointed to by
-         * shared level n caches.
+        /**
+         * Identify unique highest level of shared cache by looking for cpus
+         * backpointed to by shared level N caches.
          */
         mdesc_for_each_node_by_name(hp, mp, "cache") {
                 const u64 *cur_lvl;
@@ -709,8 +718,7 @@ static int set_sock_ids_by_cache(struct mdesc_handle *hp, int level)
                 cur_lvl = mdesc_get_property(hp, mp, "level", NULL);
                 if (*cur_lvl != level)
                         continue;
-
-                mark_sock_ids(hp, mp, idx);
+                mark_max_cache_ids(hp, mp, idx);
                 idx++;
                 fnd = 1;
         }
@@ -745,15 +753,17 @@ static void set_sock_ids(struct mdesc_handle *hp)
 {
         u64 mp;
 
-        /* If machine description exposes sockets data use it.
-         * Otherwise fallback to use shared L3 or L2 caches.
+        /**
+         * Find the highest level of shared cache which pre-T7 is also
+         * the socket.
          */
+        if (!set_max_cache_ids_by_cache(hp, 3))
+                set_max_cache_ids_by_cache(hp, 2);
+
+        /* If machine description exposes sockets data use it.*/
         mp = mdesc_node_by_name(hp, MDESC_NODE_NULL, "sockets");
         if (mp != MDESC_NODE_NULL)
-                return set_sock_ids_by_socket(hp, mp);
-
-        if (!set_sock_ids_by_cache(hp, 3))
-                set_sock_ids_by_cache(hp, 2);
+                set_sock_ids_by_socket(hp, mp);
 }
 
 static void mark_proc_ids(struct mdesc_handle *hp, u64 mp, int proc_id)
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index d3035ba6cd31..8182f7caf5b1 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -63,9 +63,13 @@ cpumask_t cpu_core_map[NR_CPUS] __read_mostly =
 cpumask_t cpu_core_sib_map[NR_CPUS] __read_mostly = {
         [0 ... NR_CPUS-1] = CPU_MASK_NONE };
 
+cpumask_t cpu_core_sib_cache_map[NR_CPUS] __read_mostly = {
+        [0 ... NR_CPUS - 1] = CPU_MASK_NONE };
+
 EXPORT_PER_CPU_SYMBOL(cpu_sibling_map);
 EXPORT_SYMBOL(cpu_core_map);
 EXPORT_SYMBOL(cpu_core_sib_map);
+EXPORT_SYMBOL(cpu_core_sib_cache_map);
 
 static cpumask_t smp_commenced_mask;
 
@@ -1265,6 +1269,10 @@ void smp_fill_in_sib_core_maps(void)
                 unsigned int j;
 
                 for_each_present_cpu(j)  {
+                        if (cpu_data(i).max_cache_id ==
+                            cpu_data(j).max_cache_id)
+                                cpumask_set_cpu(j, &cpu_core_sib_cache_map[i]);
+
                         if (cpu_data(i).sock_id == cpu_data(j).sock_id)
                                 cpumask_set_cpu(j, &cpu_core_sib_map[i]);
                 }
diff --git a/arch/sparc/lib/GENcopy_from_user.S b/arch/sparc/lib/GENcopy_from_user.S
index b7d0bd6b1406..69a439fa2fc1 100644
--- a/arch/sparc/lib/GENcopy_from_user.S
+++ b/arch/sparc/lib/GENcopy_from_user.S
@@ -3,11 +3,11 @@
  * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/GENcopy_to_user.S b/arch/sparc/lib/GENcopy_to_user.S
index 780550e1afc7..9947427ce354 100644
--- a/arch/sparc/lib/GENcopy_to_user.S
+++ b/arch/sparc/lib/GENcopy_to_user.S
@@ -3,11 +3,11 @@
  * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/GENmemcpy.S b/arch/sparc/lib/GENmemcpy.S
index 89358ee94851..059ea24ad73d 100644
--- a/arch/sparc/lib/GENmemcpy.S
+++ b/arch/sparc/lib/GENmemcpy.S
@@ -4,21 +4,18 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #define GLOBAL_SPARE    %g7
 #else
 #define GLOBAL_SPARE    %g5
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
-#endif
-
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
+#define EX_ST(x,y)      x
 #endif
 
 #ifndef LOAD
@@ -45,6 +42,29 @@
         .register       %g3,#scratch
 
         .text
+
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+ENTRY(GEN_retl_o4_1)
+        add     %o4, %o2, %o4
+        retl
+         add    %o4, 1, %o0
+ENDPROC(GEN_retl_o4_1)
+ENTRY(GEN_retl_g1_8)
+        add     %g1, %o2, %g1
+        retl
+         add    %g1, 8, %o0
+ENDPROC(GEN_retl_g1_8)
+ENTRY(GEN_retl_o2_4)
+        retl
+         add    %o2, 4, %o0
+ENDPROC(GEN_retl_o2_4)
+ENTRY(GEN_retl_o2_1)
+        retl
+         add    %o2, 1, %o0
+ENDPROC(GEN_retl_o2_1)
+#endif
+
         .align          64
 
         .globl  FUNC_NAME
@@ -73,8 +93,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %g0, %o4, %o4
         sub             %o2, %o4, %o2
 1:      subcc           %o4, 1, %o4
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o0))
+        EX_LD(LOAD(ldub, %o1, %g1),GEN_retl_o4_1)
+        EX_ST(STORE(stb, %g1, %o0),GEN_retl_o4_1)
         add             %o1, 1, %o1
         bne,pt          %XCC, 1b
         add             %o0, 1, %o0
@@ -82,8 +102,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         andn            %o2, 0x7, %g1
         sub             %o2, %g1, %o2
 1:      subcc           %g1, 0x8, %g1
-        EX_LD(LOAD(ldx, %o1, %g2))
-        EX_ST(STORE(stx, %g2, %o0))
+        EX_LD(LOAD(ldx, %o1, %g2),GEN_retl_g1_8)
+        EX_ST(STORE(stx, %g2, %o0),GEN_retl_g1_8)
         add             %o1, 0x8, %o1
         bne,pt          %XCC, 1b
          add            %o0, 0x8, %o0
@@ -100,8 +120,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 1:
         subcc           %o2, 4, %o2
-        EX_LD(LOAD(lduw, %o1, %g1))
-        EX_ST(STORE(stw, %g1, %o1 + %o3))
+        EX_LD(LOAD(lduw, %o1, %g1),GEN_retl_o2_4)
+        EX_ST(STORE(stw, %g1, %o1 + %o3),GEN_retl_o2_4)
         bgu,pt          %XCC, 1b
          add            %o1, 4, %o1
 
@@ -111,8 +131,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         .align          32
 90:
         subcc           %o2, 1, %o2
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o1 + %o3))
+        EX_LD(LOAD(ldub, %o1, %g1),GEN_retl_o2_1)
+        EX_ST(STORE(stb, %g1, %o1 + %o3),GEN_retl_o2_1)
         bgu,pt          %XCC, 90b
          add            %o1, 1, %o1
         retl
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 885f00e81d1a..69912d2f8b54 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -38,7 +38,7 @@ lib-$(CONFIG_SPARC64) +=  NG4patch.o NG4copy_page.o NG4clear_page.o NG4memset.o
 lib-$(CONFIG_SPARC64) += GENmemcpy.o GENcopy_from_user.o GENcopy_to_user.o
 lib-$(CONFIG_SPARC64) += GENpatch.o GENpage.o GENbzero.o
 
-lib-$(CONFIG_SPARC64) += copy_in_user.o user_fixup.o memmove.o
+lib-$(CONFIG_SPARC64) += copy_in_user.o memmove.o
 lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o
 
 obj-$(CONFIG_SPARC64) += iomap.o
diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S
index d5242b8c4f94..b79a6998d87c 100644
--- a/arch/sparc/lib/NG2copy_from_user.S
+++ b/arch/sparc/lib/NG2copy_from_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_LD_FP(x)             \
+#define EX_LD_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S
index 4e962d993b10..dcec55f254ab 100644
--- a/arch/sparc/lib/NG2copy_to_user.S
+++ b/arch/sparc/lib/NG2copy_to_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_ST_FP(x)             \
+#define EX_ST_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
index d5f585df2f3f..c629dbd121b6 100644
--- a/arch/sparc/lib/NG2memcpy.S
+++ b/arch/sparc/lib/NG2memcpy.S
@@ -4,6 +4,7 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #define GLOBAL_SPARE    %g7
@@ -32,21 +33,17 @@
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 #ifndef EX_LD_FP
-#define EX_LD_FP(x)     x
+#define EX_LD_FP(x,y)   x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
+#define EX_ST(x,y)      x
 #endif
 #ifndef EX_ST_FP
-#define EX_ST_FP(x)     x
-#endif
-
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
+#define EX_ST_FP(x,y)   x
 #endif
 
 #ifndef LOAD
@@ -140,45 +137,110 @@
         fsrc2           %x6, %f12; \
         fsrc2           %x7, %f14;
 #define FREG_LOAD_1(base, x0) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0))
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1)
 #define FREG_LOAD_2(base, x0, x1) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1);
 #define FREG_LOAD_3(base, x0, x1, x2) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD_FP(LOAD(ldd, base + 0x10, %x2));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1);
 #define FREG_LOAD_4(base, x0, x1, x2, x3) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD_FP(LOAD(ldd, base + 0x18, %x3));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1);
 #define FREG_LOAD_5(base, x0, x1, x2, x3, x4) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD_FP(LOAD(ldd, base + 0x20, %x4));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1);
 #define FREG_LOAD_6(base, x0, x1, x2, x3, x4, x5) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \
-        EX_LD_FP(LOAD(ldd, base + 0x28, %x5));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x28, %x5), NG2_retl_o2_plus_g1);
 #define FREG_LOAD_7(base, x0, x1, x2, x3, x4, x5, x6) \
-        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \
-        EX_LD_FP(LOAD(ldd, base + 0x28, %x5)); \
-        EX_LD_FP(LOAD(ldd, base + 0x30, %x6));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x28, %x5), NG2_retl_o2_plus_g1); \
+        EX_LD_FP(LOAD(ldd, base + 0x30, %x6), NG2_retl_o2_plus_g1);
 
         .register       %g2,#scratch
         .register       %g3,#scratch
 
         .text
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+__restore_fp:
+        VISExitHalf
+__restore_asi:
+        retl
+         wr     %g0, ASI_AIUS, %asi
+ENTRY(NG2_retl_o2)
+        ba,pt   %xcc, __restore_asi
+         mov    %o2, %o0
+ENDPROC(NG2_retl_o2)
+ENTRY(NG2_retl_o2_plus_1)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, 1, %o0
+ENDPROC(NG2_retl_o2_plus_1)
+ENTRY(NG2_retl_o2_plus_4)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, 4, %o0
+ENDPROC(NG2_retl_o2_plus_4)
+ENTRY(NG2_retl_o2_plus_8)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, 8, %o0
+ENDPROC(NG2_retl_o2_plus_8)
+ENTRY(NG2_retl_o2_plus_o4_plus_1)
+        add     %o4, 1, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG2_retl_o2_plus_o4_plus_1)
+ENTRY(NG2_retl_o2_plus_o4_plus_8)
+        add     %o4, 8, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG2_retl_o2_plus_o4_plus_8)
+ENTRY(NG2_retl_o2_plus_o4_plus_16)
+        add     %o4, 16, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG2_retl_o2_plus_o4_plus_16)
+ENTRY(NG2_retl_o2_plus_g1_fp)
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %g1, %o0
+ENDPROC(NG2_retl_o2_plus_g1_fp)
+ENTRY(NG2_retl_o2_plus_g1_plus_64_fp)
+        add     %g1, 64, %g1
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %g1, %o0
+ENDPROC(NG2_retl_o2_plus_g1_plus_64_fp)
+ENTRY(NG2_retl_o2_plus_g1_plus_1)
+        add     %g1, 1, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %g1, %o0
+ENDPROC(NG2_retl_o2_plus_g1_plus_1)
+ENTRY(NG2_retl_o2_and_7_plus_o4)
+        and     %o2, 7, %o2
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG2_retl_o2_and_7_plus_o4)
+ENTRY(NG2_retl_o2_and_7_plus_o4_plus_8)
+        and     %o2, 7, %o2
+        add     %o4, 8, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG2_retl_o2_and_7_plus_o4_plus_8)
+#endif
+
         .align          64
 
         .globl  FUNC_NAME
@@ -230,8 +292,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %g0, %o4, %o4   ! bytes to align dst
         sub             %o2, %o4, %o2
 1:      subcc           %o4, 1, %o4
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o0))
+        EX_LD(LOAD(ldub, %o1, %g1), NG2_retl_o2_plus_o4_plus_1)
+        EX_ST(STORE(stb, %g1, %o0), NG2_retl_o2_plus_o4_plus_1)
         add             %o1, 1, %o1
         bne,pt          %XCC, 1b
         add             %o0, 1, %o0
@@ -281,11 +343,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          nop
         /* fall through for 0 < low bits < 8 */
 110:    sub             %o4, 64, %g2
-        EX_LD_FP(LOAD_BLK(%g2, %f0))
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+        EX_LD_FP(LOAD_BLK(%g2, %f0), NG2_retl_o2_plus_g1)
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f14, f16)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_8(f16, f18, f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -296,10 +358,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 120:    sub             %o4, 56, %g2
         FREG_LOAD_7(%g2, f0, f2, f4, f6, f8, f10, f12)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f16, f18)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_7(f18, f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -310,10 +372,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 130:    sub             %o4, 48, %g2
         FREG_LOAD_6(%g2, f0, f2, f4, f6, f8, f10)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f6, f8, f10, f16, f18, f20)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_6(f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -324,10 +386,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 140:    sub             %o4, 40, %g2
         FREG_LOAD_5(%g2, f0, f2, f4, f6, f8)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f6, f8, f16, f18, f20, f22)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_5(f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -338,10 +400,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 150:    sub             %o4, 32, %g2
         FREG_LOAD_4(%g2, f0, f2, f4, f6)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f6, f16, f18, f20, f22, f24)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_4(f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -352,10 +414,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 160:    sub             %o4, 24, %g2
         FREG_LOAD_3(%g2, f0, f2, f4)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f4, f16, f18, f20, f22, f24, f26)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_3(f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -366,10 +428,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 170:    sub             %o4, 16, %g2
         FREG_LOAD_2(%g2, f0, f2)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f2, f16, f18, f20, f22, f24, f26, f28)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_2(f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -380,10 +442,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 180:    sub             %o4, 8, %g2
         FREG_LOAD_1(%g2, f0)
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD_FP(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
+        EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1)
         FREG_FROB(f0, f16, f18, f20, f22, f24, f26, f28, f30)
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1)
         FREG_MOVE_1(f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -393,10 +455,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          nop
 
 190:
-1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1)
         subcc           %g1, 64, %g1
-        EX_LD_FP(LOAD_BLK(%o4, %f0))
-        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f0), NG2_retl_o2_plus_g1_plus_64)
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1_plus_64)
         add             %o4, 64, %o4
         bne,pt          %xcc, 1b
          LOAD(prefetch, %o4 + 64, #one_read)
@@ -423,28 +485,28 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         andn            %o2, 0xf, %o4
         and             %o2, 0xf, %o2
 1:      subcc           %o4, 0x10, %o4
-        EX_LD(LOAD(ldx, %o1, %o5))
+        EX_LD(LOAD(ldx, %o1, %o5), NG2_retl_o2_plus_o4_plus_16)
         add             %o1, 0x08, %o1
-        EX_LD(LOAD(ldx, %o1, %g1))
+        EX_LD(LOAD(ldx, %o1, %g1), NG2_retl_o2_plus_o4_plus_16)
         sub             %o1, 0x08, %o1
-        EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE))
+        EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_o4_plus_16)
         add             %o1, 0x8, %o1
-        EX_ST(STORE(stx, %g1, %o1 + GLOBAL_SPARE))
+        EX_ST(STORE(stx, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_o4_plus_8)
         bgu,pt          %XCC, 1b
          add            %o1, 0x8, %o1
 73:     andcc           %o2, 0x8, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x8, %o2
-        EX_LD(LOAD(ldx, %o1, %o5))
-        EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE))
+        EX_LD(LOAD(ldx, %o1, %o5), NG2_retl_o2_plus_8)
+        EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_8)
         add             %o1, 0x8, %o1
 1:      andcc           %o2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x4, %o2
-        EX_LD(LOAD(lduw, %o1, %o5))
-        EX_ST(STORE(stw, %o5, %o1 + GLOBAL_SPARE))
+        EX_LD(LOAD(lduw, %o1, %o5), NG2_retl_o2_plus_4)
+        EX_ST(STORE(stw, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_4)
         add             %o1, 0x4, %o1
 1:      cmp             %o2, 0
         be,pt           %XCC, 85f
@@ -460,8 +522,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %o2, %g1, %o2
 
 1:      subcc           %g1, 1, %g1
-        EX_LD(LOAD(ldub, %o1, %o5))
-        EX_ST(STORE(stb, %o5, %o1 + GLOBAL_SPARE))
+        EX_LD(LOAD(ldub, %o1, %o5), NG2_retl_o2_plus_g1_plus_1)
+        EX_ST(STORE(stb, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_g1_plus_1)
         bgu,pt          %icc, 1b
          add            %o1, 1, %o1
 
@@ -477,16 +539,16 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 8:      mov             64, GLOBAL_SPARE
         andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1, %g2))
+        EX_LD(LOAD(ldx, %o1, %g2), NG2_retl_o2)
         sub             GLOBAL_SPARE, %g1, GLOBAL_SPARE
         andn            %o2, 0x7, %o4
         sllx            %g2, %g1, %g2
 1:      add             %o1, 0x8, %o1
-        EX_LD(LOAD(ldx, %o1, %g3))
+        EX_LD(LOAD(ldx, %o1, %g3), NG2_retl_o2_and_7_plus_o4)
         subcc           %o4, 0x8, %o4
         srlx            %g3, GLOBAL_SPARE, %o5
         or              %o5, %g2, %o5
-        EX_ST(STORE(stx, %o5, %o0))
+        EX_ST(STORE(stx, %o5, %o0), NG2_retl_o2_and_7_plus_o4_plus_8)
         add             %o0, 0x8, %o0
         bgu,pt          %icc, 1b
          sllx           %g3, %g1, %g2
@@ -506,8 +568,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 1:
         subcc           %o2, 4, %o2
-        EX_LD(LOAD(lduw, %o1, %g1))
-        EX_ST(STORE(stw, %g1, %o1 + GLOBAL_SPARE))
+        EX_LD(LOAD(lduw, %o1, %g1), NG2_retl_o2_plus_4)
+        EX_ST(STORE(stw, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_4)
         bgu,pt          %XCC, 1b
          add            %o1, 4, %o1
 
@@ -517,8 +579,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         .align          32
 90:
         subcc           %o2, 1, %o2
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o1 + GLOBAL_SPARE))
+        EX_LD(LOAD(ldub, %o1, %g1), NG2_retl_o2_plus_1)
+        EX_ST(STORE(stb, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_1)
         bgu,pt          %XCC, 90b
          add            %o1, 1, %o1
         retl
diff --git a/arch/sparc/lib/NG4copy_from_user.S b/arch/sparc/lib/NG4copy_from_user.S
index 2e8ee7ad07a9..16a286c1a528 100644
--- a/arch/sparc/lib/NG4copy_from_user.S
+++ b/arch/sparc/lib/NG4copy_from_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 2012 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x, y)             \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_LD_FP(x)             \
+#define EX_LD_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NG4copy_to_user.S b/arch/sparc/lib/NG4copy_to_user.S
index be0bf4590df8..6b0276ffc858 100644
--- a/arch/sparc/lib/NG4copy_to_user.S
+++ b/arch/sparc/lib/NG4copy_to_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 2012 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_ST_FP(x)             \
+#define EX_ST_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_asi_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 8e13ee1f4454..75bb93b1437f 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -4,6 +4,7 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #define GLOBAL_SPARE    %g7
@@ -46,22 +47,19 @@
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 #ifndef EX_LD_FP
-#define EX_LD_FP(x)     x
+#define EX_LD_FP(x,y)   x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
+#define EX_ST(x,y)      x
 #endif
 #ifndef EX_ST_FP
-#define EX_ST_FP(x)     x
+#define EX_ST_FP(x,y)   x
 #endif
 
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
-#endif
 
 #ifndef LOAD
 #define LOAD(type,addr,dest)    type [addr], dest
@@ -94,6 +92,158 @@
         .register       %g3,#scratch
 
         .text
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+__restore_asi_fp:
+        VISExitHalf
+__restore_asi:
+        retl
+         wr     %g0, ASI_AIUS, %asi
+
+ENTRY(NG4_retl_o2)
+        ba,pt   %xcc, __restore_asi
+         mov    %o2, %o0
+ENDPROC(NG4_retl_o2)
+ENTRY(NG4_retl_o2_plus_1)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, 1, %o0
+ENDPROC(NG4_retl_o2_plus_1)
+ENTRY(NG4_retl_o2_plus_4)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, 4, %o0
+ENDPROC(NG4_retl_o2_plus_4)
+ENTRY(NG4_retl_o2_plus_o5)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5)
+ENTRY(NG4_retl_o2_plus_o5_plus_4)
+        add     %o5, 4, %o5
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5_plus_4)
+ENTRY(NG4_retl_o2_plus_o5_plus_8)
+        add     %o5, 8, %o5
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5_plus_8)
+ENTRY(NG4_retl_o2_plus_o5_plus_16)
+        add     %o5, 16, %o5
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5_plus_16)
+ENTRY(NG4_retl_o2_plus_o5_plus_24)
+        add     %o5, 24, %o5
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5_plus_24)
+ENTRY(NG4_retl_o2_plus_o5_plus_32)
+        add     %o5, 32, %o5
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o5, %o0
+ENDPROC(NG4_retl_o2_plus_o5_plus_32)
+ENTRY(NG4_retl_o2_plus_g1)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %g1, %o0
+ENDPROC(NG4_retl_o2_plus_g1)
+ENTRY(NG4_retl_o2_plus_g1_plus_1)
+        add     %g1, 1, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %g1, %o0
+ENDPROC(NG4_retl_o2_plus_g1_plus_1)
+ENTRY(NG4_retl_o2_plus_g1_plus_8)
+        add     %g1, 8, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %g1, %o0
+ENDPROC(NG4_retl_o2_plus_g1_plus_8)
+ENTRY(NG4_retl_o2_plus_o4)
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4)
+ENTRY(NG4_retl_o2_plus_o4_plus_8)
+        add     %o4, 8, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_8)
+ENTRY(NG4_retl_o2_plus_o4_plus_16)
+        add     %o4, 16, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_16)
+ENTRY(NG4_retl_o2_plus_o4_plus_24)
+        add     %o4, 24, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_24)
+ENTRY(NG4_retl_o2_plus_o4_plus_32)
+        add     %o4, 32, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_32)
+ENTRY(NG4_retl_o2_plus_o4_plus_40)
+        add     %o4, 40, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_40)
+ENTRY(NG4_retl_o2_plus_o4_plus_48)
+        add     %o4, 48, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_48)
+ENTRY(NG4_retl_o2_plus_o4_plus_56)
+        add     %o4, 56, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_56)
+ENTRY(NG4_retl_o2_plus_o4_plus_64)
+        add     %o4, 64, %o4
+        ba,pt   %xcc, __restore_asi
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_64)
+ENTRY(NG4_retl_o2_plus_o4_fp)
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_8_fp)
+        add     %o4, 8, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_8_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_16_fp)
+        add     %o4, 16, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_16_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_24_fp)
+        add     %o4, 24, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_24_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_32_fp)
+        add     %o4, 32, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_32_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_40_fp)
+        add     %o4, 40, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_40_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_48_fp)
+        add     %o4, 48, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_48_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_56_fp)
+        add     %o4, 56, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_56_fp)
+ENTRY(NG4_retl_o2_plus_o4_plus_64_fp)
+        add     %o4, 64, %o4
+        ba,pt   %xcc, __restore_asi_fp
+         add    %o2, %o4, %o0
+ENDPROC(NG4_retl_o2_plus_o4_plus_64_fp)
+#endif
         .align          64
 
         .globl  FUNC_NAME
@@ -124,12 +274,13 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         brz,pt          %g1, 51f
          sub            %o2, %g1, %o2
 
-1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g2))
+
+1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1)
         add             %o1, 1, %o1
         subcc           %g1, 1, %g1
         add             %o0, 1, %o0
         bne,pt          %icc, 1b
-         EX_ST(STORE(stb, %g2, %o0 - 0x01))
+         EX_ST(STORE(stb, %g2, %o0 - 0x01), NG4_retl_o2_plus_g1_plus_1)
 
 51:     LOAD(prefetch, %o1 + 0x040, #n_reads_strong)
         LOAD(prefetch, %o1 + 0x080, #n_reads_strong)
@@ -154,43 +305,43 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         brz,pt          %g1, .Llarge_aligned
          sub            %o2, %g1, %o2
 
-1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g2))
+1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1)
         add             %o1, 8, %o1
         subcc           %g1, 8, %g1
         add             %o0, 8, %o0
         bne,pt          %icc, 1b
-         EX_ST(STORE(stx, %g2, %o0 - 0x08))
+         EX_ST(STORE(stx, %g2, %o0 - 0x08), NG4_retl_o2_plus_g1_plus_8)
 
 .Llarge_aligned:
         /* len >= 0x80 && src 8-byte aligned && dest 8-byte aligned */
         andn            %o2, 0x3f, %o4
         sub             %o2, %o4, %o2
 
-1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1))
+1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o4)
         add             %o1, 0x40, %o1
-        EX_LD(LOAD(ldx, %o1 - 0x38, %g2))
+        EX_LD(LOAD(ldx, %o1 - 0x38, %g2), NG4_retl_o2_plus_o4)
         subcc           %o4, 0x40, %o4
-        EX_LD(LOAD(ldx, %o1 - 0x30, %g3))
-        EX_LD(LOAD(ldx, %o1 - 0x28, GLOBAL_SPARE))
-        EX_LD(LOAD(ldx, %o1 - 0x20, %o5))
-        EX_ST(STORE_INIT(%g1, %o0))
+        EX_LD(LOAD(ldx, %o1 - 0x30, %g3), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD(LOAD(ldx, %o1 - 0x28, GLOBAL_SPARE), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD(LOAD(ldx, %o1 - 0x20, %o5), NG4_retl_o2_plus_o4_plus_64)
+        EX_ST(STORE_INIT(%g1, %o0), NG4_retl_o2_plus_o4_plus_64)
         add             %o0, 0x08, %o0
-        EX_ST(STORE_INIT(%g2, %o0))
+        EX_ST(STORE_INIT(%g2, %o0), NG4_retl_o2_plus_o4_plus_56)
         add             %o0, 0x08, %o0
-        EX_LD(LOAD(ldx, %o1 - 0x18, %g2))
-        EX_ST(STORE_INIT(%g3, %o0))
+        EX_LD(LOAD(ldx, %o1 - 0x18, %g2), NG4_retl_o2_plus_o4_plus_48)
+        EX_ST(STORE_INIT(%g3, %o0), NG4_retl_o2_plus_o4_plus_48)
         add             %o0, 0x08, %o0
-        EX_LD(LOAD(ldx, %o1 - 0x10, %g3))
-        EX_ST(STORE_INIT(GLOBAL_SPARE, %o0))
+        EX_LD(LOAD(ldx, %o1 - 0x10, %g3), NG4_retl_o2_plus_o4_plus_40)
+        EX_ST(STORE_INIT(GLOBAL_SPARE, %o0), NG4_retl_o2_plus_o4_plus_40)
         add             %o0, 0x08, %o0
-        EX_LD(LOAD(ldx, %o1 - 0x08, GLOBAL_SPARE))
-        EX_ST(STORE_INIT(%o5, %o0))
+        EX_LD(LOAD(ldx, %o1 - 0x08, GLOBAL_SPARE), NG4_retl_o2_plus_o4_plus_32)
+        EX_ST(STORE_INIT(%o5, %o0), NG4_retl_o2_plus_o4_plus_32)
         add             %o0, 0x08, %o0
-        EX_ST(STORE_INIT(%g2, %o0))
+        EX_ST(STORE_INIT(%g2, %o0), NG4_retl_o2_plus_o4_plus_24)
         add             %o0, 0x08, %o0
-        EX_ST(STORE_INIT(%g3, %o0))
+        EX_ST(STORE_INIT(%g3, %o0), NG4_retl_o2_plus_o4_plus_16)
         add             %o0, 0x08, %o0
-        EX_ST(STORE_INIT(GLOBAL_SPARE, %o0))
+        EX_ST(STORE_INIT(GLOBAL_SPARE, %o0), NG4_retl_o2_plus_o4_plus_8)
         add             %o0, 0x08, %o0
         bne,pt          %icc, 1b
          LOAD(prefetch, %o1 + 0x200, #n_reads_strong)
@@ -216,17 +367,17 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %o2, %o4, %o2
         alignaddr       %o1, %g0, %g1
         add             %o1, %o4, %o1
-        EX_LD_FP(LOAD(ldd, %g1 + 0x00, %f0))
-1:      EX_LD_FP(LOAD(ldd, %g1 + 0x08, %f2))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x00, %f0), NG4_retl_o2_plus_o4)
+1:      EX_LD_FP(LOAD(ldd, %g1 + 0x08, %f2), NG4_retl_o2_plus_o4)
         subcc           %o4, 0x40, %o4
-        EX_LD_FP(LOAD(ldd, %g1 + 0x10, %f4))
-        EX_LD_FP(LOAD(ldd, %g1 + 0x18, %f6))
-        EX_LD_FP(LOAD(ldd, %g1 + 0x20, %f8))
-        EX_LD_FP(LOAD(ldd, %g1 + 0x28, %f10))
-        EX_LD_FP(LOAD(ldd, %g1 + 0x30, %f12))
-        EX_LD_FP(LOAD(ldd, %g1 + 0x38, %f14))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x10, %f4), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD_FP(LOAD(ldd, %g1 + 0x18, %f6), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD_FP(LOAD(ldd, %g1 + 0x20, %f8), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD_FP(LOAD(ldd, %g1 + 0x28, %f10), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD_FP(LOAD(ldd, %g1 + 0x30, %f12), NG4_retl_o2_plus_o4_plus_64)
+        EX_LD_FP(LOAD(ldd, %g1 + 0x38, %f14), NG4_retl_o2_plus_o4_plus_64)
         faligndata      %f0, %f2, %f16
-        EX_LD_FP(LOAD(ldd, %g1 + 0x40, %f0))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x40, %f0), NG4_retl_o2_plus_o4_plus_64)
         faligndata      %f2, %f4, %f18
         add             %g1, 0x40, %g1
         faligndata      %f4, %f6, %f20
@@ -235,14 +386,14 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         faligndata      %f10, %f12, %f26
         faligndata      %f12, %f14, %f28
         faligndata      %f14, %f0, %f30
-        EX_ST_FP(STORE(std, %f16, %o0 + 0x00))
-        EX_ST_FP(STORE(std, %f18, %o0 + 0x08))
-        EX_ST_FP(STORE(std, %f20, %o0 + 0x10))
-        EX_ST_FP(STORE(std, %f22, %o0 + 0x18))
-        EX_ST_FP(STORE(std, %f24, %o0 + 0x20))
-        EX_ST_FP(STORE(std, %f26, %o0 + 0x28))
-        EX_ST_FP(STORE(std, %f28, %o0 + 0x30))
-        EX_ST_FP(STORE(std, %f30, %o0 + 0x38))
+        EX_ST_FP(STORE(std, %f16, %o0 + 0x00), NG4_retl_o2_plus_o4_plus_64)
+        EX_ST_FP(STORE(std, %f18, %o0 + 0x08), NG4_retl_o2_plus_o4_plus_56)
+        EX_ST_FP(STORE(std, %f20, %o0 + 0x10), NG4_retl_o2_plus_o4_plus_48)
+        EX_ST_FP(STORE(std, %f22, %o0 + 0x18), NG4_retl_o2_plus_o4_plus_40)
+        EX_ST_FP(STORE(std, %f24, %o0 + 0x20), NG4_retl_o2_plus_o4_plus_32)
+        EX_ST_FP(STORE(std, %f26, %o0 + 0x28), NG4_retl_o2_plus_o4_plus_24)
+        EX_ST_FP(STORE(std, %f28, %o0 + 0x30), NG4_retl_o2_plus_o4_plus_16)
+        EX_ST_FP(STORE(std, %f30, %o0 + 0x38), NG4_retl_o2_plus_o4_plus_8)
         add             %o0, 0x40, %o0
         bne,pt          %icc, 1b
          LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
@@ -270,37 +421,38 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         andncc          %o2, 0x20 - 1, %o5
         be,pn           %icc, 2f
          sub            %o2, %o5, %o2
-1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1))
-        EX_LD(LOAD(ldx, %o1 + 0x08, %g2))
-        EX_LD(LOAD(ldx, %o1 + 0x10, GLOBAL_SPARE))
-        EX_LD(LOAD(ldx, %o1 + 0x18, %o4))
+1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5)
+        EX_LD(LOAD(ldx, %o1 + 0x08, %g2), NG4_retl_o2_plus_o5)
+        EX_LD(LOAD(ldx, %o1 + 0x10, GLOBAL_SPARE), NG4_retl_o2_plus_o5)
+        EX_LD(LOAD(ldx, %o1 + 0x18, %o4), NG4_retl_o2_plus_o5)
         add             %o1, 0x20, %o1
         subcc           %o5, 0x20, %o5
-        EX_ST(STORE(stx, %g1, %o0 + 0x00))
-        EX_ST(STORE(stx, %g2, %o0 + 0x08))
-        EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10))
-        EX_ST(STORE(stx, %o4, %o0 + 0x18))
+        EX_ST(STORE(stx, %g1, %o0 + 0x00), NG4_retl_o2_plus_o5_plus_32)
+        EX_ST(STORE(stx, %g2, %o0 + 0x08), NG4_retl_o2_plus_o5_plus_24)
+        EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), NG4_retl_o2_plus_o5_plus_24)
+        EX_ST(STORE(stx, %o4, %o0 + 0x18), NG4_retl_o2_plus_o5_plus_8)
         bne,pt          %icc, 1b
          add            %o0, 0x20, %o0
 2:      andcc           %o2, 0x18, %o5
         be,pt           %icc, 3f
          sub            %o2, %o5, %o2
-1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1))
+
+1:      EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5)
         add             %o1, 0x08, %o1
         add             %o0, 0x08, %o0
         subcc           %o5, 0x08, %o5
         bne,pt          %icc, 1b
-         EX_ST(STORE(stx, %g1, %o0 - 0x08))
+         EX_ST(STORE(stx, %g1, %o0 - 0x08), NG4_retl_o2_plus_o5_plus_8)
 3:      brz,pt          %o2, .Lexit
          cmp            %o2, 0x04
         bl,pn           %icc, .Ltiny
          nop
-        EX_LD(LOAD(lduw, %o1 + 0x00, %g1))
+        EX_LD(LOAD(lduw, %o1 + 0x00, %g1), NG4_retl_o2)
         add             %o1, 0x04, %o1
         add             %o0, 0x04, %o0
         subcc           %o2, 0x04, %o2
         bne,pn          %icc, .Ltiny
-         EX_ST(STORE(stw, %g1, %o0 - 0x04))
+         EX_ST(STORE(stw, %g1, %o0 - 0x04), NG4_retl_o2_plus_4)
         ba,a,pt         %icc, .Lexit
 .Lmedium_unaligned:
         /* First get dest 8 byte aligned.  */
@@ -309,12 +461,12 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         brz,pt          %g1, 2f
          sub            %o2, %g1, %o2
 
-1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g2))
+1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1)
         add             %o1, 1, %o1
         subcc           %g1, 1, %g1
         add             %o0, 1, %o0
         bne,pt          %icc, 1b
-         EX_ST(STORE(stb, %g2, %o0 - 0x01))
+         EX_ST(STORE(stb, %g2, %o0 - 0x01), NG4_retl_o2_plus_g1_plus_1)
 2:
         and             %o1, 0x7, %g1
         brz,pn          %g1, .Lmedium_noprefetch
@@ -322,16 +474,16 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         mov             64, %g2
         sub             %g2, %g1, %g2
         andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1 + 0x00, %o4))
+        EX_LD(LOAD(ldx, %o1 + 0x00, %o4), NG4_retl_o2)
         sllx            %o4, %g1, %o4
         andn            %o2, 0x08 - 1, %o5
         sub             %o2, %o5, %o2
-1:      EX_LD(LOAD(ldx, %o1 + 0x08, %g3))
+1:      EX_LD(LOAD(ldx, %o1 + 0x08, %g3), NG4_retl_o2_plus_o5)
         add             %o1, 0x08, %o1
         subcc           %o5, 0x08, %o5
         srlx            %g3, %g2, GLOBAL_SPARE
         or              GLOBAL_SPARE, %o4, GLOBAL_SPARE
-        EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x00))
+        EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x00), NG4_retl_o2_plus_o5_plus_8)
         add             %o0, 0x08, %o0
         bne,pt          %icc, 1b
          sllx           %g3, %g1, %o4
@@ -342,17 +494,17 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         ba,pt           %icc, .Lsmall_unaligned
 
 .Ltiny:
-        EX_LD(LOAD(ldub, %o1 + 0x00, %g1))
+        EX_LD(LOAD(ldub, %o1 + 0x00, %g1), NG4_retl_o2)
         subcc           %o2, 1, %o2
         be,pn           %icc, .Lexit
-         EX_ST(STORE(stb, %g1, %o0 + 0x00))
-        EX_LD(LOAD(ldub, %o1 + 0x01, %g1))
+         EX_ST(STORE(stb, %g1, %o0 + 0x00), NG4_retl_o2_plus_1)
+        EX_LD(LOAD(ldub, %o1 + 0x01, %g1), NG4_retl_o2)
         subcc           %o2, 1, %o2
         be,pn           %icc, .Lexit
-         EX_ST(STORE(stb, %g1, %o0 + 0x01))
-        EX_LD(LOAD(ldub, %o1 + 0x02, %g1))
+         EX_ST(STORE(stb, %g1, %o0 + 0x01), NG4_retl_o2_plus_1)
+        EX_LD(LOAD(ldub, %o1 + 0x02, %g1), NG4_retl_o2)
         ba,pt           %icc, .Lexit
-         EX_ST(STORE(stb, %g1, %o0 + 0x02))
+         EX_ST(STORE(stb, %g1, %o0 + 0x02), NG4_retl_o2)
 
 .Lsmall:
         andcc           %g2, 0x3, %g0
@@ -360,22 +512,22 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          andn           %o2, 0x4 - 1, %o5
         sub             %o2, %o5, %o2
 1:
-        EX_LD(LOAD(lduw, %o1 + 0x00, %g1))
+        EX_LD(LOAD(lduw, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5)
         add             %o1, 0x04, %o1
         subcc           %o5, 0x04, %o5
         add             %o0, 0x04, %o0
         bne,pt          %icc, 1b
-         EX_ST(STORE(stw, %g1, %o0 - 0x04))
+         EX_ST(STORE(stw, %g1, %o0 - 0x04), NG4_retl_o2_plus_o5_plus_4)
         brz,pt          %o2, .Lexit
          nop
         ba,a,pt         %icc, .Ltiny
 
 .Lsmall_unaligned:
-1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g1))
+1:      EX_LD(LOAD(ldub, %o1 + 0x00, %g1), NG4_retl_o2)
         add             %o1, 1, %o1
         add             %o0, 1, %o0
         subcc           %o2, 1, %o2
         bne,pt          %icc, 1b
-         EX_ST(STORE(stb, %g1, %o0 - 0x01))
+         EX_ST(STORE(stb, %g1, %o0 - 0x01), NG4_retl_o2_plus_1)
         ba,a,pt         %icc, .Lexit
         .size           FUNC_NAME, .-FUNC_NAME
diff --git a/arch/sparc/lib/NGcopy_from_user.S b/arch/sparc/lib/NGcopy_from_user.S
index 5d1e4d1ac21e..9cd42fcbc781 100644
--- a/arch/sparc/lib/NGcopy_from_user.S
+++ b/arch/sparc/lib/NGcopy_from_user.S
@@ -3,11 +3,11 @@
  * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __ret_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NGcopy_to_user.S b/arch/sparc/lib/NGcopy_to_user.S
index ff630dcb273c..5c358afd464e 100644
--- a/arch/sparc/lib/NGcopy_to_user.S
+++ b/arch/sparc/lib/NGcopy_to_user.S
@@ -3,11 +3,11 @@
  * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __ret_one_asi;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index 96a14caf6966..d88c4ed50a00 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -4,6 +4,7 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #include <asm/asi.h>
 #include <asm/thread_info.h>
 #define GLOBAL_SPARE    %g7
@@ -27,15 +28,11 @@
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
-#endif
-
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
+#define EX_ST(x,y)      x
 #endif
 
 #ifndef LOAD
@@ -79,6 +76,92 @@
         .register       %g3,#scratch
 
         .text
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+__restore_asi:
+        ret
+        wr      %g0, ASI_AIUS, %asi
+         restore
+ENTRY(NG_ret_i2_plus_i4_plus_1)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %i5, %i0
+ENDPROC(NG_ret_i2_plus_i4_plus_1)
+ENTRY(NG_ret_i2_plus_g1)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1)
+ENTRY(NG_ret_i2_plus_g1_minus_8)
+        sub     %g1, 8, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_8)
+ENTRY(NG_ret_i2_plus_g1_minus_16)
+        sub     %g1, 16, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_16)
+ENTRY(NG_ret_i2_plus_g1_minus_24)
+        sub     %g1, 24, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_24)
+ENTRY(NG_ret_i2_plus_g1_minus_32)
+        sub     %g1, 32, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_32)
+ENTRY(NG_ret_i2_plus_g1_minus_40)
+        sub     %g1, 40, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_40)
+ENTRY(NG_ret_i2_plus_g1_minus_48)
+        sub     %g1, 48, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_48)
+ENTRY(NG_ret_i2_plus_g1_minus_56)
+        sub     %g1, 56, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_minus_56)
+ENTRY(NG_ret_i2_plus_i4)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %i4, %i0
+ENDPROC(NG_ret_i2_plus_i4)
+ENTRY(NG_ret_i2_plus_i4_minus_8)
+        sub     %i4, 8, %i4
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %i4, %i0
+ENDPROC(NG_ret_i2_plus_i4_minus_8)
+ENTRY(NG_ret_i2_plus_8)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, 8, %i0
+ENDPROC(NG_ret_i2_plus_8)
+ENTRY(NG_ret_i2_plus_4)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, 4, %i0
+ENDPROC(NG_ret_i2_plus_4)
+ENTRY(NG_ret_i2_plus_1)
+        ba,pt   %xcc, __restore_asi
+         add    %i2, 1, %i0
+ENDPROC(NG_ret_i2_plus_1)
+ENTRY(NG_ret_i2_plus_g1_plus_1)
+        add     %g1, 1, %g1
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %g1, %i0
+ENDPROC(NG_ret_i2_plus_g1_plus_1)
+ENTRY(NG_ret_i2)
+        ba,pt   %xcc, __restore_asi
+         mov    %i2, %i0
+ENDPROC(NG_ret_i2)
+ENTRY(NG_ret_i2_and_7_plus_i4)
+        and     %i2, 7, %i2
+        ba,pt   %xcc, __restore_asi
+         add    %i2, %i4, %i0
+ENDPROC(NG_ret_i2_and_7_plus_i4)
+#endif
+
         .align          64
 
         .globl  FUNC_NAME
@@ -126,8 +209,8 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         sub             %g0, %i4, %i4   ! bytes to align dst
         sub             %i2, %i4, %i2
 1:      subcc           %i4, 1, %i4
-        EX_LD(LOAD(ldub, %i1, %g1))
-        EX_ST(STORE(stb, %g1, %o0))
+        EX_LD(LOAD(ldub, %i1, %g1), NG_ret_i2_plus_i4_plus_1)
+        EX_ST(STORE(stb, %g1, %o0), NG_ret_i2_plus_i4_plus_1)
         add             %i1, 1, %i1
         bne,pt          %XCC, 1b
         add             %o0, 1, %o0
@@ -160,7 +243,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         and             %i4, 0x7, GLOBAL_SPARE
         sll             GLOBAL_SPARE, 3, GLOBAL_SPARE
         mov             64, %i5
-        EX_LD(LOAD_TWIN(%i1, %g2, %g3))
+        EX_LD(LOAD_TWIN(%i1, %g2, %g3), NG_ret_i2_plus_g1)
         sub             %i5, GLOBAL_SPARE, %i5
         mov             16, %o4
         mov             32, %o5
@@ -178,31 +261,31 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         srlx            WORD3, PRE_SHIFT, TMP; \
         or              WORD2, TMP, WORD2;
 
-8:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+8:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3), NG_ret_i2_plus_g1)
         MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
         LOAD(prefetch, %i1 + %i3, #one_read)
 
-        EX_ST(STORE_INIT(%g2, %o0 + 0x00))
-        EX_ST(STORE_INIT(%g3, %o0 + 0x08))
+        EX_ST(STORE_INIT(%g2, %o0 + 0x00), NG_ret_i2_plus_g1)
+        EX_ST(STORE_INIT(%g3, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8)
 
-        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3), NG_ret_i2_plus_g1_minus_16)
         MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%o2, %o0 + 0x10))
-        EX_ST(STORE_INIT(%o3, %o0 + 0x18))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%o3, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24)
 
-        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1_minus_32)
         MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%g2, %o0 + 0x20))
-        EX_ST(STORE_INIT(%g3, %o0 + 0x28))
+        EX_ST(STORE_INIT(%g2, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32)
+        EX_ST(STORE_INIT(%g3, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40)
 
-        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3), NG_ret_i2_plus_g1_minus_48)
         add             %i1, 64, %i1
         MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%o2, %o0 + 0x30))
-        EX_ST(STORE_INIT(%o3, %o0 + 0x38))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48)
+        EX_ST(STORE_INIT(%o3, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56)
 
         subcc           %g1, 64, %g1
         bne,pt          %XCC, 8b
@@ -211,31 +294,31 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         ba,pt           %XCC, 60f
          add            %i1, %i4, %i1
 
-9:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+9:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3), NG_ret_i2_plus_g1)
         MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
         LOAD(prefetch, %i1 + %i3, #one_read)
 
-        EX_ST(STORE_INIT(%g3, %o0 + 0x00))
-        EX_ST(STORE_INIT(%o2, %o0 + 0x08))
+        EX_ST(STORE_INIT(%g3, %o0 + 0x00), NG_ret_i2_plus_g1)
+        EX_ST(STORE_INIT(%o2, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8)
 
-        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3), NG_ret_i2_plus_g1_minus_16)
         MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%o3, %o0 + 0x10))
-        EX_ST(STORE_INIT(%g2, %o0 + 0x18))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%g2, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24)
 
-        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1_minus_32)
         MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%g3, %o0 + 0x20))
-        EX_ST(STORE_INIT(%o2, %o0 + 0x28))
+        EX_ST(STORE_INIT(%g3, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32)
+        EX_ST(STORE_INIT(%o2, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40)
 
-        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3), NG_ret_i2_plus_g1_minus_48)
         add             %i1, 64, %i1
         MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
 
-        EX_ST(STORE_INIT(%o3, %o0 + 0x30))
-        EX_ST(STORE_INIT(%g2, %o0 + 0x38))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48)
+        EX_ST(STORE_INIT(%g2, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56)
 
         subcc           %g1, 64, %g1
         bne,pt          %XCC, 9b
@@ -249,25 +332,25 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
          * one twin load ahead, then add 8 back into source when
          * we finish the loop.
          */
-        EX_LD(LOAD_TWIN(%i1, %o4, %o5))
+        EX_LD(LOAD_TWIN(%i1, %o4, %o5), NG_ret_i2_plus_g1)
         mov     16, %o7
         mov     32, %g2
         mov     48, %g3
         mov     64, %o1
-1:      EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+1:      EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1)
         LOAD(prefetch, %i1 + %o1, #one_read)
-        EX_ST(STORE_INIT(%o5, %o0 + 0x00))      ! initializes cache line
-        EX_ST(STORE_INIT(%o2, %o0 + 0x08))
-        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
-        EX_ST(STORE_INIT(%o3, %o0 + 0x10))
-        EX_ST(STORE_INIT(%o4, %o0 + 0x18))
-        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
-        EX_ST(STORE_INIT(%o5, %o0 + 0x20))
-        EX_ST(STORE_INIT(%o2, %o0 + 0x28))
-        EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5))
+        EX_ST(STORE_INIT(%o5, %o0 + 0x00), NG_ret_i2_plus_g1)   ! initializes cache line
+        EX_ST(STORE_INIT(%o2, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8)
+        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%o3, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%o4, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24)
+        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3), NG_ret_i2_plus_g1_minus_32)
+        EX_ST(STORE_INIT(%o5, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32)
+        EX_ST(STORE_INIT(%o2, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40)
+        EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5), NG_ret_i2_plus_g1_minus_48)
         add             %i1, 64, %i1
-        EX_ST(STORE_INIT(%o3, %o0 + 0x30))
-        EX_ST(STORE_INIT(%o4, %o0 + 0x38))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48)
+        EX_ST(STORE_INIT(%o4, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56)
         subcc           %g1, 64, %g1
         bne,pt          %XCC, 1b
          add            %o0, 64, %o0
@@ -282,20 +365,20 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         mov     32, %g2
         mov     48, %g3
         mov     64, %o1
-1:      EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5))
-        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+1:      EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5), NG_ret_i2_plus_g1)
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1)
         LOAD(prefetch, %i1 + %o1, #one_read)
-        EX_ST(STORE_INIT(%o4, %o0 + 0x00))      ! initializes cache line
-        EX_ST(STORE_INIT(%o5, %o0 + 0x08))
-        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
-        EX_ST(STORE_INIT(%o2, %o0 + 0x10))
-        EX_ST(STORE_INIT(%o3, %o0 + 0x18))
-        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
+        EX_ST(STORE_INIT(%o4, %o0 + 0x00), NG_ret_i2_plus_g1)   ! initializes cache line
+        EX_ST(STORE_INIT(%o5, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8)
+        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%o2, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16)
+        EX_ST(STORE_INIT(%o3, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24)
+        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3), NG_ret_i2_plus_g1_minus_32)
         add     %i1, 64, %i1
-        EX_ST(STORE_INIT(%o4, %o0 + 0x20))
-        EX_ST(STORE_INIT(%o5, %o0 + 0x28))
-        EX_ST(STORE_INIT(%o2, %o0 + 0x30))
-        EX_ST(STORE_INIT(%o3, %o0 + 0x38))
+        EX_ST(STORE_INIT(%o4, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32)
+        EX_ST(STORE_INIT(%o5, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40)
+        EX_ST(STORE_INIT(%o2, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48)
+        EX_ST(STORE_INIT(%o3, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56)
         subcc   %g1, 64, %g1
         bne,pt  %XCC, 1b
          add    %o0, 64, %o0
@@ -321,28 +404,28 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         andn            %i2, 0xf, %i4
         and             %i2, 0xf, %i2
 1:      subcc           %i4, 0x10, %i4
-        EX_LD(LOAD(ldx, %i1, %o4))
+        EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
         add             %i1, 0x08, %i1
-        EX_LD(LOAD(ldx, %i1, %g1))
+        EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
         sub             %i1, 0x08, %i1
-        EX_ST(STORE(stx, %o4, %i1 + %i3))
+        EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
         add             %i1, 0x8, %i1
-        EX_ST(STORE(stx, %g1, %i1 + %i3))
+        EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
         bgu,pt          %XCC, 1b
          add            %i1, 0x8, %i1
 73:     andcc           %i2, 0x8, %g0
         be,pt           %XCC, 1f
          nop
         sub             %i2, 0x8, %i2
-        EX_LD(LOAD(ldx, %i1, %o4))
-        EX_ST(STORE(stx, %o4, %i1 + %i3))
+        EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_8)
+        EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_8)
         add             %i1, 0x8, %i1
 1:      andcc           %i2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
         sub             %i2, 0x4, %i2
-        EX_LD(LOAD(lduw, %i1, %i5))
-        EX_ST(STORE(stw, %i5, %i1 + %i3))
+        EX_LD(LOAD(lduw, %i1, %i5), NG_ret_i2_plus_4)
+        EX_ST(STORE(stw, %i5, %i1 + %i3), NG_ret_i2_plus_4)
         add             %i1, 0x4, %i1
 1:      cmp             %i2, 0
         be,pt           %XCC, 85f
@@ -358,8 +441,8 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         sub             %i2, %g1, %i2
 
 1:      subcc           %g1, 1, %g1
-        EX_LD(LOAD(ldub, %i1, %i5))
-        EX_ST(STORE(stb, %i5, %i1 + %i3))
+        EX_LD(LOAD(ldub, %i1, %i5), NG_ret_i2_plus_g1_plus_1)
+        EX_ST(STORE(stb, %i5, %i1 + %i3), NG_ret_i2_plus_g1_plus_1)
         bgu,pt          %icc, 1b
          add            %i1, 1, %i1
 
@@ -375,16 +458,16 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 
 8:      mov             64, %i3
         andn            %i1, 0x7, %i1
-        EX_LD(LOAD(ldx, %i1, %g2))
+        EX_LD(LOAD(ldx, %i1, %g2), NG_ret_i2)
         sub             %i3, %g1, %i3
         andn            %i2, 0x7, %i4
         sllx            %g2, %g1, %g2
 1:      add             %i1, 0x8, %i1
-        EX_LD(LOAD(ldx, %i1, %g3))
+        EX_LD(LOAD(ldx, %i1, %g3), NG_ret_i2_and_7_plus_i4)
         subcc           %i4, 0x8, %i4
         srlx            %g3, %i3, %i5
         or              %i5, %g2, %i5
-        EX_ST(STORE(stx, %i5, %o0))
+        EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
         add             %o0, 0x8, %o0
         bgu,pt          %icc, 1b
          sllx           %g3, %g1, %g2
@@ -404,8 +487,8 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 
 1:
         subcc           %i2, 4, %i2
-        EX_LD(LOAD(lduw, %i1, %g1))
-        EX_ST(STORE(stw, %g1, %i1 + %i3))
+        EX_LD(LOAD(lduw, %i1, %g1), NG_ret_i2_plus_4)
+        EX_ST(STORE(stw, %g1, %i1 + %i3), NG_ret_i2_plus_4)
         bgu,pt          %XCC, 1b
          add            %i1, 4, %i1
 
@@ -415,8 +498,8 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         .align          32
 90:
         subcc           %i2, 1, %i2
-        EX_LD(LOAD(ldub, %i1, %g1))
-        EX_ST(STORE(stb, %g1, %i1 + %i3))
+        EX_LD(LOAD(ldub, %i1, %g1), NG_ret_i2_plus_1)
+        EX_ST(STORE(stb, %g1, %i1 + %i3), NG_ret_i2_plus_1)
         bgu,pt          %XCC, 90b
          add            %i1, 1, %i1
         ret
diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S
index ecc5692fa2b4..bb6ff73229e3 100644
--- a/arch/sparc/lib/U1copy_from_user.S
+++ b/arch/sparc/lib/U1copy_from_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_LD_FP(x)             \
+#define EX_LD_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_fp;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S
index 9eea392e44d4..ed92ce739558 100644
--- a/arch/sparc/lib/U1copy_to_user.S
+++ b/arch/sparc/lib/U1copy_to_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_ST_FP(x)             \
+#define EX_ST_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_fp;\
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
index 97e1b211090c..4f0d50b33a72 100644
--- a/arch/sparc/lib/U1memcpy.S
+++ b/arch/sparc/lib/U1memcpy.S
@@ -5,6 +5,7 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #include <asm/export.h>
@@ -24,21 +25,17 @@
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 #ifndef EX_LD_FP
-#define EX_LD_FP(x)     x
+#define EX_LD_FP(x,y)   x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
+#define EX_ST(x,y)      x
 #endif
 #ifndef EX_ST_FP
-#define EX_ST_FP(x)     x
-#endif
-
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
+#define EX_ST_FP(x,y)   x
 #endif
 
 #ifndef LOAD
@@ -79,53 +76,169 @@
         faligndata              %f7, %f8, %f60;                 \
         faligndata              %f8, %f9, %f62;
 
-#define MAIN_LOOP_CHUNK(src, dest, fdest, fsrc, len, jmptgt)    \
-        EX_LD_FP(LOAD_BLK(%src, %fdest));                               \
-        EX_ST_FP(STORE_BLK(%fsrc, %dest));                              \
-        add                     %src, 0x40, %src;               \
-        subcc                   %len, 0x40, %len;               \
-        be,pn                   %xcc, jmptgt;                   \
-         add                    %dest, 0x40, %dest;             \
-
-#define LOOP_CHUNK1(src, dest, len, branch_dest)                \
-        MAIN_LOOP_CHUNK(src, dest, f0,  f48, len, branch_dest)
-#define LOOP_CHUNK2(src, dest, len, branch_dest)                \
-        MAIN_LOOP_CHUNK(src, dest, f16, f48, len, branch_dest)
-#define LOOP_CHUNK3(src, dest, len, branch_dest)                \
-        MAIN_LOOP_CHUNK(src, dest, f32, f48, len, branch_dest)
+#define MAIN_LOOP_CHUNK(src, dest, fdest, fsrc, jmptgt)                 \
+        EX_LD_FP(LOAD_BLK(%src, %fdest), U1_gs_80_fp);                  \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_80_fp);                 \
+        add                     %src, 0x40, %src;                       \
+        subcc                   %GLOBAL_SPARE, 0x40, %GLOBAL_SPARE;     \
+        be,pn                   %xcc, jmptgt;                           \
+         add                    %dest, 0x40, %dest;                     \
+
+#define LOOP_CHUNK1(src, dest, branch_dest)             \
+        MAIN_LOOP_CHUNK(src, dest, f0,  f48, branch_dest)
+#define LOOP_CHUNK2(src, dest, branch_dest)             \
+        MAIN_LOOP_CHUNK(src, dest, f16, f48, branch_dest)
+#define LOOP_CHUNK3(src, dest, branch_dest)             \
+        MAIN_LOOP_CHUNK(src, dest, f32, f48, branch_dest)
 
 #define DO_SYNC                 membar  #Sync;
 #define STORE_SYNC(dest, fsrc)                          \
-        EX_ST_FP(STORE_BLK(%fsrc, %dest));                      \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_80_fp); \
         add                     %dest, 0x40, %dest;     \
         DO_SYNC
 
 #define STORE_JUMP(dest, fsrc, target)                  \
-        EX_ST_FP(STORE_BLK(%fsrc, %dest));                      \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_40_fp); \
         add                     %dest, 0x40, %dest;     \
         ba,pt                   %xcc, target;           \
          nop;
 
-#define FINISH_VISCHUNK(dest, f0, f1, left)     \
-        subcc                   %left, 8, %left;\
-        bl,pn                   %xcc, 95f;      \
-         faligndata             %f0, %f1, %f48; \
-        EX_ST_FP(STORE(std, %f48, %dest));              \
+#define FINISH_VISCHUNK(dest, f0, f1)                   \
+        subcc                   %g3, 8, %g3;            \
+        bl,pn                   %xcc, 95f;              \
+         faligndata             %f0, %f1, %f48;         \
+        EX_ST_FP(STORE(std, %f48, %dest), U1_g3_8_fp);  \
         add                     %dest, 8, %dest;
 
-#define UNEVEN_VISCHUNK_LAST(dest, f0, f1, left)        \
-        subcc                   %left, 8, %left;        \
-        bl,pn                   %xcc, 95f;              \
+#define UNEVEN_VISCHUNK_LAST(dest, f0, f1)      \
+        subcc                   %g3, 8, %g3;    \
+        bl,pn                   %xcc, 95f;      \
          fsrc2                  %f0, %f1;
 
-#define UNEVEN_VISCHUNK(dest, f0, f1, left)             \
-        UNEVEN_VISCHUNK_LAST(dest, f0, f1, left)        \
+#define UNEVEN_VISCHUNK(dest, f0, f1)           \
+        UNEVEN_VISCHUNK_LAST(dest, f0, f1)      \
         ba,a,pt                 %xcc, 93f;
 
         .register       %g2,#scratch
         .register       %g3,#scratch
 
         .text
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+ENTRY(U1_g1_1_fp)
+        VISExitHalf
+        add             %g1, 1, %g1
+        add             %g1, %g2, %g1
+        retl
+         add            %g1, %o2, %o0
+ENDPROC(U1_g1_1_fp)
+ENTRY(U1_g2_0_fp)
+        VISExitHalf
+        retl
+         add            %g2, %o2, %o0
+ENDPROC(U1_g2_0_fp)
+ENTRY(U1_g2_8_fp)
+        VISExitHalf
+        add             %g2, 8, %g2
+        retl
+         add            %g2, %o2, %o0
+ENDPROC(U1_g2_8_fp)
+ENTRY(U1_gs_0_fp)
+        VISExitHalf
+        add             %GLOBAL_SPARE, %g3, %o0
+        retl
+         add            %o0, %o2, %o0
+ENDPROC(U1_gs_0_fp)
+ENTRY(U1_gs_80_fp)
+        VISExitHalf
+        add             %GLOBAL_SPARE, 0x80, %GLOBAL_SPARE
+        add             %GLOBAL_SPARE, %g3, %o0
+        retl
+         add            %o0, %o2, %o0
+ENDPROC(U1_gs_80_fp)
+ENTRY(U1_gs_40_fp)
+        VISExitHalf
+        add             %GLOBAL_SPARE, 0x40, %GLOBAL_SPARE
+        add             %GLOBAL_SPARE, %g3, %o0
+        retl
+         add            %o0, %o2, %o0
+ENDPROC(U1_gs_40_fp)
+ENTRY(U1_g3_0_fp)
+        VISExitHalf
+        retl
+         add            %g3, %o2, %o0
+ENDPROC(U1_g3_0_fp)
+ENTRY(U1_g3_8_fp)
+        VISExitHalf
+        add             %g3, 8, %g3
+        retl
+         add            %g3, %o2, %o0
+ENDPROC(U1_g3_8_fp)
+ENTRY(U1_o2_0_fp)
+        VISExitHalf
+        retl
+         mov            %o2, %o0
+ENDPROC(U1_o2_0_fp)
+ENTRY(U1_o2_1_fp)
+        VISExitHalf
+        retl
+         add            %o2, 1, %o0
+ENDPROC(U1_o2_1_fp)
+ENTRY(U1_gs_0)
+        VISExitHalf
+        retl
+         add            %GLOBAL_SPARE, %o2, %o0
+ENDPROC(U1_gs_0)
+ENTRY(U1_gs_8)
+        VISExitHalf
+        add             %GLOBAL_SPARE, %o2, %GLOBAL_SPARE
+        retl
+         add            %GLOBAL_SPARE, 0x8, %o0
+ENDPROC(U1_gs_8)
+ENTRY(U1_gs_10)
+        VISExitHalf
+        add             %GLOBAL_SPARE, %o2, %GLOBAL_SPARE
+        retl
+         add            %GLOBAL_SPARE, 0x10, %o0
+ENDPROC(U1_gs_10)
+ENTRY(U1_o2_0)
+        retl
+         mov            %o2, %o0
+ENDPROC(U1_o2_0)
+ENTRY(U1_o2_8)
+        retl
+         add            %o2, 8, %o0
+ENDPROC(U1_o2_8)
+ENTRY(U1_o2_4)
+        retl
+         add            %o2, 4, %o0
+ENDPROC(U1_o2_4)
+ENTRY(U1_o2_1)
+        retl
+         add            %o2, 1, %o0
+ENDPROC(U1_o2_1)
+ENTRY(U1_g1_0)
+        retl
+         add            %g1, %o2, %o0
+ENDPROC(U1_g1_0)
+ENTRY(U1_g1_1)
+        add             %g1, 1, %g1
+        retl
+         add            %g1, %o2, %o0
+ENDPROC(U1_g1_1)
+ENTRY(U1_gs_0_o2_adj)
+        and             %o2, 7, %o2
+        retl
+         add            %GLOBAL_SPARE, %o2, %o0
+ENDPROC(U1_gs_0_o2_adj)
+ENTRY(U1_gs_8_o2_adj)
+        and             %o2, 7, %o2
+        add             %GLOBAL_SPARE, 8, %GLOBAL_SPARE
+        retl
+         add            %GLOBAL_SPARE, %o2, %o0
+ENDPROC(U1_gs_8_o2_adj)
+#endif
+
         .align          64
 
         .globl          FUNC_NAME
@@ -167,8 +280,8 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
          and            %g2, 0x38, %g2
 
 1:      subcc           %g1, 0x1, %g1
-        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3))
-        EX_ST_FP(STORE(stb, %o3, %o1 + %GLOBAL_SPARE))
+        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3), U1_g1_1_fp)
+        EX_ST_FP(STORE(stb, %o3, %o1 + %GLOBAL_SPARE), U1_g1_1_fp)
         bgu,pt          %XCC, 1b
          add            %o1, 0x1, %o1
 
@@ -179,20 +292,20 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         be,pt           %icc, 3f
          alignaddr      %o1, %g0, %o1
 
-        EX_LD_FP(LOAD(ldd, %o1, %f4))
-1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6))
+        EX_LD_FP(LOAD(ldd, %o1, %f4), U1_g2_0_fp)
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6), U1_g2_0_fp)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f4, %f6, %f0
-        EX_ST_FP(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0), U1_g2_8_fp)
         be,pn           %icc, 3f
          add            %o0, 0x8, %o0
 
-        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4), U1_g2_0_fp)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f6, %f4, %f0
-        EX_ST_FP(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0), U1_g2_8_fp)
         bne,pt          %icc, 1b
          add            %o0, 0x8, %o0
 
@@ -215,13 +328,13 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         add             %g1, %GLOBAL_SPARE, %g1
         subcc           %o2, %g3, %o2
 
-        EX_LD_FP(LOAD_BLK(%o1, %f0))
+        EX_LD_FP(LOAD_BLK(%o1, %f0), U1_gs_0_fp)
         add             %o1, 0x40, %o1
         add             %g1, %g3, %g1
-        EX_LD_FP(LOAD_BLK(%o1, %f16))
+        EX_LD_FP(LOAD_BLK(%o1, %f16), U1_gs_0_fp)
         add             %o1, 0x40, %o1
         sub             %GLOBAL_SPARE, 0x80, %GLOBAL_SPARE
-        EX_LD_FP(LOAD_BLK(%o1, %f32))
+        EX_LD_FP(LOAD_BLK(%o1, %f32), U1_gs_80_fp)
         add             %o1, 0x40, %o1
 
         /* There are 8 instances of the unrolled loop,
@@ -241,11 +354,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 
         .align          64
 1:      FREG_FROB(f0, f2, f4, f6, f8, f10,f12,f14,f16)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f16,f18,f20,f22,f24,f26,f28,f30,f32)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f32,f34,f36,f38,f40,f42,f44,f46,f0)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f0, %f2, %f48
 1:      FREG_FROB(f16,f18,f20,f22,f24,f26,f28,f30,f32)
@@ -262,11 +375,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 56f)
 
 1:      FREG_FROB(f2, f4, f6, f8, f10,f12,f14,f16,f18)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f18,f20,f22,f24,f26,f28,f30,f32,f34)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f34,f36,f38,f40,f42,f44,f46,f0, f2)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f2, %f4, %f48
 1:      FREG_FROB(f18,f20,f22,f24,f26,f28,f30,f32,f34)
@@ -283,11 +396,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 57f)
 
 1:      FREG_FROB(f4, f6, f8, f10,f12,f14,f16,f18,f20)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f20,f22,f24,f26,f28,f30,f32,f34,f36)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f36,f38,f40,f42,f44,f46,f0, f2, f4)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f4, %f6, %f48
 1:      FREG_FROB(f20,f22,f24,f26,f28,f30,f32,f34,f36)
@@ -304,11 +417,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 58f)
 
 1:      FREG_FROB(f6, f8, f10,f12,f14,f16,f18,f20,f22)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f22,f24,f26,f28,f30,f32,f34,f36,f38)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f38,f40,f42,f44,f46,f0, f2, f4, f6) 
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f6, %f8, %f48
 1:      FREG_FROB(f22,f24,f26,f28,f30,f32,f34,f36,f38)
@@ -325,11 +438,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 59f)
 
 1:      FREG_FROB(f8, f10,f12,f14,f16,f18,f20,f22,f24)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f24,f26,f28,f30,f32,f34,f36,f38,f40)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f40,f42,f44,f46,f0, f2, f4, f6, f8)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f8, %f10, %f48
 1:      FREG_FROB(f24,f26,f28,f30,f32,f34,f36,f38,f40)
@@ -346,11 +459,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 60f)
 
 1:      FREG_FROB(f10,f12,f14,f16,f18,f20,f22,f24,f26)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f26,f28,f30,f32,f34,f36,f38,f40,f42)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f42,f44,f46,f0, f2, f4, f6, f8, f10)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f10, %f12, %f48
 1:      FREG_FROB(f26,f28,f30,f32,f34,f36,f38,f40,f42)
@@ -367,11 +480,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 61f)
 
 1:      FREG_FROB(f12,f14,f16,f18,f20,f22,f24,f26,f28)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f28,f30,f32,f34,f36,f38,f40,f42,f44)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f44,f46,f0, f2, f4, f6, f8, f10,f12)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f12, %f14, %f48
 1:      FREG_FROB(f28,f30,f32,f34,f36,f38,f40,f42,f44)
@@ -388,11 +501,11 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         STORE_JUMP(o0, f48, 62f)
 
 1:      FREG_FROB(f14,f16,f18,f20,f22,f24,f26,f28,f30)
-        LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f)
+        LOOP_CHUNK1(o1, o0, 1f)
         FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46)
-        LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f)
+        LOOP_CHUNK2(o1, o0, 2f)
         FREG_FROB(f46,f0, f2, f4, f6, f8, f10,f12,f14)
-        LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f)
+        LOOP_CHUNK3(o1, o0, 3f)
         ba,pt           %xcc, 1b+4
          faligndata     %f14, %f16, %f48
 1:      FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46)
@@ -408,53 +521,53 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46)
         STORE_JUMP(o0, f48, 63f)
 
-40:     FINISH_VISCHUNK(o0, f0,  f2,  g3)
-41:     FINISH_VISCHUNK(o0, f2,  f4,  g3)
-42:     FINISH_VISCHUNK(o0, f4,  f6,  g3)
-43:     FINISH_VISCHUNK(o0, f6,  f8,  g3)
-44:     FINISH_VISCHUNK(o0, f8,  f10, g3)
-45:     FINISH_VISCHUNK(o0, f10, f12, g3)
-46:     FINISH_VISCHUNK(o0, f12, f14, g3)
-47:     UNEVEN_VISCHUNK(o0, f14, f0,  g3)
-48:     FINISH_VISCHUNK(o0, f16, f18, g3)
-49:     FINISH_VISCHUNK(o0, f18, f20, g3)
-50:     FINISH_VISCHUNK(o0, f20, f22, g3)
-51:     FINISH_VISCHUNK(o0, f22, f24, g3)
-52:     FINISH_VISCHUNK(o0, f24, f26, g3)
-53:     FINISH_VISCHUNK(o0, f26, f28, g3)
-54:     FINISH_VISCHUNK(o0, f28, f30, g3)
-55:     UNEVEN_VISCHUNK(o0, f30, f0,  g3)
-56:     FINISH_VISCHUNK(o0, f32, f34, g3)
-57:     FINISH_VISCHUNK(o0, f34, f36, g3)
-58:     FINISH_VISCHUNK(o0, f36, f38, g3)
-59:     FINISH_VISCHUNK(o0, f38, f40, g3)
-60:     FINISH_VISCHUNK(o0, f40, f42, g3)
-61:     FINISH_VISCHUNK(o0, f42, f44, g3)
-62:     FINISH_VISCHUNK(o0, f44, f46, g3)
-63:     UNEVEN_VISCHUNK_LAST(o0, f46, f0,  g3)
-
-93:     EX_LD_FP(LOAD(ldd, %o1, %f2))
+40:     FINISH_VISCHUNK(o0, f0,  f2)
+41:     FINISH_VISCHUNK(o0, f2,  f4)
+42:     FINISH_VISCHUNK(o0, f4,  f6)
+43:     FINISH_VISCHUNK(o0, f6,  f8)
+44:     FINISH_VISCHUNK(o0, f8,  f10)
+45:     FINISH_VISCHUNK(o0, f10, f12)
+46:     FINISH_VISCHUNK(o0, f12, f14)
+47:     UNEVEN_VISCHUNK(o0, f14, f0)
+48:     FINISH_VISCHUNK(o0, f16, f18)
+49:     FINISH_VISCHUNK(o0, f18, f20)
+50:     FINISH_VISCHUNK(o0, f20, f22)
+51:     FINISH_VISCHUNK(o0, f22, f24)
+52:     FINISH_VISCHUNK(o0, f24, f26)
+53:     FINISH_VISCHUNK(o0, f26, f28)
+54:     FINISH_VISCHUNK(o0, f28, f30)
+55:     UNEVEN_VISCHUNK(o0, f30, f0)
+56:     FINISH_VISCHUNK(o0, f32, f34)
+57:     FINISH_VISCHUNK(o0, f34, f36)
+58:     FINISH_VISCHUNK(o0, f36, f38)
+59:     FINISH_VISCHUNK(o0, f38, f40)
+60:     FINISH_VISCHUNK(o0, f40, f42)
+61:     FINISH_VISCHUNK(o0, f42, f44)
+62:     FINISH_VISCHUNK(o0, f44, f46)
+63:     UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+93:     EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
         add             %o1, 8, %o1
         subcc           %g3, 8, %g3
         faligndata      %f0, %f2, %f8
-        EX_ST_FP(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
         bl,pn           %xcc, 95f
          add            %o0, 8, %o0
-        EX_LD_FP(LOAD(ldd, %o1, %f0))
+        EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
         add             %o1, 8, %o1
         subcc           %g3, 8, %g3
         faligndata      %f2, %f0, %f8
-        EX_ST_FP(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
         bge,pt          %xcc, 93b
          add            %o0, 8, %o0
 
 95:     brz,pt          %o2, 2f
          mov            %g1, %o1
 
-1:      EX_LD_FP(LOAD(ldub, %o1, %o3))
+1:      EX_LD_FP(LOAD(ldub, %o1, %o3), U1_o2_0_fp)
         add             %o1, 1, %o1
         subcc           %o2, 1, %o2
-        EX_ST_FP(STORE(stb, %o3, %o0))
+        EX_ST_FP(STORE(stb, %o3, %o0), U1_o2_1_fp)
         bne,pt          %xcc, 1b
          add            %o0, 1, %o0
 
@@ -470,27 +583,27 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 
 72:     andn            %o2, 0xf, %GLOBAL_SPARE
         and             %o2, 0xf, %o2
-1:      EX_LD(LOAD(ldx, %o1 + 0x00, %o5))
-        EX_LD(LOAD(ldx, %o1 + 0x08, %g1))
+1:      EX_LD(LOAD(ldx, %o1 + 0x00, %o5), U1_gs_0)
+        EX_LD(LOAD(ldx, %o1 + 0x08, %g1), U1_gs_0)
         subcc           %GLOBAL_SPARE, 0x10, %GLOBAL_SPARE
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        EX_ST(STORE(stx, %o5, %o1 + %o3), U1_gs_10)
         add             %o1, 0x8, %o1
-        EX_ST(STORE(stx, %g1, %o1 + %o3))
+        EX_ST(STORE(stx, %g1, %o1 + %o3), U1_gs_8)
         bgu,pt          %XCC, 1b
          add            %o1, 0x8, %o1
 73:     andcc           %o2, 0x8, %g0
         be,pt           %XCC, 1f
          nop
-        EX_LD(LOAD(ldx, %o1, %o5))
+        EX_LD(LOAD(ldx, %o1, %o5), U1_o2_0)
         sub             %o2, 0x8, %o2
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        EX_ST(STORE(stx, %o5, %o1 + %o3), U1_o2_8)
         add             %o1, 0x8, %o1
 1:      andcc           %o2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
-        EX_LD(LOAD(lduw, %o1, %o5))
+        EX_LD(LOAD(lduw, %o1, %o5), U1_o2_0)
         sub             %o2, 0x4, %o2
-        EX_ST(STORE(stw, %o5, %o1 + %o3))
+        EX_ST(STORE(stw, %o5, %o1 + %o3), U1_o2_4)
         add             %o1, 0x4, %o1
 1:      cmp             %o2, 0
         be,pt           %XCC, 85f
@@ -504,9 +617,9 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
          sub            %g0, %g1, %g1
         sub             %o2, %g1, %o2
 
-1:      EX_LD(LOAD(ldub, %o1, %o5))
+1:      EX_LD(LOAD(ldub, %o1, %o5), U1_g1_0)
         subcc           %g1, 1, %g1
-        EX_ST(STORE(stb, %o5, %o1 + %o3))
+        EX_ST(STORE(stb, %o5, %o1 + %o3), U1_g1_1)
         bgu,pt          %icc, 1b
          add            %o1, 1, %o1
 
@@ -522,16 +635,16 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 
 8:      mov             64, %o3
         andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1, %g2))
+        EX_LD(LOAD(ldx, %o1, %g2), U1_o2_0)
         sub             %o3, %g1, %o3
         andn            %o2, 0x7, %GLOBAL_SPARE
         sllx            %g2, %g1, %g2
-1:      EX_LD(LOAD(ldx, %o1 + 0x8, %g3))
+1:      EX_LD(LOAD(ldx, %o1 + 0x8, %g3), U1_gs_0_o2_adj)
         subcc           %GLOBAL_SPARE, 0x8, %GLOBAL_SPARE
         add             %o1, 0x8, %o1
         srlx            %g3, %o3, %o5
         or              %o5, %g2, %o5
-        EX_ST(STORE(stx, %o5, %o0))
+        EX_ST(STORE(stx, %o5, %o0), U1_gs_8_o2_adj)
         add             %o0, 0x8, %o0
         bgu,pt          %icc, 1b
          sllx           %g3, %g1, %g2
@@ -549,9 +662,9 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         bne,pn          %XCC, 90f
          sub            %o0, %o1, %o3
 
-1:      EX_LD(LOAD(lduw, %o1, %g1))
+1:      EX_LD(LOAD(lduw, %o1, %g1), U1_o2_0)
         subcc           %o2, 4, %o2
-        EX_ST(STORE(stw, %g1, %o1 + %o3))
+        EX_ST(STORE(stw, %g1, %o1 + %o3), U1_o2_4)
         bgu,pt          %XCC, 1b
          add            %o1, 4, %o1
 
@@ -559,9 +672,9 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
          mov            EX_RETVAL(%o4), %o0
 
         .align          32
-90:     EX_LD(LOAD(ldub, %o1, %g1))
+90:     EX_LD(LOAD(ldub, %o1, %g1), U1_o2_0)
         subcc           %o2, 1, %o2
-        EX_ST(STORE(stb, %g1, %o1 + %o3))
+        EX_ST(STORE(stb, %g1, %o1 + %o3), U1_o2_1)
         bgu,pt          %XCC, 90b
          add            %o1, 1, %o1
         retl
diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S
index 88ad73d86fe4..db73010a1af8 100644
--- a/arch/sparc/lib/U3copy_from_user.S
+++ b/arch/sparc/lib/U3copy_from_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#define EX_LD(x)                \
+#define EX_LD(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_LD_FP(x)             \
+#define EX_LD_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S
index 845139d75537..c4ee858e352a 100644
--- a/arch/sparc/lib/U3copy_to_user.S
+++ b/arch/sparc/lib/U3copy_to_user.S
@@ -3,19 +3,19 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#define EX_ST(x)                \
+#define EX_ST(x,y)              \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, y;           \
         .text;                  \
         .align 4;
 
-#define EX_ST_FP(x)             \
+#define EX_ST_FP(x,y)           \
 98:     x;                      \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one_fp;\
+        .word 98b, y##_fp;      \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 491ee69e4995..54f98706b03b 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -4,6 +4,7 @@
  */
 
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #define GLOBAL_SPARE    %g7
@@ -22,21 +23,17 @@
 #endif
 
 #ifndef EX_LD
-#define EX_LD(x)        x
+#define EX_LD(x,y)      x
 #endif
 #ifndef EX_LD_FP
-#define EX_LD_FP(x)     x
+#define EX_LD_FP(x,y)   x
 #endif
 
 #ifndef EX_ST
-#define EX_ST(x)        x
+#define EX_ST(x,y)      x
 #endif
 #ifndef EX_ST_FP
-#define EX_ST_FP(x)     x
-#endif
-
-#ifndef EX_RETVAL
-#define EX_RETVAL(x)    x
+#define EX_ST_FP(x,y)   x
 #endif
 
 #ifndef LOAD
@@ -77,6 +74,87 @@
          */
 
         .text
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+__restore_fp:
+        VISExitHalf
+        retl
+         nop
+ENTRY(U3_retl_o2_plus_g2_plus_g1_plus_1_fp)
+        add     %g1, 1, %g1
+        add     %g2, %g1, %g2
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %g2, %o0
+ENDPROC(U3_retl_o2_plus_g2_plus_g1_plus_1_fp)
+ENTRY(U3_retl_o2_plus_g2_fp)
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %g2, %o0
+ENDPROC(U3_retl_o2_plus_g2_fp)
+ENTRY(U3_retl_o2_plus_g2_plus_8_fp)
+        add     %g2, 8, %g2
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %g2, %o0
+ENDPROC(U3_retl_o2_plus_g2_plus_8_fp)
+ENTRY(U3_retl_o2)
+        retl
+         mov    %o2, %o0
+ENDPROC(U3_retl_o2)
+ENTRY(U3_retl_o2_plus_1)
+        retl
+         add    %o2, 1, %o0
+ENDPROC(U3_retl_o2_plus_1)
+ENTRY(U3_retl_o2_plus_4)
+        retl
+         add    %o2, 4, %o0
+ENDPROC(U3_retl_o2_plus_4)
+ENTRY(U3_retl_o2_plus_8)
+        retl
+         add    %o2, 8, %o0
+ENDPROC(U3_retl_o2_plus_8)
+ENTRY(U3_retl_o2_plus_g1_plus_1)
+        add     %g1, 1, %g1
+        retl
+         add    %o2, %g1, %o0
+ENDPROC(U3_retl_o2_plus_g1_plus_1)
+ENTRY(U3_retl_o2_fp)
+        ba,pt   %xcc, __restore_fp
+         mov    %o2, %o0
+ENDPROC(U3_retl_o2_fp)
+ENTRY(U3_retl_o2_plus_o3_sll_6_plus_0x80_fp)
+        sll     %o3, 6, %o3
+        add     %o3, 0x80, %o3
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %o3, %o0
+ENDPROC(U3_retl_o2_plus_o3_sll_6_plus_0x80_fp)
+ENTRY(U3_retl_o2_plus_o3_sll_6_plus_0x40_fp)
+        sll     %o3, 6, %o3
+        add     %o3, 0x40, %o3
+        ba,pt   %xcc, __restore_fp
+         add    %o2, %o3, %o0
+ENDPROC(U3_retl_o2_plus_o3_sll_6_plus_0x40_fp)
+ENTRY(U3_retl_o2_plus_GS_plus_0x10)
+        add     GLOBAL_SPARE, 0x10, GLOBAL_SPARE
+        retl
+         add    %o2, GLOBAL_SPARE, %o0
+ENDPROC(U3_retl_o2_plus_GS_plus_0x10)
+ENTRY(U3_retl_o2_plus_GS_plus_0x08)
+        add     GLOBAL_SPARE, 0x08, GLOBAL_SPARE
+        retl
+         add    %o2, GLOBAL_SPARE, %o0
+ENDPROC(U3_retl_o2_plus_GS_plus_0x08)
+ENTRY(U3_retl_o2_and_7_plus_GS)
+        and     %o2, 7, %o2
+        retl
+         add    %o2, GLOBAL_SPARE, %o2
+ENDPROC(U3_retl_o2_and_7_plus_GS)
+ENTRY(U3_retl_o2_and_7_plus_GS_plus_8)
+        add     GLOBAL_SPARE, 8, GLOBAL_SPARE
+        and     %o2, 7, %o2
+        retl
+         add    %o2, GLOBAL_SPARE, %o2
+ENDPROC(U3_retl_o2_and_7_plus_GS_plus_8)
+#endif
+
         .align          64
 
         /* The cheetah's flexible spine, oversized liver, enlarged heart,
@@ -126,8 +204,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          and            %g2, 0x38, %g2
 
 1:      subcc           %g1, 0x1, %g1
-        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3))
-        EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE))
+        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3), U3_retl_o2_plus_g2_plus_g1_plus_1)
+        EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE), U3_retl_o2_plus_g2_plus_g1_plus_1)
         bgu,pt          %XCC, 1b
          add            %o1, 0x1, %o1
 
@@ -138,20 +216,20 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         be,pt           %icc, 3f
          alignaddr      %o1, %g0, %o1
 
-        EX_LD_FP(LOAD(ldd, %o1, %f4))
-1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6))
+        EX_LD_FP(LOAD(ldd, %o1, %f4), U3_retl_o2_plus_g2)
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6), U3_retl_o2_plus_g2)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f4, %f6, %f0
-        EX_ST_FP(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0), U3_retl_o2_plus_g2_plus_8)
         be,pn           %icc, 3f
          add            %o0, 0x8, %o0
 
-        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4), U3_retl_o2_plus_g2)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f6, %f4, %f2
-        EX_ST_FP(STORE(std, %f2, %o0))
+        EX_ST_FP(STORE(std, %f2, %o0), U3_retl_o2_plus_g2_plus_8)
         bne,pt          %icc, 1b
          add            %o0, 0x8, %o0
 
@@ -161,25 +239,25 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         LOAD(prefetch, %o1 + 0x080, #one_read)
         LOAD(prefetch, %o1 + 0x0c0, #one_read)
         LOAD(prefetch, %o1 + 0x100, #one_read)
-        EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0), U3_retl_o2)
         LOAD(prefetch, %o1 + 0x140, #one_read)
-        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2)
         LOAD(prefetch, %o1 + 0x180, #one_read)
-        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2)
         LOAD(prefetch, %o1 + 0x1c0, #one_read)
         faligndata      %f0, %f2, %f16
-        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2)
         faligndata      %f2, %f4, %f18
-        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2)
         faligndata      %f4, %f6, %f20
-        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2)
         faligndata      %f6, %f8, %f22
 
-        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2)
         faligndata      %f8, %f10, %f24
-        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2)
         faligndata      %f10, %f12, %f26
-        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
 
         subcc           GLOBAL_SPARE, 0x80, GLOBAL_SPARE
         add             %o1, 0x40, %o1
@@ -190,26 +268,26 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         .align          64
 1:
-        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2_plus_o3_sll_6_plus_0x80)
         faligndata      %f12, %f14, %f28
-        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2_plus_o3_sll_6_plus_0x80)
         faligndata      %f14, %f0, %f30
-        EX_ST_FP(STORE_BLK(%f16, %o0))
-        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x80)
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f0, %f2, %f16
         add             %o0, 0x40, %o0
 
-        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f2, %f4, %f18
-        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f4, %f6, %f20
-        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         subcc           %o3, 0x01, %o3
         faligndata      %f6, %f8, %f22
-        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2_plus_o3_sll_6_plus_0x80)
 
         faligndata      %f8, %f10, %f24
-        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2_plus_o3_sll_6_plus_0x80)
         LOAD(prefetch, %o1 + 0x1c0, #one_read)
         faligndata      %f10, %f12, %f26
         bg,pt           %XCC, 1b
@@ -217,29 +295,29 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         /* Finally we copy the last full 64-byte block. */
 2:
-        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2_plus_o3_sll_6_plus_0x80)
         faligndata      %f12, %f14, %f28
-        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2_plus_o3_sll_6_plus_0x80)
         faligndata      %f14, %f0, %f30
-        EX_ST_FP(STORE_BLK(%f16, %o0))
-        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x80)
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f0, %f2, %f16
-        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f2, %f4, %f18
-        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f4, %f6, %f20
-        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f6, %f8, %f22
-        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         faligndata      %f8, %f10, %f24
         cmp             %g1, 0
         be,pt           %XCC, 1f
          add            %o0, 0x40, %o0
-        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2_plus_o3_sll_6_plus_0x40)
 1:      faligndata      %f10, %f12, %f26
         faligndata      %f12, %f14, %f28
         faligndata      %f14, %f0, %f30
-        EX_ST_FP(STORE_BLK(%f16, %o0))
+        EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x40)
         add             %o0, 0x40, %o0
         add             %o1, 0x40, %o1
         membar          #Sync
@@ -259,20 +337,20 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         sub             %o2, %g2, %o2
         be,a,pt         %XCC, 1f
-         EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0))
+         EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0), U3_retl_o2_plus_g2)
 
-1:      EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2))
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2), U3_retl_o2_plus_g2)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f0, %f2, %f8
-        EX_ST_FP(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0), U3_retl_o2_plus_g2_plus_8)
         be,pn           %XCC, 2f
          add            %o0, 0x8, %o0
-        EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0), U3_retl_o2_plus_g2)
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f2, %f0, %f8
-        EX_ST_FP(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0), U3_retl_o2_plus_g2_plus_8)
         bne,pn          %XCC, 1b
          add            %o0, 0x8, %o0
 
@@ -292,30 +370,33 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          andcc          %o2, 0x8, %g0
         be,pt           %icc, 1f
          nop
-        EX_LD(LOAD(ldx, %o1, %o5))
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        EX_LD(LOAD(ldx, %o1, %o5), U3_retl_o2)
+        EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2)
         add             %o1, 0x8, %o1
+        sub             %o2, 8, %o2
 
 1:      andcc           %o2, 0x4, %g0
         be,pt           %icc, 1f
          nop
-        EX_LD(LOAD(lduw, %o1, %o5))
-        EX_ST(STORE(stw, %o5, %o1 + %o3))
+        EX_LD(LOAD(lduw, %o1, %o5), U3_retl_o2)
+        EX_ST(STORE(stw, %o5, %o1 + %o3), U3_retl_o2)
         add             %o1, 0x4, %o1
+        sub             %o2, 4, %o2
 
 1:      andcc           %o2, 0x2, %g0
         be,pt           %icc, 1f
          nop
-        EX_LD(LOAD(lduh, %o1, %o5))
-        EX_ST(STORE(sth, %o5, %o1 + %o3))
+        EX_LD(LOAD(lduh, %o1, %o5), U3_retl_o2)
+        EX_ST(STORE(sth, %o5, %o1 + %o3), U3_retl_o2)
         add             %o1, 0x2, %o1
+        sub             %o2, 2, %o2
 
 1:      andcc           %o2, 0x1, %g0
         be,pt           %icc, 85f
          nop
-        EX_LD(LOAD(ldub, %o1, %o5))
+        EX_LD(LOAD(ldub, %o1, %o5), U3_retl_o2)
         ba,pt           %xcc, 85f
-         EX_ST(STORE(stb, %o5, %o1 + %o3))
+         EX_ST(STORE(stb, %o5, %o1 + %o3), U3_retl_o2)
 
         .align          64
 70: /* 16 < len <= 64 */
@@ -326,26 +407,26 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         andn            %o2, 0xf, GLOBAL_SPARE
         and             %o2, 0xf, %o2
 1:      subcc           GLOBAL_SPARE, 0x10, GLOBAL_SPARE
-        EX_LD(LOAD(ldx, %o1 + 0x00, %o5))
-        EX_LD(LOAD(ldx, %o1 + 0x08, %g1))
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        EX_LD(LOAD(ldx, %o1 + 0x00, %o5), U3_retl_o2_plus_GS_plus_0x10)
+        EX_LD(LOAD(ldx, %o1 + 0x08, %g1), U3_retl_o2_plus_GS_plus_0x10)
+        EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2_plus_GS_plus_0x10)
         add             %o1, 0x8, %o1
-        EX_ST(STORE(stx, %g1, %o1 + %o3))
+        EX_ST(STORE(stx, %g1, %o1 + %o3), U3_retl_o2_plus_GS_plus_0x08)
         bgu,pt          %XCC, 1b
          add            %o1, 0x8, %o1
 73:     andcc           %o2, 0x8, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x8, %o2
-        EX_LD(LOAD(ldx, %o1, %o5))
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        EX_LD(LOAD(ldx, %o1, %o5), U3_retl_o2_plus_8)
+        EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2_plus_8)
         add             %o1, 0x8, %o1
 1:      andcc           %o2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x4, %o2
-        EX_LD(LOAD(lduw, %o1, %o5))
-        EX_ST(STORE(stw, %o5, %o1 + %o3))
+        EX_LD(LOAD(lduw, %o1, %o5), U3_retl_o2_plus_4)
+        EX_ST(STORE(stw, %o5, %o1 + %o3), U3_retl_o2_plus_4)
         add             %o1, 0x4, %o1
 1:      cmp             %o2, 0
         be,pt           %XCC, 85f
@@ -361,8 +442,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %o2, %g1, %o2
 
 1:      subcc           %g1, 1, %g1
-        EX_LD(LOAD(ldub, %o1, %o5))
-        EX_ST(STORE(stb, %o5, %o1 + %o3))
+        EX_LD(LOAD(ldub, %o1, %o5), U3_retl_o2_plus_g1_plus_1)
+        EX_ST(STORE(stb, %o5, %o1 + %o3), U3_retl_o2_plus_g1_plus_1)
         bgu,pt          %icc, 1b
          add            %o1, 1, %o1
 
@@ -378,16 +459,16 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 8:      mov             64, %o3
         andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1, %g2))
+        EX_LD(LOAD(ldx, %o1, %g2), U3_retl_o2)
         sub             %o3, %g1, %o3
         andn            %o2, 0x7, GLOBAL_SPARE
         sllx            %g2, %g1, %g2
-1:      EX_LD(LOAD(ldx, %o1 + 0x8, %g3))
+1:      EX_LD(LOAD(ldx, %o1 + 0x8, %g3), U3_retl_o2_and_7_plus_GS)
         subcc           GLOBAL_SPARE, 0x8, GLOBAL_SPARE
         add             %o1, 0x8, %o1
         srlx            %g3, %o3, %o5
         or              %o5, %g2, %o5
-        EX_ST(STORE(stx, %o5, %o0))
+        EX_ST(STORE(stx, %o5, %o0), U3_retl_o2_and_7_plus_GS_plus_8)
         add             %o0, 0x8, %o0
         bgu,pt          %icc, 1b
          sllx           %g3, %g1, %g2
@@ -407,8 +488,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 1:
         subcc           %o2, 4, %o2
-        EX_LD(LOAD(lduw, %o1, %g1))
-        EX_ST(STORE(stw, %g1, %o1 + %o3))
+        EX_LD(LOAD(lduw, %o1, %g1), U3_retl_o2_plus_4)
+        EX_ST(STORE(stw, %g1, %o1 + %o3), U3_retl_o2_plus_4)
         bgu,pt          %XCC, 1b
          add            %o1, 4, %o1
 
@@ -418,8 +499,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         .align          32
 90:
         subcc           %o2, 1, %o2
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o1 + %o3))
+        EX_LD(LOAD(ldub, %o1, %g1), U3_retl_o2_plus_1)
+        EX_ST(STORE(stb, %g1, %o1 + %o3), U3_retl_o2_plus_1)
         bgu,pt          %XCC, 90b
          add            %o1, 1, %o1
         retl
diff --git a/arch/sparc/lib/copy_in_user.S b/arch/sparc/lib/copy_in_user.S
index 482de093bdae..0252b218de45 100644
--- a/arch/sparc/lib/copy_in_user.S
+++ b/arch/sparc/lib/copy_in_user.S
@@ -9,18 +9,33 @@
 
 #define XCC xcc
 
-#define EX(x,y)                 \
+#define EX(x,y,z)               \
 98:     x,y;                    \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, __retl_one;  \
+        .word 98b, z;           \
         .text;                  \
         .align 4;
 
+#define EX_O4(x,y) EX(x,y,__retl_o4_plus_8)
+#define EX_O2_4(x,y) EX(x,y,__retl_o2_plus_4)
+#define EX_O2_1(x,y) EX(x,y,__retl_o2_plus_1)
+
         .register       %g2,#scratch
         .register       %g3,#scratch
 
         .text
+__retl_o4_plus_8:
+        add     %o4, %o2, %o4
+        retl
+         add    %o4, 8, %o0
+__retl_o2_plus_4:
+        retl
+         add    %o2, 4, %o0
+__retl_o2_plus_1:
+        retl
+         add    %o2, 1, %o0
+
         .align  32
 
         /* Don't try to get too fancy here, just nice and
@@ -45,8 +60,8 @@ ENTRY(___copy_in_user)	/* %o0=dst, %o1=src, %o2=len */
         andn            %o2, 0x7, %o4
         and             %o2, 0x7, %o2
 1:      subcc           %o4, 0x8, %o4
-        EX(ldxa [%o1] %asi, %o5)
-        EX(stxa %o5, [%o0] %asi)
+        EX_O4(ldxa [%o1] %asi, %o5)
+        EX_O4(stxa %o5, [%o0] %asi)
         add             %o1, 0x8, %o1
         bgu,pt          %XCC, 1b
          add            %o0, 0x8, %o0
@@ -54,8 +69,8 @@ ENTRY(___copy_in_user)	/* %o0=dst, %o1=src, %o2=len */
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x4, %o2
-        EX(lduwa [%o1] %asi, %o5)
-        EX(stwa %o5, [%o0] %asi)
+        EX_O2_4(lduwa [%o1] %asi, %o5)
+        EX_O2_4(stwa %o5, [%o0] %asi)
         add             %o1, 0x4, %o1
         add             %o0, 0x4, %o0
 1:      cmp             %o2, 0
@@ -71,8 +86,8 @@ ENTRY(___copy_in_user)	/* %o0=dst, %o1=src, %o2=len */
 
 82:
         subcc           %o2, 4, %o2
-        EX(lduwa [%o1] %asi, %g1)
-        EX(stwa %g1, [%o0] %asi)
+        EX_O2_4(lduwa [%o1] %asi, %g1)
+        EX_O2_4(stwa %g1, [%o0] %asi)
         add             %o1, 4, %o1
         bgu,pt          %XCC, 82b
          add            %o0, 4, %o0
@@ -83,8 +98,8 @@ ENTRY(___copy_in_user)	/* %o0=dst, %o1=src, %o2=len */
         .align  32
 90:
         subcc           %o2, 1, %o2
-        EX(lduba [%o1] %asi, %g1)
-        EX(stba %g1, [%o0] %asi)
+        EX_O2_1(lduba [%o1] %asi, %g1)
+        EX_O2_1(stba %g1, [%o0] %asi)
         add             %o1, 1, %o1
         bgu,pt          %XCC, 90b
          add            %o0, 1, %o0
diff --git a/arch/sparc/lib/user_fixup.c b/arch/sparc/lib/user_fixup.c
deleted file mode 100644
index ac96ae236709..000000000000
--- a/arch/sparc/lib/user_fixup.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/* user_fixup.c: Fix up user copy faults.
- *
- * Copyright (C) 2004 David S. Miller <davem@redhat.com>
- */
-
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/module.h>
-
-#include <asm/uaccess.h>
-
-/* Calculating the exact fault address when using
- * block loads and stores can be very complicated.
- *
- * Instead of trying to be clever and handling all
- * of the cases, just fix things up simply here.
- */
-
-static unsigned long compute_size(unsigned long start, unsigned long size, unsigned long *offset)
-{
-        unsigned long fault_addr = current_thread_info()->fault_address;
-        unsigned long end = start + size;
-
-        if (fault_addr < start || fault_addr >= end) {
-                *offset = 0;
-        } else {
-                *offset = fault_addr - start;
-                size = end - fault_addr;
-        }
-        return size;
-}
-
-unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned long size)
-{
-        unsigned long offset;
-
-        size = compute_size((unsigned long) from, size, &offset);
-        if (likely(size))
-                memset(to + offset, 0, size);
-
-        return size;
-}
-EXPORT_SYMBOL(copy_from_user_fixup);
-
-unsigned long copy_to_user_fixup(void __user *to, const void *from, unsigned long size)
-{
-        unsigned long offset;
-
-        return compute_size((unsigned long) to, size, &offset);
-}
-EXPORT_SYMBOL(copy_to_user_fixup);
-
-unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned long size)
-{
-        unsigned long fault_addr = current_thread_info()->fault_address;
-        unsigned long start = (unsigned long) to;
-        unsigned long end = start + size;
-
-        if (fault_addr >= start && fault_addr < end)
-                return end - fault_addr;
-
-        start = (unsigned long) from;
-        end = start + size;
-        if (fault_addr >= start && fault_addr < end)
-                return end - fault_addr;
-
-        return size;
-}
-EXPORT_SYMBOL(copy_in_user_fixup);
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index f2b77112e9d8..e20fbbafb0b0 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -27,6 +27,20 @@ static inline int tag_compare(unsigned long tag, unsigned long vaddr)
         return (tag == (vaddr >> 22));
 }
 
+static void flush_tsb_kernel_range_scan(unsigned long start, unsigned long end)
+{
+        unsigned long idx;
+
+        for (idx = 0; idx < KERNEL_TSB_NENTRIES; idx++) {
+                struct tsb *ent = &swapper_tsb[idx];
+                unsigned long match = idx << 13;
+
+                match |= (ent->tag << 22);
+                if (match >= start && match < end)
+                        ent->tag = (1UL << TSB_TAG_INVALID_BIT);
+        }
+}
+
 /* TSB flushes need only occur on the processor initiating the address
  * space modification, not on each cpu the address space has run on.
  * Only the TLB flush needs that treatment.
@@ -36,6 +50,9 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end)
 {
         unsigned long v;
 
+        if ((end - start) >> PAGE_SHIFT >= 2 * KERNEL_TSB_NENTRIES)
+                return flush_tsb_kernel_range_scan(start, end);
+
         for (v = start; v < end; v += PAGE_SIZE) {
                 unsigned long hash = tsb_hash(v, PAGE_SHIFT,
                                               KERNEL_TSB_NENTRIES);
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index b4f4733abc6e..5d2fd6cd3189 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -30,7 +30,7 @@
         .text
         .align          32
         .globl          __flush_tlb_mm
-__flush_tlb_mm:         /* 18 insns */
+__flush_tlb_mm:         /* 19 insns */
         /* %o0=(ctx & TAG_CONTEXT_BITS), %o1=SECONDARY_CONTEXT */
         ldxa            [%o1] ASI_DMMU, %g2
         cmp             %g2, %o0
@@ -81,7 +81,7 @@ __flush_tlb_page:	/* 22 insns */
 
         .align          32
         .globl          __flush_tlb_pending
-__flush_tlb_pending:    /* 26 insns */
+__flush_tlb_pending:    /* 27 insns */
         /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
         rdpr            %pstate, %g7
         sllx            %o1, 3, %o1
@@ -113,12 +113,14 @@ __flush_tlb_pending:	/* 26 insns */
 
         .align          32
         .globl          __flush_tlb_kernel_range
-__flush_tlb_kernel_range:       /* 16 insns */
+__flush_tlb_kernel_range:       /* 31 insns */
         /* %o0=start, %o1=end */
         cmp             %o0, %o1
         be,pn           %xcc, 2f
+         sub            %o1, %o0, %o3
+        srlx            %o3, 18, %o4
+        brnz,pn         %o4, __spitfire_flush_tlb_kernel_range_slow
          sethi          %hi(PAGE_SIZE), %o4
-        sub             %o1, %o0, %o3
         sub             %o3, %o4, %o3
         or              %o0, 0x20, %o0          ! Nucleus
 1:      stxa            %g0, [%o0 + %o3] ASI_DMMU_DEMAP
@@ -131,6 +133,41 @@ __flush_tlb_kernel_range:	/* 16 insns */
         retl
          nop
         nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+
+__spitfire_flush_tlb_kernel_range_slow:
+        mov             63 * 8, %o4
+1:      ldxa            [%o4] ASI_ITLB_DATA_ACCESS, %o3
+        andcc           %o3, 0x40, %g0                  /* _PAGE_L_4U */
+        bne,pn          %xcc, 2f
+         mov            TLB_TAG_ACCESS, %o3
+        stxa            %g0, [%o3] ASI_IMMU
+        stxa            %g0, [%o4] ASI_ITLB_DATA_ACCESS
+        membar          #Sync
+2:      ldxa            [%o4] ASI_DTLB_DATA_ACCESS, %o3
+        andcc           %o3, 0x40, %g0
+        bne,pn          %xcc, 2f
+         mov            TLB_TAG_ACCESS, %o3
+        stxa            %g0, [%o3] ASI_DMMU
+        stxa            %g0, [%o4] ASI_DTLB_DATA_ACCESS
+        membar          #Sync
+2:      sub             %o4, 8, %o4
+        brgez,pt        %o4, 1b
+         nop
+        retl
+         nop
 
 __spitfire_flush_tlb_mm_slow:
         rdpr            %pstate, %g1
@@ -285,6 +322,40 @@ __cheetah_flush_tlb_pending:	/* 27 insns */
         retl
          wrpr           %g7, 0x0, %pstate
 
+__cheetah_flush_tlb_kernel_range:       /* 31 insns */
+        /* %o0=start, %o1=end */
+        cmp             %o0, %o1
+        be,pn           %xcc, 2f
+         sub            %o1, %o0, %o3
+        srlx            %o3, 18, %o4
+        brnz,pn         %o4, 3f
+         sethi          %hi(PAGE_SIZE), %o4
+        sub             %o3, %o4, %o3
+        or              %o0, 0x20, %o0          ! Nucleus
+1:      stxa            %g0, [%o0 + %o3] ASI_DMMU_DEMAP
+        stxa            %g0, [%o0 + %o3] ASI_IMMU_DEMAP
+        membar          #Sync
+        brnz,pt         %o3, 1b
+         sub            %o3, %o4, %o3
+2:      sethi           %hi(KERNBASE), %o3
+        flush           %o3
+        retl
+         nop
+3:      mov             0x80, %o4
+        stxa            %g0, [%o4] ASI_DMMU_DEMAP
+        membar          #Sync
+        stxa            %g0, [%o4] ASI_IMMU_DEMAP
+        membar          #Sync
+        retl
+         nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+
 #ifdef DCACHE_ALIASING_POSSIBLE
 __cheetah_flush_dcache_page: /* 11 insns */
         sethi           %hi(PAGE_OFFSET), %g1
@@ -309,19 +380,28 @@ __hypervisor_tlb_tl0_error:
         ret
          restore
 
-__hypervisor_flush_tlb_mm: /* 10 insns */
+__hypervisor_flush_tlb_mm: /* 19 insns */
         mov             %o0, %o2        /* ARG2: mmu context */
         mov             0, %o0          /* ARG0: CPU lists unimplemented */
         mov             0, %o1          /* ARG1: CPU lists unimplemented */
         mov             HV_MMU_ALL, %o3 /* ARG3: flags */
         mov             HV_FAST_MMU_DEMAP_CTX, %o5
         ta              HV_FAST_TRAP
-        brnz,pn         %o0, __hypervisor_tlb_tl0_error
+        brnz,pn         %o0, 1f
          mov            HV_FAST_MMU_DEMAP_CTX, %o1
         retl
          nop
+1:      sethi           %hi(__hypervisor_tlb_tl0_error), %o5
+        jmpl            %o5 + %lo(__hypervisor_tlb_tl0_error), %g0
+         nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
 
-__hypervisor_flush_tlb_page: /* 11 insns */
+__hypervisor_flush_tlb_page: /* 22 insns */
         /* %o0 = context, %o1 = vaddr */
         mov             %o0, %g2
         mov             %o1, %o0              /* ARG0: vaddr + IMMU-bit */
@@ -330,12 +410,23 @@ __hypervisor_flush_tlb_page: /* 11 insns */
         srlx            %o0, PAGE_SHIFT, %o0
         sllx            %o0, PAGE_SHIFT, %o0
         ta              HV_MMU_UNMAP_ADDR_TRAP
-        brnz,pn         %o0, __hypervisor_tlb_tl0_error
+        brnz,pn         %o0, 1f
          mov            HV_MMU_UNMAP_ADDR_TRAP, %o1
         retl
          nop
+1:      sethi           %hi(__hypervisor_tlb_tl0_error), %o2
+        jmpl            %o2 + %lo(__hypervisor_tlb_tl0_error), %g0
+         nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
 
-__hypervisor_flush_tlb_pending: /* 16 insns */
+__hypervisor_flush_tlb_pending: /* 27 insns */
         /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
         sllx            %o1, 3, %g1
         mov             %o2, %g2
@@ -347,31 +438,57 @@ __hypervisor_flush_tlb_pending: /* 16 insns */
         srlx            %o0, PAGE_SHIFT, %o0
         sllx            %o0, PAGE_SHIFT, %o0
         ta              HV_MMU_UNMAP_ADDR_TRAP
-        brnz,pn         %o0, __hypervisor_tlb_tl0_error
+        brnz,pn         %o0, 1f
          mov            HV_MMU_UNMAP_ADDR_TRAP, %o1
         brnz,pt         %g1, 1b
          nop
         retl
          nop
+1:      sethi           %hi(__hypervisor_tlb_tl0_error), %o2
+        jmpl            %o2 + %lo(__hypervisor_tlb_tl0_error), %g0
+         nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
 
-__hypervisor_flush_tlb_kernel_range: /* 16 insns */
+__hypervisor_flush_tlb_kernel_range: /* 31 insns */
         /* %o0=start, %o1=end */
         cmp             %o0, %o1
         be,pn           %xcc, 2f
-         sethi          %hi(PAGE_SIZE), %g3
-        mov             %o0, %g1
-        sub             %o1, %g1, %g2
+         sub            %o1, %o0, %g2
+        srlx            %g2, 18, %g3
+        brnz,pn         %g3, 4f
+         mov            %o0, %g1
+        sethi           %hi(PAGE_SIZE), %g3
         sub             %g2, %g3, %g2
 1:      add             %g1, %g2, %o0   /* ARG0: virtual address */
         mov             0, %o1          /* ARG1: mmu context */
         mov             HV_MMU_ALL, %o2 /* ARG2: flags */
         ta              HV_MMU_UNMAP_ADDR_TRAP
-        brnz,pn         %o0, __hypervisor_tlb_tl0_error
+        brnz,pn         %o0, 3f
          mov            HV_MMU_UNMAP_ADDR_TRAP, %o1
         brnz,pt         %g2, 1b
          sub            %g2, %g3, %g2
 2:      retl
          nop
+3:      sethi           %hi(__hypervisor_tlb_tl0_error), %o2
+        jmpl            %o2 + %lo(__hypervisor_tlb_tl0_error), %g0
+         nop
+4:      mov             0, %o0          /* ARG0: CPU lists unimplemented */
+        mov             0, %o1          /* ARG1: CPU lists unimplemented */
+        mov             0, %o2          /* ARG2: mmu context == nucleus */
+        mov             HV_MMU_ALL, %o3 /* ARG3: flags */
+        mov             HV_FAST_MMU_DEMAP_CTX, %o5
+        ta              HV_FAST_TRAP
+        brnz,pn         %o0, 3b
+         mov            HV_FAST_MMU_DEMAP_CTX, %o1
+        retl
+         nop
 
 #ifdef DCACHE_ALIASING_POSSIBLE
         /* XXX Niagara and friends have an 8K cache, so no aliasing is
@@ -394,43 +511,6 @@ tlb_patch_one:
         retl
          nop
 
-        .globl          cheetah_patch_cachetlbops
-cheetah_patch_cachetlbops:
-        save            %sp, -128, %sp
-
-        sethi           %hi(__flush_tlb_mm), %o0
-        or              %o0, %lo(__flush_tlb_mm), %o0
-        sethi           %hi(__cheetah_flush_tlb_mm), %o1
-        or              %o1, %lo(__cheetah_flush_tlb_mm), %o1
-        call            tlb_patch_one
-         mov            19, %o2
-
-        sethi           %hi(__flush_tlb_page), %o0
-        or              %o0, %lo(__flush_tlb_page), %o0
-        sethi           %hi(__cheetah_flush_tlb_page), %o1
-        or              %o1, %lo(__cheetah_flush_tlb_page), %o1
-        call            tlb_patch_one
-         mov            22, %o2
-
-        sethi           %hi(__flush_tlb_pending), %o0
-        or              %o0, %lo(__flush_tlb_pending), %o0
-        sethi           %hi(__cheetah_flush_tlb_pending), %o1
-        or              %o1, %lo(__cheetah_flush_tlb_pending), %o1
-        call            tlb_patch_one
-         mov            27, %o2
-
-#ifdef DCACHE_ALIASING_POSSIBLE
-        sethi           %hi(__flush_dcache_page), %o0
-        or              %o0, %lo(__flush_dcache_page), %o0
-        sethi           %hi(__cheetah_flush_dcache_page), %o1
-        or              %o1, %lo(__cheetah_flush_dcache_page), %o1
-        call            tlb_patch_one
-         mov            11, %o2
-#endif /* DCACHE_ALIASING_POSSIBLE */
-
-        ret
-         restore
-
 #ifdef CONFIG_SMP
         /* These are all called by the slaves of a cross call, at
          * trap level 1, with interrupts fully disabled.
@@ -447,7 +527,7 @@ cheetah_patch_cachetlbops:
          */
         .align          32
         .globl          xcall_flush_tlb_mm
-xcall_flush_tlb_mm:     /* 21 insns */
+xcall_flush_tlb_mm:     /* 24 insns */
         mov             PRIMARY_CONTEXT, %g2
         ldxa            [%g2] ASI_DMMU, %g3
         srlx            %g3, CTX_PGSZ1_NUC_SHIFT, %g4
@@ -469,9 +549,12 @@ xcall_flush_tlb_mm:	/* 21 insns */
         nop
         nop
         nop
+        nop
+        nop
+        nop
 
         .globl          xcall_flush_tlb_page
-xcall_flush_tlb_page:   /* 17 insns */
+xcall_flush_tlb_page:   /* 20 insns */
         /* %g5=context, %g1=vaddr */
         mov             PRIMARY_CONTEXT, %g4
         ldxa            [%g4] ASI_DMMU, %g2
@@ -490,15 +573,20 @@ xcall_flush_tlb_page:	/* 17 insns */
         retry
         nop
         nop
+        nop
+        nop
+        nop
 
         .globl          xcall_flush_tlb_kernel_range
-xcall_flush_tlb_kernel_range:   /* 25 insns */
+xcall_flush_tlb_kernel_range:   /* 44 insns */
         sethi           %hi(PAGE_SIZE - 1), %g2
         or              %g2, %lo(PAGE_SIZE - 1), %g2
         andn            %g1, %g2, %g1
         andn            %g7, %g2, %g7
         sub             %g7, %g1, %g3
-        add             %g2, 1, %g2
+        srlx            %g3, 18, %g2
+        brnz,pn         %g2, 2f
+         add            %g2, 1, %g2
         sub             %g3, %g2, %g3
         or              %g1, 0x20, %g1          ! Nucleus
 1:      stxa            %g0, [%g1 + %g3] ASI_DMMU_DEMAP
@@ -507,8 +595,25 @@ xcall_flush_tlb_kernel_range:	/* 25 insns */
         brnz,pt         %g3, 1b
          sub            %g3, %g2, %g3
         retry
-        nop
-        nop
+2:      mov             63 * 8, %g1
+1:      ldxa            [%g1] ASI_ITLB_DATA_ACCESS, %g2
+        andcc           %g2, 0x40, %g0                  /* _PAGE_L_4U */
+        bne,pn          %xcc, 2f
+         mov            TLB_TAG_ACCESS, %g2
+        stxa            %g0, [%g2] ASI_IMMU
+        stxa            %g0, [%g1] ASI_ITLB_DATA_ACCESS
+        membar          #Sync
+2:      ldxa            [%g1] ASI_DTLB_DATA_ACCESS, %g2
+        andcc           %g2, 0x40, %g0
+        bne,pn          %xcc, 2f
+         mov            TLB_TAG_ACCESS, %g2
+        stxa            %g0, [%g2] ASI_DMMU
+        stxa            %g0, [%g1] ASI_DTLB_DATA_ACCESS
+        membar          #Sync
+2:      sub             %g1, 8, %g1
+        brgez,pt        %g1, 1b
+         nop
+        retry
         nop
         nop
         nop
@@ -637,6 +742,52 @@ xcall_fetch_glob_pmu_n4:
 
         retry
 
+__cheetah_xcall_flush_tlb_kernel_range: /* 44 insns */
+        sethi           %hi(PAGE_SIZE - 1), %g2
+        or              %g2, %lo(PAGE_SIZE - 1), %g2
+        andn            %g1, %g2, %g1
+        andn            %g7, %g2, %g7
+        sub             %g7, %g1, %g3
+        srlx            %g3, 18, %g2
+        brnz,pn         %g2, 2f
+         add            %g2, 1, %g2
+        sub             %g3, %g2, %g3
+        or              %g1, 0x20, %g1          ! Nucleus
+1:      stxa            %g0, [%g1 + %g3] ASI_DMMU_DEMAP
+        stxa            %g0, [%g1 + %g3] ASI_IMMU_DEMAP
+        membar          #Sync
+        brnz,pt         %g3, 1b
+         sub            %g3, %g2, %g3
+        retry
+2:      mov             0x80, %g2
+        stxa            %g0, [%g2] ASI_DMMU_DEMAP
+        membar          #Sync
+        stxa            %g0, [%g2] ASI_IMMU_DEMAP
+        membar          #Sync
+        retry
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+
 #ifdef DCACHE_ALIASING_POSSIBLE
         .align          32
         .globl          xcall_flush_dcache_page_cheetah
@@ -700,7 +851,7 @@ __hypervisor_tlb_xcall_error:
         ba,a,pt %xcc, rtrap
 
         .globl          __hypervisor_xcall_flush_tlb_mm
-__hypervisor_xcall_flush_tlb_mm: /* 21 insns */
+__hypervisor_xcall_flush_tlb_mm: /* 24 insns */
         /* %g5=ctx, g1,g2,g3,g4,g7=scratch, %g6=unusable */
         mov             %o0, %g2
         mov             %o1, %g3
@@ -714,7 +865,7 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
         mov             HV_FAST_MMU_DEMAP_CTX, %o5
         ta              HV_FAST_TRAP
         mov             HV_FAST_MMU_DEMAP_CTX, %g6
-        brnz,pn         %o0, __hypervisor_tlb_xcall_error
+        brnz,pn         %o0, 1f
          mov            %o0, %g5
         mov             %g2, %o0
         mov             %g3, %o1
@@ -723,9 +874,12 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
         mov             %g7, %o5
         membar          #Sync
         retry
+1:      sethi           %hi(__hypervisor_tlb_xcall_error), %g4
+        jmpl            %g4 + %lo(__hypervisor_tlb_xcall_error), %g0
+         nop
 
         .globl          __hypervisor_xcall_flush_tlb_page
-__hypervisor_xcall_flush_tlb_page: /* 17 insns */
+__hypervisor_xcall_flush_tlb_page: /* 20 insns */
         /* %g5=ctx, %g1=vaddr */
         mov             %o0, %g2
         mov             %o1, %g3
@@ -737,42 +891,64 @@ __hypervisor_xcall_flush_tlb_page: /* 17 insns */
         sllx            %o0, PAGE_SHIFT, %o0
         ta              HV_MMU_UNMAP_ADDR_TRAP
         mov             HV_MMU_UNMAP_ADDR_TRAP, %g6
-        brnz,a,pn       %o0, __hypervisor_tlb_xcall_error
+        brnz,a,pn       %o0, 1f
          mov            %o0, %g5
         mov             %g2, %o0
         mov             %g3, %o1
         mov             %g4, %o2
         membar          #Sync
         retry
+1:      sethi           %hi(__hypervisor_tlb_xcall_error), %g4
+        jmpl            %g4 + %lo(__hypervisor_tlb_xcall_error), %g0
+         nop
 
         .globl          __hypervisor_xcall_flush_tlb_kernel_range
-__hypervisor_xcall_flush_tlb_kernel_range: /* 25 insns */
+__hypervisor_xcall_flush_tlb_kernel_range: /* 44 insns */
         /* %g1=start, %g7=end, g2,g3,g4,g5,g6=scratch */
         sethi           %hi(PAGE_SIZE - 1), %g2
         or              %g2, %lo(PAGE_SIZE - 1), %g2
         andn            %g1, %g2, %g1
         andn            %g7, %g2, %g7
         sub             %g7, %g1, %g3
+        srlx            %g3, 18, %g7
         add             %g2, 1, %g2
         sub             %g3, %g2, %g3
         mov             %o0, %g2
         mov             %o1, %g4
-        mov             %o2, %g7
+        brnz,pn         %g7, 2f
+         mov            %o2, %g7
 1:      add             %g1, %g3, %o0   /* ARG0: virtual address */
         mov             0, %o1          /* ARG1: mmu context */
         mov             HV_MMU_ALL, %o2 /* ARG2: flags */
         ta              HV_MMU_UNMAP_ADDR_TRAP
         mov             HV_MMU_UNMAP_ADDR_TRAP, %g6
-        brnz,pn         %o0, __hypervisor_tlb_xcall_error
+        brnz,pn         %o0, 1f
          mov            %o0, %g5
         sethi           %hi(PAGE_SIZE), %o2
         brnz,pt         %g3, 1b
          sub            %g3, %o2, %g3
-        mov             %g2, %o0
+5:      mov             %g2, %o0
         mov             %g4, %o1
         mov             %g7, %o2
         membar          #Sync
         retry
+1:      sethi           %hi(__hypervisor_tlb_xcall_error), %g4
+        jmpl            %g4 + %lo(__hypervisor_tlb_xcall_error), %g0
+         nop
+2:      mov             %o3, %g1
+        mov             %o5, %g3
+        mov             0, %o0          /* ARG0: CPU lists unimplemented */
+        mov             0, %o1          /* ARG1: CPU lists unimplemented */
+        mov             0, %o2          /* ARG2: mmu context == nucleus */
+        mov             HV_MMU_ALL, %o3 /* ARG3: flags */
+        mov             HV_FAST_MMU_DEMAP_CTX, %o5
+        ta              HV_FAST_TRAP
+        mov             %g1, %o3
+        brz,pt          %o0, 5b
+         mov            %g3, %o5
+        mov             HV_FAST_MMU_DEMAP_CTX, %g6
+        ba,pt           %xcc, 1b
+         clr            %g5
 
         /* These just get rescheduled to PIL vectors. */
         .globl          xcall_call_function
@@ -809,6 +985,58 @@ xcall_kgdb_capture:
 
 #endif /* CONFIG_SMP */
 
+        .globl          cheetah_patch_cachetlbops
+cheetah_patch_cachetlbops:
+        save            %sp, -128, %sp
+
+        sethi           %hi(__flush_tlb_mm), %o0
+        or              %o0, %lo(__flush_tlb_mm), %o0
+        sethi           %hi(__cheetah_flush_tlb_mm), %o1
+        or              %o1, %lo(__cheetah_flush_tlb_mm), %o1
+        call            tlb_patch_one
+         mov            19, %o2
+
+        sethi           %hi(__flush_tlb_page), %o0
+        or              %o0, %lo(__flush_tlb_page), %o0
+        sethi           %hi(__cheetah_flush_tlb_page), %o1
+        or              %o1, %lo(__cheetah_flush_tlb_page), %o1
+        call            tlb_patch_one
+         mov            22, %o2
+
+        sethi           %hi(__flush_tlb_pending), %o0
+        or              %o0, %lo(__flush_tlb_pending), %o0
+        sethi           %hi(__cheetah_flush_tlb_pending), %o1
+        or              %o1, %lo(__cheetah_flush_tlb_pending), %o1
+        call            tlb_patch_one
+         mov            27, %o2
+
+        sethi           %hi(__flush_tlb_kernel_range), %o0
+        or              %o0, %lo(__flush_tlb_kernel_range), %o0
+        sethi           %hi(__cheetah_flush_tlb_kernel_range), %o1
+        or              %o1, %lo(__cheetah_flush_tlb_kernel_range), %o1
+        call            tlb_patch_one
+         mov            31, %o2
+
+#ifdef DCACHE_ALIASING_POSSIBLE
+        sethi           %hi(__flush_dcache_page), %o0
+        or              %o0, %lo(__flush_dcache_page), %o0
+        sethi           %hi(__cheetah_flush_dcache_page), %o1
+        or              %o1, %lo(__cheetah_flush_dcache_page), %o1
+        call            tlb_patch_one
+         mov            11, %o2
+#endif /* DCACHE_ALIASING_POSSIBLE */
+
+#ifdef CONFIG_SMP
+        sethi           %hi(xcall_flush_tlb_kernel_range), %o0
+        or              %o0, %lo(xcall_flush_tlb_kernel_range), %o0
+        sethi           %hi(__cheetah_xcall_flush_tlb_kernel_range), %o1
+        or              %o1, %lo(__cheetah_xcall_flush_tlb_kernel_range), %o1
+        call            tlb_patch_one
+         mov            44, %o2
+#endif /* CONFIG_SMP */
+
+        ret
+         restore
 
         .globl          hypervisor_patch_cachetlbops
 hypervisor_patch_cachetlbops:
@@ -819,28 +1047,28 @@ hypervisor_patch_cachetlbops:
         sethi           %hi(__hypervisor_flush_tlb_mm), %o1
         or              %o1, %lo(__hypervisor_flush_tlb_mm), %o1
         call            tlb_patch_one
-         mov            10, %o2
+         mov            19, %o2
 
         sethi           %hi(__flush_tlb_page), %o0
         or              %o0, %lo(__flush_tlb_page), %o0
         sethi           %hi(__hypervisor_flush_tlb_page), %o1
         or              %o1, %lo(__hypervisor_flush_tlb_page), %o1
         call            tlb_patch_one
-         mov            11, %o2
+         mov            22, %o2
 
         sethi           %hi(__flush_tlb_pending), %o0
         or              %o0, %lo(__flush_tlb_pending), %o0
         sethi           %hi(__hypervisor_flush_tlb_pending), %o1
         or              %o1, %lo(__hypervisor_flush_tlb_pending), %o1
         call            tlb_patch_one
-         mov            16, %o2
+         mov            27, %o2
 
         sethi           %hi(__flush_tlb_kernel_range), %o0
         or              %o0, %lo(__flush_tlb_kernel_range), %o0
         sethi           %hi(__hypervisor_flush_tlb_kernel_range), %o1
         or              %o1, %lo(__hypervisor_flush_tlb_kernel_range), %o1
         call            tlb_patch_one
-         mov            16, %o2
+         mov            31, %o2
 
 #ifdef DCACHE_ALIASING_POSSIBLE
         sethi           %hi(__flush_dcache_page), %o0
@@ -857,21 +1085,21 @@ hypervisor_patch_cachetlbops:
         sethi           %hi(__hypervisor_xcall_flush_tlb_mm), %o1
         or              %o1, %lo(__hypervisor_xcall_flush_tlb_mm), %o1
         call            tlb_patch_one
-         mov            21, %o2
+         mov            24, %o2
 
         sethi           %hi(xcall_flush_tlb_page), %o0
         or              %o0, %lo(xcall_flush_tlb_page), %o0
         sethi           %hi(__hypervisor_xcall_flush_tlb_page), %o1
         or              %o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1
         call            tlb_patch_one
-         mov            17, %o2
+         mov            20, %o2
 
         sethi           %hi(xcall_flush_tlb_kernel_range), %o0
         or              %o0, %lo(xcall_flush_tlb_kernel_range), %o0
         sethi           %hi(__hypervisor_xcall_flush_tlb_kernel_range), %o1
         or              %o1, %lo(__hypervisor_xcall_flush_tlb_kernel_range), %o1
         call            tlb_patch_one
-         mov            25, %o2
+         mov            44, %o2
 #endif /* CONFIG_SMP */
 
         ret
diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
index 6160761d5f61..4810e48dbbbf 100644
--- a/arch/tile/include/asm/cache.h
+++ b/arch/tile/include/asm/cache.h
@@ -61,4 +61,7 @@
  */
 #define __write_once __read_mostly
 
+/* __ro_after_init is the generic name for the tile arch __write_once. */
+#define __ro_after_init __read_mostly
+
 #endif /* _ASM_TILE_CACHE_H */
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 0ab5ee1c26af..aa8b0672f87a 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -888,7 +888,7 @@ static int helper_rfc4106_encrypt(struct aead_request *req)
         unsigned long auth_tag_len = crypto_aead_authsize(tfm);
         u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
         struct scatter_walk src_sg_walk;
-        struct scatter_walk dst_sg_walk;
+        struct scatter_walk dst_sg_walk = {};
         unsigned int i;
 
         /* Assuming we are supporting rfc4106 64-bit extended */
@@ -968,7 +968,7 @@ static int helper_rfc4106_decrypt(struct aead_request *req)
         u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
         u8 authTag[16];
         struct scatter_walk src_sg_walk;
-        struct scatter_walk dst_sg_walk;
+        struct scatter_walk dst_sg_walk = {};
         unsigned int i;
 
         if (unlikely(req->assoclen != 16 && req->assoclen != 20))
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 5f845eef9a4d..81195cca7eae 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -8,8 +8,12 @@
 #define PCI_DEVICE_ID_INTEL_HSW_IMC     0x0c00
 #define PCI_DEVICE_ID_INTEL_HSW_U_IMC   0x0a04
 #define PCI_DEVICE_ID_INTEL_BDW_IMC     0x1604
-#define PCI_DEVICE_ID_INTEL_SKL_IMC     0x191f
-#define PCI_DEVICE_ID_INTEL_SKL_U_IMC   0x190c
+#define PCI_DEVICE_ID_INTEL_SKL_U_IMC   0x1904
+#define PCI_DEVICE_ID_INTEL_SKL_Y_IMC   0x190c
+#define PCI_DEVICE_ID_INTEL_SKL_HD_IMC  0x1900
+#define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC  0x1910
+#define PCI_DEVICE_ID_INTEL_SKL_SD_IMC  0x190f
+#define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC  0x191f
 
 /* SNB event control */
 #define SNB_UNC_CTL_EV_SEL_MASK                 0x000000ff
@@ -616,13 +620,29 @@ static const struct pci_device_id bdw_uncore_pci_ids[] = {
 
 static const struct pci_device_id skl_uncore_pci_ids[] = {
         { /* IMC */
-                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_IMC),
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_Y_IMC),
                 .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
         },
         { /* IMC */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_U_IMC),
                 .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
         },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_HD_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_HQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SD_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
 
         { /* end: all zeroes */ },
 };
@@ -666,8 +686,12 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
         IMC_DEV(HSW_IMC, &hsw_uncore_pci_driver),    /* 4th Gen Core Processor */
         IMC_DEV(HSW_U_IMC, &hsw_uncore_pci_driver),  /* 4th Gen Core ULT Mobile Processor */
         IMC_DEV(BDW_IMC, &bdw_uncore_pci_driver),    /* 5th Gen Core U */
-        IMC_DEV(SKL_IMC, &skl_uncore_pci_driver),    /* 6th Gen Core */
+        IMC_DEV(SKL_Y_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core Y */
         IMC_DEV(SKL_U_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core U */
+        IMC_DEV(SKL_HD_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core H Dual Core */
+        IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core H Quad Core */
+        IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Dual Core */
+        IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Quad Core */
         {  /* end marker */ }
 };
 
diff --git a/arch/x86/include/asm/intel-mid.h b/arch/x86/include/asm/intel-mid.h
index 5b6753d1f7f4..49da9f497b90 100644
--- a/arch/x86/include/asm/intel-mid.h
+++ b/arch/x86/include/asm/intel-mid.h
@@ -17,6 +17,7 @@
 
 extern int intel_mid_pci_init(void);
 extern int intel_mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state);
+extern pci_power_t intel_mid_pci_get_power_state(struct pci_dev *pdev);
 
 extern void intel_mid_pwr_power_off(void);
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 4b20f7304b9c..bdde80731f49 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -948,7 +948,6 @@ struct kvm_x86_ops {
         int (*get_lpage_level)(void);
         bool (*rdtscp_supported)(void);
         bool (*invpcid_supported)(void);
-        void (*adjust_tsc_offset_guest)(struct kvm_vcpu *vcpu, s64 adjustment);
 
         void (*set_tdp_cr3)(struct kvm_vcpu *vcpu, unsigned long cr3);
 
@@ -958,8 +957,6 @@ struct kvm_x86_ops {
 
         void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
 
-        u64 (*read_l1_tsc)(struct kvm_vcpu *vcpu, u64 host_tsc);
-
         void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);
 
         int (*check_intercept)(struct kvm_vcpu *vcpu,
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index c7364bd633e1..51287cd90bf6 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -1042,8 +1042,11 @@ static int apm_get_power_status(u_short *status, u_short *bat, u_short *life)
 
         if (apm_info.get_power_status_broken)
                 return APM_32_UNSUPPORTED;
-        if (apm_bios_call(&call))
+        if (apm_bios_call(&call)) {
+                if (!call.err)
+                        return APM_NO_ERROR;
                 return call.err;
+        }
         *status = call.ebx;
         *bat = call.ecx;
         if (apm_info.get_power_status_swabinminutes) {
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index b81fe2d63e15..1e81a37c034e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -347,7 +347,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
 #ifdef CONFIG_SMP
         unsigned bits;
         int cpu = smp_processor_id();
-        unsigned int socket_id, core_complex_id;
 
         bits = c->x86_coreid_bits;
         /* Low order bits define the core id (index of core in socket) */
@@ -365,10 +364,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
          if (c->x86 != 0x17 || !cpuid_edx(0x80000006))
                 return;
 
-        socket_id       = (c->apicid >> bits) - 1;
-        core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3;
-
-        per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id;
+        per_cpu(cpu_llc_id, cpu) = c->apicid >> 3;
 #endif
 }
 
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 9bd910a7dd0a..cc9e980c68ec 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -979,6 +979,35 @@ static void x86_init_cache_qos(struct cpuinfo_x86 *c)
 }
 
 /*
+ * The physical to logical package id mapping is initialized from the
+ * acpi/mptables information. Make sure that CPUID actually agrees with
+ * that.
+ */
+static void sanitize_package_id(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_SMP
+        unsigned int pkg, apicid, cpu = smp_processor_id();
+
+        apicid = apic->cpu_present_to_apicid(cpu);
+        pkg = apicid >> boot_cpu_data.x86_coreid_bits;
+
+        if (apicid != c->initial_apicid) {
+                pr_err(FW_BUG "CPU%u: APIC id mismatch. Firmware: %x CPUID: %x\n",
+                       cpu, apicid, c->initial_apicid);
+                c->initial_apicid = apicid;
+        }
+        if (pkg != c->phys_proc_id) {
+                pr_err(FW_BUG "CPU%u: Using firmware package id %u instead of %u\n",
+                       cpu, pkg, c->phys_proc_id);
+                c->phys_proc_id = pkg;
+        }
+        c->logical_proc_id = topology_phys_to_logical_pkg(pkg);
+#else
+        c->logical_proc_id = 0;
+#endif
+}
+
+/*
  * This does the hard work of actually picking apart the CPU stuff...
  */
 static void identify_cpu(struct cpuinfo_x86 *c)
@@ -1103,8 +1132,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 #ifdef CONFIG_NUMA
         numa_add_cpu(smp_processor_id());
 #endif
-        /* The boot/hotplug time assigment got cleared, restore it */
-        c->logical_proc_id = topology_phys_to_logical_pkg(c->phys_proc_id);
+        sanitize_package_id(c);
 }
 
 /*
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 4e95d3eb2955..cbd7b92585bb 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -5045,7 +5045,7 @@ done_prefixes:
         /* Decode and fetch the destination operand: register or memory. */
         rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
 
-        if (ctxt->rip_relative)
+        if (ctxt->rip_relative && likely(ctxt->memopp))
                 ctxt->memopp->addr.mem.ea = address_mask(ctxt,
                                         ctxt->memopp->addr.mem.ea + ctxt->_eip);
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index f8157a36ab09..8ca1eca5038d 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1138,21 +1138,6 @@ static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
 }
 
-static void svm_adjust_tsc_offset_guest(struct kvm_vcpu *vcpu, s64 adjustment)
-{
-        struct vcpu_svm *svm = to_svm(vcpu);
-
-        svm->vmcb->control.tsc_offset += adjustment;
-        if (is_guest_mode(vcpu))
-                svm->nested.hsave->control.tsc_offset += adjustment;
-        else
-                trace_kvm_write_tsc_offset(vcpu->vcpu_id,
-                                     svm->vmcb->control.tsc_offset - adjustment,
-                                     svm->vmcb->control.tsc_offset);
-
-        mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
-}
-
 static void avic_init_vmcb(struct vcpu_svm *svm)
 {
         struct vmcb *vmcb = svm->vmcb;
@@ -3449,12 +3434,6 @@ static int cr8_write_interception(struct vcpu_svm *svm)
         return 0;
 }
 
-static u64 svm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
-{
-        struct vmcb *vmcb = get_host_vmcb(to_svm(vcpu));
-        return vmcb->control.tsc_offset + host_tsc;
-}
-
 static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
@@ -5422,8 +5401,6 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .has_wbinvd_exit = svm_has_wbinvd_exit,
 
         .write_tsc_offset = svm_write_tsc_offset,
-        .adjust_tsc_offset_guest = svm_adjust_tsc_offset_guest,
-        .read_l1_tsc = svm_read_l1_tsc,
 
         .set_tdp_cr3 = set_tdp_cr3,
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index cf1b16dbc98a..5382b82462fc 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -187,6 +187,7 @@ struct vmcs {
  */
 struct loaded_vmcs {
         struct vmcs *vmcs;
+        struct vmcs *shadow_vmcs;
         int cpu;
         int launched;
         struct list_head loaded_vmcss_on_cpu_link;
@@ -411,7 +412,6 @@ struct nested_vmx {
          * memory during VMXOFF, VMCLEAR, VMPTRLD.
          */
         struct vmcs12 *cached_vmcs12;
-        struct vmcs *current_shadow_vmcs;
         /*
          * Indicates if the shadow vmcs must be updated with the
          * data hold by vmcs12
@@ -421,7 +421,6 @@ struct nested_vmx {
         /* vmcs02_list cache of VMCSs recently used to run L2 guests */
         struct list_head vmcs02_pool;
         int vmcs02_num;
-        u64 vmcs01_tsc_offset;
         bool change_vmcs01_virtual_x2apic_mode;
         /* L2 must run next, and mustn't decide to exit to L1. */
         bool nested_run_pending;
@@ -1419,6 +1418,8 @@ static void vmcs_clear(struct vmcs *vmcs)
 static inline void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
 {
         vmcs_clear(loaded_vmcs->vmcs);
+        if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
+                vmcs_clear(loaded_vmcs->shadow_vmcs);
         loaded_vmcs->cpu = -1;
         loaded_vmcs->launched = 0;
 }
@@ -2605,20 +2606,6 @@ static u64 guest_read_tsc(struct kvm_vcpu *vcpu)
 }
 
 /*
- * Like guest_read_tsc, but always returns L1's notion of the timestamp
- * counter, even if a nested guest (L2) is currently running.
- */
-static u64 vmx_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
-{
-        u64 tsc_offset;
-
-        tsc_offset = is_guest_mode(vcpu) ?
-                to_vmx(vcpu)->nested.vmcs01_tsc_offset :
-                vmcs_read64(TSC_OFFSET);
-        return host_tsc + tsc_offset;
-}
-
-/*
  * writes 'offset' into guest's timestamp counter offset register
  */
 static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
@@ -2631,7 +2618,6 @@ static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
                  * to the newly set TSC to get L2's TSC.
                  */
                 struct vmcs12 *vmcs12;
-                to_vmx(vcpu)->nested.vmcs01_tsc_offset = offset;
                 /* recalculate vmcs02.TSC_OFFSET: */
                 vmcs12 = get_vmcs12(vcpu);
                 vmcs_write64(TSC_OFFSET, offset +
@@ -2644,19 +2630,6 @@ static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
         }
 }
 
-static void vmx_adjust_tsc_offset_guest(struct kvm_vcpu *vcpu, s64 adjustment)
-{
-        u64 offset = vmcs_read64(TSC_OFFSET);
-
-        vmcs_write64(TSC_OFFSET, offset + adjustment);
-        if (is_guest_mode(vcpu)) {
-                /* Even when running L2, the adjustment needs to apply to L1 */
-                to_vmx(vcpu)->nested.vmcs01_tsc_offset += adjustment;
-        } else
-                trace_kvm_write_tsc_offset(vcpu->vcpu_id, offset,
-                                           offset + adjustment);
-}
-
 static bool guest_cpuid_has_vmx(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best = kvm_find_cpuid_entry(vcpu, 1, 0);
@@ -3562,6 +3535,7 @@ static void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
         loaded_vmcs_clear(loaded_vmcs);
         free_vmcs(loaded_vmcs->vmcs);
         loaded_vmcs->vmcs = NULL;
+        WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
 }
 
 static void free_kvm_area(void)
@@ -6696,6 +6670,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
         if (!item)
                 return NULL;
         item->vmcs02.vmcs = alloc_vmcs();
+        item->vmcs02.shadow_vmcs = NULL;
         if (!item->vmcs02.vmcs) {
                 kfree(item);
                 return NULL;
@@ -7072,7 +7047,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 shadow_vmcs->revision_id |= (1u << 31);
                 /* init shadow vmcs */
                 vmcs_clear(shadow_vmcs);
-                vmx->nested.current_shadow_vmcs = shadow_vmcs;
+                vmx->vmcs01.shadow_vmcs = shadow_vmcs;
         }
 
         INIT_LIST_HEAD(&(vmx->nested.vmcs02_pool));
@@ -7174,8 +7149,11 @@ static void free_nested(struct vcpu_vmx *vmx)
                 free_page((unsigned long)vmx->nested.msr_bitmap);
                 vmx->nested.msr_bitmap = NULL;
         }
-        if (enable_shadow_vmcs)
-                free_vmcs(vmx->nested.current_shadow_vmcs);
+        if (enable_shadow_vmcs) {
+                vmcs_clear(vmx->vmcs01.shadow_vmcs);
+                free_vmcs(vmx->vmcs01.shadow_vmcs);
+                vmx->vmcs01.shadow_vmcs = NULL;
+        }
         kfree(vmx->nested.cached_vmcs12);
         /* Unpin physical memory we referred to in current vmcs02 */
         if (vmx->nested.apic_access_page) {
@@ -7352,7 +7330,7 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
         int i;
         unsigned long field;
         u64 field_value;
-        struct vmcs *shadow_vmcs = vmx->nested.current_shadow_vmcs;
+        struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
         const unsigned long *fields = shadow_read_write_fields;
         const int num_fields = max_shadow_read_write_fields;
 
@@ -7401,7 +7379,7 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
         int i, q;
         unsigned long field;
         u64 field_value = 0;
-        struct vmcs *shadow_vmcs = vmx->nested.current_shadow_vmcs;
+        struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
 
         vmcs_load(shadow_vmcs);
 
@@ -7591,7 +7569,7 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
                         vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
                                       SECONDARY_EXEC_SHADOW_VMCS);
                         vmcs_write64(VMCS_LINK_POINTER,
-                                     __pa(vmx->nested.current_shadow_vmcs));
+                                     __pa(vmx->vmcs01.shadow_vmcs));
                         vmx->nested.sync_shadow_vmcs = true;
                 }
         }
@@ -7659,7 +7637,7 @@ static int handle_invept(struct kvm_vcpu *vcpu)
 
         types = (vmx->nested.nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;
 
-        if (!(types & (1UL << type))) {
+        if (type >= 32 || !(types & (1 << type))) {
                 nested_vmx_failValid(vcpu,
                                 VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
                 skip_emulated_instruction(vcpu);
@@ -7722,7 +7700,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
 
         types = (vmx->nested.nested_vmx_vpid_caps >> 8) & 0x7;
 
-        if (!(types & (1UL << type))) {
+        if (type >= 32 || !(types & (1 << type))) {
                 nested_vmx_failValid(vcpu,
                         VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
                 skip_emulated_instruction(vcpu);
@@ -9156,6 +9134,7 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 
         vmx->loaded_vmcs = &vmx->vmcs01;
         vmx->loaded_vmcs->vmcs = alloc_vmcs();
+        vmx->loaded_vmcs->shadow_vmcs = NULL;
         if (!vmx->loaded_vmcs->vmcs)
                 goto free_msrs;
         if (!vmm_exclusive)
@@ -10061,9 +10040,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 
         if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
                 vmcs_write64(TSC_OFFSET,
-                        vmx->nested.vmcs01_tsc_offset + vmcs12->tsc_offset);
+                        vcpu->arch.tsc_offset + vmcs12->tsc_offset);
         else
-                vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+                vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
         if (kvm_has_tsc_control)
                 decache_tsc_multiplier(vmx);
 
@@ -10293,8 +10272,6 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
 
         enter_guest_mode(vcpu);
 
-        vmx->nested.vmcs01_tsc_offset = vmcs_read64(TSC_OFFSET);
-
         if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
                 vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
 
@@ -10818,7 +10795,7 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
         load_vmcs12_host_state(vcpu, vmcs12);
 
         /* Update any VMCS fields that might have changed while L2 ran */
-        vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+        vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
         if (vmx->hv_deadline_tsc == -1)
                 vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL,
                                 PIN_BASED_VMX_PREEMPTION_TIMER);
@@ -11339,8 +11316,6 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
 
         .write_tsc_offset = vmx_write_tsc_offset,
-        .adjust_tsc_offset_guest = vmx_adjust_tsc_offset_guest,
-        .read_l1_tsc = vmx_read_l1_tsc,
 
         .set_tdp_cr3 = vmx_set_cr3,
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e375235d81c9..3017de0431bd 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1409,7 +1409,7 @@ static u64 kvm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
 
 u64 kvm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
 {
-        return kvm_x86_ops->read_l1_tsc(vcpu, kvm_scale_tsc(vcpu, host_tsc));
+        return vcpu->arch.tsc_offset + kvm_scale_tsc(vcpu, host_tsc);
 }
 EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
 
@@ -1547,7 +1547,7 @@ EXPORT_SYMBOL_GPL(kvm_write_tsc);
 static inline void adjust_tsc_offset_guest(struct kvm_vcpu *vcpu,
                                            s64 adjustment)
 {
-        kvm_x86_ops->adjust_tsc_offset_guest(vcpu, adjustment);
+        kvm_vcpu_write_tsc_offset(vcpu, vcpu->arch.tsc_offset + adjustment);
 }
 
 static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
@@ -1555,7 +1555,7 @@ static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
         if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio)
                 WARN_ON(adjustment < 0);
         adjustment = kvm_scale_tsc(vcpu, (u64) adjustment);
-        kvm_x86_ops->adjust_tsc_offset_guest(vcpu, adjustment);
+        adjust_tsc_offset_guest(vcpu, adjustment);
 }
 
 #ifdef CONFIG_X86_64
@@ -2262,7 +2262,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 /* Drop writes to this legacy MSR -- see rdmsr
                  * counterpart for further detail.
                  */
-                vcpu_unimpl(vcpu, "ignored wrmsr: 0x%x data %llx\n", msr, data);
+                vcpu_unimpl(vcpu, "ignored wrmsr: 0x%x data 0x%llx\n", msr, data);
                 break;
         case MSR_AMD64_OSVW_ID_LENGTH:
                 if (!guest_cpuid_has_osvw(vcpu))
@@ -2280,11 +2280,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 if (kvm_pmu_is_valid_msr(vcpu, msr))
                         return kvm_pmu_set_msr(vcpu, msr_info);
                 if (!ignore_msrs) {
-                        vcpu_unimpl(vcpu, "unhandled wrmsr: 0x%x data %llx\n",
+                        vcpu_unimpl(vcpu, "unhandled wrmsr: 0x%x data 0x%llx\n",
                                     msr, data);
                         return 1;
                 } else {
-                        vcpu_unimpl(vcpu, "ignored wrmsr: 0x%x data %llx\n",
+                        vcpu_unimpl(vcpu, "ignored wrmsr: 0x%x data 0x%llx\n",
                                     msr, data);
                         break;
                 }
@@ -7410,10 +7410,12 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
 
 void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
 {
+        void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
+
         kvmclock_reset(vcpu);
 
-        free_cpumask_var(vcpu->arch.wbinvd_dirty_mask);
         kvm_x86_ops->vcpu_free(vcpu);
+        free_cpumask_var(wbinvd_dirty_mask);
 }
 
 struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index bf99aa7005eb..936a488d6cf6 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -861,7 +861,7 @@ static void __init __efi_enter_virtual_mode(void)
         int count = 0, pg_shift = 0;
         void *new_memmap = NULL;
         efi_status_t status;
-        phys_addr_t pa;
+        unsigned long pa;
 
         efi.systab = NULL;
 
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 58b0f801f66f..319148bd4b05 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -31,6 +31,7 @@
 #include <linux/io.h>
 #include <linux/reboot.h>
 #include <linux/slab.h>
+#include <linux/ucs2_string.h>
 
 #include <asm/setup.h>
 #include <asm/page.h>
@@ -211,6 +212,35 @@ void efi_sync_low_kernel_mappings(void)
         memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries);
 }
 
+/*
+ * Wrapper for slow_virt_to_phys() that handles NULL addresses.
+ */
+static inline phys_addr_t
+virt_to_phys_or_null_size(void *va, unsigned long size)
+{
+        bool bad_size;
+
+        if (!va)
+                return 0;
+
+        if (virt_addr_valid(va))
+                return virt_to_phys(va);
+
+        /*
+         * A fully aligned variable on the stack is guaranteed not to
+         * cross a page bounary. Try to catch strings on the stack by
+         * checking that 'size' is a power of two.
+         */
+        bad_size = size > PAGE_SIZE || !is_power_of_2(size);
+
+        WARN_ON(!IS_ALIGNED((unsigned long)va, size) || bad_size);
+
+        return slow_virt_to_phys(va);
+}
+
+#define virt_to_phys_or_null(addr)                              \
+        virt_to_phys_or_null_size((addr), sizeof(*(addr)))
+
 int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
 {
         unsigned long pfn, text;
@@ -494,8 +524,8 @@ static efi_status_t efi_thunk_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
-        phys_tc = virt_to_phys(tc);
+        phys_tm = virt_to_phys_or_null(tm);
+        phys_tc = virt_to_phys_or_null(tc);
 
         status = efi_thunk(get_time, phys_tm, phys_tc);
 
@@ -511,7 +541,7 @@ static efi_status_t efi_thunk_set_time(efi_time_t *tm)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_time, phys_tm);
 
@@ -529,9 +559,9 @@ efi_thunk_get_wakeup_time(efi_bool_t *enabled, efi_bool_t *pending,
 
         spin_lock(&rtc_lock);
 
-        phys_enabled = virt_to_phys(enabled);
-        phys_pending = virt_to_phys(pending);
-        phys_tm = virt_to_phys(tm);
+        phys_enabled = virt_to_phys_or_null(enabled);
+        phys_pending = virt_to_phys_or_null(pending);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(get_wakeup_time, phys_enabled,
                              phys_pending, phys_tm);
@@ -549,7 +579,7 @@ efi_thunk_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_wakeup_time, enabled, phys_tm);
 
@@ -558,6 +588,10 @@ efi_thunk_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
         return status;
 }
 
+static unsigned long efi_name_size(efi_char16_t *name)
+{
+        return ucs2_strsize(name, EFI_VAR_NAME_LEN) + 1;
+}
 
 static efi_status_t
 efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
@@ -567,11 +601,11 @@ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
         u32 phys_name, phys_vendor, phys_attr;
         u32 phys_data_size, phys_data;
 
-        phys_data_size = virt_to_phys(data_size);
-        phys_vendor = virt_to_phys(vendor);
-        phys_name = virt_to_phys(name);
-        phys_attr = virt_to_phys(attr);
-        phys_data = virt_to_phys(data);
+        phys_data_size = virt_to_phys_or_null(data_size);
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+        phys_attr = virt_to_phys_or_null(attr);
+        phys_data = virt_to_phys_or_null_size(data, *data_size);
 
         status = efi_thunk(get_variable, phys_name, phys_vendor,
                            phys_attr, phys_data_size, phys_data);
@@ -586,9 +620,9 @@ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
         u32 phys_name, phys_vendor, phys_data;
         efi_status_t status;
 
-        phys_name = virt_to_phys(name);
-        phys_vendor = virt_to_phys(vendor);
-        phys_data = virt_to_phys(data);
+        phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_data = virt_to_phys_or_null_size(data, data_size);
 
         /* If data_size is > sizeof(u32) we've got problems */
         status = efi_thunk(set_variable, phys_name, phys_vendor,
@@ -605,9 +639,9 @@ efi_thunk_get_next_variable(unsigned long *name_size,
         efi_status_t status;
         u32 phys_name_size, phys_name, phys_vendor;
 
-        phys_name_size = virt_to_phys(name_size);
-        phys_vendor = virt_to_phys(vendor);
-        phys_name = virt_to_phys(name);
+        phys_name_size = virt_to_phys_or_null(name_size);
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_name = virt_to_phys_or_null_size(name, *name_size);
 
         status = efi_thunk(get_next_variable, phys_name_size,
                            phys_name, phys_vendor);
@@ -621,7 +655,7 @@ efi_thunk_get_next_high_mono_count(u32 *count)
         efi_status_t status;
         u32 phys_count;
 
-        phys_count = virt_to_phys(count);
+        phys_count = virt_to_phys_or_null(count);
         status = efi_thunk(get_next_high_mono_count, phys_count);
 
         return status;
@@ -633,7 +667,7 @@ efi_thunk_reset_system(int reset_type, efi_status_t status,
 {
         u32 phys_data;
 
-        phys_data = virt_to_phys(data);
+        phys_data = virt_to_phys_or_null_size(data, data_size);
 
         efi_thunk(reset_system, reset_type, status, data_size, phys_data);
 }
@@ -661,9 +695,9 @@ efi_thunk_query_variable_info(u32 attr, u64 *storage_space,
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
-        phys_storage = virt_to_phys(storage_space);
-        phys_remaining = virt_to_phys(remaining_space);
-        phys_max = virt_to_phys(max_variable_size);
+        phys_storage = virt_to_phys_or_null(storage_space);
+        phys_remaining = virt_to_phys_or_null(remaining_space);
+        phys_max = virt_to_phys_or_null(max_variable_size);
 
         status = efi_thunk(query_variable_info, attr, phys_storage,
                            phys_remaining, phys_max);
diff --git a/arch/x86/platform/intel-mid/pwr.c b/arch/x86/platform/intel-mid/pwr.c
index 5d3b45ad1c03..67375dda451c 100644
--- a/arch/x86/platform/intel-mid/pwr.c
+++ b/arch/x86/platform/intel-mid/pwr.c
@@ -272,6 +272,25 @@ int intel_mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state)
 }
 EXPORT_SYMBOL_GPL(intel_mid_pci_set_power_state);
 
+pci_power_t intel_mid_pci_get_power_state(struct pci_dev *pdev)
+{
+        struct mid_pwr *pwr = midpwr;
+        int id, reg, bit;
+        u32 power;
+
+        if (!pwr || !pwr->available)
+                return PCI_UNKNOWN;
+
+        id = intel_mid_pwr_get_lss_id(pdev);
+        if (id < 0)
+                return PCI_UNKNOWN;
+
+        reg = (id * LSS_PWS_BITS) / 32;
+        bit = (id * LSS_PWS_BITS) % 32;
+        power = mid_pwr_get_state(pwr, reg);
+        return (__force pci_power_t)((power >> bit) & 3);
+}
+
 void intel_mid_pwr_power_off(void)
 {
         struct mid_pwr *pwr = midpwr;
diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c
index d58fbf7f04e6..7dd70927991e 100644
--- a/drivers/acpi/acpi_apd.c
+++ b/drivers/acpi/acpi_apd.c
@@ -122,7 +122,7 @@ static int acpi_apd_create_device(struct acpi_device *adev,
         int ret;
 
         if (!dev_desc) {
-                pdev = acpi_create_platform_device(adev);
+                pdev = acpi_create_platform_device(adev, NULL);
                 return IS_ERR_OR_NULL(pdev) ? PTR_ERR(pdev) : 1;
         }
 
@@ -139,14 +139,8 @@ static int acpi_apd_create_device(struct acpi_device *adev,
                         goto err_out;
         }
 
-        if (dev_desc->properties) {
-                ret = device_add_properties(&adev->dev, dev_desc->properties);
-                if (ret)
-                        goto err_out;
-        }
-
         adev->driver_data = pdata;
-        pdev = acpi_create_platform_device(adev);
+        pdev = acpi_create_platform_device(adev, dev_desc->properties);
         if (!IS_ERR_OR_NULL(pdev))
                 return 1;
 
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 552010288135..373657f7e35a 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -395,7 +395,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
 
         dev_desc = (const struct lpss_device_desc *)id->driver_data;
         if (!dev_desc) {
-                pdev = acpi_create_platform_device(adev);
+                pdev = acpi_create_platform_device(adev, NULL);
                 return IS_ERR_OR_NULL(pdev) ? PTR_ERR(pdev) : 1;
         }
         pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -451,14 +451,8 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
                 goto err_out;
         }
 
-        if (dev_desc->properties) {
-                ret = device_add_properties(&adev->dev, dev_desc->properties);
-                if (ret)
-                        goto err_out;
-        }
-
         adev->driver_data = pdata;
-        pdev = acpi_create_platform_device(adev);
+        pdev = acpi_create_platform_device(adev, dev_desc->properties);
         if (!IS_ERR_OR_NULL(pdev)) {
                 return 1;
         }
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index b200ae1f3c6f..b4c1a6a51da4 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -50,6 +50,7 @@ static void acpi_platform_fill_resource(struct acpi_device *adev,
 /**
  * acpi_create_platform_device - Create platform device for ACPI device node
  * @adev: ACPI device node to create a platform device for.
+ * @properties: Optional collection of build-in properties.
  *
  * Check if the given @adev can be represented as a platform device and, if
  * that's the case, create and register a platform device, populate its common
@@ -57,7 +58,8 @@ static void acpi_platform_fill_resource(struct acpi_device *adev,
  *
  * Name of the platform device will be the same as @adev's.
  */
-struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
+struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
+                                        struct property_entry *properties)
 {
         struct platform_device *pdev = NULL;
         struct platform_device_info pdevinfo;
@@ -106,6 +108,7 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
         pdevinfo.res = resources;
         pdevinfo.num_res = count;
         pdevinfo.fwnode = acpi_fwnode_handle(adev);
+        pdevinfo.properties = properties;
 
         if (acpi_dma_supported(adev))
                 pdevinfo.dma_mask = DMA_BIT_MASK(32);
diff --git a/drivers/acpi/dptf/int340x_thermal.c b/drivers/acpi/dptf/int340x_thermal.c
index 33505c651f62..86364097e236 100644
--- a/drivers/acpi/dptf/int340x_thermal.c
+++ b/drivers/acpi/dptf/int340x_thermal.c
@@ -34,11 +34,11 @@ static int int340x_thermal_handler_attach(struct acpi_device *adev,
                                         const struct acpi_device_id *id)
 {
         if (IS_ENABLED(CONFIG_INT340X_THERMAL))
-                acpi_create_platform_device(adev);
+                acpi_create_platform_device(adev, NULL);
         /* Intel SoC DTS thermal driver needs INT3401 to set IRQ descriptor */
         else if (IS_ENABLED(CONFIG_INTEL_SOC_DTS_THERMAL) &&
                  id->driver_data == INT3401_DEVICE)
-                acpi_create_platform_device(adev);
+                acpi_create_platform_device(adev, NULL);
         return 1;
 }
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 035ac646d8db..3d1856f1f4d0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1734,7 +1734,7 @@ static void acpi_default_enumeration(struct acpi_device *device)
                                &is_spi_i2c_slave);
         acpi_dev_free_resource_list(&resource_list);
         if (!is_spi_i2c_slave) {
-                acpi_create_platform_device(device);
+                acpi_create_platform_device(device, NULL);
                 acpi_device_set_enumerated(device);
         } else {
                 blocking_notifier_call_chain(&acpi_reconfig_chain,
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d22a7260f42b..d76cd97a98b6 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -324,7 +324,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 {
         int ret = -EPROBE_DEFER;
         int local_trigger_count = atomic_read(&deferred_trigger_count);
-        bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE);
+        bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE) &&
+                           !drv->suppress_bind_attrs;
 
         if (defer_all_probes) {
                 /*
@@ -383,7 +384,7 @@ re_probe:
         if (test_remove) {
                 test_remove = false;
 
-                if (dev->bus && dev->bus->remove)
+                if (dev->bus->remove)
                         dev->bus->remove(dev);
                 else if (drv->remove)
                         drv->remove(dev);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e44944f4be77..2932a5bd892f 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1027,6 +1027,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         TRACE_DEVICE(dev);
         TRACE_SUSPEND(0);
 
+        dpm_wait_for_children(dev, async);
+
         if (async_error)
                 goto Complete;
 
@@ -1038,8 +1040,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
-        dpm_wait_for_children(dev, async);
-
         if (dev->pm_domain) {
                 info = "noirq power domain ";
                 callback = pm_noirq_op(&dev->pm_domain->ops, state);
@@ -1174,6 +1174,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
 
         __pm_runtime_disable(dev, false);
 
+        dpm_wait_for_children(dev, async);
+
         if (async_error)
                 goto Complete;
 
@@ -1185,8 +1187,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
-        dpm_wait_for_children(dev, async);
-
         if (dev->pm_domain) {
                 info = "late power domain ";
                 callback = pm_late_early_op(&dev->pm_domain->ops, state);
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index ab19adb07a12..3c606c09fd5a 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -853,45 +853,6 @@ rqbiocnt(struct request *r)
         return n;
 }
 
-/* This can be removed if we are certain that no users of the block
- * layer will ever use zero-count pages in bios.  Otherwise we have to
- * protect against the put_page sometimes done by the network layer.
- *
- * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
- * discussion.
- *
- * We cannot use get_page in the workaround, because it insists on a
- * positive page count as a precondition.  So we use _refcount directly.
- */
-static void
-bio_pageinc(struct bio *bio)
-{
-        struct bio_vec bv;
-        struct page *page;
-        struct bvec_iter iter;
-
-        bio_for_each_segment(bv, bio, iter) {
-                /* Non-zero page count for non-head members of
-                 * compound pages is no longer allowed by the kernel.
-                 */
-                page = compound_head(bv.bv_page);
-                page_ref_inc(page);
-        }
-}
-
-static void
-bio_pagedec(struct bio *bio)
-{
-        struct page *page;
-        struct bio_vec bv;
-        struct bvec_iter iter;
-
-        bio_for_each_segment(bv, bio, iter) {
-                page = compound_head(bv.bv_page);
-                page_ref_dec(page);
-        }
-}
-
 static void
 bufinit(struct buf *buf, struct request *rq, struct bio *bio)
 {
@@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request *rq, struct bio *bio)
         buf->rq = rq;
         buf->bio = bio;
         buf->iter = bio->bi_iter;
-        bio_pageinc(bio);
 }
 
 static struct buf *
@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf *buf)
         if (buf == d->ip.buf)
                 d->ip.buf = NULL;
         rq = buf->rq;
-        bio_pagedec(buf->bio);
         mempool_free(buf, d->bufpool);
         n = (unsigned long) rq->special;
         rq->special = (void *) --n;
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 100be556e613..83482721bc01 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1871,7 +1871,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock,
                 drbd_update_congested(connection);
         }
         do {
-                rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
+                rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
                 if (rv == -EAGAIN) {
                         if (we_should_drop_the_connection(connection, sock))
                                 break;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 19a16b2dbb91..7a1048755914 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -599,7 +599,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                         return -EINVAL;
 
                 sreq = blk_mq_alloc_request(bdev_get_queue(bdev), WRITE, 0);
-                if (!sreq)
+                if (IS_ERR(sreq))
                         return -ENOMEM;
 
                 mutex_unlock(&nbd->tx_lock);
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2dc5c96c186a..5545a679abd8 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -376,7 +376,7 @@ static void virtblk_config_changed(struct virtio_device *vdev)
 
 static int init_vq(struct virtio_blk *vblk)
 {
-        int err = 0;
+        int err;
         int i;
         vq_callback_t **callbacks;
         const char **names;
@@ -390,13 +390,13 @@ static int init_vq(struct virtio_blk *vblk)
         if (err)
                 num_vqs = 1;
 
-        vblk->vqs = kmalloc(sizeof(*vblk->vqs) * num_vqs, GFP_KERNEL);
+        vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
         if (!vblk->vqs)
                 return -ENOMEM;
 
-        names = kmalloc(sizeof(*names) * num_vqs, GFP_KERNEL);
-        callbacks = kmalloc(sizeof(*callbacks) * num_vqs, GFP_KERNEL);
-        vqs = kmalloc(sizeof(*vqs) * num_vqs, GFP_KERNEL);
+        names = kmalloc_array(num_vqs, sizeof(*names), GFP_KERNEL);
+        callbacks = kmalloc_array(num_vqs, sizeof(*callbacks), GFP_KERNEL);
+        vqs = kmalloc_array(num_vqs, sizeof(*vqs), GFP_KERNEL);
         if (!names || !callbacks || !vqs) {
                 err = -ENOMEM;
                 goto out;
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index d23368874710..6af1ce04b3da 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -748,10 +748,7 @@ static int pp_release(struct inode *inode, struct file *file)
         }
 
         if (pp->pdev) {
-                const char *name = pp->pdev->name;
-
                 parport_unregister_device(pp->pdev);
-                kfree(name);
                 pp->pdev = NULL;
                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 8de61876f633..3a9149cf0110 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -813,9 +813,6 @@ int tpm_do_selftest(struct tpm_chip *chip)
                         continue;
                 }
 
-                if (rc < TPM_HEADER_SIZE)
-                        return -EFAULT;
-
                 if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) {
                         dev_info(&chip->dev,
                                  "TPM is disabled/deactivated (0x%X)\n", rc);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index d433b1db1fdd..5649234b7316 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1539,19 +1539,29 @@ static void remove_port_data(struct port *port)
         spin_lock_irq(&port->inbuf_lock);
         /* Remove unused data this port might have received. */
         discard_port_data(port);
+        spin_unlock_irq(&port->inbuf_lock);
 
         /* Remove buffers we queued up for the Host to send us data in. */
-        while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
-                free_buf(buf, true);
-        spin_unlock_irq(&port->inbuf_lock);
+        do {
+                spin_lock_irq(&port->inbuf_lock);
+                buf = virtqueue_detach_unused_buf(port->in_vq);
+                spin_unlock_irq(&port->inbuf_lock);
+                if (buf)
+                        free_buf(buf, true);
+        } while (buf);
 
         spin_lock_irq(&port->outvq_lock);
         reclaim_consumed_buffers(port);
+        spin_unlock_irq(&port->outvq_lock);
 
         /* Free pending buffers from the out-queue. */
-        while ((buf = virtqueue_detach_unused_buf(port->out_vq)))
-                free_buf(buf, true);
-        spin_unlock_irq(&port->outvq_lock);
+        do {
+                spin_lock_irq(&port->outvq_lock);
+                buf = virtqueue_detach_unused_buf(port->out_vq);
+                spin_unlock_irq(&port->outvq_lock);
+                if (buf)
+                        free_buf(buf, true);
+        } while (buf);
 }
 
 /*
diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 20b105584f82..80ae2a51452d 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -700,6 +700,7 @@ static struct clk * __init create_mux_common(struct clockgen *cg,
                                              struct mux_hwclock *hwc,
                                              const struct clk_ops *ops,
                                              unsigned long min_rate,
+                                             unsigned long max_rate,
                                              unsigned long pct80_rate,
                                              const char *fmt, int idx)
 {
@@ -728,6 +729,8 @@ static struct clk * __init create_mux_common(struct clockgen *cg,
                         continue;
                 if (rate < min_rate)
                         continue;
+                if (rate > max_rate)
+                        continue;
 
                 parent_names[j] = div->name;
                 hwc->parent_to_clksel[j] = i;
@@ -759,7 +762,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
         struct mux_hwclock *hwc;
         const struct clockgen_pll_div *div;
         unsigned long plat_rate, min_rate;
-        u64 pct80_rate;
+        u64 max_rate, pct80_rate;
         u32 clksel;
 
         hwc = kzalloc(sizeof(*hwc), GFP_KERNEL);
@@ -787,8 +790,8 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
                 return NULL;
         }
 
-        pct80_rate = clk_get_rate(div->clk);
-        pct80_rate *= 8;
+        max_rate = clk_get_rate(div->clk);
+        pct80_rate = max_rate * 8;
         do_div(pct80_rate, 10);
 
         plat_rate = clk_get_rate(cg->pll[PLATFORM_PLL].div[PLL_DIV1].clk);
@@ -798,7 +801,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
         else
                 min_rate = plat_rate / 2;
 
-        return create_mux_common(cg, hwc, &cmux_ops, min_rate,
+        return create_mux_common(cg, hwc, &cmux_ops, min_rate, max_rate,
                                  pct80_rate, "cg-cmux%d", idx);
 }
 
@@ -813,7 +816,7 @@ static struct clk * __init create_one_hwaccel(struct clockgen *cg, int idx)
         hwc->reg = cg->regs + 0x20 * idx + 0x10;
         hwc->info = cg->info.hwaccel[idx];
 
-        return create_mux_common(cg, hwc, &hwaccel_ops, 0, 0,
+        return create_mux_common(cg, hwc, &hwaccel_ops, 0, ULONG_MAX, 0,
                                  "cg-hwaccel%d", idx);
 }
 
diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c
index 5daddf5ecc4b..bc37030e38ba 100644
--- a/drivers/clk/clk-xgene.c
+++ b/drivers/clk/clk-xgene.c
@@ -463,22 +463,20 @@ static int xgene_clk_enable(struct clk_hw *hw)
         struct xgene_clk *pclk = to_xgene_clk(hw);
         unsigned long flags = 0;
         u32 data;
-        phys_addr_t reg;
 
         if (pclk->lock)
                 spin_lock_irqsave(pclk->lock, flags);
 
         if (pclk->param.csr_reg != NULL) {
                 pr_debug("%s clock enabled\n", clk_hw_get_name(hw));
-                reg = __pa(pclk->param.csr_reg);
                 /* First enable the clock */
                 data = xgene_clk_read(pclk->param.csr_reg +
                                         pclk->param.reg_clk_offset);
                 data |= pclk->param.reg_clk_mask;
                 xgene_clk_write(data, pclk->param.csr_reg +
                                         pclk->param.reg_clk_offset);
-                pr_debug("%s clock PADDR base %pa clk offset 0x%08X mask 0x%08X value 0x%08X\n",
-                        clk_hw_get_name(hw), &reg,
+                pr_debug("%s clk offset 0x%08X mask 0x%08X value 0x%08X\n",
+                        clk_hw_get_name(hw),
                         pclk->param.reg_clk_offset, pclk->param.reg_clk_mask,
                         data);
 
@@ -488,8 +486,8 @@ static int xgene_clk_enable(struct clk_hw *hw)
                 data &= ~pclk->param.reg_csr_mask;
                 xgene_clk_write(data, pclk->param.csr_reg +
                                         pclk->param.reg_csr_offset);
-                pr_debug("%s CSR RESET PADDR base %pa csr offset 0x%08X mask 0x%08X value 0x%08X\n",
-                        clk_hw_get_name(hw), &reg,
+                pr_debug("%s csr offset 0x%08X mask 0x%08X value 0x%08X\n",
+                        clk_hw_get_name(hw),
                         pclk->param.reg_csr_offset, pclk->param.reg_csr_mask,
                         data);
         }
diff --git a/drivers/clk/imx/clk-pllv3.c b/drivers/clk/imx/clk-pllv3.c
index 19f9b622981a..7a6acc3e4a92 100644
--- a/drivers/clk/imx/clk-pllv3.c
+++ b/drivers/clk/imx/clk-pllv3.c
@@ -223,7 +223,7 @@ static unsigned long clk_pllv3_av_recalc_rate(struct clk_hw *hw,
         temp64 *= mfn;
         do_div(temp64, mfd);
 
-        return (parent_rate * div) + (u32)temp64;
+        return parent_rate * div + (unsigned long)temp64;
 }
 
 static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate,
@@ -247,7 +247,11 @@ static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate,
         do_div(temp64, parent_rate);
         mfn = temp64;
 
-        return parent_rate * div + parent_rate * mfn / mfd;
+        temp64 = (u64)parent_rate;
+        temp64 *= mfn;
+        do_div(temp64, mfd);
+
+        return parent_rate * div + (unsigned long)temp64;
 }
 
 static int clk_pllv3_av_set_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 3a51fff1b0e7..9adaf48aea23 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np)
         }
 
         pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                 pr_err("failed to map apmu registers\n");
                 return;
         }
diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c
index 87f2317b2a00..f110c02e83cb 100644
--- a/drivers/clk/mmp/clk-of-pxa168.c
+++ b/drivers/clk/mmp/clk-of-pxa168.c
@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np)
         }
 
         pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                 pr_err("failed to map apmu registers\n");
                 return;
         }
diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c
index e22a67f76d93..64d1ef49caeb 100644
--- a/drivers/clk/mmp/clk-of-pxa910.c
+++ b/drivers/clk/mmp/clk-of-pxa910.c
@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np)
         }
 
         pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                 pr_err("failed to map apmu registers\n");
                 return;
         }
@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np)
         }
 
         pxa_unit->apbcp_base = of_iomap(np, 3);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apbcp_base) {
                 pr_err("failed to map apbcp registers\n");
                 return;
         }
diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c
index 8feba93672c5..e8075359366b 100644
--- a/drivers/clk/rockchip/clk-ddr.c
+++ b/drivers/clk/rockchip/clk-ddr.c
@@ -144,11 +144,8 @@ struct clk *rockchip_clk_register_ddrclk(const char *name, int flags,
         ddrclk->ddr_flag = ddr_flag;
 
         clk = clk_register(NULL, &ddrclk->hw);
-        if (IS_ERR(clk)) {
-                pr_err("%s: could not register ddrclk %s\n", __func__,  name);
+        if (IS_ERR(clk))
                 kfree(ddrclk);
-                return NULL;
-        }
 
         return clk;
 }
diff --git a/drivers/clk/samsung/clk-exynos-clkout.c b/drivers/clk/samsung/clk-exynos-clkout.c
index 96fab6cfb202..6c6afb87b4ce 100644
--- a/drivers/clk/samsung/clk-exynos-clkout.c
+++ b/drivers/clk/samsung/clk-exynos-clkout.c
@@ -132,28 +132,34 @@ free_clkout:
         pr_err("%s: failed to register clkout clock\n", __func__);
 }
 
+/*
+ * We use CLK_OF_DECLARE_DRIVER initialization method to avoid setting
+ * the OF_POPULATED flag on the pmu device tree node, so later the
+ * Exynos PMU platform device can be properly probed with PMU driver.
+ */
+
 static void __init exynos4_clkout_init(struct device_node *node)
 {
         exynos_clkout_init(node, EXYNOS4_CLKOUT_MUX_MASK);
 }
-CLK_OF_DECLARE(exynos4210_clkout, "samsung,exynos4210-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4210_clkout, "samsung,exynos4210-pmu",
                 exynos4_clkout_init);
-CLK_OF_DECLARE(exynos4212_clkout, "samsung,exynos4212-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4212_clkout, "samsung,exynos4212-pmu",
                 exynos4_clkout_init);
-CLK_OF_DECLARE(exynos4412_clkout, "samsung,exynos4412-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4412_clkout, "samsung,exynos4412-pmu",
                 exynos4_clkout_init);
-CLK_OF_DECLARE(exynos3250_clkout, "samsung,exynos3250-pmu",
+CLK_OF_DECLARE_DRIVER(exynos3250_clkout, "samsung,exynos3250-pmu",
                 exynos4_clkout_init);
 
 static void __init exynos5_clkout_init(struct device_node *node)
 {
         exynos_clkout_init(node, EXYNOS5_CLKOUT_MUX_MASK);
 }
-CLK_OF_DECLARE(exynos5250_clkout, "samsung,exynos5250-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5250_clkout, "samsung,exynos5250-pmu",
                 exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5410_clkout, "samsung,exynos5410-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5410_clkout, "samsung,exynos5410-pmu",
                 exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5420_clkout, "samsung,exynos5420-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5420_clkout, "samsung,exynos5420-pmu",
                 exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5433_clkout, "samsung,exynos5433-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5433_clkout, "samsung,exynos5433-pmu",
                 exynos5_clkout_init);
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 363fc5ec1a4e..5d3640264f2d 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -73,13 +73,13 @@ struct rfc2734_header {
 
 #define fwnet_get_hdr_lf(h)             (((h)->w0 & 0xc0000000) >> 30)
 #define fwnet_get_hdr_ether_type(h)     (((h)->w0 & 0x0000ffff))
-#define fwnet_get_hdr_dg_size(h)        (((h)->w0 & 0x0fff0000) >> 16)
+#define fwnet_get_hdr_dg_size(h)        ((((h)->w0 & 0x0fff0000) >> 16) + 1)
 #define fwnet_get_hdr_fg_off(h)         (((h)->w0 & 0x00000fff))
 #define fwnet_get_hdr_dgl(h)            (((h)->w1 & 0xffff0000) >> 16)
 
-#define fwnet_set_hdr_lf(lf)            ((lf)  << 30)
+#define fwnet_set_hdr_lf(lf)            ((lf) << 30)
 #define fwnet_set_hdr_ether_type(et)    (et)
-#define fwnet_set_hdr_dg_size(dgs)      ((dgs) << 16)
+#define fwnet_set_hdr_dg_size(dgs)      (((dgs) - 1) << 16)
 #define fwnet_set_hdr_fg_off(fgo)       (fgo)
 
 #define fwnet_set_hdr_dgl(dgl)          ((dgl) << 16)
@@ -578,6 +578,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
         int retval;
         u16 ether_type;
 
+        if (len <= RFC2374_UNFRAG_HDR_SIZE)
+                return 0;
+
         hdr.w0 = be32_to_cpu(buf[0]);
         lf = fwnet_get_hdr_lf(&hdr);
         if (lf == RFC2374_HDR_UNFRAG) {
@@ -602,7 +605,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
                 return fwnet_finish_incoming_packet(net, skb, source_node_id,
                                                     is_broadcast, ether_type);
         }
+
         /* A datagram fragment has been received, now the fun begins. */
+
+        if (len <= RFC2374_FRAG_HDR_SIZE)
+                return 0;
+
         hdr.w1 = ntohl(buf[1]);
         buf += 2;
         len -= RFC2374_FRAG_HDR_SIZE;
@@ -614,7 +622,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
                 fg_off = fwnet_get_hdr_fg_off(&hdr);
         }
         datagram_label = fwnet_get_hdr_dgl(&hdr);
-        dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */
+        dg_size = fwnet_get_hdr_dg_size(&hdr);
+
+        if (fg_off + len > dg_size)
+                return 0;
 
         spin_lock_irqsave(&dev->lock, flags);
 
@@ -722,6 +733,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
         fw_send_response(card, r, rcode);
 }
 
+static int gasp_source_id(__be32 *p)
+{
+        return be32_to_cpu(p[0]) >> 16;
+}
+
+static u32 gasp_specifier_id(__be32 *p)
+{
+        return (be32_to_cpu(p[0]) & 0xffff) << 8 |
+               (be32_to_cpu(p[1]) & 0xff000000) >> 24;
+}
+
+static u32 gasp_version(__be32 *p)
+{
+        return be32_to_cpu(p[1]) & 0xffffff;
+}
+
 static void fwnet_receive_broadcast(struct fw_iso_context *context,
                 u32 cycle, size_t header_length, void *header, void *data)
 {
@@ -731,9 +758,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
         __be32 *buf_ptr;
         int retval;
         u32 length;
-        u16 source_node_id;
-        u32 specifier_id;
-        u32 ver;
         unsigned long offset;
         unsigned long flags;
 
@@ -750,22 +774,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        specifier_id =    (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8
-                        | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24;
-        ver = be32_to_cpu(buf_ptr[1]) & 0xffffff;
-        source_node_id = be32_to_cpu(buf_ptr[0]) >> 16;
-
-        if (specifier_id == IANA_SPECIFIER_ID &&
-            (ver == RFC2734_SW_VERSION
+        if (length > IEEE1394_GASP_HDR_SIZE &&
+            gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID &&
+            (gasp_version(buf_ptr) == RFC2734_SW_VERSION
 #if IS_ENABLED(CONFIG_IPV6)
-             || ver == RFC3146_SW_VERSION
+             || gasp_version(buf_ptr) == RFC3146_SW_VERSION
 #endif
-            )) {
-                buf_ptr += 2;
-                length -= IEEE1394_GASP_HDR_SIZE;
-                fwnet_incoming_packet(dev, buf_ptr, length, source_node_id,
+            ))
+                fwnet_incoming_packet(dev, buf_ptr + 2,
+                                      length - IEEE1394_GASP_HDR_SIZE,
+                                      gasp_source_id(buf_ptr),
                                       context->card->generation, true);
-        }
 
         packet.payload_length = dev->rcv_buffer_size;
         packet.interrupt = 1;
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index cd5dc27320a2..1ed6132b993c 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -293,10 +293,10 @@ static void mvebu_gpio_irq_ack(struct irq_data *d)
 {
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct mvebu_gpio_chip *mvchip = gc->private;
-        u32 mask = ~(1 << (d->irq - gc->irq_base));
+        u32 mask = d->mask;
 
         irq_gc_lock(gc);
-        writel_relaxed(mask, mvebu_gpioreg_edge_cause(mvchip));
+        writel_relaxed(~mask, mvebu_gpioreg_edge_cause(mvchip));
         irq_gc_unlock(gc);
 }
 
@@ -305,7 +305,7 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d)
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct mvebu_gpio_chip *mvchip = gc->private;
         struct irq_chip_type *ct = irq_data_get_chip_type(d);
-        u32 mask = 1 << (d->irq - gc->irq_base);
+        u32 mask = d->mask;
 
         irq_gc_lock(gc);
         ct->mask_cache_priv &= ~mask;
@@ -319,8 +319,7 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d)
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct mvebu_gpio_chip *mvchip = gc->private;
         struct irq_chip_type *ct = irq_data_get_chip_type(d);
-
-        u32 mask = 1 << (d->irq - gc->irq_base);
+        u32 mask = d->mask;
 
         irq_gc_lock(gc);
         ct->mask_cache_priv |= mask;
@@ -333,8 +332,7 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d)
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct mvebu_gpio_chip *mvchip = gc->private;
         struct irq_chip_type *ct = irq_data_get_chip_type(d);
-
-        u32 mask = 1 << (d->irq - gc->irq_base);
+        u32 mask = d->mask;
 
         irq_gc_lock(gc);
         ct->mask_cache_priv &= ~mask;
@@ -347,8 +345,7 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d)
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct mvebu_gpio_chip *mvchip = gc->private;
         struct irq_chip_type *ct = irq_data_get_chip_type(d);
-
-        u32 mask = 1 << (d->irq - gc->irq_base);
+        u32 mask = d->mask;
 
         irq_gc_lock(gc);
         ct->mask_cache_priv |= mask;
@@ -462,7 +459,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
         for (i = 0; i < mvchip->chip.ngpio; i++) {
                 int irq;
 
-                irq = mvchip->irqbase + i;
+                irq = irq_find_mapping(mvchip->domain, i);
 
                 if (!(cause & (1 << i)))
                         continue;
@@ -655,6 +652,7 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         struct irq_chip_type *ct;
         struct clk *clk;
         unsigned int ngpios;
+        bool have_irqs;
         int soc_variant;
         int i, cpu, id;
         int err;
@@ -665,6 +663,9 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         else
                 soc_variant = MVEBU_GPIO_SOC_VARIANT_ORION;
 
+        /* Some gpio controllers do not provide irq support */
+        have_irqs = of_irq_count(np) != 0;
+
         mvchip = devm_kzalloc(&pdev->dev, sizeof(struct mvebu_gpio_chip),
                               GFP_KERNEL);
         if (!mvchip)
@@ -697,7 +698,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         mvchip->chip.get = mvebu_gpio_get;
         mvchip->chip.direction_output = mvebu_gpio_direction_output;
         mvchip->chip.set = mvebu_gpio_set;
-        mvchip->chip.to_irq = mvebu_gpio_to_irq;
+        if (have_irqs)
+                mvchip->chip.to_irq = mvebu_gpio_to_irq;
         mvchip->chip.base = id * MVEBU_MAX_GPIO_PER_BANK;
         mvchip->chip.ngpio = ngpios;
         mvchip->chip.can_sleep = false;
@@ -758,34 +760,30 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
         /* Some gpio controllers do not provide irq support */
-        if (!of_irq_count(np))
+        if (!have_irqs)
                 return 0;
 
-        /* Setup the interrupt handlers. Each chip can have up to 4
-         * interrupt handlers, with each handler dealing with 8 GPIO
-         * pins. */
-        for (i = 0; i < 4; i++) {
-                int irq = platform_get_irq(pdev, i);
-
-                if (irq < 0)
-                        continue;
-                irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler,
-                                                 mvchip);
-        }
-
-        mvchip->irqbase = irq_alloc_descs(-1, 0, ngpios, -1);
-        if (mvchip->irqbase < 0) {
-                dev_err(&pdev->dev, "no irqs\n");
-                return mvchip->irqbase;
+        mvchip->domain =
+            irq_domain_add_linear(np, ngpios, &irq_generic_chip_ops, NULL);
+        if (!mvchip->domain) {
+                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
+                        mvchip->chip.label);
+                return -ENODEV;
         }
 
-        gc = irq_alloc_generic_chip("mvebu_gpio_irq", 2, mvchip->irqbase,
-                                    mvchip->membase, handle_level_irq);
-        if (!gc) {
-                dev_err(&pdev->dev, "Cannot allocate generic irq_chip\n");
-                return -ENOMEM;
+        err = irq_alloc_domain_generic_chips(
+            mvchip->domain, ngpios, 2, np->name, handle_level_irq,
+            IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_LEVEL, 0, 0);
+        if (err) {
+                dev_err(&pdev->dev, "couldn't allocate irq chips %s (DT).\n",
+                        mvchip->chip.label);
+                goto err_domain;
         }
 
+        /* NOTE: The common accessors cannot be used because of the percpu
+         * access to the mask registers
+         */
+        gc = irq_get_domain_generic_chip(mvchip->domain, 0);
         gc->private = mvchip;
         ct = &gc->chip_types[0];
         ct->type = IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW;
@@ -803,27 +801,23 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         ct->handler = handle_edge_irq;
         ct->chip.name = mvchip->chip.label;
 
-        irq_setup_generic_chip(gc, IRQ_MSK(ngpios), 0,
-                               IRQ_NOREQUEST, IRQ_LEVEL | IRQ_NOPROBE);
+        /* Setup the interrupt handlers. Each chip can have up to 4
+         * interrupt handlers, with each handler dealing with 8 GPIO
+         * pins.
+         */
+        for (i = 0; i < 4; i++) {
+                int irq = platform_get_irq(pdev, i);
 
-        /* Setup irq domain on top of the generic chip. */
-        mvchip->domain = irq_domain_add_simple(np, mvchip->chip.ngpio,
-                                               mvchip->irqbase,
-                                               &irq_domain_simple_ops,
-                                               mvchip);
-        if (!mvchip->domain) {
-                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
-                        mvchip->chip.label);
-                err = -ENODEV;
-                goto err_generic_chip;
+                if (irq < 0)
+                        continue;
+                irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler,
+                                                 mvchip);
         }
 
         return 0;
 
-err_generic_chip:
-        irq_remove_generic_chip(gc, IRQ_MSK(ngpios), IRQ_NOREQUEST,
-                                IRQ_LEVEL | IRQ_NOPROBE);
-        kfree(gc);
+err_domain:
+        irq_domain_remove(mvchip->domain);
 
         return err;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index ecad3f0e3b77..193f15d50bba 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -26,14 +26,18 @@
 
 #include "gpiolib.h"
 
-static int of_gpiochip_match_node(struct gpio_chip *chip, void *data)
+static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
 {
-        return chip->gpiodev->dev.of_node == data;
+        struct of_phandle_args *gpiospec = data;
+
+        return chip->gpiodev->dev.of_node == gpiospec->np &&
+                                chip->of_xlate(chip, gpiospec, NULL) >= 0;
 }
 
-static struct gpio_chip *of_find_gpiochip_by_node(struct device_node *np)
+static struct gpio_chip *of_find_gpiochip_by_xlate(
+                                        struct of_phandle_args *gpiospec)
 {
-        return gpiochip_find(np, of_gpiochip_match_node);
+        return gpiochip_find(gpiospec, of_gpiochip_match_node_and_xlate);
 }
 
 static struct gpio_desc *of_xlate_and_get_gpiod_flags(struct gpio_chip *chip,
@@ -79,7 +83,7 @@ struct gpio_desc *of_get_named_gpiod_flags(struct device_node *np,
                 return ERR_PTR(ret);
         }
 
-        chip = of_find_gpiochip_by_node(gpiospec.np);
+        chip = of_find_gpiochip_by_xlate(&gpiospec);
         if (!chip) {
                 desc = ERR_PTR(-EPROBE_DEFER);
                 goto out;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 20e09b7c2de3..93ed0e00c578 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -21,6 +21,7 @@
 #include <linux/uaccess.h>
 #include <linux/compat.h>
 #include <linux/anon_inodes.h>
+#include <linux/file.h>
 #include <linux/kfifo.h>
 #include <linux/poll.h>
 #include <linux/timekeeping.h>
@@ -423,6 +424,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 {
         struct gpiohandle_request handlereq;
         struct linehandle_state *lh;
+        struct file *file;
         int fd, i, ret;
 
         if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
@@ -499,26 +501,41 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
         i--;
         lh->numdescs = handlereq.lines;
 
-        fd = anon_inode_getfd("gpio-linehandle",
-                              &linehandle_fileops,
-                              lh,
-                              O_RDONLY | O_CLOEXEC);
+        fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
         if (fd < 0) {
                 ret = fd;
                 goto out_free_descs;
         }
 
+        file = anon_inode_getfile("gpio-linehandle",
+                                  &linehandle_fileops,
+                                  lh,
+                                  O_RDONLY | O_CLOEXEC);
+        if (IS_ERR(file)) {
+                ret = PTR_ERR(file);
+                goto out_put_unused_fd;
+        }
+
         handlereq.fd = fd;
         if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
-                ret = -EFAULT;
-                goto out_free_descs;
+                /*
+                 * fput() will trigger the release() callback, so do not go onto
+                 * the regular error cleanup path here.
+                 */
+                fput(file);
+                put_unused_fd(fd);
+                return -EFAULT;
         }
 
+        fd_install(fd, file);
+
         dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
                 lh->numdescs);
 
         return 0;
 
+out_put_unused_fd:
+        put_unused_fd(fd);
 out_free_descs:
         for (; i >= 0; i--)
                 gpiod_free(lh->descs[i]);
@@ -721,6 +738,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
         struct gpioevent_request eventreq;
         struct lineevent_state *le;
         struct gpio_desc *desc;
+        struct file *file;
         u32 offset;
         u32 lflags;
         u32 eflags;
@@ -815,23 +833,38 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
         if (ret)
                 goto out_free_desc;
 
-        fd = anon_inode_getfd("gpio-event",
-                              &lineevent_fileops,
-                              le,
-                              O_RDONLY | O_CLOEXEC);
+        fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
         if (fd < 0) {
                 ret = fd;
                 goto out_free_irq;
         }
 
+        file = anon_inode_getfile("gpio-event",
+                                  &lineevent_fileops,
+                                  le,
+                                  O_RDONLY | O_CLOEXEC);
+        if (IS_ERR(file)) {
+                ret = PTR_ERR(file);
+                goto out_put_unused_fd;
+        }
+
         eventreq.fd = fd;
         if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
-                ret = -EFAULT;
-                goto out_free_irq;
+                /*
+                 * fput() will trigger the release() callback, so do not go onto
+                 * the regular error cleanup path here.
+                 */
+                fput(file);
+                put_unused_fd(fd);
+                return -EFAULT;
         }
 
+        fd_install(fd, file);
+
         return 0;
 
+out_put_unused_fd:
+        put_unused_fd(fd);
 out_free_irq:
         free_irq(le->irq, le);
 out_free_desc:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index 892d60fb225b..2057683f7b59 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -395,9 +395,12 @@ static int acp_hw_fini(void *handle)
 {
         int i, ret;
         struct device *dev;
-
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        /* return early if no ACP */
+        if (!adev->acp.acp_genpd)
+                return 0;
+
         for (i = 0; i < ACP_DEVS ; i++) {
                 dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
                 ret = pm_genpd_remove_device(&adev->acp.acp_genpd->gpd, dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 7a8bfa34682f..662976292535 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -795,10 +795,19 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                 if (!adev->pm.fw) {
                         switch (adev->asic_type) {
                         case CHIP_TOPAZ:
-                                strcpy(fw_name, "amdgpu/topaz_smc.bin");
+                                if (((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x81)) ||
+                                    ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x83)) ||
+                                    ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87)))
+                                        strcpy(fw_name, "amdgpu/topaz_k_smc.bin");
+                                else
+                                        strcpy(fw_name, "amdgpu/topaz_smc.bin");
                                 break;
                         case CHIP_TONGA:
-                                strcpy(fw_name, "amdgpu/tonga_smc.bin");
+                                if (((adev->pdev->device == 0x6939) && (adev->pdev->revision == 0xf1)) ||
+                                    ((adev->pdev->device == 0x6938) && (adev->pdev->revision == 0xf1)))
+                                        strcpy(fw_name, "amdgpu/tonga_k_smc.bin");
+                                else
+                                        strcpy(fw_name, "amdgpu/tonga_smc.bin");
                                 break;
                         case CHIP_FIJI:
                                 strcpy(fw_name, "amdgpu/fiji_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index e3281d4e3e41..086aa5c9c634 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -769,7 +769,7 @@ static void amdgpu_connector_unregister(struct drm_connector *connector)
 {
         struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
 
-        if (amdgpu_connector->ddc_bus->has_aux) {
+        if (amdgpu_connector->ddc_bus && amdgpu_connector->ddc_bus->has_aux) {
                 drm_dp_aux_unregister(&amdgpu_connector->ddc_bus->aux);
                 amdgpu_connector->ddc_bus->has_aux = false;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index b0f6e6957536..82dc8d20e28a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -519,7 +519,8 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
                 r = ttm_eu_reserve_buffers(&p->ticket, &p->validated, true,
                                            &duplicates);
                 if (unlikely(r != 0)) {
-                        DRM_ERROR("ttm_eu_reserve_buffers failed.\n");
+                        if (r != -ERESTARTSYS)
+                                DRM_ERROR("ttm_eu_reserve_buffers failed.\n");
                         goto error_free_pages;
                 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index b4f4a9239069..7ca07e7b25c1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1959,6 +1959,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool suspend, bool fbcon)
         /* evict remaining vram memory */
         amdgpu_bo_evict_vram(adev);
 
+        amdgpu_atombios_scratch_regs_save(adev);
         pci_save_state(dev->pdev);
         if (suspend) {
                 /* Shut down the device */
@@ -2010,6 +2011,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
                         return r;
                 }
         }
+        amdgpu_atombios_scratch_regs_restore(adev);
 
         /* post card */
         if (!amdgpu_card_posted(adev) || !resume) {
@@ -2268,8 +2270,6 @@ int amdgpu_gpu_reset(struct amdgpu_device *adev)
         }
 
         if (need_full_reset) {
-                /* save scratch */
-                amdgpu_atombios_scratch_regs_save(adev);
                 r = amdgpu_suspend(adev);
 
 retry:
@@ -2279,8 +2279,9 @@ retry:
                         amdgpu_display_stop_mc_access(adev, &save);
                         amdgpu_wait_for_idle(adev, AMD_IP_BLOCK_TYPE_GMC);
                 }
-
+                amdgpu_atombios_scratch_regs_save(adev);
                 r = amdgpu_asic_reset(adev);
+                amdgpu_atombios_scratch_regs_restore(adev);
                 /* post card */
                 amdgpu_atom_asic_init(adev->mode_info.atom_context);
 
@@ -2288,8 +2289,6 @@ retry:
                         dev_info(adev->dev, "GPU reset succeeded, trying to resume\n");
                         r = amdgpu_resume(adev);
                 }
-                /* restore scratch */
-                amdgpu_atombios_scratch_regs_restore(adev);
         }
         if (!r) {
                 amdgpu_irq_gpu_reset_resume_helper(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 71ed27eb3dde..02ff0747197c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -735,8 +735,20 @@ static struct pci_driver amdgpu_kms_pci_driver = {
 
 static int __init amdgpu_init(void)
 {
-        amdgpu_sync_init();
-        amdgpu_fence_slab_init();
+        int r;
+
+        r = amdgpu_sync_init();
+        if (r)
+                goto error_sync;
+
+        r = amdgpu_fence_slab_init();
+        if (r)
+                goto error_fence;
+
+        r = amd_sched_fence_slab_init();
+        if (r)
+                goto error_sched;
+
         if (vgacon_text_force()) {
                 DRM_ERROR("VGACON disables amdgpu kernel modesetting.\n");
                 return -EINVAL;
@@ -748,6 +760,15 @@ static int __init amdgpu_init(void)
         amdgpu_register_atpx_handler();
         /* let modprobe override vga console setting */
         return drm_pci_init(driver, pdriver);
+
+error_sched:
+        amdgpu_fence_slab_fini();
+
+error_fence:
+        amdgpu_sync_fini();
+
+error_sync:
+        return r;
 }
 
 static void __exit amdgpu_exit(void)
@@ -756,6 +777,7 @@ static void __exit amdgpu_exit(void)
         drm_pci_exit(driver, pdriver);
         amdgpu_unregister_atpx_handler();
         amdgpu_sync_fini();
+        amd_sched_fence_slab_fini();
         amdgpu_fence_slab_fini();
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 3a2e42f4b897..77b34ec92632 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -68,6 +68,7 @@ int amdgpu_fence_slab_init(void)
 
 void amdgpu_fence_slab_fini(void)
 {
+        rcu_barrier();
         kmem_cache_destroy(amdgpu_fence_slab);
 }
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
index 278708f5a744..9fa809876339 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -239,6 +239,7 @@ int amdgpu_irq_init(struct amdgpu_device *adev)
         if (r) {
                 adev->irq.installed = false;
                 flush_work(&adev->hotplug_work);
+                cancel_work_sync(&adev->reset_work);
                 return r;
         }
 
@@ -264,6 +265,7 @@ void amdgpu_irq_fini(struct amdgpu_device *adev)
                 if (adev->irq.msi_enabled)
                         pci_disable_msi(adev->pdev);
                 flush_work(&adev->hotplug_work);
+                cancel_work_sync(&adev->reset_work);
         }
 
         for (i = 0; i < AMDGPU_MAX_IRQ_SRC_ID; ++i) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index c2c7fb140338..3938fca1ea8e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -99,6 +99,8 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
 
         if ((amdgpu_runtime_pm != 0) &&
             amdgpu_has_atpx() &&
+            (amdgpu_is_atpx_hybrid() ||
+             amdgpu_has_atpx_dgpu_power_cntl()) &&
             ((flags & AMD_IS_APU) == 0))
                 flags |= AMD_IS_PX;
 
@@ -459,10 +461,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 /* return all clocks in KHz */
                 dev_info.gpu_counter_freq = amdgpu_asic_get_xclk(adev) * 10;
                 if (adev->pm.dpm_enabled) {
-                        dev_info.max_engine_clock =
-                                adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk * 10;
-                        dev_info.max_memory_clock =
-                                adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.mclk * 10;
+                        dev_info.max_engine_clock = amdgpu_dpm_get_sclk(adev, false) * 10;
+                        dev_info.max_memory_clock = amdgpu_dpm_get_mclk(adev, false) * 10;
                 } else {
                         dev_info.max_engine_clock = adev->pm.default_sclk * 10;
                         dev_info.max_memory_clock = adev->pm.default_mclk * 10;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 06f24322e7c3..968c4260d7a7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1758,5 +1758,6 @@ void amdgpu_vm_manager_fini(struct amdgpu_device *adev)
                 fence_put(adev->vm_manager.ids[i].first);
                 amdgpu_sync_free(&adev->vm_manager.ids[i].active);
                 fence_put(id->flushed_updates);
+                fence_put(id->last_flush);
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 1d8c375a3561..5be788b269e2 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -4075,7 +4075,7 @@ static int ci_enable_uvd_dpm(struct amdgpu_device *adev, bool enable)
                                                           pi->dpm_level_enable_mask.mclk_dpm_enable_mask);
                 }
         } else {
-                if (pi->last_mclk_dpm_enable_mask & 0x1) {
+                if (pi->uvd_enabled) {
                         pi->uvd_enabled = false;
                         pi->dpm_level_enable_mask.mclk_dpm_enable_mask |= 1;
                         amdgpu_ci_send_msg_to_smc_with_parameter(adev,
@@ -6236,6 +6236,8 @@ static int ci_dpm_sw_fini(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        flush_work(&adev->pm.dpm.thermal.work);
+
         mutex_lock(&adev->pm.mutex);
         amdgpu_pm_sysfs_fini(adev);
         ci_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 4108c686aa7c..9260caef74fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -3151,10 +3151,6 @@ static int dce_v10_0_hw_fini(void *handle)
 
 static int dce_v10_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        amdgpu_atombios_scratch_regs_save(adev);
-
         return dce_v10_0_hw_fini(handle);
 }
 
@@ -3165,8 +3161,6 @@ static int dce_v10_0_resume(void *handle)
 
         ret = dce_v10_0_hw_init(handle);
 
-        amdgpu_atombios_scratch_regs_restore(adev);
-
         /* turn on the BL */
         if (adev->mode_info.bl_encoder) {
                 u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index f264b8f17ad1..367739bd1927 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3215,10 +3215,6 @@ static int dce_v11_0_hw_fini(void *handle)
 
 static int dce_v11_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        amdgpu_atombios_scratch_regs_save(adev);
-
         return dce_v11_0_hw_fini(handle);
 }
 
@@ -3229,8 +3225,6 @@ static int dce_v11_0_resume(void *handle)
 
         ret = dce_v11_0_hw_init(handle);
 
-        amdgpu_atombios_scratch_regs_restore(adev);
-
         /* turn on the BL */
         if (adev->mode_info.bl_encoder) {
                 u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index b948d6cb1399..15f9fc0514b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -2482,10 +2482,6 @@ static int dce_v6_0_hw_fini(void *handle)
 
 static int dce_v6_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        amdgpu_atombios_scratch_regs_save(adev);
-
         return dce_v6_0_hw_fini(handle);
 }
 
@@ -2496,8 +2492,6 @@ static int dce_v6_0_resume(void *handle)
 
         ret = dce_v6_0_hw_init(handle);
 
-        amdgpu_atombios_scratch_regs_restore(adev);
-
         /* turn on the BL */
         if (adev->mode_info.bl_encoder) {
                 u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 5966166ec94c..8c4d808db0f1 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -3033,10 +3033,6 @@ static int dce_v8_0_hw_fini(void *handle)
 
 static int dce_v8_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-        amdgpu_atombios_scratch_regs_save(adev);
-
         return dce_v8_0_hw_fini(handle);
 }
 
@@ -3047,8 +3043,6 @@ static int dce_v8_0_resume(void *handle)
 
         ret = dce_v8_0_hw_init(handle);
 
-        amdgpu_atombios_scratch_regs_restore(adev);
-
         /* turn on the BL */
         if (adev->mode_info.bl_encoder) {
                 u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index ee6a48a09214..bb97182dc749 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -640,7 +640,6 @@ static const u32 stoney_mgcg_cgcg_init[] =
         mmCP_MEM_SLP_CNTL, 0xffffffff, 0x00020201,
         mmRLC_MEM_SLP_CNTL, 0xffffffff, 0x00020201,
         mmCGTS_SM_CTRL_REG, 0xffffffff, 0x96940200,
-        mmATC_MISC_CG, 0xffffffff, 0x000c0200,
 };
 
 static void gfx_v8_0_set_ring_funcs(struct amdgpu_device *adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index c22ef140a542..a16b2201d52c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -100,6 +100,7 @@ static const u32 cz_mgcg_cgcg_init[] =
 
 static const u32 stoney_mgcg_cgcg_init[] =
 {
+        mmATC_MISC_CG, 0xffffffff, 0x000c0200,
         mmMC_MEM_POWER_LS, 0xffffffff, 0x00000104
 };
 
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index f8618a3881a8..71d2856222fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -3063,6 +3063,8 @@ static int kv_dpm_sw_fini(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        flush_work(&adev->pm.dpm.thermal.work);
+
         mutex_lock(&adev->pm.mutex);
         amdgpu_pm_sysfs_fini(adev);
         kv_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 3de7bca5854b..d6f85b1a0b93 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -3477,6 +3477,49 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
         int i;
         struct si_dpm_quirk *p = si_dpm_quirk_list;
 
+        /* limit all SI kickers */
+        if (adev->asic_type == CHIP_PITCAIRN) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->device == 0x6810) ||
+                    (adev->pdev->device == 0x6811) ||
+                    (adev->pdev->device == 0x6816) ||
+                    (adev->pdev->device == 0x6817) ||
+                    (adev->pdev->device == 0x6806))
+                        max_mclk = 120000;
+        } else if (adev->asic_type == CHIP_VERDE) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0x87) ||
+                    (adev->pdev->device == 0x6820) ||
+                    (adev->pdev->device == 0x6821) ||
+                    (adev->pdev->device == 0x6822) ||
+                    (adev->pdev->device == 0x6823) ||
+                    (adev->pdev->device == 0x682A) ||
+                    (adev->pdev->device == 0x682B)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (adev->asic_type == CHIP_OLAND) {
+                if ((adev->pdev->revision == 0xC7) ||
+                    (adev->pdev->revision == 0x80) ||
+                    (adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->device == 0x6604) ||
+                    (adev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (adev->asic_type == CHIP_HAINAN) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0xC3) ||
+                    (adev->pdev->device == 0x6664) ||
+                    (adev->pdev->device == 0x6665) ||
+                    (adev->pdev->device == 0x6667)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        }
         /* Apply dpm quirks */
         while (p && p->chip_device != 0) {
                 if (adev->pdev->vendor == p->chip_vendor &&
@@ -3489,22 +3532,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                 }
                 ++p;
         }
-        /* limit mclk on all R7 370 parts for stability */
-        if (adev->pdev->device == 0x6811 &&
-            adev->pdev->revision == 0x81)
-                max_mclk = 120000;
-        /* limit sclk/mclk on Jet parts for stability */
-        if (adev->pdev->device == 0x6665 &&
-            adev->pdev->revision == 0xc3) {
-                max_sclk = 75000;
-                max_mclk = 80000;
-        }
-        /* Limit clocks for some HD8600 parts */
-        if (adev->pdev->device == 0x6660 &&
-            adev->pdev->revision == 0x83) {
-                max_sclk = 75000;
-                max_mclk = 80000;
-        }
 
         if (rps->vce_active) {
                 rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
@@ -7777,6 +7804,8 @@ static int si_dpm_sw_fini(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        flush_work(&adev->pm.dpm.thermal.work);
+
         mutex_lock(&adev->pm.mutex);
         amdgpu_pm_sysfs_fini(adev);
         si_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 8533269ec160..6feed726e299 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -52,6 +52,8 @@
 #define VCE_V3_0_STACK_SIZE     (64 * 1024)
 #define VCE_V3_0_DATA_SIZE      ((16 * 1024 * AMDGPU_MAX_VCE_HANDLES) + (52 * 1024))
 
+#define FW_52_8_3       ((52 << 24) | (8 << 16) | (3 << 8))
+
 static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx);
 static void vce_v3_0_set_ring_funcs(struct amdgpu_device *adev);
 static void vce_v3_0_set_irq_funcs(struct amdgpu_device *adev);
@@ -382,6 +384,10 @@ static int vce_v3_0_sw_init(void *handle)
         if (r)
                 return r;
 
+        /* 52.8.3 required for 3 ring support */
+        if (adev->vce.fw_version < FW_52_8_3)
+                adev->vce.num_rings = 2;
+
         r = amdgpu_vce_resume(adev);
         if (r)
                 return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index c0d9aad7126f..f62f1a74f890 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -80,7 +80,9 @@
 #include "dce_virtual.h"
 
 MODULE_FIRMWARE("amdgpu/topaz_smc.bin");
+MODULE_FIRMWARE("amdgpu/topaz_k_smc.bin");
 MODULE_FIRMWARE("amdgpu/tonga_smc.bin");
+MODULE_FIRMWARE("amdgpu/tonga_k_smc.bin");
 MODULE_FIRMWARE("amdgpu/fiji_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc_sk.bin");
@@ -1651,7 +1653,7 @@ static int vi_common_early_init(void *handle)
                         AMD_CG_SUPPORT_SDMA_MGCG |
                         AMD_CG_SUPPORT_SDMA_LS |
                         AMD_CG_SUPPORT_VCE_MGCG;
-                adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                adev->pg_flags = AMD_PG_SUPPORT_GFX_PG |
                         AMD_PG_SUPPORT_GFX_SMG |
                         AMD_PG_SUPPORT_GFX_PIPELINE |
                         AMD_PG_SUPPORT_UVD |
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
index 14f8c1f4da3d..0723758ed065 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
@@ -272,7 +272,7 @@ bool phm_check_smc_update_required_for_display_configuration(struct pp_hwmgr *hw
         PHM_FUNC_CHECK(hwmgr);
 
         if (hwmgr->hwmgr_func->check_smc_update_required_for_display_configuration == NULL)
-                return -EINVAL;
+                return false;
 
         return hwmgr->hwmgr_func->check_smc_update_required_for_display_configuration(hwmgr);
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
index 1167205057b3..e03dcb6ea9c1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
@@ -710,13 +710,15 @@ int phm_get_voltage_evv_on_sclk(struct pp_hwmgr *hwmgr, uint8_t voltage_type,
         uint32_t vol;
         int ret = 0;
 
-        if (hwmgr->chip_id < CHIP_POLARIS10) {
-                atomctrl_get_voltage_evv_on_sclk(hwmgr, voltage_type, sclk, id, voltage);
+        if (hwmgr->chip_id < CHIP_TONGA) {
+                ret = atomctrl_get_voltage_evv(hwmgr, id, voltage);
+        } else if (hwmgr->chip_id < CHIP_POLARIS10) {
+                ret = atomctrl_get_voltage_evv_on_sclk(hwmgr, voltage_type, sclk, id, voltage);
                 if (*voltage >= 2000 || *voltage == 0)
                         *voltage = 1150;
         } else {
                 ret = atomctrl_get_voltage_evv_on_sclk_ai(hwmgr, voltage_type, sclk, id, &vol);
-                *voltage = (uint16_t)vol/100;
+                *voltage = (uint16_t)(vol/100);
         }
         return ret;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
index 1126bd4f74dc..0894527d932f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1320,7 +1320,8 @@ int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_
         if (0 != result)
                 return result;
 
-        *voltage = le32_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)(&get_voltage_info_param_space))->ulVoltageLevel);
+        *voltage = le32_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)
+                                (&get_voltage_info_param_space))->ulVoltageLevel);
 
         return result;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
index 7de701d8a450..4477c55a58e3 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
@@ -1201,12 +1201,15 @@ static uint32_t make_classification_flags(struct pp_hwmgr *hwmgr,
 static int ppt_get_num_of_vce_state_table_entries_v1_0(struct pp_hwmgr *hwmgr)
 {
         const ATOM_Tonga_POWERPLAYTABLE *pp_table = get_powerplay_table(hwmgr);
-        const ATOM_Tonga_VCE_State_Table *vce_state_table =
-                                (ATOM_Tonga_VCE_State_Table *)(((unsigned long)pp_table) + le16_to_cpu(pp_table->usVCEStateTableOffset));
+        const ATOM_Tonga_VCE_State_Table *vce_state_table;
 
-        if (vce_state_table == NULL)
+
+        if (pp_table == NULL)
                 return 0;
 
+        vce_state_table = (void *)pp_table +
+                        le16_to_cpu(pp_table->usVCEStateTableOffset);
+
         return vce_state_table->ucNumEntries;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 609996c84ad5..b0c929dd8beb 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -1168,8 +1168,8 @@ int smu7_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
 
         tmp_result = (!smum_is_dpm_running(hwmgr)) ? 0 : -1;
         PP_ASSERT_WITH_CODE(tmp_result == 0,
-                        "DPM is already running right now, no need to enable DPM!",
-                        return 0);
+                        "DPM is already running",
+                        );
 
         if (smu7_voltage_control(hwmgr)) {
                 tmp_result = smu7_enable_voltage_control(hwmgr);
@@ -1460,19 +1460,19 @@ static int smu7_get_evv_voltages(struct pp_hwmgr *hwmgr)
         struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table = NULL;
 
 
-        if (table_info == NULL)
-                return -EINVAL;
-
-        sclk_table = table_info->vdd_dep_on_sclk;
-
         for (i = 0; i < SMU7_MAX_LEAKAGE_COUNT; i++) {
                 vv_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i;
 
                 if (data->vdd_gfx_control == SMU7_VOLTAGE_CONTROL_BY_SVID2) {
-                        if (0 == phm_get_sclk_for_voltage_evv(hwmgr,
+                        if ((hwmgr->pp_table_version == PP_TABLE_V1)
+                            && !phm_get_sclk_for_voltage_evv(hwmgr,
                                                 table_info->vddgfx_lookup_table, vv_id, &sclk)) {
                                 if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
                                                         PHM_PlatformCaps_ClockStretcher)) {
+                                        if (table_info == NULL)
+                                                return -EINVAL;
+                                        sclk_table = table_info->vdd_dep_on_sclk;
+
                                         for (j = 1; j < sclk_table->count; j++) {
                                                 if (sclk_table->entries[j].clk == sclk &&
                                                                 sclk_table->entries[j].cks_enable == 0) {
@@ -1498,12 +1498,15 @@ static int smu7_get_evv_voltages(struct pp_hwmgr *hwmgr)
                                 }
                         }
                 } else {
-
                         if ((hwmgr->pp_table_version == PP_TABLE_V0)
                                 || !phm_get_sclk_for_voltage_evv(hwmgr,
                                         table_info->vddc_lookup_table, vv_id, &sclk)) {
                                 if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
                                                 PHM_PlatformCaps_ClockStretcher)) {
+                                        if (table_info == NULL)
+                                                return -EINVAL;
+                                        sclk_table = table_info->vdd_dep_on_sclk;
+
                                         for (j = 1; j < sclk_table->count; j++) {
                                                 if (sclk_table->entries[j].clk == sclk &&
                                                                 sclk_table->entries[j].cks_enable == 0) {
@@ -2127,15 +2130,20 @@ static int smu7_patch_acp_vddc(struct pp_hwmgr *hwmgr,
 }
 
 static int smu7_patch_limits_vddc(struct pp_hwmgr *hwmgr,
-                                     struct phm_clock_and_voltage_limits *tab)
+                                  struct phm_clock_and_voltage_limits *tab)
 {
+        uint32_t vddc, vddci;
         struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
 
         if (tab) {
-                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, (uint32_t *)&tab->vddc,
-                                                        &data->vddc_leakage);
-                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, (uint32_t *)&tab->vddci,
-                                                        &data->vddci_leakage);
+                vddc = tab->vddc;
+                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, &vddc,
+                                                   &data->vddc_leakage);
+                tab->vddc = vddc;
+                vddci = tab->vddci;
+                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, &vddci,
+                                                   &data->vddci_leakage);
+                tab->vddci = vddci;
         }
 
         return 0;
@@ -4225,18 +4233,26 @@ static int smu7_get_sclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
 {
         struct phm_ppt_v1_information *table_info =
                         (struct phm_ppt_v1_information *)hwmgr->pptable;
-        struct phm_ppt_v1_clock_voltage_dependency_table *dep_sclk_table;
+        struct phm_ppt_v1_clock_voltage_dependency_table *dep_sclk_table = NULL;
+        struct phm_clock_voltage_dependency_table *sclk_table;
         int i;
 
-        if (table_info == NULL)
-                return -EINVAL;
-
-        dep_sclk_table = table_info->vdd_dep_on_sclk;
-
-        for (i = 0; i < dep_sclk_table->count; i++) {
-                clocks->clock[i] = dep_sclk_table->entries[i].clk;
-                clocks->count++;
+        if (hwmgr->pp_table_version == PP_TABLE_V1) {
+                if (table_info == NULL || table_info->vdd_dep_on_sclk == NULL)
+                        return -EINVAL;
+                dep_sclk_table = table_info->vdd_dep_on_sclk;
+                for (i = 0; i < dep_sclk_table->count; i++) {
+                        clocks->clock[i] = dep_sclk_table->entries[i].clk;
+                        clocks->count++;
+                }
+        } else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+                sclk_table = hwmgr->dyn_state.vddc_dependency_on_sclk;
+                for (i = 0; i < sclk_table->count; i++) {
+                        clocks->clock[i] = sclk_table->entries[i].clk;
+                        clocks->count++;
+                }
         }
+
         return 0;
 }
 
@@ -4258,17 +4274,24 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
                         (struct phm_ppt_v1_information *)hwmgr->pptable;
         struct phm_ppt_v1_clock_voltage_dependency_table *dep_mclk_table;
         int i;
+        struct phm_clock_voltage_dependency_table *mclk_table;
 
-        if (table_info == NULL)
-                return -EINVAL;
-
-        dep_mclk_table = table_info->vdd_dep_on_mclk;
-
-        for (i = 0; i < dep_mclk_table->count; i++) {
-                clocks->clock[i] = dep_mclk_table->entries[i].clk;
-                clocks->latency[i] = smu7_get_mem_latency(hwmgr,
+        if (hwmgr->pp_table_version == PP_TABLE_V1) {
+                if (table_info == NULL)
+                        return -EINVAL;
+                dep_mclk_table = table_info->vdd_dep_on_mclk;
+                for (i = 0; i < dep_mclk_table->count; i++) {
+                        clocks->clock[i] = dep_mclk_table->entries[i].clk;
+                        clocks->latency[i] = smu7_get_mem_latency(hwmgr,
                                                 dep_mclk_table->entries[i].clk);
-                clocks->count++;
+                        clocks->count++;
+                }
+        } else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+                mclk_table = hwmgr->dyn_state.vddc_dependency_on_mclk;
+                for (i = 0; i < mclk_table->count; i++) {
+                        clocks->clock[i] = mclk_table->entries[i].clk;
+                        clocks->count++;
+                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
index fb6c6f6106d5..29d0319b22e6 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
@@ -30,7 +30,7 @@ int smu7_fan_ctrl_get_fan_speed_info(struct pp_hwmgr *hwmgr,
                 struct phm_fan_speed_info *fan_speed_info)
 {
         if (hwmgr->thermal_controller.fanInfo.bNoFan)
-                return 0;
+                return -ENODEV;
 
         fan_speed_info->supports_percent_read = true;
         fan_speed_info->supports_percent_write = true;
@@ -60,7 +60,7 @@ int smu7_fan_ctrl_get_fan_speed_percent(struct pp_hwmgr *hwmgr,
         uint64_t tmp64;
 
         if (hwmgr->thermal_controller.fanInfo.bNoFan)
-                return 0;
+                return -ENODEV;
 
         duty100 = PHM_READ_VFPF_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
                         CG_FDO_CTRL1, FMAX_DUTY100);
@@ -89,7 +89,7 @@ int smu7_fan_ctrl_get_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t *speed)
         if (hwmgr->thermal_controller.fanInfo.bNoFan ||
                         (hwmgr->thermal_controller.fanInfo.
                                 ucTachometerPulsesPerRevolution == 0))
-                return 0;
+                return -ENODEV;
 
         tach_period = PHM_READ_VFPF_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
                         CG_TACH_STATUS, TACH_PERIOD);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 963a24d46a93..ffe1f85ce300 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -34,9 +34,6 @@ static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
 static void amd_sched_process_job(struct fence *f, struct fence_cb *cb);
 
-struct kmem_cache *sched_fence_slab;
-atomic_t sched_fence_slab_ref = ATOMIC_INIT(0);
-
 /* Initialize a given run queue struct */
 static void amd_sched_rq_init(struct amd_sched_rq *rq)
 {
@@ -618,13 +615,6 @@ int amd_sched_init(struct amd_gpu_scheduler *sched,
         INIT_LIST_HEAD(&sched->ring_mirror_list);
         spin_lock_init(&sched->job_list_lock);
         atomic_set(&sched->hw_rq_count, 0);
-        if (atomic_inc_return(&sched_fence_slab_ref) == 1) {
-                sched_fence_slab = kmem_cache_create(
-                        "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
-                        SLAB_HWCACHE_ALIGN, NULL);
-                if (!sched_fence_slab)
-                        return -ENOMEM;
-        }
 
         /* Each scheduler will run on a seperate kernel thread */
         sched->thread = kthread_run(amd_sched_main, sched, sched->name);
@@ -645,6 +635,4 @@ void amd_sched_fini(struct amd_gpu_scheduler *sched)
 {
         if (sched->thread)
                 kthread_stop(sched->thread);
-        if (atomic_dec_and_test(&sched_fence_slab_ref))
-                kmem_cache_destroy(sched_fence_slab);
 }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 7cbbbfb502ef..51068e6c3d9a 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -30,9 +30,6 @@
 struct amd_gpu_scheduler;
 struct amd_sched_rq;
 
-extern struct kmem_cache *sched_fence_slab;
-extern atomic_t sched_fence_slab_ref;
-
 /**
  * A scheduler entity is a wrapper around a job queue or a group
  * of other entities. Entities take turns emitting jobs from their
@@ -145,6 +142,9 @@ void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                            struct amd_sched_entity *entity);
 void amd_sched_entity_push_job(struct amd_sched_job *sched_job);
 
+int amd_sched_fence_slab_init(void);
+void amd_sched_fence_slab_fini(void);
+
 struct amd_sched_fence *amd_sched_fence_create(
         struct amd_sched_entity *s_entity, void *owner);
 void amd_sched_fence_scheduled(struct amd_sched_fence *fence);
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index 6b63beaf7574..88fc2d662579 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -27,6 +27,25 @@
 #include <drm/drmP.h>
 #include "gpu_scheduler.h"
 
+static struct kmem_cache *sched_fence_slab;
+
+int amd_sched_fence_slab_init(void)
+{
+        sched_fence_slab = kmem_cache_create(
+                "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
+                SLAB_HWCACHE_ALIGN, NULL);
+        if (!sched_fence_slab)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void amd_sched_fence_slab_fini(void)
+{
+        rcu_barrier();
+        kmem_cache_destroy(sched_fence_slab);
+}
+
 struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *entity,
                                                void *owner)
 {
@@ -103,7 +122,7 @@ static void amd_sched_fence_free(struct rcu_head *rcu)
 }
 
 /**
- * amd_sched_fence_release - callback that fence can be freed
+ * amd_sched_fence_release_scheduled - callback that fence can be freed
  *
  * @fence: fence
  *
@@ -118,7 +137,7 @@ static void amd_sched_fence_release_scheduled(struct fence *f)
 }
 
 /**
- * amd_sched_fence_release_scheduled - drop extra reference
+ * amd_sched_fence_release_finished - drop extra reference
  *
  * @f: fence
  *
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 23739609427d..e6862a744210 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -420,18 +420,21 @@ drm_atomic_replace_property_blob_from_id(struct drm_crtc *crtc,
                                          ssize_t expected_size,
                                          bool *replaced)
 {
-        struct drm_device *dev = crtc->dev;
         struct drm_property_blob *new_blob = NULL;
 
         if (blob_id != 0) {
-                new_blob = drm_property_lookup_blob(dev, blob_id);
+                new_blob = drm_property_lookup_blob(crtc->dev, blob_id);
                 if (new_blob == NULL)
                         return -EINVAL;
-                if (expected_size > 0 && expected_size != new_blob->length)
+
+                if (expected_size > 0 && expected_size != new_blob->length) {
+                        drm_property_unreference_blob(new_blob);
                         return -EINVAL;
+                }
         }
 
         drm_atomic_replace_property_blob(blob, new_blob, replaced);
+        drm_property_unreference_blob(new_blob);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f83476f996..21f992605541 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -594,10 +594,6 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
         struct drm_plane_state *plane_state;
         int i, ret = 0;
 
-        ret = drm_atomic_normalize_zpos(dev, state);
-        if (ret)
-                return ret;
-
         for_each_plane_in_state(state, plane, plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 04e457117980..aa644487749c 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -914,6 +914,7 @@ static void drm_dp_destroy_port(struct kref *kref)
                 /* no need to clean up vcpi
                  * as if we have no connector we never setup a vcpi */
                 drm_dp_port_teardown_pdt(port, port->pdt);
+                port->pdt = DP_PEER_DEVICE_NONE;
         }
         kfree(port);
 }
@@ -1159,7 +1160,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
                         drm_dp_put_port(port);
                         goto out;
                 }
-                if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
+                if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV ||
+                     port->pdt == DP_PEER_DEVICE_SST_SINK) &&
+                    port->port_num >= DP_MST_LOGICAL_PORT_0) {
                         port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
                         drm_mode_connector_set_tile_property(port->connector);
                 }
@@ -2919,6 +2922,7 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
                 mgr->cbs->destroy_connector(mgr, port->connector);
 
                 drm_dp_port_teardown_pdt(port, port->pdt);
+                port->pdt = DP_PEER_DEVICE_NONE;
 
                 if (!port->input && port->vcpi.vcpi > 0) {
                         drm_dp_mst_reset_vcpi_slots(mgr, port);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 03414bde1f15..6c75e62c0b22 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -131,7 +131,12 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
         return 0;
 fail:
         for (i = 0; i < fb_helper->connector_count; i++) {
-                kfree(fb_helper->connector_info[i]);
+                struct drm_fb_helper_connector *fb_helper_connector =
+                        fb_helper->connector_info[i];
+
+                drm_connector_unreference(fb_helper_connector->connector);
+
+                kfree(fb_helper_connector);
                 fb_helper->connector_info[i] = NULL;
         }
         fb_helper->connector_count = 0;
@@ -603,6 +608,24 @@ int drm_fb_helper_blank(int blank, struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_blank);
 
+static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper,
+                                          struct drm_mode_set *modeset)
+{
+        int i;
+
+        for (i = 0; i < modeset->num_connectors; i++) {
+                drm_connector_unreference(modeset->connectors[i]);
+                modeset->connectors[i] = NULL;
+        }
+        modeset->num_connectors = 0;
+
+        drm_mode_destroy(helper->dev, modeset->mode);
+        modeset->mode = NULL;
+
+        /* FIXME should hold a ref? */
+        modeset->fb = NULL;
+}
+
 static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
 {
         int i;
@@ -612,10 +635,12 @@ static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
                 kfree(helper->connector_info[i]);
         }
         kfree(helper->connector_info);
+
         for (i = 0; i < helper->crtc_count; i++) {
-                kfree(helper->crtc_info[i].mode_set.connectors);
-                if (helper->crtc_info[i].mode_set.mode)
-                        drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode);
+                struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set;
+
+                drm_fb_helper_modeset_release(helper, modeset);
+                kfree(modeset->connectors);
         }
         kfree(helper->crtc_info);
 }
@@ -644,7 +669,9 @@ static void drm_fb_helper_dirty_work(struct work_struct *work)
         clip->x2 = clip->y2 = 0;
         spin_unlock_irqrestore(&helper->dirty_lock, flags);
 
-        helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
+        /* call dirty callback only when it has been really touched */
+        if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2)
+                helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
 }
 
 /**
@@ -2088,7 +2115,6 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
         struct drm_fb_helper_crtc **crtcs;
         struct drm_display_mode **modes;
         struct drm_fb_offset *offsets;
-        struct drm_mode_set *modeset;
         bool *enabled;
         int width, height;
         int i;
@@ -2136,45 +2162,35 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
 
         /* need to set the modesets up here for use later */
         /* fill out the connector<->crtc mappings into the modesets */
-        for (i = 0; i < fb_helper->crtc_count; i++) {
-                modeset = &fb_helper->crtc_info[i].mode_set;
-                modeset->num_connectors = 0;
-                modeset->fb = NULL;
-        }
+        for (i = 0; i < fb_helper->crtc_count; i++)
+                drm_fb_helper_modeset_release(fb_helper,
+                                              &fb_helper->crtc_info[i].mode_set);
 
         for (i = 0; i < fb_helper->connector_count; i++) {
                 struct drm_display_mode *mode = modes[i];
                 struct drm_fb_helper_crtc *fb_crtc = crtcs[i];
                 struct drm_fb_offset *offset = &offsets[i];
-                modeset = &fb_crtc->mode_set;
+                struct drm_mode_set *modeset = &fb_crtc->mode_set;
 
                 if (mode && fb_crtc) {
+                        struct drm_connector *connector =
+                                fb_helper->connector_info[i]->connector;
+
                         DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n",
                                       mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y);
+
                         fb_crtc->desired_mode = mode;
                         fb_crtc->x = offset->x;
                         fb_crtc->y = offset->y;
-                        if (modeset->mode)
-                                drm_mode_destroy(dev, modeset->mode);
                         modeset->mode = drm_mode_duplicate(dev,
                                                            fb_crtc->desired_mode);
-                        modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector;
+                        drm_connector_reference(connector);
+                        modeset->connectors[modeset->num_connectors++] = connector;
                         modeset->fb = fb_helper->fb;
                         modeset->x = offset->x;
                         modeset->y = offset->y;
                 }
         }
-
-        /* Clear out any old modes if there are no more connected outputs. */
-        for (i = 0; i < fb_helper->crtc_count; i++) {
-                modeset = &fb_helper->crtc_info[i].mode_set;
-                if (modeset->num_connectors == 0) {
-                        BUG_ON(modeset->fb);
-                        if (modeset->mode)
-                                drm_mode_destroy(dev, modeset->mode);
-                        modeset->mode = NULL;
-                }
-        }
 out:
         kfree(crtcs);
         kfree(modes);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index def78c8c1780..f86e7c846678 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -262,6 +262,26 @@ int exynos_atomic_commit(struct drm_device *dev, struct drm_atomic_state *state,
         return 0;
 }
 
+int exynos_atomic_check(struct drm_device *dev,
+                        struct drm_atomic_state *state)
+{
+        int ret;
+
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
 static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 {
         struct drm_exynos_file_private *file_priv;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index d215149e737b..80c4d5b81689 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -301,6 +301,7 @@ static inline int exynos_dpi_bind(struct drm_device *dev,
 
 int exynos_atomic_commit(struct drm_device *dev, struct drm_atomic_state *state,
                          bool nonblock);
+int exynos_atomic_check(struct drm_device *dev, struct drm_atomic_state *state);
 
 
 extern struct platform_driver fimd_driver;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index 40ce841eb952..23cce0a3f5fc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -190,7 +190,7 @@ dma_addr_t exynos_drm_fb_dma_addr(struct drm_framebuffer *fb, int index)
 static const struct drm_mode_config_funcs exynos_drm_mode_config_funcs = {
         .fb_create = exynos_user_fb_create,
         .output_poll_changed = exynos_drm_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = exynos_atomic_check,
         .atomic_commit = exynos_atomic_commit,
 };
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index bfb2efd8d4d4..18dfdd5c1b3b 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1447,8 +1447,6 @@ static int i915_drm_suspend(struct drm_device *dev)
 
         dev_priv->suspend_count++;
 
-        intel_display_set_init_power(dev_priv, false);
-
         intel_csr_ucode_suspend(dev_priv);
 
 out:
@@ -1466,6 +1464,8 @@ static int i915_drm_suspend_late(struct drm_device *dev, bool hibernation)
 
         disable_rpm_wakeref_asserts(dev_priv);
 
+        intel_display_set_init_power(dev_priv, false);
+
         fw_csr = !IS_BROXTON(dev_priv) &&
                 suspend_to_idle(dev_priv) && dev_priv->csr.dmc_payload;
         /*
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8b9ee4e390c0..685e9e065287 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2883,6 +2883,11 @@ __i915_printk(struct drm_i915_private *dev_priv, const char *level,
 extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
                               unsigned long arg);
 #endif
+extern const struct dev_pm_ops i915_pm_ops;
+
+extern int i915_driver_load(struct pci_dev *pdev,
+                            const struct pci_device_id *ent);
+extern void i915_driver_unload(struct drm_device *dev);
 extern int intel_gpu_reset(struct drm_i915_private *dev_priv, u32 engine_mask);
 extern bool intel_has_gpu_reset(struct drm_i915_private *dev_priv);
 extern void i915_reset(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 947e82c2b175..91ab7e9d6d2e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1806,7 +1806,7 @@ int i915_gem_fault(struct vm_area_struct *area, struct vm_fault *vmf)
                 /* Use a partial view if it is bigger than available space */
                 chunk_size = MIN_CHUNK_PAGES;
                 if (i915_gem_object_is_tiled(obj))
-                        chunk_size = max(chunk_size, tile_row_pages(obj));
+                        chunk_size = roundup(chunk_size, tile_row_pages(obj));
 
                 memset(&view, 0, sizeof(view));
                 view.type = I915_GGTT_VIEW_PARTIAL;
@@ -3543,15 +3543,27 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
         if (view->type == I915_GGTT_VIEW_NORMAL)
                 vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment,
                                                PIN_MAPPABLE | PIN_NONBLOCK);
-        if (IS_ERR(vma))
-                vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment, 0);
+        if (IS_ERR(vma)) {
+                struct drm_i915_private *i915 = to_i915(obj->base.dev);
+                unsigned int flags;
+
+                /* Valleyview is definitely limited to scanning out the first
+                 * 512MiB. Lets presume this behaviour was inherited from the
+                 * g4x display engine and that all earlier gen are similarly
+                 * limited. Testing suggests that it is a little more
+                 * complicated than this. For example, Cherryview appears quite
+                 * happy to scanout from anywhere within its global aperture.
+                 */
+                flags = 0;
+                if (HAS_GMCH_DISPLAY(i915))
+                        flags = PIN_MAPPABLE;
+                vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment, flags);
+        }
         if (IS_ERR(vma))
                 goto err_unpin_display;
 
         vma->display_alignment = max_t(u64, vma->display_alignment, alignment);
 
-        WARN_ON(obj->pin_display > i915_vma_pin_count(vma));
-
         i915_gem_object_flush_cpu_write_domain(obj);
 
         old_write_domain = obj->base.write_domain;
@@ -3588,7 +3600,6 @@ i915_gem_object_unpin_from_display_plane(struct i915_vma *vma)
                 list_move_tail(&vma->vm_link, &vma->vm->inactive_list);
 
         i915_vma_unpin(vma);
-        WARN_ON(vma->obj->pin_display > i915_vma_pin_count(vma));
 }
 
 /**
@@ -3745,7 +3756,12 @@ void __i915_vma_set_map_and_fenceable(struct i915_vma *vma)
         mappable = (vma->node.start + fence_size <=
                     dev_priv->ggtt.mappable_end);
 
-        if (mappable && fenceable)
+        /*
+         * Explicitly disable for rotated VMA since the display does not
+         * need the fence and the VMA is not accessible to other users.
+         */
+        if (mappable && fenceable &&
+            vma->ggtt_view.type != I915_GGTT_VIEW_ROTATED)
                 vma->flags |= I915_VMA_CAN_FENCE;
         else
                 vma->flags &= ~I915_VMA_CAN_FENCE;
diff --git a/drivers/gpu/drm/i915/i915_gem_fence.c b/drivers/gpu/drm/i915/i915_gem_fence.c
index 8df1fa7234e8..2c7ba0ee127c 100644
--- a/drivers/gpu/drm/i915/i915_gem_fence.c
+++ b/drivers/gpu/drm/i915/i915_gem_fence.c
@@ -290,6 +290,8 @@ i915_vma_put_fence(struct i915_vma *vma)
 {
         struct drm_i915_fence_reg *fence = vma->fence;
 
+        assert_rpm_wakelock_held(to_i915(vma->vm->dev));
+
         if (!fence)
                 return 0;
 
@@ -341,6 +343,8 @@ i915_vma_get_fence(struct i915_vma *vma)
         struct drm_i915_fence_reg *fence;
         struct i915_vma *set = i915_gem_object_is_tiled(vma->obj) ? vma : NULL;
 
+        assert_rpm_wakelock_held(to_i915(vma->vm->dev));
+
         /* Just update our place in the LRU if our fence is getting reused. */
         if (vma->fence) {
                 fence = vma->fence;
@@ -371,6 +375,12 @@ void i915_gem_restore_fences(struct drm_device *dev)
         struct drm_i915_private *dev_priv = to_i915(dev);
         int i;
 
+        /* Note that this may be called outside of struct_mutex, by
+         * runtime suspend/resume. The barrier we require is enforced by
+         * rpm itself - all access to fences/GTT are only within an rpm
+         * wakeref, and to acquire that wakeref you must pass through here.
+         */
+
         for (i = 0; i < dev_priv->num_fence_regs; i++) {
                 struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
                 struct i915_vma *vma = reg->vma;
@@ -379,10 +389,17 @@ void i915_gem_restore_fences(struct drm_device *dev)
                  * Commit delayed tiling changes if we have an object still
                  * attached to the fence, otherwise just clear the fence.
                  */
-                if (vma && !i915_gem_object_is_tiled(vma->obj))
+                if (vma && !i915_gem_object_is_tiled(vma->obj)) {
+                        GEM_BUG_ON(!reg->dirty);
+                        GEM_BUG_ON(vma->obj->fault_mappable);
+
+                        list_move(&reg->link, &dev_priv->mm.fence_list);
+                        vma->fence = NULL;
                         vma = NULL;
+                }
 
-                fence_update(reg, vma);
+                fence_write(reg, vma);
+                reg->vma = vma;
         }
 }
 
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 687c768833b3..31e6edd08dd0 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -431,9 +431,6 @@ static const struct pci_device_id pciidlist[] = {
 };
 MODULE_DEVICE_TABLE(pci, pciidlist);
 
-extern int i915_driver_load(struct pci_dev *pdev,
-                            const struct pci_device_id *ent);
-
 static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         struct intel_device_info *intel_info =
@@ -463,8 +460,6 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return i915_driver_load(pdev, ent);
 }
 
-extern void i915_driver_unload(struct drm_device *dev);
-
 static void i915_pci_remove(struct pci_dev *pdev)
 {
         struct drm_device *dev = pci_get_drvdata(pdev);
@@ -473,8 +468,6 @@ static void i915_pci_remove(struct pci_dev *pdev)
         drm_dev_unref(dev);
 }
 
-extern const struct dev_pm_ops i915_pm_ops;
-
 static struct pci_driver i915_pci_driver = {
         .name = DRIVER_NAME,
         .id_table = pciidlist,
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index c6e69e4cfa83..1f8af87c6294 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1031,6 +1031,77 @@ static u8 translate_iboost(u8 val)
         return mapping[val];
 }
 
+static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
+                             enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port p;
+
+        if (!info->alternate_ddc_pin)
+                return;
+
+        for_each_port_masked(p, (1 << port) - 1) {
+                struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
+
+                if (info->alternate_ddc_pin != i->alternate_ddc_pin)
+                        continue;
+
+                DRM_DEBUG_KMS("port %c trying to use the same DDC pin (0x%x) as port %c, "
+                              "disabling port %c DVI/HDMI support\n",
+                              port_name(p), i->alternate_ddc_pin,
+                              port_name(port), port_name(p));
+
+                /*
+                 * If we have multiple ports supposedly sharing the
+                 * pin, then dvi/hdmi couldn't exist on the shared
+                 * port. Otherwise they share the same ddc bin and
+                 * system couldn't communicate with them separately.
+                 *
+                 * Due to parsing the ports in alphabetical order,
+                 * a higher port will always clobber a lower one.
+                 */
+                i->supports_dvi = false;
+                i->supports_hdmi = false;
+                i->alternate_ddc_pin = 0;
+        }
+}
+
+static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
+                            enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port p;
+
+        if (!info->alternate_aux_channel)
+                return;
+
+        for_each_port_masked(p, (1 << port) - 1) {
+                struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
+
+                if (info->alternate_aux_channel != i->alternate_aux_channel)
+                        continue;
+
+                DRM_DEBUG_KMS("port %c trying to use the same AUX CH (0x%x) as port %c, "
+                              "disabling port %c DP support\n",
+                              port_name(p), i->alternate_aux_channel,
+                              port_name(port), port_name(p));
+
+                /*
+                 * If we have multiple ports supposedlt sharing the
+                 * aux channel, then DP couldn't exist on the shared
+                 * port. Otherwise they share the same aux channel
+                 * and system couldn't communicate with them separately.
+                 *
+                 * Due to parsing the ports in alphabetical order,
+                 * a higher port will always clobber a lower one.
+                 */
+                i->supports_dp = false;
+                i->alternate_aux_channel = 0;
+        }
+}
+
 static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                            const struct bdb_header *bdb)
 {
@@ -1105,54 +1176,15 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                 DRM_DEBUG_KMS("Port %c is internal DP\n", port_name(port));
 
         if (is_dvi) {
-                if (port == PORT_E) {
-                        info->alternate_ddc_pin = ddc_pin;
-                        /* if DDIE share ddc pin with other port, then
-                         * dvi/hdmi couldn't exist on the shared port.
-                         * Otherwise they share the same ddc bin and system
-                         * couldn't communicate with them seperately. */
-                        if (ddc_pin == DDC_PIN_B) {
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_hdmi = 0;
-                        } else if (ddc_pin == DDC_PIN_C) {
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_hdmi = 0;
-                        } else if (ddc_pin == DDC_PIN_D) {
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_hdmi = 0;
-                        }
-                } else if (ddc_pin == DDC_PIN_B && port != PORT_B)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port B\n");
-                else if (ddc_pin == DDC_PIN_C && port != PORT_C)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port C\n");
-                else if (ddc_pin == DDC_PIN_D && port != PORT_D)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port D\n");
+                info->alternate_ddc_pin = ddc_pin;
+
+                sanitize_ddc_pin(dev_priv, port);
         }
 
         if (is_dp) {
-                if (port == PORT_E) {
-                        info->alternate_aux_channel = aux_channel;
-                        /* if DDIE share aux channel with other port, then
-                         * DP couldn't exist on the shared port. Otherwise
-                         * they share the same aux channel and system
-                         * couldn't communicate with them seperately. */
-                        if (aux_channel == DP_AUX_A)
-                                dev_priv->vbt.ddi_port_info[PORT_A].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_B)
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_C)
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_D)
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_dp = 0;
-                }
-                else if (aux_channel == DP_AUX_A && port != PORT_A)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port A\n");
-                else if (aux_channel == DP_AUX_B && port != PORT_B)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port B\n");
-                else if (aux_channel == DP_AUX_C && port != PORT_C)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port C\n");
-                else if (aux_channel == DP_AUX_D && port != PORT_D)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port D\n");
+                info->alternate_aux_channel = aux_channel;
+
+                sanitize_aux_ch(dev_priv, port);
         }
 
         if (bdb->version >= 158) {
diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
index 73b6858600ac..1b20e160bc1f 100644
--- a/drivers/gpu/drm/i915/intel_device_info.c
+++ b/drivers/gpu/drm/i915/intel_device_info.c
@@ -192,7 +192,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
         struct sseu_dev_info *sseu = &mkwrite_device_info(dev_priv)->sseu;
         const int s_max = 3, ss_max = 3, eu_max = 8;
         int s, ss;
-        u32 fuse2, eu_disable[s_max];
+        u32 fuse2, eu_disable[3]; /* s_max */
 
         fuse2 = I915_READ(GEN8_FUSE2);
         sseu->slice_mask = (fuse2 & GEN8_F2_S_ENA_MASK) >> GEN8_F2_S_ENA_SHIFT;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index fbcfed63a76e..81c11499bcf0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2978,7 +2978,8 @@ int skl_check_plane_surface(struct intel_plane_state *plane_state)
         /* Rotate src coordinates to match rotated GTT view */
         if (intel_rotation_90_or_270(rotation))
                 drm_rect_rotate(&plane_state->base.src,
-                                fb->width, fb->height, DRM_ROTATE_270);
+                                fb->width << 16, fb->height << 16,
+                                DRM_ROTATE_270);
 
         /*
          * Handle the AUX surface first since
@@ -10242,6 +10243,29 @@ static void bxt_modeset_commit_cdclk(struct drm_atomic_state *old_state)
         bxt_set_cdclk(to_i915(dev), req_cdclk);
 }
 
+static int bdw_adjust_min_pipe_pixel_rate(struct intel_crtc_state *crtc_state,
+                                          int pixel_rate)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
+
+        /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
+        if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled)
+                pixel_rate = DIV_ROUND_UP(pixel_rate * 100, 95);
+
+        /* BSpec says "Do not use DisplayPort with CDCLK less than
+         * 432 MHz, audio enabled, port width x4, and link rate
+         * HBR2 (5.4 GHz), or else there may be audio corruption or
+         * screen corruption."
+         */
+        if (intel_crtc_has_dp_encoder(crtc_state) &&
+            crtc_state->has_audio &&
+            crtc_state->port_clock >= 540000 &&
+            crtc_state->lane_count == 4)
+                pixel_rate = max(432000, pixel_rate);
+
+        return pixel_rate;
+}
+
 /* compute the max rate for new configuration */
 static int ilk_max_pixel_rate(struct drm_atomic_state *state)
 {
@@ -10267,9 +10291,9 @@ static int ilk_max_pixel_rate(struct drm_atomic_state *state)
 
                 pixel_rate = ilk_pipe_pixel_rate(crtc_state);
 
-                /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
-                if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled)
-                        pixel_rate = DIV_ROUND_UP(pixel_rate * 100, 95);
+                if (IS_BROADWELL(dev_priv) || IS_GEN9(dev_priv))
+                        pixel_rate = bdw_adjust_min_pipe_pixel_rate(crtc_state,
+                                                                    pixel_rate);
 
                 intel_state->min_pixclk[i] = pixel_rate;
         }
@@ -14310,7 +14334,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 
         for_each_plane_in_state(state, plane, plane_state, i) {
                 struct intel_plane_state *intel_plane_state =
-                        to_intel_plane_state(plane_state);
+                        to_intel_plane_state(plane->state);
 
                 if (!intel_plane_state->wait_req)
                         continue;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 14a3cf0b7213..3581b5a7f716 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1108,6 +1108,44 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
         return ret;
 }
 
+static enum port intel_aux_port(struct drm_i915_private *dev_priv,
+                                enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port aux_port;
+
+        if (!info->alternate_aux_channel) {
+                DRM_DEBUG_KMS("using AUX %c for port %c (platform default)\n",
+                              port_name(port), port_name(port));
+                return port;
+        }
+
+        switch (info->alternate_aux_channel) {
+        case DP_AUX_A:
+                aux_port = PORT_A;
+                break;
+        case DP_AUX_B:
+                aux_port = PORT_B;
+                break;
+        case DP_AUX_C:
+                aux_port = PORT_C;
+                break;
+        case DP_AUX_D:
+                aux_port = PORT_D;
+                break;
+        default:
+                MISSING_CASE(info->alternate_aux_channel);
+                aux_port = PORT_A;
+                break;
+        }
+
+        DRM_DEBUG_KMS("using AUX %c for port %c (VBT)\n",
+                      port_name(aux_port), port_name(port));
+
+        return aux_port;
+}
+
 static i915_reg_t g4x_aux_ctl_reg(struct drm_i915_private *dev_priv,
                                        enum port port)
 {
@@ -1168,36 +1206,9 @@ static i915_reg_t ilk_aux_data_reg(struct drm_i915_private *dev_priv,
         }
 }
 
-/*
- * On SKL we don't have Aux for port E so we rely
- * on VBT to set a proper alternate aux channel.
- */
-static enum port skl_porte_aux_port(struct drm_i915_private *dev_priv)
-{
-        const struct ddi_vbt_port_info *info =
-                &dev_priv->vbt.ddi_port_info[PORT_E];
-
-        switch (info->alternate_aux_channel) {
-        case DP_AUX_A:
-                return PORT_A;
-        case DP_AUX_B:
-                return PORT_B;
-        case DP_AUX_C:
-                return PORT_C;
-        case DP_AUX_D:
-                return PORT_D;
-        default:
-                MISSING_CASE(info->alternate_aux_channel);
-                return PORT_A;
-        }
-}
-
 static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
                                        enum port port)
 {
-        if (port == PORT_E)
-                port = skl_porte_aux_port(dev_priv);
-
         switch (port) {
         case PORT_A:
         case PORT_B:
@@ -1213,9 +1224,6 @@ static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
 static i915_reg_t skl_aux_data_reg(struct drm_i915_private *dev_priv,
                                         enum port port, int index)
 {
-        if (port == PORT_E)
-                port = skl_porte_aux_port(dev_priv);
-
         switch (port) {
         case PORT_A:
         case PORT_B:
@@ -1253,7 +1261,8 @@ static i915_reg_t intel_aux_data_reg(struct drm_i915_private *dev_priv,
 static void intel_aux_reg_init(struct intel_dp *intel_dp)
 {
         struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
-        enum port port = dp_to_dig_port(intel_dp)->port;
+        enum port port = intel_aux_port(dev_priv,
+                                        dp_to_dig_port(intel_dp)->port);
         int i;
 
         intel_dp->aux_ch_ctl_reg = intel_aux_ctl_reg(dev_priv, port);
@@ -3551,8 +3560,8 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
         /* Read the eDP Display control capabilities registers */
         if ((intel_dp->dpcd[DP_EDP_CONFIGURATION_CAP] & DP_DPCD_DISPLAY_CONTROL_CAPABLE) &&
             drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
-                             intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd) ==
-                             sizeof(intel_dp->edp_dpcd)))
+                             intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd)) ==
+                             sizeof(intel_dp->edp_dpcd))
                 DRM_DEBUG_KMS("EDP DPCD : %*ph\n", (int) sizeof(intel_dp->edp_dpcd),
                               intel_dp->edp_dpcd);
 
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index faa67624e1ed..c43dd9abce79 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -104,8 +104,10 @@ static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
         int lines;
 
         intel_fbc_get_plane_source_size(cache, NULL, &lines);
-        if (INTEL_INFO(dev_priv)->gen >= 7)
+        if (INTEL_GEN(dev_priv) == 7)
                 lines = min(lines, 2048);
+        else if (INTEL_GEN(dev_priv) >= 8)
+                lines = min(lines, 2560);
 
         /* Hardware needs the full buffer stride, not just the active area. */
         return lines * cache->fb.stride;
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index f40a35f2913a..13c306173f27 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1799,6 +1799,50 @@ intel_hdmi_add_properties(struct intel_hdmi *intel_hdmi, struct drm_connector *c
         intel_hdmi->aspect_ratio = HDMI_PICTURE_ASPECT_NONE;
 }
 
+static u8 intel_hdmi_ddc_pin(struct drm_i915_private *dev_priv,
+                             enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        u8 ddc_pin;
+
+        if (info->alternate_ddc_pin) {
+                DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (VBT)\n",
+                              info->alternate_ddc_pin, port_name(port));
+                return info->alternate_ddc_pin;
+        }
+
+        switch (port) {
+        case PORT_B:
+                if (IS_BROXTON(dev_priv))
+                        ddc_pin = GMBUS_PIN_1_BXT;
+                else
+                        ddc_pin = GMBUS_PIN_DPB;
+                break;
+        case PORT_C:
+                if (IS_BROXTON(dev_priv))
+                        ddc_pin = GMBUS_PIN_2_BXT;
+                else
+                        ddc_pin = GMBUS_PIN_DPC;
+                break;
+        case PORT_D:
+                if (IS_CHERRYVIEW(dev_priv))
+                        ddc_pin = GMBUS_PIN_DPD_CHV;
+                else
+                        ddc_pin = GMBUS_PIN_DPD;
+                break;
+        default:
+                MISSING_CASE(port);
+                ddc_pin = GMBUS_PIN_DPB;
+                break;
+        }
+
+        DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (platform default)\n",
+                      ddc_pin, port_name(port));
+
+        return ddc_pin;
+}
+
 void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
                                struct intel_connector *intel_connector)
 {
@@ -1808,7 +1852,6 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
         struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
         enum port port = intel_dig_port->port;
-        uint8_t alternate_ddc_pin;
 
         DRM_DEBUG_KMS("Adding HDMI connector on port %c\n",
                       port_name(port));
@@ -1826,12 +1869,10 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
         connector->doublescan_allowed = 0;
         connector->stereo_allowed = 1;
 
+        intel_hdmi->ddc_bus = intel_hdmi_ddc_pin(dev_priv, port);
+
         switch (port) {
         case PORT_B:
-                if (IS_BROXTON(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_1_BXT;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
                 /*
                  * On BXT A0/A1, sw needs to activate DDIA HPD logic and
                  * interrupts to check the external panel connection.
@@ -1842,46 +1883,17 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
                         intel_encoder->hpd_pin = HPD_PORT_B;
                 break;
         case PORT_C:
-                if (IS_BROXTON(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_2_BXT;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
                 intel_encoder->hpd_pin = HPD_PORT_C;
                 break;
         case PORT_D:
-                if (WARN_ON(IS_BROXTON(dev_priv)))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DISABLED;
-                else if (IS_CHERRYVIEW(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD_CHV;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
                 intel_encoder->hpd_pin = HPD_PORT_D;
                 break;
         case PORT_E:
-                /* On SKL PORT E doesn't have seperate GMBUS pin
-                 *  We rely on VBT to set a proper alternate GMBUS pin. */
-                alternate_ddc_pin =
-                        dev_priv->vbt.ddi_port_info[PORT_E].alternate_ddc_pin;
-                switch (alternate_ddc_pin) {
-                case DDC_PIN_B:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
-                        break;
-                case DDC_PIN_C:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
-                        break;
-                case DDC_PIN_D:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
-                        break;
-                default:
-                        MISSING_CASE(alternate_ddc_pin);
-                }
                 intel_encoder->hpd_pin = HPD_PORT_E;
                 break;
-        case PORT_A:
-                intel_encoder->hpd_pin = HPD_PORT_A;
-                /* Internal port only for eDP. */
         default:
-                BUG();
+                MISSING_CASE(port);
+                return;
         }
 
         if (IS_VALLEYVIEW(dev) || IS_CHERRYVIEW(dev)) {
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index a2f751cd187a..db24f898853c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3362,13 +3362,15 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
         int num_active;
         int id, i;
 
+        /* Clear the partitioning for disabled planes. */
+        memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
+        memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
+
         if (WARN_ON(!state))
                 return 0;
 
         if (!cstate->base.active) {
                 ddb->pipe[pipe].start = ddb->pipe[pipe].end = 0;
-                memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
-                memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
                 return 0;
         }
 
@@ -3468,12 +3470,6 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
         return 0;
 }
 
-static uint32_t skl_pipe_pixel_rate(const struct intel_crtc_state *config)
-{
-        /* TODO: Take into account the scalers once we support them */
-        return config->base.adjusted_mode.crtc_clock;
-}
-
 /*
  * The max latency should be 257 (max the punit can code is 255 and we add 2us
  * for the read latency) and cpp should always be <= 8, so that
@@ -3524,7 +3520,7 @@ static uint32_t skl_adjusted_plane_pixel_rate(const struct intel_crtc_state *cst
          * Adjusted plane pixel rate is just the pipe's adjusted pixel rate
          * with additional adjustments for plane-specific scaling.
          */
-        adjusted_pixel_rate = skl_pipe_pixel_rate(cstate);
+        adjusted_pixel_rate = ilk_pipe_pixel_rate(cstate);
         downscale_amount = skl_plane_downscale_amount(pstate);
 
         pixel_rate = adjusted_pixel_rate * downscale_amount >> 16;
@@ -3736,11 +3732,11 @@ skl_compute_linetime_wm(struct intel_crtc_state *cstate)
         if (!cstate->base.active)
                 return 0;
 
-        if (WARN_ON(skl_pipe_pixel_rate(cstate) == 0))
+        if (WARN_ON(ilk_pipe_pixel_rate(cstate) == 0))
                 return 0;
 
         return DIV_ROUND_UP(8 * cstate->base.adjusted_mode.crtc_htotal * 1000,
-                            skl_pipe_pixel_rate(cstate));
+                            ilk_pipe_pixel_rate(cstate));
 }
 
 static void skl_compute_transition_wm(struct intel_crtc_state *cstate,
@@ -4050,6 +4046,12 @@ skl_compute_ddb(struct drm_atomic_state *state)
                 intel_state->wm_results.dirty_pipes = ~0;
         }
 
+        /*
+         * We're not recomputing for the pipes not included in the commit, so
+         * make sure we start with the current state.
+         */
+        memcpy(ddb, &dev_priv->wm.skl_hw.ddb, sizeof(*ddb));
+
         for_each_intel_crtc_mask(dev, intel_crtc, realloc_pipes) {
                 struct intel_crtc_state *cstate;
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 6c11168facd6..a38c2fefe85a 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -1139,7 +1139,9 @@ static void vlv_display_power_well_deinit(struct drm_i915_private *dev_priv)
 
         intel_power_sequencer_reset(dev_priv);
 
-        intel_hpd_poll_init(dev_priv);
+        /* Prevent us from re-enabling polling on accident in late suspend */
+        if (!dev_priv->drm.dev->power.is_suspended)
+                intel_hpd_poll_init(dev_priv);
 }
 
 static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 98df09c2b388..9672b579f950 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -357,8 +357,8 @@ static int imx_drm_bind(struct device *dev)
         int ret;
 
         drm = drm_dev_alloc(&imx_drm_driver, dev);
-        if (!drm)
-                return -ENOMEM;
+        if (IS_ERR(drm))
+                return PTR_ERR(drm);
 
         imxdrm = devm_kzalloc(dev, sizeof(*imxdrm), GFP_KERNEL);
         if (!imxdrm) {
@@ -436,9 +436,11 @@ static int imx_drm_bind(struct device *dev)
 
 err_fbhelper:
         drm_kms_helper_poll_fini(drm);
+#if IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION)
         if (imxdrm->fbhelper)
                 drm_fbdev_cma_fini(imxdrm->fbhelper);
 err_unbind:
+#endif
         component_unbind_all(drm->dev, drm);
 err_vblank:
         drm_vblank_cleanup(drm);
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 4e1ae3fc462d..6be515a9fb69 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -68,6 +68,12 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
 
         ipu_dc_disable_channel(ipu_crtc->dc);
         ipu_di_disable(ipu_crtc->di);
+        /*
+         * Planes must be disabled before DC clock is removed, as otherwise the
+         * attached IDMACs will be left in undefined state, possibly hanging
+         * the IPU or even system.
+         */
+        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false);
         ipu_dc_disable(ipu);
 
         spin_lock_irq(&crtc->dev->event_lock);
@@ -77,9 +83,6 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
         }
         spin_unlock_irq(&crtc->dev->event_lock);
 
-        /* always disable planes on the CRTC */
-        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
-
         drm_crtc_vblank_off(crtc);
 }
 
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index ce22d0a0ddc8..d5864ed4d772 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -103,11 +103,11 @@ drm_plane_state_to_vbo(struct drm_plane_state *state)
                (state->src_x >> 16) / 2 - eba;
 }
 
-static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
-                                      struct drm_plane_state *old_state)
+static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane)
 {
         struct drm_plane *plane = &ipu_plane->base;
         struct drm_plane_state *state = plane->state;
+        struct drm_crtc_state *crtc_state = state->crtc->state;
         struct drm_framebuffer *fb = state->fb;
         unsigned long eba, ubo, vbo;
         int active;
@@ -117,7 +117,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
         switch (fb->pixel_format) {
         case DRM_FORMAT_YUV420:
         case DRM_FORMAT_YVU420:
-                if (old_state->fb)
+                if (!drm_atomic_crtc_needs_modeset(crtc_state))
                         break;
 
                 /*
@@ -149,7 +149,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
                 break;
         }
 
-        if (old_state->fb) {
+        if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
                 active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch);
                 ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba);
                 ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active);
@@ -259,6 +259,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
         struct drm_framebuffer *fb = state->fb;
         struct drm_framebuffer *old_fb = old_state->fb;
         unsigned long eba, ubo, vbo, old_ubo, old_vbo;
+        int hsub, vsub;
 
         /* Ok to disable */
         if (!fb)
@@ -355,7 +356,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                 if ((ubo > 0xfffff8) || (vbo > 0xfffff8))
                         return -EINVAL;
 
-                if (old_fb) {
+                if (old_fb &&
+                    (old_fb->pixel_format == DRM_FORMAT_YUV420 ||
+                     old_fb->pixel_format == DRM_FORMAT_YVU420)) {
                         old_ubo = drm_plane_state_to_ubo(old_state);
                         old_vbo = drm_plane_state_to_vbo(old_state);
                         if (ubo != old_ubo || vbo != old_vbo)
@@ -370,6 +373,16 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
 
                 if (old_fb && old_fb->pitches[1] != fb->pitches[1])
                         crtc_state->mode_changed = true;
+
+                /*
+                 * The x/y offsets must be even in case of horizontal/vertical
+                 * chroma subsampling.
+                 */
+                hsub = drm_format_horz_chroma_subsampling(fb->pixel_format);
+                vsub = drm_format_vert_chroma_subsampling(fb->pixel_format);
+                if (((state->src_x >> 16) & (hsub - 1)) ||
+                    ((state->src_y >> 16) & (vsub - 1)))
+                        return -EINVAL;
         }
 
         return 0;
@@ -392,7 +405,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                 struct drm_crtc_state *crtc_state = state->crtc->state;
 
                 if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
-                        ipu_plane_atomic_set_base(ipu_plane, old_state);
+                        ipu_plane_atomic_set_base(ipu_plane);
                         return;
                 }
         }
@@ -424,6 +437,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                         ipu_dp_set_global_alpha(ipu_plane->dp, false, 0, false);
                         break;
                 default:
+                        ipu_dp_set_global_alpha(ipu_plane->dp, true, 0, true);
                         break;
                 }
         }
@@ -437,7 +451,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
         ipu_cpmem_set_high_priority(ipu_plane->ipu_ch);
         ipu_idmac_set_double_buffer(ipu_plane->ipu_ch, 1);
         ipu_cpmem_set_stride(ipu_plane->ipu_ch, state->fb->pitches[0]);
-        ipu_plane_atomic_set_base(ipu_plane, old_state);
+        ipu_plane_atomic_set_base(ipu_plane);
         ipu_plane_enable(ipu_plane);
 }
 
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index f05ed0e1f3d6..6f240021705b 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -139,6 +139,7 @@ struct msm_dsi_host {
 
         u32 err_work_state;
         struct work_struct err_work;
+        struct work_struct hpd_work;
         struct workqueue_struct *workqueue;
 
         /* DSI 6G TX buffer*/
@@ -1294,6 +1295,14 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
         wmb();  /* make sure dsi controller enabled again */
 }
 
+static void dsi_hpd_worker(struct work_struct *work)
+{
+        struct msm_dsi_host *msm_host =
+                container_of(work, struct msm_dsi_host, hpd_work);
+
+        drm_helper_hpd_irq_event(msm_host->dev);
+}
+
 static void dsi_err_worker(struct work_struct *work)
 {
         struct msm_dsi_host *msm_host =
@@ -1480,7 +1489,7 @@ static int dsi_host_attach(struct mipi_dsi_host *host,
 
         DBG("id=%d", msm_host->id);
         if (msm_host->dev)
-                drm_helper_hpd_irq_event(msm_host->dev);
+                queue_work(msm_host->workqueue, &msm_host->hpd_work);
 
         return 0;
 }
@@ -1494,7 +1503,7 @@ static int dsi_host_detach(struct mipi_dsi_host *host,
 
         DBG("id=%d", msm_host->id);
         if (msm_host->dev)
-                drm_helper_hpd_irq_event(msm_host->dev);
+                queue_work(msm_host->workqueue, &msm_host->hpd_work);
 
         return 0;
 }
@@ -1748,6 +1757,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
         /* setup workqueue */
         msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
         INIT_WORK(&msm_host->err_work, dsi_err_worker);
+        INIT_WORK(&msm_host->hpd_work, dsi_hpd_worker);
 
         msm_dsi->host = &msm_host->base;
         msm_dsi->id = msm_host->id;
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
index 598fdaff0a41..26e3a01a99c2 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
@@ -521,6 +521,7 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm)
                 .parent_names = (const char *[]){ "xo" },
                 .num_parents = 1,
                 .name = vco_name,
+                .flags = CLK_IGNORE_UNUSED,
                 .ops = &clk_ops_dsi_pll_28nm_vco,
         };
         struct device *dev = &pll_28nm->pdev->dev;
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
index 38c90e1eb002..49008451085b 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
@@ -412,6 +412,7 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm)
         struct clk_init_data vco_init = {
                 .parent_names = (const char *[]){ "pxo" },
                 .num_parents = 1,
+                .flags = CLK_IGNORE_UNUSED,
                 .ops = &clk_ops_dsi_pll_28nm_vco,
         };
         struct device *dev = &pll_28nm->pdev->dev;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
index aa94a553794f..143eab46ba68 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
@@ -702,6 +702,7 @@ static struct clk_init_data pll_init = {
         .ops = &hdmi_8996_pll_ops,
         .parent_names = hdmi_pll_parents,
         .num_parents = ARRAY_SIZE(hdmi_pll_parents),
+        .flags = CLK_IGNORE_UNUSED,
 };
 
 int msm_hdmi_pll_8996_init(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c b/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
index 92da69aa6187..99590758c68b 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
@@ -424,6 +424,7 @@ static struct clk_init_data pll_init = {
         .ops = &hdmi_pll_ops,
         .parent_names = hdmi_pll_parents,
         .num_parents = ARRAY_SIZE(hdmi_pll_parents),
+        .flags = CLK_IGNORE_UNUSED,
 };
 
 int msm_hdmi_pll_8960_init(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index ac9e4cde1380..8b4e3004f451 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -272,7 +272,7 @@ const struct mdp5_cfg_hw msm8x16_config = {
                 .count = 2,
                 .base = { 0x14000, 0x16000 },
                 .caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
-                                MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_DECIMATION,
+                                MDP_PIPE_CAP_DECIMATION,
         },
         .pipe_dma = {
                 .count = 1,
@@ -282,7 +282,7 @@ const struct mdp5_cfg_hw msm8x16_config = {
         .lm = {
                 .count = 2, /* LM0 and LM3 */
                 .base = { 0x44000, 0x47000 },
-                .nb_stages = 5,
+                .nb_stages = 8,
                 .max_width = 2048,
                 .max_height = 0xFFFF,
         },
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index fa2be7ce9468..c205c360e16d 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -223,12 +223,7 @@ static void blend_setup(struct drm_crtc *crtc)
                 plane_cnt++;
         }
 
-        /*
-        * If there is no base layer, enable border color.
-        * Although it's not possbile in current blend logic,
-        * put it here as a reminder.
-        */
-        if (!pstates[STAGE_BASE] && plane_cnt) {
+        if (!pstates[STAGE_BASE]) {
                 ctl_blend_flags |= MDP5_CTL_BLEND_OP_FLAG_BORDER_OUT;
                 DBG("Border Color is enabled");
         }
@@ -365,6 +360,15 @@ static int pstate_cmp(const void *a, const void *b)
         return pa->state->zpos - pb->state->zpos;
 }
 
+/* is there a helper for this? */
+static bool is_fullscreen(struct drm_crtc_state *cstate,
+                struct drm_plane_state *pstate)
+{
+        return (pstate->crtc_x <= 0) && (pstate->crtc_y <= 0) &&
+                ((pstate->crtc_x + pstate->crtc_w) >= cstate->mode.hdisplay) &&
+                ((pstate->crtc_y + pstate->crtc_h) >= cstate->mode.vdisplay);
+}
+
 static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
                 struct drm_crtc_state *state)
 {
@@ -375,21 +379,11 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
         struct plane_state pstates[STAGE_MAX + 1];
         const struct mdp5_cfg_hw *hw_cfg;
         const struct drm_plane_state *pstate;
-        int cnt = 0, i;
+        int cnt = 0, base = 0, i;
 
         DBG("%s: check", mdp5_crtc->name);
 
-        /* verify that there are not too many planes attached to crtc
-         * and that we don't have conflicting mixer stages:
-         */
-        hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
         drm_atomic_crtc_state_for_each_plane_state(plane, pstate, state) {
-                if (cnt >= (hw_cfg->lm.nb_stages)) {
-                        dev_err(dev->dev, "too many planes!\n");
-                        return -EINVAL;
-                }
-
-
                 pstates[cnt].plane = plane;
                 pstates[cnt].state = to_mdp5_plane_state(pstate);
 
@@ -399,8 +393,24 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
         /* assign a stage based on sorted zpos property */
         sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
 
+        /* if the bottom-most layer is not fullscreen, we need to use
+         * it for solid-color:
+         */
+        if ((cnt > 0) && !is_fullscreen(state, &pstates[0].state->base))
+                base++;
+
+        /* verify that there are not too many planes attached to crtc
+         * and that we don't have conflicting mixer stages:
+         */
+        hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+
+        if ((cnt + base) >= hw_cfg->lm.nb_stages) {
+                dev_err(dev->dev, "too many planes!\n");
+                return -EINVAL;
+        }
+
         for (i = 0; i < cnt; i++) {
-                pstates[i].state->stage = STAGE_BASE + i;
+                pstates[i].state->stage = STAGE_BASE + i + base;
                 DBG("%s: assign pipe %s on stage=%d", mdp5_crtc->name,
                                 pipe2name(mdp5_plane_pipe(pstates[i].plane)),
                                 pstates[i].state->stage);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index 951c002b05df..83bf997dda03 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -292,8 +292,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                 format = to_mdp_format(msm_framebuffer_format(state->fb));
                 if (MDP_FORMAT_IS_YUV(format) &&
                         !pipe_supports_yuv(mdp5_plane->caps)) {
-                        dev_err(plane->dev->dev,
-                                "Pipe doesn't support YUV\n");
+                        DBG("Pipe doesn't support YUV\n");
 
                         return -EINVAL;
                 }
@@ -301,8 +300,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                 if (!(mdp5_plane->caps & MDP_PIPE_CAP_SCALE) &&
                         (((state->src_w >> 16) != state->crtc_w) ||
                         ((state->src_h >> 16) != state->crtc_h))) {
-                        dev_err(plane->dev->dev,
-                                "Pipe doesn't support scaling (%dx%d -> %dx%d)\n",
+                        DBG("Pipe doesn't support scaling (%dx%d -> %dx%d)\n",
                                 state->src_w >> 16, state->src_h >> 16,
                                 state->crtc_w, state->crtc_h);
 
@@ -313,8 +311,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                 vflip = !!(state->rotation & DRM_REFLECT_Y);
                 if ((vflip && !(mdp5_plane->caps & MDP_PIPE_CAP_VFLIP)) ||
                         (hflip && !(mdp5_plane->caps & MDP_PIPE_CAP_HFLIP))) {
-                        dev_err(plane->dev->dev,
-                                "Pipe doesn't support flip\n");
+                        DBG("Pipe doesn't support flip\n");
 
                         return -EINVAL;
                 }
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index fb5c0b0a7594..46568fc80848 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -228,7 +228,7 @@ static int msm_drm_uninit(struct device *dev)
         flush_workqueue(priv->atomic_wq);
         destroy_workqueue(priv->atomic_wq);
 
-        if (kms)
+        if (kms && kms->funcs)
                 kms->funcs->destroy(kms);
 
         if (gpu) {
diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c
index 283d2841ba58..192b2d3a79cb 100644
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -163,6 +163,9 @@ void msm_gem_shrinker_init(struct drm_device *dev)
 void msm_gem_shrinker_cleanup(struct drm_device *dev)
 {
         struct msm_drm_private *priv = dev->dev_private;
-        WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
-        unregister_shrinker(&priv->shrinker);
+
+        if (priv->shrinker.nr_deferred) {
+                WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
+                unregister_shrinker(&priv->shrinker);
+        }
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index dc57b628e074..193573d191e5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -240,7 +240,8 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
         if (!parent_adev)
                 return false;
 
-        return acpi_has_method(parent_adev->handle, "_PR3");
+        return parent_adev->power.flags.power_resources &&
+                acpi_has_method(parent_adev->handle, "_PR3");
 }
 
 static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out,
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 103fc8650197..a0d4a0522fdc 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev)
 void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
                               int ring, u32 cp_int_cntl)
 {
-        u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
-
-        WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
+        WREG32(SRBM_GFX_CNTL, RINGID(ring));
         WREG32(CP_INT_CNTL, cp_int_cntl);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e18839d52e3e..27affbde058c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -931,7 +931,7 @@ static void radeon_connector_unregister(struct drm_connector *connector)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
 
-        if (radeon_connector->ddc_bus->has_aux) {
+        if (radeon_connector->ddc_bus && radeon_connector->ddc_bus->has_aux) {
                 drm_dp_aux_unregister(&radeon_connector->ddc_bus->aux);
                 radeon_connector->ddc_bus->has_aux = false;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index eb92aef46e3c..621af069a3d2 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -104,6 +104,14 @@ static const char radeon_family_name[][16] = {
         "LAST",
 };
 
+#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_has_atpx_dgpu_power_cntl(void);
+bool radeon_is_atpx_hybrid(void);
+#else
+static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+static inline bool radeon_is_atpx_hybrid(void) { return false; }
+#endif
+
 #define RADEON_PX_QUIRK_DISABLE_PX  (1 << 0)
 #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
 
@@ -160,6 +168,11 @@ static void radeon_device_handle_px_quirks(struct radeon_device *rdev)
 
         if (rdev->px_quirk_flags & RADEON_PX_QUIRK_DISABLE_PX)
                 rdev->flags &= ~RADEON_IS_PX;
+
+        /* disable PX is the system doesn't support dGPU power control or hybrid gfx */
+        if (!radeon_is_atpx_hybrid() &&
+            !radeon_has_atpx_dgpu_power_cntl())
+                rdev->flags &= ~RADEON_IS_PX;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
index 2d465648856a..474a8a1886f7 100644
--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
+++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg
 
         tmp &= AUX_HPD_SEL(0x7);
         tmp |= AUX_HPD_SEL(chan->rec.hpd);
-        tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
+        tmp |= AUX_EN | AUX_LS_READ_EN;
 
         WREG32(AUX_CONTROL + aux_offset[instance], tmp);
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 89bdf20344ae..c49934527a87 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
         int i;
         struct si_dpm_quirk *p = si_dpm_quirk_list;
 
+        /* limit all SI kickers */
+        if (rdev->family == CHIP_PITCAIRN) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->device == 0x6810) ||
+                    (rdev->pdev->device == 0x6811) ||
+                    (rdev->pdev->device == 0x6816) ||
+                    (rdev->pdev->device == 0x6817) ||
+                    (rdev->pdev->device == 0x6806))
+                        max_mclk = 120000;
+        } else if (rdev->family == CHIP_VERDE) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0x87) ||
+                    (rdev->pdev->device == 0x6820) ||
+                    (rdev->pdev->device == 0x6821) ||
+                    (rdev->pdev->device == 0x6822) ||
+                    (rdev->pdev->device == 0x6823) ||
+                    (rdev->pdev->device == 0x682A) ||
+                    (rdev->pdev->device == 0x682B)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (rdev->family == CHIP_OLAND) {
+                if ((rdev->pdev->revision == 0xC7) ||
+                    (rdev->pdev->revision == 0x80) ||
+                    (rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->device == 0x6604) ||
+                    (rdev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (rdev->family == CHIP_HAINAN) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0xC3) ||
+                    (rdev->pdev->device == 0x6664) ||
+                    (rdev->pdev->device == 0x6665) ||
+                    (rdev->pdev->device == 0x6667)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        }
         /* Apply dpm quirks */
         while (p && p->chip_device != 0) {
                 if (rdev->pdev->vendor == p->chip_vendor &&
@@ -3011,16 +3054,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
                 ++p;
         }
-        /* limit mclk on all R7 370 parts for stability */
-        if (rdev->pdev->device == 0x6811 &&
-            rdev->pdev->revision == 0x81)
-                max_mclk = 120000;
-        /* limit sclk/mclk on Jet parts for stability */
-        if (rdev->pdev->device == 0x6665 &&
-            rdev->pdev->revision == 0xc3) {
-                max_sclk = 75000;
-                max_mclk = 80000;
-        }
 
         if (rps->vce_active) {
                 rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
index bd9c3bb9252c..392c7e6de042 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
@@ -231,8 +231,16 @@ static int rcar_du_atomic_check(struct drm_device *dev,
         struct rcar_du_device *rcdu = dev->dev_private;
         int ret;
 
-        ret = drm_atomic_helper_check(dev, state);
-        if (ret < 0)
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
                 return ret;
 
         if (rcar_du_has(rcdu, RCAR_DU_FEATURE_VSP1_SOURCE))
diff --git a/drivers/gpu/drm/sti/sti_drv.c b/drivers/gpu/drm/sti/sti_drv.c
index 2784919a7366..9df308565f6c 100644
--- a/drivers/gpu/drm/sti/sti_drv.c
+++ b/drivers/gpu/drm/sti/sti_drv.c
@@ -195,6 +195,26 @@ static void sti_atomic_work(struct work_struct *work)
         sti_atomic_complete(private, private->commit.state);
 }
 
+static int sti_atomic_check(struct drm_device *dev,
+                            struct drm_atomic_state *state)
+{
+        int ret;
+
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
 static int sti_atomic_commit(struct drm_device *drm,
                              struct drm_atomic_state *state, bool nonblock)
 {
@@ -248,7 +268,7 @@ static void sti_output_poll_changed(struct drm_device *ddev)
 static const struct drm_mode_config_funcs sti_mode_config_funcs = {
         .fb_create = drm_fb_cma_create,
         .output_poll_changed = sti_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = sti_atomic_check,
         .atomic_commit = sti_atomic_commit,
 };
 
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 29f0207fa677..873f010d9616 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -98,17 +98,23 @@ success:
 static int udl_select_std_channel(struct udl_device *udl)
 {
         int ret;
-        u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
-                            0x1C, 0x88, 0x5E, 0x15,
-                            0x60, 0xFE, 0xC6, 0x97,
-                            0x16, 0x3D, 0x47, 0xF2};
+        static const u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
+                                         0x1C, 0x88, 0x5E, 0x15,
+                                         0x60, 0xFE, 0xC6, 0x97,
+                                         0x16, 0x3D, 0x47, 0xF2};
+        void *sendbuf;
+
+        sendbuf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
+        if (!sendbuf)
+                return -ENOMEM;
 
         ret = usb_control_msg(udl->udev,
                               usb_sndctrlpipe(udl->udev, 0),
                               NR_USB_REQUEST_CHANNEL,
                               (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
-                              set_def_chn, sizeof(set_def_chn),
+                              sendbuf, sizeof(set_def_chn),
                               USB_CTRL_SET_TIMEOUT);
+        kfree(sendbuf);
         return ret < 0 ? ret : 0;
 }
 
diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
index 7cf3678623c3..58048709c34e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_display.c
+++ b/drivers/gpu/drm/virtio/virtgpu_display.c
@@ -338,8 +338,7 @@ static void vgdev_atomic_commit_tail(struct drm_atomic_state *state)
 
         drm_atomic_helper_commit_modeset_disables(dev, state);
         drm_atomic_helper_commit_modeset_enables(dev, state);
-        drm_atomic_helper_commit_planes(dev, state,
-                                        DRM_PLANE_COMMIT_ACTIVE_ONLY);
+        drm_atomic_helper_commit_planes(dev, state, 0);
 
         drm_atomic_helper_commit_hw_done(state);
 
diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
index 2ba7d437a2af..805b6fa7b5f4 100644
--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
@@ -1617,7 +1617,7 @@ ipu_image_convert(struct ipu_soc *ipu, enum ipu_ic_task ic_task,
         ctx = ipu_image_convert_prepare(ipu, ic_task, in, out, rot_mode,
                                         complete, complete_context);
         if (IS_ERR(ctx))
-                return ERR_PTR(PTR_ERR(ctx));
+                return ERR_CAST(ctx);
 
         run = kzalloc(sizeof(*run), GFP_KERNEL);
         if (!run) {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 6cfb5cacc253..575aa65436d1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -179,6 +179,7 @@
 #define USB_DEVICE_ID_ATEN_4PORTKVM     0x2205
 #define USB_DEVICE_ID_ATEN_4PORTKVMC    0x2208
 #define USB_DEVICE_ID_ATEN_CS682        0x2213
+#define USB_DEVICE_ID_ATEN_CS692        0x8021
 
 #define USB_VENDOR_ID_ATMEL             0x03eb
 #define USB_DEVICE_ID_ATMEL_MULTITOUCH  0x211c
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 5614fee82347..3a84aaf1418b 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -292,11 +292,11 @@ static ssize_t show_value(struct device *dev, struct device_attribute *attr,
         bool input = false;
         int value = 0;
 
-        if (sscanf(attr->attr.name, "feature-%d-%x-%s", &index, &usage,
+        if (sscanf(attr->attr.name, "feature-%x-%x-%s", &index, &usage,
                    name) == 3) {
                 feature = true;
                 field_index = index + sensor_inst->input_field_count;
-        } else if (sscanf(attr->attr.name, "input-%d-%x-%s", &index, &usage,
+        } else if (sscanf(attr->attr.name, "input-%x-%x-%s", &index, &usage,
                    name) == 3) {
                 input = true;
                 field_index = index;
@@ -398,7 +398,7 @@ static ssize_t store_value(struct device *dev, struct device_attribute *attr,
         char name[HID_CUSTOM_NAME_LENGTH];
         int value;
 
-        if (sscanf(attr->attr.name, "feature-%d-%x-%s", &index, &usage,
+        if (sscanf(attr->attr.name, "feature-%x-%x-%s", &index, &usage,
                    name) == 3) {
                 field_index = index + sensor_inst->input_field_count;
         } else
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 658a607dc6d9..c5c3d6111729 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -251,6 +251,9 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
         struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
         int report_size;
         int ret = 0;
+        u8 *val_ptr;
+        int buffer_index = 0;
+        int i;
 
         mutex_lock(&data->mutex);
         report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
@@ -271,7 +274,17 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
                 goto done_proc;
         }
         ret = min(report_size, buffer_size);
-        memcpy(buffer, report->field[field_index]->value, ret);
+
+        val_ptr = (u8 *)report->field[field_index]->value;
+        for (i = 0; i < report->field[field_index]->report_count; ++i) {
+                if (buffer_index >= ret)
+                        break;
+
+                memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
+                       report->field[field_index]->report_size / 8);
+                val_ptr += sizeof(__s32);
+                buffer_index += (report->field[field_index]->report_size / 8);
+        }
 
 done_proc:
         mutex_unlock(&data->mutex);
diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
index e2517c11e0ee..0c9ac4d5d850 100644
--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -638,6 +638,58 @@ eoi:
 }
 
 /**
+ * ish_disable_dma() - disable dma communication between host and ISHFW
+ * @dev: ishtp device pointer
+ *
+ * Clear the dma enable bit and wait for dma inactive.
+ *
+ * Return: 0 for success else error code.
+ */
+static int ish_disable_dma(struct ishtp_device *dev)
+{
+        unsigned int    dma_delay;
+
+        /* Clear the dma enable bit */
+        ish_reg_write(dev, IPC_REG_ISH_RMP2, 0);
+
+        /* wait for dma inactive */
+        for (dma_delay = 0; dma_delay < MAX_DMA_DELAY &&
+                _ish_read_fw_sts_reg(dev) & (IPC_ISH_IN_DMA);
+                dma_delay += 5)
+                mdelay(5);
+
+        if (dma_delay >= MAX_DMA_DELAY) {
+                dev_err(dev->devc,
+                        "Wait for DMA inactive timeout\n");
+                return  -EBUSY;
+        }
+
+        return 0;
+}
+
+/**
+ * ish_wakeup() - wakeup ishfw from waiting-for-host state
+ * @dev: ishtp device pointer
+ *
+ * Set the dma enable bit and send a void message to FW,
+ * it wil wakeup FW from waiting-for-host state.
+ */
+static void ish_wakeup(struct ishtp_device *dev)
+{
+        /* Set dma enable bit */
+        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
+
+        /*
+         * Send 0 IPC message so that ISH FW wakes up if it was already
+         * asleep.
+         */
+        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
+
+        /* Flush writes to doorbell and REMAP2 */
+        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
+}
+
+/**
  * _ish_hw_reset() - HW reset
  * @dev: ishtp device pointer
  *
@@ -649,7 +701,6 @@ static int _ish_hw_reset(struct ishtp_device *dev)
 {
         struct pci_dev *pdev = dev->pdev;
         int     rv;
-        unsigned int    dma_delay;
         uint16_t csr;
 
         if (!pdev)
@@ -664,15 +715,8 @@ static int _ish_hw_reset(struct ishtp_device *dev)
                 return  -EINVAL;
         }
 
-        /* Now trigger reset to FW */
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, 0);
-
-        for (dma_delay = 0; dma_delay < MAX_DMA_DELAY &&
-                _ish_read_fw_sts_reg(dev) & (IPC_ISH_IN_DMA);
-                dma_delay += 5)
-                mdelay(5);
-
-        if (dma_delay >= MAX_DMA_DELAY) {
+        /* Disable dma communication between FW and host */
+        if (ish_disable_dma(dev)) {
                 dev_err(&pdev->dev,
                         "Can't reset - stuck with DMA in-progress\n");
                 return  -EBUSY;
@@ -690,16 +734,8 @@ static int _ish_hw_reset(struct ishtp_device *dev)
         csr |= PCI_D0;
         pci_write_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, csr);
 
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
-
-        /*
-         * Send 0 IPC message so that ISH FW wakes up if it was already
-         * asleep
-         */
-        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
-
-        /* Flush writes to doorbell and REMAP2 */
-        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
+        /* Now we can enable ISH DMA operation and wakeup ISHFW */
+        ish_wakeup(dev);
 
         return  0;
 }
@@ -758,16 +794,9 @@ static int _ish_ipc_reset(struct ishtp_device *dev)
 int ish_hw_start(struct ishtp_device *dev)
 {
         ish_set_host_rdy(dev);
-        /* After that we can enable ISH DMA operation */
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
 
-        /*
-         * Send 0 IPC message so that ISH FW wakes up if it was already
-         * asleep
-         */
-        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
-        /* Flush write to doorbell */
-        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
+        /* After that we can enable ISH DMA operation and wakeup ISHFW */
+        ish_wakeup(dev);
 
         set_host_ready(dev);
 
@@ -876,6 +905,21 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev)
  */
 void    ish_device_disable(struct ishtp_device *dev)
 {
+        struct pci_dev *pdev = dev->pdev;
+
+        if (!pdev)
+                return;
+
+        /* Disable dma communication between FW and host */
+        if (ish_disable_dma(dev)) {
+                dev_err(&pdev->dev,
+                        "Can't reset - stuck with DMA in-progress\n");
+                return;
+        }
+
+        /* Put ISH to D3hot state for power saving */
+        pci_set_power_state(pdev, PCI_D3hot);
+
         dev->dev_state = ISHTP_DEV_DISABLED;
         ish_clr_host_rdy(dev);
 }
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 42f0beeb09fd..20d647d2dd2c 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -146,7 +146,7 @@ static int ish_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pdev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
 
         /* request and enable interrupt */
-        ret = request_irq(pdev->irq, ish_irq_handler, IRQF_NO_SUSPEND,
+        ret = request_irq(pdev->irq, ish_irq_handler, IRQF_SHARED,
                           KBUILD_MODNAME, dev);
         if (ret) {
                 dev_err(&pdev->dev, "ISH: request IRQ failure (%d)\n",
@@ -202,6 +202,7 @@ static void ish_remove(struct pci_dev *pdev)
         kfree(ishtp_dev);
 }
 
+#ifdef CONFIG_PM
 static struct device *ish_resume_device;
 
 /**
@@ -293,7 +294,6 @@ static int ish_resume(struct device *device)
         return 0;
 }
 
-#ifdef CONFIG_PM
 static const struct dev_pm_ops ish_pm_ops = {
         .suspend = ish_suspend,
         .resume = ish_resume,
@@ -301,7 +301,7 @@ static const struct dev_pm_ops ish_pm_ops = {
 #define ISHTP_ISH_PM_OPS        (&ish_pm_ops)
 #else
 #define ISHTP_ISH_PM_OPS        NULL
-#endif
+#endif /* CONFIG_PM */
 
 static struct pci_driver ish_driver = {
         .name = KBUILD_MODNAME,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 354d49ea36dd..e6cfd323babc 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -63,6 +63,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index a259e18d22d5..0276d2ef06ee 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -961,7 +961,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 {
         int ret = 0;
 
-        dev_set_name(&child_device_obj->device, "vmbus-%pUl",
+        dev_set_name(&child_device_obj->device, "%pUl",
                      child_device_obj->channel->offermsg.offer.if_instance.b);
 
         child_device_obj->device.bus = &hv_bus;
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index adae6848ffb2..a74c075a30ec 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -536,8 +536,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
 
                 hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups),
                                              GFP_KERNEL);
-                if (!hwdev->groups)
-                        return ERR_PTR(-ENOMEM);
+                if (!hwdev->groups) {
+                        err = -ENOMEM;
+                        goto free_hwmon;
+                }
 
                 attrs = __hwmon_create_attrs(dev, drvdata, chip);
                 if (IS_ERR(attrs)) {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 1704fc84d647..b432b64e307a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -2179,6 +2179,7 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
         /* add the driver to the list of i2c drivers in the driver core */
         driver->driver.owner = owner;
         driver->driver.bus = &i2c_bus_type;
+        INIT_LIST_HEAD(&driver->clients);
 
         /* When registration returns, the driver core
          * will have called probe() for all matching-but-unbound devices.
@@ -2189,7 +2190,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
 
         pr_debug("driver [%s] registered\n", driver->driver.name);
 
-        INIT_LIST_HEAD(&driver->clients);
         /* Walk the adapters that are already present */
         i2c_for_each_dev(driver, __process_new_driver);
 
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index da3fb069ec5c..ce69048c88e9 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -743,8 +743,8 @@ static int st_accel_read_raw(struct iio_dev *indio_dev,
 
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_SCALE:
-                *val = 0;
-                *val2 = adata->current_fullscale->gain;
+                *val = adata->current_fullscale->gain / 1000000;
+                *val2 = adata->current_fullscale->gain % 1000000;
                 return IIO_VAL_INT_PLUS_MICRO;
         case IIO_CHAN_INFO_SAMP_FREQ:
                 *val = adata->odr;
@@ -763,9 +763,13 @@ static int st_accel_write_raw(struct iio_dev *indio_dev,
         int err;
 
         switch (mask) {
-        case IIO_CHAN_INFO_SCALE:
-                err = st_sensors_set_fullscale_by_gain(indio_dev, val2);
+        case IIO_CHAN_INFO_SCALE: {
+                int gain;
+
+                gain = val * 1000000 + val2;
+                err = st_sensors_set_fullscale_by_gain(indio_dev, gain);
                 break;
+        }
         case IIO_CHAN_INFO_SAMP_FREQ:
                 if (val2)
                         return -EINVAL;
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index dc33c1dd5191..b5beea53d6f6 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -30,26 +30,26 @@ static struct {
         u32 usage_id;
         int unit; /* 0 for default others from HID sensor spec */
         int scale_val0; /* scale, whole number */
-        int scale_val1; /* scale, fraction in micros */
+        int scale_val1; /* scale, fraction in nanos */
 } unit_conversion[] = {
-        {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650},
+        {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650000},
         {HID_USAGE_SENSOR_ACCEL_3D,
                 HID_USAGE_SENSOR_UNITS_METERS_PER_SEC_SQRD, 1, 0},
         {HID_USAGE_SENSOR_ACCEL_3D,
-                HID_USAGE_SENSOR_UNITS_G, 9, 806650},
+                HID_USAGE_SENSOR_UNITS_G, 9, 806650000},
 
-        {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453},
+        {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453293},
         {HID_USAGE_SENSOR_GYRO_3D,
                 HID_USAGE_SENSOR_UNITS_RADIANS_PER_SECOND, 1, 0},
         {HID_USAGE_SENSOR_GYRO_3D,
-                HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453},
+                HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453293},
 
-        {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000},
+        {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000000},
         {HID_USAGE_SENSOR_COMPASS_3D, HID_USAGE_SENSOR_UNITS_GAUSS, 1, 0},
 
-        {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453},
+        {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453293},
         {HID_USAGE_SENSOR_INCLINOMETER_3D,
-                HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453},
+                HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453293},
         {HID_USAGE_SENSOR_INCLINOMETER_3D,
                 HID_USAGE_SENSOR_UNITS_RADIANS, 1, 0},
 
@@ -57,7 +57,7 @@ static struct {
         {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
 
         {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000000},
 };
 
 static int pow_10(unsigned power)
@@ -266,15 +266,15 @@ EXPORT_SYMBOL(hid_sensor_write_raw_hyst_value);
 /*
  * This fuction applies the unit exponent to the scale.
  * For example:
- * 9.806650 ->exp:2-> val0[980]val1[665000]
- * 9.000806 ->exp:2-> val0[900]val1[80600]
- * 0.174535 ->exp:2-> val0[17]val1[453500]
- * 1.001745 ->exp:0-> val0[1]val1[1745]
- * 1.001745 ->exp:2-> val0[100]val1[174500]
- * 1.001745 ->exp:4-> val0[10017]val1[450000]
- * 9.806650 ->exp:-2-> val0[0]val1[98066]
+ * 9.806650000 ->exp:2-> val0[980]val1[665000000]
+ * 9.000806000 ->exp:2-> val0[900]val1[80600000]
+ * 0.174535293 ->exp:2-> val0[17]val1[453529300]
+ * 1.001745329 ->exp:0-> val0[1]val1[1745329]
+ * 1.001745329 ->exp:2-> val0[100]val1[174532900]
+ * 1.001745329 ->exp:4-> val0[10017]val1[453290000]
+ * 9.806650000 ->exp:-2-> val0[0]val1[98066500]
  */
-static void adjust_exponent_micro(int *val0, int *val1, int scale0,
+static void adjust_exponent_nano(int *val0, int *val1, int scale0,
                                   int scale1, int exp)
 {
         int i;
@@ -285,32 +285,32 @@ static void adjust_exponent_micro(int *val0, int *val1, int scale0,
         if (exp > 0) {
                 *val0 = scale0 * pow_10(exp);
                 res = 0;
-                if (exp > 6) {
+                if (exp > 9) {
                         *val1 = 0;
                         return;
                 }
                 for (i = 0; i < exp; ++i) {
-                        x = scale1 / pow_10(5 - i);
+                        x = scale1 / pow_10(8 - i);
                         res += (pow_10(exp - 1 - i) * x);
-                        scale1 = scale1 % pow_10(5 - i);
+                        scale1 = scale1 % pow_10(8 - i);
                 }
                 *val0 += res;
                         *val1 = scale1 * pow_10(exp);
         } else if (exp < 0) {
                 exp = abs(exp);
-                if (exp > 6) {
+                if (exp > 9) {
                         *val0 = *val1 = 0;
                         return;
                 }
                 *val0 = scale0 / pow_10(exp);
                 rem = scale0 % pow_10(exp);
                 res = 0;
-                for (i = 0; i < (6 - exp); ++i) {
-                        x = scale1 / pow_10(5 - i);
-                        res += (pow_10(5 - exp - i) * x);
-                        scale1 = scale1 % pow_10(5 - i);
+                for (i = 0; i < (9 - exp); ++i) {
+                        x = scale1 / pow_10(8 - i);
+                        res += (pow_10(8 - exp - i) * x);
+                        scale1 = scale1 % pow_10(8 - i);
                 }
-                *val1 = rem * pow_10(6 - exp) + res;
+                *val1 = rem * pow_10(9 - exp) + res;
         } else {
                 *val0 = scale0;
                 *val1 = scale1;
@@ -332,14 +332,14 @@ int hid_sensor_format_scale(u32 usage_id,
                         unit_conversion[i].unit == attr_info->units) {
                         exp  = hid_sensor_convert_exponent(
                                                 attr_info->unit_expo);
-                        adjust_exponent_micro(val0, val1,
+                        adjust_exponent_nano(val0, val1,
                                         unit_conversion[i].scale_val0,
                                         unit_conversion[i].scale_val1, exp);
                         break;
                 }
         }
 
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT_PLUS_NANO;
 }
 EXPORT_SYMBOL(hid_sensor_format_scale);
 
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 285a64a589d7..975a1f19f747 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -612,7 +612,7 @@ EXPORT_SYMBOL(st_sensors_sysfs_sampling_frequency_avail);
 ssize_t st_sensors_sysfs_scale_avail(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
-        int i, len = 0;
+        int i, len = 0, q, r;
         struct iio_dev *indio_dev = dev_get_drvdata(dev);
         struct st_sensor_data *sdata = iio_priv(indio_dev);
 
@@ -621,8 +621,10 @@ ssize_t st_sensors_sysfs_scale_avail(struct device *dev,
                 if (sdata->sensor_settings->fs.fs_avl[i].num == 0)
                         break;
 
-                len += scnprintf(buf + len, PAGE_SIZE - len, "0.%06u ",
-                                sdata->sensor_settings->fs.fs_avl[i].gain);
+                q = sdata->sensor_settings->fs.fs_avl[i].gain / 1000000;
+                r = sdata->sensor_settings->fs.fs_avl[i].gain % 1000000;
+
+                len += scnprintf(buf + len, PAGE_SIZE - len, "%u.%06u ", q, r);
         }
         mutex_unlock(&indio_dev->mlock);
         buf[len - 1] = '\n';
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index b98b9d94d184..a97e802ca523 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -335,6 +335,7 @@ static struct platform_driver hid_dev_rot_platform_driver = {
         .id_table = hid_dev_rot_ids,
         .driver = {
                 .name   = KBUILD_MODNAME,
+                .pm     = &hid_sensor_pm_ops,
         },
         .probe          = hid_dev_rot_probe,
         .remove         = hid_dev_rot_remove,
diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index 066161a4bccd..f962f31a5eb2 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -136,6 +136,8 @@ static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
                 ret = spi_read(data->spi, (void *)&buf32, storage_bytes);
                 *val = be32_to_cpu(buf32);
                 break;
+        default:
+                ret = -EINVAL;
         }
 
         if (ret)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 36bf50ebb187..89a6b0546804 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1094,47 +1094,47 @@ static void cma_save_ib_info(struct sockaddr *src_addr,
         }
 }
 
-static void cma_save_ip4_info(struct sockaddr *src_addr,
-                              struct sockaddr *dst_addr,
+static void cma_save_ip4_info(struct sockaddr_in *src_addr,
+                              struct sockaddr_in *dst_addr,
                               struct cma_hdr *hdr,
                               __be16 local_port)
 {
-        struct sockaddr_in *ip4;
-
         if (src_addr) {
-                ip4 = (struct sockaddr_in *)src_addr;
-                ip4->sin_family = AF_INET;
-                ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr;
-                ip4->sin_port = local_port;
+                *src_addr = (struct sockaddr_in) {
+                        .sin_family = AF_INET,
+                        .sin_addr.s_addr = hdr->dst_addr.ip4.addr,
+                        .sin_port = local_port,
+                };
         }
 
         if (dst_addr) {
-                ip4 = (struct sockaddr_in *)dst_addr;
-                ip4->sin_family = AF_INET;
-                ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr;
-                ip4->sin_port = hdr->port;
+                *dst_addr = (struct sockaddr_in) {
+                        .sin_family = AF_INET,
+                        .sin_addr.s_addr = hdr->src_addr.ip4.addr,
+                        .sin_port = hdr->port,
+                };
         }
 }
 
-static void cma_save_ip6_info(struct sockaddr *src_addr,
-                              struct sockaddr *dst_addr,
+static void cma_save_ip6_info(struct sockaddr_in6 *src_addr,
+                              struct sockaddr_in6 *dst_addr,
                               struct cma_hdr *hdr,
                               __be16 local_port)
 {
-        struct sockaddr_in6 *ip6;
-
         if (src_addr) {
-                ip6 = (struct sockaddr_in6 *)src_addr;
-                ip6->sin6_family = AF_INET6;
-                ip6->sin6_addr = hdr->dst_addr.ip6;
-                ip6->sin6_port = local_port;
+                *src_addr = (struct sockaddr_in6) {
+                        .sin6_family = AF_INET6,
+                        .sin6_addr = hdr->dst_addr.ip6,
+                        .sin6_port = local_port,
+                };
         }
 
         if (dst_addr) {
-                ip6 = (struct sockaddr_in6 *)dst_addr;
-                ip6->sin6_family = AF_INET6;
-                ip6->sin6_addr = hdr->src_addr.ip6;
-                ip6->sin6_port = hdr->port;
+                *dst_addr = (struct sockaddr_in6) {
+                        .sin6_family = AF_INET6,
+                        .sin6_addr = hdr->src_addr.ip6,
+                        .sin6_port = hdr->port,
+                };
         }
 }
 
@@ -1159,10 +1159,12 @@ static int cma_save_ip_info(struct sockaddr *src_addr,
 
         switch (cma_get_ip_ver(hdr)) {
         case 4:
-                cma_save_ip4_info(src_addr, dst_addr, hdr, port);
+                cma_save_ip4_info((struct sockaddr_in *)src_addr,
+                                  (struct sockaddr_in *)dst_addr, hdr, port);
                 break;
         case 6:
-                cma_save_ip6_info(src_addr, dst_addr, hdr, port);
+                cma_save_ip6_info((struct sockaddr_in6 *)src_addr,
+                                  (struct sockaddr_in6 *)dst_addr, hdr, port);
                 break;
         default:
                 return -EAFNOSUPPORT;
diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
index 54eceb30ede5..a7d39689bbfb 100644
--- a/drivers/input/mouse/focaltech.c
+++ b/drivers/input/mouse/focaltech.c
@@ -43,7 +43,7 @@ int focaltech_detect(struct psmouse *psmouse, bool set_properties)
 
         if (set_properties) {
                 psmouse->vendor = "FocalTech";
-                psmouse->name = "FocalTech Touchpad";
+                psmouse->name = "Touchpad";
         }
 
         return 0;
@@ -146,8 +146,8 @@ static void focaltech_report_state(struct psmouse *psmouse)
         }
         input_mt_report_pointer_emulation(dev, true);
 
-        input_report_key(psmouse->dev, BTN_LEFT, state->pressed);
-        input_sync(psmouse->dev);
+        input_report_key(dev, BTN_LEFT, state->pressed);
+        input_sync(dev);
 }
 
 static void focaltech_process_touch_packet(struct psmouse *psmouse,
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index f4bfb4b2d50a..073246c7d163 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -877,6 +877,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
                 },
         },
+        {
+                /* Schenker XMG C504 - Elantech touchpad */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 15c01c3cd540..e6f9b2d745ca 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -2636,17 +2636,26 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
         /* And we're up. Go go go! */
         of_iommu_set_ops(dev->of_node, &arm_smmu_ops);
 #ifdef CONFIG_PCI
-        pci_request_acs();
-        ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
-        if (ret)
-                return ret;
+        if (pci_bus_type.iommu_ops != &arm_smmu_ops) {
+                pci_request_acs();
+                ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
 #endif
 #ifdef CONFIG_ARM_AMBA
-        ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
-        if (ret)
-                return ret;
+        if (amba_bustype.iommu_ops != &arm_smmu_ops) {
+                ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
 #endif
-        return bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+        if (platform_bus_type.iommu_ops != &arm_smmu_ops) {
+                ret = bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
+        return 0;
 }
 
 static int arm_smmu_device_remove(struct platform_device *pdev)
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index c841eb7a1a74..8f7281444551 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -324,8 +324,10 @@ struct arm_smmu_master_cfg {
 #define INVALID_SMENDX                  -1
 #define __fwspec_cfg(fw) ((struct arm_smmu_master_cfg *)fw->iommu_priv)
 #define fwspec_smmu(fw)  (__fwspec_cfg(fw)->smmu)
+#define fwspec_smendx(fw, i) \
+        (i >= fw->num_ids ? INVALID_SMENDX : __fwspec_cfg(fw)->smendx[i])
 #define for_each_cfg_sme(fw, i, idx) \
-        for (i = 0; idx = __fwspec_cfg(fw)->smendx[i], i < fw->num_ids; ++i)
+        for (i = 0; idx = fwspec_smendx(fw, i), i < fw->num_ids; ++i)
 
 struct arm_smmu_device {
         struct device                   *dev;
@@ -1228,6 +1230,16 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                 return -ENXIO;
         }
 
+        /*
+         * FIXME: The arch/arm DMA API code tries to attach devices to its own
+         * domains between of_xlate() and add_device() - we have no way to cope
+         * with that, so until ARM gets converted to rely on groups and default
+         * domains, just say no (but more politely than by dereferencing NULL).
+         * This should be at least a WARN_ON once that's sorted.
+         */
+        if (!fwspec->iommu_priv)
+                return -ENODEV;
+
         smmu = fwspec_smmu(fwspec);
         /* Ensure that the domain is finalised */
         ret = arm_smmu_init_domain_context(domain, smmu);
@@ -1390,7 +1402,7 @@ static int arm_smmu_add_device(struct device *dev)
                 fwspec = dev->iommu_fwspec;
                 if (ret)
                         goto out_free;
-        } else if (fwspec) {
+        } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
                 smmu = arm_smmu_get_by_node(to_of_node(fwspec->iommu_fwnode));
         } else {
                 return -ENODEV;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a4407eabf0e6..3965e73db51c 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1711,6 +1711,7 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
         if (!iommu->domains || !iommu->domain_ids)
                 return;
 
+again:
         spin_lock_irqsave(&device_domain_lock, flags);
         list_for_each_entry_safe(info, tmp, &device_domain_list, global) {
                 struct dmar_domain *domain;
@@ -1723,10 +1724,19 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
 
                 domain = info->domain;
 
-                dmar_remove_one_dev_info(domain, info->dev);
+                __dmar_remove_one_dev_info(info);
 
-                if (!domain_type_is_vm_or_si(domain))
+                if (!domain_type_is_vm_or_si(domain)) {
+                        /*
+                         * The domain_exit() function  can't be called under
+                         * device_domain_lock, as it takes this lock itself.
+                         * So release the lock here and re-run the loop
+                         * afterwards.
+                         */
+                        spin_unlock_irqrestore(&device_domain_lock, flags);
                         domain_exit(domain);
+                        goto again;
+                }
         }
         spin_unlock_irqrestore(&device_domain_lock, flags);
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index eac84d8ff724..2089d46b0eb8 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3887,10 +3887,10 @@ array_state_show(struct mddev *mddev, char *page)
                         st = read_auto;
                         break;
                 case 0:
-                        if (mddev->in_sync)
-                                st = clean;
-                        else if (test_bit(MD_CHANGE_PENDING, &mddev->flags))
+                        if (test_bit(MD_CHANGE_PENDING, &mddev->flags))
                                 st = write_pending;
+                        else if (mddev->in_sync)
+                                st = clean;
                         else if (mddev->safemode)
                                 st = active_idle;
                         else
@@ -8144,14 +8144,14 @@ void md_do_sync(struct md_thread *thread)
 
         if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
             !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
-            mddev->curr_resync > 2) {
+            mddev->curr_resync > 3) {
                 mddev->curr_resync_completed = mddev->curr_resync;
                 sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
         mddev->pers->sync_request(mddev, max_sectors, &skipped);
 
         if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
-            mddev->curr_resync > 2) {
+            mddev->curr_resync > 3) {
                 if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
                         if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
                                 if (mddev->curr_resync >= mddev->recovery_cp) {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 1961d827dbd1..29e2df5cd77b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -403,11 +403,14 @@ static void raid1_end_write_request(struct bio *bio)
         struct bio *to_put = NULL;
         int mirror = find_bio_disk(r1_bio, bio);
         struct md_rdev *rdev = conf->mirrors[mirror].rdev;
+        bool discard_error;
+
+        discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
 
         /*
          * 'one mirror IO has finished' event handler:
          */
-        if (bio->bi_error) {
+        if (bio->bi_error && !discard_error) {
                 set_bit(WriteErrorSeen, &rdev->flags);
                 if (!test_and_set_bit(WantReplacement, &rdev->flags))
                         set_bit(MD_RECOVERY_NEEDED, &
@@ -444,7 +447,7 @@ static void raid1_end_write_request(struct bio *bio)
 
                 /* Maybe we can clear some bad blocks. */
                 if (is_badblock(rdev, r1_bio->sector, r1_bio->sectors,
-                                &first_bad, &bad_sectors)) {
+                                &first_bad, &bad_sectors) && !discard_error) {
                         r1_bio->bios[mirror] = IO_MADE_GOOD;
                         set_bit(R1BIO_MadeGood, &r1_bio->state);
                 }
@@ -2294,17 +2297,23 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
          * This is all done synchronously while the array is
          * frozen
          */
+
+        bio = r1_bio->bios[r1_bio->read_disk];
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r1_bio->bios[r1_bio->read_disk] = NULL;
+
         if (mddev->ro == 0) {
                 freeze_array(conf, 1);
                 fix_read_error(conf, r1_bio->read_disk,
                                r1_bio->sector, r1_bio->sectors);
                 unfreeze_array(conf);
-        } else
-                md_error(mddev, conf->mirrors[r1_bio->read_disk].rdev);
+        } else {
+                r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED;
+        }
+
         rdev_dec_pending(conf->mirrors[r1_bio->read_disk].rdev, conf->mddev);
 
-        bio = r1_bio->bios[r1_bio->read_disk];
-        bdevname(bio->bi_bdev, b);
 read_more:
         disk = read_balance(conf, r1_bio, &max_sectors);
         if (disk == -1) {
@@ -2315,11 +2324,6 @@ read_more:
         } else {
                 const unsigned long do_sync
                         = r1_bio->master_bio->bi_opf & REQ_SYNC;
-                if (bio) {
-                        r1_bio->bios[r1_bio->read_disk] =
-                                mddev->ro ? IO_BLOCKED : NULL;
-                        bio_put(bio);
-                }
                 r1_bio->read_disk = disk;
                 bio = bio_clone_mddev(r1_bio->master_bio, GFP_NOIO, mddev);
                 bio_trim(bio, r1_bio->sector - bio->bi_iter.bi_sector,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index be1a9fca3b2d..39fddda2fef2 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -447,6 +447,9 @@ static void raid10_end_write_request(struct bio *bio)
         struct r10conf *conf = r10_bio->mddev->private;
         int slot, repl;
         struct md_rdev *rdev = NULL;
+        bool discard_error;
+
+        discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
 
         dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
 
@@ -460,7 +463,7 @@ static void raid10_end_write_request(struct bio *bio)
         /*
          * this branch is our 'one mirror IO has finished' event handler:
          */
-        if (bio->bi_error) {
+        if (bio->bi_error && !discard_error) {
                 if (repl)
                         /* Never record new bad blocks to replacement,
                          * just fail it.
@@ -503,7 +506,7 @@ static void raid10_end_write_request(struct bio *bio)
                 if (is_badblock(rdev,
                                 r10_bio->devs[slot].addr,
                                 r10_bio->sectors,
-                                &first_bad, &bad_sectors)) {
+                                &first_bad, &bad_sectors) && !discard_error) {
                         bio_put(bio);
                         if (repl)
                                 r10_bio->devs[slot].repl_bio = IO_MADE_GOOD;
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 1b1ab4a1d132..a227a9f3ee65 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1087,7 +1087,7 @@ static int r5l_recovery_log(struct r5l_log *log)
          * 1's seq + 10 and let superblock points to meta2. The same recovery will
          * not think meta 3 is a valid meta, because its seq doesn't match
          */
-        if (ctx.seq > log->last_cp_seq + 1) {
+        if (ctx.seq > log->last_cp_seq) {
                 int ret;
 
                 ret = r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq + 10);
@@ -1096,6 +1096,8 @@ static int r5l_recovery_log(struct r5l_log *log)
                 log->seq = ctx.seq + 11;
                 log->log_start = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
                 r5l_write_super(log, ctx.pos);
+                log->last_checkpoint = ctx.pos;
+                log->next_checkpoint = ctx.pos;
         } else {
                 log->log_start = ctx.pos;
                 log->seq = ctx.seq;
@@ -1154,6 +1156,7 @@ create:
         if (create_super) {
                 log->last_cp_seq = prandom_u32();
                 cp = 0;
+                r5l_log_write_empty_meta_block(log, cp, log->last_cp_seq);
                 /*
                  * Make sure super points to correct address. Log might have
                  * data very soon. If super hasn't correct log tail address,
@@ -1168,6 +1171,7 @@ create:
         if (log->max_free_space > RECLAIM_MAX_FREE_SPACE)
                 log->max_free_space = RECLAIM_MAX_FREE_SPACE;
         log->last_checkpoint = cp;
+        log->next_checkpoint = cp;
 
         __free_page(page);
 
diff --git a/drivers/media/dvb-frontends/Kconfig b/drivers/media/dvb-frontends/Kconfig
index 012225587c25..b71b747ee0ba 100644
--- a/drivers/media/dvb-frontends/Kconfig
+++ b/drivers/media/dvb-frontends/Kconfig
@@ -513,6 +513,11 @@ config DVB_AS102_FE
         depends on DVB_CORE
         default DVB_AS102
 
+config DVB_GP8PSK_FE
+        tristate
+        depends on DVB_CORE
+        default DVB_USB_GP8PSK
+
 comment "DVB-C (cable) frontends"
         depends on DVB_CORE
 
diff --git a/drivers/media/dvb-frontends/Makefile b/drivers/media/dvb-frontends/Makefile
index e90165ad361b..93921a4eaa27 100644
--- a/drivers/media/dvb-frontends/Makefile
+++ b/drivers/media/dvb-frontends/Makefile
@@ -121,6 +121,7 @@ obj-$(CONFIG_DVB_RTL2832_SDR) += rtl2832_sdr.o
 obj-$(CONFIG_DVB_M88RS2000) += m88rs2000.o
 obj-$(CONFIG_DVB_AF9033) += af9033.o
 obj-$(CONFIG_DVB_AS102_FE) += as102_fe.o
+obj-$(CONFIG_DVB_GP8PSK_FE) += gp8psk-fe.o
 obj-$(CONFIG_DVB_TC90522) += tc90522.o
 obj-$(CONFIG_DVB_HORUS3A) += horus3a.o
 obj-$(CONFIG_DVB_ASCOT2E) += ascot2e.o
diff --git a/drivers/media/usb/dvb-usb/gp8psk-fe.c b/drivers/media/dvb-frontends/gp8psk-fe.c
index db6eb79cde07..93f59bfea092 100644
--- a/drivers/media/usb/dvb-usb/gp8psk-fe.c
+++ b/drivers/media/dvb-frontends/gp8psk-fe.c
@@ -1,5 +1,5 @@
-/* DVB USB compliant Linux driver for the
- *  - GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
+/*
+ * Frontend driver for the GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
  *
  * Copyright (C) 2006,2007 Alan Nisota (alannisota@gmail.com)
  * Copyright (C) 2006,2007 Genpix Electronics (genpix@genpix-electronics.com)
@@ -8,17 +8,31 @@
  *
  * This module is based off the vp7045 and vp702x modules
  *
- *      This program is free software; you can redistribute it and/or modify it
- *      under the terms of the GNU General Public License as published by the Free
- *      Software Foundation, version 2.
- *
- * see Documentation/dvb/README.dvb-usb for more information
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 2.
  */
-#include "gp8psk.h"
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "gp8psk-fe.h"
+#include "dvb_frontend.h"
+
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+
+#define dprintk(fmt, arg...) do {                                       \
+        if (debug)                                                      \
+                printk(KERN_DEBUG pr_fmt("%s: " fmt),                   \
+                       __func__, ##arg);                                \
+} while (0)
 
 struct gp8psk_fe_state {
         struct dvb_frontend fe;
-        struct dvb_usb_device *d;
+        void *priv;
+        const struct gp8psk_fe_ops *ops;
+        bool is_rev1;
         u8 lock;
         u16 snr;
         unsigned long next_status_check;
@@ -29,22 +43,24 @@ static int gp8psk_tuned_to_DCII(struct dvb_frontend *fe)
 {
         struct gp8psk_fe_state *st = fe->demodulator_priv;
         u8 status;
-        gp8psk_usb_in_op(st->d, GET_8PSK_CONFIG, 0, 0, &status, 1);
+
+        st->ops->in(st->priv, GET_8PSK_CONFIG, 0, 0, &status, 1);
         return status & bmDCtuned;
 }
 
 static int gp8psk_set_tuner_mode(struct dvb_frontend *fe, int mode)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
-        return gp8psk_usb_out_op(state->d, SET_8PSK_CONFIG, mode, 0, NULL, 0);
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
+
+        return st->ops->out(st->priv, SET_8PSK_CONFIG, mode, 0, NULL, 0);
 }
 
 static int gp8psk_fe_update_status(struct gp8psk_fe_state *st)
 {
         u8 buf[6];
         if (time_after(jiffies,st->next_status_check)) {
-                gp8psk_usb_in_op(st->d, GET_SIGNAL_LOCK, 0,0,&st->lock,1);
-                gp8psk_usb_in_op(st->d, GET_SIGNAL_STRENGTH, 0,0,buf,6);
+                st->ops->in(st->priv, GET_SIGNAL_LOCK, 0, 0, &st->lock, 1);
+                st->ops->in(st->priv, GET_SIGNAL_STRENGTH, 0, 0, buf, 6);
                 st->snr = (buf[1]) << 8 | buf[0];
                 st->next_status_check = jiffies + (st->status_check_interval*HZ)/1000;
         }
@@ -116,13 +132,12 @@ static int gp8psk_fe_get_tune_settings(struct dvb_frontend* fe, struct dvb_front
 
 static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
         struct dtv_frontend_properties *c = &fe->dtv_property_cache;
         u8 cmd[10];
         u32 freq = c->frequency * 1000;
-        int gp_product_id = le16_to_cpu(state->d->udev->descriptor.idProduct);
 
-        deb_fe("%s()\n", __func__);
+        dprintk("%s()\n", __func__);
 
         cmd[4] = freq         & 0xff;
         cmd[5] = (freq >> 8)  & 0xff;
@@ -136,21 +151,21 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
         switch (c->delivery_system) {
         case SYS_DVBS:
                 if (c->modulation != QPSK) {
-                        deb_fe("%s: unsupported modulation selected (%d)\n",
+                        dprintk("%s: unsupported modulation selected (%d)\n",
                                 __func__, c->modulation);
                         return -EOPNOTSUPP;
                 }
                 c->fec_inner = FEC_AUTO;
                 break;
         case SYS_DVBS2: /* kept for backwards compatibility */
-                deb_fe("%s: DVB-S2 delivery system selected\n", __func__);
+                dprintk("%s: DVB-S2 delivery system selected\n", __func__);
                 break;
         case SYS_TURBO:
-                deb_fe("%s: Turbo-FEC delivery system selected\n", __func__);
+                dprintk("%s: Turbo-FEC delivery system selected\n", __func__);
                 break;
 
         default:
-                deb_fe("%s: unsupported delivery system selected (%d)\n",
+                dprintk("%s: unsupported delivery system selected (%d)\n",
                         __func__, c->delivery_system);
                 return -EOPNOTSUPP;
         }
@@ -161,9 +176,9 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
         cmd[3] = (c->symbol_rate >> 24) & 0xff;
         switch (c->modulation) {
         case QPSK:
-                if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
+                if (st->is_rev1)
                         if (gp8psk_tuned_to_DCII(fe))
-                                gp8psk_bcm4500_reload(state->d);
+                                st->ops->reload(st->priv);
                 switch (c->fec_inner) {
                 case FEC_1_2:
                         cmd[9] = 0; break;
@@ -207,18 +222,18 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
                 cmd[9] = 0;
                 break;
         default: /* Unknown modulation */
-                deb_fe("%s: unsupported modulation selected (%d)\n",
+                dprintk("%s: unsupported modulation selected (%d)\n",
                         __func__, c->modulation);
                 return -EOPNOTSUPP;
         }
 
-        if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
+        if (st->is_rev1)
                 gp8psk_set_tuner_mode(fe, 0);
-        gp8psk_usb_out_op(state->d, TUNE_8PSK, 0, 0, cmd, 10);
+        st->ops->out(st->priv, TUNE_8PSK, 0, 0, cmd, 10);
 
-        state->lock = 0;
-        state->next_status_check = jiffies;
-        state->status_check_interval = 200;
+        st->lock = 0;
+        st->next_status_check = jiffies;
+        st->status_check_interval = 200;
 
         return 0;
 }
@@ -228,9 +243,9 @@ static int gp8psk_fe_send_diseqc_msg (struct dvb_frontend* fe,
 {
         struct gp8psk_fe_state *st = fe->demodulator_priv;
 
-        deb_fe("%s\n",__func__);
+        dprintk("%s\n", __func__);
 
-        if (gp8psk_usb_out_op(st->d,SEND_DISEQC_COMMAND, m->msg[0], 0,
+        if (st->ops->out(st->priv, SEND_DISEQC_COMMAND, m->msg[0], 0,
                         m->msg, m->msg_len)) {
                 return -EINVAL;
         }
@@ -243,12 +258,12 @@ static int gp8psk_fe_send_diseqc_burst(struct dvb_frontend *fe,
         struct gp8psk_fe_state *st = fe->demodulator_priv;
         u8 cmd;
 
-        deb_fe("%s\n",__func__);
+        dprintk("%s\n", __func__);
 
         /* These commands are certainly wrong */
         cmd = (burst == SEC_MINI_A) ? 0x00 : 0x01;
 
-        if (gp8psk_usb_out_op(st->d,SEND_DISEQC_COMMAND, cmd, 0,
+        if (st->ops->out(st->priv, SEND_DISEQC_COMMAND, cmd, 0,
                         &cmd, 0)) {
                 return -EINVAL;
         }
@@ -258,10 +273,10 @@ static int gp8psk_fe_send_diseqc_burst(struct dvb_frontend *fe,
 static int gp8psk_fe_set_tone(struct dvb_frontend *fe,
                               enum fe_sec_tone_mode tone)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
 
-        if (gp8psk_usb_out_op(state->d,SET_22KHZ_TONE,
-                 (tone == SEC_TONE_ON), 0, NULL, 0)) {
+        if (st->ops->out(st->priv, SET_22KHZ_TONE,
+                         (tone == SEC_TONE_ON), 0, NULL, 0)) {
                 return -EINVAL;
         }
         return 0;
@@ -270,9 +285,9 @@ static int gp8psk_fe_set_tone(struct dvb_frontend *fe,
 static int gp8psk_fe_set_voltage(struct dvb_frontend *fe,
                                  enum fe_sec_voltage voltage)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
 
-        if (gp8psk_usb_out_op(state->d,SET_LNB_VOLTAGE,
+        if (st->ops->out(st->priv, SET_LNB_VOLTAGE,
                          voltage == SEC_VOLTAGE_18, 0, NULL, 0)) {
                 return -EINVAL;
         }
@@ -281,52 +296,60 @@ static int gp8psk_fe_set_voltage(struct dvb_frontend *fe,
 
 static int gp8psk_fe_enable_high_lnb_voltage(struct dvb_frontend* fe, long onoff)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
-        return gp8psk_usb_out_op(state->d, USE_EXTRA_VOLT, onoff, 0,NULL,0);
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
+
+        return st->ops->out(st->priv, USE_EXTRA_VOLT, onoff, 0, NULL, 0);
 }
 
 static int gp8psk_fe_send_legacy_dish_cmd (struct dvb_frontend* fe, unsigned long sw_cmd)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
         u8 cmd = sw_cmd & 0x7f;
 
-        if (gp8psk_usb_out_op(state->d,SET_DN_SWITCH, cmd, 0,
-                        NULL, 0)) {
+        if (st->ops->out(st->priv, SET_DN_SWITCH, cmd, 0, NULL, 0))
                 return -EINVAL;
-        }
-        if (gp8psk_usb_out_op(state->d,SET_LNB_VOLTAGE, !!(sw_cmd & 0x80),
-                        0, NULL, 0)) {
+
+        if (st->ops->out(st->priv, SET_LNB_VOLTAGE, !!(sw_cmd & 0x80),
+                        0, NULL, 0))
                 return -EINVAL;
-        }
 
         return 0;
 }
 
 static void gp8psk_fe_release(struct dvb_frontend* fe)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
-        kfree(state);
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
+
+        kfree(st);
 }
 
 static struct dvb_frontend_ops gp8psk_fe_ops;
 
-struct dvb_frontend * gp8psk_fe_attach(struct dvb_usb_device *d)
+struct dvb_frontend *gp8psk_fe_attach(const struct gp8psk_fe_ops *ops,
+                                      void *priv, bool is_rev1)
 {
-        struct gp8psk_fe_state *s = kzalloc(sizeof(struct gp8psk_fe_state), GFP_KERNEL);
-        if (s == NULL)
-                goto error;
-
-        s->d = d;
-        memcpy(&s->fe.ops, &gp8psk_fe_ops, sizeof(struct dvb_frontend_ops));
-        s->fe.demodulator_priv = s;
-
-        goto success;
-error:
-        return NULL;
-success:
-        return &s->fe;
-}
+        struct gp8psk_fe_state *st;
 
+        if (!ops || !ops->in || !ops->out || !ops->reload) {
+                pr_err("Error! gp8psk-fe ops not defined.\n");
+                return NULL;
+        }
+
+        st = kzalloc(sizeof(struct gp8psk_fe_state), GFP_KERNEL);
+        if (!st)
+                return NULL;
+
+        memcpy(&st->fe.ops, &gp8psk_fe_ops, sizeof(struct dvb_frontend_ops));
+        st->fe.demodulator_priv = st;
+        st->ops = ops;
+        st->priv = priv;
+        st->is_rev1 = is_rev1;
+
+        pr_info("Frontend %sattached\n", is_rev1 ? "revision 1 " : "");
+
+        return &st->fe;
+}
+EXPORT_SYMBOL_GPL(gp8psk_fe_attach);
 
 static struct dvb_frontend_ops gp8psk_fe_ops = {
         .delsys = { SYS_DVBS },
@@ -370,3 +393,8 @@ static struct dvb_frontend_ops gp8psk_fe_ops = {
         .dishnetwork_send_legacy_command = gp8psk_fe_send_legacy_dish_cmd,
         .enable_high_lnb_voltage = gp8psk_fe_enable_high_lnb_voltage
 };
+
+MODULE_AUTHOR("Alan Nisota <alannisota@gamil.com>");
+MODULE_DESCRIPTION("Frontend Driver for Genpix DVB-S");
+MODULE_VERSION("1.1");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb-frontends/gp8psk-fe.h b/drivers/media/dvb-frontends/gp8psk-fe.h
new file mode 100644
index 000000000000..6c7944b1ecd6
--- /dev/null
+++ b/drivers/media/dvb-frontends/gp8psk-fe.h
@@ -0,0 +1,82 @@
+/*
+ * gp8psk_fe driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef GP8PSK_FE_H
+#define GP8PSK_FE_H
+
+#include <linux/types.h>
+
+/* gp8psk commands */
+
+#define GET_8PSK_CONFIG                 0x80    /* in */
+#define SET_8PSK_CONFIG                 0x81
+#define I2C_WRITE                       0x83
+#define I2C_READ                        0x84
+#define ARM_TRANSFER                    0x85
+#define TUNE_8PSK                       0x86
+#define GET_SIGNAL_STRENGTH             0x87    /* in */
+#define LOAD_BCM4500                    0x88
+#define BOOT_8PSK                       0x89    /* in */
+#define START_INTERSIL                  0x8A    /* in */
+#define SET_LNB_VOLTAGE                 0x8B
+#define SET_22KHZ_TONE                  0x8C
+#define SEND_DISEQC_COMMAND             0x8D
+#define SET_DVB_MODE                    0x8E
+#define SET_DN_SWITCH                   0x8F
+#define GET_SIGNAL_LOCK                 0x90    /* in */
+#define GET_FW_VERS                     0x92
+#define GET_SERIAL_NUMBER               0x93    /* in */
+#define USE_EXTRA_VOLT                  0x94
+#define GET_FPGA_VERS                   0x95
+#define CW3K_INIT                       0x9d
+
+/* PSK_configuration bits */
+#define bm8pskStarted                   0x01
+#define bm8pskFW_Loaded                 0x02
+#define bmIntersilOn                    0x04
+#define bmDVBmode                       0x08
+#define bm22kHz                         0x10
+#define bmSEL18V                        0x20
+#define bmDCtuned                       0x40
+#define bmArmed                         0x80
+
+/* Satellite modulation modes */
+#define ADV_MOD_DVB_QPSK 0     /* DVB-S QPSK */
+#define ADV_MOD_TURBO_QPSK 1   /* Turbo QPSK */
+#define ADV_MOD_TURBO_8PSK 2   /* Turbo 8PSK (also used for Trellis 8PSK) */
+#define ADV_MOD_TURBO_16QAM 3  /* Turbo 16QAM (also used for Trellis 8PSK) */
+
+#define ADV_MOD_DCII_C_QPSK 4  /* Digicipher II Combo */
+#define ADV_MOD_DCII_I_QPSK 5  /* Digicipher II I-stream */
+#define ADV_MOD_DCII_Q_QPSK 6  /* Digicipher II Q-stream */
+#define ADV_MOD_DCII_C_OQPSK 7 /* Digicipher II offset QPSK */
+#define ADV_MOD_DSS_QPSK 8     /* DSS (DIRECTV) QPSK */
+#define ADV_MOD_DVB_BPSK 9     /* DVB-S BPSK */
+
+/* firmware revision id's */
+#define GP8PSK_FW_REV1                  0x020604
+#define GP8PSK_FW_REV2                  0x020704
+#define GP8PSK_FW_VERS(_fw_vers) \
+        ((_fw_vers)[2]<<0x10 | (_fw_vers)[1]<<0x08 | (_fw_vers)[0])
+
+struct gp8psk_fe_ops {
+        int (*in)(void *priv, u8 req, u16 value, u16 index, u8 *b, int blen);
+        int (*out)(void *priv, u8 req, u16 value, u16 index, u8 *b, int blen);
+        int (*reload)(void *priv);
+};
+
+struct dvb_frontend *gp8psk_fe_attach(const struct gp8psk_fe_ops *ops,
+                                      void *priv, bool is_rev1);
+
+#endif
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index f95a6bc839d5..cede3975d04b 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -118,7 +118,7 @@ static int get_key_haup_common(struct IR_i2c *ir, enum rc_type *protocol,
                         *protocol = RC_TYPE_RC6_MCE;
                         dev &= 0x7f;
                         dprintk(1, "ir hauppauge (rc6-mce): t%d vendor=%d dev=%d code=%d\n",
-                                                toggle, vendor, dev, code);
+                                                *ptoggle, vendor, dev, code);
                 } else {
                         *ptoggle = 0;
                         *protocol = RC_TYPE_RC6_6A_32;
diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
index d4bdba60b0f7..52bc42da8a4c 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -73,23 +73,34 @@ static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI,
         u8 request_type = (read ? USB_DIR_IN : USB_DIR_OUT) | USB_TYPE_VENDOR;
         u8 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI) |
                 (read ? 0x80 : 0);
+        int ret;
+
+        mutex_lock(&fc_usb->data_mutex);
+        if (!read)
+                memcpy(fc_usb->data, val, sizeof(*val));
 
-        int len = usb_control_msg(fc_usb->udev,
+        ret = usb_control_msg(fc_usb->udev,
                         read ? B2C2_USB_CTRL_PIPE_IN : B2C2_USB_CTRL_PIPE_OUT,
                         request,
                         request_type, /* 0xc0 read or 0x40 write */
                         wAddress,
                         0,
-                        val,
+                        fc_usb->data,
                         sizeof(u32),
                         B2C2_WAIT_FOR_OPERATION_RDW * HZ);
 
-        if (len != sizeof(u32)) {
+        if (ret != sizeof(u32)) {
                 err("error while %s dword from %d (%d).", read ? "reading" :
                                 "writing", wAddress, wRegOffsPCI);
-                return -EIO;
+                if (ret >= 0)
+                        ret = -EIO;
         }
-        return 0;
+
+        if (read && ret >= 0)
+                memcpy(val, fc_usb->data, sizeof(*val));
+        mutex_unlock(&fc_usb->data_mutex);
+
+        return ret;
 }
 /*
  * DKT 010817 - add support for V8 memory read/write and flash update
@@ -100,9 +111,14 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
 {
         u8 request_type = USB_TYPE_VENDOR;
         u16 wIndex;
-        int nWaitTime, pipe, len;
+        int nWaitTime, pipe, ret;
         wIndex = page << 8;
 
+        if (buflen > sizeof(fc_usb->data)) {
+                err("Buffer size bigger than max URB control message\n");
+                return -EIO;
+        }
+
         switch (req) {
         case B2C2_USB_READ_V8_MEM:
                 nWaitTime = B2C2_WAIT_FOR_OPERATION_V8READ;
@@ -127,17 +143,32 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
         deb_v8("v8mem: %02x %02x %04x %04x, len: %d\n", request_type, req,
                         wAddress, wIndex, buflen);
 
-        len = usb_control_msg(fc_usb->udev, pipe,
+        mutex_lock(&fc_usb->data_mutex);
+
+        if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT)
+                memcpy(fc_usb->data, pbBuffer, buflen);
+
+        ret = usb_control_msg(fc_usb->udev, pipe,
                         req,
                         request_type,
                         wAddress,
                         wIndex,
-                        pbBuffer,
+                        fc_usb->data,
                         buflen,
                         nWaitTime * HZ);
+        if (ret != buflen)
+                ret = -EIO;
+
+        if (ret >= 0) {
+                ret = 0;
+                if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
+                        memcpy(pbBuffer, fc_usb->data, buflen);
+        }
 
-        debug_dump(pbBuffer, len, deb_v8);
-        return len == buflen ? 0 : -EIO;
+        mutex_unlock(&fc_usb->data_mutex);
+
+        debug_dump(pbBuffer, ret, deb_v8);
+        return ret;
 }
 
 #define bytes_left_to_read_on_page(paddr,buflen) \
@@ -196,29 +227,6 @@ static int flexcop_usb_get_mac_addr(struct flexcop_device *fc, int extended)
                 fc->dvb_adapter.proposed_mac, 6);
 }
 
-#if 0
-static int flexcop_usb_utility_req(struct flexcop_usb *fc_usb, int set,
-                flexcop_usb_utility_function_t func, u8 extra, u16 wIndex,
-                u16 buflen, u8 *pvBuffer)
-{
-        u16 wValue;
-        u8 request_type = (set ? USB_DIR_OUT : USB_DIR_IN) | USB_TYPE_VENDOR;
-        int nWaitTime = 2,
-            pipe = set ? B2C2_USB_CTRL_PIPE_OUT : B2C2_USB_CTRL_PIPE_IN, len;
-        wValue = (func << 8) | extra;
-
-        len = usb_control_msg(fc_usb->udev,pipe,
-                        B2C2_USB_UTILITY,
-                        request_type,
-                        wValue,
-                        wIndex,
-                        pvBuffer,
-                        buflen,
-                        nWaitTime * HZ);
-        return len == buflen ? 0 : -EIO;
-}
-#endif
-
 /* usb i2c stuff */
 static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
                 flexcop_usb_request_t req, flexcop_usb_i2c_function_t func,
@@ -226,9 +234,14 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
 {
         struct flexcop_usb *fc_usb = i2c->fc->bus_specific;
         u16 wValue, wIndex;
-        int nWaitTime,pipe,len;
+        int nWaitTime, pipe, ret;
         u8 request_type = USB_TYPE_VENDOR;
 
+        if (buflen > sizeof(fc_usb->data)) {
+                err("Buffer size bigger than max URB control message\n");
+                return -EIO;
+        }
+
         switch (func) {
         case USB_FUNC_I2C_WRITE:
         case USB_FUNC_I2C_MULTIWRITE:
@@ -257,15 +270,32 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
                         wValue & 0xff, wValue >> 8,
                         wIndex & 0xff, wIndex >> 8);
 
-        len = usb_control_msg(fc_usb->udev,pipe,
+        mutex_lock(&fc_usb->data_mutex);
+
+        if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT)
+                memcpy(fc_usb->data, buf, buflen);
+
+        ret = usb_control_msg(fc_usb->udev, pipe,
                         req,
                         request_type,
                         wValue,
                         wIndex,
-                        buf,
+                        fc_usb->data,
                         buflen,
                         nWaitTime * HZ);
-        return len == buflen ? 0 : -EREMOTEIO;
+
+        if (ret != buflen)
+                ret = -EIO;
+
+        if (ret >= 0) {
+                ret = 0;
+                if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
+                        memcpy(buf, fc_usb->data, buflen);
+        }
+
+        mutex_unlock(&fc_usb->data_mutex);
+
+        return 0;
 }
 
 /* actual bus specific access functions,
@@ -516,6 +546,7 @@ static int flexcop_usb_probe(struct usb_interface *intf,
         /* general flexcop init */
         fc_usb = fc->bus_specific;
         fc_usb->fc_dev = fc;
+        mutex_init(&fc_usb->data_mutex);
 
         fc->read_ibi_reg  = flexcop_usb_read_ibi_reg;
         fc->write_ibi_reg = flexcop_usb_write_ibi_reg;
diff --git a/drivers/media/usb/b2c2/flexcop-usb.h b/drivers/media/usb/b2c2/flexcop-usb.h
index 92529a9c4475..25ad43166e78 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.h
+++ b/drivers/media/usb/b2c2/flexcop-usb.h
@@ -29,6 +29,10 @@ struct flexcop_usb {
 
         u8 tmp_buffer[1023+190];
         int tmp_buffer_length;
+
+        /* for URB control messages */
+        u8 data[80];
+        struct mutex data_mutex;
 };
 
 #if 0
diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index 13620cdf0599..e9100a235831 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -545,18 +545,30 @@ static void free_sbufs(struct camera_data *cam)
 static int write_packet(struct usb_device *udev,
                         u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
+
         if (!registers || size <= 0)
                 return -EINVAL;
 
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memcpy(buf, registers, size);
+
+        ret = usb_control_msg(udev,
                                usb_sndctrlpipe(udev, 0),
                                request,
                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                                start,   /* value */
                                0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                                size,
                                HZ);
+
+        kfree(buf);
+        return ret;
 }
 
 /****************************************************************************
@@ -567,18 +579,32 @@ static int write_packet(struct usb_device *udev,
 static int read_packet(struct usb_device *udev,
                        u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
+
         if (!registers || size <= 0)
                 return -EINVAL;
 
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(udev,
                                usb_rcvctrlpipe(udev, 0),
                                request,
                                USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE,
                                start,   /* value */
                                0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                                size,
                                HZ);
+
+        if (ret >= 0)
+                memcpy(registers, buf, size);
+
+        kfree(buf);
+
+        return ret;
 }
 
 /******************************************************************************
diff --git a/drivers/media/usb/dvb-usb/Makefile b/drivers/media/usb/dvb-usb/Makefile
index 2a7b5a963acf..3b3f32b426d1 100644
--- a/drivers/media/usb/dvb-usb/Makefile
+++ b/drivers/media/usb/dvb-usb/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_DVB_USB_VP7045) += dvb-usb-vp7045.o
 dvb-usb-vp702x-objs := vp702x.o vp702x-fe.o
 obj-$(CONFIG_DVB_USB_VP702X) += dvb-usb-vp702x.o
 
-dvb-usb-gp8psk-objs := gp8psk.o gp8psk-fe.o
+dvb-usb-gp8psk-objs := gp8psk.o
 obj-$(CONFIG_DVB_USB_GP8PSK) += dvb-usb-gp8psk.o
 
 dvb-usb-dtt200u-objs := dtt200u.o dtt200u-fe.o
diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index efa782ed6e2d..7853261906b1 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -52,17 +52,15 @@ u8 regmask[8] = { 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f, 0xff };
 struct af9005_device_state {
         u8 sequence;
         int led_state;
+        unsigned char data[256];
 };
 
 static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
                               int readwrite, int type, u8 * values, int len)
 {
         struct af9005_device_state *st = d->priv;
-        u8 obuf[16] = { 0 };
-        u8 ibuf[17] = { 0 };
-        u8 command;
-        int i;
-        int ret;
+        u8 command, seq;
+        int i, ret;
 
         if (len < 1) {
                 err("generic read/write, less than 1 byte. Makes no sense.");
@@ -73,16 +71,17 @@ static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
                 return -EINVAL;
         }
 
-        obuf[0] = 14;           /* rest of buffer length low */
-        obuf[1] = 0;            /* rest of buffer length high */
+        mutex_lock(&d->data_mutex);
+        st->data[0] = 14;               /* rest of buffer length low */
+        st->data[1] = 0;                /* rest of buffer length high */
 
-        obuf[2] = AF9005_REGISTER_RW;   /* register operation */
-        obuf[3] = 12;           /* rest of buffer length */
+        st->data[2] = AF9005_REGISTER_RW;       /* register operation */
+        st->data[3] = 12;               /* rest of buffer length */
 
-        obuf[4] = st->sequence++;       /* sequence number */
+        st->data[4] = seq = st->sequence++;     /* sequence number */
 
-        obuf[5] = (u8) (reg >> 8);      /* register address */
-        obuf[6] = (u8) (reg & 0xff);
+        st->data[5] = (u8) (reg >> 8);  /* register address */
+        st->data[6] = (u8) (reg & 0xff);
 
         if (type == AF9005_OFDM_REG) {
                 command = AF9005_CMD_OFDM_REG;
@@ -96,51 +95,52 @@ static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
         command |= readwrite;
         if (readwrite == AF9005_CMD_WRITE)
                 for (i = 0; i < len; i++)
-                        obuf[8 + i] = values[i];
+                        st->data[8 + i] = values[i];
         else if (type == AF9005_TUNER_REG)
                 /* read command for tuner, the first byte contains the i2c address */
-                obuf[8] = values[0];
-        obuf[7] = command;
+                st->data[8] = values[0];
+        st->data[7] = command;
 
-        ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 17, 0);
+        ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 17, 0);
         if (ret)
-                return ret;
+                goto ret;
 
         /* sanity check */
-        if (ibuf[2] != AF9005_REGISTER_RW_ACK) {
+        if (st->data[2] != AF9005_REGISTER_RW_ACK) {
                 err("generic read/write, wrong reply code.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
-        if (ibuf[3] != 0x0d) {
+        if (st->data[3] != 0x0d) {
                 err("generic read/write, wrong length in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
-        if (ibuf[4] != obuf[4]) {
+        if (st->data[4] != seq) {
                 err("generic read/write, wrong sequence in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
         /*
-           Windows driver doesn't check these fields, in fact sometimes
-           the register in the reply is different that what has been sent
-
-           if (ibuf[5] != obuf[5] || ibuf[6] != obuf[6]) {
-           err("generic read/write, wrong register in reply.");
-           return -EIO;
-           }
-           if (ibuf[7] != command) {
-           err("generic read/write wrong command in reply.");
-           return -EIO;
-           }
+         * In thesis, both input and output buffers should have
+         * identical values for st->data[5] to st->data[8].
+         * However, windows driver doesn't check these fields, in fact
+         * sometimes the register in the reply is different that what
+         * has been sent
          */
-        if (ibuf[16] != 0x01) {
+        if (st->data[16] != 0x01) {
                 err("generic read/write wrong status code in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
+
         if (readwrite == AF9005_CMD_READ)
                 for (i = 0; i < len; i++)
-                        values[i] = ibuf[8 + i];
+                        values[i] = st->data[8 + i];
 
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 
 }
 
@@ -464,8 +464,7 @@ int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
         struct af9005_device_state *st = d->priv;
 
         int ret, i, packet_len;
-        u8 buf[64];
-        u8 ibuf[64];
+        u8 seq;
 
         if (wlen < 0) {
                 err("send command, wlen less than 0 bytes. Makes no sense.");
@@ -480,94 +479,97 @@ int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
                 return -EINVAL;
         }
         packet_len = wlen + 5;
-        buf[0] = (u8) (packet_len & 0xff);
-        buf[1] = (u8) ((packet_len & 0xff00) >> 8);
-
-        buf[2] = 0x26;          /* packet type */
-        buf[3] = wlen + 3;
-        buf[4] = st->sequence++;
-        buf[5] = command;
-        buf[6] = wlen;
+
+        mutex_lock(&d->data_mutex);
+
+        st->data[0] = (u8) (packet_len & 0xff);
+        st->data[1] = (u8) ((packet_len & 0xff00) >> 8);
+
+        st->data[2] = 0x26;             /* packet type */
+        st->data[3] = wlen + 3;
+        st->data[4] = seq = st->sequence++;
+        st->data[5] = command;
+        st->data[6] = wlen;
         for (i = 0; i < wlen; i++)
-                buf[7 + i] = wbuf[i];
-        ret = dvb_usb_generic_rw(d, buf, wlen + 7, ibuf, rlen + 7, 0);
-        if (ret)
-                return ret;
-        if (ibuf[2] != 0x27) {
+                st->data[7 + i] = wbuf[i];
+        ret = dvb_usb_generic_rw(d, st->data, wlen + 7, st->data, rlen + 7, 0);
+        if (st->data[2] != 0x27) {
                 err("send command, wrong reply code.");
-                return -EIO;
-        }
-        if (ibuf[4] != buf[4]) {
+                ret = -EIO;
+        } else if (st->data[4] != seq) {
                 err("send command, wrong sequence in reply.");
-                return -EIO;
-        }
-        if (ibuf[5] != 0x01) {
+                ret = -EIO;
+        } else if (st->data[5] != 0x01) {
                 err("send command, wrong status code in reply.");
-                return -EIO;
-        }
-        if (ibuf[6] != rlen) {
+                ret = -EIO;
+        } else if (st->data[6] != rlen) {
                 err("send command, invalid data length in reply.");
-                return -EIO;
+                ret = -EIO;
         }
-        for (i = 0; i < rlen; i++)
-                rbuf[i] = ibuf[i + 7];
-        return 0;
+        if (!ret) {
+                for (i = 0; i < rlen; i++)
+                        rbuf[i] = st->data[i + 7];
+        }
+
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 int af9005_read_eeprom(struct dvb_usb_device *d, u8 address, u8 * values,
                        int len)
 {
         struct af9005_device_state *st = d->priv;
-        u8 obuf[16], ibuf[14];
+        u8 seq;
         int ret, i;
 
-        memset(obuf, 0, sizeof(obuf));
-        memset(ibuf, 0, sizeof(ibuf));
+        mutex_lock(&d->data_mutex);
 
-        obuf[0] = 14;           /* length of rest of packet low */
-        obuf[1] = 0;            /* length of rest of packer high */
+        memset(st->data, 0, sizeof(st->data));
 
-        obuf[2] = 0x2a;         /* read/write eeprom */
+        st->data[0] = 14;               /* length of rest of packet low */
+        st->data[1] = 0;                /* length of rest of packer high */
 
-        obuf[3] = 12;           /* size */
+        st->data[2] = 0x2a;             /* read/write eeprom */
 
-        obuf[4] = st->sequence++;
+        st->data[3] = 12;               /* size */
 
-        obuf[5] = 0;            /* read */
+        st->data[4] = seq = st->sequence++;
 
-        obuf[6] = len;
-        obuf[7] = address;
-        ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 14, 0);
-        if (ret)
-                return ret;
-        if (ibuf[2] != 0x2b) {
+        st->data[5] = 0;                /* read */
+
+        st->data[6] = len;
+        st->data[7] = address;
+        ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 14, 0);
+        if (st->data[2] != 0x2b) {
                 err("Read eeprom, invalid reply code");
-                return -EIO;
-        }
-        if (ibuf[3] != 10) {
+                ret = -EIO;
+        } else if (st->data[3] != 10) {
                 err("Read eeprom, invalid reply length");
-                return -EIO;
-        }
-        if (ibuf[4] != obuf[4]) {
+                ret = -EIO;
+        } else if (st->data[4] != seq) {
                 err("Read eeprom, wrong sequence in reply ");
-                return -EIO;
-        }
-        if (ibuf[5] != 1) {
+                ret = -EIO;
+        } else if (st->data[5] != 1) {
                 err("Read eeprom, wrong status in reply ");
-                return -EIO;
+                ret = -EIO;
         }
-        for (i = 0; i < len; i++) {
-                values[i] = ibuf[6 + i];
+
+        if (!ret) {
+                for (i = 0; i < len; i++)
+                        values[i] = st->data[6 + i];
         }
-        return 0;
+        mutex_unlock(&d->data_mutex);
+
+        return ret;
 }
 
-static int af9005_boot_packet(struct usb_device *udev, int type, u8 * reply)
+static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
+                              u8 *buf, int size)
 {
-        u8 buf[FW_BULKOUT_SIZE + 2];
         u16 checksum;
         int act_len, i, ret;
-        memset(buf, 0, sizeof(buf));
+
+        memset(buf, 0, size);
         buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
         buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
         switch (type) {
@@ -720,15 +722,21 @@ static int af9005_download_firmware(struct usb_device *udev, const struct firmwa
 {
         int i, packets, ret, act_len;
 
-        u8 buf[FW_BULKOUT_SIZE + 2];
+        u8 *buf;
         u8 reply;
 
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+        buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
         if (ret)
-                return ret;
+                goto err;
         if (reply != 0x01) {
                 err("before downloading firmware, FW_CONFIG expected 0x01, received 0x%x", reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
         }
         packets = fw->size / FW_BULKOUT_SIZE;
         buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
@@ -743,28 +751,35 @@ static int af9005_download_firmware(struct usb_device *udev, const struct firmwa
                                    buf, FW_BULKOUT_SIZE + 2, &act_len, 1000);
                 if (ret) {
                         err("firmware download failed at packet %d with code %d", i, ret);
-                        return ret;
+                        goto err;
                 }
         }
-        ret = af9005_boot_packet(udev, FW_CONFIRM, &reply);
+        ret = af9005_boot_packet(udev, FW_CONFIRM, &reply,
+                                 buf, FW_BULKOUT_SIZE + 2);
         if (ret)
-                return ret;
+                goto err;
         if (reply != (u8) (packets & 0xff)) {
                 err("after downloading firmware, FW_CONFIRM expected 0x%x, received 0x%x", packets & 0xff, reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
         }
-        ret = af9005_boot_packet(udev, FW_BOOT, &reply);
+        ret = af9005_boot_packet(udev, FW_BOOT, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
         if (ret)
-                return ret;
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+                goto err;
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
         if (ret)
-                return ret;
+                goto err;
         if (reply != 0x02) {
                 err("after downloading firmware, FW_CONFIG expected 0x02, received 0x%x", reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
         }
 
-        return 0;
+err:
+        kfree(buf);
+        return ret;
 
 }
 
@@ -823,53 +838,59 @@ static int af9005_rc_query(struct dvb_usb_device *d, u32 * event, int *state)
 {
         struct af9005_device_state *st = d->priv;
         int ret, len;
-
-        u8 obuf[5];
-        u8 ibuf[256];
+        u8 seq;
 
         *state = REMOTE_NO_KEY_PRESSED;
         if (rc_decode == NULL) {
                 /* it shouldn't never come here */
                 return 0;
         }
+
+        mutex_lock(&d->data_mutex);
+
         /* deb_info("rc_query\n"); */
-        obuf[0] = 3;            /* rest of packet length low */
-        obuf[1] = 0;            /* rest of packet lentgh high */
-        obuf[2] = 0x40;         /* read remote */
-        obuf[3] = 1;            /* rest of packet length */
-        obuf[4] = st->sequence++;       /* sequence number */
-        ret = dvb_usb_generic_rw(d, obuf, 5, ibuf, 256, 0);
+        st->data[0] = 3;                /* rest of packet length low */
+        st->data[1] = 0;                /* rest of packet lentgh high */
+        st->data[2] = 0x40;             /* read remote */
+        st->data[3] = 1;                /* rest of packet length */
+        st->data[4] = seq = st->sequence++;     /* sequence number */
+        ret = dvb_usb_generic_rw(d, st->data, 5, st->data, 256, 0);
         if (ret) {
                 err("rc query failed");
-                return ret;
+                goto ret;
         }
-        if (ibuf[2] != 0x41) {
+        if (st->data[2] != 0x41) {
                 err("rc query bad header.");
-                return -EIO;
-        }
-        if (ibuf[4] != obuf[4]) {
+                ret = -EIO;
+                goto ret;
+        } else if (st->data[4] != seq) {
                 err("rc query bad sequence.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
-        len = ibuf[5];
+        len = st->data[5];
         if (len > 246) {
                 err("rc query invalid length");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
         }
         if (len > 0) {
                 deb_rc("rc data (%d) ", len);
-                debug_dump((ibuf + 6), len, deb_rc);
-                ret = rc_decode(d, &ibuf[6], len, event, state);
+                debug_dump((st->data + 6), len, deb_rc);
+                ret = rc_decode(d, &st->data[6], len, event, state);
                 if (ret) {
                         err("rc_decode failed");
-                        return ret;
+                        goto ret;
                 } else {
                         deb_rc("rc_decode state %x event %x\n", *state, *event);
                         if (*state == REMOTE_KEY_REPEAT)
                                 *event = d->last_event;
                 }
         }
-        return 0;
+
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 static int af9005_power_ctrl(struct dvb_usb_device *d, int onoff)
@@ -953,10 +974,16 @@ static int af9005_identify_state(struct usb_device *udev,
                                  int *cold)
 {
         int ret;
-        u8 reply;
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+        u8 reply, *buf;
+
+        buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply,
+                                 buf, FW_BULKOUT_SIZE + 2);
         if (ret)
-                return ret;
+                goto err;
         deb_info("result of FW_CONFIG in identify state %d\n", reply);
         if (reply == 0x01)
                 *cold = 1;
@@ -965,7 +992,10 @@ static int af9005_identify_state(struct usb_device *udev,
         else
                 return -EIO;
         deb_info("Identify state cold = %d\n", *cold);
-        return 0;
+
+err:
+        kfree(buf);
+        return ret;
 }
 
 static struct dvb_usb_device_properties af9005_properties;
@@ -974,7 +1004,7 @@ static int af9005_usb_probe(struct usb_interface *intf,
                             const struct usb_device_id *id)
 {
         return dvb_usb_device_init(intf, &af9005_properties,
-                                   THIS_MODULE, NULL, adapter_nr);
+                                  THIS_MODULE, NULL, adapter_nr);
 }
 
 enum af9005_usb_table_entry {
diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c
index 9fd1527494eb..290275bc7fde 100644
--- a/drivers/media/usb/dvb-usb/cinergyT2-core.c
+++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c
@@ -41,6 +41,7 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
 struct cinergyt2_state {
         u8 rc_counter;
+        unsigned char data[64];
 };
 
 /* We are missing a release hook with usb_device data */
@@ -50,38 +51,57 @@ static struct dvb_usb_device_properties cinergyt2_properties;
 
 static int cinergyt2_streaming_ctrl(struct dvb_usb_adapter *adap, int enable)
 {
-        char buf[] = { CINERGYT2_EP1_CONTROL_STREAM_TRANSFER, enable ? 1 : 0 };
-        char result[64];
-        return dvb_usb_generic_rw(adap->dev, buf, sizeof(buf), result,
-                                sizeof(result), 0);
+        struct dvb_usb_device *d = adap->dev;
+        struct cinergyt2_state *st = d->priv;
+        int ret;
+
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_CONTROL_STREAM_TRANSFER;
+        st->data[1] = enable ? 1 : 0;
+
+        ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 64, 0);
+        mutex_unlock(&d->data_mutex);
+
+        return ret;
 }
 
 static int cinergyt2_power_ctrl(struct dvb_usb_device *d, int enable)
 {
-        char buf[] = { CINERGYT2_EP1_SLEEP_MODE, enable ? 0 : 1 };
-        char state[3];
-        return dvb_usb_generic_rw(d, buf, sizeof(buf), state, sizeof(state), 0);
+        struct cinergyt2_state *st = d->priv;
+        int ret;
+
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_SLEEP_MODE;
+        st->data[1] = enable ? 0 : 1;
+
+        ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 3, 0);
+        mutex_unlock(&d->data_mutex);
+
+        return ret;
 }
 
 static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        char query[] = { CINERGYT2_EP1_GET_FIRMWARE_VERSION };
-        char state[3];
+        struct dvb_usb_device *d = adap->dev;
+        struct cinergyt2_state *st = d->priv;
         int ret;
 
         adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev);
 
-        ret = dvb_usb_generic_rw(adap->dev, query, sizeof(query), state,
-                                sizeof(state), 0);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_GET_FIRMWARE_VERSION;
+
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0);
         if (ret < 0) {
                 deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep "
                         "state info\n");
         }
+        mutex_unlock(&d->data_mutex);
 
         /* Copy this pointer as we are gonna need it in the release phase */
         cinergyt2_usb_device = adap->dev;
 
-        return 0;
+        return ret;
 }
 
 static struct rc_map_table rc_map_cinergyt2_table[] = {
@@ -141,13 +161,18 @@ static int repeatable_keys[] = {
 static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
         struct cinergyt2_state *st = d->priv;
-        u8 key[5] = {0, 0, 0, 0, 0}, cmd = CINERGYT2_EP1_GET_RC_EVENTS;
-        int i;
+        int i, ret;
 
         *state = REMOTE_NO_KEY_PRESSED;
 
-        dvb_usb_generic_rw(d, &cmd, 1, key, sizeof(key), 0);
-        if (key[4] == 0xff) {
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_GET_RC_EVENTS;
+
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0);
+        if (ret < 0)
+                goto ret;
+
+        if (st->data[4] == 0xff) {
                 /* key repeat */
                 st->rc_counter++;
                 if (st->rc_counter > RC_REPEAT_DELAY) {
@@ -157,34 +182,36 @@ static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
                                         *event = d->last_event;
                                         deb_rc("repeat key, event %x\n",
                                                    *event);
-                                        return 0;
+                                        goto ret;
                                 }
                         }
                         deb_rc("repeated key (non repeatable)\n");
                 }
-                return 0;
+                goto ret;
         }
 
         /* hack to pass checksum on the custom field */
-        key[2] = ~key[1];
-        dvb_usb_nec_rc_key_to_event(d, key, event, state);
-        if (key[0] != 0) {
+        st->data[2] = ~st->data[1];
+        dvb_usb_nec_rc_key_to_event(d, st->data, event, state);
+        if (st->data[0] != 0) {
                 if (*event != d->last_event)
                         st->rc_counter = 0;
 
-                deb_rc("key: %*ph\n", 5, key);
+                deb_rc("key: %*ph\n", 5, st->data);
         }
-        return 0;
+
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 static int cinergyt2_usb_probe(struct usb_interface *intf,
                                 const struct usb_device_id *id)
 {
         return dvb_usb_device_init(intf, &cinergyt2_properties,
-                                        THIS_MODULE, NULL, adapter_nr);
+                                   THIS_MODULE, NULL, adapter_nr);
 }
 
-
 static struct usb_device_id cinergyt2_usb_table[] = {
         { USB_DEVICE(USB_VID_TERRATEC, 0x0038) },
         { 0 }
diff --git a/drivers/media/usb/dvb-usb/cinergyT2-fe.c b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
index b3ec743a7a2e..2d29b4174dba 100644
--- a/drivers/media/usb/dvb-usb/cinergyT2-fe.c
+++ b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
@@ -139,32 +139,42 @@ static uint16_t compute_tps(struct dtv_frontend_properties *op)
 struct cinergyt2_fe_state {
         struct dvb_frontend fe;
         struct dvb_usb_device *d;
+
+        unsigned char data[64];
+        struct mutex data_mutex;
+
+        struct dvbt_get_status_msg status;
 };
 
 static int cinergyt2_fe_read_status(struct dvb_frontend *fe,
                                     enum fe_status *status)
 {
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg result;
-        u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
         int ret;
 
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&result,
-                        sizeof(result), 0);
+        mutex_lock(&state->data_mutex);
+        state->data[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
+
+        ret = dvb_usb_generic_rw(state->d, state->data, 1,
+                                 state->data, sizeof(state->status), 0);
+        if (!ret)
+                memcpy(&state->status, state->data, sizeof(state->status));
+        mutex_unlock(&state->data_mutex);
+
         if (ret < 0)
                 return ret;
 
         *status = 0;
 
-        if (0xffff - le16_to_cpu(result.gain) > 30)
+        if (0xffff - le16_to_cpu(state->status.gain) > 30)
                 *status |= FE_HAS_SIGNAL;
-        if (result.lock_bits & (1 << 6))
+        if (state->status.lock_bits & (1 << 6))
                 *status |= FE_HAS_LOCK;
-        if (result.lock_bits & (1 << 5))
+        if (state->status.lock_bits & (1 << 5))
                 *status |= FE_HAS_SYNC;
-        if (result.lock_bits & (1 << 4))
+        if (state->status.lock_bits & (1 << 4))
                 *status |= FE_HAS_CARRIER;
-        if (result.lock_bits & (1 << 1))
+        if (state->status.lock_bits & (1 << 1))
                 *status |= FE_HAS_VITERBI;
 
         if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) !=
@@ -177,34 +187,16 @@ static int cinergyt2_fe_read_status(struct dvb_frontend *fe,
 static int cinergyt2_fe_read_ber(struct dvb_frontend *fe, u32 *ber)
 {
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
-
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
-                                sizeof(status), 0);
-        if (ret < 0)
-                return ret;
 
-        *ber = le32_to_cpu(status.viterbi_error_rate);
+        *ber = le32_to_cpu(state->status.viterbi_error_rate);
         return 0;
 }
 
 static int cinergyt2_fe_read_unc_blocks(struct dvb_frontend *fe, u32 *unc)
 {
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
 
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&status,
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_unc_blocks() Failed! (Error=%d)\n",
-                        ret);
-                return ret;
-        }
-        *unc = le32_to_cpu(status.uncorrected_block_count);
+        *unc = le32_to_cpu(state->status.uncorrected_block_count);
         return 0;
 }
 
@@ -212,35 +204,16 @@ static int cinergyt2_fe_read_signal_strength(struct dvb_frontend *fe,
                                                 u16 *strength)
 {
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
 
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_signal_strength() Failed!"
-                        " (Error=%d)\n", ret);
-                return ret;
-        }
-        *strength = (0xffff - le16_to_cpu(status.gain));
+        *strength = (0xffff - le16_to_cpu(state->status.gain));
         return 0;
 }
 
 static int cinergyt2_fe_read_snr(struct dvb_frontend *fe, u16 *snr)
 {
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
 
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_snr() Failed! (Error=%d)\n", ret);
-                return ret;
-        }
-        *snr = (status.snr << 8) | status.snr;
+        *snr = (state->status.snr << 8) | state->status.snr;
         return 0;
 }
 
@@ -266,34 +239,36 @@ static int cinergyt2_fe_set_frontend(struct dvb_frontend *fe)
 {
         struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
         struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_set_parameters_msg param;
-        char result[2];
+        struct dvbt_set_parameters_msg *param;
         int err;
 
-        param.cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
-        param.tps = cpu_to_le16(compute_tps(fep));
-        param.freq = cpu_to_le32(fep->frequency / 1000);
-        param.flags = 0;
+        mutex_lock(&state->data_mutex);
+
+        param = (void *)state->data;
+        param->cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
+        param->tps = cpu_to_le16(compute_tps(fep));
+        param->freq = cpu_to_le32(fep->frequency / 1000);
+        param->flags = 0;
 
         switch (fep->bandwidth_hz) {
         default:
         case 8000000:
-                param.bandwidth = 8;
+                param->bandwidth = 8;
                 break;
         case 7000000:
-                param.bandwidth = 7;
+                param->bandwidth = 7;
                 break;
         case 6000000:
-                param.bandwidth = 6;
+                param->bandwidth = 6;
                 break;
         }
 
-        err = dvb_usb_generic_rw(state->d,
-                        (char *)&param, sizeof(param),
-                        result, sizeof(result), 0);
+        err = dvb_usb_generic_rw(state->d, state->data, sizeof(*param),
+                                 state->data, 2, 0);
         if (err < 0)
                 err("cinergyt2_fe_set_frontend() Failed! err=%d\n", err);
 
+        mutex_unlock(&state->data_mutex);
         return (err < 0) ? err : 0;
 }
 
@@ -315,6 +290,7 @@ struct dvb_frontend *cinergyt2_fe_attach(struct dvb_usb_device *d)
         s->d = d;
         memcpy(&s->fe.ops, &cinergyt2_fe_ops, sizeof(struct dvb_frontend_ops));
         s->fe.demodulator_priv = s;
+        mutex_init(&s->data_mutex);
         return &s->fe;
 }
 
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 907ac01ae297..243403081fa5 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -45,9 +45,6 @@
 #include "si2168.h"
 #include "si2157.h"
 
-/* Max transfer size done by I2C transfer functions */
-#define MAX_XFER_SIZE  80
-
 /* debug */
 static int dvb_usb_cxusb_debug;
 module_param_named(debug, dvb_usb_cxusb_debug, int, 0644);
@@ -61,23 +58,27 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 static int cxusb_ctrl_msg(struct dvb_usb_device *d,
                           u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
-        int wo = (rbuf == NULL || rlen == 0); /* write-only */
-        u8 sndbuf[MAX_XFER_SIZE];
+        struct cxusb_state *st = d->priv;
+        int ret, wo;
 
-        if (1 + wlen > sizeof(sndbuf)) {
-                warn("i2c wr: len=%d is too big!\n",
-                     wlen);
+        if (1 + wlen > MAX_XFER_SIZE) {
+                warn("i2c wr: len=%d is too big!\n", wlen);
                 return -EOPNOTSUPP;
         }
 
-        memset(sndbuf, 0, 1+wlen);
+        wo = (rbuf == NULL || rlen == 0); /* write-only */
 
-        sndbuf[0] = cmd;
-        memcpy(&sndbuf[1], wbuf, wlen);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = cmd;
+        memcpy(&st->data[1], wbuf, wlen);
         if (wo)
-                return dvb_usb_generic_write(d, sndbuf, 1+wlen);
+                ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
         else
-                return dvb_usb_generic_rw(d, sndbuf, 1+wlen, rbuf, rlen, 0);
+                ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
+                                         rbuf, rlen, 0);
+
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 /* GPIO */
diff --git a/drivers/media/usb/dvb-usb/cxusb.h b/drivers/media/usb/dvb-usb/cxusb.h
index 527ff7905e15..18acda19527a 100644
--- a/drivers/media/usb/dvb-usb/cxusb.h
+++ b/drivers/media/usb/dvb-usb/cxusb.h
@@ -28,10 +28,15 @@
 #define CMD_ANALOG        0x50
 #define CMD_DIGITAL       0x51
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  80
+
 struct cxusb_state {
         u8 gpio_write_state[3];
         struct i2c_client *i2c_client_demod;
         struct i2c_client *i2c_client_tuner;
+
+        unsigned char data[MAX_XFER_SIZE];
 };
 
 #endif
diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
index f3196658fb70..47ce9d5de4c6 100644
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -213,7 +213,7 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                                                  usb_rcvctrlpipe(d->udev, 0),
                                                  REQUEST_NEW_I2C_READ,
                                                  USB_TYPE_VENDOR | USB_DIR_IN,
-                                                 value, index, msg[i].buf,
+                                                 value, index, st->buf,
                                                  msg[i].len,
                                                  USB_CTRL_GET_TIMEOUT);
                         if (result < 0) {
@@ -221,6 +221,14 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                                 break;
                         }
 
+                        if (msg[i].len > sizeof(st->buf)) {
+                                deb_info("buffer too small to fit %d bytes\n",
+                                         msg[i].len);
+                                return -EIO;
+                        }
+
+                        memcpy(msg[i].buf, st->buf, msg[i].len);
+
                         deb_data("<<< ");
                         debug_dump(msg[i].buf, msg[i].len, deb_data);
 
@@ -238,6 +246,13 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                         /* I2C ctrl + FE bus; */
                         st->buf[3] = ((gen_mode << 6) & 0xC0) |
                                  ((bus_mode << 4) & 0x30);
+
+                        if (msg[i].len > sizeof(st->buf) - 4) {
+                                deb_info("i2c message to big: %d\n",
+                                         msg[i].len);
+                                return -EIO;
+                        }
+
                         /* The Actual i2c payload */
                         memcpy(&st->buf[4], msg[i].buf, msg[i].len);
 
@@ -283,6 +298,11 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                 /* fill in the address */
                 st->buf[1] = msg[i].addr << 1;
                 /* fill the buffer */
+                if (msg[i].len > sizeof(st->buf) - 2) {
+                        deb_info("i2c xfer to big: %d\n",
+                                msg[i].len);
+                        return -EIO;
+                }
                 memcpy(&st->buf[2], msg[i].buf, msg[i].len);
 
                 /* write/read request */
@@ -292,13 +312,20 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
 
                         /* special thing in the current firmware: when length is zero the read-failed */
                         len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2,
-                                        msg[i+1].buf, msg[i+1].len);
+                                              st->buf, msg[i + 1].len);
                         if (len <= 0) {
                                 deb_info("I2C read failed on address 0x%02x\n",
                                                 msg[i].addr);
                                 break;
                         }
 
+                        if (msg[i + 1].len > sizeof(st->buf)) {
+                                deb_info("i2c xfer buffer to small for %d\n",
+                                        msg[i].len);
+                                return -EIO;
+                        }
+                        memcpy(msg[i + 1].buf, st->buf, msg[i + 1].len);
+
                         msg[i+1].len = len;
 
                         i++;
@@ -677,7 +704,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
         struct dvb_usb_device *d = purb->context;
         struct dib0700_rc_response *poll_reply;
         enum rc_type protocol;
-        u32 uninitialized_var(keycode);
+        u32 keycode;
         u8 toggle;
 
         deb_info("%s()\n", __func__);
@@ -718,7 +745,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
                     poll_reply->nec.data       == 0x00 &&
                     poll_reply->nec.not_data   == 0xff) {
                         poll_reply->data_state = 2;
-                        break;
+                        rc_repeat(d->rc_dev);
+                        goto resubmit;
                 }
 
                 if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
index 0857b56e652c..ef1b8ee75c57 100644
--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -508,8 +508,6 @@ static int stk7700ph_tuner_attach(struct dvb_usb_adapter *adap)
 
 #define DEFAULT_RC_INTERVAL 50
 
-static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
-
 /*
  * This function is used only when firmware is < 1.20 version. Newer
  * firmwares use bulk mode, with functions implemented at dib0700_core,
@@ -517,7 +515,6 @@ static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
  */
 static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)
 {
-        u8 key[4];
         enum rc_type protocol;
         u32 scancode;
         u8 toggle;
@@ -532,39 +529,43 @@ static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)
                 return 0;
         }
 
-        i = dib0700_ctrl_rd(d, rc_request, 2, key, 4);
+        st->buf[0] = REQUEST_POLL_RC;
+        st->buf[1] = 0;
+
+        i = dib0700_ctrl_rd(d, st->buf, 2, st->buf, 4);
         if (i <= 0) {
                 err("RC Query Failed");
-                return -1;
+                return -EIO;
         }
 
         /* losing half of KEY_0 events from Philipps rc5 remotes.. */
-        if (key[0] == 0 && key[1] == 0 && key[2] == 0 && key[3] == 0)
+        if (st->buf[0] == 0 && st->buf[1] == 0
+            && st->buf[2] == 0 && st->buf[3] == 0)
                 return 0;
 
-        /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)key[3-2],(int)key[3-3],(int)key[3-1],(int)key[3]);  */
+        /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)st->buf[3 - 2],(int)st->buf[3 - 3],(int)st->buf[3 - 1],(int)st->buf[3]);  */
 
         dib0700_rc_setup(d, NULL); /* reset ir sensor data to prevent false events */
 
         switch (d->props.rc.core.protocol) {
         case RC_BIT_NEC:
                 /* NEC protocol sends repeat code as 0 0 0 FF */
-                if ((key[3-2] == 0x00) && (key[3-3] == 0x00) &&
-                    (key[3] == 0xff)) {
+                if ((st->buf[3 - 2] == 0x00) && (st->buf[3 - 3] == 0x00) &&
+                    (st->buf[3] == 0xff)) {
                         rc_repeat(d->rc_dev);
                         return 0;
                 }
 
                 protocol = RC_TYPE_NEC;
-                scancode = RC_SCANCODE_NEC(key[3-2], key[3-3]);
+                scancode = RC_SCANCODE_NEC(st->buf[3 - 2], st->buf[3 - 3]);
                 toggle = 0;
                 break;
 
         default:
                 /* RC-5 protocol changes toggle bit on new keypress */
                 protocol = RC_TYPE_RC5;
-                scancode = RC_SCANCODE_RC5(key[3-2], key[3-3]);
-                toggle = key[3-1];
+                scancode = RC_SCANCODE_RC5(st->buf[3 - 2], st->buf[3 - 3]);
+                toggle = st->buf[3 - 1];
                 break;
         }
 
diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index 18ed3bfbb5e2..de3ee2547479 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -62,72 +62,117 @@ EXPORT_SYMBOL(dibusb_pid_filter_ctrl);
 
 int dibusb_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b[3];
+        u8 *b;
         int ret;
+
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
         b[0] = DIBUSB_REQ_SET_IOCTL;
         b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
         b[2] = onoff ? DIBUSB_IOCTL_POWER_WAKEUP : DIBUSB_IOCTL_POWER_SLEEP;
-        ret = dvb_usb_generic_write(d,b,3);
+
+        ret = dvb_usb_generic_write(d, b, 3);
+
+        kfree(b);
+
         msleep(10);
+
         return ret;
 }
 EXPORT_SYMBOL(dibusb_power_ctrl);
 
 int dibusb2_0_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 {
-        u8 b[3] = { 0 };
         int ret;
+        u8 *b;
+
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
 
         if ((ret = dibusb_streaming_ctrl(adap,onoff)) < 0)
-                return ret;
+                goto ret;
 
         if (onoff) {
                 b[0] = DIBUSB_REQ_SET_STREAMING_MODE;
                 b[1] = 0x00;
-                if ((ret = dvb_usb_generic_write(adap->dev,b,2)) < 0)
-                        return ret;
+                ret = dvb_usb_generic_write(adap->dev, b, 2);
+                if (ret  < 0)
+                        goto ret;
         }
 
         b[0] = DIBUSB_REQ_SET_IOCTL;
         b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
-        return dvb_usb_generic_write(adap->dev,b,3);
+        ret = dvb_usb_generic_write(adap->dev, b, 3);
+
+ret:
+        kfree(b);
+        return ret;
 }
 EXPORT_SYMBOL(dibusb2_0_streaming_ctrl);
 
 int dibusb2_0_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        if (onoff) {
-                u8 b[3] = { DIBUSB_REQ_SET_IOCTL, DIBUSB_IOCTL_CMD_POWER_MODE, DIBUSB_IOCTL_POWER_WAKEUP };
-                return dvb_usb_generic_write(d,b,3);
-        } else
+        u8 *b;
+        int ret;
+
+        if (!onoff)
                 return 0;
+
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
+        b[0] = DIBUSB_REQ_SET_IOCTL;
+        b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
+        b[2] = DIBUSB_IOCTL_POWER_WAKEUP;
+
+        ret = dvb_usb_generic_write(d, b, 3);
+
+        kfree(b);
+
+        return ret;
 }
 EXPORT_SYMBOL(dibusb2_0_power_ctrl);
 
 static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
                           u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
 {
-        u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+        u8 *sndbuf;
+        int ret, wo, len;
+
         /* write only ? */
-        int wo = (rbuf == NULL || rlen == 0),
-                len = 2 + wlen + (wo ? 0 : 2);
+        wo = (rbuf == NULL || rlen == 0);
+
+        len = 2 + wlen + (wo ? 0 : 2);
+
+        sndbuf = kmalloc(MAX_XFER_SIZE, GFP_KERNEL);
+        if (!sndbuf)
+                return -ENOMEM;
 
-        if (4 + wlen > sizeof(sndbuf)) {
+        if (4 + wlen > MAX_XFER_SIZE) {
                 warn("i2c wr: len=%d is too big!\n", wlen);
-                return -EOPNOTSUPP;
+                ret = -EOPNOTSUPP;
+                goto ret;
         }
 
         sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
         sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
 
-        memcpy(&sndbuf[2],wbuf,wlen);
+        memcpy(&sndbuf[2], wbuf, wlen);
 
         if (!wo) {
-                sndbuf[wlen+2] = (rlen >> 8) & 0xff;
-                sndbuf[wlen+3] = rlen & 0xff;
+                sndbuf[wlen + 2] = (rlen >> 8) & 0xff;
+                sndbuf[wlen + 3] = rlen & 0xff;
         }
 
-        return dvb_usb_generic_rw(d,sndbuf,len,rbuf,rlen,0);
+        ret = dvb_usb_generic_rw(d, sndbuf, len, rbuf, rlen, 0);
+
+ret:
+        kfree(sndbuf);
+        return ret;
 }
 
 /*
@@ -319,11 +364,27 @@ EXPORT_SYMBOL(rc_map_dibusb_table);
 
 int dibusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
-        u8 key[5],cmd = DIBUSB_REQ_POLL_REMOTE;
-        dvb_usb_generic_rw(d,&cmd,1,key,5,0);
-        dvb_usb_nec_rc_key_to_event(d,key,event,state);
-        if (key[0] != 0)
-                deb_info("key: %*ph\n", 5, key);
-        return 0;
+        u8 *buf;
+        int ret;
+
+        buf = kmalloc(5, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = DIBUSB_REQ_POLL_REMOTE;
+
+        ret = dvb_usb_generic_rw(d, buf, 1, buf, 5, 0);
+        if (ret < 0)
+                goto ret;
+
+        dvb_usb_nec_rc_key_to_event(d, buf, event, state);
+
+        if (buf[0] != 0)
+                deb_info("key: %*ph\n", 5, buf);
+
+        kfree(buf);
+
+ret:
+        return ret;
 }
 EXPORT_SYMBOL(dibusb_rc_query);
diff --git a/drivers/media/usb/dvb-usb/dibusb.h b/drivers/media/usb/dvb-usb/dibusb.h
index 3f82163d8ab8..697be2a17ade 100644
--- a/drivers/media/usb/dvb-usb/dibusb.h
+++ b/drivers/media/usb/dvb-usb/dibusb.h
@@ -96,6 +96,9 @@
 #define DIBUSB_IOCTL_CMD_ENABLE_STREAM  0x01
 #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 struct dibusb_state {
         struct dib_fe_xfer_ops ops;
         int mt2060_present;
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 63134335c994..4284f6984dc1 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -28,22 +28,26 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 static int digitv_ctrl_msg(struct dvb_usb_device *d,
                 u8 cmd, u8 vv, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
-        int wo = (rbuf == NULL || rlen == 0); /* write-only */
-        u8 sndbuf[7],rcvbuf[7];
-        memset(sndbuf,0,7); memset(rcvbuf,0,7);
+        struct digitv_state *st = d->priv;
+        int ret, wo;
 
-        sndbuf[0] = cmd;
-        sndbuf[1] = vv;
-        sndbuf[2] = wo ? wlen : rlen;
+        wo = (rbuf == NULL || rlen == 0); /* write-only */
+
+        memset(st->sndbuf, 0, 7);
+        memset(st->rcvbuf, 0, 7);
+
+        st->sndbuf[0] = cmd;
+        st->sndbuf[1] = vv;
+        st->sndbuf[2] = wo ? wlen : rlen;
 
         if (wo) {
-                memcpy(&sndbuf[3],wbuf,wlen);
-                dvb_usb_generic_write(d,sndbuf,7);
+                memcpy(&st->sndbuf[3], wbuf, wlen);
+                ret = dvb_usb_generic_write(d, st->sndbuf, 7);
         } else {
-                dvb_usb_generic_rw(d,sndbuf,7,rcvbuf,7,10);
-                memcpy(rbuf,&rcvbuf[3],rlen);
+                ret = dvb_usb_generic_rw(d, st->sndbuf, 7, st->rcvbuf, 7, 10);
+                memcpy(rbuf, &st->rcvbuf[3], rlen);
         }
-        return 0;
+        return ret;
 }
 
 /* I2C */
diff --git a/drivers/media/usb/dvb-usb/digitv.h b/drivers/media/usb/dvb-usb/digitv.h
index 908c09f4966b..581e09c25491 100644
--- a/drivers/media/usb/dvb-usb/digitv.h
+++ b/drivers/media/usb/dvb-usb/digitv.h
@@ -5,7 +5,10 @@
 #include "dvb-usb.h"
 
 struct digitv_state {
-    int is_nxt6000;
+        int is_nxt6000;
+
+        unsigned char sndbuf[7];
+        unsigned char rcvbuf[7];
 };
 
 /* protocol (from usblogging and the SDK:
diff --git a/drivers/media/usb/dvb-usb/dtt200u-fe.c b/drivers/media/usb/dvb-usb/dtt200u-fe.c
index c09332bd99cb..f5c042baa254 100644
--- a/drivers/media/usb/dvb-usb/dtt200u-fe.c
+++ b/drivers/media/usb/dvb-usb/dtt200u-fe.c
@@ -18,17 +18,28 @@ struct dtt200u_fe_state {
 
         struct dtv_frontend_properties fep;
         struct dvb_frontend frontend;
+
+        unsigned char data[80];
+        struct mutex data_mutex;
 };
 
 static int dtt200u_fe_read_status(struct dvb_frontend *fe,
                                   enum fe_status *stat)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 st = GET_TUNE_STATUS, b[3];
+        int ret;
+
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_TUNE_STATUS;
 
-        dvb_usb_generic_rw(state->d,&st,1,b,3,0);
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0);
+        if (ret < 0) {
+                *stat = 0;
+                mutex_unlock(&state->data_mutex);
+                return ret;
+        }
 
-        switch (b[0]) {
+        switch (state->data[0]) {
                 case 0x01:
                         *stat = FE_HAS_SIGNAL | FE_HAS_CARRIER |
                                 FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
@@ -41,51 +52,86 @@ static int dtt200u_fe_read_status(struct dvb_frontend *fe,
                         *stat = 0;
                         break;
         }
+        mutex_unlock(&state->data_mutex);
         return 0;
 }
 
 static int dtt200u_fe_read_ber(struct dvb_frontend* fe, u32 *ber)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_VIT_ERR_CNT,b[3];
-        dvb_usb_generic_rw(state->d,&bw,1,b,3,0);
-        *ber = (b[0] << 16) | (b[1] << 8) | b[2];
-        return 0;
+        int ret;
+
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_VIT_ERR_CNT;
+
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0);
+        if (ret >= 0)
+                *ber = (state->data[0] << 16) | (state->data[1] << 8) | state->data[2];
+
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 
 static int dtt200u_fe_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_RS_UNCOR_BLK_CNT,b[2];
+        int ret;
 
-        dvb_usb_generic_rw(state->d,&bw,1,b,2,0);
-        *unc = (b[0] << 8) | b[1];
-        return 0;
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_RS_UNCOR_BLK_CNT;
+
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 2, 0);
+        if (ret >= 0)
+                *unc = (state->data[0] << 8) | state->data[1];
+
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 
 static int dtt200u_fe_read_signal_strength(struct dvb_frontend* fe, u16 *strength)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_AGC, b;
-        dvb_usb_generic_rw(state->d,&bw,1,&b,1,0);
-        *strength = (b << 8) | b;
-        return 0;
+        int ret;
+
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_AGC;
+
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0);
+        if (ret >= 0)
+                *strength = (state->data[0] << 8) | state->data[0];
+
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 
 static int dtt200u_fe_read_snr(struct dvb_frontend* fe, u16 *snr)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_SNR,br;
-        dvb_usb_generic_rw(state->d,&bw,1,&br,1,0);
-        *snr = ~((br << 8) | br);
-        return 0;
+        int ret;
+
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_SNR;
+
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0);
+        if (ret >= 0)
+                *snr = ~((state->data[0] << 8) | state->data[0]);
+
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 
 static int dtt200u_fe_init(struct dvb_frontend* fe)
 {
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 b = SET_INIT;
-        return dvb_usb_generic_write(state->d,&b,1);
+        int ret;
+
+        mutex_lock(&state->data_mutex);
+        state->data[0] = SET_INIT;
+
+        ret = dvb_usb_generic_write(state->d, state->data, 1);
+        mutex_unlock(&state->data_mutex);
+
+        return ret;
 }
 
 static int dtt200u_fe_sleep(struct dvb_frontend* fe)
@@ -105,39 +151,40 @@ static int dtt200u_fe_set_frontend(struct dvb_frontend *fe)
 {
         struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
         struct dtt200u_fe_state *state = fe->demodulator_priv;
-        int i;
-        enum fe_status st;
+        int ret;
         u16 freq = fep->frequency / 250000;
-        u8 bwbuf[2] = { SET_BANDWIDTH, 0 },freqbuf[3] = { SET_RF_FREQ, 0, 0 };
 
+        mutex_lock(&state->data_mutex);
+        state->data[0] = SET_BANDWIDTH;
         switch (fep->bandwidth_hz) {
         case 8000000:
-                bwbuf[1] = 8;
+                state->data[1] = 8;
                 break;
         case 7000000:
-                bwbuf[1] = 7;
+                state->data[1] = 7;
                 break;
         case 6000000:
-                bwbuf[1] = 6;
+                state->data[1] = 6;
                 break;
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto ret;
         }
 
-        dvb_usb_generic_write(state->d,bwbuf,2);
+        ret = dvb_usb_generic_write(state->d, state->data, 2);
+        if (ret < 0)
+                goto ret;
 
-        freqbuf[1] = freq & 0xff;
-        freqbuf[2] = (freq >> 8) & 0xff;
-        dvb_usb_generic_write(state->d,freqbuf,3);
+        state->data[0] = SET_RF_FREQ;
+        state->data[1] = freq & 0xff;
+        state->data[2] = (freq >> 8) & 0xff;
+        ret = dvb_usb_generic_write(state->d, state->data, 3);
+        if (ret < 0)
+                goto ret;
 
-        for (i = 0; i < 30; i++) {
-                msleep(20);
-                dtt200u_fe_read_status(fe, &st);
-                if (st & FE_TIMEDOUT)
-                        continue;
-        }
-
-        return 0;
+ret:
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 
 static int dtt200u_fe_get_frontend(struct dvb_frontend* fe,
@@ -169,6 +216,7 @@ struct dvb_frontend* dtt200u_fe_attach(struct dvb_usb_device *d)
         deb_info("attaching frontend dtt200u\n");
 
         state->d = d;
+        mutex_init(&state->data_mutex);
 
         memcpy(&state->frontend.ops,&dtt200u_fe_ops,sizeof(struct dvb_frontend_ops));
         state->frontend.demodulator_priv = state;
diff --git a/drivers/media/usb/dvb-usb/dtt200u.c b/drivers/media/usb/dvb-usb/dtt200u.c
index d2a01b50af0d..fcbff7fb0c4e 100644
--- a/drivers/media/usb/dvb-usb/dtt200u.c
+++ b/drivers/media/usb/dvb-usb/dtt200u.c
@@ -20,75 +20,115 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,xfer=2 (or-able))." DVB_USB
 
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
+struct dtt200u_state {
+        unsigned char data[80];
+};
+
 static int dtt200u_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b = SET_INIT;
+        struct dtt200u_state *st = d->priv;
+        int ret = 0;
+
+        mutex_lock(&d->data_mutex);
+
+        st->data[0] = SET_INIT;
 
         if (onoff)
-                dvb_usb_generic_write(d,&b,2);
+                ret = dvb_usb_generic_write(d, st->data, 2);
 
-        return 0;
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 static int dtt200u_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 {
-        u8 b_streaming[2] = { SET_STREAMING, onoff };
-        u8 b_rst_pid = RESET_PID_FILTER;
+        struct dvb_usb_device *d = adap->dev;
+        struct dtt200u_state *st = d->priv;
+        int ret;
 
-        dvb_usb_generic_write(adap->dev, b_streaming, 2);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = SET_STREAMING;
+        st->data[1] = onoff;
 
-        if (onoff == 0)
-                dvb_usb_generic_write(adap->dev, &b_rst_pid, 1);
-        return 0;
+        ret = dvb_usb_generic_write(adap->dev, st->data, 2);
+        if (ret < 0)
+                goto ret;
+
+        if (onoff)
+                goto ret;
+
+        st->data[0] = RESET_PID_FILTER;
+        ret = dvb_usb_generic_write(adap->dev, st->data, 1);
+
+ret:
+        mutex_unlock(&d->data_mutex);
+
+        return ret;
 }
 
 static int dtt200u_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid, int onoff)
 {
-        u8 b_pid[4];
+        struct dvb_usb_device *d = adap->dev;
+        struct dtt200u_state *st = d->priv;
+        int ret;
+
         pid = onoff ? pid : 0;
 
-        b_pid[0] = SET_PID_FILTER;
-        b_pid[1] = index;
-        b_pid[2] = pid & 0xff;
-        b_pid[3] = (pid >> 8) & 0x1f;
+        mutex_lock(&d->data_mutex);
+        st->data[0] = SET_PID_FILTER;
+        st->data[1] = index;
+        st->data[2] = pid & 0xff;
+        st->data[3] = (pid >> 8) & 0x1f;
+
+        ret = dvb_usb_generic_write(adap->dev, st->data, 4);
+        mutex_unlock(&d->data_mutex);
 
-        return dvb_usb_generic_write(adap->dev, b_pid, 4);
+        return ret;
 }
 
 static int dtt200u_rc_query(struct dvb_usb_device *d)
 {
-        u8 key[5],cmd = GET_RC_CODE;
+        struct dtt200u_state *st = d->priv;
         u32 scancode;
+        int ret;
+
+        mutex_lock(&d->data_mutex);
+        st->data[0] = GET_RC_CODE;
 
-        dvb_usb_generic_rw(d,&cmd,1,key,5,0);
-        if (key[0] == 1) {
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0);
+        if (ret < 0)
+                goto ret;
+
+        if (st->data[0] == 1) {
                 enum rc_type proto = RC_TYPE_NEC;
 
-                scancode = key[1];
-                if ((u8) ~key[1] != key[2]) {
+                scancode = st->data[1];
+                if ((u8) ~st->data[1] != st->data[2]) {
                         /* Extended NEC */
                         scancode = scancode << 8;
-                        scancode |= key[2];
+                        scancode |= st->data[2];
                         proto = RC_TYPE_NECX;
                 }
                 scancode = scancode << 8;
-                scancode |= key[3];
+                scancode |= st->data[3];
 
                 /* Check command checksum is ok */
-                if ((u8) ~key[3] == key[4])
+                if ((u8) ~st->data[3] == st->data[4])
                         rc_keydown(d->rc_dev, proto, scancode, 0);
                 else
                         rc_keyup(d->rc_dev);
-        } else if (key[0] == 2) {
+        } else if (st->data[0] == 2) {
                 rc_repeat(d->rc_dev);
         } else {
                 rc_keyup(d->rc_dev);
         }
 
-        if (key[0] != 0)
-                deb_info("key: %*ph\n", 5, key);
+        if (st->data[0] != 0)
+                deb_info("st->data: %*ph\n", 5, st->data);
 
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 
 static int dtt200u_frontend_attach(struct dvb_usb_adapter *adap)
@@ -140,6 +180,8 @@ static struct dvb_usb_device_properties dtt200u_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-dtt200u-01.fw",
 
+        .size_of_priv     = sizeof(struct dtt200u_state),
+
         .num_adapters = 1,
         .adapter = {
                 {
@@ -190,6 +232,8 @@ static struct dvb_usb_device_properties wt220u_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-wt220u-02.fw",
 
+        .size_of_priv     = sizeof(struct dtt200u_state),
+
         .num_adapters = 1,
         .adapter = {
                 {
@@ -240,6 +284,8 @@ static struct dvb_usb_device_properties wt220u_fc_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-wt220u-fc03.fw",
 
+        .size_of_priv     = sizeof(struct dtt200u_state),
+
         .num_adapters = 1,
         .adapter = {
                 {
@@ -290,6 +336,8 @@ static struct dvb_usb_device_properties wt220u_zl0353_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-wt220u-zl0353-01.fw",
 
+        .size_of_priv     = sizeof(struct dtt200u_state),
+
         .num_adapters = 1,
         .adapter = {
                 {
@@ -340,6 +388,8 @@ static struct dvb_usb_device_properties wt220u_miglia_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-wt220u-miglia-01.fw",
 
+        .size_of_priv     = sizeof(struct dtt200u_state),
+
         .num_adapters = 1,
         .generic_bulk_ctrl_endpoint = 0x01,
 
diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c
index 3d11df41cac0..c60fb54f445f 100644
--- a/drivers/media/usb/dvb-usb/dtv5100.c
+++ b/drivers/media/usb/dvb-usb/dtv5100.c
@@ -31,9 +31,14 @@ module_param_named(debug, dvb_usb_dtv5100_debug, int, 0644);
 MODULE_PARM_DESC(debug, "set debugging level" DVB_USB_DEBUG_STATUS);
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
+struct dtv5100_state {
+        unsigned char data[80];
+};
+
 static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
                            u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
 {
+        struct dtv5100_state *st = d->priv;
         u8 request;
         u8 type;
         u16 value;
@@ -60,9 +65,10 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
         }
         index = (addr << 8) + wbuf[0];
 
+        memcpy(st->data, rbuf, rlen);
         msleep(1); /* avoid I2C errors */
         return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request,
-                               type, value, index, rbuf, rlen,
+                               type, value, index, st->data, rlen,
                                DTV5100_USB_TIMEOUT);
 }
 
@@ -176,7 +182,7 @@ static struct dvb_usb_device_properties dtv5100_properties = {
         .caps = DVB_USB_IS_AN_I2C_ADAPTER,
         .usb_ctrl = DEVICE_SPECIFIC,
 
-        .size_of_priv = 0,
+        .size_of_priv = sizeof(struct dtv5100_state),
 
         .num_adapters = 1,
         .adapter = {{
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 3896ba9a4179..84308569e7dc 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -142,6 +142,7 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums)
 {
         int ret = 0;
 
+        mutex_init(&d->data_mutex);
         mutex_init(&d->usb_mutex);
         mutex_init(&d->i2c_mutex);
 
diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h
index 639c4678c65b..107255b08b2b 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb.h
+++ b/drivers/media/usb/dvb-usb/dvb-usb.h
@@ -404,8 +404,12 @@ struct dvb_usb_adapter {
  *  Powered is in/decremented for each call to modify the state.
  * @udev: pointer to the device's struct usb_device.
  *
- * @usb_mutex: semaphore of USB control messages (reading needs two messages)
- * @i2c_mutex: semaphore for i2c-transfers
+ * @data_mutex: mutex to protect the data structure used to store URB data
+ * @usb_mutex: mutex of USB control messages (reading needs two messages).
+ *      Please notice that this mutex is used internally at the generic
+ *      URB control functions. So, drivers using dvb_usb_generic_rw() and
+ *      derivated functions should not lock it internally.
+ * @i2c_mutex: mutex for i2c-transfers
  *
  * @i2c_adap: device's i2c_adapter if it uses I2CoverUSB
  *
@@ -433,6 +437,7 @@ struct dvb_usb_device {
         int powered;
 
         /* locking */
+        struct mutex data_mutex;
         struct mutex usb_mutex;
 
         /* i2c */
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 5fb0c650926e..2c720cb2fb00 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -852,7 +852,7 @@ static int su3000_power_ctrl(struct dvb_usb_device *d, int i)
         if (i && !state->initialized) {
                 state->initialized = 1;
                 /* reset board */
-                dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
+                return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
         }
 
         return 0;
diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c
index 5d0384dd45b5..993bb7a72985 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.c
+++ b/drivers/media/usb/dvb-usb/gp8psk.c
@@ -15,6 +15,7 @@
  * see Documentation/dvb/README.dvb-usb for more information
  */
 #include "gp8psk.h"
+#include "gp8psk-fe.h"
 
 /* debug */
 static char bcm4500_firmware[] = "dvb-usb-gp8psk-02.fw";
@@ -24,37 +25,19 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,xfer=2,rc=4 (or-able))." DV
 
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
-static int gp8psk_get_fw_version(struct dvb_usb_device *d, u8 *fw_vers)
-{
-        return (gp8psk_usb_in_op(d, GET_FW_VERS, 0, 0, fw_vers, 6));
-}
-
-static int gp8psk_get_fpga_version(struct dvb_usb_device *d, u8 *fpga_vers)
-{
-        return (gp8psk_usb_in_op(d, GET_FPGA_VERS, 0, 0, fpga_vers, 1));
-}
-
-static void gp8psk_info(struct dvb_usb_device *d)
-{
-        u8 fpga_vers, fw_vers[6];
-
-        if (!gp8psk_get_fw_version(d, fw_vers))
-                info("FW Version = %i.%02i.%i (0x%x)  Build %4i/%02i/%02i",
-                fw_vers[2], fw_vers[1], fw_vers[0], GP8PSK_FW_VERS(fw_vers),
-                2000 + fw_vers[5], fw_vers[4], fw_vers[3]);
-        else
-                info("failed to get FW version");
-
-        if (!gp8psk_get_fpga_version(d, &fpga_vers))
-                info("FPGA Version = %i", fpga_vers);
-        else
-                info("failed to get FPGA version");
-}
+struct gp8psk_state {
+        unsigned char data[80];
+};
 
-int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen)
+static int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
 {
+        struct gp8psk_state *st = d->priv;
         int ret = 0,try = 0;
 
+        if (blen > sizeof(st->data))
+                return -EIO;
+
         if ((ret = mutex_lock_interruptible(&d->usb_mutex)))
                 return ret;
 
@@ -63,7 +46,7 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
                         usb_rcvctrlpipe(d->udev,0),
                         req,
                         USB_TYPE_VENDOR | USB_DIR_IN,
-                        value,index,b,blen,
+                        value, index, st->data, blen,
                         2000);
                 deb_info("reading number %d (ret: %d)\n",try,ret);
                 try++;
@@ -72,8 +55,10 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
         if (ret < 0 || ret != blen) {
                 warn("usb in %d operation failed.", req);
                 ret = -EIO;
-        } else
+        } else {
                 ret = 0;
+                memcpy(b, st->data, blen);
+        }
 
         deb_xfer("in: req. %x, val: %x, ind: %x, buffer: ",req,value,index);
         debug_dump(b,blen,deb_xfer);
@@ -83,22 +68,27 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
         return ret;
 }
 
-int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
+static int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
                              u16 index, u8 *b, int blen)
 {
+        struct gp8psk_state *st = d->priv;
         int ret;
 
         deb_xfer("out: req. %x, val: %x, ind: %x, buffer: ",req,value,index);
         debug_dump(b,blen,deb_xfer);
 
+        if (blen > sizeof(st->data))
+                return -EIO;
+
         if ((ret = mutex_lock_interruptible(&d->usb_mutex)))
                 return ret;
 
+        memcpy(st->data, b, blen);
         if (usb_control_msg(d->udev,
                         usb_sndctrlpipe(d->udev,0),
                         req,
                         USB_TYPE_VENDOR | USB_DIR_OUT,
-                        value,index,b,blen,
+                        value, index, st->data, blen,
                         2000) != blen) {
                 warn("usb out operation failed.");
                 ret = -EIO;
@@ -109,6 +99,34 @@ int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
         return ret;
 }
 
+
+static int gp8psk_get_fw_version(struct dvb_usb_device *d, u8 *fw_vers)
+{
+        return gp8psk_usb_in_op(d, GET_FW_VERS, 0, 0, fw_vers, 6);
+}
+
+static int gp8psk_get_fpga_version(struct dvb_usb_device *d, u8 *fpga_vers)
+{
+        return gp8psk_usb_in_op(d, GET_FPGA_VERS, 0, 0, fpga_vers, 1);
+}
+
+static void gp8psk_info(struct dvb_usb_device *d)
+{
+        u8 fpga_vers, fw_vers[6];
+
+        if (!gp8psk_get_fw_version(d, fw_vers))
+                info("FW Version = %i.%02i.%i (0x%x)  Build %4i/%02i/%02i",
+                fw_vers[2], fw_vers[1], fw_vers[0], GP8PSK_FW_VERS(fw_vers),
+                2000 + fw_vers[5], fw_vers[4], fw_vers[3]);
+        else
+                info("failed to get FW version");
+
+        if (!gp8psk_get_fpga_version(d, &fpga_vers))
+                info("FPGA Version = %i", fpga_vers);
+        else
+                info("failed to get FPGA version");
+}
+
 static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
 {
         int ret;
@@ -143,6 +161,11 @@ static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
                         err("failed to load bcm4500 firmware.");
                         goto out_free;
                 }
+                if (buflen > 64) {
+                        err("firmare chunk size bigger than 64 bytes.");
+                        goto out_free;
+                }
+
                 memcpy(buf, ptr, buflen);
                 if (dvb_usb_generic_write(d, buf, buflen)) {
                         err("failed to load bcm4500 firmware.");
@@ -206,10 +229,13 @@ static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
         return 0;
 }
 
-int gp8psk_bcm4500_reload(struct dvb_usb_device *d)
+static int gp8psk_bcm4500_reload(struct dvb_usb_device *d)
 {
         u8 buf;
         int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct);
+
+        deb_xfer("reloading firmware\n");
+
         /* Turn off 8psk power */
         if (gp8psk_usb_in_op(d, BOOT_8PSK, 0, 0, &buf, 1))
                 return -EINVAL;
@@ -228,9 +254,47 @@ static int gp8psk_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
         return gp8psk_usb_out_op(adap->dev, ARM_TRANSFER, onoff, 0 , NULL, 0);
 }
 
+/* Callbacks for gp8psk-fe.c */
+
+static int gp8psk_fe_in(void *priv, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
+{
+        struct dvb_usb_device *d = priv;
+
+        return gp8psk_usb_in_op(d, req, value, index, b, blen);
+}
+
+static int gp8psk_fe_out(void *priv, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
+{
+        struct dvb_usb_device *d = priv;
+
+        return gp8psk_usb_out_op(d, req, value, index, b, blen);
+}
+
+static int gp8psk_fe_reload(void *priv)
+{
+        struct dvb_usb_device *d = priv;
+
+        return gp8psk_bcm4500_reload(d);
+}
+
+const struct gp8psk_fe_ops gp8psk_fe_ops = {
+        .in = gp8psk_fe_in,
+        .out = gp8psk_fe_out,
+        .reload = gp8psk_fe_reload,
+};
+
 static int gp8psk_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        adap->fe_adap[0].fe = gp8psk_fe_attach(adap->dev);
+        struct dvb_usb_device *d = adap->dev;
+        int id = le16_to_cpu(d->udev->descriptor.idProduct);
+        int is_rev1;
+
+        is_rev1 = (id == USB_PID_GENPIX_8PSK_REV_1_WARM) ? true : false;
+
+        adap->fe_adap[0].fe = dvb_attach(gp8psk_fe_attach,
+                                         &gp8psk_fe_ops, d, is_rev1);
         return 0;
 }
 
@@ -265,6 +329,8 @@ static struct dvb_usb_device_properties gp8psk_properties = {
         .usb_ctrl = CYPRESS_FX2,
         .firmware = "dvb-usb-gp8psk-01.fw",
 
+        .size_of_priv = sizeof(struct gp8psk_state),
+
         .num_adapters = 1,
         .adapter = {
                 {
diff --git a/drivers/media/usb/dvb-usb/gp8psk.h b/drivers/media/usb/dvb-usb/gp8psk.h
index ed32b9da4843..d8975b866dee 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.h
+++ b/drivers/media/usb/dvb-usb/gp8psk.h
@@ -24,58 +24,6 @@ extern int dvb_usb_gp8psk_debug;
 #define deb_info(args...) dprintk(dvb_usb_gp8psk_debug,0x01,args)
 #define deb_xfer(args...) dprintk(dvb_usb_gp8psk_debug,0x02,args)
 #define deb_rc(args...)   dprintk(dvb_usb_gp8psk_debug,0x04,args)
-#define deb_fe(args...)   dprintk(dvb_usb_gp8psk_debug,0x08,args)
-
-/* Twinhan Vendor requests */
-#define TH_COMMAND_IN                     0xC0
-#define TH_COMMAND_OUT                    0xC1
-
-/* gp8psk commands */
-
-#define GET_8PSK_CONFIG                 0x80    /* in */
-#define SET_8PSK_CONFIG                 0x81
-#define I2C_WRITE                       0x83
-#define I2C_READ                        0x84
-#define ARM_TRANSFER                    0x85
-#define TUNE_8PSK                       0x86
-#define GET_SIGNAL_STRENGTH             0x87    /* in */
-#define LOAD_BCM4500                    0x88
-#define BOOT_8PSK                       0x89    /* in */
-#define START_INTERSIL                  0x8A    /* in */
-#define SET_LNB_VOLTAGE                 0x8B
-#define SET_22KHZ_TONE                  0x8C
-#define SEND_DISEQC_COMMAND             0x8D
-#define SET_DVB_MODE                    0x8E
-#define SET_DN_SWITCH                   0x8F
-#define GET_SIGNAL_LOCK                 0x90    /* in */
-#define GET_FW_VERS                     0x92
-#define GET_SERIAL_NUMBER               0x93    /* in */
-#define USE_EXTRA_VOLT                  0x94
-#define GET_FPGA_VERS                   0x95
-#define CW3K_INIT                       0x9d
-
-/* PSK_configuration bits */
-#define bm8pskStarted                   0x01
-#define bm8pskFW_Loaded                 0x02
-#define bmIntersilOn                    0x04
-#define bmDVBmode                       0x08
-#define bm22kHz                         0x10
-#define bmSEL18V                        0x20
-#define bmDCtuned                       0x40
-#define bmArmed                         0x80
-
-/* Satellite modulation modes */
-#define ADV_MOD_DVB_QPSK 0     /* DVB-S QPSK */
-#define ADV_MOD_TURBO_QPSK 1   /* Turbo QPSK */
-#define ADV_MOD_TURBO_8PSK 2   /* Turbo 8PSK (also used for Trellis 8PSK) */
-#define ADV_MOD_TURBO_16QAM 3  /* Turbo 16QAM (also used for Trellis 8PSK) */
-
-#define ADV_MOD_DCII_C_QPSK 4  /* Digicipher II Combo */
-#define ADV_MOD_DCII_I_QPSK 5  /* Digicipher II I-stream */
-#define ADV_MOD_DCII_Q_QPSK 6  /* Digicipher II Q-stream */
-#define ADV_MOD_DCII_C_OQPSK 7 /* Digicipher II offset QPSK */
-#define ADV_MOD_DSS_QPSK 8     /* DSS (DIRECTV) QPSK */
-#define ADV_MOD_DVB_BPSK 9     /* DVB-S BPSK */
 
 #define GET_USB_SPEED                     0x07
 
@@ -86,15 +34,4 @@ extern int dvb_usb_gp8psk_debug;
 #define PRODUCT_STRING_READ               0x0D
 #define FW_BCD_VERSION_READ               0x14
 
-/* firmware revision id's */
-#define GP8PSK_FW_REV1                  0x020604
-#define GP8PSK_FW_REV2                  0x020704
-#define GP8PSK_FW_VERS(_fw_vers)        ((_fw_vers)[2]<<0x10 | (_fw_vers)[1]<<0x08 | (_fw_vers)[0])
-
-extern struct dvb_frontend * gp8psk_fe_attach(struct dvb_usb_device *d);
-extern int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen);
-extern int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
-                             u16 index, u8 *b, int blen);
-extern int gp8psk_bcm4500_reload(struct dvb_usb_device *d);
-
 #endif
diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
index fc7569e2728d..1babd3341910 100644
--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
@@ -74,22 +74,31 @@ static struct rc_map_table rc_map_haupp_table[] = {
  */
 static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
-        u8 key[5],cmd[2] = { DIBUSB_REQ_POLL_REMOTE, 0x35 }, data,toggle,custom;
+        u8 *buf, data, toggle, custom;
         u16 raw;
-        int i;
+        int i, ret;
         struct dibusb_device_state *st = d->priv;
 
-        dvb_usb_generic_rw(d,cmd,2,key,5,0);
+        buf = kmalloc(5, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = DIBUSB_REQ_POLL_REMOTE;
+        buf[1] = 0x35;
+        ret = dvb_usb_generic_rw(d, buf, 2, buf, 5, 0);
+        if (ret < 0)
+                goto ret;
 
         *state = REMOTE_NO_KEY_PRESSED;
-        switch (key[0]) {
+        switch (buf[0]) {
                 case DIBUSB_RC_HAUPPAUGE_KEY_PRESSED:
-                        raw = ((key[1] << 8) | key[2]) >> 3;
+                        raw = ((buf[1] << 8) | buf[2]) >> 3;
                         toggle = !!(raw & 0x800);
                         data = raw & 0x3f;
                         custom = (raw >> 6) & 0x1f;
 
-                        deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n",key[1],key[2],key[3],custom,data,toggle);
+                        deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n",
+                               buf[1], buf[2], buf[3], custom, data, toggle);
 
                         for (i = 0; i < ARRAY_SIZE(rc_map_haupp_table); i++) {
                                 if (rc5_data(&rc_map_haupp_table[i]) == data &&
@@ -117,7 +126,9 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
                         break;
         }
 
-        return 0;
+ret:
+        kfree(buf);
+        return ret;
 }
 
 static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c
index c05de1b088a4..07fa08be9e99 100644
--- a/drivers/media/usb/dvb-usb/pctv452e.c
+++ b/drivers/media/usb/dvb-usb/pctv452e.c
@@ -97,48 +97,53 @@ struct pctv452e_state {
         u8 c;      /* transaction counter, wraps around...  */
         u8 initialized; /* set to 1 if 0x15 has been sent */
         u16 last_rc_key;
+
+        unsigned char data[80];
 };
 
 static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data,
                          unsigned int write_len, unsigned int read_len)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 buf[64];
         u8 id;
         unsigned int rlen;
         int ret;
 
-        BUG_ON(NULL == data && 0 != (write_len | read_len));
-        BUG_ON(write_len > 64 - 4);
-        BUG_ON(read_len > 64 - 4);
+        if (!data || (write_len > 64 - 4) || (read_len > 64 - 4)) {
+                err("%s: transfer data invalid", __func__);
+                return -EIO;
+        }
 
+        mutex_lock(&state->ca_mutex);
         id = state->c++;
 
-        buf[0] = SYNC_BYTE_OUT;
-        buf[1] = id;
-        buf[2] = cmd;
-        buf[3] = write_len;
+        state->data[0] = SYNC_BYTE_OUT;
+        state->data[1] = id;
+        state->data[2] = cmd;
+        state->data[3] = write_len;
 
-        memcpy(buf + 4, data, write_len);
+        memcpy(state->data + 4, data, write_len);
 
         rlen = (read_len > 0) ? 64 : 0;
-        ret = dvb_usb_generic_rw(d, buf, 4 + write_len,
-                                  buf, rlen, /* delay_ms */ 0);
+        ret = dvb_usb_generic_rw(d, state->data, 4 + write_len,
+                                  state->data, rlen, /* delay_ms */ 0);
         if (0 != ret)
                 goto failed;
 
         ret = -EIO;
-        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
+        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
                 goto failed;
 
-        memcpy(data, buf + 4, read_len);
+        memcpy(data, state->data + 4, read_len);
 
+        mutex_unlock(&state->ca_mutex);
         return 0;
 
 failed:
         err("CI error %d; %02X %02X %02X -> %*ph.",
-             ret, SYNC_BYTE_OUT, id, cmd, 3, buf);
+             ret, SYNC_BYTE_OUT, id, cmd, 3, state->data);
 
+        mutex_unlock(&state->ca_mutex);
         return ret;
 }
 
@@ -405,52 +410,53 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr,
                                 u8 *rcv_buf, u8 rcv_len)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 buf[64];
         u8 id;
         int ret;
 
+        mutex_lock(&state->ca_mutex);
         id = state->c++;
 
         ret = -EINVAL;
         if (snd_len > 64 - 7 || rcv_len > 64 - 7)
                 goto failed;
 
-        buf[0] = SYNC_BYTE_OUT;
-        buf[1] = id;
-        buf[2] = PCTV_CMD_I2C;
-        buf[3] = snd_len + 3;
-        buf[4] = addr << 1;
-        buf[5] = snd_len;
-        buf[6] = rcv_len;
+        state->data[0] = SYNC_BYTE_OUT;
+        state->data[1] = id;
+        state->data[2] = PCTV_CMD_I2C;
+        state->data[3] = snd_len + 3;
+        state->data[4] = addr << 1;
+        state->data[5] = snd_len;
+        state->data[6] = rcv_len;
 
-        memcpy(buf + 7, snd_buf, snd_len);
+        memcpy(state->data + 7, snd_buf, snd_len);
 
-        ret = dvb_usb_generic_rw(d, buf, 7 + snd_len,
-                                  buf, /* rcv_len */ 64,
+        ret = dvb_usb_generic_rw(d, state->data, 7 + snd_len,
+                                  state->data, /* rcv_len */ 64,
                                   /* delay_ms */ 0);
         if (ret < 0)
                 goto failed;
 
         /* TT USB protocol error. */
         ret = -EIO;
-        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
+        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
                 goto failed;
 
         /* I2C device didn't respond as expected. */
         ret = -EREMOTEIO;
-        if (buf[5] < snd_len || buf[6] < rcv_len)
+        if (state->data[5] < snd_len || state->data[6] < rcv_len)
                 goto failed;
 
-        memcpy(rcv_buf, buf + 7, rcv_len);
+        memcpy(rcv_buf, state->data + 7, rcv_len);
+        mutex_unlock(&state->ca_mutex);
 
         return rcv_len;
 
 failed:
-        err("I2C error %d; %02X %02X  %02X %02X %02X -> "
-             "%02X %02X  %02X %02X %02X.",
+        err("I2C error %d; %02X %02X  %02X %02X %02X -> %*ph",
              ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len,
-             buf[0], buf[1], buf[4], buf[5], buf[6]);
+             7, state->data);
 
+        mutex_unlock(&state->ca_mutex);
         return ret;
 }
 
@@ -499,8 +505,7 @@ static u32 pctv452e_i2c_func(struct i2c_adapter *adapter)
 static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 b0[] = { 0xaa, 0, PCTV_CMD_RESET, 1, 0 };
-        u8 rx[PCTV_ANSWER_LEN];
+        u8 *rx;
         int ret;
 
         info("%s: %d\n", __func__, i);
@@ -511,6 +516,11 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
         if (state->initialized)
                 return 0;
 
+        rx = kmalloc(PCTV_ANSWER_LEN, GFP_KERNEL);
+        if (!rx)
+                return -ENOMEM;
+
+        mutex_lock(&state->ca_mutex);
         /* hmm where shoud this should go? */
         ret = usb_set_interface(d->udev, 0, ISOC_INTERFACE_ALTERNATIVE);
         if (ret != 0)
@@ -518,65 +528,75 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
                         __func__, ret);
 
         /* this is a one-time initialization, dont know where to put */
-        b0[1] = state->c++;
+        state->data[0] = 0xaa;
+        state->data[1] = state->c++;
+        state->data[2] = PCTV_CMD_RESET;
+        state->data[3] = 1;
+        state->data[4] = 0;
         /* reset board */
-        ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
         if (ret)
-                return ret;
+                goto ret;
 
-        b0[1] = state->c++;
-        b0[4] = 1;
+        state->data[1] = state->c++;
+        state->data[4] = 1;
         /* reset board (again?) */
-        ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
         if (ret)
-                return ret;
+                goto ret;
 
         state->initialized = 1;
 
-        return 0;
+ret:
+        mutex_unlock(&state->ca_mutex);
+        kfree(rx);
+        return ret;
 }
 
 static int pctv452e_rc_query(struct dvb_usb_device *d)
 {
         struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 b[CMD_BUFFER_SIZE];
-        u8 rx[PCTV_ANSWER_LEN];
         int ret, i;
-        u8 id = state->c++;
+        u8 id;
+
+        mutex_lock(&state->ca_mutex);
+        id = state->c++;
 
         /* prepare command header  */
-        b[0] = SYNC_BYTE_OUT;
-        b[1] = id;
-        b[2] = PCTV_CMD_IR;
-        b[3] = 0;
+        state->data[0] = SYNC_BYTE_OUT;
+        state->data[1] = id;
+        state->data[2] = PCTV_CMD_IR;
+        state->data[3] = 0;
 
         /* send ir request */
-        ret = dvb_usb_generic_rw(d, b, 4, rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 4,
+                                 state->data, PCTV_ANSWER_LEN, 0);
         if (ret != 0)
-                return ret;
+                goto ret;
 
         if (debug > 3) {
-                info("%s: read: %2d: %*ph: ", __func__, ret, 3, rx);
-                for (i = 0; (i < rx[3]) && ((i+3) < PCTV_ANSWER_LEN); i++)
-                        info(" %02x", rx[i+3]);
+                info("%s: read: %2d: %*ph: ", __func__, ret, 3, state->data);
+                for (i = 0; (i < state->data[3]) && ((i + 3) < PCTV_ANSWER_LEN); i++)
+                        info(" %02x", state->data[i + 3]);
 
                 info("\n");
         }
 
-        if ((rx[3] == 9) &&  (rx[12] & 0x01)) {
+        if ((state->data[3] == 9) &&  (state->data[12] & 0x01)) {
                 /* got a "press" event */
-                state->last_rc_key = RC_SCANCODE_RC5(rx[7], rx[6]);
+                state->last_rc_key = RC_SCANCODE_RC5(state->data[7], state->data[6]);
                 if (debug > 2)
                         info("%s: cmd=0x%02x sys=0x%02x\n",
-                                __func__, rx[6], rx[7]);
+                                __func__, state->data[6], state->data[7]);
 
                 rc_keydown(d->rc_dev, RC_TYPE_RC5, state->last_rc_key, 0);
         } else if (state->last_rc_key) {
                 rc_keyup(d->rc_dev);
                 state->last_rc_key = 0;
         }
-
-        return 0;
+ret:
+        mutex_unlock(&state->ca_mutex);
+        return ret;
 }
 
 static int pctv452e_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
index d9f3262bf071..4706628a3ed5 100644
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -89,9 +89,13 @@ struct technisat_usb2_state {
 static int technisat_usb2_i2c_access(struct usb_device *udev,
                 u8 device_addr, u8 *tx, u8 txlen, u8 *rx, u8 rxlen)
 {
-        u8 b[64];
+        u8 *b;
         int ret, actual_length;
 
+        b = kmalloc(64, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
         deb_i2c("i2c-access: %02x, tx: ", device_addr);
         debug_dump(tx, txlen, deb_i2c);
         deb_i2c(" ");
@@ -123,7 +127,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
 
         if (ret < 0) {
                 err("i2c-error: out failed %02x = %d", device_addr, ret);
-                return -ENODEV;
+                goto err;
         }
 
         ret = usb_bulk_msg(udev,
@@ -131,7 +135,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
                         b, 64, &actual_length, 1000);
         if (ret < 0) {
                 err("i2c-error: in failed %02x = %d", device_addr, ret);
-                return -ENODEV;
+                goto err;
         }
 
         if (b[0] != I2C_STATUS_OK) {
@@ -140,7 +144,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
                 if (!(b[0] == I2C_STATUS_NAK &&
                                 device_addr == 0x60
                                 /* && device_is_technisat_usb2 */))
-                        return -ENODEV;
+                        goto err;
         }
 
         deb_i2c("status: %d, ", b[0]);
@@ -154,7 +158,9 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
 
         deb_i2c("\n");
 
-        return 0;
+err:
+        kfree(b);
+        return ret;
 }
 
 static int technisat_usb2_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index c3a0e87066eb..f7bb78c1873c 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1901,19 +1901,30 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request,
                              s32 TransferBufferLength, int bOut)
 {
         int r;
+        unsigned char *buf;
+
+        buf = kmalloc(TransferBufferLength, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         if (!bOut) {
                 r = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                                     Request,
                                     USB_TYPE_VENDOR | USB_RECIP_DEVICE |
                                     USB_DIR_IN,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                     TransferBufferLength, HZ * 5);
+
+                if (r >= 0)
+                        memcpy(TransferBuffer, buf, TransferBufferLength);
         } else {
+                memcpy(buf, TransferBuffer, TransferBufferLength);
                 r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                                     Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                     TransferBufferLength, HZ * 5);
         }
+        kfree(buf);
         return r;
 }
 
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index db200c9d796d..22a9aae16291 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -147,20 +147,26 @@ int stk_camera_write_reg(struct stk_camera *dev, u16 index, u8 value)
 int stk_camera_read_reg(struct stk_camera *dev, u16 index, int *value)
 {
         struct usb_device *udev = dev->udev;
+        unsigned char *buf;
         int ret;
 
+        buf = kmalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                         0x00,
                         USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                         0x00,
                         index,
-                        (u8 *) value,
+                        buf,
                         sizeof(u8),
                         500);
-        if (ret < 0)
-                return ret;
-        else
-                return 0;
+        if (ret >= 0)
+                memcpy(value, buf, sizeof(u8));
+
+        kfree(buf);
+        return ret;
 }
 
 static int stk_start_stream(struct stk_camera *dev)
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index e9e6ea3ab73c..75b9d4ac8b1e 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
 
         ret = 0;
         bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
-        if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+        if (bytes_recv < if_version_length) {
                 dev_err(bus->dev, "Could not read IF version\n");
                 ret = -EIO;
                 goto err;
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index 5a8dc5a76e0d..3678220964fe 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -2347,7 +2347,7 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
         struct mmc_test_req *rq = mmc_test_req_alloc();
         struct mmc_host *host = test->card->host;
         struct mmc_test_area *t = &test->area;
-        struct mmc_async_req areq;
+        struct mmc_test_async_req test_areq = { .test = test };
         struct mmc_request *mrq;
         unsigned long timeout;
         bool expired = false;
@@ -2363,8 +2363,8 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
                 mrq->sbc = &rq->sbc;
         mrq->cap_cmd_during_tfr = true;
 
-        areq.mrq = mrq;
-        areq.err_check = mmc_test_check_result_async;
+        test_areq.areq.mrq = mrq;
+        test_areq.areq.err_check = mmc_test_check_result_async;
 
         mmc_test_prepare_mrq(test, mrq, t->sg, t->sg_len, dev_addr, t->blocks,
                              512, write);
@@ -2378,7 +2378,7 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
 
         /* Start ongoing data request */
         if (use_areq) {
-                mmc_start_req(host, &areq, &ret);
+                mmc_start_req(host, &test_areq.areq, &ret);
                 if (ret)
                         goto out_free;
         } else {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 39fc5b2b96c5..df19777068a6 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -26,6 +26,8 @@
 #include "mmc_ops.h"
 #include "sd_ops.h"
 
+#define DEFAULT_CMD6_TIMEOUT_MS 500
+
 static const unsigned int tran_exp[] = {
         10000,          100000,         1000000,        10000000,
         0,              0,              0,              0
@@ -571,6 +573,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
                 card->erased_byte = 0x0;
 
         /* eMMC v4.5 or later */
+        card->ext_csd.generic_cmd6_time = DEFAULT_CMD6_TIMEOUT_MS;
         if (card->ext_csd.rev >= 6) {
                 card->ext_csd.feature_support |= MMC_DISCARD_FEATURE;
 
diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c0bb0c793e84..dbbc4303bdd0 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -46,12 +46,13 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
         host->pdata = pdev->dev.platform_data;
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        /* Get registers' physical base address */
-        host->phy_regs = regs->start;
         host->regs = devm_ioremap_resource(&pdev->dev, regs);
         if (IS_ERR(host->regs))
                 return PTR_ERR(host->regs);
 
+        /* Get registers' physical base address */
+        host->phy_regs = regs->start;
+
         platform_set_drvdata(pdev, host);
         return dw_mci_probe(host);
 }
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 4fcbc4012ed0..50a674be6655 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2940,7 +2940,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
                 return ERR_PTR(-ENOMEM);
 
         /* find reset controller when exist */
-        pdata->rstc = devm_reset_control_get_optional(dev, NULL);
+        pdata->rstc = devm_reset_control_get_optional(dev, "reset");
         if (IS_ERR(pdata->rstc)) {
                 if (PTR_ERR(pdata->rstc) == -EPROBE_DEFER)
                         return ERR_PTR(-EPROBE_DEFER);
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index d839147e591d..44ecebd1ea8c 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -661,13 +661,13 @@ static int mxs_mmc_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, mmc);
 
+        spin_lock_init(&host->lock);
+
         ret = devm_request_irq(&pdev->dev, irq_err, mxs_mmc_irq_handler, 0,
                                dev_name(&pdev->dev), host);
         if (ret)
                 goto out_free_dma;
 
-        spin_lock_init(&host->lock);
-
         ret = mmc_add_host(mmc);
         if (ret)
                 goto out_free_dma;
diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 8ef44a2a2fd9..90ed2e12d345 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -647,6 +647,7 @@ static int sdhci_msm_probe(struct platform_device *pdev)
         if (msm_host->pwr_irq < 0) {
                 dev_err(&pdev->dev, "Get pwr_irq failed (%d)\n",
                         msm_host->pwr_irq);
+                ret = msm_host->pwr_irq;
                 goto clk_disable;
         }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 71654b90227f..42ef3ebb1d8c 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2086,6 +2086,10 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
 
                 if (!host->tuning_done) {
                         pr_info(DRIVER_NAME ": Timeout waiting for Buffer Read Ready interrupt during tuning procedure, falling back to fixed sampling clock\n");
+
+                        sdhci_do_reset(host, SDHCI_RESET_CMD);
+                        sdhci_do_reset(host, SDHCI_RESET_DATA);
+
                         ctrl = sdhci_readw(host, SDHCI_HOST_CONTROL2);
                         ctrl &= ~SDHCI_CTRL_TUNED_CLK;
                         ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
@@ -2286,10 +2290,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
 
         for (i = 0; i < SDHCI_MAX_MRQS; i++) {
                 mrq = host->mrqs_done[i];
-                if (mrq) {
-                        host->mrqs_done[i] = NULL;
+                if (mrq)
                         break;
-                }
         }
 
         if (!mrq) {
@@ -2320,6 +2322,17 @@ static bool sdhci_request_done(struct sdhci_host *host)
          * upon error conditions.
          */
         if (sdhci_needs_reset(host, mrq)) {
+                /*
+                 * Do not finish until command and data lines are available for
+                 * reset. Note there can only be one other mrq, so it cannot
+                 * also be in mrqs_done, otherwise host->cmd and host->data_cmd
+                 * would both be null.
+                 */
+                if (host->cmd || host->data_cmd) {
+                        spin_unlock_irqrestore(&host->lock, flags);
+                        return true;
+                }
+
                 /* Some controllers need this kick or reset won't work here */
                 if (host->quirks & SDHCI_QUIRK_CLOCK_BEFORE_RESET)
                         /* This is to force an update */
@@ -2327,10 +2340,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
 
                 /* Spec says we should do both at the same time, but Ricoh
                    controllers do not like that. */
-                if (!host->cmd)
-                        sdhci_do_reset(host, SDHCI_RESET_CMD);
-                if (!host->data_cmd)
-                        sdhci_do_reset(host, SDHCI_RESET_DATA);
+                sdhci_do_reset(host, SDHCI_RESET_CMD);
+                sdhci_do_reset(host, SDHCI_RESET_DATA);
 
                 host->pending_reset = false;
         }
@@ -2338,6 +2349,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
         if (!sdhci_has_requests(host))
                 sdhci_led_deactivate(host);
 
+        host->mrqs_done[i] = NULL;
+
         mmiowb();
         spin_unlock_irqrestore(&host->lock, flags);
 
@@ -2512,9 +2525,6 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
         if (!host->data) {
                 struct mmc_command *data_cmd = host->data_cmd;
 
-                if (data_cmd)
-                        host->data_cmd = NULL;
-
                 /*
                  * The "data complete" interrupt is also used to
                  * indicate that a busy state has ended. See comment
@@ -2522,11 +2532,13 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
                  */
                 if (data_cmd && (data_cmd->flags & MMC_RSP_BUSY)) {
                         if (intmask & SDHCI_INT_DATA_TIMEOUT) {
+                                host->data_cmd = NULL;
                                 data_cmd->error = -ETIMEDOUT;
                                 sdhci_finish_mrq(host, data_cmd->mrq);
                                 return;
                         }
                         if (intmask & SDHCI_INT_DATA_END) {
+                                host->data_cmd = NULL;
                                 /*
                                  * Some cards handle busy-end interrupt
                                  * before the command completed, so make
@@ -2912,6 +2924,10 @@ int sdhci_runtime_resume_host(struct sdhci_host *host)
                 spin_unlock_irqrestore(&host->lock, flags);
         }
 
+        if ((mmc->caps2 & MMC_CAP2_HS400_ES) &&
+            mmc->ops->hs400_enhanced_strobe)
+                mmc->ops->hs400_enhanced_strobe(mmc, &mmc->ios);
+
         spin_lock_irqsave(&host->lock, flags);
 
         host->runtime_suspended = false;
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
index 0f68a99fc4ad..141bd70a49c2 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
@@ -161,7 +161,7 @@ int gpmi_init(struct gpmi_nand_data *this)
 
         ret = gpmi_enable_clk(this);
         if (ret)
-                goto err_out;
+                return ret;
         ret = gpmi_reset_block(r->gpmi_regs, false);
         if (ret)
                 goto err_out;
@@ -197,6 +197,7 @@ int gpmi_init(struct gpmi_nand_data *this)
         gpmi_disable_clk(this);
         return 0;
 err_out:
+        gpmi_disable_clk(this);
         return ret;
 }
 
@@ -270,7 +271,7 @@ int bch_set_geometry(struct gpmi_nand_data *this)
 
         ret = gpmi_enable_clk(this);
         if (ret)
-                goto err_out;
+                return ret;
 
         /*
         * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
@@ -308,6 +309,7 @@ int bch_set_geometry(struct gpmi_nand_data *this)
         gpmi_disable_clk(this);
         return 0;
 err_out:
+        gpmi_disable_clk(this);
         return ret;
 }
 
diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
index d54f666417e1..dbf256217b3e 100644
--- a/drivers/mtd/nand/mtk_ecc.c
+++ b/drivers/mtd/nand/mtk_ecc.c
@@ -86,6 +86,8 @@ struct mtk_ecc {
         struct completion done;
         struct mutex lock;
         u32 sectors;
+
+        u8 eccdata[112];
 };
 
 static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
@@ -366,9 +368,8 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
                    u8 *data, u32 bytes)
 {
         dma_addr_t addr;
-        u8 *p;
-        u32 len, i, val;
-        int ret = 0;
+        u32 len;
+        int ret;
 
         addr = dma_map_single(ecc->dev, data, bytes, DMA_TO_DEVICE);
         ret = dma_mapping_error(ecc->dev, addr);
@@ -393,14 +394,12 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
 
         /* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
         len = (config->strength * ECC_PARITY_BITS + 7) >> 3;
-        p = data + bytes;
 
-        /* write the parity bytes generated by the ECC back to the OOB region */
-        for (i = 0; i < len; i++) {
-                if ((i % 4) == 0)
-                        val = readl(ecc->regs + ECC_ENCPAR(i / 4));
-                p[i] = (val >> ((i % 4) * 8)) & 0xff;
-        }
+        /* write the parity bytes generated by the ECC back to temp buffer */
+        __ioread32_copy(ecc->eccdata, ecc->regs + ECC_ENCPAR(0), round_up(len, 4));
+
+        /* copy into possibly unaligned OOB region with actual length */
+        memcpy(data + bytes, ecc->eccdata, len);
 timeout:
 
         dma_unmap_single(ecc->dev, addr, bytes, DMA_TO_DEVICE);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index e5718e5ecf92..3bde96a3f7bf 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1095,10 +1095,11 @@ static void nand_release_data_interface(struct nand_chip *chip)
 /**
  * nand_reset - Reset and initialize a NAND device
  * @chip: The NAND chip
+ * @chipnr: Internal die id
  *
  * Returns 0 for success or negative error code otherwise
  */
-int nand_reset(struct nand_chip *chip)
+int nand_reset(struct nand_chip *chip, int chipnr)
 {
         struct mtd_info *mtd = nand_to_mtd(chip);
         int ret;
@@ -1107,9 +1108,17 @@ int nand_reset(struct nand_chip *chip)
         if (ret)
                 return ret;
 
+        /*
+         * The CS line has to be released before we can apply the new NAND
+         * interface settings, hence this weird ->select_chip() dance.
+         */
+        chip->select_chip(mtd, chipnr);
         chip->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
+        chip->select_chip(mtd, -1);
 
+        chip->select_chip(mtd, chipnr);
         ret = nand_setup_data_interface(chip);
+        chip->select_chip(mtd, -1);
         if (ret)
                 return ret;
 
@@ -1185,8 +1194,6 @@ int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         /* Shift to get chip number */
         chipnr = ofs >> chip->chip_shift;
 
-        chip->select_chip(mtd, chipnr);
-
         /*
          * Reset the chip.
          * If we want to check the WP through READ STATUS and check the bit 7
@@ -1194,7 +1201,9 @@ int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
          * some operation can also clear the bit 7 of status register
          * eg. erase/program a locked block
          */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+
+        chip->select_chip(mtd, chipnr);
 
         /* Check, if it is write protected */
         if (nand_check_wp(mtd)) {
@@ -1244,8 +1253,6 @@ int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         /* Shift to get chip number */
         chipnr = ofs >> chip->chip_shift;
 
-        chip->select_chip(mtd, chipnr);
-
         /*
          * Reset the chip.
          * If we want to check the WP through READ STATUS and check the bit 7
@@ -1253,7 +1260,9 @@ int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
          * some operation can also clear the bit 7 of status register
          * eg. erase/program a locked block
          */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+
+        chip->select_chip(mtd, chipnr);
 
         /* Check, if it is write protected */
         if (nand_check_wp(mtd)) {
@@ -2940,10 +2949,6 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
         }
 
         chipnr = (int)(to >> chip->chip_shift);
-        chip->select_chip(mtd, chipnr);
-
-        /* Shift to get page */
-        page = (int)(to >> chip->page_shift);
 
         /*
          * Reset the chip. Some chips (like the Toshiba TC5832DC found in one
@@ -2951,7 +2956,12 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
          * if we don't do this. I have no clue why, but I seem to have 'fixed'
          * it in the doc2000 driver in August 1999.  dwmw2.
          */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+
+        chip->select_chip(mtd, chipnr);
+
+        /* Shift to get page */
+        page = (int)(to >> chip->page_shift);
 
         /* Check, if it is write protected */
         if (nand_check_wp(mtd)) {
@@ -3984,14 +3994,14 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
         int i, maf_idx;
         u8 id_data[8];
 
-        /* Select the device */
-        chip->select_chip(mtd, 0);
-
         /*
          * Reset the chip, required by some chips (e.g. Micron MT29FxGxxxxx)
          * after power-up.
          */
-        nand_reset(chip);
+        nand_reset(chip, 0);
+
+        /* Select the device */
+        chip->select_chip(mtd, 0);
 
         /* Send the command for reading device ID */
         chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
@@ -4329,17 +4339,31 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
                 return PTR_ERR(type);
         }
 
+        /* Initialize the ->data_interface field. */
         ret = nand_init_data_interface(chip);
         if (ret)
                 return ret;
 
+        /*
+         * Setup the data interface correctly on the chip and controller side.
+         * This explicit call to nand_setup_data_interface() is only required
+         * for the first die, because nand_reset() has been called before
+         * ->data_interface and ->default_onfi_timing_mode were set.
+         * For the other dies, nand_reset() will automatically switch to the
+         * best mode for us.
+         */
+        ret = nand_setup_data_interface(chip);
+        if (ret)
+                return ret;
+
         chip->select_chip(mtd, -1);
 
         /* Check for a chip array */
         for (i = 1; i < maxchips; i++) {
-                chip->select_chip(mtd, i);
                 /* See comment in nand_get_flash_type for reset */
-                nand_reset(chip);
+                nand_reset(chip, i);
+
+                chip->select_chip(mtd, i);
                 /* Send the command for reading device ID */
                 chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
                 /* Read manufacturer and device IDs */
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 3eb7430dffbf..f8ff25c8ee2e 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -142,6 +142,9 @@ struct plx_pci_card {
 #define CTI_PCI_VENDOR_ID               0x12c4
 #define CTI_PCI_DEVICE_ID_CRG001        0x0900
 
+#define MOXA_PCI_VENDOR_ID              0x1393
+#define MOXA_PCI_DEVICE_ID              0x0100
+
 static void plx_pci_reset_common(struct pci_dev *pdev);
 static void plx9056_pci_reset_common(struct pci_dev *pdev);
 static void plx_pci_reset_marathon_pci(struct pci_dev *pdev);
@@ -258,6 +261,14 @@ static struct plx_pci_card_info plx_pci_card_info_elcus = {
         /* based on PLX9030 */
 };
 
+static struct plx_pci_card_info plx_pci_card_info_moxa = {
+        "MOXA", 2,
+        PLX_PCI_CAN_CLOCK, PLX_PCI_OCR, PLX_PCI_CDR,
+        {0, 0x00, 0x00}, { {0, 0x00, 0x80}, {1, 0x00, 0x80} },
+        &plx_pci_reset_common
+         /* based on PLX9052 */
+};
+
 static const struct pci_device_id plx_pci_tbl[] = {
         {
                 /* Adlink PCI-7841/cPCI-7841 */
@@ -357,6 +368,13 @@ static const struct pci_device_id plx_pci_tbl[] = {
                 0, 0,
                 (kernel_ulong_t)&plx_pci_card_info_elcus
         },
+        {
+                /* moxa */
+                MOXA_PCI_VENDOR_ID, MOXA_PCI_DEVICE_ID,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0,
+                (kernel_ulong_t)&plx_pci_card_info_moxa
+        },
         { 0,}
 };
 MODULE_DEVICE_TABLE(pci, plx_pci_tbl);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index c481f104a8fe..5390ae89136c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -204,17 +204,6 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
         return num_msgs;
 }
 
-static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
-{
-        u32 data = 0x7777;
-
-        xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
-}
-
 void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
                             struct xgene_enet_pdata *pdata,
                             enum xgene_enet_err_code status)
@@ -929,5 +918,4 @@ struct xgene_ring_ops xgene_ring1_ops = {
         .clear = xgene_enet_clear_ring,
         .wr_cmd = xgene_enet_wr_cmd,
         .len = xgene_enet_ring_len,
-        .coalesce = xgene_enet_setup_coalescing,
 };
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 8456337a237d..06e598c8bc16 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -55,8 +55,10 @@ enum xgene_enet_rm {
 #define PREFETCH_BUF_EN         BIT(21)
 #define CSR_RING_ID_BUF         0x000c
 #define CSR_PBM_COAL            0x0014
+#define CSR_PBM_CTICK0          0x0018
 #define CSR_PBM_CTICK1          0x001c
 #define CSR_PBM_CTICK2          0x0020
+#define CSR_PBM_CTICK3          0x0024
 #define CSR_THRESHOLD0_SET1     0x0030
 #define CSR_THRESHOLD1_SET1     0x0034
 #define CSR_RING_NE_INT_MODE    0x017c
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 3fc7b0db952b..1352b5245fcc 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1188,7 +1188,8 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
                 tx_ring->dst_ring_num = xgene_enet_dst_ring_num(cp_ring);
         }
 
-        pdata->ring_ops->coalesce(pdata->tx_ring[0]);
+        if (pdata->ring_ops->coalesce)
+                pdata->ring_ops->coalesce(pdata->tx_ring[0]);
         pdata->tx_qcnt_hi = pdata->tx_ring[0]->slots - 128;
 
         return 0;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
index 2b76732add5d..af51dd5844ce 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
@@ -30,7 +30,7 @@ static void xgene_enet_ring_init(struct xgene_enet_desc_ring *ring)
                 ring_cfg[0] |= SET_VAL(X2_INTLINE, ring->id & RING_BUFNUM_MASK);
                 ring_cfg[3] |= SET_BIT(X2_DEQINTEN);
         }
-        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 1);
+        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 2);
 
         addr >>= 8;
         ring_cfg[2] |= QCOHERENT | SET_VAL(RINGADDRL, addr);
@@ -192,13 +192,15 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
 
 static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
 {
-        u32 data = 0x7777;
+        u32 data = 0x77777777;
 
         xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK0, data);
         xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK3, data);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x08);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x10);
 }
 
 struct xgene_ring_ops xgene_ring2_ops = {
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index a29787fbb572..0e066dc6b8cc 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -307,6 +307,10 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
         u32 ctl;
 
         ctl = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_CTL);
+
+        /* preserve ONLY bits 16-17 from current hardware value */
+        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
+
         if (bgmac->feature_flags & BGMAC_FEAT_RX_MASK_SETUP) {
                 ctl &= ~BGMAC_DMA_RX_BL_MASK;
                 ctl |= BGMAC_DMA_RX_BL_128 << BGMAC_DMA_RX_BL_SHIFT;
@@ -317,7 +321,6 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
                 ctl &= ~BGMAC_DMA_RX_PT_MASK;
                 ctl |= BGMAC_DMA_RX_PT_1 << BGMAC_DMA_RX_PT_SHIFT;
         }
-        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
         ctl |= BGMAC_DMA_RX_ENABLE;
         ctl |= BGMAC_DMA_RX_PARITY_DISABLE;
         ctl |= BGMAC_DMA_RX_OVERFLOW_CONT;
@@ -1046,9 +1049,9 @@ static void bgmac_enable(struct bgmac *bgmac)
 
         mode = (bgmac_read(bgmac, BGMAC_DEV_STATUS) & BGMAC_DS_MM_MASK) >>
                 BGMAC_DS_MM_SHIFT;
-        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) || mode != 0)
+        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST || mode != 0)
                 bgmac_set(bgmac, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT);
-        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST && mode == 2)
+        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) && mode == 2)
                 bgmac_cco_ctl_maskset(bgmac, 1, ~0,
                                       BGMAC_CHIPCTL_1_RXC_DLL_BYPASS);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index eab49ff4eecd..7baf30082ab3 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -49,6 +49,7 @@
 #include <linux/firmware.h>
 #include <linux/log2.h>
 #include <linux/aer.h>
+#include <linux/crash_dump.h>
 
 #if IS_ENABLED(CONFIG_CNIC)
 #define BCM_CNIC 1
@@ -4764,15 +4765,16 @@ bnx2_setup_msix_tbl(struct bnx2 *bp)
         BNX2_WR(bp, BNX2_PCI_GRC_WINDOW3_ADDR, BNX2_MSIX_PBA_ADDR);
 }
 
-static int
-bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+static void
+bnx2_wait_dma_complete(struct bnx2 *bp)
 {
         u32 val;
-        int i, rc = 0;
-        u8 old_port;
+        int i;
 
-        /* Wait for the current PCI transaction to complete before
-         * issuing a reset. */
+        /*
+         * Wait for the current PCI transaction to complete before
+         * issuing a reset.
+         */
         if ((BNX2_CHIP(bp) == BNX2_CHIP_5706) ||
             (BNX2_CHIP(bp) == BNX2_CHIP_5708)) {
                 BNX2_WR(bp, BNX2_MISC_ENABLE_CLR_BITS,
@@ -4796,6 +4798,21 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 }
         }
 
+        return;
+}
+
+
+static int
+bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+{
+        u32 val;
+        int i, rc = 0;
+        u8 old_port;
+
+        /* Wait for the current PCI transaction to complete before
+         * issuing a reset. */
+        bnx2_wait_dma_complete(bp);
+
         /* Wait for the firmware to tell us it is ok to issue a reset. */
         bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT0 | reset_code, 1, 1);
 
@@ -6361,6 +6378,10 @@ bnx2_open(struct net_device *dev)
         struct bnx2 *bp = netdev_priv(dev);
         int rc;
 
+        rc = bnx2_request_firmware(bp);
+        if (rc < 0)
+                goto out;
+
         netif_carrier_off(dev);
 
         bnx2_disable_int(bp);
@@ -6429,6 +6450,7 @@ open_err:
         bnx2_free_irq(bp);
         bnx2_free_mem(bp);
         bnx2_del_napi(bp);
+        bnx2_release_firmware(bp);
         goto out;
 }
 
@@ -8571,12 +8593,15 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_set_drvdata(pdev, dev);
 
-        rc = bnx2_request_firmware(bp);
-        if (rc < 0)
-                goto error;
-
+        /*
+         * In-flight DMA from 1st kernel could continue going in kdump kernel.
+         * New io-page table has been created before bnx2 does reset at open stage.
+         * We have to wait for the in-flight DMA to complete to avoid it look up
+         * into the newly created io-page table.
+         */
+        if (is_kdump_kernel())
+                bnx2_wait_dma_complete(bp);
 
-        bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
         memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
@@ -8611,7 +8636,6 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
-        bnx2_release_firmware(bp);
         pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index d313b02485a1..27a2dd917643 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6305,6 +6305,7 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                          struct tc_to_netdev *ntc)
 {
         struct bnxt *bp = netdev_priv(dev);
+        bool sh = false;
         u8 tc;
 
         if (ntc->type != TC_SETUP_MQPRIO)
@@ -6321,12 +6322,11 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
         if (netdev_get_num_tc(dev) == tc)
                 return 0;
 
+        if (bp->flags & BNXT_FLAG_SHARED_RINGS)
+                sh = true;
+
         if (tc) {
                 int max_rx_rings, max_tx_rings, rc;
-                bool sh = false;
-
-                if (bp->flags & BNXT_FLAG_SHARED_RINGS)
-                        sh = true;
 
                 rc = bnxt_get_max_rings(bp, &max_rx_rings, &max_tx_rings, sh);
                 if (rc || bp->tx_nr_rings_per_tc * tc > max_tx_rings)
@@ -6344,7 +6344,8 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                 bp->tx_nr_rings = bp->tx_nr_rings_per_tc;
                 netdev_reset_tc(dev);
         }
-        bp->cp_nr_rings = max_t(int, bp->tx_nr_rings, bp->rx_nr_rings);
+        bp->cp_nr_rings = sh ? max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
+                               bp->tx_nr_rings + bp->rx_nr_rings;
         bp->num_stat_ctxs = bp->cp_nr_rings;
 
         if (netif_running(bp->dev))
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index ec6cd18842c3..60e2af8678bd 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -774,8 +774,8 @@ static int bnxt_vf_set_link(struct bnxt *bp, struct bnxt_vf_info *vf)
 
                 if (vf->flags & BNXT_VF_LINK_UP) {
                         /* if physical link is down, force link up on VF */
-                        if (phy_qcfg_resp.link ==
-                            PORT_PHY_QCFG_RESP_LINK_NO_LINK) {
+                        if (phy_qcfg_resp.link !=
+                            PORT_PHY_QCFG_RESP_LINK_LINK) {
                                 phy_qcfg_resp.link =
                                         PORT_PHY_QCFG_RESP_LINK_LINK;
                                 phy_qcfg_resp.link_speed = cpu_to_le16(
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index b200a783443e..112030828c4b 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -177,6 +177,7 @@ bnad_txcmpl_process(struct bnad *bnad, struct bna_tcb *tcb)
                 return 0;
 
         hw_cons = *(tcb->hw_consumer_index);
+        rmb();
         cons = tcb->consumer_index;
         q_depth = tcb->q_depth;
 
@@ -3094,7 +3095,7 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         BNA_QE_INDX_INC(prod, q_depth);
         tcb->producer_index = prod;
 
-        smp_mb();
+        wmb();
 
         if (unlikely(!test_bit(BNAD_TXQ_TX_STARTED, &tcb->flags)))
                 return NETDEV_TX_OK;
@@ -3102,7 +3103,6 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         skb_tx_timestamp(skb);
 
         bna_txq_prod_indx_doorbell(tcb);
-        smp_mb();
 
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 50812a1d67bd..df1573c4a659 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -178,9 +178,9 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x6005),
         CH_PCI_ID_TABLE_FENTRY(0x6006),
         CH_PCI_ID_TABLE_FENTRY(0x6007),
+        CH_PCI_ID_TABLE_FENTRY(0x6008),
         CH_PCI_ID_TABLE_FENTRY(0x6009),
         CH_PCI_ID_TABLE_FENTRY(0x600d),
-        CH_PCI_ID_TABLE_FENTRY(0x6010),
         CH_PCI_ID_TABLE_FENTRY(0x6011),
         CH_PCI_ID_TABLE_FENTRY(0x6014),
         CH_PCI_ID_TABLE_FENTRY(0x6015),
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index c54c6fac0d1d..b6ed818f78ff 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -332,8 +332,10 @@ struct hnae_handle *hnae_get_handle(struct device *owner_dev,
                 return ERR_PTR(-ENODEV);
 
         handle = dev->ops->get_handle(dev, port_id);
-        if (IS_ERR(handle))
+        if (IS_ERR(handle)) {
+                put_device(&dev->cls_dev);
                 return handle;
+        }
 
         handle->dev = dev;
         handle->owner_dev = owner_dev;
@@ -356,6 +358,8 @@ out_when_init_queue:
         for (j = i - 1; j >= 0; j--)
                 hnae_fini_queue(handle->qs[j]);
 
+        put_device(&dev->cls_dev);
+
         return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL(hnae_get_handle);
@@ -377,6 +381,8 @@ void hnae_put_handle(struct hnae_handle *h)
                 dev->ops->put_handle(h);
 
         module_put(dev->owner);
+
+        put_device(&dev->cls_dev);
 }
 EXPORT_SYMBOL(hnae_put_handle);
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index e9719ba450d7..fa66fa6f8bee 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -2438,6 +2438,8 @@ static int ehea_open(struct net_device *dev)
 
         netif_info(port, ifup, dev, "enabling port\n");
 
+        netif_carrier_off(dev);
+
         ret = ehea_up(dev);
         if (!ret) {
                 port_napi_enable(port);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d54405b46109..1e486d1312e9 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1493,9 +1493,8 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
                     adapter->max_rx_add_entries_per_subcrq > entries_page ?
                     entries_page : adapter->max_rx_add_entries_per_subcrq;
 
-                /* Choosing the maximum number of queues supported by firmware*/
-                adapter->req_tx_queues = adapter->max_tx_queues;
-                adapter->req_rx_queues = adapter->max_rx_queues;
+                adapter->req_tx_queues = adapter->opt_tx_comp_sub_queues;
+                adapter->req_rx_queues = adapter->opt_rx_comp_queues;
                 adapter->req_rx_add_queues = adapter->max_rx_add_queues;
 
                 adapter->req_mtu = adapter->max_mtu;
@@ -3698,7 +3697,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         struct net_device *netdev;
         unsigned char *mac_addr_p;
         struct dentry *ent;
-        char buf[16]; /* debugfs name buf */
+        char buf[17]; /* debugfs name buf */
         int rc;
 
         dev_dbg(&dev->dev, "entering ibmvnic_probe for UA 0x%x\n",
@@ -3837,6 +3836,9 @@ static int ibmvnic_remove(struct vio_dev *dev)
         if (adapter->debugfs_dir && !IS_ERR(adapter->debugfs_dir))
                 debugfs_remove_recursive(adapter->debugfs_dir);
 
+        dma_unmap_single(&dev->dev, adapter->stats_token,
+                         sizeof(struct ibmvnic_statistics), DMA_FROM_DEVICE);
+
         if (adapter->ras_comps)
                 dma_free_coherent(&dev->dev,
                                   adapter->ras_comp_num *
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 6749b831998c..81b08d71c0f8 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1379,6 +1379,7 @@ static unsigned int get_rx_coal(struct mv643xx_eth_private *mp)
                 temp = (val & 0x003fff00) >> 8;
 
         temp *= 64000000;
+        temp += mp->t_clk / 2;
         do_div(temp, mp->t_clk);
 
         return (unsigned int)temp;
@@ -1415,6 +1416,7 @@ static unsigned int get_tx_coal(struct mv643xx_eth_private *mp)
 
         temp = (rdlp(mp, TX_FIFO_URGENT_THRESHOLD) & 0x3fff0) >> 4;
         temp *= 64000000;
+        temp += mp->t_clk / 2;
         do_div(temp, mp->t_clk);
 
         return (unsigned int)temp;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 9bf7320107b0..9a807e93c9fd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2254,7 +2254,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 
         if (!shutdown)
                 free_netdev(dev);
-        dev->ethtool_ops = NULL;
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 313b765e2d4f..52b4fd53b1a7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1445,6 +1445,7 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->netdev   = priv->netdev;
         c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
         c->num_tc   = priv->params.num_tc;
+        c->xdp      = !!priv->xdp_prog;
 
         if (priv->params.rx_am_enabled)
                 rx_cq_profile = mlx5e_am_get_def_profile(priv->params.rx_cq_period_mode);
@@ -1468,6 +1469,12 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         if (err)
                 goto err_close_tx_cqs;
 
+        /* XDP SQ CQ params are same as normal TXQ sq CQ params */
+        err = c->xdp ? mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
+                                     priv->params.tx_cq_moderation) : 0;
+        if (err)
+                goto err_close_rx_cq;
+
         napi_enable(&c->napi);
 
         err = mlx5e_open_sq(c, 0, &cparam->icosq, &c->icosq);
@@ -1488,21 +1495,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
                 }
         }
 
-        if (priv->xdp_prog) {
-                /* XDP SQ CQ params are same as normal TXQ sq CQ params */
-                err = mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
-                                    priv->params.tx_cq_moderation);
-                if (err)
-                        goto err_close_sqs;
-
-                err = mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq);
-                if (err) {
-                        mlx5e_close_cq(&c->xdp_sq.cq);
-                        goto err_close_sqs;
-                }
-        }
+        err = c->xdp ? mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq) : 0;
+        if (err)
+                goto err_close_sqs;
 
-        c->xdp = !!priv->xdp_prog;
         err = mlx5e_open_rq(c, &cparam->rq, &c->rq);
         if (err)
                 goto err_close_xdp_sq;
@@ -1512,7 +1508,8 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
 
         return 0;
 err_close_xdp_sq:
-        mlx5e_close_sq(&c->xdp_sq);
+        if (c->xdp)
+                mlx5e_close_sq(&c->xdp_sq);
 
 err_close_sqs:
         mlx5e_close_sqs(c);
@@ -1522,6 +1519,10 @@ err_close_icosq:
 
 err_disable_napi:
         napi_disable(&c->napi);
+        if (c->xdp)
+                mlx5e_close_cq(&c->xdp_sq.cq);
+
+err_close_rx_cq:
         mlx5e_close_cq(&c->rq.cq);
 
 err_close_tx_cqs:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 47dfd5b14dfb..a84825d59f33 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -310,7 +310,7 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
         netdev->switchdev_ops = &mlx5e_rep_switchdev_ops;
 #endif
 
-        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC;
+        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC | NETIF_F_NETNS_LOCAL;
         netdev->hw_features      |= NETIF_F_HW_TC;
 
         eth_hw_addr_random(netdev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 9d133fc6c65e..4b991124bc57 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -398,12 +398,15 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
                         skb_flow_dissector_target(f->dissector,
                                                   FLOW_DISSECTOR_KEY_VLAN,
                                                   f->mask);
-                if (mask->vlan_id) {
+                if (mask->vlan_id || mask->vlan_priority) {
                         MLX5_SET(fte_match_set_lyr_2_4, headers_c, vlan_tag, 1);
                         MLX5_SET(fte_match_set_lyr_2_4, headers_v, vlan_tag, 1);
 
                         MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_vid, mask->vlan_id);
                         MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_vid, key->vlan_id);
+
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_prio, mask->vlan_priority);
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_prio, key->vlan_priority);
                 }
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 50fe8e8861bb..731f28625cc3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -58,7 +58,8 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
         if (esw->mode != SRIOV_OFFLOADS)
                 return ERR_PTR(-EOPNOTSUPP);
 
-        flow_act.action = attr->action;
+        /* per flow vlan pop/push is emulated, don't set that into the firmware */
+        flow_act.action = attr->action & ~(MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH | MLX5_FLOW_CONTEXT_ACTION_VLAN_POP);
 
         if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) {
                 dest[i].type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 9adc766c7a3f..68ec4ea25d50 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1836,7 +1836,7 @@ static int init_root_ns(struct mlx5_flow_steering *steering)
 {
 
         steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
-        if (IS_ERR_OR_NULL(steering->root_ns))
+        if (!steering->root_ns)
                 goto cleanup;
 
         if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a3a0887d80e4..c07493307a83 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1226,6 +1226,9 @@ static int init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
+        dev->pdev = pdev;
+        dev->event = mlx5_core_event;
+
         if (prof_sel < 0 || prof_sel >= ARRAY_SIZE(profile)) {
                 mlx5_core_warn(dev,
                                "selected profile out of range, selecting default (%d)\n",
@@ -1233,8 +1236,6 @@ static int init_one(struct pci_dev *pdev,
                 prof_sel = MLX5_DEFAULT_PROF;
         }
         dev->profile = &profile[prof_sel];
-        dev->pdev = pdev;
-        dev->event = mlx5_core_event;
 
         INIT_LIST_HEAD(&priv->ctx_list);
         spin_lock_init(&priv->ctx_lock);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index a5433e425484..4a1f9d5f7c03 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -231,7 +231,7 @@ mlxsw_sp_span_entry_create(struct mlxsw_sp_port *port)
 
         span_entry->used = true;
         span_entry->id = index;
-        span_entry->ref_count = 0;
+        span_entry->ref_count = 1;
         span_entry->local_port = local_port;
         return span_entry;
 }
@@ -270,6 +270,7 @@ static struct mlxsw_sp_span_entry
 
         span_entry = mlxsw_sp_span_entry_find(port);
         if (span_entry) {
+                /* Already exists, just take a reference */
                 span_entry->ref_count++;
                 return span_entry;
         }
@@ -280,6 +281,7 @@ static struct mlxsw_sp_span_entry
 static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
                                    struct mlxsw_sp_span_entry *span_entry)
 {
+        WARN_ON(!span_entry->ref_count);
         if (--span_entry->ref_count == 0)
                 mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 04a2bc7043bc..cc1af19d699a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -115,7 +115,7 @@ struct mlxsw_sp_rif {
 struct mlxsw_sp_mid {
         struct list_head list;
         unsigned char addr[ETH_ALEN];
-        u16 vid;
+        u16 fid;
         u16 mid;
         unsigned int ref_count;
 };
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index df31f3861c4f..164bd309e92b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -589,21 +589,22 @@ static int mlxsw_sp_vrs_init(struct mlxsw_sp *mlxsw_sp)
         return 0;
 }
 
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp);
+
 static void mlxsw_sp_vrs_fini(struct mlxsw_sp *mlxsw_sp)
 {
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
         kfree(mlxsw_sp->router.vrs);
 }
 
 struct mlxsw_sp_neigh_key {
-        unsigned char addr[sizeof(struct in6_addr)];
-        struct net_device *dev;
+        struct neighbour *n;
 };
 
 struct mlxsw_sp_neigh_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_neigh_key key;
         u16 rif;
-        struct neighbour *n;
         bool offloaded;
         struct delayed_work dw;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -641,19 +642,15 @@ mlxsw_sp_neigh_entry_remove(struct mlxsw_sp *mlxsw_sp,
 static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work);
 
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_create(const void *addr, size_t addr_len,
-                            struct net_device *dev, u16 rif,
-                            struct neighbour *n)
+mlxsw_sp_neigh_entry_create(struct neighbour *n, u16 rif)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
 
         neigh_entry = kzalloc(sizeof(*neigh_entry), GFP_ATOMIC);
         if (!neigh_entry)
                 return NULL;
-        memcpy(neigh_entry->key.addr, addr, addr_len);
-        neigh_entry->key.dev = dev;
+        neigh_entry->key.n = n;
         neigh_entry->rif = rif;
-        neigh_entry->n = n;
         INIT_DELAYED_WORK(&neigh_entry->dw, mlxsw_sp_router_neigh_update_hw);
         INIT_LIST_HEAD(&neigh_entry->nexthop_list);
         return neigh_entry;
@@ -666,13 +663,11 @@ mlxsw_sp_neigh_entry_destroy(struct mlxsw_sp_neigh_entry *neigh_entry)
 }
 
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, const void *addr,
-                            size_t addr_len, struct net_device *dev)
+mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, struct neighbour *n)
 {
-        struct mlxsw_sp_neigh_key key = {{ 0 } };
+        struct mlxsw_sp_neigh_key key;
 
-        memcpy(key.addr, addr, addr_len);
-        key.dev = dev;
+        key.n = n;
         return rhashtable_lookup_fast(&mlxsw_sp->router.neigh_ht,
                                       &key, mlxsw_sp_neigh_ht_params);
 }
@@ -684,26 +679,20 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_rif *r;
-        u32 dip;
         int err;
 
         if (n->tbl != &arp_tbl)
                 return 0;
 
-        dip = ntohl(*((__be32 *) n->primary_key));
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
-                                                  n->dev);
-        if (neigh_entry) {
-                WARN_ON(neigh_entry->n != n);
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+        if (neigh_entry)
                 return 0;
-        }
 
         r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
         if (WARN_ON(!r))
                 return -EINVAL;
 
-        neigh_entry = mlxsw_sp_neigh_entry_create(&dip, sizeof(dip), n->dev,
-                                                  r->rif, n);
+        neigh_entry = mlxsw_sp_neigh_entry_create(n, r->rif);
         if (!neigh_entry)
                 return -ENOMEM;
         err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
@@ -722,14 +711,11 @@ void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 dip;
 
         if (n->tbl != &arp_tbl)
                 return;
 
-        dip = ntohl(*((__be32 *) n->primary_key));
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
-                                                  n->dev);
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
         if (!neigh_entry)
                 return;
         mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry);
@@ -812,6 +798,26 @@ static void mlxsw_sp_router_neigh_rec_process(struct mlxsw_sp *mlxsw_sp,
         }
 }
 
+static bool mlxsw_sp_router_rauhtd_is_full(char *rauhtd_pl)
+{
+        u8 num_rec, last_rec_index, num_entries;
+
+        num_rec = mlxsw_reg_rauhtd_num_rec_get(rauhtd_pl);
+        last_rec_index = num_rec - 1;
+
+        if (num_rec < MLXSW_REG_RAUHTD_REC_MAX_NUM)
+                return false;
+        if (mlxsw_reg_rauhtd_rec_type_get(rauhtd_pl, last_rec_index) ==
+            MLXSW_REG_RAUHTD_TYPE_IPV6)
+                return true;
+
+        num_entries = mlxsw_reg_rauhtd_ipv4_rec_num_entries_get(rauhtd_pl,
+                                                                last_rec_index);
+        if (++num_entries == MLXSW_REG_RAUHTD_IPV4_ENT_PER_REC)
+                return true;
+        return false;
+}
+
 static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
 {
         char *rauhtd_pl;
@@ -838,7 +844,7 @@ static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
                 for (i = 0; i < num_rec; i++)
                         mlxsw_sp_router_neigh_rec_process(mlxsw_sp, rauhtd_pl,
                                                           i);
-        } while (num_rec);
+        } while (mlxsw_sp_router_rauhtd_is_full(rauhtd_pl));
         rtnl_unlock();
 
         kfree(rauhtd_pl);
@@ -857,7 +863,7 @@ static void mlxsw_sp_router_neighs_update_nh(struct mlxsw_sp *mlxsw_sp)
                  * is active regardless of the traffic.
                  */
                 if (!list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
         }
         rtnl_unlock();
 }
@@ -903,9 +909,9 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work)
         rtnl_lock();
         list_for_each_entry(neigh_entry, &mlxsw_sp->router.nexthop_neighs_list,
                             nexthop_neighs_list_node) {
-                if (!(neigh_entry->n->nud_state & NUD_VALID) &&
+                if (!(neigh_entry->key.n->nud_state & NUD_VALID) &&
                     !list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
         }
         rtnl_unlock();
 
@@ -922,7 +928,7 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry =
                 container_of(work, struct mlxsw_sp_neigh_entry, dw.work);
-        struct neighbour *n = neigh_entry->n;
+        struct neighbour *n = neigh_entry->key.n;
         struct mlxsw_sp_port *mlxsw_sp_port = neigh_entry->mlxsw_sp_port;
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         char rauht_pl[MLXSW_REG_RAUHT_LEN];
@@ -1025,11 +1031,8 @@ int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
 
                 mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
                 dip = ntohl(*((__be32 *) n->primary_key));
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp,
-                                                          &dip,
-                                                          sizeof(__be32),
-                                                          dev);
-                if (WARN_ON(!neigh_entry) || WARN_ON(neigh_entry->n != n)) {
+                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+                if (WARN_ON(!neigh_entry)) {
                         mlxsw_sp_port_dev_put(mlxsw_sp_port);
                         return NOTIFY_DONE;
                 }
@@ -1338,33 +1341,26 @@ static int mlxsw_sp_nexthop_init(struct mlxsw_sp *mlxsw_sp,
                                  struct fib_nh *fib_nh)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 gwip = ntohl(fib_nh->nh_gw);
         struct net_device *dev = fib_nh->nh_dev;
         struct neighbour *n;
         u8 nud_state;
 
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
-                                                  sizeof(gwip), dev);
-        if (!neigh_entry) {
-                __be32 gwipn = htonl(gwip);
-
-                n = neigh_create(&arp_tbl, &gwipn, dev);
+        /* Take a reference of neigh here ensuring that neigh would
+         * not be detructed before the nexthop entry is finished.
+         * The reference is taken either in neigh_lookup() or
+         * in neith_create() in case n is not found.
+         */
+        n = neigh_lookup(&arp_tbl, &fib_nh->nh_gw, dev);
+        if (!n) {
+                n = neigh_create(&arp_tbl, &fib_nh->nh_gw, dev);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
                 neigh_event_send(n, NULL);
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
-                                                          sizeof(gwip), dev);
-                if (!neigh_entry) {
-                        neigh_release(n);
-                        return -EINVAL;
-                }
-        } else {
-                /* Take a reference of neigh here ensuring that neigh would
-                 * not be detructed before the nexthop entry is finished.
-                 * The second branch takes the reference in neith_create()
-                 */
-                n = neigh_entry->n;
-                neigh_clone(n);
+        }
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+        if (!neigh_entry) {
+                neigh_release(n);
+                return -EINVAL;
         }
 
         /* If that is the first nexthop connected to that neigh, add to
@@ -1398,7 +1394,7 @@ static void mlxsw_sp_nexthop_fini(struct mlxsw_sp *mlxsw_sp,
         if (list_empty(&nh->neigh_entry->nexthop_list))
                 list_del(&nh->neigh_entry->nexthop_neighs_list_node);
 
-        neigh_release(neigh_entry->n);
+        neigh_release(neigh_entry->key.n);
 }
 
 static struct mlxsw_sp_nexthop_group *
@@ -1458,11 +1454,11 @@ static bool mlxsw_sp_nexthop_match(struct mlxsw_sp_nexthop *nh,
 
         for (i = 0; i < fi->fib_nhs; i++) {
                 struct fib_nh *fib_nh = &fi->fib_nh[i];
-                u32 gwip = ntohl(fib_nh->nh_gw);
+                struct neighbour *n = nh->neigh_entry->key.n;
 
-                if (memcmp(nh->neigh_entry->key.addr,
-                           &gwip, sizeof(u32)) == 0 &&
-                    nh->neigh_entry->key.dev == fib_nh->nh_dev)
+                if (memcmp(n->primary_key, &fib_nh->nh_gw,
+                           sizeof(fib_nh->nh_gw)) == 0 &&
+                    n->dev == fib_nh->nh_dev)
                         return true;
         }
         return false;
@@ -1869,19 +1865,19 @@ static int mlxsw_sp_router_set_abort_trap(struct mlxsw_sp *mlxsw_sp)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ralue), ralue_pl);
 }
 
-static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp)
 {
         struct mlxsw_sp_fib_entry *fib_entry;
         struct mlxsw_sp_fib_entry *tmp;
         struct mlxsw_sp_vr *vr;
         int i;
-        int err;
 
         if (mlxsw_sp->router.aborted)
                 return;
         dev_warn(mlxsw_sp->bus_info->dev, "FIB abort triggered. Note that FIB entries are no longer being offloaded to this device.\n");
         for (i = 0; i < MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_VRS); i++) {
                 vr = &mlxsw_sp->router.vrs[i];
+
                 if (!vr->used)
                         continue;
 
@@ -1897,6 +1893,13 @@ static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
                                 break;
                 }
         }
+}
+
+static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+{
+        int err;
+
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
         mlxsw_sp->router.aborted = true;
         err = mlxsw_sp_router_set_abort_trap(mlxsw_sp);
         if (err)
@@ -1952,6 +1955,9 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb,
         struct fib_entry_notifier_info *fen_info = ptr;
         int err;
 
+        if (!net_eq(fen_info->info.net, &init_net))
+                return NOTIFY_DONE;
+
         switch (event) {
         case FIB_EVENT_ENTRY_ADD:
                 err = mlxsw_sp_router_fib4_add(mlxsw_sp, fen_info);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index b19552a72778..b87ba7d36bc4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -929,12 +929,12 @@ static int mlxsw_sp_port_smid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mid,
 
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
                                               const unsigned char *addr,
-                                              u16 vid)
+                                              u16 fid)
 {
         struct mlxsw_sp_mid *mid;
 
         list_for_each_entry(mid, &mlxsw_sp->br_mids.list, list) {
-                if (ether_addr_equal(mid->addr, addr) && mid->vid == vid)
+                if (ether_addr_equal(mid->addr, addr) && mid->fid == fid)
                         return mid;
         }
         return NULL;
@@ -942,7 +942,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
 
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
                                                 const unsigned char *addr,
-                                                u16 vid)
+                                                u16 fid)
 {
         struct mlxsw_sp_mid *mid;
         u16 mid_idx;
@@ -958,7 +958,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
 
         set_bit(mid_idx, mlxsw_sp->br_mids.mapped);
         ether_addr_copy(mid->addr, addr);
-        mid->vid = vid;
+        mid->fid = fid;
         mid->mid = mid_idx;
         mid->ref_count = 0;
         list_add_tail(&mid->list, &mlxsw_sp->br_mids.list);
@@ -991,9 +991,9 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
         if (switchdev_trans_ph_prepare(trans))
                 return 0;
 
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
         if (!mid) {
-                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, mdb->vid);
+                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, fid);
                 if (!mid) {
                         netdev_err(dev, "Unable to allocate MC group\n");
                         return -ENOMEM;
@@ -1137,7 +1137,7 @@ static int mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
         u16 mid_idx;
         int err = 0;
 
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
         if (!mid) {
                 netdev_err(dev, "Unable to remove port from MC DB\n");
                 return -EINVAL;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index f5a4ebb3963f..785ab03683eb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -727,9 +727,6 @@ struct core_tx_bd_flags {
 #define CORE_TX_BD_FLAGS_L4_PROTOCOL_SHIFT      6
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_MASK       0x1
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_SHIFT 7
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_MASK         0x1
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_SHIFT        12
-
 };
 
 struct core_tx_bd {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 63e1a1b0ef8e..f95385cbbd40 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -1119,6 +1119,7 @@ static void qed_ll2_prepare_tx_packet_set_bd(struct qed_hwfn *p_hwfn,
         start_bd->bd_flags.as_bitfield |= CORE_TX_BD_FLAGS_START_BD_MASK <<
             CORE_TX_BD_FLAGS_START_BD_SHIFT;
         SET_FIELD(start_bd->bitfield0, CORE_TX_BD_NBDS, num_of_bds);
+        SET_FIELD(start_bd->bitfield0, CORE_TX_BD_ROCE_FLAV, type);
         DMA_REGPAIR_LE(start_bd->addr, first_frag);
         start_bd->nbytes = cpu_to_le16(first_frag_len);
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index b71d73a41b10..aeb98d8c5626 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -845,20 +845,19 @@ static void qed_update_pf_params(struct qed_dev *cdev,
 {
         int i;
 
+        if (IS_ENABLED(CONFIG_QED_RDMA)) {
+                params->rdma_pf_params.num_qps = QED_ROCE_QPS;
+                params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
+                /* divide by 3 the MRs to avoid MF ILT overflow */
+                params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
+                params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
+        }
+
         for (i = 0; i < cdev->num_hwfns; i++) {
                 struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
 
                 p_hwfn->pf_params = *params;
         }
-
-        if (!IS_ENABLED(CONFIG_QED_RDMA))
-                return;
-
-        params->rdma_pf_params.num_qps = QED_ROCE_QPS;
-        params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
-        /* divide by 3 the MRs to avoid MF ILT overflow */
-        params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
-        params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
 }
 
 static int qed_slowpath_start(struct qed_dev *cdev,
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index fe7e7b8650dd..8a3debef39ee 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -177,16 +177,23 @@ static void qede_get_strings_stats(struct qede_dev *edev, u8 *buf)
         for (i = 0, k = 0; i < QEDE_QUEUE_CNT(edev); i++) {
                 int tc;
 
-                for (j = 0; j < QEDE_NUM_RQSTATS; j++)
-                        sprintf(buf + (k + j) * ETH_GSTRING_LEN,
-                                "%d:   %s", i, qede_rqstats_arr[j].string);
-                k += QEDE_NUM_RQSTATS;
-                for (tc = 0; tc < edev->num_tc; tc++) {
-                        for (j = 0; j < QEDE_NUM_TQSTATS; j++)
+                if (edev->fp_array[i].type & QEDE_FASTPATH_RX) {
+                        for (j = 0; j < QEDE_NUM_RQSTATS; j++)
                                 sprintf(buf + (k + j) * ETH_GSTRING_LEN,
-                                        "%d.%d: %s", i, tc,
-                                        qede_tqstats_arr[j].string);
-                        k += QEDE_NUM_TQSTATS;
+                                        "%d:   %s", i,
+                                        qede_rqstats_arr[j].string);
+                        k += QEDE_NUM_RQSTATS;
+                }
+
+                if (edev->fp_array[i].type & QEDE_FASTPATH_TX) {
+                        for (tc = 0; tc < edev->num_tc; tc++) {
+                                for (j = 0; j < QEDE_NUM_TQSTATS; j++)
+                                        sprintf(buf + (k + j) *
+                                                ETH_GSTRING_LEN,
+                                                "%d.%d: %s", i, tc,
+                                                qede_tqstats_arr[j].string);
+                                k += QEDE_NUM_TQSTATS;
+                        }
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index df02c454eccc..b84a2c4ef083 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -2915,7 +2915,7 @@ static int qede_alloc_sge_mem(struct qede_dev *edev, struct qede_rx_queue *rxq)
                 }
 
                 mapping = dma_map_page(&edev->pdev->dev, replace_buf->data, 0,
-                                       rxq->rx_buf_size, DMA_FROM_DEVICE);
+                                       PAGE_SIZE, DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(&edev->pdev->dev, mapping))) {
                         DP_NOTICE(edev,
                                   "Failed to map TPA replacement buffer\n");
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 6fb3bee904d3..0b4deb31e742 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -575,10 +575,11 @@ void emac_mac_start(struct emac_adapter *adpt)
 
         mac |= TXEN | RXEN;     /* enable RX/TX */
 
-        /* We don't have ethtool support yet, so force flow-control mode
-         * to 'full' always.
-         */
-        mac |= TXFC | RXFC;
+        /* Configure MAC flow control to match the PHY's settings. */
+        if (phydev->pause)
+                mac |= RXFC;
+        if (phydev->pause != phydev->asym_pause)
+                mac |= TXFC;
 
         /* setup link speed */
         mac &= ~SPEED_MASK;
@@ -1003,6 +1004,12 @@ int emac_mac_up(struct emac_adapter *adpt)
         writel((u32)~DIS_INT, adpt->base + EMAC_INT_STATUS);
         writel(adpt->irq.mask, adpt->base + EMAC_INT_MASK);
 
+        /* Enable pause frames.  Without this feature, the EMAC has been shown
+         * to receive (and drop) frames with FCS errors at gigabit connections.
+         */
+        adpt->phydev->supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+        adpt->phydev->advertising |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+
         adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
         phy_start(adpt->phydev);
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
index 75c1b530e39e..72fe343c7a36 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
@@ -421,7 +421,7 @@ static const struct emac_reg_write sgmii_v2_laned[] = {
         /* CDR Settings */
         {EMAC_SGMII_LN_UCDR_FO_GAIN_MODE0,
                 UCDR_STEP_BY_TWO_MODE0 | UCDR_xO_GAIN_MODE(10)},
-        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(6)},
+        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(0)},
         {EMAC_SGMII_LN_UCDR_SO_CONFIG, UCDR_ENABLE | UCDR_SO_SATURATION(12)},
 
         /* TX/RX Settings */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index b626da6e80a5..649bc508fa4b 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -485,6 +485,9 @@ efx_copy_channel(const struct efx_channel *old_channel)
         *channel = *old_channel;
 
         channel->napi_dev = NULL;
+        INIT_HLIST_NODE(&channel->napi_str.napi_hash_node);
+        channel->napi_str.napi_id = 0;
+        channel->napi_str.state = 0;
         memset(&channel->eventq, 0, sizeof(channel->eventq));
 
         for (j = 0; j < EFX_TXQ_TYPES; j++) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 10909c9c0033..03dbf8e89c4c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -882,6 +882,13 @@ static int stmmac_init_phy(struct net_device *dev)
                 return -ENODEV;
         }
 
+        /* stmmac_adjust_link will change this to PHY_IGNORE_INTERRUPT to avoid
+         * subsequent PHY polling, make sure we force a link transition if
+         * we have a UP/DOWN/UP transition
+         */
+        if (phydev->is_pseudo_fixed_link)
+                phydev->irq = PHY_POLL;
+
         pr_debug("stmmac_init_phy:  %s: attached to PHY (UID 0x%x)"
                  " Link = %d\n", dev->name, phydev->phy_id, phydev->link);
 
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index 054a8dd23dae..ba1e45ff6aae 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -176,9 +176,12 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
         }
 
         dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        of_node_put(node);
         priv = dev_get_drvdata(dev);
 
         priv->cpsw_phy_sel(priv, phy_mode, slave);
+
+        put_device(dev);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);
 
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 2fd94a5bc1f3..84fbe5714f8b 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1410,6 +1410,7 @@ static int emac_dev_open(struct net_device *ndev)
         int i = 0;
         struct emac_priv *priv = netdev_priv(ndev);
         struct phy_device *phydev = NULL;
+        struct device *phy = NULL;
 
         ret = pm_runtime_get_sync(&priv->pdev->dev);
         if (ret < 0) {
@@ -1488,19 +1489,20 @@ static int emac_dev_open(struct net_device *ndev)
 
         /* use the first phy on the bus if pdata did not give us a phy id */
         if (!phydev && !priv->phy_id) {
-                struct device *phy;
-
                 phy = bus_find_device(&mdio_bus_type, NULL, NULL,
                                       match_first_device);
-                if (phy)
+                if (phy) {
                         priv->phy_id = dev_name(phy);
+                        if (!priv->phy_id || !*priv->phy_id)
+                                put_device(phy);
+                }
         }
 
         if (!phydev && priv->phy_id && *priv->phy_id) {
                 phydev = phy_connect(ndev, priv->phy_id,
                                      &emac_adjust_link,
                                      PHY_INTERFACE_MODE_MII);
-
+                put_device(phy);        /* reference taken by bus_find_device */
                 if (IS_ERR(phydev)) {
                         dev_err(emac_dev, "could not connect to phy %s\n",
                                 priv->phy_id);
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index b3abd02dc949..eed18f88bdff 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -1694,7 +1694,7 @@ struct gelic_wl_scan_info *gelic_wl_find_best_bss(struct gelic_wl_info *wl)
                                 pr_debug("%s: bssid matched\n", __func__);
                                 break;
                         } else {
-                                pr_debug("%s: bssid unmached\n", __func__);
+                                pr_debug("%s: bssid unmatched\n", __func__);
                                 continue;
                         }
                 }
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 46cc33b9e926..07d862d90869 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -708,8 +708,7 @@ static int eth_poll(struct napi_struct *napi, int budget)
                         if (!qmgr_stat_below_low_watermark(rxq) &&
                             napi_reschedule(napi)) { /* not empty again */
 #if DEBUG_RX
-                                printk(KERN_DEBUG "%s: eth_poll"
-                                       " napi_reschedule successed\n",
+                                printk(KERN_DEBUG "%s: eth_poll napi_reschedule succeeded\n",
                                        dev->name);
 #endif
                                 qmgr_disable_irq(rxq);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index d0361f3197c9..13b7e0b9bd9b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1280,6 +1280,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev;
         int err;
         int macmode;
+        bool create = false;
 
         if (!tb[IFLA_LINK])
                 return -EINVAL;
@@ -1310,12 +1311,18 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 err = macvlan_port_create(lowerdev);
                 if (err < 0)
                         return err;
+                create = true;
         }
         port = macvlan_port_get_rtnl(lowerdev);
 
         /* Only 1 macvlan device can be created in passthru mode */
-        if (port->passthru)
-                return -EINVAL;
+        if (port->passthru) {
+                /* The macvlan port must be not created this time,
+                 * still goto destroy_macvlan_port for readability.
+                 */
+                err = -EINVAL;
+                goto destroy_macvlan_port;
+        }
 
         vlan->lowerdev = lowerdev;
         vlan->dev      = dev;
@@ -1331,24 +1338,28 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 vlan->flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
 
         if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
-                if (port->count)
-                        return -EINVAL;
+                if (port->count) {
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                 port->passthru = true;
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
         if (data && data[IFLA_MACVLAN_MACADDR_MODE]) {
-                if (vlan->mode != MACVLAN_MODE_SOURCE)
-                        return -EINVAL;
+                if (vlan->mode != MACVLAN_MODE_SOURCE) {
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                 macmode = nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE]);
                 err = macvlan_changelink_sources(vlan, macmode, data);
                 if (err)
-                        return err;
+                        goto destroy_macvlan_port;
         }
 
         err = register_netdevice(dev);
         if (err < 0)
-                return err;
+                goto destroy_macvlan_port;
 
         dev->priv_flags |= IFF_MACVLAN;
         err = netdev_upper_dev_link(lowerdev, dev);
@@ -1363,7 +1374,9 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 
 unregister_netdev:
         unregister_netdevice(dev);
-
+destroy_macvlan_port:
+        if (create)
+                macvlan_port_destroy(port->dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(macvlan_common_newlink);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 49a1c988d29c..9e8f048891bd 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -724,6 +724,7 @@ struct phy_device *phy_connect(struct net_device *dev, const char *bus_id,
         phydev = to_phy_device(d);
 
         rc = phy_connect_direct(dev, phydev, handler, interface);
+        put_device(d);
         if (rc)
                 return ERR_PTR(rc);
 
@@ -956,6 +957,7 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
         phydev = to_phy_device(d);
 
         rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+        put_device(d);
         if (rc)
                 return ERR_PTR(rc);
 
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 36c70d6f7363..a3a7db0702d8 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1654,6 +1654,19 @@ static const struct driver_info ax88178a_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info cypress_GX3_info = {
+        .description = "Cypress GX3 SuperSpeed to Gigabit Ethernet Controller",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info dlink_dub1312_info = {
         .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
         .bind = ax88179_bind,
@@ -1716,6 +1729,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0b95, 0x178a),
         .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* Cypress GX3 SuperSpeed to Gigabit Ethernet Bridge Controller */
+        USB_DEVICE(0x04b4, 0x3610),
+        .driver_info = (unsigned long)&cypress_GX3_info,
+}, {
         /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
         USB_DEVICE(0x2001, 0x4a00),
         .driver_info = (unsigned long)&dlink_dub1312_info,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 4213c28eeb43..7dc61228c55b 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
         u8 checksum = CHECKSUM_NONE;
         u32 opts2, opts3;
 
-        if (tp->version == RTL_VER_01)
+        if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
                 goto return_result;
 
         opts2 = le32_to_cpu(rx_desc->opts2);
@@ -1745,7 +1745,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
                         checksum = CHECKSUM_NONE;
                 else
                         checksum = CHECKSUM_UNNECESSARY;
-        } else if (RD_IPV6_CS) {
+        } else if (opts2 & RD_IPV6_CS) {
                 if ((opts2 & RD_UDP_CS) && !(opts3 & UDPF))
                         checksum = CHECKSUM_UNNECESSARY;
                 else if ((opts2 & RD_TCP_CS) && !(opts3 & TCPF))
@@ -3266,10 +3266,8 @@ static int rtl8152_open(struct net_device *netdev)
                 goto out;
 
         res = usb_autopm_get_interface(tp->intf);
-        if (res < 0) {
-                free_all_mem(tp);
-                goto out;
-        }
+        if (res < 0)
+                goto out_free;
 
         mutex_lock(&tp->control);
 
@@ -3285,10 +3283,9 @@ static int rtl8152_open(struct net_device *netdev)
                         netif_device_detach(tp->netdev);
                 netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                            res);
-                free_all_mem(tp);
-        } else {
-                napi_enable(&tp->napi);
+                goto out_unlock;
         }
+        napi_enable(&tp->napi);
 
         mutex_unlock(&tp->control);
 
@@ -3297,7 +3294,13 @@ static int rtl8152_open(struct net_device *netdev)
         tp->pm_notifier.notifier_call = rtl_notifier;
         register_pm_notifier(&tp->pm_notifier);
 #endif
+        return 0;
 
+out_unlock:
+        mutex_unlock(&tp->control);
+        usb_autopm_put_interface(tp->intf);
+out_free:
+        free_all_mem(tp);
 out:
         return res;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2cafd12a1075..ca5239aea4d9 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2037,23 +2037,33 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
+#define VIRTNET_FEATURES \
+        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, \
+        VIRTIO_NET_F_MAC, \
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, \
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, \
+        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, \
+        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, \
+        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, \
+        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, \
+        VIRTIO_NET_F_CTRL_MAC_ADDR, \
+        VIRTIO_NET_F_MTU
+
 static unsigned int features[] = {
-        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
-        VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
-        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
-        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
-        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
-        VIRTIO_NET_F_CTRL_MAC_ADDR,
+        VIRTNET_FEATURES,
+};
+
+static unsigned int features_legacy[] = {
+        VIRTNET_FEATURES,
+        VIRTIO_NET_F_GSO,
         VIRTIO_F_ANY_LAYOUT,
-        VIRTIO_NET_F_MTU,
 };
 
 static struct virtio_driver virtio_net_driver = {
         .feature_table = features,
         .feature_table_size = ARRAY_SIZE(features),
+        .feature_table_legacy = features_legacy,
+        .feature_table_size_legacy = ARRAY_SIZE(features_legacy),
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index cb5cc7c03160..5264c1a49d86 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -944,7 +944,9 @@ static bool vxlan_group_used(struct vxlan_net *vn, struct vxlan_dev *dev)
 {
         struct vxlan_dev *vxlan;
         struct vxlan_sock *sock4;
-        struct vxlan_sock *sock6 = NULL;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct vxlan_sock *sock6;
+#endif
         unsigned short family = dev->default_dst.remote_ip.sa.sa_family;
 
         sock4 = rtnl_dereference(dev->vn4_sock);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 2295336355df..cf267f9da753 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4518,7 +4518,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         /* store current 11d setting */
         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
                                   &ifp->vif->is_11d)) {
-                supports_11d = false;
+                is_11d = supports_11d = false;
         } else {
                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
                                               settings->beacon.tail_len,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 4fdc3dad3e85..b88e2048ae0b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1087,6 +1087,15 @@ iwl_mvm_netdetect_config(struct iwl_mvm *mvm,
                 ret = iwl_mvm_switch_to_d3(mvm);
                 if (ret)
                         return ret;
+        } else {
+                /* In theory, we wouldn't have to stop a running sched
+                 * scan in order to start another one (for
+                 * net-detect).  But in practice this doesn't seem to
+                 * work properly, so stop any running sched_scan now.
+                 */
+                ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
+                if (ret)
+                        return ret;
         }
 
         /* rfkill release can be either for wowlan or netdetect */
@@ -1254,7 +1263,10 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
  out:
         if (ret < 0) {
                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
-                ieee80211_restart_hw(mvm->hw);
+                if (mvm->restart_fw > 0) {
+                        mvm->restart_fw--;
+                        ieee80211_restart_hw(mvm->hw);
+                }
                 iwl_mvm_free_nd(mvm);
         }
  out_noreset:
@@ -2088,6 +2100,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         iwl_mvm_update_changed_regdom(mvm);
 
         if (mvm->net_detect) {
+                /* If this is a non-unified image, we restart the FW,
+                 * so no need to stop the netdetect scan.  If that
+                 * fails, continue and try to get the wake-up reasons,
+                 * but trigger a HW restart by keeping a failure code
+                 * in ret.
+                 */
+                if (unified_image)
+                        ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_NETDETECT,
+                                                false);
+
                 iwl_mvm_query_netdetect_reasons(mvm, vif);
                 /* has unlocked the mutex, so skip that */
                 goto out;
@@ -2271,7 +2293,8 @@ static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac,
 static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
 {
         struct iwl_mvm *mvm = inode->i_private;
-        int remaining_time = 10;
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 
         mvm->d3_test_active = false;
 
@@ -2282,17 +2305,21 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
 
         iwl_abort_notification_waits(&mvm->notif_wait);
-        ieee80211_restart_hw(mvm->hw);
+        if (!unified_image) {
+                int remaining_time = 10;
 
-        /* wait for restart and disconnect all interfaces */
-        while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
-               remaining_time > 0) {
-                remaining_time--;
-                msleep(1000);
-        }
+                ieee80211_restart_hw(mvm->hw);
+
+                /* wait for restart and disconnect all interfaces */
+                while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
+                       remaining_time > 0) {
+                        remaining_time--;
+                        msleep(1000);
+                }
 
-        if (remaining_time == 0)
-                IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n");
+                if (remaining_time == 0)
+                        IWL_ERR(mvm, "Timed out waiting for HW restart!\n");
+        }
 
         ieee80211_iterate_active_interfaces_atomic(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index 07da4efe8458..7b7d2a146e30 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1529,8 +1529,8 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
                 .data = { &cmd, },
                 .len = { sizeof(cmd) },
         };
-        size_t delta, len;
-        ssize_t ret;
+        size_t delta;
+        ssize_t ret, len;
 
         hcmd.id = iwl_cmd_id(*ppos >> 24 ? UMAC_RD_WR : LMAC_RD_WR,
                              DEBUG_GROUP, 0);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 318efd814037..1db1dc13e988 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -4121,7 +4121,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
                                      struct iwl_mvm_internal_rxq_notif *notif,
                                      u32 size)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(notif_waitq);
         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
         int ret;
 
@@ -4143,7 +4142,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
         }
 
         if (notif->sync)
-                ret = wait_event_timeout(notif_waitq,
+                ret = wait_event_timeout(mvm->rx_sync_waitq,
                                          atomic_read(&mvm->queue_sync_counter) == 0,
                                          HZ);
         WARN_ON_ONCE(!ret);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index d17cbf603f7c..c60703e0c246 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -937,6 +937,7 @@ struct iwl_mvm {
         /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */
         spinlock_t d0i3_tx_lock;
         wait_queue_head_t d0i3_exit_waitq;
+        wait_queue_head_t rx_sync_waitq;
 
         /* BT-Coex */
         struct iwl_bt_coex_profile_notif last_bt_notif;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 05fe6dd1a2c8..4d35deb628bc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -619,6 +619,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         spin_lock_init(&mvm->refs_lock);
         skb_queue_head_init(&mvm->d0i3_tx);
         init_waitqueue_head(&mvm->d0i3_exit_waitq);
+        init_waitqueue_head(&mvm->rx_sync_waitq);
 
         atomic_set(&mvm->queue_sync_counter, 0);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a57c6ef5bc14..6c802cee900c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -547,7 +547,8 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                                   "Received expired RX queue sync message\n");
                         return;
                 }
-                atomic_dec(&mvm->queue_sync_counter);
+                if (!atomic_dec_return(&mvm->queue_sync_counter))
+                        wake_up(&mvm->rx_sync_waitq);
         }
 
         switch (internal_notif->type) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index f279fdd6eb44..fa9743205491 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1199,6 +1199,9 @@ static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
 
 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
 {
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
+
         /* This looks a bit arbitrary, but the idea is that if we run
          * out of possible simultaneous scans and the userspace is
          * trying to run a scan type that is already running, we
@@ -1225,12 +1228,30 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
                         return -EBUSY;
                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
         case IWL_MVM_SCAN_NETDETECT:
-                /* No need to stop anything for net-detect since the
-                 * firmware is restarted anyway.  This way, any sched
-                 * scans that were running will be restarted when we
-                 * resume.
-                */
-                return 0;
+                /* For non-unified images, there's no need to stop
+                 * anything for net-detect since the firmware is
+                 * restarted anyway.  This way, any sched scans that
+                 * were running will be restarted when we resume.
+                 */
+                if (!unified_image)
+                        return 0;
+
+                /* If this is a unified image and we ran out of scans,
+                 * we need to stop something.  Prefer stopping regular
+                 * scans, because the results are useless at this
+                 * point, and we should be able to keep running
+                 * another scheduled scan while suspended.
+                 */
+                if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
+                                                 true);
+                if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
+                                                 true);
+
+                /* fall through, something is wrong if no scan was
+                 * running but we ran out of scans.
+                 */
         default:
                 WARN_ON(1);
                 break;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 001be406a3d3..2f8134b2a504 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -541,48 +541,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids);
 
 #ifdef CONFIG_ACPI
-#define SPL_METHOD              "SPLC"
-#define SPL_DOMAINTYPE_MODULE   BIT(0)
-#define SPL_DOMAINTYPE_WIFI     BIT(1)
-#define SPL_DOMAINTYPE_WIGIG    BIT(2)
-#define SPL_DOMAINTYPE_RFEM     BIT(3)
+#define ACPI_SPLC_METHOD        "SPLC"
+#define ACPI_SPLC_DOMAIN_WIFI   (0x07)
 
-static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
+static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc)
 {
-        union acpi_object *limits, *domain_type, *power_limit;
-
-        if (splx->type != ACPI_TYPE_PACKAGE ||
-            splx->package.count != 2 ||
-            splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
-            splx->package.elements[0].integer.value != 0) {
-                IWL_ERR(trans, "Unsupported splx structure\n");
+        union acpi_object *data_pkg, *dflt_pwr_limit;
+        int i;
+
+        /* We need at least two elements, one for the revision and one
+         * for the data itself.  Also check that the revision is
+         * supported (currently only revision 0).
+        */
+        if (splc->type != ACPI_TYPE_PACKAGE ||
+            splc->package.count < 2 ||
+            splc->package.elements[0].type != ACPI_TYPE_INTEGER ||
+            splc->package.elements[0].integer.value != 0) {
+                IWL_DEBUG_INFO(trans,
+                               "Unsupported structure returned by the SPLC method.  Ignoring.\n");
                 return 0;
         }
 
-        limits = &splx->package.elements[1];
-        if (limits->type != ACPI_TYPE_PACKAGE ||
-            limits->package.count < 2 ||
-            limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
-            limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
-                IWL_ERR(trans, "Invalid limits element\n");
-                return 0;
+        /* loop through all the packages to find the one for WiFi */
+        for (i = 1; i < splc->package.count; i++) {
+                union acpi_object *domain;
+
+                data_pkg = &splc->package.elements[i];
+
+                /* Skip anything that is not a package with the right
+                 * amount of elements (i.e. at least 2 integers).
+                 */
+                if (data_pkg->type != ACPI_TYPE_PACKAGE ||
+                    data_pkg->package.count < 2 ||
+                    data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
+                    data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
+                        continue;
+
+                domain = &data_pkg->package.elements[0];
+                if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI)
+                        break;
+
+                data_pkg = NULL;
         }
 
-        domain_type = &limits->package.elements[0];
-        power_limit = &limits->package.elements[1];
-        if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
-                IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
+        if (!data_pkg) {
+                IWL_DEBUG_INFO(trans,
+                               "No element for the WiFi domain returned by the SPLC method.\n");
                 return 0;
         }
 
-        return power_limit->integer.value;
+        dflt_pwr_limit = &data_pkg->package.elements[1];
+        return dflt_pwr_limit->integer.value;
 }
 
 static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
 {
         acpi_handle pxsx_handle;
         acpi_handle handle;
-        struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL};
+        struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL};
         acpi_status status;
 
         pxsx_handle = ACPI_HANDLE(&pdev->dev);
@@ -593,23 +609,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
         }
 
         /* Get the method's handle */
-        status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
+        status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD,
+                                 &handle);
         if (ACPI_FAILURE(status)) {
-                IWL_DEBUG_INFO(trans, "SPL method not found\n");
+                IWL_DEBUG_INFO(trans, "SPLC method not found\n");
                 return;
         }
 
         /* Call SPLC with no arguments */
-        status = acpi_evaluate_object(handle, NULL, NULL, &splx);
+        status = acpi_evaluate_object(handle, NULL, NULL, &splc);
         if (ACPI_FAILURE(status)) {
                 IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
                 return;
         }
 
-        trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
+        trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer);
         IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
                        trans->dflt_pwr_limit);
-        kfree(splx.pointer);
+        kfree(splc.pointer);
 }
 
 #else /* CONFIG_ACPI */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index e9a278b60dfd..5f840f16f40b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -592,6 +592,7 @@ error:
 static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                               int slots_num, u32 txq_id)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         txq->need_update = false;
@@ -606,6 +607,13 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                 return ret;
 
         spin_lock_init(&txq->lock);
+
+        if (txq_id == trans_pcie->cmd_queue) {
+                static struct lock_class_key iwl_pcie_cmd_queue_lock_class;
+
+                lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class);
+        }
+
         __skb_queue_head_init(&txq->overflow_q);
 
         /*
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 7d616b003e89..e085c8c31cfe 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -304,7 +304,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
                 queue->rx_skbs[id] = skb;
 
                 ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
-                BUG_ON((signed short)ref < 0);
+                WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
                 queue->grant_rx_ref[id] = ref;
 
                 page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
@@ -428,7 +428,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset,
         id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
         tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
         ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
-        BUG_ON((signed short)ref < 0);
+        WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
 
         gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
                                         gfn, GNTMAP_readonly);
diff --git a/drivers/nfc/mei_phy.c b/drivers/nfc/mei_phy.c
index 83deda4bb4d6..6f9563a96488 100644
--- a/drivers/nfc/mei_phy.c
+++ b/drivers/nfc/mei_phy.c
@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc_mei_phy *phy)
                 return -ENOMEM;
 
         bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
-        if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+        if (bytes_recv < 0 || bytes_recv < if_version_length) {
                 pr_err("Could not read IF version\n");
                 r = -EIO;
                 goto err;
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index 0d5c29ae51de..7310a261c858 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -112,17 +112,17 @@ MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
 
 module_param_named(xeon_b2b_usd_bar4_addr64,
                    xeon_b2b_usd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr64,
                  "XEON B2B USD BAR 4 64-bit address");
 
 module_param_named(xeon_b2b_usd_bar4_addr32,
                    xeon_b2b_usd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr32,
                  "XEON B2B USD split-BAR 4 32-bit address");
 
 module_param_named(xeon_b2b_usd_bar5_addr32,
                    xeon_b2b_usd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar5_addr32,
                  "XEON B2B USD split-BAR 5 32-bit address");
 
 module_param_named(xeon_b2b_dsd_bar2_addr64,
@@ -132,17 +132,17 @@ MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
 
 module_param_named(xeon_b2b_dsd_bar4_addr64,
                    xeon_b2b_dsd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr64,
                  "XEON B2B DSD BAR 4 64-bit address");
 
 module_param_named(xeon_b2b_dsd_bar4_addr32,
                    xeon_b2b_dsd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr32,
                  "XEON B2B DSD split-BAR 4 32-bit address");
 
 module_param_named(xeon_b2b_dsd_bar5_addr32,
                    xeon_b2b_dsd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar5_addr32,
                  "XEON B2B DSD split-BAR 5 32-bit address");
 
 #ifndef ioread64
@@ -1755,6 +1755,8 @@ static int xeon_setup_b2b_mw(struct intel_ntb_dev *ndev,
                                             XEON_B2B_MIN_SIZE);
                 if (!ndev->peer_mmio)
                         return -EIO;
+
+                ndev->peer_addr = pci_resource_start(pdev, b2b_bar);
         }
 
         return 0;
@@ -2019,6 +2021,7 @@ static int intel_ntb_init_pci(struct intel_ntb_dev *ndev, struct pci_dev *pdev)
                 goto err_mmio;
         }
         ndev->peer_mmio = ndev->self_mmio;
+        ndev->peer_addr = pci_resource_start(pdev, 0);
 
         return 0;
 
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 8601c10acf74..4eb8adb34508 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -257,7 +257,7 @@ enum {
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
 #define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 6a50f20bf1cd..e75d4fdc0866 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -72,7 +72,7 @@
 #define MAX_THREADS             32
 #define MAX_TEST_SIZE           SZ_1M
 #define MAX_SRCS                32
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 #define DMA_RETRIES             20
 #define SZ_4G                   (1ULL << 32)
 #define MAX_SEG_ORDER           20 /* no larger than 1M for kmalloc buffer */
@@ -589,7 +589,7 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                 return -ENOMEM;
 
         if (mutex_is_locked(&perf->run_mutex)) {
-                out_off = snprintf(buf, 64, "running\n");
+                out_off = scnprintf(buf, 64, "running\n");
                 goto read_from_buf;
         }
 
@@ -600,14 +600,14 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                         break;
 
                 if (pctx->status) {
-                        out_off += snprintf(buf + out_off, 1024 - out_off,
+                        out_off += scnprintf(buf + out_off, 1024 - out_off,
                                             "%d: error %d\n", i,
                                             pctx->status);
                         continue;
                 }
 
                 rate = div64_u64(pctx->copied, pctx->diff_us);
-                out_off += snprintf(buf + out_off, 1024 - out_off,
+                out_off += scnprintf(buf + out_off, 1024 - out_off,
                         "%d: copied %llu bytes in %llu usecs, %llu MBytes/s\n",
                         i, pctx->copied, pctx->diff_us, rate);
         }
diff --git a/drivers/ntb/test/ntb_pingpong.c b/drivers/ntb/test/ntb_pingpong.c
index 7d311799fca1..435861189d97 100644
--- a/drivers/ntb/test/ntb_pingpong.c
+++ b/drivers/ntb/test/ntb_pingpong.c
@@ -88,7 +88,7 @@ MODULE_PARM_DESC(delay_ms, "Milliseconds to delay the response to peer");
 
 static unsigned long db_init = 0x7;
 module_param(db_init, ulong, 0644);
-MODULE_PARM_DESC(delay_ms, "Initial doorbell bits to ring on the peer");
+MODULE_PARM_DESC(db_init, "Initial doorbell bits to ring on the peer");
 
 struct pp_ctx {
         struct ntb_dev                  *ntb;
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index f5e3011e31fc..5daf2f4be0cd 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -612,7 +612,7 @@ int nvme_nvm_register(struct nvme_ns *ns, char *disk_name, int node,
 
         ret = nvm_register(dev);
 
-        ns->lba_shift = ilog2(dev->sec_size) - 9;
+        ns->lba_shift = ilog2(dev->sec_size);
 
         if (sysfs_create_group(&dev->dev.kobj, attrs))
                 pr_warn("%s: failed to create sysfs group for identification\n",
diff --git a/drivers/of/base.c b/drivers/of/base.c
index d687e6de24a0..a0bccb54a9bd 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -2077,8 +2077,6 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                         name = of_get_property(of_aliases, "stdout", NULL);
                 if (name)
                         of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
-                if (of_stdout)
-                        console_set_by_of();
         }
 
         if (!of_aliases)
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 035f50c03281..bed19994c1e9 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -637,8 +637,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
                 }
         }
 
-        pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
-
         if (pp->ops->host_init)
                 pp->ops->host_init(pp);
 
@@ -809,6 +807,11 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
 {
         u32 val;
 
+        /* get iATU unroll support */
+        pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
+        dev_dbg(pp->dev, "iATU unroll: %s\n",
+                pp->iatu_unroll_enabled ? "enabled" : "disabled");
+
         /* set the number of lanes */
         val = dw_pcie_readl_rc(pp, PCIE_PORT_LINK_CONTROL);
         val &= ~PORT_LINK_MODE_MASK;
diff --git a/drivers/pci/host/pcie-qcom.c b/drivers/pci/host/pcie-qcom.c
index ef0a84c7a588..35936409b2d4 100644
--- a/drivers/pci/host/pcie-qcom.c
+++ b/drivers/pci/host/pcie-qcom.c
@@ -533,11 +533,11 @@ static int qcom_pcie_probe(struct platform_device *pdev)
         if (IS_ERR(pcie->phy))
                 return PTR_ERR(pcie->phy);
 
+        pp->dev = dev;
         ret = pcie->ops->get_resources(pcie);
         if (ret)
                 return ret;
 
-        pp->dev = dev;
         pp->root_bus_nr = -1;
         pp->ops = &qcom_pcie_dw_ops;
 
diff --git a/drivers/pci/host/pcie-rockchip.c b/drivers/pci/host/pcie-rockchip.c
index e0b22dab9b7a..e04f69beb42d 100644
--- a/drivers/pci/host/pcie-rockchip.c
+++ b/drivers/pci/host/pcie-rockchip.c
@@ -190,6 +190,9 @@ struct rockchip_pcie {
         struct  reset_control *mgmt_rst;
         struct  reset_control *mgmt_sticky_rst;
         struct  reset_control *pipe_rst;
+        struct  reset_control *pm_rst;
+        struct  reset_control *aclk_rst;
+        struct  reset_control *pclk_rst;
         struct  clk *aclk_pcie;
         struct  clk *aclk_perf_pcie;
         struct  clk *hclk_pcie;
@@ -408,6 +411,44 @@ static int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
 
         gpiod_set_value(rockchip->ep_gpio, 0);
 
+        err = reset_control_assert(rockchip->aclk_rst);
+        if (err) {
+                dev_err(dev, "assert aclk_rst err %d\n", err);
+                return err;
+        }
+
+        err = reset_control_assert(rockchip->pclk_rst);
+        if (err) {
+                dev_err(dev, "assert pclk_rst err %d\n", err);
+                return err;
+        }
+
+        err = reset_control_assert(rockchip->pm_rst);
+        if (err) {
+                dev_err(dev, "assert pm_rst err %d\n", err);
+                return err;
+        }
+
+        udelay(10);
+
+        err = reset_control_deassert(rockchip->pm_rst);
+        if (err) {
+                dev_err(dev, "deassert pm_rst err %d\n", err);
+                return err;
+        }
+
+        err = reset_control_deassert(rockchip->aclk_rst);
+        if (err) {
+                dev_err(dev, "deassert mgmt_sticky_rst err %d\n", err);
+                return err;
+        }
+
+        err = reset_control_deassert(rockchip->pclk_rst);
+        if (err) {
+                dev_err(dev, "deassert mgmt_sticky_rst err %d\n", err);
+                return err;
+        }
+
         err = phy_init(rockchip->phy);
         if (err < 0) {
                 dev_err(dev, "fail to init phy, err %d\n", err);
@@ -781,6 +822,27 @@ static int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
                 return PTR_ERR(rockchip->pipe_rst);
         }
 
+        rockchip->pm_rst = devm_reset_control_get(dev, "pm");
+        if (IS_ERR(rockchip->pm_rst)) {
+                if (PTR_ERR(rockchip->pm_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing pm reset property in node\n");
+                return PTR_ERR(rockchip->pm_rst);
+        }
+
+        rockchip->pclk_rst = devm_reset_control_get(dev, "pclk");
+        if (IS_ERR(rockchip->pclk_rst)) {
+                if (PTR_ERR(rockchip->pclk_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing pclk reset property in node\n");
+                return PTR_ERR(rockchip->pclk_rst);
+        }
+
+        rockchip->aclk_rst = devm_reset_control_get(dev, "aclk");
+        if (IS_ERR(rockchip->aclk_rst)) {
+                if (PTR_ERR(rockchip->aclk_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing aclk reset property in node\n");
+                return PTR_ERR(rockchip->aclk_rst);
+        }
+
         rockchip->ep_gpio = devm_gpiod_get(dev, "ep", GPIOD_OUT_HIGH);
         if (IS_ERR(rockchip->ep_gpio)) {
                 dev_err(dev, "missing ep-gpios property in node\n");
diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
index 55f453de562e..c7f3408e3148 100644
--- a/drivers/pci/pci-mid.c
+++ b/drivers/pci/pci-mid.c
@@ -29,6 +29,11 @@ static int mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state)
         return intel_mid_pci_set_power_state(pdev, state);
 }
 
+static pci_power_t mid_pci_get_power_state(struct pci_dev *pdev)
+{
+        return intel_mid_pci_get_power_state(pdev);
+}
+
 static pci_power_t mid_pci_choose_state(struct pci_dev *pdev)
 {
         return PCI_D3hot;
@@ -52,6 +57,7 @@ static bool mid_pci_need_resume(struct pci_dev *dev)
 static struct pci_platform_pm_ops mid_pci_platform_pm = {
         .is_manageable  = mid_pci_power_manageable,
         .set_state      = mid_pci_set_power_state,
+        .get_state      = mid_pci_get_power_state,
         .choose_state   = mid_pci_choose_state,
         .sleep_wake     = mid_pci_sleep_wake,
         .run_wake       = mid_pci_run_wake,
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 66c4d8f42233..9526e341988b 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -121,6 +121,14 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
                 return -EINVAL;
         }
 
+        /*
+         * If we have a shadow copy in RAM, the PCI device doesn't respond
+         * to the shadow range, so we don't need to claim it, and upstream
+         * bridges don't need to route the range to the device.
+         */
+        if (res->flags & IORESOURCE_ROM_SHADOW)
+                return 0;
+
         root = pci_find_parent_resource(dev, res);
         if (!root) {
                 dev_info(&dev->dev, "can't claim BAR %d %pR: no compatible bridge window\n",
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 153f3122283d..b6b316de055c 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -107,7 +107,7 @@ int soc_pcmcia_regulator_set(struct soc_pcmcia_socket *skt,
 
                 ret = regulator_enable(r->reg);
         } else {
-                regulator_disable(r->reg);
+                ret = regulator_disable(r->reg);
         }
         if (ret == 0)
                 r->on = on;
diff --git a/drivers/phy/phy-da8xx-usb.c b/drivers/phy/phy-da8xx-usb.c
index 32ae78c8ca17..c85fb0b59729 100644
--- a/drivers/phy/phy-da8xx-usb.c
+++ b/drivers/phy/phy-da8xx-usb.c
@@ -198,7 +198,8 @@ static int da8xx_usb_phy_probe(struct platform_device *pdev)
         } else {
                 int ret;
 
-                ret = phy_create_lookup(d_phy->usb11_phy, "usb-phy", "ohci.0");
+                ret = phy_create_lookup(d_phy->usb11_phy, "usb-phy",
+                                        "ohci-da8xx");
                 if (ret)
                         dev_warn(dev, "Failed to create usb11 phy lookup\n");
                 ret = phy_create_lookup(d_phy->usb20_phy, "usb-phy",
@@ -216,7 +217,7 @@ static int da8xx_usb_phy_remove(struct platform_device *pdev)
 
         if (!pdev->dev.of_node) {
                 phy_remove_lookup(d_phy->usb20_phy, "usb-phy", "musb-da8xx");
-                phy_remove_lookup(d_phy->usb11_phy, "usb-phy", "ohci.0");
+                phy_remove_lookup(d_phy->usb11_phy, "usb-phy", "ohci-da8xx");
         }
 
         return 0;
diff --git a/drivers/phy/phy-rockchip-pcie.c b/drivers/phy/phy-rockchip-pcie.c
index a2b4c6b58aea..6904633cad68 100644
--- a/drivers/phy/phy-rockchip-pcie.c
+++ b/drivers/phy/phy-rockchip-pcie.c
@@ -249,21 +249,10 @@ err_refclk:
 static int rockchip_pcie_phy_exit(struct phy *phy)
 {
         struct rockchip_pcie_phy *rk_phy = phy_get_drvdata(phy);
-        int err = 0;
 
         clk_disable_unprepare(rk_phy->clk_pciephy_ref);
 
-        err = reset_control_deassert(rk_phy->phy_rst);
-        if (err) {
-                dev_err(&phy->dev, "deassert phy_rst err %d\n", err);
-                goto err_reset;
-        }
-
-        return err;
-
-err_reset:
-        clk_prepare_enable(rk_phy->clk_pciephy_ref);
-        return err;
+        return 0;
 }
 
 static const struct phy_ops ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index b9342a2af7b3..fec34f5213c4 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -264,7 +264,7 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                 return ret;
         }
 
-        if (data->cfg->enable_pmu_unk1) {
+        if (phy->pmu && data->cfg->enable_pmu_unk1) {
                 val = readl(phy->pmu + REG_PMU_UNK1);
                 writel(val & ~2, phy->pmu + REG_PMU_UNK1);
         }
diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
index c8c72e8259d3..87b46390b695 100644
--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
+++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
@@ -26,7 +26,7 @@
 
 #define ASPEED_G5_NR_PINS 228
 
-#define COND1           SIG_DESC_BIT(SCU90, 6, 0)
+#define COND1           { SCU90, BIT(6), 0, 0 }
 #define COND2           { SCU94, GENMASK(1, 0), 0, 0 }
 
 #define B14 0
diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
index 7f7700716398..5d1e505c3c63 100644
--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
@@ -844,6 +844,6 @@ static struct platform_driver iproc_gpio_driver = {
 
 static int __init iproc_gpio_init(void)
 {
-        return platform_driver_probe(&iproc_gpio_driver, iproc_gpio_probe);
+        return platform_driver_register(&iproc_gpio_driver);
 }
 arch_initcall_sync(iproc_gpio_init);
diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c b/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
index 35783db1c10b..c8deb8be1da7 100644
--- a/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
@@ -741,6 +741,6 @@ static struct platform_driver nsp_gpio_driver = {
 
 static int __init nsp_gpio_init(void)
 {
-        return platform_driver_probe(&nsp_gpio_driver, nsp_gpio_probe);
+        return platform_driver_register(&nsp_gpio_driver);
 }
 arch_initcall_sync(nsp_gpio_init);
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index 47613201269a..79c4e14a5a75 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -687,6 +687,7 @@ static int imx_pinctrl_probe_dt(struct platform_device *pdev,
         if (!info->functions)
                 return -ENOMEM;
 
+        info->group_index = 0;
         if (flat_funcs) {
                 info->ngroups = of_get_child_count(np);
         } else {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 30389f4ccab4..c43b1e9a06af 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1652,12 +1652,15 @@ static int chv_pinctrl_probe(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM_SLEEP
-static int chv_pinctrl_suspend(struct device *dev)
+static int chv_pinctrl_suspend_noirq(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+        unsigned long flags;
         int i;
 
+        raw_spin_lock_irqsave(&chv_lock, flags);
+
         pctrl->saved_intmask = readl(pctrl->regs + CHV_INTMASK);
 
         for (i = 0; i < pctrl->community->npins; i++) {
@@ -1678,15 +1681,20 @@ static int chv_pinctrl_suspend(struct device *dev)
                 ctx->padctrl1 = readl(reg);
         }
 
+        raw_spin_unlock_irqrestore(&chv_lock, flags);
+
         return 0;
 }
 
-static int chv_pinctrl_resume(struct device *dev)
+static int chv_pinctrl_resume_noirq(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+        unsigned long flags;
         int i;
 
+        raw_spin_lock_irqsave(&chv_lock, flags);
+
         /*
          * Mask all interrupts before restoring per-pin configuration
          * registers because we don't know in which state BIOS left them
@@ -1731,12 +1739,15 @@ static int chv_pinctrl_resume(struct device *dev)
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
         chv_writel(pctrl->saved_intmask, pctrl->regs + CHV_INTMASK);
 
+        raw_spin_unlock_irqrestore(&chv_lock, flags);
+
         return 0;
 }
 #endif
 
 static const struct dev_pm_ops chv_pinctrl_pm_ops = {
-        SET_LATE_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend, chv_pinctrl_resume)
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend_noirq,
+                                      chv_pinctrl_resume_noirq)
 };
 
 static const struct acpi_device_id chv_pinctrl_acpi_match[] = {
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 99da4cf91031..b7bb37167969 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1512,7 +1512,7 @@ static int st_gpiolib_register_bank(struct st_pinctrl *info,
         if (info->irqmux_base || gpio_irq > 0) {
                 err = gpiochip_irqchip_add(&bank->gpio_chip, &st_gpio_irqchip,
                                            0, handle_simple_irq,
-                                           IRQ_TYPE_LEVEL_LOW);
+                                           IRQ_TYPE_NONE);
                 if (err) {
                         gpiochip_remove(&bank->gpio_chip);
                         dev_info(dev, "could not add irqchip\n");
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index 200667f08c37..efc43711ff5c 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1092,9 +1092,11 @@ int stm32_pctl_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        ret = stm32_pctrl_dt_setup_irq(pdev, pctl);
-        if (ret)
-                return ret;
+        if (of_find_property(np, "interrupt-parent", NULL)) {
+                ret = stm32_pctrl_dt_setup_irq(pdev, pctl);
+                if (ret)
+                        return ret;
+        }
 
         for_each_child_of_node(np, child)
                 if (of_property_read_bool(child, "gpio-controller"))
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index a2323941e677..a7614fc542b5 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -934,6 +934,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
                 },
         },
         {
+                .ident = "Lenovo Yoga 900",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_BOARD_NAME, "VIUU4"),
+                },
+        },
+        {
                 .ident = "Lenovo YOGA 910-13IKB",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index ed5874217ee7..12dbb5063376 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -264,7 +264,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
                 return AE_OK;
 
         if (acpi_match_device_ids(dev, ids) == 0)
-                if (acpi_create_platform_device(dev))
+                if (acpi_create_platform_device(dev, NULL))
                         dev_info(&dev->dev,
                                  "intel-hid: created platform device\n");
 
diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index 146d02f8c9bc..78080763df51 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -164,7 +164,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
                 return AE_OK;
 
         if (acpi_match_device_ids(dev, ids) == 0)
-                if (acpi_create_platform_device(dev))
+                if (acpi_create_platform_device(dev, NULL))
                         dev_info(&dev->dev,
                                  "intel-vbtn: created platform device\n");
 
diff --git a/drivers/platform/x86/toshiba-wmi.c b/drivers/platform/x86/toshiba-wmi.c
index feac4576b837..2df07ee8f3c3 100644
--- a/drivers/platform/x86/toshiba-wmi.c
+++ b/drivers/platform/x86/toshiba-wmi.c
@@ -24,14 +24,15 @@
 #include <linux/acpi.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
+#include <linux/dmi.h>
 
 MODULE_AUTHOR("Azael Avalos");
 MODULE_DESCRIPTION("Toshiba WMI Hotkey Driver");
 MODULE_LICENSE("GPL");
 
-#define TOSHIBA_WMI_EVENT_GUID  "59142400-C6A3-40FA-BADB-8A2652834100"
+#define WMI_EVENT_GUID  "59142400-C6A3-40FA-BADB-8A2652834100"
 
-MODULE_ALIAS("wmi:"TOSHIBA_WMI_EVENT_GUID);
+MODULE_ALIAS("wmi:"WMI_EVENT_GUID);
 
 static struct input_dev *toshiba_wmi_input_dev;
 
@@ -63,6 +64,16 @@ static void toshiba_wmi_notify(u32 value, void *context)
         kfree(response.pointer);
 }
 
+static struct dmi_system_id toshiba_wmi_dmi_table[] __initdata = {
+        {
+                .ident = "Toshiba laptop",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                },
+        },
+        {}
+};
+
 static int __init toshiba_wmi_input_setup(void)
 {
         acpi_status status;
@@ -81,7 +92,7 @@ static int __init toshiba_wmi_input_setup(void)
         if (err)
                 goto err_free_dev;
 
-        status = wmi_install_notify_handler(TOSHIBA_WMI_EVENT_GUID,
+        status = wmi_install_notify_handler(WMI_EVENT_GUID,
                                             toshiba_wmi_notify, NULL);
         if (ACPI_FAILURE(status)) {
                 err = -EIO;
@@ -95,7 +106,7 @@ static int __init toshiba_wmi_input_setup(void)
         return 0;
 
  err_remove_notifier:
-        wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
+        wmi_remove_notify_handler(WMI_EVENT_GUID);
  err_free_keymap:
         sparse_keymap_free(toshiba_wmi_input_dev);
  err_free_dev:
@@ -105,7 +116,7 @@ static int __init toshiba_wmi_input_setup(void)
 
 static void toshiba_wmi_input_destroy(void)
 {
-        wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
+        wmi_remove_notify_handler(WMI_EVENT_GUID);
         sparse_keymap_free(toshiba_wmi_input_dev);
         input_unregister_device(toshiba_wmi_input_dev);
 }
@@ -114,7 +125,8 @@ static int __init toshiba_wmi_init(void)
 {
         int ret;
 
-        if (!wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
+        if (!wmi_has_guid(WMI_EVENT_GUID) ||
+            !dmi_check_system(toshiba_wmi_dmi_table))
                 return -ENODEV;
 
         ret = toshiba_wmi_input_setup();
@@ -130,7 +142,7 @@ static int __init toshiba_wmi_init(void)
 
 static void __exit toshiba_wmi_exit(void)
 {
-        if (wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
+        if (wmi_has_guid(WMI_EVENT_GUID))
                 toshiba_wmi_input_destroy();
 }
 
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 67426c0477d3..5c1519b229e0 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2754,7 +2754,7 @@ static int _regulator_set_voltage_time(struct regulator_dev *rdev,
                 ramp_delay = rdev->desc->ramp_delay;
 
         if (ramp_delay == 0) {
-                rdev_warn(rdev, "ramp_delay not set\n");
+                rdev_dbg(rdev, "ramp_delay not set\n");
                 return 0;
         }
 
diff --git a/drivers/rtc/rtc-asm9260.c b/drivers/rtc/rtc-asm9260.c
index 18a93d3e3f93..d36534965635 100644
--- a/drivers/rtc/rtc-asm9260.c
+++ b/drivers/rtc/rtc-asm9260.c
@@ -327,6 +327,7 @@ static const struct of_device_id asm9260_dt_ids[] = {
         { .compatible = "alphascale,asm9260-rtc", },
         {}
 };
+MODULE_DEVICE_TABLE(of, asm9260_dt_ids);
 
 static struct platform_driver asm9260_rtc_driver = {
         .probe          = asm9260_rtc_probe,
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index dd3d59806ffa..7030d7cd3861 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -776,7 +776,7 @@ static void cmos_do_shutdown(int rtc_irq)
         spin_unlock_irq(&rtc_lock);
 }
 
-static void __exit cmos_do_remove(struct device *dev)
+static void cmos_do_remove(struct device *dev)
 {
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         struct resource *ports;
@@ -996,8 +996,9 @@ static u32 rtc_handler(void *context)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned char rtc_control = 0;
         unsigned char rtc_intr;
+        unsigned long flags;
 
-        spin_lock_irq(&rtc_lock);
+        spin_lock_irqsave(&rtc_lock, flags);
         if (cmos_rtc.suspend_ctrl)
                 rtc_control = CMOS_READ(RTC_CONTROL);
         if (rtc_control & RTC_AIE) {
@@ -1006,7 +1007,7 @@ static u32 rtc_handler(void *context)
                 rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
                 rtc_update_irq(cmos->rtc, 1, rtc_intr);
         }
-        spin_unlock_irq(&rtc_lock);
+        spin_unlock_irqrestore(&rtc_lock, flags);
 
         pm_wakeup_event(dev, 0);
         acpi_clear_event(ACPI_EVENT_RTC);
@@ -1129,7 +1130,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
                                 pnp_irq(pnp, 0));
 }
 
-static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+static void cmos_pnp_remove(struct pnp_dev *pnp)
 {
         cmos_do_remove(&pnp->dev);
 }
@@ -1161,7 +1162,7 @@ static struct pnp_driver cmos_pnp_driver = {
         .name           = (char *) driver_name,
         .id_table       = rtc_ids,
         .probe          = cmos_pnp_probe,
-        .remove         = __exit_p(cmos_pnp_remove),
+        .remove         = cmos_pnp_remove,
         .shutdown       = cmos_pnp_shutdown,
 
         /* flag ensures resume() gets called, and stops syslog spam */
@@ -1238,7 +1239,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev)
         return cmos_do_probe(&pdev->dev, resource, irq);
 }
 
-static int __exit cmos_platform_remove(struct platform_device *pdev)
+static int cmos_platform_remove(struct platform_device *pdev)
 {
         cmos_do_remove(&pdev->dev);
         return 0;
@@ -1263,7 +1264,7 @@ static void cmos_platform_shutdown(struct platform_device *pdev)
 MODULE_ALIAS("platform:rtc_cmos");
 
 static struct platform_driver cmos_platform_driver = {
-        .remove         = __exit_p(cmos_platform_remove),
+        .remove         = cmos_platform_remove,
         .shutdown       = cmos_platform_shutdown,
         .driver = {
                 .name           = driver_name,
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index b04ea9b5ae67..51e52446eacb 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -113,6 +113,7 @@
 /* OMAP_RTC_OSC_REG bit fields: */
 #define OMAP_RTC_OSC_32KCLK_EN          BIT(6)
 #define OMAP_RTC_OSC_SEL_32KCLK_SRC     BIT(3)
+#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE  BIT(4)
 
 /* OMAP_RTC_IRQWAKEEN bit fields: */
 #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1)
@@ -146,6 +147,7 @@ struct omap_rtc {
         u8 interrupts_reg;
         bool is_pmic_controller;
         bool has_ext_clk;
+        bool is_suspending;
         const struct omap_rtc_device_type *type;
         struct pinctrl_dev *pctldev;
 };
@@ -786,8 +788,9 @@ static int omap_rtc_probe(struct platform_device *pdev)
          */
         if (rtc->has_ext_clk) {
                 reg = rtc_read(rtc, OMAP_RTC_OSC_REG);
-                rtc_write(rtc, OMAP_RTC_OSC_REG,
-                          reg | OMAP_RTC_OSC_SEL_32KCLK_SRC);
+                reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE;
+                reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC;
+                rtc_writel(rtc, OMAP_RTC_OSC_REG, reg);
         }
 
         rtc->type->lock(rtc);
@@ -898,8 +901,7 @@ static int omap_rtc_suspend(struct device *dev)
                 rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, 0);
         rtc->type->lock(rtc);
 
-        /* Disable the clock/module */
-        pm_runtime_put_sync(dev);
+        rtc->is_suspending = true;
 
         return 0;
 }
@@ -908,9 +910,6 @@ static int omap_rtc_resume(struct device *dev)
 {
         struct omap_rtc *rtc = dev_get_drvdata(dev);
 
-        /* Enable the clock/module so that we can access the registers */
-        pm_runtime_get_sync(dev);
-
         rtc->type->unlock(rtc);
         if (device_may_wakeup(dev))
                 disable_irq_wake(rtc->irq_alarm);
@@ -918,11 +917,34 @@ static int omap_rtc_resume(struct device *dev)
                 rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, rtc->interrupts_reg);
         rtc->type->lock(rtc);
 
+        rtc->is_suspending = false;
+
         return 0;
 }
 #endif
 
-static SIMPLE_DEV_PM_OPS(omap_rtc_pm_ops, omap_rtc_suspend, omap_rtc_resume);
+#ifdef CONFIG_PM
+static int omap_rtc_runtime_suspend(struct device *dev)
+{
+        struct omap_rtc *rtc = dev_get_drvdata(dev);
+
+        if (rtc->is_suspending && !rtc->has_ext_clk)
+                return -EBUSY;
+
+        return 0;
+}
+
+static int omap_rtc_runtime_resume(struct device *dev)
+{
+        return 0;
+}
+#endif
+
+static const struct dev_pm_ops omap_rtc_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(omap_rtc_suspend, omap_rtc_resume)
+        SET_RUNTIME_PM_OPS(omap_rtc_runtime_suspend,
+                           omap_rtc_runtime_resume, NULL)
+};
 
 static void omap_rtc_shutdown(struct platform_device *pdev)
 {
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 3d53d636b17b..f0cfb0451757 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2636,18 +2636,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
         struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
         struct CommandControlBlock *ccb;
         int target = cmd->device->id;
-        int lun = cmd->device->lun;
-        uint8_t scsicmd = cmd->cmnd[0];
         cmd->scsi_done = done;
         cmd->host_scribble = NULL;
         cmd->result = 0;
-        if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
-                if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
-                        cmd->result = (DID_NO_CONNECT << 16);
-                }
-                cmd->scsi_done(cmd);
-                return 0;
-        }
         if (target == 16) {
                 /* virtual device for iop message transfer */
                 arcmsr_handle_virtual_command(acb, cmd);
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index d1421139e6ea..2ffe029ff2b6 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -2081,9 +2081,10 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
         /*  never reached the xmit task callout */
         if (tdata->skb)
                 __kfree_skb(tdata->skb);
-        memset(tdata, 0, sizeof(*tdata));
 
         task_release_itt(task, task->hdr_itt);
+        memset(tdata, 0, sizeof(*tdata));
+
         iscsi_tcp_cleanup_task(task);
 }
 EXPORT_SYMBOL_GPL(cxgbi_cleanup_task);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 241829e59668..7bb20684e9fa 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -793,6 +793,7 @@ static void alua_rtpg_work(struct work_struct *work)
                 WARN_ON(pg->flags & ALUA_PG_RUN_RTPG);
                 WARN_ON(pg->flags & ALUA_PG_RUN_STPG);
                 spin_unlock_irqrestore(&pg->lock, flags);
+                kref_put(&pg->kref, release_port_group);
                 return;
         }
         if (pg->flags & ALUA_SYNC_STPG)
@@ -890,6 +891,7 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 /* Do not queue if the worker is already running */
                 if (!(pg->flags & ALUA_PG_RUNNING)) {
                         kref_get(&pg->kref);
+                        sdev = NULL;
                         start_queue = 1;
                 }
         }
@@ -901,7 +903,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
         if (start_queue &&
             !queue_delayed_work(alua_wq, &pg->rtpg_work,
                                 msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                scsi_device_put(sdev);
+                if (sdev)
+                        scsi_device_put(sdev);
                 kref_put(&pg->kref, release_port_group);
         }
 }
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index ca86c885dfaa..3aaea713bf37 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -2233,7 +2233,7 @@ struct megasas_instance_template {
 };
 
 #define MEGASAS_IS_LOGICAL(scp)                                         \
-        (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
+        ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1)
 
 #define MEGASAS_DEV_INDEX(scp)                                          \
         (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +   \
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 9ff57dee72d7..d8b1fbd4c8aa 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1700,16 +1700,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
                 goto out_done;
         }
 
-        switch (scmd->cmnd[0]) {
-        case SYNCHRONIZE_CACHE:
-                /*
-                 * FW takes care of flush cache on its own
-                 * No need to send it down
-                 */
+        /*
+         * FW takes care of flush cache on its own for Virtual Disk.
+         * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
+         */
+        if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
                 scmd->result = DID_OK << 16;
                 goto out_done;
-        default:
-                break;
         }
 
         return instance->instancet->build_and_issue_cmd(instance, scmd);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 209a969a979d..8aa769a2d919 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -1273,9 +1273,9 @@ scsih_target_alloc(struct scsi_target *starget)
                         sas_target_priv_data->handle = raid_device->handle;
                         sas_target_priv_data->sas_address = raid_device->wwid;
                         sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME;
-                        sas_target_priv_data->raid_device = raid_device;
                         if (ioc->is_warpdrive)
-                                raid_device->starget = starget;
+                                sas_target_priv_data->raid_device = raid_device;
+                        raid_device->starget = starget;
                 }
                 spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
                 return 0;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index ace65db1d2a2..567fa080e261 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -707,6 +707,11 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
         srb_t *sp;
         int rval;
 
+        if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) {
+                cmd->result = DID_NO_CONNECT << 16;
+                goto qc24_fail_command;
+        }
+
         if (ha->flags.eeh_busy) {
                 if (ha->flags.pci_channel_io_perm_failure) {
                         ql_dbg(ql_dbg_aer, vha, 0x9010,
@@ -1451,6 +1456,15 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                 for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
                         sp = req->outstanding_cmds[cnt];
                         if (sp) {
+                                /* Get a reference to the sp and drop the lock.
+                                 * The reference ensures this sp->done() call
+                                 * - and not the call in qla2xxx_eh_abort() -
+                                 * ends the SCSI command (with result 'res').
+                                 */
+                                sp_get(sp);
+                                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                                qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                spin_lock_irqsave(&ha->hardware_lock, flags);
                                 req->outstanding_cmds[cnt] = NULL;
                                 sp->done(vha, sp, res);
                         }
@@ -2341,6 +2355,8 @@ qla2xxx_scan_finished(struct Scsi_Host *shost, unsigned long time)
 {
         scsi_qla_host_t *vha = shost_priv(shost);
 
+        if (test_bit(UNLOADING, &vha->dpc_flags))
+                return 1;
         if (!vha->host)
                 return 1;
         if (time > vha->hw->loop_reset_delay * HZ)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index c905709707f0..cf04a364fd8b 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -5134,6 +5134,7 @@ static void __exit scsi_debug_exit(void)
         bus_unregister(&pseudo_lld_bus);
         root_device_unregister(pseudo_primary);
 
+        vfree(map_storep);
         vfree(dif_storep);
         vfree(fake_storep);
         kfree(sdebug_q_arr);
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 4a0d3cdc607c..15ca09cd16f3 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -793,6 +793,7 @@ static int pvscsi_abort(struct scsi_cmnd *cmd)
         unsigned long flags;
         int result = SUCCESS;
         DECLARE_COMPLETION_ONSTACK(abort_cmp);
+        int done;
 
         scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
                     adapter->host->host_no, cmd);
@@ -824,10 +825,10 @@ static int pvscsi_abort(struct scsi_cmnd *cmd)
         pvscsi_abort_cmd(adapter, ctx);
         spin_unlock_irqrestore(&adapter->hw_lock, flags);
         /* Wait for 2 secs for the completion. */
-        wait_for_completion_timeout(&abort_cmp, msecs_to_jiffies(2000));
+        done = wait_for_completion_timeout(&abort_cmp, msecs_to_jiffies(2000));
         spin_lock_irqsave(&adapter->hw_lock, flags);
 
-        if (!completion_done(&abort_cmp)) {
+        if (!done) {
                 /*
                  * Failed to abort the command, unmark the fact that it
                  * was requested to be aborted.
diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
index c097d2ccbde3..d41292ef85f2 100644
--- a/drivers/scsi/vmw_pvscsi.h
+++ b/drivers/scsi/vmw_pvscsi.h
@@ -26,7 +26,7 @@
 
 #include <linux/types.h>
 
-#define PVSCSI_DRIVER_VERSION_STRING   "1.0.6.0-k"
+#define PVSCSI_DRIVER_VERSION_STRING   "1.0.7.0-k"
 
 #define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
 
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 35c0dd945668..a67b0ff6a362 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -70,6 +70,7 @@
 #define SPI_SR                  0x2c
 #define SPI_SR_EOQF             0x10000000
 #define SPI_SR_TCFQF            0x80000000
+#define SPI_SR_CLEAR            0xdaad0000
 
 #define SPI_RSER                0x30
 #define SPI_RSER_EOQFE          0x10000000
@@ -646,6 +647,11 @@ static const struct regmap_config dspi_regmap_config = {
         .max_register = 0x88,
 };
 
+static void dspi_init(struct fsl_dspi *dspi)
+{
+        regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
+}
+
 static int dspi_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
@@ -709,6 +715,7 @@ static int dspi_probe(struct platform_device *pdev)
                 return PTR_ERR(dspi->regmap);
         }
 
+        dspi_init(dspi);
         dspi->irq = platform_get_irq(pdev, 0);
         if (dspi->irq < 0) {
                 dev_err(&pdev->dev, "can't get platform irq\n");
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index 7451585a080e..2c175b9495f7 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -458,7 +458,7 @@ static void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
 
                 mspi->len -= rx_nr_bytes;
 
-                if (mspi->rx)
+                if (rx_nr_bytes && mspi->rx)
                         mspi->get_rx(rx_data, mspi);
         }
 
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 5787b723b593..838783c3fed0 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1618,9 +1618,11 @@ static void of_register_spi_devices(struct spi_master *master)
                 if (of_node_test_and_set_flag(nc, OF_POPULATED))
                         continue;
                 spi = of_register_spi_device(master, nc);
-                if (IS_ERR(spi))
+                if (IS_ERR(spi)) {
                         dev_warn(&master->dev, "Failed to create SPI device for %s\n",
                                 nc->full_name);
+                        of_node_clear_flag(nc, OF_POPULATED);
+                }
         }
 }
 #else
@@ -3131,6 +3133,7 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
                 if (IS_ERR(spi)) {
                         pr_err("%s: failed to create for '%s'\n",
                                         __func__, rd->dn->full_name);
+                        of_node_clear_flag(rd->dn, OF_POPULATED);
                         return notifier_from_errno(PTR_ERR(spi));
                 }
                 break;
diff --git a/drivers/staging/comedi/drivers/ni_tio.c b/drivers/staging/comedi/drivers/ni_tio.c
index 7043eb0543f6..5ab49a798164 100644
--- a/drivers/staging/comedi/drivers/ni_tio.c
+++ b/drivers/staging/comedi/drivers/ni_tio.c
@@ -207,7 +207,8 @@ static int ni_tio_clock_period_ps(const struct ni_gpct *counter,
                  * clock period is specified by user with prescaling
                  * already taken into account.
                  */
-                return counter->clock_period_ps;
+                *period_ps = counter->clock_period_ps;
+                return 0;
         }
 
         switch (generic_clock_source & NI_GPCT_PRESCALE_MODE_CLOCK_SRC_MASK) {
diff --git a/drivers/staging/greybus/arche-platform.c b/drivers/staging/greybus/arche-platform.c
index 34307ac3f255..d33d6fe078ad 100644
--- a/drivers/staging/greybus/arche-platform.c
+++ b/drivers/staging/greybus/arche-platform.c
@@ -186,6 +186,7 @@ int arche_platform_change_state(enum arche_platform_state state,
 exit:
         spin_unlock_irqrestore(&arche_pdata->wake_lock, flags);
         mutex_unlock(&arche_pdata->platform_state_mutex);
+        put_device(&pdev->dev);
         of_node_put(np);
         return ret;
 }
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 5eecf1cb1028..3892a7470410 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -655,6 +655,7 @@ static void ad5933_work(struct work_struct *work)
         __be16 buf[2];
         int val[2];
         unsigned char status;
+        int ret;
 
         mutex_lock(&indio_dev->mlock);
         if (st->state == AD5933_CTRL_INIT_START_FREQ) {
@@ -662,19 +663,22 @@ static void ad5933_work(struct work_struct *work)
                 ad5933_cmd(st, AD5933_CTRL_START_SWEEP);
                 st->state = AD5933_CTRL_START_SWEEP;
                 schedule_delayed_work(&st->work, st->poll_time_jiffies);
-                mutex_unlock(&indio_dev->mlock);
-                return;
+                goto out;
         }
 
-        ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
+        ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
+        if (ret)
+                goto out;
 
         if (status & AD5933_STAT_DATA_VALID) {
                 int scan_count = bitmap_weight(indio_dev->active_scan_mask,
                                                indio_dev->masklength);
-                ad5933_i2c_read(st->client,
+                ret = ad5933_i2c_read(st->client,
                                 test_bit(1, indio_dev->active_scan_mask) ?
                                 AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA,
                                 scan_count * 2, (u8 *)buf);
+                if (ret)
+                        goto out;
 
                 if (scan_count == 2) {
                         val[0] = be16_to_cpu(buf[0]);
@@ -686,8 +690,7 @@ static void ad5933_work(struct work_struct *work)
         } else {
                 /* no data available - try again later */
                 schedule_delayed_work(&st->work, st->poll_time_jiffies);
-                mutex_unlock(&indio_dev->mlock);
-                return;
+                goto out;
         }
 
         if (status & AD5933_STAT_SWEEP_DONE) {
@@ -700,7 +703,7 @@ static void ad5933_work(struct work_struct *work)
                 ad5933_cmd(st, AD5933_CTRL_INC_FREQ);
                 schedule_delayed_work(&st->work, st->poll_time_jiffies);
         }
-
+out:
         mutex_unlock(&indio_dev->mlock);
 }
 
diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index ea15cc638097..4d9bd02ede47 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -482,6 +482,8 @@ static int bcm2048_set_rds_no_lock(struct bcm2048_device *bdev, u8 rds_on)
                                            flags);
                 memset(&bdev->rds_info, 0, sizeof(bdev->rds_info));
         }
+        if (err)
+                return err;
 
         return bcm2048_send_command(bdev, BCM2048_I2C_FM_RDS_SYSTEM,
                                     bdev->cache_fm_rds_system);
diff --git a/drivers/staging/nvec/nvec_ps2.c b/drivers/staging/nvec/nvec_ps2.c
index a324322ee0ad..499952c8ef39 100644
--- a/drivers/staging/nvec/nvec_ps2.c
+++ b/drivers/staging/nvec/nvec_ps2.c
@@ -106,13 +106,12 @@ static int nvec_mouse_probe(struct platform_device *pdev)
 {
         struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent);
         struct serio *ser_dev;
-        char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 };
 
-        ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL);
+        ser_dev = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!ser_dev)
                 return -ENOMEM;
 
-        ser_dev->id.type = SERIO_PS_PSTHRU;
+        ser_dev->id.type = SERIO_8042;
         ser_dev->write = ps2_sendcommand;
         ser_dev->start = ps2_startstreaming;
         ser_dev->stop = ps2_stopstreaming;
@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platform_device *pdev)
 
         serio_register_port(ser_dev);
 
-        /* mouse reset */
-        nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset));
-
         return 0;
 }
 
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index 955247979aaa..4ed6d8d7712a 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -601,13 +601,13 @@
 
 #define PANEL_PLANE_TL                                0x08001C
 #define PANEL_PLANE_TL_TOP_SHIFT                      16
-#define PANEL_PLANE_TL_TOP_MASK                       (0xeff << 16)
-#define PANEL_PLANE_TL_LEFT_MASK                      0xeff
+#define PANEL_PLANE_TL_TOP_MASK                       (0x7ff << 16)
+#define PANEL_PLANE_TL_LEFT_MASK                      0x7ff
 
 #define PANEL_PLANE_BR                                0x080020
 #define PANEL_PLANE_BR_BOTTOM_SHIFT                   16
-#define PANEL_PLANE_BR_BOTTOM_MASK                    (0xeff << 16)
-#define PANEL_PLANE_BR_RIGHT_MASK                     0xeff
+#define PANEL_PLANE_BR_BOTTOM_MASK                    (0x7ff << 16)
+#define PANEL_PLANE_BR_RIGHT_MASK                     0x7ff
 
 #define PANEL_HORIZONTAL_TOTAL                        0x080024
 #define PANEL_HORIZONTAL_TOTAL_TOTAL_SHIFT            16
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 78f0f85bebdc..fada988512a1 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -932,8 +932,6 @@ static int wait_serial_change(struct acm *acm, unsigned long arg)
         DECLARE_WAITQUEUE(wait, current);
         struct async_icount old, new;
 
-        if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD))
-                return -EINVAL;
         do {
                 spin_lock_irq(&acm->read_lock);
                 old = acm->oldcount;
@@ -1161,6 +1159,8 @@ static int acm_probe(struct usb_interface *intf,
         if (quirks == IGNORE_DEVICE)
                 return -ENODEV;
 
+        memset(&h, 0x00, sizeof(struct usb_cdc_parsed_header));
+
         num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
 
         /* handle quirks deadly to normal probing*/
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 7287a763cd0c..fea446900cad 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -769,15 +769,14 @@ static int dwc3_core_init(struct dwc3 *dwc)
         return 0;
 
 err4:
-        phy_power_off(dwc->usb2_generic_phy);
+        phy_power_off(dwc->usb3_generic_phy);
 
 err3:
-        phy_power_off(dwc->usb3_generic_phy);
+        phy_power_off(dwc->usb2_generic_phy);
 
 err2:
         usb_phy_set_suspend(dwc->usb2_phy, 1);
         usb_phy_set_suspend(dwc->usb3_phy, 1);
-        dwc3_core_exit(dwc);
 
 err1:
         usb_phy_shutdown(dwc->usb2_phy);
diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c
index 89a2f712fdfe..aaaf256f71dd 100644
--- a/drivers/usb/dwc3/dwc3-st.c
+++ b/drivers/usb/dwc3/dwc3-st.c
@@ -31,6 +31,7 @@
 #include <linux/slab.h>
 #include <linux/regmap.h>
 #include <linux/reset.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/usb/of.h>
 
 #include "core.h"
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 686067dd8d2c..84a1709e0784 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -579,14 +579,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 
         req->length = length;
 
-        /* throttle high/super speed IRQ rate back slightly */
-        if (gadget_is_dualspeed(dev->gadget))
-                req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
-                                       dev->gadget->speed == USB_SPEED_SUPER)) &&
-                                        !list_empty(&dev->tx_reqs))
-                        ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
-                        : 0;
-
         retval = usb_ep_queue(in, req, GFP_ATOMIC);
         switch (retval) {
         default:
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index d793f548dfe2..a9a1e4c40480 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -995,6 +995,14 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
         }
         val = readl(base + ext_cap_offset);
 
+        /* Auto handoff never worked for these devices. Force it and continue */
+        if ((pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241) ||
+                        (pdev->vendor == PCI_VENDOR_ID_RENESAS
+                         && pdev->device == 0x0014)) {
+                val = (val | XHCI_HC_OS_OWNED) & ~XHCI_HC_BIOS_OWNED;
+                writel(val, base + ext_cap_offset);
+        }
+
         /* If the BIOS owns the HC, signal that the OS wants it, and wait */
         if (val & XHCI_HC_BIOS_OWNED) {
                 writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 210b7e43a6fd..2440f88e07a3 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -479,7 +479,8 @@ static int da8xx_probe(struct platform_device *pdev)
 
         glue->phy = devm_phy_get(&pdev->dev, "usb-phy");
         if (IS_ERR(glue->phy)) {
-                dev_err(&pdev->dev, "failed to get phy\n");
+                if (PTR_ERR(glue->phy) != -EPROBE_DEFER)
+                        dev_err(&pdev->dev, "failed to get phy\n");
                 return PTR_ERR(glue->phy);
         }
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 27dadc0d9114..e01116e4c067 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2114,11 +2114,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                 musb->io.ep_offset = musb_flat_ep_offset;
                 musb->io.ep_select = musb_flat_ep_select;
         }
-        /* And override them with platform specific ops if specified. */
-        if (musb->ops->ep_offset)
-                musb->io.ep_offset = musb->ops->ep_offset;
-        if (musb->ops->ep_select)
-                musb->io.ep_select = musb->ops->ep_select;
 
         /* At least tusb6010 has its own offsets */
         if (musb->ops->ep_offset)
diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c
index d059ad4d0dbd..97ee1b46db69 100644
--- a/drivers/uwb/lc-rc.c
+++ b/drivers/uwb/lc-rc.c
@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index)
         struct uwb_rc *rc = NULL;
 
         dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match);
-        if (dev)
+        if (dev) {
                 rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
+
         return rc;
 }
 
@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc)
         if (dev) {
                 rc = dev_get_drvdata(dev);
                 __uwb_rc_get(rc);
+                put_device(dev);
         }
+
         return rc;
 }
 EXPORT_SYMBOL_GPL(__uwb_rc_try_get);
@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev)
 
         dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev,
                                 find_rc_grandpa);
-        if (dev)
+        if (dev) {
                 rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
+
         return rc;
 }
 EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa);
@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr)
         struct uwb_rc *rc = NULL;
 
         dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev);
-        if (dev)
+        if (dev) {
                 rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
 
         return rc;
 }
diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c
index c1304b8d4985..678e93741ae1 100644
--- a/drivers/uwb/pal.c
+++ b/drivers/uwb/pal.c
@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc)
 
         dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc);
 
+        put_device(dev);
+
         return (dev != NULL);
 }
 
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index d624a527777f..031bc08d000d 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -829,8 +829,9 @@ static long vfio_pci_ioctl(void *device_data,
 
         } else if (cmd == VFIO_DEVICE_SET_IRQS) {
                 struct vfio_irq_set hdr;
+                size_t size;
                 u8 *data = NULL;
-                int ret = 0;
+                int max, ret = 0;
 
                 minsz = offsetofend(struct vfio_irq_set, count);
 
@@ -838,23 +839,31 @@ static long vfio_pci_ioctl(void *device_data,
                         return -EFAULT;
 
                 if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
+                    hdr.count >= (U32_MAX - hdr.start) ||
                     hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
                                   VFIO_IRQ_SET_ACTION_TYPE_MASK))
                         return -EINVAL;
 
-                if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
-                        size_t size;
-                        int max = vfio_pci_get_irq_count(vdev, hdr.index);
+                max = vfio_pci_get_irq_count(vdev, hdr.index);
+                if (hdr.start >= max || hdr.start + hdr.count > max)
+                        return -EINVAL;
 
-                        if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
-                                size = sizeof(uint8_t);
-                        else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
-                                size = sizeof(int32_t);
-                        else
-                                return -EINVAL;
+                switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
+                case VFIO_IRQ_SET_DATA_NONE:
+                        size = 0;
+                        break;
+                case VFIO_IRQ_SET_DATA_BOOL:
+                        size = sizeof(uint8_t);
+                        break;
+                case VFIO_IRQ_SET_DATA_EVENTFD:
+                        size = sizeof(int32_t);
+                        break;
+                default:
+                        return -EINVAL;
+                }
 
-                        if (hdr.argsz - minsz < hdr.count * size ||
-                            hdr.start >= max || hdr.start + hdr.count > max)
+                if (size) {
+                        if (hdr.argsz - minsz < hdr.count * size)
                                 return -EINVAL;
 
                         data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index c2e60893cd09..1c46045b0e7f 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -256,7 +256,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
         if (!is_irq_none(vdev))
                 return -EINVAL;
 
-        vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
+        vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
         if (!vdev->ctx)
                 return -ENOMEM;
 
diff --git a/drivers/virtio/config.c b/drivers/virtio/config.c
deleted file mode 100644
index f70bcd2ff98f..000000000000
--- a/drivers/virtio/config.c
+++ /dev/null
@@ -1,12 +0,0 @@
-/* Configuration space parsing helpers for virtio.
- *
- * The configuration is [type][len][... len bytes ...] fields.
- *
- * Copyright 2007 Rusty Russell, IBM Corporation.
- * GPL v2 or later.
- */
-#include <linux/err.h>
-#include <linux/virtio.h>
-#include <linux/virtio_config.h>
-#include <linux/bug.h>
-
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 4e7003db12c4..181793f07852 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -577,6 +577,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
 
         virtio_device_ready(vdev);
 
+        if (towards_target(vb))
+                virtballoon_changed(vdev);
         return 0;
 
 out_del_vqs:
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 8c4e61783441..6d9e5173d5fa 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -212,10 +212,18 @@ int virtio_pci_legacy_probe(struct virtio_pci_device *vp_dev)
                 return -ENODEV;
         }
 
-        rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(64));
-        if (rc)
-                rc = dma_set_mask_and_coherent(&pci_dev->dev,
-                                                DMA_BIT_MASK(32));
+        rc = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(64));
+        if (rc) {
+                rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
+        } else {
+                /*
+                 * The virtio ring base address is expressed as a 32-bit PFN,
+                 * with a page size of 1 << VIRTIO_PCI_QUEUE_ADDR_SHIFT.
+                 */
+                dma_set_coherent_mask(&pci_dev->dev,
+                                DMA_BIT_MASK(32 + VIRTIO_PCI_QUEUE_ADDR_SHIFT));
+        }
+
         if (rc)
                 dev_warn(&pci_dev->dev, "Failed to enable 64-bit or 32-bit DMA.  Trying to continue, but this might not work.\n");
 
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index ed9c9eeedfe5..489bfc61cf30 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
  * making all of the arch DMA ops work on the vring device itself
  * is a mess.  For now, we use the parent device for DMA ops.
  */
-static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static inline struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
         return vq->vq.vdev->dev.parent;
 }
@@ -732,7 +732,8 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
 
         if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
                 vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
         }
 
 }
@@ -764,7 +765,8 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
          * entry. Always do both to keep code simple. */
         if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
                 vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
         }
         vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
         END_USE(vq);
@@ -832,10 +834,11 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
          * more to do. */
         /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
          * either clear the flags bit or point the event index at the next
-         * entry. Always do both to keep code simple. */
+         * entry. Always update the event index to keep code simple. */
         if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
                 vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
         }
         /* TODO: tune this threshold */
         bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
@@ -953,7 +956,8 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
         /* No callback?  Tell other side not to bother us. */
         if (!callback) {
                 vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
         }
 
         /* Put everything in free lists. */
diff --git a/fs/aio.c b/fs/aio.c
index 1157e13a36d6..428484f2f841 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
         unsigned tail, pos, head;
         unsigned long   flags;
 
+        if (kiocb->ki_flags & IOCB_WRITE) {
+                struct file *file = kiocb->ki_filp;
+
+                /*
+                 * Tell lockdep we inherited freeze protection from submission
+                 * thread.
+                 */
+                __sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
+                file_end_write(file);
+        }
+
         /*
          * Special case handling for sync iocbs:
          *  - events go directly into the iocb for fast handling
@@ -1392,122 +1403,106 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
         return -EINVAL;
 }
 
-typedef ssize_t (rw_iter_op)(struct kiocb *, struct iov_iter *);
-
-static int aio_setup_vectored_rw(int rw, char __user *buf, size_t len,
-                                 struct iovec **iovec,
-                                 bool compat,
-                                 struct iov_iter *iter)
+static int aio_setup_rw(int rw, struct iocb *iocb, struct iovec **iovec,
+                bool vectored, bool compat, struct iov_iter *iter)
 {
+        void __user *buf = (void __user *)(uintptr_t)iocb->aio_buf;
+        size_t len = iocb->aio_nbytes;
+
+        if (!vectored) {
+                ssize_t ret = import_single_range(rw, buf, len, *iovec, iter);
+                *iovec = NULL;
+                return ret;
+        }
 #ifdef CONFIG_COMPAT
         if (compat)
-                return compat_import_iovec(rw,
-                                (struct compat_iovec __user *)buf,
-                                len, UIO_FASTIOV, iovec, iter);
+                return compat_import_iovec(rw, buf, len, UIO_FASTIOV, iovec,
+                                iter);
 #endif
-        return import_iovec(rw, (struct iovec __user *)buf,
-                                len, UIO_FASTIOV, iovec, iter);
+        return import_iovec(rw, buf, len, UIO_FASTIOV, iovec, iter);
 }
 
-/*
- * aio_run_iocb:
- *      Performs the initial checks and io submission.
- */
-static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
-                            char __user *buf, size_t len, bool compat)
+static inline ssize_t aio_ret(struct kiocb *req, ssize_t ret)
+{
+        switch (ret) {
+        case -EIOCBQUEUED:
+                return ret;
+        case -ERESTARTSYS:
+        case -ERESTARTNOINTR:
+        case -ERESTARTNOHAND:
+        case -ERESTART_RESTARTBLOCK:
+                /*
+                 * There's no easy way to restart the syscall since other AIO's
+                 * may be already running. Just fail this IO with EINTR.
+                 */
+                ret = -EINTR;
+                /*FALLTHRU*/
+        default:
+                aio_complete(req, ret, 0);
+                return 0;
+        }
+}
+
+static ssize_t aio_read(struct kiocb *req, struct iocb *iocb, bool vectored,
+                bool compat)
 {
         struct file *file = req->ki_filp;
-        ssize_t ret;
-        int rw;
-        fmode_t mode;
-        rw_iter_op *iter_op;
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct iov_iter iter;
+        ssize_t ret;
 
-        switch (opcode) {
-        case IOCB_CMD_PREAD:
-        case IOCB_CMD_PREADV:
-                mode    = FMODE_READ;
-                rw      = READ;
-                iter_op = file->f_op->read_iter;
-                goto rw_common;
-
-        case IOCB_CMD_PWRITE:
-        case IOCB_CMD_PWRITEV:
-                mode    = FMODE_WRITE;
-                rw      = WRITE;
-                iter_op = file->f_op->write_iter;
-                goto rw_common;
-rw_common:
-                if (unlikely(!(file->f_mode & mode)))
-                        return -EBADF;
-
-                if (!iter_op)
-                        return -EINVAL;
-
-                if (opcode == IOCB_CMD_PREADV || opcode == IOCB_CMD_PWRITEV)
-                        ret = aio_setup_vectored_rw(rw, buf, len,
-                                                &iovec, compat, &iter);
-                else {
-                        ret = import_single_range(rw, buf, len, iovec, &iter);
-                        iovec = NULL;
-                }
-                if (!ret)
-                        ret = rw_verify_area(rw, file, &req->ki_pos,
-                                             iov_iter_count(&iter));
-                if (ret < 0) {
-                        kfree(iovec);
-                        return ret;
-                }
-
-                if (rw == WRITE)
-                        file_start_write(file);
-
-                ret = iter_op(req, &iter);
-
-                if (rw == WRITE)
-                        file_end_write(file);
-                kfree(iovec);
-                break;
-
-        case IOCB_CMD_FDSYNC:
-                if (!file->f_op->aio_fsync)
-                        return -EINVAL;
-
-                ret = file->f_op->aio_fsync(req, 1);
-                break;
+        if (unlikely(!(file->f_mode & FMODE_READ)))
+                return -EBADF;
+        if (unlikely(!file->f_op->read_iter))
+                return -EINVAL;
 
-        case IOCB_CMD_FSYNC:
-                if (!file->f_op->aio_fsync)
-                        return -EINVAL;
+        ret = aio_setup_rw(READ, iocb, &iovec, vectored, compat, &iter);
+        if (ret)
+                return ret;
+        ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter));
+        if (!ret)
+                ret = aio_ret(req, file->f_op->read_iter(req, &iter));
+        kfree(iovec);
+        return ret;
+}
 
-                ret = file->f_op->aio_fsync(req, 0);
-                break;
+static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
+                bool compat)
+{
+        struct file *file = req->ki_filp;
+        struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
+        struct iov_iter iter;
+        ssize_t ret;
 
-        default:
-                pr_debug("EINVAL: no operation provided\n");
+        if (unlikely(!(file->f_mode & FMODE_WRITE)))
+                return -EBADF;
+        if (unlikely(!file->f_op->write_iter))
                 return -EINVAL;
-        }
 
-        if (ret != -EIOCBQUEUED) {
+        ret = aio_setup_rw(WRITE, iocb, &iovec, vectored, compat, &iter);
+        if (ret)
+                return ret;
+        ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter));
+        if (!ret) {
+                req->ki_flags |= IOCB_WRITE;
+                file_start_write(file);
+                ret = aio_ret(req, file->f_op->write_iter(req, &iter));
                 /*
-                 * There's no easy way to restart the syscall since other AIO's
-                 * may be already running. Just fail this IO with EINTR.
+                 * We release freeze protection in aio_complete().  Fool lockdep
+                 * by telling it the lock got released so that it doesn't
+                 * complain about held lock when we return to userspace.
                  */
-                if (unlikely(ret == -ERESTARTSYS || ret == -ERESTARTNOINTR ||
-                             ret == -ERESTARTNOHAND ||
-                             ret == -ERESTART_RESTARTBLOCK))
-                        ret = -EINTR;
-                aio_complete(req, ret, 0);
+                __sb_writers_release(file_inode(file)->i_sb, SB_FREEZE_WRITE);
         }
-
-        return 0;
+        kfree(iovec);
+        return ret;
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                          struct iocb *iocb, bool compat)
 {
         struct aio_kiocb *req;
+        struct file *file;
         ssize_t ret;
 
         /* enforce forwards compatibility on users */
@@ -1530,7 +1525,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         if (unlikely(!req))
                 return -EAGAIN;
 
-        req->common.ki_filp = fget(iocb->aio_fildes);
+        req->common.ki_filp = file = fget(iocb->aio_fildes);
         if (unlikely(!req->common.ki_filp)) {
                 ret = -EBADF;
                 goto out_put_req;
@@ -1565,13 +1560,29 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         req->ki_user_iocb = user_iocb;
         req->ki_user_data = iocb->aio_data;
 
-        ret = aio_run_iocb(&req->common, iocb->aio_lio_opcode,
-                           (char __user *)(unsigned long)iocb->aio_buf,
-                           iocb->aio_nbytes,
-                           compat);
-        if (ret)
-                goto out_put_req;
+        get_file(file);
+        switch (iocb->aio_lio_opcode) {
+        case IOCB_CMD_PREAD:
+                ret = aio_read(&req->common, iocb, false, compat);
+                break;
+        case IOCB_CMD_PWRITE:
+                ret = aio_write(&req->common, iocb, false, compat);
+                break;
+        case IOCB_CMD_PREADV:
+                ret = aio_read(&req->common, iocb, true, compat);
+                break;
+        case IOCB_CMD_PWRITEV:
+                ret = aio_write(&req->common, iocb, true, compat);
+                break;
+        default:
+                pr_debug("invalid aio operation %d\n", iocb->aio_lio_opcode);
+                ret = -EINVAL;
+                break;
+        }
+        fput(file);
 
+        if (ret && ret != -EIOCBQUEUED)
+                goto out_put_req;
         return 0;
 out_put_req:
         put_reqs_available(ctx, 1);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 210c94ac8818..4607af38c72e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2647,7 +2647,10 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
 
                 btrfs_free_delayed_extent_op(extent_op);
                 if (ret) {
+                        spin_lock(&delayed_refs->lock);
                         locked_ref->processing = 0;
+                        delayed_refs->num_heads_ready++;
+                        spin_unlock(&delayed_refs->lock);
                         btrfs_delayed_ref_unlock(locked_ref);
                         btrfs_put_delayed_ref(ref);
                         btrfs_debug(fs_info, "run_one_delayed_ref returned %d",
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 66a755150056..8ed05d95584a 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -5569,7 +5569,7 @@ void le_bitmap_set(u8 *map, unsigned int start, int len)
                 *p |= mask_to_set;
                 len -= bits_to_set;
                 bits_to_set = BITS_PER_BYTE;
-                mask_to_set = ~(u8)0;
+                mask_to_set = ~0;
                 p++;
         }
         if (len) {
@@ -5589,7 +5589,7 @@ void le_bitmap_clear(u8 *map, unsigned int start, int len)
                 *p &= ~mask_to_clear;
                 len -= bits_to_clear;
                 bits_to_clear = BITS_PER_BYTE;
-                mask_to_clear = ~(u8)0;
+                mask_to_clear = ~0;
                 p++;
         }
         if (len) {
@@ -5679,7 +5679,7 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
                 kaddr[offset] |= mask_to_set;
                 len -= bits_to_set;
                 bits_to_set = BITS_PER_BYTE;
-                mask_to_set = ~(u8)0;
+                mask_to_set = ~0;
                 if (++offset >= PAGE_SIZE && len > 0) {
                         offset = 0;
                         page = eb->pages[++i];
@@ -5721,7 +5721,7 @@ void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
                 kaddr[offset] &= ~mask_to_clear;
                 len -= bits_to_clear;
                 bits_to_clear = BITS_PER_BYTE;
-                mask_to_clear = ~(u8)0;
+                mask_to_clear = ~0;
                 if (++offset >= PAGE_SIZE && len > 0) {
                         offset = 0;
                         page = eb->pages[++i];
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 2b790bda7998..8e3a5a266917 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4605,8 +4605,8 @@ delete:
                         BUG_ON(ret);
                         if (btrfs_should_throttle_delayed_refs(trans, root))
                                 btrfs_async_run_delayed_refs(root,
-                                                             trans->transid,
-                                        trans->delayed_ref_updates * 2, 0);
+                                        trans->delayed_ref_updates * 2,
+                                        trans->transid, 0);
                         if (be_nice) {
                                 if (truncate_space_check(trans, root,
                                                          extent_num_bytes)) {
@@ -8931,9 +8931,14 @@ again:
          *    So even we call qgroup_free_data(), it won't decrease reserved
          *    space.
          * 2) Not written to disk
-         *    This means the reserved space should be freed here.
+         *    This means the reserved space should be freed here. However,
+         *    if a truncate invalidates the page (by clearing PageDirty)
+         *    and the page is accounted for while allocating extent
+         *    in btrfs_check_data_free_space() we let delayed_ref to
+         *    free the entire extent.
          */
-        btrfs_qgroup_free_data(inode, page_start, PAGE_SIZE);
+        if (PageDirty(page))
+                btrfs_qgroup_free_data(inode, page_start, PAGE_SIZE);
         if (!inode_evicting) {
                 clear_extent_bit(tree, page_start, page_end,
                                  EXTENT_LOCKED | EXTENT_DIRTY |
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 18e1aa0f85f5..7acbd2cf6192 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3814,6 +3814,11 @@ process_slot:
                 }
                 btrfs_release_path(path);
                 key.offset = next_key_min_offset;
+
+                if (fatal_signal_pending(current)) {
+                        ret = -EINTR;
+                        goto out;
+                }
         }
         ret = 0;
 
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 0ec8ffa37ab0..c4af0cdb783d 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2728,7 +2728,14 @@ static int do_relocation(struct btrfs_trans_handle *trans,
 
                 bytenr = btrfs_node_blockptr(upper->eb, slot);
                 if (lowest) {
-                        BUG_ON(bytenr != node->bytenr);
+                        if (bytenr != node->bytenr) {
+                                btrfs_err(root->fs_info,
+                "lowest leaf/node mismatch: bytenr %llu node->bytenr %llu slot %d upper %llu",
+                                          bytenr, node->bytenr, slot,
+                                          upper->eb->start);
+                                err = -EIO;
+                                goto next;
+                        }
                 } else {
                         if (node->eb->start == bytenr)
                                 goto next;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 18630e800208..f995e3528a33 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1770,7 +1770,6 @@ const struct file_operations ceph_file_fops = {
         .fsync = ceph_fsync,
         .lock = ceph_lock,
         .flock = ceph_flock,
-        .splice_read = generic_file_splice_read,
         .splice_write = iter_file_splice_write,
         .unlocked_ioctl = ceph_ioctl,
         .compat_ioctl   = ceph_ioctl,
diff --git a/fs/coredump.c b/fs/coredump.c
index 281b768000e6..eb9c92c9b20f 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -1,6 +1,7 @@
 #include <linux/slab.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
+#include <linux/freezer.h>
 #include <linux/mm.h>
 #include <linux/stat.h>
 #include <linux/fcntl.h>
@@ -423,7 +424,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
         if (core_waiters > 0) {
                 struct core_thread *ptr;
 
+                freezer_do_not_count();
                 wait_for_completion(&core_state->startup);
+                freezer_count();
                 /*
                  * Wait for all the threads to become inactive, so that
                  * all the thread context (extended register state, like
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 7555ba889d1f..ebecfb8fba06 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -314,7 +314,8 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
                 /* Match the full socket address */
                 if (!rpc_cmp_addr_port(sap, clap))
                         /* Match all xprt_switch full socket addresses */
-                        if (!rpc_clnt_xprt_switch_has_addr(clp->cl_rpcclient,
+                        if (IS_ERR(clp->cl_rpcclient) ||
+                            !rpc_clnt_xprt_switch_has_addr(clp->cl_rpcclient,
                                                            sap))
                                 continue;
 
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index c8162c660c44..5551e8ef67fd 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -98,7 +98,7 @@ rename_retry:
                 return end;
         }
         namelen = strlen(base);
-        if (flags & NFS_PATH_CANONICAL) {
+        if (*end == '/') {
                 /* Strip off excess slashes in base string */
                 while (namelen > 0 && base[namelen - 1] == '/')
                         namelen--;
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index b62973045a3e..a61350f75c74 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -178,12 +178,14 @@ static int nfs4_slot_get_seqid(struct nfs4_slot_table  *tbl, u32 slotid,
         __must_hold(&tbl->slot_tbl_lock)
 {
         struct nfs4_slot *slot;
+        int ret;
 
         slot = nfs4_lookup_slot(tbl, slotid);
-        if (IS_ERR(slot))
-                return PTR_ERR(slot);
-        *seq_nr = slot->seq_nr;
-        return 0;
+        ret = PTR_ERR_OR_ZERO(slot);
+        if (!ret)
+                *seq_nr = slot->seq_nr;
+
+        return ret;
 }
 
 /*
@@ -196,7 +198,7 @@ static int nfs4_slot_get_seqid(struct nfs4_slot_table  *tbl, u32 slotid,
 static bool nfs4_slot_seqid_in_use(struct nfs4_slot_table *tbl,
                 u32 slotid, u32 seq_nr)
 {
-        u32 cur_seq;
+        u32 cur_seq = 0;
         bool ret = false;
 
         spin_lock(&tbl->slot_tbl_lock);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 56b2d96f9103..259ef85f435a 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -146,6 +146,8 @@ set_pnfs_layoutdriver(struct nfs_server *server, const struct nfs_fh *mntfh,
         u32 id;
         int i;
 
+        if (fsinfo->nlayouttypes == 0)
+                goto out_no_driver;
         if (!(server->nfs_client->cl_exchange_flags &
                  (EXCHGID4_FLAG_USE_NON_PNFS | EXCHGID4_FLAG_USE_PNFS_MDS))) {
                 printk(KERN_ERR "NFS: %s: cl_exchange_flags 0x%x\n",
diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
index b10d557f9c9e..ee36efd5aece 100644
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -84,6 +84,8 @@ struct nfsd_net {
         struct list_head client_lru;
         struct list_head close_lru;
         struct list_head del_recall_lru;
+
+        /* protected by blocked_locks_lock */
         struct list_head blocked_locks_lru;
 
         struct delayed_work laundromat_work;
@@ -91,6 +93,9 @@ struct nfsd_net {
         /* client_lock protects the client lru list and session hash table */
         spinlock_t client_lock;
 
+        /* protects blocked_locks_lru */
+        spinlock_t blocked_locks_lock;
+
         struct file *rec_file;
         bool in_grace;
         const struct nfsd4_client_tracking_ops *client_tracking_ops;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9752beb78659..4b4beaaa4eaa 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -217,7 +217,7 @@ find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 {
         struct nfsd4_blocked_lock *cur, *found = NULL;
 
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
                 if (fh_match(fh, &cur->nbl_fh)) {
                         list_del_init(&cur->nbl_list);
@@ -226,7 +226,7 @@ find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
                         break;
                 }
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
         if (found)
                 posix_unblock_lock(&found->nbl_lock);
         return found;
@@ -1227,9 +1227,7 @@ static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
 
 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 {
-        struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
-
-        lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
+        lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
 
         list_del_init(&stp->st_locks);
         nfs4_unhash_stid(&stp->st_stid);
@@ -1238,12 +1236,12 @@ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 
 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 {
-        struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
+        struct nfs4_client *clp = stp->st_stid.sc_client;
         bool unhashed;
 
-        spin_lock(&oo->oo_owner.so_client->cl_lock);
+        spin_lock(&clp->cl_lock);
         unhashed = unhash_lock_stateid(stp);
-        spin_unlock(&oo->oo_owner.so_client->cl_lock);
+        spin_unlock(&clp->cl_lock);
         if (unhashed)
                 nfs4_put_stid(&stp->st_stid);
 }
@@ -4665,7 +4663,7 @@ nfs4_laundromat(struct nfsd_net *nn)
          * indefinitely once the lock does become free.
          */
         BUG_ON(!list_empty(&reaplist));
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         while (!list_empty(&nn->blocked_locks_lru)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
                                         struct nfsd4_blocked_lock, nbl_lru);
@@ -4678,7 +4676,7 @@ nfs4_laundromat(struct nfsd_net *nn)
                 list_move(&nbl->nbl_lru, &reaplist);
                 list_del_init(&nbl->nbl_list);
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         while (!list_empty(&reaplist)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
@@ -5439,13 +5437,13 @@ nfsd4_lm_notify(struct file_lock *fl)
         bool queue = false;
 
         /* An empty list means that something else is going to be using it */
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         if (!list_empty(&nbl->nbl_list)) {
                 list_del_init(&nbl->nbl_list);
                 list_del_init(&nbl->nbl_lru);
                 queue = true;
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         if (queue)
                 nfsd4_run_cb(&nbl->nbl_cb);
@@ -5868,10 +5866,10 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         if (fl_flags & FL_SLEEP) {
                 nbl->nbl_time = jiffies;
-                spin_lock(&nn->client_lock);
+                spin_lock(&nn->blocked_locks_lock);
                 list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
                 list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
-                spin_unlock(&nn->client_lock);
+                spin_unlock(&nn->blocked_locks_lock);
         }
 
         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
@@ -5900,10 +5898,10 @@ out:
         if (nbl) {
                 /* dequeue it if we queued it before */
                 if (fl_flags & FL_SLEEP) {
-                        spin_lock(&nn->client_lock);
+                        spin_lock(&nn->blocked_locks_lock);
                         list_del_init(&nbl->nbl_list);
                         list_del_init(&nbl->nbl_lru);
-                        spin_unlock(&nn->client_lock);
+                        spin_unlock(&nn->blocked_locks_lock);
                 }
                 free_blocked_lock(nbl);
         }
@@ -6943,9 +6941,11 @@ static int nfs4_state_create_net(struct net *net)
         INIT_LIST_HEAD(&nn->client_lru);
         INIT_LIST_HEAD(&nn->close_lru);
         INIT_LIST_HEAD(&nn->del_recall_lru);
-        INIT_LIST_HEAD(&nn->blocked_locks_lru);
         spin_lock_init(&nn->client_lock);
 
+        spin_lock_init(&nn->blocked_locks_lock);
+        INIT_LIST_HEAD(&nn->blocked_locks_lru);
+
         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
         get_net(net);
 
@@ -7063,14 +7063,14 @@ nfs4_state_shutdown_net(struct net *net)
         }
 
         BUG_ON(!list_empty(&reaplist));
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         while (!list_empty(&nn->blocked_locks_lru)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
                                         struct nfsd4_blocked_lock, nbl_lru);
                 list_move(&nbl->nbl_lru, &reaplist);
                 list_del_init(&nbl->nbl_list);
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         while (!list_empty(&reaplist)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
index a18613579001..0ee19ecc982d 100644
--- a/fs/ntfs/dir.c
+++ b/fs/ntfs/dir.c
@@ -1544,8 +1544,6 @@ const struct file_operations ntfs_dir_ops = {
         .iterate        = ntfs_readdir,         /* Read directory contents. */
 #ifdef NTFS_RW
         .fsync          = ntfs_dir_fsync,       /* Sync a directory to disk. */
-        /*.aio_fsync    = ,*/                   /* Sync all outstanding async
-                                                   i/o operations on a kiocb. */
 #endif /* NTFS_RW */
         /*.ioctl        = ,*/                   /* Perform function on the
                                                    mounted filesystem. */
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index e7054e2ac922..3ecb9f337b7d 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -3699,7 +3699,7 @@ static void ocfs2_dx_dir_transfer_leaf(struct inode *dir, u32 split_hash,
 static int ocfs2_dx_dir_rebalance_credits(struct ocfs2_super *osb,
                                           struct ocfs2_dx_root_block *dx_root)
 {
-        int credits = ocfs2_clusters_to_blocks(osb->sb, 2);
+        int credits = ocfs2_clusters_to_blocks(osb->sb, 3);
 
         credits += ocfs2_calc_extend_credits(osb->sb, &dx_root->dr_list);
         credits += ocfs2_quota_trans_credits(osb->sb);
diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
index eb09aa026723..d484068ca716 100644
--- a/fs/orangefs/orangefs-debugfs.c
+++ b/fs/orangefs/orangefs-debugfs.c
@@ -141,6 +141,9 @@ static struct client_debug_mask client_debug_mask;
  */
 static DEFINE_MUTEX(orangefs_debug_lock);
 
+/* Used to protect data in ORANGEFS_KMOD_DEBUG_HELP_FILE */
+static DEFINE_MUTEX(orangefs_help_file_lock);
+
 /*
  * initialize kmod debug operations, create orangefs debugfs dir and
  * ORANGEFS_KMOD_DEBUG_HELP_FILE.
@@ -289,6 +292,8 @@ static void *help_start(struct seq_file *m, loff_t *pos)
 
         gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_start: start\n");
 
+        mutex_lock(&orangefs_help_file_lock);
+
         if (*pos == 0)
                 payload = m->private;
 
@@ -305,6 +310,7 @@ static void *help_next(struct seq_file *m, void *v, loff_t *pos)
 static void help_stop(struct seq_file *m, void *p)
 {
         gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_stop: start\n");
+        mutex_unlock(&orangefs_help_file_lock);
 }
 
 static int help_show(struct seq_file *m, void *v)
@@ -610,32 +616,54 @@ out:
  * /sys/kernel/debug/orangefs/debug-help can be catted to
  * see all the available kernel and client debug keywords.
  *
- * When the kernel boots, we have no idea what keywords the
+ * When orangefs.ko initializes, we have no idea what keywords the
  * client supports, nor their associated masks.
  *
- * We pass through this function once at boot and stamp a
+ * We pass through this function once at module-load and stamp a
  * boilerplate "we don't know" message for the client in the
  * debug-help file. We pass through here again when the client
  * starts and then we can fill out the debug-help file fully.
  *
  * The client might be restarted any number of times between
- * reboots, we only build the debug-help file the first time.
+ * module reloads, we only build the debug-help file the first time.
  */
 int orangefs_prepare_debugfs_help_string(int at_boot)
 {
-        int rc = -EINVAL;
-        int i;
-        int byte_count = 0;
         char *client_title = "Client Debug Keywords:\n";
         char *kernel_title = "Kernel Debug Keywords:\n";
+        size_t string_size =  DEBUG_HELP_STRING_SIZE;
+        size_t result_size;
+        size_t i;
+        char *new;
+        int rc = -EINVAL;
 
         gossip_debug(GOSSIP_UTILS_DEBUG, "%s: start\n", __func__);
 
-        if (at_boot) {
-                byte_count += strlen(HELP_STRING_UNINITIALIZED);
+        if (at_boot)
                 client_title = HELP_STRING_UNINITIALIZED;
-        } else {
-                /*
+
+        /* build a new debug_help_string. */
+        new = kzalloc(DEBUG_HELP_STRING_SIZE, GFP_KERNEL);
+        if (!new) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        /*
+         * strlcat(dst, src, size) will append at most
+         * "size - strlen(dst) - 1" bytes of src onto dst,
+         * null terminating the result, and return the total
+         * length of the string it tried to create.
+         *
+         * We'll just plow through here building our new debug
+         * help string and let strlcat take care of assuring that
+         * dst doesn't overflow.
+         */
+        strlcat(new, client_title, string_size);
+
+        if (!at_boot) {
+
+                /*
                  * fill the client keyword/mask array and remember
                  * how many elements there were.
                  */
@@ -644,64 +672,40 @@ int orangefs_prepare_debugfs_help_string(int at_boot)
                 if (cdm_element_count <= 0)
                         goto out;
 
-                /* Count the bytes destined for debug_help_string. */
-                byte_count += strlen(client_title);
-
                 for (i = 0; i < cdm_element_count; i++) {
-                        byte_count += strlen(cdm_array[i].keyword + 2);
-                        if (byte_count >= DEBUG_HELP_STRING_SIZE) {
-                                pr_info("%s: overflow 1!\n", __func__);
-                                goto out;
-                        }
+                        strlcat(new, "\t", string_size);
+                        strlcat(new, cdm_array[i].keyword, string_size);
+                        strlcat(new, "\n", string_size);
                 }
-
-                gossip_debug(GOSSIP_UTILS_DEBUG,
-                             "%s: cdm_element_count:%d:\n",
-                             __func__,
-                             cdm_element_count);
         }
 
-        byte_count += strlen(kernel_title);
+        strlcat(new, "\n", string_size);
+        strlcat(new, kernel_title, string_size);
+
         for (i = 0; i < num_kmod_keyword_mask_map; i++) {
-                byte_count +=
-                        strlen(s_kmod_keyword_mask_map[i].keyword + 2);
-                if (byte_count >= DEBUG_HELP_STRING_SIZE) {
-                        pr_info("%s: overflow 2!\n", __func__);
-                        goto out;
-                }
+                strlcat(new, "\t", string_size);
+                strlcat(new, s_kmod_keyword_mask_map[i].keyword, string_size);
+                result_size = strlcat(new, "\n", string_size);
         }
 
-        /* build debug_help_string. */
-        debug_help_string = kzalloc(DEBUG_HELP_STRING_SIZE, GFP_KERNEL);
-        if (!debug_help_string) {
-                rc = -ENOMEM;
+        /* See if we tried to put too many bytes into "new"... */
+        if (result_size >= string_size) {
+                kfree(new);
                 goto out;
         }
 
-        strcat(debug_help_string, client_title);
-
-        if (!at_boot) {
-                for (i = 0; i < cdm_element_count; i++) {
-                        strcat(debug_help_string, "\t");
-                        strcat(debug_help_string, cdm_array[i].keyword);
-                        strcat(debug_help_string, "\n");
-                }
-        }
-
-        strcat(debug_help_string, "\n");
-        strcat(debug_help_string, kernel_title);
-
-        for (i = 0; i < num_kmod_keyword_mask_map; i++) {
-                strcat(debug_help_string, "\t");
-                strcat(debug_help_string, s_kmod_keyword_mask_map[i].keyword);
-                strcat(debug_help_string, "\n");
+        if (at_boot) {
+                debug_help_string = new;
+        } else {
+                mutex_lock(&orangefs_help_file_lock);
+                memset(debug_help_string, 0, DEBUG_HELP_STRING_SIZE);
+                strlcat(debug_help_string, new, string_size);
+                mutex_unlock(&orangefs_help_file_lock);
         }
 
         rc = 0;
 
-out:
-
-        return rc;
+out:    return rc;
 
 }
 
@@ -959,8 +963,12 @@ int orangefs_debugfs_new_client_string(void __user *arg)
         ret = copy_from_user(&client_debug_array_string,
                                      (void __user *)arg,
                                      ORANGEFS_MAX_DEBUG_STRING_LEN);
-        if (ret != 0)
+
+        if (ret != 0) {
+                pr_info("%s: CLIENT_STRING: copy_from_user failed\n",
+                        __func__);
                 return -EIO;
+        }
 
         /*
          * The real client-core makes an effort to ensure
@@ -975,45 +983,18 @@ int orangefs_debugfs_new_client_string(void __user *arg)
         client_debug_array_string[ORANGEFS_MAX_DEBUG_STRING_LEN - 1] =
                 '\0';
         
-        if (ret != 0) {
-                pr_info("%s: CLIENT_STRING: copy_from_user failed\n",
-                        __func__);
-                return -EIO;
-        }
-
         pr_info("%s: client debug array string has been received.\n",
                 __func__);
 
         if (!help_string_initialized) {
 
-                /* Free the "we don't know yet" default string... */
-                kfree(debug_help_string);
-
-                /* build a proper debug help string */
+                /* Build a proper debug help string. */
                 if (orangefs_prepare_debugfs_help_string(0)) {
                         gossip_err("%s: no debug help string \n",
                                    __func__);
                         return -EIO;
                 }
 
-                /* Replace the boilerplate boot-time debug-help file. */
-                debugfs_remove(help_file_dentry);
-
-                help_file_dentry =
-                        debugfs_create_file(
-                                ORANGEFS_KMOD_DEBUG_HELP_FILE,
-                                0444,
-                                debug_dir,
-                                debug_help_string,
-                                &debug_help_fops);
-
-                if (!help_file_dentry) {
-                        gossip_err("%s: debugfs_create_file failed for"
-                                   " :%s:!\n",
-                                   __func__,
-                                   ORANGEFS_KMOD_DEBUG_HELP_FILE);
-                        return -EIO;
-                }
         }
 
         debug_mask_to_string(&client_debug_mask, 1);
diff --git a/fs/orangefs/orangefs-mod.c b/fs/orangefs/orangefs-mod.c
index 2e5b03065f34..4113eb0495bf 100644
--- a/fs/orangefs/orangefs-mod.c
+++ b/fs/orangefs/orangefs-mod.c
@@ -124,7 +124,7 @@ static int __init orangefs_init(void)
          * unknown at boot time.
          *
          * orangefs_prepare_debugfs_help_string will be used again
-         * later to rebuild the debug-help file after the client starts
+         * later to rebuild the debug-help-string after the client starts
          * and passes along the needed info. The argument signifies
          * which time orangefs_prepare_debugfs_help_string is being
          * called.
@@ -152,7 +152,9 @@ static int __init orangefs_init(void)
 
         ret = register_filesystem(&orangefs_fs_type);
         if (ret == 0) {
-                pr_info("orangefs: module version %s loaded\n", ORANGEFS_VERSION);
+                pr_info("%s: module version %s loaded\n",
+                        __func__,
+                        ORANGEFS_VERSION);
                 ret = 0;
                 goto out;
         }
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index aeb60f791418..36795eed40b0 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -178,6 +178,8 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
                 len -= bytes;
         }
 
+        if (!error)
+                error = vfs_fsync(new_file, 0);
         fput(new_file);
 out_fput:
         fput(old_file);
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index c58f01babf30..7fb53d055537 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -270,9 +270,6 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type)
         if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !IS_POSIXACL(realinode))
                 return NULL;
 
-        if (!realinode->i_op->get_acl)
-                return NULL;
-
         old_cred = ovl_override_creds(inode->i_sb);
         acl = get_acl(realinode, type);
         revert_creds(old_cred);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index bcf3965be819..edd46a0e951d 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1037,6 +1037,21 @@ ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
 
         posix_acl_release(acl);
 
+        /*
+         * Check if sgid bit needs to be cleared (actual setacl operation will
+         * be done with mounter's capabilities and so that won't do it for us).
+         */
+        if (unlikely(inode->i_mode & S_ISGID) &&
+            handler->flags == ACL_TYPE_ACCESS &&
+            !in_group_p(inode->i_gid) &&
+            !capable_wrt_inode_uidgid(inode, CAP_FSETID)) {
+                struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
+
+                err = ovl_setattr(dentry, &iattr);
+                if (err)
+                        return err;
+        }
+
         err = ovl_xattr_set(dentry, handler->name, value, size, flags);
         if (!err)
                 ovl_copyattr(ovl_inode_real(inode, NULL), inode);
diff --git a/fs/splice.c b/fs/splice.c
index 153d4f3bd441..dcaf185a5731 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -299,13 +299,8 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
 {
         struct iov_iter to;
         struct kiocb kiocb;
-        loff_t isize;
         int idx, ret;
 
-        isize = i_size_read(in->f_mapping->host);
-        if (unlikely(*ppos >= isize))
-                return 0;
-
         iov_iter_pipe(&to, ITER_PIPE | READ, pipe, len);
         idx = to.idx;
         init_sync_kiocb(&kiocb, in);
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 613c5cf19436..5c2929f94bd3 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -199,9 +199,9 @@ xfs_defer_intake_work(
         struct xfs_defer_pending        *dfp;
 
         list_for_each_entry(dfp, &dop->dop_intake, dfp_list) {
-                trace_xfs_defer_intake_work(tp->t_mountp, dfp);
                 dfp->dfp_intent = dfp->dfp_type->create_intent(tp,
                                 dfp->dfp_count);
+                trace_xfs_defer_intake_work(tp->t_mountp, dfp);
                 list_sort(tp->t_mountp, &dfp->dfp_work,
                                 dfp->dfp_type->diff_items);
                 list_for_each(li, &dfp->dfp_work)
@@ -221,21 +221,14 @@ xfs_defer_trans_abort(
         struct xfs_defer_pending        *dfp;
 
         trace_xfs_defer_trans_abort(tp->t_mountp, dop);
-        /*
-         * If the transaction was committed, drop the intent reference
-         * since we're bailing out of here. The other reference is
-         * dropped when the intent hits the AIL.  If the transaction
-         * was not committed, the intent is freed by the intent item
-         * unlock handler on abort.
-         */
-        if (!dop->dop_committed)
-                return;
 
-        /* Abort intent items. */
+        /* Abort intent items that don't have a done item. */
         list_for_each_entry(dfp, &dop->dop_pending, dfp_list) {
                 trace_xfs_defer_pending_abort(tp->t_mountp, dfp);
-                if (!dfp->dfp_done)
+                if (dfp->dfp_intent && !dfp->dfp_done) {
                         dfp->dfp_type->abort_intent(dfp->dfp_intent);
+                        dfp->dfp_intent = NULL;
+                }
         }
 
         /* Shut down FS. */
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 40e887068da2..0504ef8f3aa3 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -118,9 +118,9 @@ do {									\
 #define this_cpu_generic_read(pcp)                                      \
 ({                                                                      \
         typeof(pcp) __ret;                                              \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __ret = raw_cpu_generic_read(pcp);                              \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
         __ret;                                                          \
 })
 
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index af0254c09424..4df64a1fc09e 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -14,6 +14,8 @@
  * [_sdata, _edata]: contains .data.* sections, may also contain .rodata.*
  *                   and/or .init.* sections.
  * [__start_rodata, __end_rodata]: contains .rodata.* sections
+ * [__start_data_ro_after_init, __end_data_ro_after_init]:
+ *                   contains data.ro_after_init section
  * [__init_begin, __init_end]: contains .init.* sections, but .init.text.*
  *                   may be out of this range on some architectures.
  * [_sinittext, _einittext]: contains .init.text.* sections
@@ -31,6 +33,7 @@ extern char _data[], _sdata[], _edata[];
 extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
+extern char __start_data_ro_after_init[], __end_data_ro_after_init[];
 extern char _end[];
 extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
 extern char __kprobes_text_start[], __kprobes_text_end[];
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 30747960bc54..31e1d639abed 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -259,7 +259,10 @@
  * own by defining an empty RO_AFTER_INIT_DATA.
  */
 #ifndef RO_AFTER_INIT_DATA
-#define RO_AFTER_INIT_DATA *(.data..ro_after_init)
+#define RO_AFTER_INIT_DATA                                              \
+        __start_data_ro_after_init = .;                                 \
+        *(.data..ro_after_init)                                         \
+        __end_data_ro_after_init = .;
 #endif
 
 /*
diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h
index 43cf193e54d6..8b4dc62470ff 100644
--- a/include/drm/drm_plane.h
+++ b/include/drm/drm_plane.h
@@ -47,8 +47,14 @@ struct drm_crtc;
  * @src_h: height of visible portion of plane (in 16.16)
  * @rotation: rotation of the plane
  * @zpos: priority of the given plane on crtc (optional)
+ *      Note that multiple active planes on the same crtc can have an identical
+ *      zpos value. The rule to solving the conflict is to compare the plane
+ *      object IDs; the plane with a higher ID must be stacked on top of a
+ *      plane with a lower ID.
  * @normalized_zpos: normalized value of zpos: unique, range from 0 to N-1
- *      where N is the number of active planes for given crtc
+ *      where N is the number of active planes for given crtc. Note that
+ *      the driver must call drm_atomic_normalize_zpos() to update this before
+ *      it can be trusted.
  * @src: clipped source coordinates of the plane (in 16.16)
  * @dst: clipped destination coordinates of the plane
  * @visible: visibility of the plane
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 689a8b9b9c8f..61a3d90f32b3 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -555,7 +555,8 @@ int acpi_device_uevent_modalias(struct device *, struct kobj_uevent_env *);
 int acpi_device_modalias(struct device *, char *, int);
 void acpi_walk_dep_device_list(acpi_handle handle);
 
-struct platform_device *acpi_create_platform_device(struct acpi_device *);
+struct platform_device *acpi_create_platform_device(struct acpi_device *,
+                                                    struct property_entry *);
 #define ACPI_PTR(_ptr)  (_ptr)
 
 static inline void acpi_device_set_enumerated(struct acpi_device *adev)
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 96337b15a60d..a8e66344bacc 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -258,6 +258,8 @@ struct ceph_watch_item {
         struct ceph_entity_addr addr;
 };
 
+#define CEPH_LINGER_ID_START    0xffff000000000000ULL
+
 struct ceph_osd_client {
         struct ceph_client     *client;
 
diff --git a/include/linux/console.h b/include/linux/console.h
index 3672809234a7..d530c4627e54 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -173,12 +173,6 @@ static inline void console_sysfs_notify(void)
 #endif
 extern bool console_suspend_enabled;
 
-#ifdef CONFIG_OF
-extern void console_set_by_of(void);
-#else
-static inline void console_set_by_of(void) {}
-#endif
-
 /* Suspend and resume console messages over PM events */
 extern void suspend_console(void);
 extern void resume_console(void);
diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h
index c46d2aa16d81..1d18af034554 100644
--- a/include/linux/frontswap.h
+++ b/include/linux/frontswap.h
@@ -106,8 +106,9 @@ static inline void frontswap_invalidate_area(unsigned type)
 
 static inline void frontswap_init(unsigned type, unsigned long *map)
 {
-        if (frontswap_enabled())
-                __frontswap_init(type, map);
+#ifdef CONFIG_FRONTSWAP
+        __frontswap_init(type, map);
+#endif
 }
 
 #endif /* _LINUX_FRONTSWAP_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 16d2b6e874d6..dc0478c07b2a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -321,6 +321,7 @@ struct writeback_control;
 #define IOCB_HIPRI              (1 << 3)
 #define IOCB_DSYNC              (1 << 4)
 #define IOCB_SYNC               (1 << 5)
+#define IOCB_WRITE              (1 << 6)
 
 struct kiocb {
         struct file             *ki_filp;
@@ -1709,7 +1710,6 @@ struct file_operations {
         int (*flush) (struct file *, fl_owner_t id);
         int (*release) (struct inode *, struct file *);
         int (*fsync) (struct file *, loff_t, loff_t, int datasync);
-        int (*aio_fsync) (struct kiocb *, int datasync);
         int (*fasync) (int, struct file *, int);
         int (*lock) (struct file *, int, struct file_lock *);
         ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int);
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 93756585521f..3f95233b2733 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -153,7 +153,7 @@ static inline bool inet6_exact_dif_match(struct net *net, struct sk_buff *skb)
 {
 #if defined(CONFIG_NET_L3_MASTER_DEV)
         if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
-            ipv6_l3mdev_skb(IP6CB(skb)->flags))
+            skb && ipv6_l3mdev_skb(IP6CB(skb)->flags))
                 return true;
 #endif
         return false;
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index c5d3d5024fc8..d8905a229f34 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -1184,7 +1184,7 @@ int nand_read_oob_syndrome(struct mtd_info *mtd, struct nand_chip *chip,
                            int page);
 
 /* Reset and initialize a NAND device */
-int nand_reset(struct nand_chip *chip);
+int nand_reset(struct nand_chip *chip, int chipnr);
 
 /* Free resources held by the NAND device */
 void nand_cleanup(struct nand_chip *chip);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d64135a0ab71..86bacf6a64f0 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3252,6 +3252,21 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 bool is_skb_forwardable(const struct net_device *dev,
                         const struct sk_buff *skb);
 
+static __always_inline int ____dev_forward_skb(struct net_device *dev,
+                                               struct sk_buff *skb)
+{
+        if (skb_orphan_frags(skb, GFP_ATOMIC) ||
+            unlikely(!is_skb_forwardable(dev, skb))) {
+                atomic_long_inc(&dev->rx_dropped);
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
+
+        skb_scrub_packet(skb, true);
+        skb->priority = 0;
+        return 0;
+}
+
 void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);
 
 extern int              netdev_budget;
diff --git a/include/linux/phy/phy.h b/include/linux/phy/phy.h
index ee1bed7dbfc6..78bb0d7f6b11 100644
--- a/include/linux/phy/phy.h
+++ b/include/linux/phy/phy.h
@@ -253,6 +253,13 @@ static inline int phy_set_mode(struct phy *phy, enum phy_mode mode)
         return -ENOSYS;
 }
 
+static inline int phy_reset(struct phy *phy)
+{
+        if (!phy)
+                return 0;
+        return -ENOSYS;
+}
+
 static inline int phy_get_bus_width(struct phy *phy)
 {
         return -ENOSYS;
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 9adc7b21903d..f6673132431d 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -15,6 +15,7 @@
 
 #include <linux/list.h>
 #include <linux/rbtree.h>
+#include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/bug.h>
 #include <linux/lockdep.h>
@@ -116,22 +117,22 @@ struct reg_sequence {
 #define regmap_read_poll_timeout(map, addr, val, cond, sleep_us, timeout_us) \
 ({ \
         ktime_t timeout = ktime_add_us(ktime_get(), timeout_us); \
-        int ret; \
+        int pollret; \
         might_sleep_if(sleep_us); \
         for (;;) { \
-                ret = regmap_read((map), (addr), &(val)); \
-                if (ret) \
+                pollret = regmap_read((map), (addr), &(val)); \
+                if (pollret) \
                         break; \
                 if (cond) \
                         break; \
                 if (timeout_us && ktime_compare(ktime_get(), timeout) > 0) { \
-                        ret = regmap_read((map), (addr), &(val)); \
+                        pollret = regmap_read((map), (addr), &(val)); \
                         break; \
                 } \
                 if (sleep_us) \
                         usleep_range((sleep_us >> 2) + 1, sleep_us); \
         } \
-        ret ?: ((cond) ? 0 : -ETIMEDOUT); \
+        pollret ?: ((cond) ? 0 : -ETIMEDOUT); \
 })
 
 #ifdef CONFIG_REGMAP
diff --git a/include/net/ip.h b/include/net/ip.h
index f48c67cab222..ab6761a7c883 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -47,8 +47,7 @@ struct inet_skb_parm {
 #define IPSKB_REROUTED          BIT(4)
 #define IPSKB_DOREDIRECT        BIT(5)
 #define IPSKB_FRAG_PMTU         BIT(6)
-#define IPSKB_FRAG_SEGS         BIT(7)
-#define IPSKB_L3SLAVE           BIT(8)
+#define IPSKB_L3SLAVE           BIT(7)
 
         u16                     frag_max_size;
 };
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 20ed9699fcd4..1b1cf33cbfb0 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -146,6 +146,7 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
 {
         int pkt_len, err;
 
+        memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
         pkt_len = skb->len - skb_inner_network_offset(skb);
         err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb);
         if (unlikely(net_xmit_eval(err)))
diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index 498814626e28..1723a67c0b0a 100644
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -30,8 +30,7 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
         if (net->ct.labels_used == 0)
                 return NULL;
 
-        return nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,
-                                    sizeof(struct nf_conn_labels), GFP_ATOMIC);
+        return nf_ct_ext_add(ct, NF_CT_EXT_LABELS, GFP_ATOMIC);
 #else
         return NULL;
 #endif
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 3295fb85bff6..311f02739b51 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -161,7 +161,7 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
         return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
 }
 
-unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
+int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
 unsigned int nft_parse_register(const struct nlattr *attr);
 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
 
@@ -558,7 +558,8 @@ void *nft_set_elem_init(const struct nft_set *set,
                         const struct nft_set_ext_tmpl *tmpl,
                         const u32 *key, const u32 *data,
                         u64 timeout, gfp_t gfp);
-void nft_set_elem_destroy(const struct nft_set *set, void *elem);
+void nft_set_elem_destroy(const struct nft_set *set, void *elem,
+                          bool destroy_expr);
 
 /**
  *      struct nft_set_gc_batch_head - nf_tables set garbage collection batch
@@ -709,7 +710,6 @@ static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
 {
         int err;
 
-        __module_get(src->ops->type->owner);
         if (src->ops->clone) {
                 dst->ops = src->ops;
                 err = src->ops->clone(dst, src);
@@ -718,6 +718,8 @@ static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
         } else {
                 memcpy(dst, src, src->ops->size);
         }
+
+        __module_get(src->ops->type->owner);
         return 0;
 }
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 87a7f42e7639..31acc3f4f132 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -152,7 +152,7 @@ void sctp_unhash_endpoint(struct sctp_endpoint *);
 struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *,
                              struct sctphdr *, struct sctp_association **,
                              struct sctp_transport **);
-void sctp_err_finish(struct sock *, struct sctp_association *);
+void sctp_err_finish(struct sock *, struct sctp_transport *);
 void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
                            struct sctp_transport *t, __u32 pmtu);
 void sctp_icmp_redirect(struct sock *, struct sctp_transport *,
diff --git a/include/net/sock.h b/include/net/sock.h
index 9d905ed0cd25..442cbb118a07 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1612,11 +1612,11 @@ static inline void sock_put(struct sock *sk)
 void sock_gen_put(struct sock *sk);
 
 int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested,
-                     unsigned int trim_cap);
+                     unsigned int trim_cap, bool refcounted);
 static inline int sk_receive_skb(struct sock *sk, struct sk_buff *skb,
                                  const int nested)
 {
-        return __sk_receive_skb(sk, skb, nested, 1);
+        return __sk_receive_skb(sk, skb, nested, 1, true);
 }
 
 static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 5b82d4d94834..123979fe12bf 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -805,7 +805,7 @@ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
         if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
-            ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
+            skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
                 return true;
 #endif
         return false;
@@ -1220,6 +1220,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp)
 
 bool tcp_prequeue(struct sock *sk, struct sk_buff *skb);
 bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb);
+int tcp_filter(struct sock *sk, struct sk_buff *skb);
 
 #undef STATE_TRACE
 
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
index 5cd4d4d2dd1d..9c9c6ad55f14 100644
--- a/include/uapi/linux/atm_zatm.h
+++ b/include/uapi/linux/atm_zatm.h
@@ -14,7 +14,6 @@
 
 #include <linux/atmapi.h>
 #include <linux/atmioc.h>
-#include <linux/time.h>
 
 #define ZATM_GETPOOL    _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
                                                 /* get pool statistics */
diff --git a/include/uapi/linux/bpqether.h b/include/uapi/linux/bpqether.h
index a6c35e1a89ad..05865edaefda 100644
--- a/include/uapi/linux/bpqether.h
+++ b/include/uapi/linux/bpqether.h
@@ -5,9 +5,7 @@
  *      Defines for the BPQETHER pseudo device driver
  */
 
-#ifndef __LINUX_IF_ETHER_H
 #include <linux/if_ether.h>
-#endif
 
 #define SIOCSBPQETHOPT          (SIOCDEVPRIVATE+0)      /* reserved */
 #define SIOCSBPQETHADDR         (SIOCDEVPRIVATE+1)
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index 33d00a4ce656..819d895edfdc 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -18,12 +18,6 @@
 #include <linux/types.h>
 #include <sound/asound.h>
 
-#ifndef __KERNEL__
-#error This API is an early revision and not enabled in the current
-#error kernel release, it will be enabled in a future kernel version
-#error with incompatible changes to what is here.
-#endif
-
 /*
  * Maximum number of channels topology kcontrol can represent.
  */
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 570eeca7bdfa..ad1bc67aff1b 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -687,7 +687,8 @@ static void delete_all_elements(struct bpf_htab *htab)
 
                 hlist_for_each_entry_safe(l, n, head, hash_node) {
                         hlist_del_rcu(&l->hash_node);
-                        htab_elem_free(htab, l);
+                        if (l->state != HTAB_EXTRA_ELEM_USED)
+                                htab_elem_free(htab, l);
                 }
         }
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index cdc06546401b..233e3ac836a6 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -195,7 +195,7 @@ static int map_create(union bpf_attr *attr)
 
         err = bpf_map_charge_memlock(map);
         if (err)
-                goto free_map;
+                goto free_map_nouncharge;
 
         err = bpf_map_new_fd(map);
         if (err < 0)
@@ -205,6 +205,8 @@ static int map_create(union bpf_attr *attr)
         return err;
 
 free_map:
+        bpf_map_uncharge_memlock(map);
+free_map_nouncharge:
         map->ops->map_free(map);
         return err;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 623259fc794d..997ac1d584f7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -315,6 +315,9 @@ static void account_kernel_stack(struct task_struct *tsk, int account)
 
 static void release_task_stack(struct task_struct *tsk)
 {
+        if (WARN_ON(tsk->state != TASK_DEAD))
+                return;  /* Better to leak the stack than to free prematurely */
+
         account_kernel_stack(tsk, -1);
         arch_release_thread_stack(tsk->stack);
         free_thread_stack(tsk);
@@ -1862,6 +1865,7 @@ bad_fork_cleanup_count:
         atomic_dec(&p->cred->user->processes);
         exit_creds(p);
 bad_fork_free:
+        p->state = TASK_DEAD;
         put_task_stack(p);
         free_task(p);
 fork_out:
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 9c4d30483264..6b669593e7eb 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1341,12 +1341,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         } else if (new->flags & IRQF_TRIGGER_MASK) {
                 unsigned int nmsk = new->flags & IRQF_TRIGGER_MASK;
-                unsigned int omsk = irq_settings_get_trigger_mask(desc);
+                unsigned int omsk = irqd_get_trigger_type(&desc->irq_data);
 
                 if (nmsk != omsk)
                         /* hope the handler works with current  trigger mode */
                         pr_warn("irq %d uses trigger mode %u; requested %u\n",
-                                irq, nmsk, omsk);
+                                irq, omsk, nmsk);
         }
 
         *old_ptr = new;
diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
index 084452e34a12..bdff5ed57f10 100644
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -203,8 +203,10 @@ static int __init test_suspend(void)
 
         /* RTCs have initialized by now too ... can we use one? */
         dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm);
-        if (dev)
+        if (dev) {
                 rtc = rtc_class_open(dev_name(dev));
+                put_device(dev);
+        }
         if (!rtc) {
                 printk(warn_no_rtc);
                 return 0;
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index de08fc90baaf..f7a55e9ff2f7 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -253,17 +253,6 @@ static int preferred_console = -1;
 int console_set_on_cmdline;
 EXPORT_SYMBOL(console_set_on_cmdline);
 
-#ifdef CONFIG_OF
-static bool of_specified_console;
-
-void console_set_by_of(void)
-{
-        of_specified_console = true;
-}
-#else
-# define of_specified_console false
-#endif
-
 /* Flag: console code may call schedule() */
 static int console_may_schedule;
 
@@ -794,8 +783,6 @@ static ssize_t devkmsg_write(struct kiocb *iocb, struct iov_iter *from)
         return ret;
 }
 
-static void cont_flush(void);
-
 static ssize_t devkmsg_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
@@ -811,7 +798,6 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
         if (ret)
                 return ret;
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         while (user->seq == log_next_seq) {
                 if (file->f_flags & O_NONBLOCK) {
                         ret = -EAGAIN;
@@ -874,7 +860,6 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
                 return -ESPIPE;
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         switch (whence) {
         case SEEK_SET:
                 /* the first record */
@@ -913,7 +898,6 @@ static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
         poll_wait(file, &log_wait, wait);
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         if (user->seq < log_next_seq) {
                 /* return error when data has vanished underneath us */
                 if (user->seq < log_first_seq)
@@ -1300,7 +1284,6 @@ static int syslog_print(char __user *buf, int size)
                 size_t skip;
 
                 raw_spin_lock_irq(&logbuf_lock);
-                cont_flush();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -1360,7 +1343,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 return -ENOMEM;
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         if (buf) {
                 u64 next_seq;
                 u64 seq;
@@ -1522,7 +1504,6 @@ int do_syslog(int type, char __user *buf, int len, int source)
         /* Number of chars in the log buffer */
         case SYSLOG_ACTION_SIZE_UNREAD:
                 raw_spin_lock_irq(&logbuf_lock);
-                cont_flush();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -2657,7 +2638,7 @@ void register_console(struct console *newcon)
          *      didn't select a console we take the first one
          *      that registers here.
          */
-        if (preferred_console < 0 && !of_specified_console) {
+        if (preferred_console < 0) {
                 if (newcon->index < 0)
                         newcon->index = 0;
                 if (newcon->setup == NULL ||
@@ -3039,7 +3020,6 @@ void kmsg_dump(enum kmsg_dump_reason reason)
                 dumper->active = true;
 
                 raw_spin_lock_irqsave(&logbuf_lock, flags);
-                cont_flush();
                 dumper->cur_seq = clear_seq;
                 dumper->cur_idx = clear_idx;
                 dumper->next_seq = log_next_seq;
@@ -3130,7 +3110,6 @@ bool kmsg_dump_get_line(struct kmsg_dumper *dumper, bool syslog,
         bool ret;
 
         raw_spin_lock_irqsave(&logbuf_lock, flags);
-        cont_flush();
         ret = kmsg_dump_get_line_nolock(dumper, syslog, line, size, len);
         raw_spin_unlock_irqrestore(&logbuf_lock, flags);
 
@@ -3173,7 +3152,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
                 goto out;
 
         raw_spin_lock_irqsave(&logbuf_lock, flags);
-        cont_flush();
         if (dumper->cur_seq < log_first_seq) {
                 /* messages are gone, move to first available one */
                 dumper->cur_seq = log_first_seq;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 42d4027f9e26..154fd689fe02 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5192,21 +5192,14 @@ void sched_show_task(struct task_struct *p)
         int ppid;
         unsigned long state = p->state;
 
+        if (!try_get_task_stack(p))
+                return;
         if (state)
                 state = __ffs(state) + 1;
         printk(KERN_INFO "%-15.15s %c", p->comm,
                 state < sizeof(stat_nam) - 1 ? stat_nam[state] : '?');
-#if BITS_PER_LONG == 32
-        if (state == TASK_RUNNING)
-                printk(KERN_CONT " running  ");
-        else
-                printk(KERN_CONT " %08lx ", thread_saved_pc(p));
-#else
         if (state == TASK_RUNNING)
                 printk(KERN_CONT "  running task    ");
-        else
-                printk(KERN_CONT " %016lx ", thread_saved_pc(p));
-#endif
 #ifdef CONFIG_DEBUG_STACK_USAGE
         free = stack_not_used(p);
 #endif
@@ -5221,6 +5214,7 @@ void sched_show_task(struct task_struct *p)
 
         print_worker_info(KERN_INFO, p);
         show_stack(p, NULL);
+        put_task_stack(p);
 }
 
 void show_state_filter(unsigned long state_filter)
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 9b7f838511ce..8a5e44236f78 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -49,7 +49,11 @@ static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1
         [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING },
         [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },};
 
-static const struct nla_policy cgroupstats_cmd_get_policy[CGROUPSTATS_CMD_ATTR_MAX+1] = {
+/*
+ * We have to use TASKSTATS_CMD_ATTR_MAX here, it is the maxattr in the family.
+ * Make sure they are always aligned.
+ */
+static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = {
         [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 },
 };
 
diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index 4d830e299989..f87d138e9672 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -192,6 +192,7 @@ void depot_fetch_stack(depot_stack_handle_t handle, struct stack_trace *trace)
         trace->entries = stack->entries;
         trace->skip = 0;
 }
+EXPORT_SYMBOL_GPL(depot_fetch_stack);
 
 /**
  * depot_save_stack - save stack in a stack depot.
@@ -283,3 +284,4 @@ exit:
 fast_exit:
         return retval;
 }
+EXPORT_SYMBOL_GPL(depot_save_stack);
diff --git a/mm/cma.c b/mm/cma.c
index 384c2cb51b56..c960459eda7e 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -385,6 +385,9 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align)
         bitmap_maxno = cma_bitmap_maxno(cma);
         bitmap_count = cma_bitmap_pages_to_bits(cma, count);
 
+        if (bitmap_count > bitmap_maxno)
+                return NULL;
+
         for (;;) {
                 mutex_lock(&cma->lock);
                 bitmap_no = bitmap_find_next_zero_area_off(cma->bitmap,
diff --git a/mm/filemap.c b/mm/filemap.c
index c7fe2f16503f..50b52fe51937 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1732,6 +1732,9 @@ find_page:
                         if (inode->i_blkbits == PAGE_SHIFT ||
                                         !mapping->a_ops->is_partially_uptodate)
                                 goto page_not_up_to_date;
+                        /* pipes can't handle partially uptodate pages */
+                        if (unlikely(iter->type & ITER_PIPE))
+                                goto page_not_up_to_date;
                         if (!trylock_page(page))
                                 goto page_not_up_to_date;
                         /* Did it get truncated before we got the lock? */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ec49d9ef1eef..418bf01a50ed 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1826,11 +1826,17 @@ static void return_unused_surplus_pages(struct hstate *h,
  * is not the case is if a reserve map was changed between calls.  It
  * is the responsibility of the caller to notice the difference and
  * take appropriate action.
+ *
+ * vma_add_reservation is used in error paths where a reservation must
+ * be restored when a newly allocated huge page must be freed.  It is
+ * to be called after calling vma_needs_reservation to determine if a
+ * reservation exists.
  */
 enum vma_resv_mode {
         VMA_NEEDS_RESV,
         VMA_COMMIT_RESV,
         VMA_END_RESV,
+        VMA_ADD_RESV,
 };
 static long __vma_reservation_common(struct hstate *h,
                                 struct vm_area_struct *vma, unsigned long addr,
@@ -1856,6 +1862,14 @@ static long __vma_reservation_common(struct hstate *h,
                 region_abort(resv, idx, idx + 1);
                 ret = 0;
                 break;
+        case VMA_ADD_RESV:
+                if (vma->vm_flags & VM_MAYSHARE)
+                        ret = region_add(resv, idx, idx + 1);
+                else {
+                        region_abort(resv, idx, idx + 1);
+                        ret = region_del(resv, idx, idx + 1);
+                }
+                break;
         default:
                 BUG();
         }
@@ -1903,6 +1917,56 @@ static void vma_end_reservation(struct hstate *h,
         (void)__vma_reservation_common(h, vma, addr, VMA_END_RESV);
 }
 
+static long vma_add_reservation(struct hstate *h,
+                        struct vm_area_struct *vma, unsigned long addr)
+{
+        return __vma_reservation_common(h, vma, addr, VMA_ADD_RESV);
+}
+
+/*
+ * This routine is called to restore a reservation on error paths.  In the
+ * specific error paths, a huge page was allocated (via alloc_huge_page)
+ * and is about to be freed.  If a reservation for the page existed,
+ * alloc_huge_page would have consumed the reservation and set PagePrivate
+ * in the newly allocated page.  When the page is freed via free_huge_page,
+ * the global reservation count will be incremented if PagePrivate is set.
+ * However, free_huge_page can not adjust the reserve map.  Adjust the
+ * reserve map here to be consistent with global reserve count adjustments
+ * to be made by free_huge_page.
+ */
+static void restore_reserve_on_error(struct hstate *h,
+                        struct vm_area_struct *vma, unsigned long address,
+                        struct page *page)
+{
+        if (unlikely(PagePrivate(page))) {
+                long rc = vma_needs_reservation(h, vma, address);
+
+                if (unlikely(rc < 0)) {
+                        /*
+                         * Rare out of memory condition in reserve map
+                         * manipulation.  Clear PagePrivate so that
+                         * global reserve count will not be incremented
+                         * by free_huge_page.  This will make it appear
+                         * as though the reservation for this page was
+                         * consumed.  This may prevent the task from
+                         * faulting in the page at a later time.  This
+                         * is better than inconsistent global huge page
+                         * accounting of reserve counts.
+                         */
+                        ClearPagePrivate(page);
+                } else if (rc) {
+                        rc = vma_add_reservation(h, vma, address);
+                        if (unlikely(rc < 0))
+                                /*
+                                 * See above comment about rare out of
+                                 * memory condition.
+                                 */
+                                ClearPagePrivate(page);
+                } else
+                        vma_end_reservation(h, vma, address);
+        }
+}
+
 struct page *alloc_huge_page(struct vm_area_struct *vma,
                                     unsigned long addr, int avoid_reserve)
 {
@@ -3498,6 +3562,7 @@ retry_avoidcopy:
         spin_unlock(ptl);
         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 out_release_all:
+        restore_reserve_on_error(h, vma, address, new_page);
         put_page(new_page);
 out_release_old:
         put_page(old_page);
@@ -3680,6 +3745,7 @@ backout:
         spin_unlock(ptl);
 backout_unlocked:
         unlock_page(page);
+        restore_reserve_on_error(h, vma, address, page);
         put_page(page);
         goto out;
 }
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index e5355a5b423f..d1380ed93fdf 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1414,6 +1414,7 @@ static void kmemleak_scan(void)
         /* data/bss scanning */
         scan_large_block(_sdata, _edata);
         scan_large_block(__bss_start, __bss_stop);
+        scan_large_block(__start_data_ro_after_init, __end_data_ro_after_init);
 
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index de88f33519c0..19e796d36a62 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1112,10 +1112,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
         }
 
         if (!PageHuge(p) && PageTransHuge(hpage)) {
-                lock_page(hpage);
-                if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
-                        unlock_page(hpage);
-                        if (!PageAnon(hpage))
+                lock_page(p);
+                if (!PageAnon(p) || unlikely(split_huge_page(p))) {
+                        unlock_page(p);
+                        if (!PageAnon(p))
                                 pr_err("Memory failure: %#lx: non anonymous thp\n",
                                         pfn);
                         else
@@ -1126,9 +1126,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                         put_hwpoison_page(p);
                         return -EBUSY;
                 }
-                unlock_page(hpage);
-                get_hwpoison_page(p);
-                put_hwpoison_page(hpage);
+                unlock_page(p);
                 VM_BUG_ON_PAGE(!page_count(p), p);
                 hpage = compound_head(p);
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 8fd42aa7c4bd..6de9440e3ae2 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -92,7 +92,7 @@ int _node_numa_mem_[MAX_NUMNODES];
 #endif
 
 #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
-volatile u64 latent_entropy __latent_entropy;
+volatile unsigned long latent_entropy __latent_entropy;
 EXPORT_SYMBOL(latent_entropy);
 #endif
 
@@ -3658,7 +3658,7 @@ retry:
         /* Make sure we know about allocations which stall for too long */
         if (time_after(jiffies, alloc_start + stall_timeout)) {
                 warn_alloc(gfp_mask,
-                        "page alloction stalls for %ums, order:%u\n",
+                        "page allocation stalls for %ums, order:%u",
                         jiffies_to_msecs(jiffies-alloc_start), order);
                 stall_timeout += 10 * HZ;
         }
diff --git a/mm/shmem.c b/mm/shmem.c
index ad7813d73ea7..166ebf5d2bce 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1483,6 +1483,8 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         copy_highpage(newpage, oldpage);
         flush_dcache_page(newpage);
 
+        __SetPageLocked(newpage);
+        __SetPageSwapBacked(newpage);
         SetPageUptodate(newpage);
         set_page_private(newpage, swap_index);
         SetPageSwapCache(newpage);
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 71f0b28a1bec..329b03843863 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -533,8 +533,8 @@ void memcg_create_kmem_cache(struct mem_cgroup *memcg,
 
         s = create_cache(cache_name, root_cache->object_size,
                          root_cache->size, root_cache->align,
-                         root_cache->flags, root_cache->ctor,
-                         memcg, root_cache);
+                         root_cache->flags & CACHE_CREATE_MASK,
+                         root_cache->ctor, memcg, root_cache);
         /*
          * If we could not create a memcg cache, do not complain, because
          * that's not critical at all as we can always proceed with the root
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 2210de290b54..f30438970cd1 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2224,6 +2224,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p,
                 swab32s(&swap_header->info.version);
                 swab32s(&swap_header->info.last_page);
                 swab32s(&swap_header->info.nr_badpages);
+                if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
+                        return 0;
                 for (i = 0; i < swap_header->info.nr_badpages; i++)
                         swab32s(&swap_header->info.badpages[i]);
         }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8e999ffdf28b..8af9d25ff988 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1549,24 +1549,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
         struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
         struct sock *sk = sock->sk;
         struct bcm_sock *bo = bcm_sk(sk);
+        int ret = 0;
 
         if (len < sizeof(*addr))
                 return -EINVAL;
 
-        if (bo->bound)
-                return -EISCONN;
+        lock_sock(sk);
+
+        if (bo->bound) {
+                ret = -EISCONN;
+                goto fail;
+        }
 
         /* bind a device to this socket */
         if (addr->can_ifindex) {
                 struct net_device *dev;
 
                 dev = dev_get_by_index(&init_net, addr->can_ifindex);
-                if (!dev)
-                        return -ENODEV;
-
+                if (!dev) {
+                        ret = -ENODEV;
+                        goto fail;
+                }
                 if (dev->type != ARPHRD_CAN) {
                         dev_put(dev);
-                        return -ENODEV;
+                        ret = -ENODEV;
+                        goto fail;
                 }
 
                 bo->ifindex = dev->ifindex;
@@ -1577,17 +1584,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
                 bo->ifindex = 0;
         }
 
-        bo->bound = 1;
-
         if (proc_dir) {
                 /* unique socket address as filename */
                 sprintf(bo->procname, "%lu", sock_i_ino(sk));
                 bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
                                                      proc_dir,
                                                      &bcm_proc_fops, sk);
+                if (!bo->bcm_proc_read) {
+                        ret = -ENOMEM;
+                        goto fail;
+                }
         }
 
-        return 0;
+        bo->bound = 1;
+
+fail:
+        release_sock(sk);
+
+        return ret;
 }
 
 static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
diff --git a/net/ceph/ceph_fs.c b/net/ceph/ceph_fs.c
index 7d54e944de5e..dcbe67ff3e2b 100644
--- a/net/ceph/ceph_fs.c
+++ b/net/ceph/ceph_fs.c
@@ -34,7 +34,8 @@ void ceph_file_layout_from_legacy(struct ceph_file_layout *fl,
         fl->stripe_count = le32_to_cpu(legacy->fl_stripe_count);
         fl->object_size = le32_to_cpu(legacy->fl_object_size);
         fl->pool_id = le32_to_cpu(legacy->fl_pg_pool);
-        if (fl->pool_id == 0)
+        if (fl->pool_id == 0 && fl->stripe_unit == 0 &&
+            fl->stripe_count == 0 && fl->object_size == 0)
                 fl->pool_id = -1;
 }
 EXPORT_SYMBOL(ceph_file_layout_from_legacy);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index d9bf7a1d0a58..e6ae15bc41b7 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -4094,6 +4094,7 @@ int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
         osd_init(&osdc->homeless_osd);
         osdc->homeless_osd.o_osdc = osdc;
         osdc->homeless_osd.o_osd = CEPH_HOMELESS_OSD;
+        osdc->last_linger_id = CEPH_LINGER_ID_START;
         osdc->linger_requests = RB_ROOT;
         osdc->map_checks = RB_ROOT;
         osdc->linger_map_checks = RB_ROOT;
diff --git a/net/core/dev.c b/net/core/dev.c
index 7385c1a152fd..6deba68ad9e4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1765,19 +1765,14 @@ EXPORT_SYMBOL_GPL(is_skb_forwardable);
 
 int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
-        if (skb_orphan_frags(skb, GFP_ATOMIC) ||
-            unlikely(!is_skb_forwardable(dev, skb))) {
-                atomic_long_inc(&dev->rx_dropped);
-                kfree_skb(skb);
-                return NET_RX_DROP;
-        }
+        int ret = ____dev_forward_skb(dev, skb);
 
-        skb_scrub_packet(skb, true);
-        skb->priority = 0;
-        skb->protocol = eth_type_trans(skb, dev);
-        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+        if (likely(!ret)) {
+                skb->protocol = eth_type_trans(skb, dev);
+                skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+        }
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(__dev_forward_skb);
 
@@ -2599,7 +2594,7 @@ int skb_checksum_help(struct sk_buff *skb)
                         goto out;
         }
 
-        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum) ?: CSUM_MANGLED_0;
 out_set_summed:
         skb->ip_summed = CHECKSUM_NONE;
 out:
diff --git a/net/core/filter.c b/net/core/filter.c
index cd9e2ba66b0e..dece94fef005 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1628,6 +1628,19 @@ static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb)
         return dev_forward_skb(dev, skb);
 }
 
+static inline int __bpf_rx_skb_no_mac(struct net_device *dev,
+                                      struct sk_buff *skb)
+{
+        int ret = ____dev_forward_skb(dev, skb);
+
+        if (likely(!ret)) {
+                skb->dev = dev;
+                ret = netif_rx(skb);
+        }
+
+        return ret;
+}
+
 static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
 {
         int ret;
@@ -1647,6 +1660,51 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
         return ret;
 }
 
+static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
+                                 u32 flags)
+{
+        /* skb->mac_len is not set on normal egress */
+        unsigned int mlen = skb->network_header - skb->mac_header;
+
+        __skb_pull(skb, mlen);
+
+        /* At ingress, the mac header has already been pulled once.
+         * At egress, skb_pospull_rcsum has to be done in case that
+         * the skb is originated from ingress (i.e. a forwarded skb)
+         * to ensure that rcsum starts at net header.
+         */
+        if (!skb_at_tc_ingress(skb))
+                skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+        skb_pop_mac_header(skb);
+        skb_reset_mac_len(skb);
+        return flags & BPF_F_INGRESS ?
+               __bpf_rx_skb_no_mac(dev, skb) : __bpf_tx_skb(dev, skb);
+}
+
+static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev,
+                                 u32 flags)
+{
+        bpf_push_mac_rcsum(skb);
+        return flags & BPF_F_INGRESS ?
+               __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
+}
+
+static int __bpf_redirect(struct sk_buff *skb, struct net_device *dev,
+                          u32 flags)
+{
+        switch (dev->type) {
+        case ARPHRD_TUNNEL:
+        case ARPHRD_TUNNEL6:
+        case ARPHRD_SIT:
+        case ARPHRD_IPGRE:
+        case ARPHRD_VOID:
+        case ARPHRD_NONE:
+                return __bpf_redirect_no_mac(skb, dev, flags);
+        default:
+                return __bpf_redirect_common(skb, dev, flags);
+        }
+}
+
 BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)
 {
         struct net_device *dev;
@@ -1675,10 +1733,7 @@ BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)
                 return -ENOMEM;
         }
 
-        bpf_push_mac_rcsum(clone);
-
-        return flags & BPF_F_INGRESS ?
-               __bpf_rx_skb(dev, clone) : __bpf_tx_skb(dev, clone);
+        return __bpf_redirect(clone, dev, flags);
 }
 
 static const struct bpf_func_proto bpf_clone_redirect_proto = {
@@ -1722,10 +1777,7 @@ int skb_do_redirect(struct sk_buff *skb)
                 return -EINVAL;
         }
 
-        bpf_push_mac_rcsum(skb);
-
-        return ri->flags & BPF_F_INGRESS ?
-               __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
+        return __bpf_redirect(skb, dev, ri->flags);
 }
 
 static const struct bpf_func_proto bpf_redirect_proto = {
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 87e01815ec85..b481a4a6d3ec 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -122,7 +122,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
         struct flow_dissector_key_keyid *key_keyid;
         bool skip_vlan = false;
         u8 ip_proto = 0;
-        bool ret = false;
+        bool ret;
 
         if (!data) {
                 data = skb->data;
@@ -549,12 +549,17 @@ ip_proto_again:
 out_good:
         ret = true;
 
-out_bad:
+        key_control->thoff = (u16)nhoff;
+out:
         key_basic->n_proto = proto;
         key_basic->ip_proto = ip_proto;
-        key_control->thoff = (u16)nhoff;
 
         return ret;
+
+out_bad:
+        ret = false;
+        key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
+        goto out;
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fb7348f13501..db313ec7af32 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -275,6 +275,7 @@ int rtnl_unregister(int protocol, int msgtype)
 
         rtnl_msg_handlers[protocol][msgindex].doit = NULL;
         rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
+        rtnl_msg_handlers[protocol][msgindex].calcit = NULL;
 
         return 0;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 0397928dfdc2..14e6145be33b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -453,7 +453,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
 int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
-                     const int nested, unsigned int trim_cap)
+                     const int nested, unsigned int trim_cap, bool refcounted)
 {
         int rc = NET_RX_SUCCESS;
 
@@ -487,7 +487,8 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
 
         bh_unlock_sock(sk);
 out:
-        sock_put(sk);
+        if (refcounted)
+                sock_put(sk);
         return rc;
 discard_and_relse:
         kfree_skb(skb);
@@ -1543,6 +1544,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
 
                 newsk->sk_err      = 0;
+                newsk->sk_err_soft = 0;
                 newsk->sk_priority = 0;
                 newsk->sk_incoming_cpu = raw_smp_processor_id();
                 atomic64_set(&newsk->sk_cookie, 0);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index a957acac2337..fda321d814d6 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -235,7 +235,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
 {
         const struct iphdr *iph = (struct iphdr *)skb->data;
         const u8 offset = iph->ihl << 2;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        const struct dccp_hdr *dh;
         struct dccp_sock *dp;
         struct inet_sock *inet;
         const int type = icmp_hdr(skb)->type;
@@ -245,11 +245,13 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         int err;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < offset + sizeof(*dh) ||
-            skb->len < offset + __dccp_basic_hdr_len(dh)) {
-                __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
-                return;
-        }
+        /* Only need dccph_dport & dccph_sport which are the first
+         * 4 bytes in dccp header.
+         * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+         */
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+        dh = (struct dccp_hdr *)(skb->data + offset);
 
         sk = __inet_lookup_established(net, &dccp_hashinfo,
                                        iph->daddr, dh->dccph_dport,
@@ -862,7 +864,7 @@ lookup:
                 goto discard_and_relse;
         nf_reset(skb);
 
-        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4);
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4, refcounted);
 
 no_dccp_socket:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 32f9f1a189f8..adfc790f7193 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -70,7 +70,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         u8 type, u8 code, int offset, __be32 info)
 {
         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        const struct dccp_hdr *dh;
         struct dccp_sock *dp;
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -78,12 +78,13 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u64 seq;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < offset + sizeof(*dh) ||
-            skb->len < offset + __dccp_basic_hdr_len(dh)) {
-                __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
-                                  ICMP6_MIB_INERRORS);
-                return;
-        }
+        /* Only need dccph_dport & dccph_sport which are the first
+         * 4 bytes in dccp header.
+         * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
+         */
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+        dh = (struct dccp_hdr *)(skb->data + offset);
 
         sk = __inet6_lookup_established(net, &dccp_hashinfo,
                                         &hdr->daddr, dh->dccph_dport,
@@ -738,7 +739,8 @@ lookup:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
-        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4) ? -1 : 0;
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
+                                refcounted) ? -1 : 0;
 
 no_dccp_socket:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
@@ -956,6 +958,7 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
         .getsockopt        = ipv6_getsockopt,
         .addr2sockaddr     = inet6_csk_addr2sockaddr,
         .sockaddr_len      = sizeof(struct sockaddr_in6),
+        .bind_conflict     = inet6_csk_bind_conflict,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_ipv6_setsockopt,
         .compat_getsockopt = compat_ipv6_getsockopt,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 41e65804ddf5..9fe25bf63296 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1009,6 +1009,10 @@ void dccp_close(struct sock *sk, long timeout)
                 __kfree_skb(skb);
         }
 
+        /* If socket has been already reset kill it. */
+        if (sk->sk_state == DCCP_CLOSED)
+                goto adjudge_to_death;
+
         if (data_was_unread) {
                 /* Unread data was tossed, send an appropriate Reset Code */
                 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 9648c97e541f..5ddf5cda07f4 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -533,9 +533,9 @@ EXPORT_SYMBOL(inet_dgram_connect);
 
 static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
 {
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+        add_wait_queue(sk_sleep(sk), &wait);
         sk->sk_write_pending += writebias;
 
         /* Basic assumption: if someone sets sk->sk_err, he _must_
@@ -545,13 +545,12 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
          */
         while ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 release_sock(sk);
-                timeo = schedule_timeout(timeo);
+                timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
                 lock_sock(sk);
                 if (signal_pending(current) || !timeo)
                         break;
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk_sleep(sk), &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         sk->sk_write_pending -= writebias;
         return timeo;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 31cef3602585..4cff74d4133f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2413,22 +2413,19 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
         struct key_vector *l, **tp = &iter->tnode;
         t_key key;
 
-        /* use cache location of next-to-find key */
+        /* use cached location of previously found key */
         if (iter->pos > 0 && pos >= iter->pos) {
-                pos -= iter->pos;
                 key = iter->key;
         } else {
-                iter->pos = 0;
+                iter->pos = 1;
                 key = 0;
         }
 
-        while ((l = leaf_walk_rcu(tp, key)) != NULL) {
+        pos -= iter->pos;
+
+        while ((l = leaf_walk_rcu(tp, key)) && (pos-- > 0)) {
                 key = l->key + 1;
                 iter->pos++;
-
-                if (--pos <= 0)
-                        break;
-
                 l = NULL;
 
                 /* handle unlikely case of a key wrap */
@@ -2437,7 +2434,7 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
         }
 
         if (l)
-                iter->key = key;        /* remember it */
+                iter->key = l->key;     /* remember it */
         else
                 iter->pos = 0;          /* forget it */
 
@@ -2465,7 +2462,7 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos)
                 return fib_route_get_idx(iter, *pos);
 
         iter->pos = 0;
-        iter->key = 0;
+        iter->key = KEY_MAX;
 
         return SEQ_START_TOKEN;
 }
@@ -2474,7 +2471,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct fib_route_iter *iter = seq->private;
         struct key_vector *l = NULL;
-        t_key key = iter->key;
+        t_key key = iter->key + 1;
 
         ++*pos;
 
@@ -2483,7 +2480,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 l = leaf_walk_rcu(&iter->tnode, key);
 
         if (l) {
-                iter->key = l->key + 1;
+                iter->key = l->key;
                 iter->pos++;
         } else {
                 iter->pos = 0;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 53a890b605fc..691146abde2d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -479,7 +479,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
         fl4->flowi4_proto = IPPROTO_ICMP;
         fl4->fl4_icmp_type = type;
         fl4->fl4_icmp_code = code;
-        fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev);
+        fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
 
         security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
         rt = __ip_route_output_key_hash(net, fl4,
@@ -504,7 +504,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
         if (err)
                 goto relookup_failed;
 
-        if (inet_addr_type_dev_table(net, skb_in->dev,
+        if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
                                      fl4_dec.saddr) == RTN_LOCAL) {
                 rt2 = __ip_route_output_key(net, &fl4_dec);
                 if (IS_ERR(rt2))
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 8b4ffd216839..9f0a7b96646f 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -117,7 +117,7 @@ int ip_forward(struct sk_buff *skb)
         if (opt->is_strictroute && rt->rt_uses_gateway)
                 goto sr_failed;
 
-        IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
         mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
         if (ip_exceeds_mtu(skb, mtu)) {
                 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 37dfacd340af..eaf720b65d7e 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -239,19 +239,23 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
         struct sk_buff *segs;
         int ret = 0;
 
-        /* common case: fragmentation of segments is not allowed,
-         * or seglen is <= mtu
+        /* common case: seglen is <= mtu
          */
-        if (((IPCB(skb)->flags & IPSKB_FRAG_SEGS) == 0) ||
-              skb_gso_validate_mtu(skb, mtu))
+        if (skb_gso_validate_mtu(skb, mtu))
                 return ip_finish_output2(net, sk, skb);
 
-        /* Slowpath -  GSO segment length is exceeding the dst MTU.
+        /* Slowpath -  GSO segment length exceeds the egress MTU.
          *
-         * This can happen in two cases:
-         * 1) TCP GRO packet, DF bit not set
-         * 2) skb arrived via virtio-net, we thus get TSO/GSO skbs directly
-         * from host network stack.
+         * This can happen in several cases:
+         *  - Forwarding of a TCP GRO skb, when DF flag is not set.
+         *  - Forwarding of an skb that arrived on a virtualization interface
+         *    (virtio-net/vhost/tap) with TSO/GSO size set by other network
+         *    stack.
+         *  - Local GSO skb transmitted on an NETIF_F_TSO tunnel stacked over an
+         *    interface with a smaller MTU.
+         *  - Arriving GRO skb (or GSO skb in a virtualized environment) that is
+         *    bridged to a NETIF_F_TSO tunnel stacked over an interface with an
+         *    insufficent MTU.
          */
         features = netif_skb_features(skb);
         BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET);
@@ -1579,7 +1583,8 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
         }
 
         oif = arg->bound_dev_if;
-        oif = oif ? : skb->skb_iif;
+        if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                oif = skb->skb_iif;
 
         flowi4_init_output(&fl4, oif,
                            IP4_REPLY_MARK(net, skb->mark),
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 777bc1883870..fed3d29f9eb3 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -63,7 +63,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         int pkt_len = skb->len - skb_inner_network_offset(skb);
         struct net *net = dev_net(rt->dst.dev);
         struct net_device *dev = skb->dev;
-        int skb_iif = skb->skb_iif;
         struct iphdr *iph;
         int err;
 
@@ -73,16 +72,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-        if (skb_iif && !(df & htons(IP_DF))) {
-                /* Arrived from an ingress interface, got encapsulated, with
-                 * fragmentation of encapulating frames allowed.
-                 * If skb is gso, the resulting encapsulated network segments
-                 * may exceed dst mtu.
-                 * Allow IP Fragmentation of segments.
-                 */
-                IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
-        }
-
         /* Push down and install the IP header. */
         skb_push(skb, sizeof(struct iphdr));
         skb_reset_network_header(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index f2fd13b07273..665505d86b12 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1754,7 +1754,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
                 vif->dev->stats.tx_bytes += skb->len;
         }
 
-        IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
 
         /* RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
          * not only before forwarding, but after forwarding on all output
diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
index 7ab544fbc382..0af3d8df70dd 100644
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
         struct in_addr gw = {
                 .s_addr = (__force __be32)regs->data[priv->sreg_addr],
         };
-        int oif = regs->data[priv->sreg_dev];
+        int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
         nf_dup_ipv4(nft_net(pkt), pkt->skb, nft_hook(pkt), &gw, oif);
 }
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
 
-        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+                goto nla_put_failure;
+        if (priv->sreg_dev &&
             nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                 goto nla_put_failure;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2355883e1025..d37fc6f7e679 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -755,7 +755,9 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                         goto reject_redirect;
         }
 
-        n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
+        n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
+        if (!n)
+                n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
         if (!IS_ERR(n)) {
                 if (!(n->nud_state & NUD_VALID)) {
                         neigh_event_send(n, NULL);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f8f924ca662d..b025a69ebd28 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1162,7 +1162,7 @@ restart:
 
         err = -EPIPE;
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
-                goto out_err;
+                goto do_error;
 
         sg = !!(sk->sk_route_caps & NETIF_F_SG);
 
@@ -1239,7 +1239,7 @@ new_segment:
 
                         if (!skb_can_coalesce(skb, i, pfrag->page,
                                               pfrag->offset)) {
-                                if (i == sysctl_max_skb_frags || !sg) {
+                                if (i >= sysctl_max_skb_frags || !sg) {
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 }
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 10d728b6804c..ab37c6775630 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -56,6 +56,7 @@ struct dctcp {
         u32 next_seq;
         u32 ce_state;
         u32 delayed_ack_reserved;
+        u32 loss_cwnd;
 };
 
 static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
@@ -96,6 +97,7 @@ static void dctcp_init(struct sock *sk)
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
 
                 ca->delayed_ack_reserved = 0;
+                ca->loss_cwnd = 0;
                 ca->ce_state = 0;
 
                 dctcp_reset(tp, ca);
@@ -111,9 +113,10 @@ static void dctcp_init(struct sock *sk)
 
 static u32 dctcp_ssthresh(struct sock *sk)
 {
-        const struct dctcp *ca = inet_csk_ca(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
+        ca->loss_cwnd = tp->snd_cwnd;
         return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->dctcp_alpha) >> 11U), 2U);
 }
 
@@ -308,12 +311,20 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
         return 0;
 }
 
+static u32 dctcp_cwnd_undo(struct sock *sk)
+{
+        const struct dctcp *ca = inet_csk_ca(sk);
+
+        return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd);
+}
+
 static struct tcp_congestion_ops dctcp __read_mostly = {
         .init           = dctcp_init,
         .in_ack_event   = dctcp_update_alpha,
         .cwnd_event     = dctcp_cwnd_event,
         .ssthresh       = dctcp_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
+        .undo_cwnd      = dctcp_cwnd_undo,
         .set_state      = dctcp_state,
         .get_info       = dctcp_get_info,
         .flags          = TCP_CONG_NEEDS_ECN,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6491b7c1f975..5555eb86e549 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1567,6 +1567,21 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_add_backlog);
 
+int tcp_filter(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcphdr *th = (struct tcphdr *)skb->data;
+        unsigned int eaten = skb->len;
+        int err;
+
+        err = sk_filter_trim_cap(sk, skb, th->doff * 4);
+        if (!err) {
+                eaten -= skb->len;
+                TCP_SKB_CB(skb)->end_seq -= eaten;
+        }
+        return err;
+}
+EXPORT_SYMBOL(tcp_filter);
+
 /*
  *      From tcp_input.c
  */
@@ -1679,8 +1694,10 @@ process:
 
         nf_reset(skb);
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard_and_relse;
+        th = (const struct tcphdr *)skb->data;
+        iph = ip_hdr(skb);
 
         skb->dev = NULL;
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index ab249fee616b..eb948ffd734b 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -449,7 +449,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
         else
-                iif = l3mdev_master_ifindex(skb->dev);
+                iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
 
         /*
          *      Must not send error if the source does not uniquely
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ddc878d2cc6d..b37054b1873d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1367,7 +1367,7 @@ emsgsize:
         if (((length > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index a7520528ecd2..b283f293ee4a 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -88,9 +88,6 @@ int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
 
         uh->len = htons(skb->len);
 
-        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
-                            | IPSKB_REROUTED);
         skb_dst_set(skb, dst);
 
         udp6_set_csum(nocheck, skb, saddr, daddr, skb->len);
diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
index 26074a8bada7..d8b5b60b7d53 100644
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
 {
         struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
         struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
-        int oif = regs->data[priv->sreg_dev];
+        int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
         nf_dup_ipv6(nft_net(pkt), pkt->skb, nft_hook(pkt), gw, oif);
 }
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 
-        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+                goto nla_put_failure;
+        if (priv->sreg_dev &&
             nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                 goto nla_put_failure;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6aa014eedccd..b317bb135ed4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1364,6 +1364,9 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
         if (rt6->rt6i_flags & RTF_LOCAL)
                 return;
 
+        if (dst_metric_locked(dst, RTAX_MTU))
+                return;
+
         dst_confirm(dst);
         mtu = max_t(u32, mtu, IPV6_MIN_MTU);
         if (mtu >= dst_mtu(dst))
@@ -2763,6 +2766,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            PMTU discouvery.
          */
         if (rt->dst.dev == arg->dev &&
+            dst_metric_raw(&rt->dst, RTAX_MTU) &&
             !dst_metric_locked(&rt->dst, RTAX_MTU)) {
                 if (rt->rt6i_flags & RTF_CACHE) {
                         /* For RTF_CACHE with rt6i_pmtu == 0
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index aece1b15e744..28ec0a2e7b72 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -819,8 +819,12 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
         fl6.flowi6_proto = IPPROTO_TCP;
         if (rt6_need_strict(&fl6.daddr) && !oif)
                 fl6.flowi6_oif = tcp_v6_iif(skb);
-        else
-                fl6.flowi6_oif = oif ? : skb->skb_iif;
+        else {
+                if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                        oif = skb->skb_iif;
+
+                fl6.flowi6_oif = oif;
+        }
 
         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
         fl6.fl6_dport = t1->dest;
@@ -1227,7 +1231,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_do_rcv(sk, skb);
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard;
 
         /*
@@ -1455,8 +1459,10 @@ process:
         if (tcp_v6_inbound_md5_hash(sk, skb))
                 goto discard_and_relse;
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard_and_relse;
+        th = (const struct tcphdr *)skb->data;
+        hdr = ipv6_hdr(skb);
 
         skb->dev = NULL;
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 6b85ded4f91d..038c2ba0ae0f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3869,7 +3869,7 @@ static struct genl_family ip_vs_genl_family __ro_after_init = {
         .hdrsize        = 0,
         .name           = IPVS_GENL_NAME,
         .version        = IPVS_GENL_VERSION,
-        .maxattr        = IPVS_CMD_MAX,
+        .maxattr        = IPVS_CMD_ATTR_MAX,
         .netnsok        = true,         /* Make ipvsadm to work on netns */
         .module         = THIS_MODULE,
         .ops            = ip_vs_genl_ops,
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 1b07578bedf3..9350530c16c1 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -283,6 +283,7 @@ struct ip_vs_sync_buff {
  */
 static void ntoh_seq(struct ip_vs_seq *no, struct ip_vs_seq *ho)
 {
+        memset(ho, 0, sizeof(*ho));
         ho->init_seq       = get_unaligned_be32(&no->init_seq);
         ho->delta          = get_unaligned_be32(&no->delta);
         ho->previous_delta = get_unaligned_be32(&no->previous_delta);
@@ -917,8 +918,10 @@ static void ip_vs_proc_conn(struct netns_ipvs *ipvs, struct ip_vs_conn_param *pa
                         kfree(param->pe_data);
         }
 
-        if (opt)
-                memcpy(&cp->in_seq, opt, sizeof(*opt));
+        if (opt) {
+                cp->in_seq = opt->in_seq;
+                cp->out_seq = opt->out_seq;
+        }
         atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
         cp->state = state;
         cp->old_state = cp->state;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e9ffe33dc0ca..6a0bbfa8e702 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -76,6 +76,7 @@ struct conntrack_gc_work {
         struct delayed_work     dwork;
         u32                     last_bucket;
         bool                    exiting;
+        long                    next_gc_run;
 };
 
 static __read_mostly struct kmem_cache *nf_conntrack_cachep;
@@ -83,9 +84,11 @@ static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
 static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
 static __read_mostly bool nf_conntrack_locks_all;
 
+/* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */
 #define GC_MAX_BUCKETS_DIV      64u
-#define GC_MAX_BUCKETS          8192u
-#define GC_INTERVAL             (5 * HZ)
+/* upper bound of scan intervals */
+#define GC_INTERVAL_MAX         (2 * HZ)
+/* maximum conntracks to evict per gc run */
 #define GC_MAX_EVICTS           256u
 
 static struct conntrack_gc_work conntrack_gc_work;
@@ -936,13 +939,13 @@ static noinline int early_drop(struct net *net, unsigned int _hash)
 static void gc_worker(struct work_struct *work)
 {
         unsigned int i, goal, buckets = 0, expired_count = 0;
-        unsigned long next_run = GC_INTERVAL;
-        unsigned int ratio, scanned = 0;
         struct conntrack_gc_work *gc_work;
+        unsigned int ratio, scanned = 0;
+        unsigned long next_run;
 
         gc_work = container_of(work, struct conntrack_gc_work, dwork.work);
 
-        goal = min(nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV, GC_MAX_BUCKETS);
+        goal = nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV;
         i = gc_work->last_bucket;
 
         do {
@@ -982,17 +985,47 @@ static void gc_worker(struct work_struct *work)
         if (gc_work->exiting)
                 return;
 
+        /*
+         * Eviction will normally happen from the packet path, and not
+         * from this gc worker.
+         *
+         * This worker is only here to reap expired entries when system went
+         * idle after a busy period.
+         *
+         * The heuristics below are supposed to balance conflicting goals:
+         *
+         * 1. Minimize time until we notice a stale entry
+         * 2. Maximize scan intervals to not waste cycles
+         *
+         * Normally, expired_count will be 0, this increases the next_run time
+         * to priorize 2) above.
+         *
+         * As soon as a timed-out entry is found, move towards 1) and increase
+         * the scan frequency.
+         * In case we have lots of evictions next scan is done immediately.
+         */
         ratio = scanned ? expired_count * 100 / scanned : 0;
-        if (ratio >= 90 || expired_count == GC_MAX_EVICTS)
+        if (ratio >= 90 || expired_count == GC_MAX_EVICTS) {
+                gc_work->next_gc_run = 0;
                 next_run = 0;
+        } else if (expired_count) {
+                gc_work->next_gc_run /= 2U;
+                next_run = msecs_to_jiffies(1);
+        } else {
+                if (gc_work->next_gc_run < GC_INTERVAL_MAX)
+                        gc_work->next_gc_run += msecs_to_jiffies(1);
+
+                next_run = gc_work->next_gc_run;
+        }
 
         gc_work->last_bucket = i;
-        schedule_delayed_work(&gc_work->dwork, next_run);
+        queue_delayed_work(system_long_wq, &gc_work->dwork, next_run);
 }
 
 static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work)
 {
         INIT_DELAYED_WORK(&gc_work->dwork, gc_worker);
+        gc_work->next_gc_run = GC_INTERVAL_MAX;
         gc_work->exiting = false;
 }
 
@@ -1884,7 +1917,7 @@ int nf_conntrack_init_start(void)
         nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED);
 
         conntrack_gc_work_init(&conntrack_gc_work);
-        schedule_delayed_work(&conntrack_gc_work.dwork, GC_INTERVAL);
+        queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, GC_INTERVAL_MAX);
 
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 336e21559e01..7341adf7059d 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -138,9 +138,14 @@ __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum)
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
                 hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) {
-                        if (!strcmp(h->name, name) &&
-                            h->tuple.src.l3num == l3num &&
-                            h->tuple.dst.protonum == protonum)
+                        if (strcmp(h->name, name))
+                                continue;
+
+                        if (h->tuple.src.l3num != NFPROTO_UNSPEC &&
+                            h->tuple.src.l3num != l3num)
+                                continue;
+
+                        if (h->tuple.dst.protonum == protonum)
                                 return h;
                 }
         }
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 621b81c7bddc..c3fc14e021ec 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1436,9 +1436,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
                 handler = &sip_handlers[i];
                 if (handler->request == NULL)
                         continue;
-                if (*datalen < handler->len ||
+                if (*datalen < handler->len + 2 ||
                     strncasecmp(*dptr, handler->method, handler->len))
                         continue;
+                if ((*dptr)[handler->len] != ' ' ||
+                    !isalpha((*dptr)[handler->len+1]))
+                        continue;
 
                 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
                                       &matchoff, &matchlen) <= 0) {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 24db22257586..026581b04ea8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2956,12 +2956,14 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 
         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
         if (err < 0)
-                goto err2;
+                goto err3;
 
         list_add_tail_rcu(&set->list, &table->sets);
         table->use++;
         return 0;
 
+err3:
+        ops->destroy(set);
 err2:
         kfree(set);
 err1:
@@ -3452,14 +3454,15 @@ void *nft_set_elem_init(const struct nft_set *set,
         return elem;
 }
 
-void nft_set_elem_destroy(const struct nft_set *set, void *elem)
+void nft_set_elem_destroy(const struct nft_set *set, void *elem,
+                          bool destroy_expr)
 {
         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
         nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
                 nft_data_uninit(nft_set_ext_data(ext), set->dtype);
-        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+        if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
 
         kfree(elem);
@@ -3565,6 +3568,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                 dreg = nft_type_to_reg(set->dtype);
                 list_for_each_entry(binding, &set->bindings, list) {
                         struct nft_ctx bind_ctx = {
+                                .net    = ctx->net,
                                 .afi    = ctx->afi,
                                 .table  = ctx->table,
                                 .chain  = (struct nft_chain *)binding->chain,
@@ -3812,7 +3816,7 @@ void nft_set_gc_batch_release(struct rcu_head *rcu)
 
         gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
         for (i = 0; i < gcb->head.cnt; i++)
-                nft_set_elem_destroy(gcb->head.set, gcb->elems[i]);
+                nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
         kfree(gcb);
 }
 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
@@ -4030,7 +4034,7 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                 break;
         case NFT_MSG_DELSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv);
+                                     nft_trans_elem(trans).priv, true);
                 break;
         }
         kfree(trans);
@@ -4171,7 +4175,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
                 break;
         case NFT_MSG_NEWSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv);
+                                     nft_trans_elem(trans).priv, true);
                 break;
         }
         kfree(trans);
@@ -4421,7 +4425,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
  *      Otherwise a 0 is returned and the attribute value is stored in the
  *      destination variable.
  */
-unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
+int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
 {
         u32 val;
 
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 4339e3f1c4b1..7de2f46734a4 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -44,18 +44,22 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
                                  &regs->data[priv->sreg_key],
                                  &regs->data[priv->sreg_data],
                                  timeout, GFP_ATOMIC);
-        if (elem == NULL) {
-                if (set->size)
-                        atomic_dec(&set->nelems);
-                return NULL;
-        }
+        if (elem == NULL)
+                goto err1;
 
         ext = nft_set_elem_ext(set, elem);
         if (priv->expr != NULL &&
             nft_expr_clone(nft_set_ext_expr(ext), priv->expr) < 0)
-                return NULL;
+                goto err2;
 
         return elem;
+
+err2:
+        nft_set_elem_destroy(set, elem, false);
+err1:
+        if (set->size)
+                atomic_dec(&set->nelems);
+        return NULL;
 }
 
 static void nft_dynset_eval(const struct nft_expr *expr,
@@ -139,6 +143,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
                         return PTR_ERR(set);
         }
 
+        if (set->ops->update == NULL)
+                return -EOPNOTSUPP;
+
         if (set->flags & NFT_SET_CONSTANT)
                 return -EBUSY;
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 3794cb2fc788..a3dface3e6e6 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -98,7 +98,7 @@ static bool nft_hash_update(struct nft_set *set, const u32 *key,
                             const struct nft_set_ext **ext)
 {
         struct nft_hash *priv = nft_set_priv(set);
-        struct nft_hash_elem *he;
+        struct nft_hash_elem *he, *prev;
         struct nft_hash_cmp_arg arg = {
                 .genmask = NFT_GENMASK_ANY,
                 .set     = set,
@@ -112,15 +112,24 @@ static bool nft_hash_update(struct nft_set *set, const u32 *key,
         he = new(set, expr, regs);
         if (he == NULL)
                 goto err1;
-        if (rhashtable_lookup_insert_key(&priv->ht, &arg, &he->node,
-                                         nft_hash_params))
+
+        prev = rhashtable_lookup_get_insert_key(&priv->ht, &arg, &he->node,
+                                                nft_hash_params);
+        if (IS_ERR(prev))
                 goto err2;
+
+        /* Another cpu may race to insert the element with the same key */
+        if (prev) {
+                nft_set_elem_destroy(set, he, true);
+                he = prev;
+        }
+
 out:
         *ext = &he->ext;
         return true;
 
 err2:
-        nft_set_elem_destroy(set, he);
+        nft_set_elem_destroy(set, he, true);
 err1:
         return false;
 }
@@ -332,7 +341,7 @@ static int nft_hash_init(const struct nft_set *set,
 
 static void nft_hash_elem_destroy(void *ptr, void *arg)
 {
-        nft_set_elem_destroy((const struct nft_set *)arg, ptr);
+        nft_set_elem_destroy((const struct nft_set *)arg, ptr, true);
 }
 
 static void nft_hash_destroy(const struct nft_set *set)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 38b5bda242f8..36493a7cae88 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -266,7 +266,7 @@ static void nft_rbtree_destroy(const struct nft_set *set)
         while ((node = priv->root.rb_node) != NULL) {
                 rb_erase(node, &priv->root);
                 rbe = rb_entry(node, struct nft_rbtree_elem, node);
-                nft_set_elem_destroy(set, rbe);
+                nft_set_elem_destroy(set, rbe, true);
         }
 }
 
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 69f78e96fdb4..b83e158e116a 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -44,7 +44,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
         u_int32_t newmark;
 
         ct = nf_ct_get(skb, &ctinfo);
-        if (ct == NULL)
+        if (ct == NULL || nf_ct_is_untracked(ct))
                 return XT_CONTINUE;
 
         switch (info->mode) {
@@ -97,7 +97,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
         const struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
-        if (ct == NULL)
+        if (ct == NULL || nf_ct_is_untracked(ct))
                 return false;
 
         return ((ct->mark & info->mask) == info->mark) ^ info->invert;
diff --git a/net/netlink/diag.c b/net/netlink/diag.c
index b2f0e986a6f4..a5546249fb10 100644
--- a/net/netlink/diag.c
+++ b/net/netlink/diag.c
@@ -178,11 +178,8 @@ static int netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 }
                 cb->args[1] = i;
         } else {
-                if (req->sdiag_protocol >= MAX_LINKS) {
-                        read_unlock(&nl_table_lock);
-                        rcu_read_unlock();
+                if (req->sdiag_protocol >= MAX_LINKS)
                         return -ENOENT;
-                }
 
                 err = __netlink_diag_dump(skb, cb, req->sdiag_protocol, s_num);
         }
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index bbd3bff885a1..fb6e10fdb217 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -383,6 +383,7 @@ int genl_register_family(struct genl_family *family)
 
 errout_remove:
         idr_remove(&genl_fam_idr, family->id);
+        kfree(family->attrbuf);
 errout_locked:
         genl_unlock_all();
         return err;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index a2ea1d1cc06a..a01a56ec8b8c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -181,9 +181,10 @@ int sctp_rcv(struct sk_buff *skb)
          * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
          */
         if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb))) {
-                if (asoc) {
-                        sctp_association_put(asoc);
+                if (transport) {
+                        sctp_transport_put(transport);
                         asoc = NULL;
+                        transport = NULL;
                 } else {
                         sctp_endpoint_put(ep);
                         ep = NULL;
@@ -269,8 +270,8 @@ int sctp_rcv(struct sk_buff *skb)
         bh_unlock_sock(sk);
 
         /* Release the asoc/ep ref we took in the lookup calls. */
-        if (asoc)
-                sctp_association_put(asoc);
+        if (transport)
+                sctp_transport_put(transport);
         else
                 sctp_endpoint_put(ep);
 
@@ -283,8 +284,8 @@ discard_it:
 
 discard_release:
         /* Release the asoc/ep ref we took in the lookup calls. */
-        if (asoc)
-                sctp_association_put(asoc);
+        if (transport)
+                sctp_transport_put(transport);
         else
                 sctp_endpoint_put(ep);
 
@@ -300,6 +301,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
         struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
+        struct sctp_transport *t = chunk->transport;
         struct sctp_ep_common *rcvr = NULL;
         int backloged = 0;
 
@@ -351,7 +353,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 done:
         /* Release the refs we took in sctp_add_backlog */
         if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                sctp_association_put(sctp_assoc(rcvr));
+                sctp_transport_put(t);
         else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
                 sctp_endpoint_put(sctp_ep(rcvr));
         else
@@ -363,6 +365,7 @@ done:
 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+        struct sctp_transport *t = chunk->transport;
         struct sctp_ep_common *rcvr = chunk->rcvr;
         int ret;
 
@@ -373,7 +376,7 @@ static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
                  * from us
                  */
                 if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                        sctp_association_hold(sctp_assoc(rcvr));
+                        sctp_transport_hold(t);
                 else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
                         sctp_endpoint_hold(sctp_ep(rcvr));
                 else
@@ -537,15 +540,15 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
         return sk;
 
 out:
-        sctp_association_put(asoc);
+        sctp_transport_put(transport);
         return NULL;
 }
 
 /* Common cleanup code for icmp/icmpv6 error handler. */
-void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
+void sctp_err_finish(struct sock *sk, struct sctp_transport *t)
 {
         bh_unlock_sock(sk);
-        sctp_association_put(asoc);
+        sctp_transport_put(t);
 }
 
 /*
@@ -641,7 +644,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         }
 
 out_unlock:
-        sctp_err_finish(sk, asoc);
+        sctp_err_finish(sk, transport);
 }
 
 /*
@@ -952,11 +955,8 @@ static struct sctp_association *__sctp_lookup_association(
                 goto out;
 
         asoc = t->asoc;
-        sctp_association_hold(asoc);
         *pt = t;
 
-        sctp_transport_put(t);
-
 out:
         return asoc;
 }
@@ -986,7 +986,7 @@ int sctp_has_association(struct net *net,
         struct sctp_transport *transport;
 
         if ((asoc = sctp_lookup_association(net, laddr, paddr, &transport))) {
-                sctp_association_put(asoc);
+                sctp_transport_put(transport);
                 return 1;
         }
 
@@ -1021,7 +1021,6 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
         struct sctphdr *sh = sctp_hdr(skb);
         union sctp_params params;
         sctp_init_chunk_t *init;
-        struct sctp_transport *transport;
         struct sctp_af *af;
 
         /*
@@ -1052,7 +1051,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
 
                 af->from_addr_param(paddr, params.addr, sh->source, 0);
 
-                asoc = __sctp_lookup_association(net, laddr, paddr, &transport);
+                asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
                 if (asoc)
                         return asoc;
         }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index f473779e8b1c..176af3080a2b 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -198,7 +198,7 @@ static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
 out_unlock:
-        sctp_err_finish(sk, asoc);
+        sctp_err_finish(sk, transport);
 out:
         if (likely(idev != NULL))
                 in6_dev_put(idev);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9fbb6feb8c27..f23ad913dc7a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1214,9 +1214,12 @@ static int __sctp_connect(struct sock *sk,
 
         timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
 
-        err = sctp_wait_for_connect(asoc, &timeo);
-        if ((err == 0 || err == -EINPROGRESS) && assoc_id)
+        if (assoc_id)
                 *assoc_id = asoc->assoc_id;
+        err = sctp_wait_for_connect(asoc, &timeo);
+        /* Note: the asoc may be freed after the return of
+         * sctp_wait_for_connect.
+         */
 
         /* Don't free association on exit. */
         asoc = NULL;
@@ -4282,19 +4285,18 @@ static void sctp_shutdown(struct sock *sk, int how)
 {
         struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
-        struct sctp_association *asoc;
 
         if (!sctp_style(sk, TCP))
                 return;
 
-        if (how & SEND_SHUTDOWN) {
+        ep = sctp_sk(sk)->ep;
+        if (how & SEND_SHUTDOWN && !list_empty(&ep->asocs)) {
+                struct sctp_association *asoc;
+
                 sk->sk_state = SCTP_SS_CLOSING;
-                ep = sctp_sk(sk)->ep;
-                if (!list_empty(&ep->asocs)) {
-                        asoc = list_entry(ep->asocs.next,
-                                          struct sctp_association, asocs);
-                        sctp_primitive_SHUTDOWN(net, asoc, NULL);
-                }
+                asoc = list_entry(ep->asocs.next,
+                                  struct sctp_association, asocs);
+                sctp_primitive_SHUTDOWN(net, asoc, NULL);
         }
 }
 
@@ -4480,12 +4482,9 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
         if (!transport || !sctp_transport_hold(transport))
                 goto out;
 
-        sctp_association_hold(transport->asoc);
-        sctp_transport_put(transport);
-
         rcu_read_unlock();
         err = cb(transport, p);
-        sctp_association_put(transport->asoc);
+        sctp_transport_put(transport);
 
 out:
         return err;
diff --git a/net/socket.c b/net/socket.c
index 4ce33c35e606..f9e26c68c3cf 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2064,6 +2064,8 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                 if (err)
                         break;
                 ++datagrams;
+                if (msg_data_left(&msg_sys))
+                        break;
                 cond_resched();
         }
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index d8bd97a5a7c9..3dfd769dc5b5 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1616,7 +1616,7 @@ gss_validate(struct rpc_task *task, __be32 *p)
 {
         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
-        __be32          seq;
+        __be32          *seq = NULL;
         struct kvec     iov;
         struct xdr_buf  verf_buf;
         struct xdr_netobj mic;
@@ -1631,9 +1631,12 @@ gss_validate(struct rpc_task *task, __be32 *p)
                 goto out_bad;
         if (flav != RPC_AUTH_GSS)
                 goto out_bad;
-        seq = htonl(task->tk_rqstp->rq_seqno);
-        iov.iov_base = &seq;
-        iov.iov_len = sizeof(seq);
+        seq = kmalloc(4, GFP_NOFS);
+        if (!seq)
+                goto out_bad;
+        *seq = htonl(task->tk_rqstp->rq_seqno);
+        iov.iov_base = seq;
+        iov.iov_len = 4;
         xdr_buf_from_iov(&iov, &verf_buf);
         mic.data = (u8 *)p;
         mic.len = len;
@@ -1653,11 +1656,13 @@ gss_validate(struct rpc_task *task, __be32 *p)
         gss_put_ctx(ctx);
         dprintk("RPC: %5u %s: gss_verify_mic succeeded.\n",
                         task->tk_pid, __func__);
+        kfree(seq);
         return p + XDR_QUADLEN(len);
 out_bad:
         gss_put_ctx(ctx);
         dprintk("RPC: %5u %s failed ret %ld.\n", task->tk_pid, __func__,
                 PTR_ERR(ret));
+        kfree(seq);
         return ret;
 }
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 244245bcbbd2..90115ceefd49 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -166,8 +166,8 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
                        unsigned int usage, struct xdr_netobj *cksumout)
 {
         struct scatterlist              sg[1];
-        int err;
-        u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN];
+        int err = -1;
+        u8 *checksumdata;
         u8 rc4salt[4];
         struct crypto_ahash *md5;
         struct crypto_ahash *hmac_md5;
@@ -187,23 +187,22 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
                 return GSS_S_FAILURE;
         }
 
+        checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
+        if (!checksumdata)
+                return GSS_S_FAILURE;
+
         md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(md5))
-                return GSS_S_FAILURE;
+                goto out_free_cksum;
 
         hmac_md5 = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0,
                                       CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hmac_md5)) {
-                crypto_free_ahash(md5);
-                return GSS_S_FAILURE;
-        }
+        if (IS_ERR(hmac_md5))
+                goto out_free_md5;
 
         req = ahash_request_alloc(md5, GFP_KERNEL);
-        if (!req) {
-                crypto_free_ahash(hmac_md5);
-                crypto_free_ahash(md5);
-                return GSS_S_FAILURE;
-        }
+        if (!req)
+                goto out_free_hmac_md5;
 
         ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
 
@@ -232,11 +231,8 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
 
         ahash_request_free(req);
         req = ahash_request_alloc(hmac_md5, GFP_KERNEL);
-        if (!req) {
-                crypto_free_ahash(hmac_md5);
-                crypto_free_ahash(md5);
-                return GSS_S_FAILURE;
-        }
+        if (!req)
+                goto out_free_hmac_md5;
 
         ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
 
@@ -258,8 +254,12 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
         cksumout->len = kctx->gk5e->cksumlength;
 out:
         ahash_request_free(req);
-        crypto_free_ahash(md5);
+out_free_hmac_md5:
         crypto_free_ahash(hmac_md5);
+out_free_md5:
+        crypto_free_ahash(md5);
+out_free_cksum:
+        kfree(checksumdata);
         return err ? GSS_S_FAILURE : 0;
 }
 
@@ -276,8 +276,8 @@ make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen,
         struct crypto_ahash *tfm;
         struct ahash_request *req;
         struct scatterlist              sg[1];
-        int err;
-        u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN];
+        int err = -1;
+        u8 *checksumdata;
         unsigned int checksumlen;
 
         if (kctx->gk5e->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR)
@@ -291,15 +291,17 @@ make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen,
                 return GSS_S_FAILURE;
         }
 
+        checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
+        if (checksumdata == NULL)
+                return GSS_S_FAILURE;
+
         tfm = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm))
-                return GSS_S_FAILURE;
+                goto out_free_cksum;
 
         req = ahash_request_alloc(tfm, GFP_KERNEL);
-        if (!req) {
-                crypto_free_ahash(tfm);
-                return GSS_S_FAILURE;
-        }
+        if (!req)
+                goto out_free_ahash;
 
         ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
 
@@ -349,7 +351,10 @@ make_checksum(struct krb5_ctx *kctx, char *header, int hdrlen,
         cksumout->len = kctx->gk5e->cksumlength;
 out:
         ahash_request_free(req);
+out_free_ahash:
         crypto_free_ahash(tfm);
+out_free_cksum:
+        kfree(checksumdata);
         return err ? GSS_S_FAILURE : 0;
 }
 
@@ -368,8 +373,8 @@ make_checksum_v2(struct krb5_ctx *kctx, char *header, int hdrlen,
         struct crypto_ahash *tfm;
         struct ahash_request *req;
         struct scatterlist sg[1];
-        int err;
-        u8 checksumdata[GSS_KRB5_MAX_CKSUM_LEN];
+        int err = -1;
+        u8 *checksumdata;
         unsigned int checksumlen;
 
         if (kctx->gk5e->keyed_cksum == 0) {
@@ -383,16 +388,18 @@ make_checksum_v2(struct krb5_ctx *kctx, char *header, int hdrlen,
                 return GSS_S_FAILURE;
         }
 
+        checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
+        if (!checksumdata)
+                return GSS_S_FAILURE;
+
         tfm = crypto_alloc_ahash(kctx->gk5e->cksum_name, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm))
-                return GSS_S_FAILURE;
+                goto out_free_cksum;
         checksumlen = crypto_ahash_digestsize(tfm);
 
         req = ahash_request_alloc(tfm, GFP_KERNEL);
-        if (!req) {
-                crypto_free_ahash(tfm);
-                return GSS_S_FAILURE;
-        }
+        if (!req)
+                goto out_free_ahash;
 
         ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
 
@@ -433,7 +440,10 @@ make_checksum_v2(struct krb5_ctx *kctx, char *header, int hdrlen,
         }
 out:
         ahash_request_free(req);
+out_free_ahash:
         crypto_free_ahash(tfm);
+out_free_cksum:
+        kfree(checksumdata);
         return err ? GSS_S_FAILURE : 0;
 }
 
@@ -666,14 +676,17 @@ gss_krb5_cts_crypt(struct crypto_skcipher *cipher, struct xdr_buf *buf,
         u32 ret;
         struct scatterlist sg[1];
         SKCIPHER_REQUEST_ON_STACK(req, cipher);
-        u8 data[GSS_KRB5_MAX_BLOCKSIZE * 2];
+        u8 *data;
         struct page **save_pages;
         u32 len = buf->len - offset;
 
-        if (len > ARRAY_SIZE(data)) {
+        if (len > GSS_KRB5_MAX_BLOCKSIZE * 2) {
                 WARN_ON(0);
                 return -ENOMEM;
         }
+        data = kmalloc(GSS_KRB5_MAX_BLOCKSIZE * 2, GFP_NOFS);
+        if (!data)
+                return -ENOMEM;
 
         /*
          * For encryption, we want to read from the cleartext
@@ -708,6 +721,7 @@ gss_krb5_cts_crypt(struct crypto_skcipher *cipher, struct xdr_buf *buf,
         ret = write_bytes_to_xdr_buf(buf, offset, data, len);
 
 out:
+        kfree(data);
         return ret;
 }
 
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index d67f7e1bc82d..45662d7f0943 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -718,30 +718,37 @@ gss_write_null_verf(struct svc_rqst *rqstp)
 static int
 gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
 {
-        __be32                  xdr_seq;
+        __be32                  *xdr_seq;
         u32                     maj_stat;
         struct xdr_buf          verf_data;
         struct xdr_netobj       mic;
         __be32                  *p;
         struct kvec             iov;
+        int err = -1;
 
         svc_putnl(rqstp->rq_res.head, RPC_AUTH_GSS);
-        xdr_seq = htonl(seq);
+        xdr_seq = kmalloc(4, GFP_KERNEL);
+        if (!xdr_seq)
+                return -1;
+        *xdr_seq = htonl(seq);
 
-        iov.iov_base = &xdr_seq;
-        iov.iov_len = sizeof(xdr_seq);
+        iov.iov_base = xdr_seq;
+        iov.iov_len = 4;
         xdr_buf_from_iov(&iov, &verf_data);
         p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
         mic.data = (u8 *)(p + 1);
         maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
         if (maj_stat != GSS_S_COMPLETE)
-                return -1;
+                goto out;
         *p++ = htonl(mic.len);
         memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len);
         p += XDR_QUADLEN(mic.len);
         if (!xdr_ressize_check(rqstp, p))
-                return -1;
-        return 0;
+                goto out;
+        err = 0;
+out:
+        kfree(xdr_seq);
+        return err;
 }
 
 struct gss_domain {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 34dd7b26ee5f..62a482790937 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -2753,14 +2753,18 @@ EXPORT_SYMBOL_GPL(rpc_cap_max_reconnect_timeout);
 
 void rpc_clnt_xprt_switch_put(struct rpc_clnt *clnt)
 {
+        rcu_read_lock();
         xprt_switch_put(rcu_dereference(clnt->cl_xpi.xpi_xpswitch));
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(rpc_clnt_xprt_switch_put);
 
 void rpc_clnt_xprt_switch_add_xprt(struct rpc_clnt *clnt, struct rpc_xprt *xprt)
 {
+        rcu_read_lock();
         rpc_xprt_switch_add_xprt(rcu_dereference(clnt->cl_xpi.xpi_xpswitch),
                                  xprt);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(rpc_clnt_xprt_switch_add_xprt);
 
@@ -2770,9 +2774,8 @@ bool rpc_clnt_xprt_switch_has_addr(struct rpc_clnt *clnt,
         struct rpc_xprt_switch *xps;
         bool ret;
 
-        xps = rcu_dereference(clnt->cl_xpi.xpi_xpswitch);
-
         rcu_read_lock();
+        xps = rcu_dereference(clnt->cl_xpi.xpi_xpswitch);
         ret = rpc_xprt_switch_has_addr(xps, sap);
         rcu_read_unlock();
         return ret;
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index 210949562786..26b26beef2d4 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -44,18 +44,20 @@
  * being done.
  *
  * When the underlying transport disconnects, MRs are left in one of
- * three states:
+ * four states:
  *
  * INVALID:     The MR was not in use before the QP entered ERROR state.
- *              (Or, the LOCAL_INV WR has not completed or flushed yet).
- *
- * STALE:       The MR was being registered or unregistered when the QP
- *              entered ERROR state, and the pending WR was flushed.
  *
  * VALID:       The MR was registered before the QP entered ERROR state.
  *
- * When frwr_op_map encounters STALE and VALID MRs, they are recovered
- * with ib_dereg_mr and then are re-initialized. Beause MR recovery
+ * FLUSHED_FR:  The MR was being registered when the QP entered ERROR
+ *              state, and the pending WR was flushed.
+ *
+ * FLUSHED_LI:  The MR was being invalidated when the QP entered ERROR
+ *              state, and the pending WR was flushed.
+ *
+ * When frwr_op_map encounters FLUSHED and VALID MRs, they are recovered
+ * with ib_dereg_mr and then are re-initialized. Because MR recovery
  * allocates fresh resources, it is deferred to a workqueue, and the
  * recovered MRs are placed back on the rb_mws list when recovery is
  * complete. frwr_op_map allocates another MR for the current RPC while
@@ -177,12 +179,15 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r)
 static void
 frwr_op_recover_mr(struct rpcrdma_mw *mw)
 {
+        enum rpcrdma_frmr_state state = mw->frmr.fr_state;
         struct rpcrdma_xprt *r_xprt = mw->mw_xprt;
         struct rpcrdma_ia *ia = &r_xprt->rx_ia;
         int rc;
 
         rc = __frwr_reset_mr(ia, mw);
-        ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir);
+        if (state != FRMR_FLUSHED_LI)
+                ib_dma_unmap_sg(ia->ri_device,
+                                mw->mw_sg, mw->mw_nents, mw->mw_dir);
         if (rc)
                 goto out_release;
 
@@ -262,10 +267,8 @@ frwr_op_maxpages(struct rpcrdma_xprt *r_xprt)
 }
 
 static void
-__frwr_sendcompletion_flush(struct ib_wc *wc, struct rpcrdma_frmr *frmr,
-                            const char *wr)
+__frwr_sendcompletion_flush(struct ib_wc *wc, const char *wr)
 {
-        frmr->fr_state = FRMR_IS_STALE;
         if (wc->status != IB_WC_WR_FLUSH_ERR)
                 pr_err("rpcrdma: %s: %s (%u/0x%x)\n",
                        wr, ib_wc_status_msg(wc->status),
@@ -288,7 +291,8 @@ frwr_wc_fastreg(struct ib_cq *cq, struct ib_wc *wc)
         if (wc->status != IB_WC_SUCCESS) {
                 cqe = wc->wr_cqe;
                 frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
-                __frwr_sendcompletion_flush(wc, frmr, "fastreg");
+                frmr->fr_state = FRMR_FLUSHED_FR;
+                __frwr_sendcompletion_flush(wc, "fastreg");
         }
 }
 
@@ -308,7 +312,8 @@ frwr_wc_localinv(struct ib_cq *cq, struct ib_wc *wc)
         if (wc->status != IB_WC_SUCCESS) {
                 cqe = wc->wr_cqe;
                 frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
-                __frwr_sendcompletion_flush(wc, frmr, "localinv");
+                frmr->fr_state = FRMR_FLUSHED_LI;
+                __frwr_sendcompletion_flush(wc, "localinv");
         }
 }
 
@@ -328,8 +333,10 @@ frwr_wc_localinv_wake(struct ib_cq *cq, struct ib_wc *wc)
         /* WARNING: Only wr_cqe and status are reliable at this point */
         cqe = wc->wr_cqe;
         frmr = container_of(cqe, struct rpcrdma_frmr, fr_cqe);
-        if (wc->status != IB_WC_SUCCESS)
-                __frwr_sendcompletion_flush(wc, frmr, "localinv");
+        if (wc->status != IB_WC_SUCCESS) {
+                frmr->fr_state = FRMR_FLUSHED_LI;
+                __frwr_sendcompletion_flush(wc, "localinv");
+        }
         complete(&frmr->fr_linv_done);
 }
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index 2d8545c34095..20027f8de129 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -177,18 +177,26 @@ xprt_rdma_bc_allocate(struct rpc_task *task)
                 return -EINVAL;
         }
 
+        /* svc_rdma_sendto releases this page */
         page = alloc_page(RPCRDMA_DEF_GFP);
         if (!page)
                 return -ENOMEM;
-
         rqst->rq_buffer = page_address(page);
+
+        rqst->rq_rbuffer = kmalloc(rqst->rq_rcvsize, RPCRDMA_DEF_GFP);
+        if (!rqst->rq_rbuffer) {
+                put_page(page);
+                return -ENOMEM;
+        }
         return 0;
 }
 
 static void
 xprt_rdma_bc_free(struct rpc_task *task)
 {
-        /* No-op: ctxt and page have already been freed. */
+        struct rpc_rqst *rqst = task->tk_rqstp;
+
+        kfree(rqst->rq_rbuffer);
 }
 
 static int
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 0d35b761c883..6e1bba358203 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -216,7 +216,8 @@ struct rpcrdma_rep {
 enum rpcrdma_frmr_state {
         FRMR_IS_INVALID,        /* ready to be used */
         FRMR_IS_VALID,          /* in use */
-        FRMR_IS_STALE,          /* failed completion */
+        FRMR_FLUSHED_FR,        /* flushed FASTREG WR */
+        FRMR_FLUSHED_LI,        /* flushed LOCALINV WR */
 };
 
 struct rpcrdma_frmr {
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7178d0aa7861..af392d9b9cec 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2563,6 +2563,7 @@ static int bc_malloc(struct rpc_task *task)
         buf->len = PAGE_SIZE;
 
         rqst->rq_buffer = buf->data;
+        rqst->rq_rbuffer = (char *)rqst->rq_buffer + rqst->rq_callsize;
         return 0;
 }
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 87620183910e..6a705d0ff889 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2812,7 +2812,8 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                                 i++;
                         }
                         for ( ; i < len; i++)
-                                seq_putc(seq, u->addr->name->sun_path[i]);
+                                seq_putc(seq, u->addr->name->sun_path[i] ?:
+                                         '@');
                 }
                 unix_state_unlock(s);
                 seq_putc(seq, '\n');
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 5c53fdb67ca7..ac87f9c068ae 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -26,6 +26,7 @@ hostprogs-y += xdp2
 hostprogs-y += test_current_task_under_cgroup
 hostprogs-y += trace_event
 hostprogs-y += sampleip
+hostprogs-y += tc_l2_redirect
 
 sock_example-objs := sock_example.o libbpf.o
 fds_example-objs := bpf_load.o libbpf.o fds_example.o
@@ -53,6 +54,7 @@ test_current_task_under_cgroup-objs := bpf_load.o libbpf.o \
                                        test_current_task_under_cgroup_user.o
 trace_event-objs := bpf_load.o libbpf.o trace_event_user.o
 sampleip-objs := bpf_load.o libbpf.o sampleip_user.o
+tc_l2_redirect-objs := bpf_load.o libbpf.o tc_l2_redirect_user.o
 
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)
@@ -69,6 +71,7 @@ always += test_probe_write_user_kern.o
 always += trace_output_kern.o
 always += tcbpf1_kern.o
 always += tcbpf2_kern.o
+always += tc_l2_redirect_kern.o
 always += lathist_kern.o
 always += offwaketime_kern.o
 always += spintest_kern.o
@@ -108,6 +111,7 @@ HOSTLOADLIBES_xdp2 += -lelf
 HOSTLOADLIBES_test_current_task_under_cgroup += -lelf
 HOSTLOADLIBES_trace_event += -lelf
 HOSTLOADLIBES_sampleip += -lelf
+HOSTLOADLIBES_tc_l2_redirect += -l elf
 
 # Allows pointing LLC/CLANG to a LLVM backend with bpf support, redefine on cmdline:
 #  make samples/bpf/ LLC=~/git/llvm/build/bin/llc CLANG=~/git/llvm/build/bin/clang
diff --git a/samples/bpf/tc_l2_redirect.sh b/samples/bpf/tc_l2_redirect.sh
new file mode 100755
index 000000000000..80a05591a140
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect.sh
@@ -0,0 +1,173 @@
+#!/bin/bash
+
+[[ -z $TC ]] && TC='tc'
+[[ -z $IP ]] && IP='ip'
+
+REDIRECT_USER='./tc_l2_redirect'
+REDIRECT_BPF='./tc_l2_redirect_kern.o'
+
+RP_FILTER=$(< /proc/sys/net/ipv4/conf/all/rp_filter)
+IPV6_FORWARDING=$(< /proc/sys/net/ipv6/conf/all/forwarding)
+
+function config_common {
+        local tun_type=$1
+
+        $IP netns add ns1
+        $IP netns add ns2
+        $IP link add ve1 type veth peer name vens1
+        $IP link add ve2 type veth peer name vens2
+        $IP link set dev ve1 up
+        $IP link set dev ve2 up
+        $IP link set dev ve1 mtu 1500
+        $IP link set dev ve2 mtu 1500
+        $IP link set dev vens1 netns ns1
+        $IP link set dev vens2 netns ns2
+
+        $IP -n ns1 link set dev lo up
+        $IP -n ns1 link set dev vens1 up
+        $IP -n ns1 addr add 10.1.1.101/24 dev vens1
+        $IP -n ns1 addr add 2401:db01::65/64 dev vens1 nodad
+        $IP -n ns1 route add default via 10.1.1.1 dev vens1
+        $IP -n ns1 route add default via 2401:db01::1 dev vens1
+
+        $IP -n ns2 link set dev lo up
+        $IP -n ns2 link set dev vens2 up
+        $IP -n ns2 addr add 10.2.1.102/24 dev vens2
+        $IP -n ns2 addr add 2401:db02::66/64 dev vens2 nodad
+        $IP -n ns2 addr add 10.10.1.102 dev lo
+        $IP -n ns2 addr add 2401:face::66/64 dev lo nodad
+        $IP -n ns2 link add ipt2 type ipip local 10.2.1.102 remote 10.2.1.1
+        $IP -n ns2 link add ip6t2 type ip6tnl mode any local 2401:db02::66 remote 2401:db02::1
+        $IP -n ns2 link set dev ipt2 up
+        $IP -n ns2 link set dev ip6t2 up
+        $IP netns exec ns2 $TC qdisc add dev vens2 clsact
+        $IP netns exec ns2 $TC filter add dev vens2 ingress bpf da obj $REDIRECT_BPF sec drop_non_tun_vip
+        if [[ $tun_type == "ipip" ]]; then
+                $IP -n ns2 route add 10.1.1.0/24 dev ipt2
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ipt2.rp_filter=0
+        else
+                $IP -n ns2 route add 10.1.1.0/24 dev ip6t2
+                $IP -n ns2 route add 2401:db01::/64 dev ip6t2
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ip6t2.rp_filter=0
+        fi
+
+        $IP addr add 10.1.1.1/24 dev ve1
+        $IP addr add 2401:db01::1/64 dev ve1 nodad
+        $IP addr add 10.2.1.1/24 dev ve2
+        $IP addr add 2401:db02::1/64 dev ve2 nodad
+
+        $TC qdisc add dev ve2 clsact
+        $TC filter add dev ve2 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_forward
+
+        sysctl -q -w net.ipv4.conf.all.rp_filter=0
+        sysctl -q -w net.ipv6.conf.all.forwarding=1
+}
+
+function cleanup {
+        set +e
+        [[ -z $DEBUG ]] || set +x
+        $IP netns delete ns1 >& /dev/null
+        $IP netns delete ns2 >& /dev/null
+        $IP link del ve1 >& /dev/null
+        $IP link del ve2 >& /dev/null
+        $IP link del ipt >& /dev/null
+        $IP link del ip6t >& /dev/null
+        sysctl -q -w net.ipv4.conf.all.rp_filter=$RP_FILTER
+        sysctl -q -w net.ipv6.conf.all.forwarding=$IPV6_FORWARDING
+        rm -f /sys/fs/bpf/tc/globals/tun_iface
+        [[ -z $DEBUG ]] || set -x
+        set -e
+}
+
+function l2_to_ipip {
+        echo -n "l2_to_ipip $1: "
+
+        local dir=$1
+
+        config_common ipip
+
+        $IP link add ipt type ipip external
+        $IP link set dev ipt up
+        sysctl -q -w net.ipv4.conf.ipt.rp_filter=0
+        sysctl -q -w net.ipv4.conf.ipt.forwarding=1
+
+        if [[ $dir == "egress" ]]; then
+                $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
+                $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
+                sysctl -q -w net.ipv4.conf.ve1.forwarding=1
+        else
+                $TC qdisc add dev ve1 clsact
+                $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
+        fi
+
+        $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ipt/ifindex)
+
+        $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
+
+        if [[ $dir == "egress" ]]; then
+                # test direct egress to ve2 (i.e. not forwarding from
+                # ve1 to ve2).
+                ping -c1 10.10.1.102 >& /dev/null
+        fi
+
+        cleanup
+
+        echo "OK"
+}
+
+function l2_to_ip6tnl {
+        echo -n "l2_to_ip6tnl $1: "
+
+        local dir=$1
+
+        config_common ip6tnl
+
+        $IP link add ip6t type ip6tnl mode any external
+        $IP link set dev ip6t up
+        sysctl -q -w net.ipv4.conf.ip6t.rp_filter=0
+        sysctl -q -w net.ipv4.conf.ip6t.forwarding=1
+
+        if [[ $dir == "egress" ]]; then
+                $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
+                $IP route add 2401:face::/64 via 2401:db02::66 dev ve2
+                $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
+                sysctl -q -w net.ipv4.conf.ve1.forwarding=1
+        else
+                $TC qdisc add dev ve1 clsact
+                $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
+        fi
+
+        $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ip6t/ifindex)
+
+        $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
+        $IP netns exec ns1 ping -6 -c1 2401:face::66 >& /dev/null
+
+        if [[ $dir == "egress" ]]; then
+                # test direct egress to ve2 (i.e. not forwarding from
+                # ve1 to ve2).
+                ping -c1 10.10.1.102 >& /dev/null
+                ping -6 -c1 2401:face::66 >& /dev/null
+        fi
+
+        cleanup
+
+        echo "OK"
+}
+
+cleanup
+test_names="l2_to_ipip l2_to_ip6tnl"
+test_dirs="ingress egress"
+if [[ $# -ge 2 ]]; then
+        test_names=$1
+        test_dirs=$2
+elif [[ $# -ge 1 ]]; then
+        test_names=$1
+fi
+
+for t in $test_names; do
+        for d in $test_dirs; do
+                $t $d
+        done
+done
diff --git a/samples/bpf/tc_l2_redirect_kern.c b/samples/bpf/tc_l2_redirect_kern.c
new file mode 100644
index 000000000000..92a44729dbe4
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect_kern.c
@@ -0,0 +1,236 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#include <uapi/linux/bpf.h>
+#include <uapi/linux/if_ether.h>
+#include <uapi/linux/if_packet.h>
+#include <uapi/linux/ip.h>
+#include <uapi/linux/ipv6.h>
+#include <uapi/linux/in.h>
+#include <uapi/linux/tcp.h>
+#include <uapi/linux/filter.h>
+#include <uapi/linux/pkt_cls.h>
+#include <net/ipv6.h>
+#include "bpf_helpers.h"
+
+#define _htonl __builtin_bswap32
+
+#define PIN_GLOBAL_NS           2
+struct bpf_elf_map {
+        __u32 type;
+        __u32 size_key;
+        __u32 size_value;
+        __u32 max_elem;
+        __u32 flags;
+        __u32 id;
+        __u32 pinning;
+};
+
+/* copy of 'struct ethhdr' without __packed */
+struct eth_hdr {
+        unsigned char   h_dest[ETH_ALEN];
+        unsigned char   h_source[ETH_ALEN];
+        unsigned short  h_proto;
+};
+
+struct bpf_elf_map SEC("maps") tun_iface = {
+        .type = BPF_MAP_TYPE_ARRAY,
+        .size_key = sizeof(int),
+        .size_value = sizeof(int),
+        .pinning = PIN_GLOBAL_NS,
+        .max_elem = 1,
+};
+
+static __always_inline bool is_vip_addr(__be16 eth_proto, __be32 daddr)
+{
+        if (eth_proto == htons(ETH_P_IP))
+                return (_htonl(0xffffff00) & daddr) == _htonl(0x0a0a0100);
+        else if (eth_proto == htons(ETH_P_IPV6))
+                return (daddr == _htonl(0x2401face));
+
+        return false;
+}
+
+SEC("l2_to_iptun_ingress_forward")
+int _l2_to_iptun_ingress_forward(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        int ret;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "ingress forward to ifindex:%d daddr4:%x\n";
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (iph->protocol != IPPROTO_IPIP)
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), *ifindex,
+                                 _htonl(iph->daddr));
+                return bpf_redirect(*ifindex, BPF_F_INGRESS);
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                char fmt6[] = "ingress forward to ifindex:%d daddr6:%x::%x\n";
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (ip6h->nexthdr != IPPROTO_IPIP &&
+                    ip6h->nexthdr != IPPROTO_IPV6)
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt6, sizeof(fmt6), *ifindex,
+                                 _htonl(ip6h->daddr.s6_addr32[0]),
+                                 _htonl(ip6h->daddr.s6_addr32[3]));
+                return bpf_redirect(*ifindex, BPF_F_INGRESS);
+        }
+
+        return TC_ACT_OK;
+}
+
+SEC("l2_to_iptun_ingress_redirect")
+int _l2_to_iptun_ingress_redirect(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        int ret;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
+                struct iphdr *iph = data + sizeof(*eth);
+                __be32 daddr = iph->daddr;
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, daddr))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(daddr), *ifindex);
+        } else {
+                return TC_ACT_OK;
+        }
+
+        tkey.tunnel_id = 10000;
+        tkey.tunnel_ttl = 64;
+        tkey.remote_ipv4 = 0x0a020166; /* 10.2.1.102 */
+        bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), 0);
+        return bpf_redirect(*ifindex, 0);
+}
+
+SEC("l2_to_ip6tun_ingress_redirect")
+int _l2_to_ip6tun_ingress_redirect(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, iph->daddr))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(iph->daddr),
+                                 *ifindex);
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                char fmt6[] = "e/ingress redirect daddr6:%x to ifindex:%d\n";
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt6, sizeof(fmt6),
+                                 _htonl(ip6h->daddr.s6_addr32[0]), *ifindex);
+        } else {
+                return TC_ACT_OK;
+        }
+
+        tkey.tunnel_id = 10000;
+        tkey.tunnel_ttl = 64;
+        /* 2401:db02:0:0:0:0:0:66 */
+        tkey.remote_ipv6[0] = _htonl(0x2401db02);
+        tkey.remote_ipv6[1] = 0;
+        tkey.remote_ipv6[2] = 0;
+        tkey.remote_ipv6[3] = _htonl(0x00000066);
+        bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), BPF_F_TUNINFO_IPV6);
+        return bpf_redirect(*ifindex, 0);
+}
+
+SEC("drop_non_tun_vip")
+int _drop_non_tun_vip(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (is_vip_addr(eth->h_proto, iph->daddr))
+                        return TC_ACT_SHOT;
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
+                        return TC_ACT_SHOT;
+        }
+
+        return TC_ACT_OK;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/samples/bpf/tc_l2_redirect_user.c b/samples/bpf/tc_l2_redirect_user.c
new file mode 100644
index 000000000000..4013c5337b91
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect_user.c
@@ -0,0 +1,73 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#include <linux/unistd.h>
+#include <linux/bpf.h>
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+#include "libbpf.h"
+
+static void usage(void)
+{
+        printf("Usage: tc_l2_ipip_redirect [...]\n");
+        printf("       -U <file>   Update an already pinned BPF array\n");
+        printf("       -i <ifindex> Interface index\n");
+        printf("       -h          Display this help\n");
+}
+
+int main(int argc, char **argv)
+{
+        const char *pinned_file = NULL;
+        int ifindex = -1;
+        int array_key = 0;
+        int array_fd = -1;
+        int ret = -1;
+        int opt;
+
+        while ((opt = getopt(argc, argv, "F:U:i:")) != -1) {
+                switch (opt) {
+                /* General args */
+                case 'U':
+                        pinned_file = optarg;
+                        break;
+                case 'i':
+                        ifindex = atoi(optarg);
+                        break;
+                default:
+                        usage();
+                        goto out;
+                }
+        }
+
+        if (ifindex < 0 || !pinned_file) {
+                usage();
+                goto out;
+        }
+
+        array_fd = bpf_obj_get(pinned_file);
+        if (array_fd < 0) {
+                fprintf(stderr, "bpf_obj_get(%s): %s(%d)\n",
+                        pinned_file, strerror(errno), errno);
+                goto out;
+        }
+
+        /* bpf_tunnel_key.remote_ipv4 expects host byte orders */
+        ret = bpf_update_elem(array_fd, &array_key, &ifindex, 0);
+        if (ret) {
+                perror("bpf_update_elem");
+                goto out;
+        }
+
+out:
+        if (array_fd != -1)
+                close(array_fd);
+        return ret;
+}
diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
index 53449a6ff6aa..7c321a603b07 100644
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -36,6 +36,7 @@ warning-2 += -Wshadow
 warning-2 += $(call cc-option, -Wlogical-op)
 warning-2 += $(call cc-option, -Wmissing-field-initializers)
 warning-2 += $(call cc-option, -Wsign-compare)
+warning-2 += $(call cc-option, -Wmaybe-uninitialized)
 
 warning-3 := -Wbad-function-cast
 warning-3 += -Wcast-qual
diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
index dd779c40c8e6..3b1b13818d59 100644
--- a/scripts/Makefile.ubsan
+++ b/scripts/Makefile.ubsan
@@ -17,4 +17,8 @@ endif
 ifdef CONFIG_UBSAN_NULL
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=null)
 endif
+
+      # -fsanitize=* options makes GCC less smart than usual and
+      # increase number of 'maybe-uninitialized false-positives
+      CFLAGS_UBSAN += $(call cc-option, -Wno-maybe-uninitialized)
 endif
diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 19f5adfd877d..d9ff038c1b28 100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
@@ -8,6 +8,9 @@
 # of the GNU General Public License, incorporated herein by reference.
 
 import sys, os, re
+from signal import signal, SIGPIPE, SIG_DFL
+
+signal(SIGPIPE, SIG_DFL)
 
 if len(sys.argv) != 3:
     sys.stderr.write("usage: %s file1 file2\n" % sys.argv[0])
diff --git a/scripts/gcc-plugins/cyc_complexity_plugin.c b/scripts/gcc-plugins/cyc_complexity_plugin.c
index 34df974c6ba3..8af7db06122d 100644
--- a/scripts/gcc-plugins/cyc_complexity_plugin.c
+++ b/scripts/gcc-plugins/cyc_complexity_plugin.c
@@ -20,7 +20,7 @@
 
 #include "gcc-common.h"
 
-int plugin_is_GPL_compatible;
+__visible int plugin_is_GPL_compatible;
 
 static struct plugin_info cyc_complexity_plugin_info = {
         .version        = "20160225",
@@ -49,7 +49,7 @@ static unsigned int cyc_complexity_execute(void)
 
 #include "gcc-generate-gimple-pass.h"
 
-int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
+__visible int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 {
         const char * const plugin_name = plugin_info->base_name;
         struct register_pass_info cyc_complexity_pass_info;
diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
index 172850bcd0d9..950fd2e64bb7 100644
--- a/scripts/gcc-plugins/gcc-common.h
+++ b/scripts/gcc-plugins/gcc-common.h
@@ -130,6 +130,7 @@ extern void dump_gimple_stmt(pretty_printer *, gimple, int, int);
 #endif
 
 #define __unused __attribute__((__unused__))
+#define __visible __attribute__((visibility("default")))
 
 #define DECL_NAME_POINTER(node) IDENTIFIER_POINTER(DECL_NAME(node))
 #define DECL_NAME_LENGTH(node) IDENTIFIER_LENGTH(DECL_NAME(node))
diff --git a/scripts/gcc-plugins/latent_entropy_plugin.c b/scripts/gcc-plugins/latent_entropy_plugin.c
index ff1939b804ae..8160f1c1b56e 100644
--- a/scripts/gcc-plugins/latent_entropy_plugin.c
+++ b/scripts/gcc-plugins/latent_entropy_plugin.c
@@ -77,7 +77,7 @@
 
 #include "gcc-common.h"
 
-int plugin_is_GPL_compatible;
+__visible int plugin_is_GPL_compatible;
 
 static GTY(()) tree latent_entropy_decl;
 
@@ -340,7 +340,7 @@ static enum tree_code get_op(tree *rhs)
                 break;
         }
         if (rhs)
-                *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
+                *rhs = build_int_cstu(long_unsigned_type_node, random_const);
         return op;
 }
 
@@ -372,7 +372,7 @@ static void __perturb_latent_entropy(gimple_stmt_iterator *gsi,
         enum tree_code op;
 
         /* 1. create temporary copy of latent_entropy */
-        temp = create_var(unsigned_intDI_type_node, "tmp_latent_entropy");
+        temp = create_var(long_unsigned_type_node, "temp_latent_entropy");
 
         /* 2. read... */
         add_referenced_var(latent_entropy_decl);
@@ -459,13 +459,13 @@ static void init_local_entropy(basic_block bb, tree local_entropy)
         gsi_insert_before(&gsi, call, GSI_NEW_STMT);
         update_stmt(call);
 
-        udi_frame_addr = fold_convert(unsigned_intDI_type_node, frame_addr);
+        udi_frame_addr = fold_convert(long_unsigned_type_node, frame_addr);
         assign = gimple_build_assign(local_entropy, udi_frame_addr);
         gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
         update_stmt(assign);
 
         /* 3. create temporary copy of latent_entropy */
-        tmp = create_var(unsigned_intDI_type_node, "tmp_latent_entropy");
+        tmp = create_var(long_unsigned_type_node, "temp_latent_entropy");
 
         /* 4. read the global entropy variable into local entropy */
         add_referenced_var(latent_entropy_decl);
@@ -480,7 +480,7 @@ static void init_local_entropy(basic_block bb, tree local_entropy)
         update_stmt(assign);
 
         rand_cst = get_random_const();
-        rand_const = build_int_cstu(unsigned_intDI_type_node, rand_cst);
+        rand_const = build_int_cstu(long_unsigned_type_node, rand_cst);
         op = get_op(NULL);
         assign = create_assign(op, local_entropy, local_entropy, rand_const);
         gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
@@ -529,7 +529,7 @@ static unsigned int latent_entropy_execute(void)
         }
 
         /* 1. create the local entropy variable */
-        local_entropy = create_var(unsigned_intDI_type_node, "local_entropy");
+        local_entropy = create_var(long_unsigned_type_node, "local_entropy");
 
         /* 2. initialize the local entropy variable */
         init_local_entropy(bb, local_entropy);
@@ -561,10 +561,9 @@ static void latent_entropy_start_unit(void *gcc_data __unused,
         if (in_lto_p)
                 return;
 
-        /* extern volatile u64 latent_entropy */
-        gcc_assert(TYPE_PRECISION(long_long_unsigned_type_node) == 64);
-        quals = TYPE_QUALS(long_long_unsigned_type_node) | TYPE_QUAL_VOLATILE;
-        type = build_qualified_type(long_long_unsigned_type_node, quals);
+        /* extern volatile unsigned long latent_entropy */
+        quals = TYPE_QUALS(long_unsigned_type_node) | TYPE_QUAL_VOLATILE;
+        type = build_qualified_type(long_unsigned_type_node, quals);
         id = get_identifier("latent_entropy");
         latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, id, type);
 
@@ -584,8 +583,8 @@ static void latent_entropy_start_unit(void *gcc_data __unused,
         | TODO_update_ssa
 #include "gcc-generate-gimple-pass.h"
 
-int plugin_init(struct plugin_name_args *plugin_info,
-                struct plugin_gcc_version *version)
+__visible int plugin_init(struct plugin_name_args *plugin_info,
+                          struct plugin_gcc_version *version)
 {
         bool enabled = true;
         const char * const plugin_name = plugin_info->base_name;
diff --git a/scripts/gcc-plugins/sancov_plugin.c b/scripts/gcc-plugins/sancov_plugin.c
index aedd6113cb73..7ea0b3f50739 100644
--- a/scripts/gcc-plugins/sancov_plugin.c
+++ b/scripts/gcc-plugins/sancov_plugin.c
@@ -21,7 +21,7 @@
 
 #include "gcc-common.h"
 
-int plugin_is_GPL_compatible;
+__visible int plugin_is_GPL_compatible;
 
 tree sancov_fndecl;
 
@@ -86,7 +86,7 @@ static void sancov_start_unit(void __unused *gcc_data, void __unused *user_data)
 #endif
 }
 
-int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
+__visible int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
 {
         int i;
         struct register_pass_info sancov_plugin_pass_info;
diff --git a/sound/core/info.c b/sound/core/info.c
index 895362a696c9..8ab72e0f5932 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -325,10 +325,15 @@ static ssize_t snd_info_text_entry_write(struct file *file,
         size_t next;
         int err = 0;
 
+        if (!entry->c.text.write)
+                return -EIO;
         pos = *offset;
         if (!valid_pos(pos, count))
                 return -EIO;
         next = pos + count;
+        /* don't handle too large text inputs */
+        if (next > 16 * 1024)
+                return -EIO;
         mutex_lock(&entry->access);
         buf = data->wbuffer;
         if (!buf) {
@@ -366,7 +371,9 @@ static int snd_info_seq_show(struct seq_file *seq, void *p)
         struct snd_info_private_data *data = seq->private;
         struct snd_info_entry *entry = data->entry;
 
-        if (entry->c.text.read) {
+        if (!entry->c.text.read) {
+                return -EIO;
+        } else {
                 data->rbuffer->buffer = (char *)seq; /* XXX hack! */
                 entry->c.text.read(entry, data->rbuffer);
         }
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 18baea2f7d65..84f86745c30e 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -148,11 +148,11 @@ SND_SOC_DAPM_OUTPUT("AOUTR"),
 };
 
 static const struct snd_soc_dapm_route cs4270_dapm_routes[] = {
-        { "Capture", NULL, "AINA" },
-        { "Capture", NULL, "AINB" },
+        { "Capture", NULL, "AINL" },
+        { "Capture", NULL, "AINR" },
 
-        { "AOUTA", NULL, "Playback" },
-        { "AOUTB", NULL, "Playback" },
+        { "AOUTL", NULL, "Playback" },
+        { "AOUTR", NULL, "Playback" },
 };
 
 /**
diff --git a/sound/soc/codecs/da7219.c b/sound/soc/codecs/da7219.c
index 1152aa5e7c39..cf37936bfe3a 100644
--- a/sound/soc/codecs/da7219.c
+++ b/sound/soc/codecs/da7219.c
@@ -880,7 +880,8 @@ static const struct snd_soc_dapm_widget da7219_dapm_widgets[] = {
                             SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
 
         /* DAI */
-        SND_SOC_DAPM_AIF_OUT("DAIOUT", "Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("DAIOUT", "Capture", 0, DA7219_DAI_TDM_CTRL,
+                             DA7219_DAI_OE_SHIFT, DA7219_NO_INVERT),
         SND_SOC_DAPM_AIF_IN("DAIIN", "Playback", 0, SND_SOC_NOPM, 0, 0),
 
         /* Output Muxes */
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index b904492d7744..90b5948e0ff3 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -364,7 +364,12 @@ static int hdmi_of_xlate_dai_name(struct snd_soc_component *component,
                                   struct of_phandle_args *args,
                                   const char **dai_name)
 {
-        int id = args->args[0];
+        int id;
+
+        if (args->args_count)
+                id = args->args[0];
+        else
+                id = 0;
 
         if (id < ARRAY_SIZE(hdmi_dai_name)) {
                 *dai_name = hdmi_dai_name[id];
diff --git a/sound/soc/codecs/rt298.c b/sound/soc/codecs/rt298.c
index 55558643166f..2db8179047ae 100644
--- a/sound/soc/codecs/rt298.c
+++ b/sound/soc/codecs/rt298.c
@@ -249,6 +249,11 @@ static int rt298_jack_detect(struct rt298_priv *rt298, bool *hp, bool *mic)
                         snd_soc_dapm_force_enable_pin(dapm, "LDO1");
                         snd_soc_dapm_sync(dapm);
 
+                        regmap_update_bits(rt298->regmap,
+                                RT298_POWER_CTRL1, 0x1001, 0);
+                        regmap_update_bits(rt298->regmap,
+                                RT298_POWER_CTRL2, 0x4, 0x4);
+
                         regmap_write(rt298->regmap, RT298_SET_MIC1, 0x24);
                         msleep(50);
 
diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
index 01a18d88f1eb..00ff2788879e 100644
--- a/sound/soc/codecs/rt5663.c
+++ b/sound/soc/codecs/rt5663.c
@@ -1547,11 +1547,11 @@ static int rt5663_jack_detect(struct snd_soc_codec *codec, int jack_insert)
                         msleep(sleep_time[i]);
                         val = snd_soc_read(codec, RT5663_EM_JACK_TYPE_2) &
                                 0x0003;
+                        dev_dbg(codec->dev, "%s: MX-00e7 val=%x sleep %d\n",
+                                __func__, val, sleep_time[i]);
                         i++;
                         if (val == 0x1 || val == 0x2 || val == 0x3)
                                 break;
-                        dev_dbg(codec->dev, "%s: MX-00e7 val=%x sleep %d\n",
-                                __func__, val, sleep_time[i]);
                 }
                 dev_dbg(codec->dev, "%s val = %d\n", __func__, val);
                 switch (val) {
diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
index 7b31ee9b82bc..d6e00c77edcd 100644
--- a/sound/soc/codecs/sti-sas.c
+++ b/sound/soc/codecs/sti-sas.c
@@ -424,7 +424,7 @@ static const struct snd_soc_dai_ops stih407_dac_ops = {
 static const struct regmap_config stih407_sas_regmap = {
         .reg_bits = 32,
         .val_bits = 32,
-
+        .fast_io = true,
         .max_register = STIH407_AUDIO_DAC_CTRL,
         .reg_defaults = stih407_sas_reg_defaults,
         .num_reg_defaults = ARRAY_SIZE(stih407_sas_reg_defaults),
diff --git a/sound/soc/codecs/tas571x.c b/sound/soc/codecs/tas571x.c
index df5e5cb33baa..810369f687d7 100644
--- a/sound/soc/codecs/tas571x.c
+++ b/sound/soc/codecs/tas571x.c
@@ -341,20 +341,9 @@ static int tas571x_set_bias_level(struct snd_soc_codec *codec,
                                         return ret;
                                 }
                         }
-
-                        gpiod_set_value(priv->pdn_gpio, 0);
-                        usleep_range(5000, 6000);
-
-                        regcache_cache_only(priv->regmap, false);
-                        ret = regcache_sync(priv->regmap);
-                        if (ret)
-                                return ret;
                 }
                 break;
         case SND_SOC_BIAS_OFF:
-                regcache_cache_only(priv->regmap, true);
-                gpiod_set_value(priv->pdn_gpio, 1);
-
                 if (!IS_ERR(priv->mclk))
                         clk_disable_unprepare(priv->mclk);
                 break;
@@ -401,16 +390,6 @@ static const struct snd_kcontrol_new tas5711_controls[] = {
                    TAS571X_SOFT_MUTE_REG,
                    TAS571X_SOFT_MUTE_CH1_SHIFT, TAS571X_SOFT_MUTE_CH2_SHIFT,
                    1, 1),
-
-        SOC_DOUBLE_R_RANGE("CH1 Mixer Volume",
-                           TAS5717_CH1_LEFT_CH_MIX_REG,
-                           TAS5717_CH1_RIGHT_CH_MIX_REG,
-                           16, 0, 0x80, 0),
-
-        SOC_DOUBLE_R_RANGE("CH2 Mixer Volume",
-                           TAS5717_CH2_LEFT_CH_MIX_REG,
-                           TAS5717_CH2_RIGHT_CH_MIX_REG,
-                           16, 0, 0x80, 0),
 };
 
 static const struct regmap_range tas571x_readonly_regs_range[] = {
@@ -488,6 +467,16 @@ static const struct snd_kcontrol_new tas5717_controls[] = {
                    TAS571X_SOFT_MUTE_CH1_SHIFT, TAS571X_SOFT_MUTE_CH2_SHIFT,
                    1, 1),
 
+        SOC_DOUBLE_R_RANGE("CH1 Mixer Volume",
+                           TAS5717_CH1_LEFT_CH_MIX_REG,
+                           TAS5717_CH1_RIGHT_CH_MIX_REG,
+                           16, 0, 0x80, 0),
+
+        SOC_DOUBLE_R_RANGE("CH2 Mixer Volume",
+                           TAS5717_CH2_LEFT_CH_MIX_REG,
+                           TAS5717_CH2_RIGHT_CH_MIX_REG,
+                           16, 0, 0x80, 0),
+
         /*
          * The biquads are named according to the register names.
          * Please note that TI's TAS57xx Graphical Development Environment
@@ -747,13 +736,14 @@ static int tas571x_i2c_probe(struct i2c_client *client,
                 /* pulse the active low reset line for ~100us */
                 usleep_range(100, 200);
                 gpiod_set_value(priv->reset_gpio, 0);
-                usleep_range(12000, 20000);
+                usleep_range(13500, 20000);
         }
 
         ret = regmap_write(priv->regmap, TAS571X_OSC_TRIM_REG, 0);
         if (ret)
                 return ret;
 
+        usleep_range(50000, 60000);
 
         memcpy(&priv->codec_driver, &tas571x_codec, sizeof(priv->codec_driver));
         priv->codec_driver.component_driver.controls = priv->chip->controls;
@@ -770,9 +760,6 @@ static int tas571x_i2c_probe(struct i2c_client *client,
                         return ret;
         }
 
-        regcache_cache_only(priv->regmap, true);
-        gpiod_set_value(priv->pdn_gpio, 1);
-
         return snd_soc_register_codec(&client->dev, &priv->codec_driver,
                                       &tas571x_dai, 1);
 }
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 26eb5a0a5575..fd5d1e091038 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -47,6 +47,7 @@ config SND_SOC_INTEL_SST_MATCH
 
 config SND_SOC_INTEL_HASWELL
         tristate
+        select SND_SOC_INTEL_SST_FIRMWARE
 
 config SND_SOC_INTEL_BAYTRAIL
         tristate
@@ -56,7 +57,6 @@ config SND_SOC_INTEL_HASWELL_MACH
         depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM
         depends on DW_DMAC_CORE
         select SND_SOC_INTEL_SST
-        select SND_SOC_INTEL_SST_FIRMWARE
         select SND_SOC_INTEL_HASWELL
         select SND_SOC_RT5640
         help
@@ -138,7 +138,6 @@ config SND_SOC_INTEL_BROADWELL_MACH
                    I2C_DESIGNWARE_PLATFORM
         depends on DW_DMAC_CORE
         select SND_SOC_INTEL_SST
-        select SND_SOC_INTEL_SST_FIRMWARE
         select SND_SOC_INTEL_HASWELL
         select SND_SOC_RT286
         help
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index ba5c0d71720a..0a88537ca58a 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -416,6 +416,7 @@ static const struct dmi_system_id cht_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Surface 3"),
                 },
         },
+        { }
 };
 
 
diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
index 6532b8f0ab2f..865a21e557cc 100644
--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -130,8 +130,8 @@ static int broxton_da7219_codec_init(struct snd_soc_pcm_runtime *rtd)
          */
         ret = snd_soc_card_jack_new(rtd->card, "Headset Jack",
                         SND_JACK_HEADSET | SND_JACK_BTN_0 | SND_JACK_BTN_1 |
-                        SND_JACK_BTN_2 | SND_JACK_BTN_3, &broxton_headset,
-                        NULL, 0);
+                        SND_JACK_BTN_2 | SND_JACK_BTN_3 | SND_JACK_LINEOUT,
+                        &broxton_headset, NULL, 0);
         if (ret) {
                 dev_err(rtd->dev, "Headset Jack creation failed: %d\n", ret);
                 return ret;
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 2989c164dafe..06fa5e85dd0e 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -674,7 +674,7 @@ static int skl_probe(struct pci_dev *pci,
 
         if (skl->nhlt == NULL) {
                 err = -ENODEV;
-                goto out_free;
+                goto out_display_power_off;
         }
 
         skl_nhlt_update_topology_bin(skl);
@@ -746,6 +746,9 @@ out_mach_free:
         skl_machine_device_unregister(skl);
 out_nhlt_free:
         skl_nhlt_free(skl->nhlt);
+out_display_power_off:
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+                snd_hdac_display_power(bus, false);
 out_free:
         skl->init_failed = 1;
         skl_free(ebus);
@@ -785,8 +788,7 @@ static void skl_remove(struct pci_dev *pci)
 
         release_firmware(skl->tplg);
 
-        if (pci_dev_run_wake(pci))
-                pm_runtime_get_noresume(&pci->dev);
+        pm_runtime_get_noresume(&pci->dev);
 
         /* codec removal, invoke bus_device_remove */
         snd_hdac_ext_bus_device_remove(ebus);
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index f2bf8661dd21..823b5a236d8d 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -208,7 +208,7 @@ config SND_PXA2XX_SOC_IMOTE2
 
 config SND_MMP_SOC_BROWNSTONE
         tristate "SoC Audio support for Marvell Brownstone"
-        depends on SND_MMP_SOC && MACH_BROWNSTONE
+        depends on SND_MMP_SOC && MACH_BROWNSTONE && I2C
         select SND_MMP_SOC_SSPA
         select MFD_WM8994
         select SND_SOC_WM8994
diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
index 3cde9fb977fa..eff3f9a8b685 100644
--- a/sound/soc/qcom/lpass-cpu.c
+++ b/sound/soc/qcom/lpass-cpu.c
@@ -586,3 +586,6 @@ int asoc_qcom_lpass_cpu_platform_remove(struct platform_device *pdev)
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_qcom_lpass_cpu_platform_remove);
+
+MODULE_DESCRIPTION("QTi LPASS CPU Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index e2ff538a8aa5..b392e51de94d 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -61,7 +61,41 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        int ret;
+        struct snd_soc_dai *cpu_dai = soc_runtime->cpu_dai;
+        struct lpass_data *drvdata =
+                snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_variant *v = drvdata->variant;
+        int ret, dma_ch, dir = substream->stream;
+        struct lpass_pcm_data *data;
+
+        data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        data->i2s_port = cpu_dai->driver->id;
+        runtime->private_data = data;
+
+        dma_ch = 0;
+        if (v->alloc_dma_channel)
+                dma_ch = v->alloc_dma_channel(drvdata, dir);
+        if (dma_ch < 0)
+                return dma_ch;
+
+        drvdata->substream[dma_ch] = substream;
+
+        ret = regmap_write(drvdata->lpaif_map,
+                        LPAIF_DMACTL_REG(v, dma_ch, dir), 0);
+        if (ret) {
+                dev_err(soc_runtime->dev,
+                        "%s() error writing to rdmactl reg: %d\n",
+                        __func__, ret);
+                        return ret;
+        }
+
+        if (dir == SNDRV_PCM_STREAM_PLAYBACK)
+                data->rdma_ch = dma_ch;
+        else
+                data->wrdma_ch = dma_ch;
 
         snd_soc_set_runtime_hwparams(substream, &lpass_platform_pcm_hardware);
 
@@ -80,13 +114,40 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
         return 0;
 }
 
+static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
+        struct lpass_data *drvdata =
+                snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_variant *v = drvdata->variant;
+        struct lpass_pcm_data *data;
+        int dma_ch, dir = substream->stream;
+
+        data = runtime->private_data;
+        v = drvdata->variant;
+
+        if (dir == SNDRV_PCM_STREAM_PLAYBACK)
+                dma_ch = data->rdma_ch;
+        else
+                dma_ch = data->wrdma_ch;
+
+        drvdata->substream[dma_ch] = NULL;
+
+        if (v->free_dma_channel)
+                v->free_dma_channel(drvdata, dma_ch);
+
+        return 0;
+}
+
 static int lpass_platform_pcmops_hw_params(struct snd_pcm_substream *substream,
                 struct snd_pcm_hw_params *params)
 {
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_pcm_data *pcm_data = drvdata->private_data;
+        struct snd_pcm_runtime *rt = substream->runtime;
+        struct lpass_pcm_data *pcm_data = rt->private_data;
         struct lpass_variant *v = drvdata->variant;
         snd_pcm_format_t format = params_format(params);
         unsigned int channels = params_channels(params);
@@ -179,7 +240,8 @@ static int lpass_platform_pcmops_hw_free(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_pcm_data *pcm_data = drvdata->private_data;
+        struct snd_pcm_runtime *rt = substream->runtime;
+        struct lpass_pcm_data *pcm_data = rt->private_data;
         struct lpass_variant *v = drvdata->variant;
         unsigned int reg;
         int ret;
@@ -203,7 +265,8 @@ static int lpass_platform_pcmops_prepare(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_pcm_data *pcm_data = drvdata->private_data;
+        struct snd_pcm_runtime *rt = substream->runtime;
+        struct lpass_pcm_data *pcm_data = rt->private_data;
         struct lpass_variant *v = drvdata->variant;
         int ret, ch, dir = substream->stream;
 
@@ -257,7 +320,8 @@ static int lpass_platform_pcmops_trigger(struct snd_pcm_substream *substream,
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_pcm_data *pcm_data = drvdata->private_data;
+        struct snd_pcm_runtime *rt = substream->runtime;
+        struct lpass_pcm_data *pcm_data = rt->private_data;
         struct lpass_variant *v = drvdata->variant;
         int ret, ch, dir = substream->stream;
 
@@ -333,7 +397,8 @@ static snd_pcm_uframes_t lpass_platform_pcmops_pointer(
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
         struct lpass_data *drvdata =
                         snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_pcm_data *pcm_data = drvdata->private_data;
+        struct snd_pcm_runtime *rt = substream->runtime;
+        struct lpass_pcm_data *pcm_data = rt->private_data;
         struct lpass_variant *v = drvdata->variant;
         unsigned int base_addr, curr_addr;
         int ret, ch, dir = substream->stream;
@@ -374,6 +439,7 @@ static int lpass_platform_pcmops_mmap(struct snd_pcm_substream *substream,
 
 static const struct snd_pcm_ops lpass_platform_pcm_ops = {
         .open           = lpass_platform_pcmops_open,
+        .close          = lpass_platform_pcmops_close,
         .ioctl          = snd_pcm_lib_ioctl,
         .hw_params      = lpass_platform_pcmops_hw_params,
         .hw_free        = lpass_platform_pcmops_hw_free,
@@ -470,117 +536,45 @@ static int lpass_platform_pcm_new(struct snd_soc_pcm_runtime *soc_runtime)
 {
         struct snd_pcm *pcm = soc_runtime->pcm;
         struct snd_pcm_substream *psubstream, *csubstream;
-        struct snd_soc_dai *cpu_dai = soc_runtime->cpu_dai;
-        struct lpass_data *drvdata =
-                snd_soc_platform_get_drvdata(soc_runtime->platform);
-        struct lpass_variant *v = drvdata->variant;
         int ret = -EINVAL;
-        struct lpass_pcm_data *data;
         size_t size = lpass_platform_pcm_hardware.buffer_bytes_max;
 
-        data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->i2s_port = cpu_dai->driver->id;
-        drvdata->private_data = data;
-
         psubstream = pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
         if (psubstream) {
-                if (v->alloc_dma_channel)
-                        data->rdma_ch = v->alloc_dma_channel(drvdata,
-                                                SNDRV_PCM_STREAM_PLAYBACK);
-
-                if (data->rdma_ch < 0)
-                        return data->rdma_ch;
-
-                drvdata->substream[data->rdma_ch] = psubstream;
-
                 ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
                                         soc_runtime->platform->dev,
                                         size, &psubstream->dma_buffer);
-                if (ret)
-                        goto playback_alloc_err;
-
-                ret = regmap_write(drvdata->lpaif_map,
-                        LPAIF_RDMACTL_REG(v, data->rdma_ch), 0);
                 if (ret) {
-                        dev_err(soc_runtime->dev,
-                                "%s() error writing to rdmactl reg: %d\n",
-                                __func__, ret);
-                        goto capture_alloc_err;
+                        dev_err(soc_runtime->dev, "Cannot allocate buffer(s)\n");
+                        return ret;
                 }
         }
 
         csubstream = pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream;
         if (csubstream) {
-                if (v->alloc_dma_channel)
-                        data->wrdma_ch = v->alloc_dma_channel(drvdata,
-                                                SNDRV_PCM_STREAM_CAPTURE);
-
-                if (data->wrdma_ch < 0) {
-                        ret = data->wrdma_ch;
-                        goto capture_alloc_err;
-                }
-
-                drvdata->substream[data->wrdma_ch] = csubstream;
-
                 ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
                                         soc_runtime->platform->dev,
                                         size, &csubstream->dma_buffer);
-                if (ret)
-                        goto capture_alloc_err;
-
-                ret = regmap_write(drvdata->lpaif_map,
-                        LPAIF_WRDMACTL_REG(v, data->wrdma_ch), 0);
                 if (ret) {
-                        dev_err(soc_runtime->dev,
-                                "%s() error writing to wrdmactl reg: %d\n",
-                                __func__, ret);
-                        goto capture_reg_err;
+                        dev_err(soc_runtime->dev, "Cannot allocate buffer(s)\n");
+                        if (psubstream)
+                                snd_dma_free_pages(&psubstream->dma_buffer);
+                        return ret;
                 }
+
         }
 
         return 0;
-
-capture_reg_err:
-        if (csubstream)
-                snd_dma_free_pages(&csubstream->dma_buffer);
-
-capture_alloc_err:
-        if (psubstream)
-                snd_dma_free_pages(&psubstream->dma_buffer);
-
- playback_alloc_err:
-        dev_err(soc_runtime->dev, "Cannot allocate buffer(s)\n");
-
-        return ret;
 }
 
 static void lpass_platform_pcm_free(struct snd_pcm *pcm)
 {
-        struct snd_soc_pcm_runtime *rt;
-        struct lpass_data *drvdata;
-        struct lpass_pcm_data *data;
-        struct lpass_variant *v;
         struct snd_pcm_substream *substream;
-        int ch, i;
+        int i;
 
         for (i = 0; i < ARRAY_SIZE(pcm->streams); i++) {
                 substream = pcm->streams[i].substream;
                 if (substream) {
-                        rt = substream->private_data;
-                        drvdata = snd_soc_platform_get_drvdata(rt->platform);
-                        data = drvdata->private_data;
-
-                        ch = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                                ? data->rdma_ch
-                                : data->wrdma_ch;
-                        v = drvdata->variant;
-                        drvdata->substream[ch] = NULL;
-                        if (v->free_dma_channel)
-                                v->free_dma_channel(drvdata, ch);
-
                         snd_dma_free_pages(&substream->dma_buffer);
                         substream->dma_buffer.area = NULL;
                         substream->dma_buffer.addr = 0;
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index 35b3cea8207d..924971b6ded5 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -59,7 +59,6 @@ struct lpass_data {
         struct clk *pcnoc_mport_clk;
         struct clk *pcnoc_sway_clk;
 
-        void *private_data;
 };
 
 /* Vairant data per each SOC */
diff --git a/sound/soc/samsung/ac97.c b/sound/soc/samsung/ac97.c
index 97d6700b1009..cbc0023c2bc8 100644
--- a/sound/soc/samsung/ac97.c
+++ b/sound/soc/samsung/ac97.c
@@ -383,11 +383,6 @@ static int s3c_ac97_probe(struct platform_device *pdev)
                 goto err4;
         }
 
-        ret = devm_snd_soc_register_component(&pdev->dev, &s3c_ac97_component,
-                                         s3c_ac97_dai, ARRAY_SIZE(s3c_ac97_dai));
-        if (ret)
-                goto err5;
-
         ret = samsung_asoc_dma_platform_register(&pdev->dev,
                                                  ac97_pdata->dma_filter,
                                                  NULL, NULL);
@@ -396,6 +391,11 @@ static int s3c_ac97_probe(struct platform_device *pdev)
                 goto err5;
         }
 
+        ret = devm_snd_soc_register_component(&pdev->dev, &s3c_ac97_component,
+                                         s3c_ac97_dai, ARRAY_SIZE(s3c_ac97_dai));
+        if (ret)
+                goto err5;
+
         return 0;
 err5:
         free_irq(irq_res->start, NULL);
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index 7e32cf4581f8..7825bff45ae3 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -1237,14 +1237,14 @@ static int samsung_i2s_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "Unable to get drvdata\n");
                         return -EFAULT;
                 }
-                ret = devm_snd_soc_register_component(&sec_dai->pdev->dev,
-                                                &samsung_i2s_component,
-                                                &sec_dai->i2s_dai_drv, 1);
+                ret = samsung_asoc_dma_platform_register(&pdev->dev,
+                                        sec_dai->filter, "tx-sec", NULL);
                 if (ret != 0)
                         return ret;
 
-                return samsung_asoc_dma_platform_register(&pdev->dev,
-                                        sec_dai->filter, "tx-sec", NULL);
+                return devm_snd_soc_register_component(&sec_dai->pdev->dev,
+                                                &samsung_i2s_component,
+                                                &sec_dai->i2s_dai_drv, 1);
         }
 
         pri_dai = i2s_alloc_dai(pdev, false);
@@ -1314,6 +1314,11 @@ static int samsung_i2s_probe(struct platform_device *pdev)
         if (quirks & QUIRK_PRI_6CHAN)
                 pri_dai->i2s_dai_drv.playback.channels_max = 6;
 
+        ret = samsung_asoc_dma_platform_register(&pdev->dev, pri_dai->filter,
+                                                 NULL, NULL);
+        if (ret < 0)
+                goto err_disable_clk;
+
         if (quirks & QUIRK_SEC_DAI) {
                 sec_dai = i2s_alloc_dai(pdev, true);
                 if (!sec_dai) {
@@ -1353,10 +1358,6 @@ static int samsung_i2s_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err_free_dai;
 
-        ret = samsung_asoc_dma_platform_register(&pdev->dev, pri_dai->filter,
-                                                 NULL, NULL);
-        if (ret < 0)
-                goto err_free_dai;
 
         pm_runtime_enable(&pdev->dev);
 
diff --git a/sound/soc/samsung/pcm.c b/sound/soc/samsung/pcm.c
index 43e367a9acc3..c484985812ed 100644
--- a/sound/soc/samsung/pcm.c
+++ b/sound/soc/samsung/pcm.c
@@ -565,24 +565,25 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
         pcm->dma_capture = &s3c_pcm_stereo_in[pdev->id];
         pcm->dma_playback = &s3c_pcm_stereo_out[pdev->id];
 
+        ret = samsung_asoc_dma_platform_register(&pdev->dev, filter,
+                                                 NULL, NULL);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to get register DMA: %d\n", ret);
+                goto err5;
+        }
+
         pm_runtime_enable(&pdev->dev);
 
         ret = devm_snd_soc_register_component(&pdev->dev, &s3c_pcm_component,
                                          &s3c_pcm_dai[pdev->id], 1);
         if (ret != 0) {
                 dev_err(&pdev->dev, "failed to get register DAI: %d\n", ret);
-                goto err5;
-        }
-
-        ret = samsung_asoc_dma_platform_register(&pdev->dev, filter,
-                                                 NULL, NULL);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to get register DMA: %d\n", ret);
-                goto err5;
+                goto err6;
         }
 
         return 0;
-
+err6:
+        pm_runtime_disable(&pdev->dev);
 err5:
         clk_disable_unprepare(pcm->pclk);
 err4:
diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
index 3e89fbc0c51d..0a4718207e6e 100644
--- a/sound/soc/samsung/s3c2412-i2s.c
+++ b/sound/soc/samsung/s3c2412-i2s.c
@@ -168,19 +168,19 @@ static int s3c2412_iis_dev_probe(struct platform_device *pdev)
         s3c2412_i2s_pcm_stereo_in.addr = res->start + S3C2412_IISRXD;
         s3c2412_i2s_pcm_stereo_in.filter_data = pdata->dma_capture;
 
-        ret = s3c_i2sv2_register_component(&pdev->dev, -1,
-                                           &s3c2412_i2s_component,
-                                           &s3c2412_i2s_dai);
+        ret = samsung_asoc_dma_platform_register(&pdev->dev,
+                                                 pdata->dma_filter,
+                                                 NULL, NULL);
         if (ret) {
-                pr_err("failed to register the dai\n");
+                pr_err("failed to register the DMA: %d\n", ret);
                 return ret;
         }
 
-        ret = samsung_asoc_dma_platform_register(&pdev->dev,
-                                                 pdata->dma_filter,
-                                                 NULL, NULL);
+        ret = s3c_i2sv2_register_component(&pdev->dev, -1,
+                                           &s3c2412_i2s_component,
+                                           &s3c2412_i2s_dai);
         if (ret)
-                pr_err("failed to register the DMA: %d\n", ret);
+                pr_err("failed to register the dai\n");
 
         return ret;
 }
diff --git a/sound/soc/samsung/s3c24xx-i2s.c b/sound/soc/samsung/s3c24xx-i2s.c
index c78a936a3099..9052f6a7073e 100644
--- a/sound/soc/samsung/s3c24xx-i2s.c
+++ b/sound/soc/samsung/s3c24xx-i2s.c
@@ -474,18 +474,18 @@ static int s3c24xx_iis_dev_probe(struct platform_device *pdev)
         s3c24xx_i2s_pcm_stereo_in.addr = res->start + S3C2410_IISFIFO;
         s3c24xx_i2s_pcm_stereo_in.filter_data = pdata->dma_capture;
 
-        ret = devm_snd_soc_register_component(&pdev->dev,
-                        &s3c24xx_i2s_component, &s3c24xx_i2s_dai, 1);
+        ret = samsung_asoc_dma_platform_register(&pdev->dev,
+                                                 pdata->dma_filter,
+                                                 NULL, NULL);
         if (ret) {
-                pr_err("failed to register the dai\n");
+                pr_err("failed to register the dma: %d\n", ret);
                 return ret;
         }
 
-        ret = samsung_asoc_dma_platform_register(&pdev->dev,
-                                                 pdata->dma_filter,
-                                                 NULL, NULL);
+        ret = devm_snd_soc_register_component(&pdev->dev,
+                        &s3c24xx_i2s_component, &s3c24xx_i2s_dai, 1);
         if (ret)
-                pr_err("failed to register the dma: %d\n", ret);
+                pr_err("failed to register the dai\n");
 
         return ret;
 }
diff --git a/sound/soc/samsung/spdif.c b/sound/soc/samsung/spdif.c
index 26c1fbed4d35..779504f54bc0 100644
--- a/sound/soc/samsung/spdif.c
+++ b/sound/soc/samsung/spdif.c
@@ -416,15 +416,6 @@ static int spdif_probe(struct platform_device *pdev)
                 goto err3;
         }
 
-        dev_set_drvdata(&pdev->dev, spdif);
-
-        ret = devm_snd_soc_register_component(&pdev->dev,
-                        &samsung_spdif_component, &samsung_spdif_dai, 1);
-        if (ret != 0) {
-                dev_err(&pdev->dev, "fail to register dai\n");
-                goto err4;
-        }
-
         spdif_stereo_out.addr_width = 2;
         spdif_stereo_out.addr = mem_res->start + DATA_OUTBUF;
         filter = NULL;
@@ -432,7 +423,6 @@ static int spdif_probe(struct platform_device *pdev)
                 spdif_stereo_out.filter_data = spdif_pdata->dma_playback;
                 filter = spdif_pdata->dma_filter;
         }
-
         spdif->dma_playback = &spdif_stereo_out;
 
         ret = samsung_asoc_dma_platform_register(&pdev->dev, filter,
@@ -442,6 +432,15 @@ static int spdif_probe(struct platform_device *pdev)
                 goto err4;
         }
 
+        dev_set_drvdata(&pdev->dev, spdif);
+
+        ret = devm_snd_soc_register_component(&pdev->dev,
+                        &samsung_spdif_component, &samsung_spdif_dai, 1);
+        if (ret != 0) {
+                dev_err(&pdev->dev, "fail to register dai\n");
+                goto err4;
+        }
+
         return 0;
 err4:
         iounmap(spdif->regs);
diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
index 1bc8ebc2528e..ad54d4cf58ad 100644
--- a/sound/soc/sti/uniperif_player.c
+++ b/sound/soc/sti/uniperif_player.c
@@ -614,7 +614,11 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
         iec958->status[3] = ucontrol->value.iec958.status[3];
         mutex_unlock(&player->ctrl_lock);
 
-        uni_player_set_channel_status(player, NULL);
+        if (player->substream && player->substream->runtime)
+                uni_player_set_channel_status(player,
+                                              player->substream->runtime);
+        else
+                uni_player_set_channel_status(player, NULL);
 
         return 0;
 }
diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
index e047ec06d538..56ed9472e89f 100644
--- a/sound/soc/sunxi/sun4i-codec.c
+++ b/sound/soc/sunxi/sun4i-codec.c
@@ -765,11 +765,11 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev)
 
         card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL);
         if (!card)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         card->dai_link = sun4i_codec_create_link(dev, &card->num_links);
         if (!card->dai_link)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         card->dev               = dev;
         card->name              = "sun4i-codec";
@@ -829,12 +829,6 @@ static int sun4i_codec_probe(struct platform_device *pdev)
                 return PTR_ERR(scodec->clk_module);
         }
 
-        /* Enable the bus clock */
-        if (clk_prepare_enable(scodec->clk_apb)) {
-                dev_err(&pdev->dev, "Failed to enable the APB clock\n");
-                return -EINVAL;
-        }
-
         scodec->gpio_pa = devm_gpiod_get_optional(&pdev->dev, "allwinner,pa",
                                                   GPIOD_OUT_LOW);
         if (IS_ERR(scodec->gpio_pa)) {
@@ -844,6 +838,12 @@ static int sun4i_codec_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        /* Enable the bus clock */
+        if (clk_prepare_enable(scodec->clk_apb)) {
+                dev_err(&pdev->dev, "Failed to enable the APB clock\n");
+                return -EINVAL;
+        }
+
         /* DMA configuration for TX FIFO */
         scodec->playback_dma_data.addr = res->start + SUN4I_CODEC_DAC_TXDATA;
         scodec->playback_dma_data.maxburst = 4;
@@ -876,7 +876,8 @@ static int sun4i_codec_probe(struct platform_device *pdev)
         }
 
         card = sun4i_codec_create_card(&pdev->dev);
-        if (!card) {
+        if (IS_ERR(card)) {
+                ret = PTR_ERR(card);
                 dev_err(&pdev->dev, "Failed to create our card\n");
                 goto err_unregister_codec;
         }
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 4ffff7be9299..a53fef0c673b 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1337,8 +1337,8 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 }
 
                 if (first) {
-                        ui_browser__printf(&browser->b, "%c", folded_sign);
-                        width--;
+                        ui_browser__printf(&browser->b, "%c ", folded_sign);
+                        width -= 2;
                         first = false;
                 } else {
                         ui_browser__printf(&browser->b, "  ");
@@ -1361,8 +1361,10 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 width -= hpp.buf - s;
         }
 
-        ui_browser__write_nstring(&browser->b, "", hierarchy_indent);
-        width -= hierarchy_indent;
+        if (!first) {
+                ui_browser__write_nstring(&browser->b, "", hierarchy_indent);
+                width -= hierarchy_indent;
+        }
 
         if (column >= browser->b.horiz_scroll) {
                 char s[2048];
@@ -1381,7 +1383,13 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 }
 
                 perf_hpp_list__for_each_format(entry->hpp_list, fmt) {
-                        ui_browser__write_nstring(&browser->b, "", 2);
+                        if (first) {
+                                ui_browser__printf(&browser->b, "%c ", folded_sign);
+                                first = false;
+                        } else {
+                                ui_browser__write_nstring(&browser->b, "", 2);
+                        }
+
                         width -= 2;
 
                         /*
@@ -1555,10 +1563,11 @@ static int hists_browser__scnprintf_hierarchy_headers(struct hist_browser *brows
         int indent = hists->nr_hpp_node - 2;
         bool first_node, first_col;
 
-        ret = scnprintf(buf, size, " ");
+        ret = scnprintf(buf, size, "  ");
         if (advance_hpp_check(&dummy_hpp, ret))
                 return ret;
 
+        first_node = true;
         /* the first hpp_list_node is for overhead columns */
         fmt_node = list_first_entry(&hists->hpp_formats,
                                     struct perf_hpp_list_node, list);
@@ -1573,12 +1582,16 @@ static int hists_browser__scnprintf_hierarchy_headers(struct hist_browser *brows
                 ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "  ");
                 if (advance_hpp_check(&dummy_hpp, ret))
                         break;
+
+                first_node = false;
         }
 
-        ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "%*s",
-                        indent * HIERARCHY_INDENT, "");
-        if (advance_hpp_check(&dummy_hpp, ret))
-                return ret;
+        if (!first_node) {
+                ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "%*s",
+                                indent * HIERARCHY_INDENT, "");
+                if (advance_hpp_check(&dummy_hpp, ret))
+                        return ret;
+        }
 
         first_node = true;
         list_for_each_entry_continue(fmt_node, &hists->hpp_formats, list) {
@@ -2076,8 +2089,21 @@ void hist_browser__init(struct hist_browser *browser,
         browser->b.use_navkeypressed    = true;
         browser->show_headers           = symbol_conf.show_hist_headers;
 
-        hists__for_each_format(hists, fmt)
+        if (symbol_conf.report_hierarchy) {
+                struct perf_hpp_list_node *fmt_node;
+
+                /* count overhead columns (in the first node) */
+                fmt_node = list_first_entry(&hists->hpp_formats,
+                                            struct perf_hpp_list_node, list);
+                perf_hpp_list__for_each_format(&fmt_node->hpp, fmt)
+                        ++browser->b.columns;
+
+                /* add a single column for whole hierarchy sort keys*/
                 ++browser->b.columns;
+        } else {
+                hists__for_each_format(hists, fmt)
+                        ++browser->b.columns;
+        }
 
         hists__reset_column_width(hists);
 }
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index b02992efb513..a69f027368ef 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1600,18 +1600,18 @@ static void hists__hierarchy_output_resort(struct hists *hists,
                 if (prog)
                         ui_progress__update(prog, 1);
 
+                hists->nr_entries++;
+                if (!he->filtered) {
+                        hists->nr_non_filtered_entries++;
+                        hists__calc_col_len(hists, he);
+                }
+
                 if (!he->leaf) {
                         hists__hierarchy_output_resort(hists, prog,
                                                        &he->hroot_in,
                                                        &he->hroot_out,
                                                        min_callchain_hits,
                                                        use_callchain);
-                        hists->nr_entries++;
-                        if (!he->filtered) {
-                                hists->nr_non_filtered_entries++;
-                                hists__calc_col_len(hists, he);
-                        }
-
                         continue;
                 }
 
diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
index b4bf76971dc9..1eef0aed6423 100644
--- a/tools/power/cpupower/utils/cpufreq-set.c
+++ b/tools/power/cpupower/utils/cpufreq-set.c
@@ -296,7 +296,7 @@ int cmd_freq_set(int argc, char **argv)
                         struct cpufreq_affected_cpus *cpus;
 
                         if (!bitmask_isbitset(cpus_chosen, cpu) ||
-                            cpupower_is_cpu_online(cpu))
+                            cpupower_is_cpu_online(cpu) != 1)
                                 continue;
 
                         cpus = cpufreq_get_related_cpus(cpu);
@@ -316,10 +316,7 @@ int cmd_freq_set(int argc, char **argv)
              cpu <= bitmask_last(cpus_chosen); cpu++) {
 
                 if (!bitmask_isbitset(cpus_chosen, cpu) ||
-                    cpupower_is_cpu_online(cpu))
-                        continue;
-
-                if (cpupower_is_cpu_online(cpu) != 1)
+                    cpupower_is_cpu_online(cpu) != 1)
                         continue;
 
                 printf(_("Setting cpu: %d\n"), cpu);
diff --git a/tools/virtio/ringtest/Makefile b/tools/virtio/ringtest/Makefile
index 877a8a4721b6..c012edbdb13b 100644
--- a/tools/virtio/ringtest/Makefile
+++ b/tools/virtio/ringtest/Makefile
@@ -3,8 +3,8 @@ all:
 all: ring virtio_ring_0_9 virtio_ring_poll virtio_ring_inorder ptr_ring noring
 
 CFLAGS += -Wall
-CFLAGS += -pthread -O2 -ggdb
-LDFLAGS += -pthread -O2 -ggdb
+CFLAGS += -pthread -O2 -ggdb -flto -fwhole-program
+LDFLAGS += -pthread -O2 -ggdb -flto -fwhole-program
 
 main.o: main.c main.h
 ring.o: ring.c main.h
diff --git a/tools/virtio/ringtest/main.c b/tools/virtio/ringtest/main.c
index 147abb452a6c..f31353fac541 100644
--- a/tools/virtio/ringtest/main.c
+++ b/tools/virtio/ringtest/main.c
@@ -96,7 +96,13 @@ void set_affinity(const char *arg)
         assert(!ret);
 }
 
-static void run_guest(void)
+void poll_used(void)
+{
+        while (used_empty())
+                busy_wait();
+}
+
+static void __attribute__((__flatten__)) run_guest(void)
 {
         int completed_before;
         int completed = 0;
@@ -141,7 +147,7 @@ static void run_guest(void)
                 assert(completed <= bufs);
                 assert(started <= bufs);
                 if (do_sleep) {
-                        if (enable_call())
+                        if (used_empty() && enable_call())
                                 wait_for_call();
                 } else {
                         poll_used();
@@ -149,7 +155,13 @@ static void run_guest(void)
         }
 }
 
-static void run_host(void)
+void poll_avail(void)
+{
+        while (avail_empty())
+                busy_wait();
+}
+
+static void __attribute__((__flatten__)) run_host(void)
 {
         int completed_before;
         int completed = 0;
@@ -160,7 +172,7 @@ static void run_host(void)
 
         for (;;) {
                 if (do_sleep) {
-                        if (enable_kick())
+                        if (avail_empty() && enable_kick())
                                 wait_for_kick();
                 } else {
                         poll_avail();
diff --git a/tools/virtio/ringtest/main.h b/tools/virtio/ringtest/main.h
index 16917acb0ade..34e63cc4c572 100644
--- a/tools/virtio/ringtest/main.h
+++ b/tools/virtio/ringtest/main.h
@@ -56,15 +56,15 @@ void alloc_ring(void);
 int add_inbuf(unsigned, void *, void *);
 void *get_buf(unsigned *, void **);
 void disable_call();
+bool used_empty();
 bool enable_call();
 void kick_available();
-void poll_used();
 /* host side */
 void disable_kick();
+bool avail_empty();
 bool enable_kick();
 bool use_buf(unsigned *, void **);
 void call_used();
-void poll_avail();
 
 /* implemented by main */
 extern bool do_sleep;
diff --git a/tools/virtio/ringtest/noring.c b/tools/virtio/ringtest/noring.c
index eda2f4824130..b8d1c1daac7c 100644
--- a/tools/virtio/ringtest/noring.c
+++ b/tools/virtio/ringtest/noring.c
@@ -24,8 +24,9 @@ void *get_buf(unsigned *lenp, void **bufp)
         return "Buffer";
 }
 
-void poll_used(void)
+bool used_empty()
 {
+        return false;
 }
 
 void disable_call()
@@ -54,8 +55,9 @@ bool enable_kick()
         assert(0);
 }
 
-void poll_avail(void)
+bool avail_empty()
 {
+        return false;
 }
 
 bool use_buf(unsigned *lenp, void **bufp)
diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c
index bd2ad1d3b7a9..635b07b4fdd3 100644
--- a/tools/virtio/ringtest/ptr_ring.c
+++ b/tools/virtio/ringtest/ptr_ring.c
@@ -133,18 +133,9 @@ void *get_buf(unsigned *lenp, void **bufp)
         return datap;
 }
 
-void poll_used(void)
+bool used_empty()
 {
-        void *b;
-
-        do {
-                if (tailcnt == headcnt || __ptr_ring_full(&array)) {
-                        b = NULL;
-                        barrier();
-                } else {
-                        b = "Buffer\n";
-                }
-        } while (!b);
+        return (tailcnt == headcnt || __ptr_ring_full(&array));
 }
 
 void disable_call()
@@ -173,14 +164,9 @@ bool enable_kick()
         assert(0);
 }
 
-void poll_avail(void)
+bool avail_empty()
 {
-        void *b;
-
-        do {
-                barrier();
-                b = __ptr_ring_peek(&array);
-        } while (!b);
+        return !__ptr_ring_peek(&array);
 }
 
 bool use_buf(unsigned *lenp, void **bufp)
diff --git a/tools/virtio/ringtest/ring.c b/tools/virtio/ringtest/ring.c
index c25c8d248b6b..747c5dd47be8 100644
--- a/tools/virtio/ringtest/ring.c
+++ b/tools/virtio/ringtest/ring.c
@@ -163,12 +163,11 @@ void *get_buf(unsigned *lenp, void **bufp)
         return datap;
 }
 
-void poll_used(void)
+bool used_empty()
 {
         unsigned head = (ring_size - 1) & guest.last_used_idx;
 
-        while (ring[head].flags & DESC_HW)
-                busy_wait();
+        return (ring[head].flags & DESC_HW);
 }
 
 void disable_call()
@@ -180,13 +179,11 @@ void disable_call()
 
 bool enable_call()
 {
-        unsigned head = (ring_size - 1) & guest.last_used_idx;
-
         event->call_index = guest.last_used_idx;
         /* Flush call index write */
         /* Barrier D (for pairing) */
         smp_mb();
-        return ring[head].flags & DESC_HW;
+        return used_empty();
 }
 
 void kick_available(void)
@@ -213,20 +210,17 @@ void disable_kick()
 
 bool enable_kick()
 {
-        unsigned head = (ring_size - 1) & host.used_idx;
-
         event->kick_index = host.used_idx;
         /* Barrier C (for pairing) */
         smp_mb();
-        return !(ring[head].flags & DESC_HW);
+        return avail_empty();
 }
 
-void poll_avail(void)
+bool avail_empty()
 {
         unsigned head = (ring_size - 1) & host.used_idx;
 
-        while (!(ring[head].flags & DESC_HW))
-                busy_wait();
+        return !(ring[head].flags & DESC_HW);
 }
 
 bool use_buf(unsigned *lenp, void **bufp)
diff --git a/tools/virtio/ringtest/virtio_ring_0_9.c b/tools/virtio/ringtest/virtio_ring_0_9.c
index 761866212aac..bbc3043b2fb1 100644
--- a/tools/virtio/ringtest/virtio_ring_0_9.c
+++ b/tools/virtio/ringtest/virtio_ring_0_9.c
@@ -194,24 +194,16 @@ void *get_buf(unsigned *lenp, void **bufp)
         return datap;
 }
 
-void poll_used(void)
+bool used_empty()
 {
+        unsigned short last_used_idx = guest.last_used_idx;
 #ifdef RING_POLL
-        unsigned head = (ring_size - 1) & guest.last_used_idx;
+        unsigned short head = last_used_idx & (ring_size - 1);
+        unsigned index = ring.used->ring[head].id;
 
-        for (;;) {
-                unsigned index = ring.used->ring[head].id;
-
-                if ((index ^ guest.last_used_idx ^ 0x8000) & ~(ring_size - 1))
-                        busy_wait();
-                else
-                        break;
-        }
+        return (index ^ last_used_idx ^ 0x8000) & ~(ring_size - 1);
 #else
-        unsigned head = guest.last_used_idx;
-
-        while (ring.used->idx == head)
-                busy_wait();
+        return ring.used->idx == last_used_idx;
 #endif
 }
 
@@ -224,22 +216,11 @@ void disable_call()
 
 bool enable_call()
 {
-        unsigned short last_used_idx;
-
-        vring_used_event(&ring) = (last_used_idx = guest.last_used_idx);
+        vring_used_event(&ring) = guest.last_used_idx;
         /* Flush call index write */
         /* Barrier D (for pairing) */
         smp_mb();
-#ifdef RING_POLL
-        {
-                unsigned short head = last_used_idx & (ring_size - 1);
-                unsigned index = ring.used->ring[head].id;
-
-                return (index ^ last_used_idx ^ 0x8000) & ~(ring_size - 1);
-        }
-#else
-        return ring.used->idx == last_used_idx;
-#endif
+        return used_empty();
 }
 
 void kick_available(void)
@@ -266,36 +247,21 @@ void disable_kick()
 
 bool enable_kick()
 {
-        unsigned head = host.used_idx;
-
-        vring_avail_event(&ring) = head;
+        vring_avail_event(&ring) = host.used_idx;
         /* Barrier C (for pairing) */
         smp_mb();
-#ifdef RING_POLL
-        {
-                unsigned index = ring.avail->ring[head & (ring_size - 1)];
-
-                return (index ^ head ^ 0x8000) & ~(ring_size - 1);
-        }
-#else
-        return head == ring.avail->idx;
-#endif
+        return avail_empty();
 }
 
-void poll_avail(void)
+bool avail_empty()
 {
         unsigned head = host.used_idx;
 #ifdef RING_POLL
-        for (;;) {
-                unsigned index = ring.avail->ring[head & (ring_size - 1)];
-                if ((index ^ head ^ 0x8000) & ~(ring_size - 1))
-                        busy_wait();
-                else
-                        break;
-        }
+        unsigned index = ring.avail->ring[head & (ring_size - 1)];
+
+        return ((index ^ head ^ 0x8000) & ~(ring_size - 1));
 #else
-        while (ring.avail->idx == head)
-                busy_wait();
+        return head == ring.avail->idx;
 #endif
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index e18b30ddcdce..ebe1b9fa3c4d 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -453,17 +453,33 @@ struct vgic_io_device *kvm_to_vgic_iodev(const struct kvm_io_device *dev)
         return container_of(dev, struct vgic_io_device, dev);
 }
 
-static bool check_region(const struct vgic_register_region *region,
+static bool check_region(const struct kvm *kvm,
+                         const struct vgic_register_region *region,
                          gpa_t addr, int len)
 {
-        if ((region->access_flags & VGIC_ACCESS_8bit) && len == 1)
-                return true;
-        if ((region->access_flags & VGIC_ACCESS_32bit) &&
-            len == sizeof(u32) && !(addr & 3))
-                return true;
-        if ((region->access_flags & VGIC_ACCESS_64bit) &&
-            len == sizeof(u64) && !(addr & 7))
-                return true;
+        int flags, nr_irqs = kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS;
+
+        switch (len) {
+        case sizeof(u8):
+                flags = VGIC_ACCESS_8bit;
+                break;
+        case sizeof(u32):
+                flags = VGIC_ACCESS_32bit;
+                break;
+        case sizeof(u64):
+                flags = VGIC_ACCESS_64bit;
+                break;
+        default:
+                return false;
+        }
+
+        if ((region->access_flags & flags) && IS_ALIGNED(addr, len)) {
+                if (!region->bits_per_irq)
+                        return true;
+
+                /* Do we access a non-allocated IRQ? */
+                return VGIC_ADDR_TO_INTID(addr, region->bits_per_irq) < nr_irqs;
+        }
 
         return false;
 }
@@ -477,7 +493,7 @@ static int dispatch_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
 
         region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
                                        addr - iodev->base_addr);
-        if (!region || !check_region(region, addr, len)) {
+        if (!region || !check_region(vcpu->kvm, region, addr, len)) {
                 memset(val, 0, len);
                 return 0;
         }
@@ -510,10 +526,7 @@ static int dispatch_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *dev,
 
         region = vgic_find_mmio_region(iodev->regions, iodev->nr_regions,
                                        addr - iodev->base_addr);
-        if (!region)
-                return 0;
-
-        if (!check_region(region, addr, len))
+        if (!region || !check_region(vcpu->kvm, region, addr, len))
                 return 0;
 
         switch (iodev->iodev_type) {
diff --git a/virt/kvm/arm/vgic/vgic-mmio.h b/virt/kvm/arm/vgic/vgic-mmio.h
index 4c34d39d44a0..84961b4e4422 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.h
+++ b/virt/kvm/arm/vgic/vgic-mmio.h
@@ -50,15 +50,15 @@ extern struct kvm_io_device_ops kvm_io_gic_ops;
 #define VGIC_ADDR_IRQ_MASK(bits) (((bits) * 1024 / 8) - 1)
 
 /*
- * (addr & mask) gives us the byte offset for the INT ID, so we want to
- * divide this with 'bytes per irq' to get the INT ID, which is given
- * by '(bits) / 8'.  But we do this with fixed-point-arithmetic and
- * take advantage of the fact that division by a fraction equals
- * multiplication with the inverted fraction, and scale up both the
- * numerator and denominator with 8 to support at most 64 bits per IRQ:
+ * (addr & mask) gives us the _byte_ offset for the INT ID.
+ * We multiply this by 8 the get the _bit_ offset, then divide this by
+ * the number of bits to learn the actual INT ID.
+ * But instead of a division (which requires a "long long div" implementation),
+ * we shift by the binary logarithm of <bits>.
+ * This assumes that <bits> is a power of two.
  */
 #define VGIC_ADDR_TO_INTID(addr, bits)  (((addr) & VGIC_ADDR_IRQ_MASK(bits)) * \
-                                        64 / (bits) / 8)
+                                        8 >> ilog2(bits))
 
 /*
  * Some VGIC registers store per-IRQ information, with a different number
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 2893d5ba523a..6440b56ec90e 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -273,6 +273,18 @@ retry:
                  * no more work for us to do.
                  */
                 spin_unlock(&irq->irq_lock);
+
+                /*
+                 * We have to kick the VCPU here, because we could be
+                 * queueing an edge-triggered interrupt for which we
+                 * get no EOI maintenance interrupt. In that case,
+                 * while the IRQ is already on the VCPU's AP list, the
+                 * VCPU could have EOI'ed the original interrupt and
+                 * won't see this one until it exits for some other
+                 * reason.
+                 */
+                if (vcpu)
+                        kvm_vcpu_kick(vcpu);
                 return false;
         }
 
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index f397e9b20370..a29786dd9522 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -42,6 +42,7 @@
 
 #ifdef CONFIG_HAVE_KVM_IRQFD
 
+static struct workqueue_struct *irqfd_cleanup_wq;
 
 static void
 irqfd_inject(struct work_struct *work)
@@ -167,7 +168,7 @@ irqfd_deactivate(struct kvm_kernel_irqfd *irqfd)
 
         list_del_init(&irqfd->list);
 
-        schedule_work(&irqfd->shutdown);
+        queue_work(irqfd_cleanup_wq, &irqfd->shutdown);
 }
 
 int __attribute__((weak)) kvm_arch_set_irq_inatomic(
@@ -554,7 +555,7 @@ kvm_irqfd_deassign(struct kvm *kvm, struct kvm_irqfd *args)
          * so that we guarantee there will not be any more interrupts on this
          * gsi once this deassign function returns.
          */
-        flush_work(&irqfd->shutdown);
+        flush_workqueue(irqfd_cleanup_wq);
 
         return 0;
 }
@@ -591,7 +592,7 @@ kvm_irqfd_release(struct kvm *kvm)
          * Block until we know all outstanding shutdown jobs have completed
          * since we do not take a kvm* reference.
          */
-        flush_work(&irqfd->shutdown);
+        flush_workqueue(irqfd_cleanup_wq);
 
 }
 
@@ -621,8 +622,23 @@ void kvm_irq_routing_update(struct kvm *kvm)
         spin_unlock_irq(&kvm->irqfds.lock);
 }
 
+/*
+ * create a host-wide workqueue for issuing deferred shutdown requests
+ * aggregated from all vm* instances. We need our own isolated
+ * queue to ease flushing work items when a VM exits.
+ */
+int kvm_irqfd_init(void)
+{
+        irqfd_cleanup_wq = alloc_workqueue("kvm-irqfd-cleanup", 0, 0);
+        if (!irqfd_cleanup_wq)
+                return -ENOMEM;
+
+        return 0;
+}
+
 void kvm_irqfd_exit(void)
 {
+        destroy_workqueue(irqfd_cleanup_wq);
 }
 #endif
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 2907b7b78654..5c360347a1e9 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3844,7 +3844,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
          * kvm_arch_init makes sure there's at most one caller
          * for architectures that support multiple implementations,
          * like intel and amd on x86.
+         * kvm_arch_init must be called before kvm_irqfd_init to avoid creating
+         * conflicts in case kvm is already setup for another implementation.
          */
+        r = kvm_irqfd_init();
+        if (r)
+                goto out_irqfd;
 
         if (!zalloc_cpumask_var(&cpus_hardware_enabled, GFP_KERNEL)) {
                 r = -ENOMEM;
@@ -3926,6 +3931,7 @@ out_free_0a:
         free_cpumask_var(cpus_hardware_enabled);
 out_free_0:
         kvm_irqfd_exit();
+out_irqfd:
         kvm_arch_exit();
 out_fail:
         return r;