Merge branch 'from-rusty/modules-next' into for-4.5/core

As agreed with Rusty, we're taking a current module-next pile through
livepatching.git, as it contains solely patches that are pre-requisity
for module page protection cleanups in livepatching. Rusty will be
restarting module-next from scratch.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>

271 files changed, 3794 insertions, 2213 deletions

diff --git a/Documentation/IPMI.txt b/Documentation/IPMI.txt
index 31d1d658827f..c0d8788e75d3 100644
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -587,7 +587,7 @@ used to control it:
 
   modprobe ipmi_watchdog timeout=<t> pretimeout=<t> action=<action type>
       preaction=<preaction type> preop=<preop type> start_now=x
-      nowayout=x ifnum_to_use=n
+      nowayout=x ifnum_to_use=n panic_wdt_timeout=<t>
 
 ifnum_to_use specifies which interface the watchdog timer should use.
 The default is -1, which means to pick the first one registered.
@@ -597,7 +597,9 @@ is the amount of seconds before the reset that the pre-timeout panic will
 occur (if pretimeout is zero, then pretimeout will not be enabled).  Note
 that the pretimeout is the time before the final timeout.  So if the
 timeout is 50 seconds and the pretimeout is 10 seconds, then the pretimeout
-will occur in 40 second (10 seconds before the timeout).
+will occur in 40 second (10 seconds before the timeout). The panic_wdt_timeout
+is the value of timeout which is set on kernel panic, in order to let actions
+such as kdump to occur during panic.
 
 The action may be "reset", "power_cycle", or "power_off", and
 specifies what to do when the timer times out, and defaults to
@@ -634,6 +636,7 @@ for configuring the watchdog:
         ipmi_watchdog.preop=<preop type>
         ipmi_watchdog.start_now=x
         ipmi_watchdog.nowayout=x
+        ipmi_watchdog.panic_wdt_timeout=<t>
 
 The options are the same as the module parameter options.
 
diff --git a/Documentation/block/null_blk.txt b/Documentation/block/null_blk.txt
index 2f6c6ff7161d..d8880ca30af4 100644
--- a/Documentation/block/null_blk.txt
+++ b/Documentation/block/null_blk.txt
@@ -70,3 +70,6 @@ use_per_node_hctx=[0/1]: Default: 0
      parameter.
   1: The multi-queue block layer is instantiated with a hardware dispatch
      queue for each CPU node in the system.
+
+use_lightnvm=[0/1]: Default: 0
+  Register device with LightNVM. Requires blk-mq to be used.
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 6a4b1af724f8..1bba38dd2637 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -32,6 +32,7 @@ Supported adapters:
   * Intel Sunrise Point-LP (PCH)
   * Intel DNV (SOC)
   * Intel Broxton (SOC)
+  * Intel Lewisburg (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index f8aae632f02f..742f69d18fc8 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1583,9 +1583,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 hwp_only
                         Only load intel_pstate on systems which support
                         hardware P state control (HWP) if available.
-                no_acpi
-                        Don't use ACPI processor performance control objects
-                        _PSS and _PPC specified limits.
 
         intremap=       [X86-64, Intel-IOMMU]
                         on      enable Interrupt Remapping (default)
diff --git a/MAINTAINERS b/MAINTAINERS
index b16bffabe70a..3f92804f5dac 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2449,7 +2449,9 @@ F:	drivers/firmware/broadcom/*
 
 BROADCOM STB NAND FLASH DRIVER
 M:      Brian Norris <computersforpeace@gmail.com>
+M:      Kamal Dasu <kdasu.kdev@gmail.com>
 L:      linux-mtd@lists.infradead.org
+L:      bcm-kernel-feedback-list@broadcom.com
 S:      Maintained
 F:      drivers/mtd/nand/brcmnand/
 
@@ -2929,10 +2931,9 @@ S:	Maintained
 F:      drivers/platform/x86/compal-laptop.c
 
 CONEXANT ACCESSRUNNER USB DRIVER
-M:      Simon Arlott <cxacru@fire.lp0.eu>
 L:      accessrunner-general@lists.sourceforge.net
 W:      http://accessrunner.sourceforge.net/
-S:      Maintained
+S:      Orphan
 F:      drivers/usb/atm/cxacru.c
 
 CONFIGFS
@@ -4409,6 +4410,7 @@ K:	fmc_d.*register
 
 FPGA MANAGER FRAMEWORK
 M:      Alan Tull <atull@opensource.altera.com>
+R:      Moritz Fischer <moritz.fischer@ettus.com>
 S:      Maintained
 F:      drivers/fpga/
 F:      include/linux/fpga/fpga-mgr.h
@@ -6364,6 +6366,7 @@ F:	arch/*/include/asm/pmem.h
 LIGHTNVM PLATFORM SUPPORT
 M:      Matias Bjorling <mb@lightnvm.io>
 W:      http://github/OpenChannelSSD
+L:      linux-block@vger.kernel.org
 S:      Maintained
 F:      drivers/lightnvm/
 F:      include/linux/lightnvm.h
@@ -7902,6 +7905,18 @@ S:	Maintained
 F:      net/openvswitch/
 F:      include/uapi/linux/openvswitch.h
 
+OPERATING PERFORMANCE POINTS (OPP)
+M:      Viresh Kumar <vireshk@kernel.org>
+M:      Nishanth Menon <nm@ti.com>
+M:      Stephen Boyd <sboyd@codeaurora.org>
+L:      linux-pm@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm.git
+F:      drivers/base/power/opp/
+F:      include/linux/pm_opp.h
+F:      Documentation/power/opp.txt
+F:      Documentation/devicetree/bindings/opp/
+
 OPL4 DRIVER
 M:      Clemens Ladisch <clemens@ladisch.de>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
diff --git a/Makefile b/Makefile
index 3a0234f50f36..2ffdf9d6f339 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Blurry Fish Butt
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
index 2fd00b7077e4..936bc8f89a67 100644
--- a/arch/alpha/kernel/module.c
+++ b/arch/alpha/kernel/module.c
@@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
 
         /* The small sections were sorted to the end of the segment.
            The following should definitely cover them.  */
-        gp = (u64)me->module_core + me->core_size - 0x8000;
+        gp = (u64)me->core_layout.base + me->core_layout.size - 0x8000;
         got = sechdrs[me->arch.gotsecindex].sh_addr;
 
         for (i = 0; i < n; i++) {
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 93c6ea52b671..e0034a6656ef 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -372,8 +372,8 @@ void *unwind_add_table(struct module *module, const void *table_start,
                 return NULL;
 
         init_unwind_table(table, module->name,
-                          module->module_core, module->core_size,
-                          module->module_init, module->init_size,
+                          module->core_layout.base, module->core_layout.size,
+                          module->init_layout.base, module->init_layout.size,
                           table_start, table_size,
                           NULL, 0);
 
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index feb9d34b239c..f818ea483aeb 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -486,7 +486,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024000 0x200>;
                                 interrupts = <56>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 0>;
                                 status = "disabled";
                         };
@@ -495,7 +498,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024200 0x200>;
                                 interrupts = <54>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 1>;
                                 dr_mode = "host";
                                 status = "disabled";
@@ -505,7 +511,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024400 0x200>;
                                 interrupts = <55>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 2>;
                                 dr_mode = "host";
                                 status = "disabled";
@@ -515,7 +524,6 @@
                                 #index-cells = <1>;
                                 compatible = "fsl,imx27-usbmisc";
                                 reg = <0x10024600 0x200>;
-                                clocks = <&clks IMX27_CLK_USB_AHB_GATE>;
                         };
 
                         sahara2: sahara@10025000 {
diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
index 097e2e201b9f..0c7efc3446c0 100644
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -32,7 +32,7 @@ struct plt_entries {
 
 static bool in_init(const struct module *mod, u32 addr)
 {
-        return addr - (u32)mod->module_init < mod->init_size;
+        return addr - (u32)mod->init_layout.base < mod->init_layout.size;
 }
 
 u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val)
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index eab83b2435b8..e06fd299de08 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -564,17 +564,12 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                         vcpu_sleep(vcpu);
 
                 /*
-                 * Disarming the background timer must be done in a
-                 * preemptible context, as this call may sleep.
-                 */
-                kvm_timer_flush_hwstate(vcpu);
-
-                /*
                  * Preparing the interrupts to be injected also
                  * involves poking the GIC, which must be done in a
                  * non-preemptible context.
                  */
                 preempt_disable();
+                kvm_timer_flush_hwstate(vcpu);
                 kvm_vgic_flush_hwstate(vcpu);
 
                 local_irq_disable();
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 6984342da13d..7dace909d5cf 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -98,6 +98,11 @@ static void kvm_flush_dcache_pud(pud_t pud)
         __kvm_flush_dcache_pud(pud);
 }
 
+static bool kvm_is_device_pfn(unsigned long pfn)
+{
+        return !pfn_valid(pfn);
+}
+
 /**
  * stage2_dissolve_pmd() - clear and flush huge PMD entry
  * @kvm:        pointer to kvm structure.
@@ -213,7 +218,7 @@ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
                         kvm_tlb_flush_vmid_ipa(kvm, addr);
 
                         /* No need to invalidate the cache for device mappings */
-                        if ((pte_val(old_pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                        if (!kvm_is_device_pfn(__phys_to_pfn(addr)))
                                 kvm_flush_dcache_pte(old_pte);
 
                         put_page(virt_to_page(pte));
@@ -305,8 +310,7 @@ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
 
         pte = pte_offset_kernel(pmd, addr);
         do {
-                if (!pte_none(*pte) &&
-                    (pte_val(*pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                if (!pte_none(*pte) && !kvm_is_device_pfn(__phys_to_pfn(addr)))
                         kvm_flush_dcache_pte(*pte);
         } while (pte++, addr += PAGE_SIZE, addr != end);
 }
@@ -1037,11 +1041,6 @@ static bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
         return kvm_vcpu_dabt_iswrite(vcpu);
 }
 
-static bool kvm_is_device_pfn(unsigned long pfn)
-{
-        return !pfn_valid(pfn);
-}
-
 /**
  * stage2_wp_ptes - write protect PMD range
  * @pmd:        pointer to pmd entry
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 9ac16a482ff1..e55848c1edf4 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -316,6 +316,27 @@ config ARM64_ERRATUM_832075
 
           If unsure, say Y.
 
+config ARM64_ERRATUM_834220
+        bool "Cortex-A57: 834220: Stage 2 translation fault might be incorrectly reported in presence of a Stage 1 fault"
+        depends on KVM
+        default y
+        help
+          This option adds an alternative code sequence to work around ARM
+          erratum 834220 on Cortex-A57 parts up to r1p2.
+
+          Affected Cortex-A57 parts might report a Stage 2 translation
+          fault as the result of a Stage 1 fault for load crossing a
+          page boundary when there is a permission or device memory
+          alignment fault at Stage 1 and a translation fault at Stage 2.
+
+          The workaround is to verify that the Stage 1 translation
+          doesn't generate a fault before handling the Stage 2 fault.
+          Please note that this does not necessarily enable the workaround,
+          as it depends on the alternative framework, which will only patch
+          the kernel if an affected CPU is detected.
+
+          If unsure, say Y.
+
 config ARM64_ERRATUM_845719
         bool "Cortex-A53: 845719: a load might read incorrect data"
         depends on COMPAT
diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c
index ce47792a983d..f7bd9bf0bbb3 100644
--- a/arch/arm64/crypto/aes-ce-cipher.c
+++ b/arch/arm64/crypto/aes-ce-cipher.c
@@ -237,7 +237,7 @@ EXPORT_SYMBOL(ce_aes_setkey);
 static struct crypto_alg aes_alg = {
         .cra_name               = "aes",
         .cra_driver_name        = "aes-ce",
-        .cra_priority           = 300,
+        .cra_priority           = 250,
         .cra_flags              = CRYPTO_ALG_TYPE_CIPHER,
         .cra_blocksize          = AES_BLOCK_SIZE,
         .cra_ctxsize            = sizeof(struct crypto_aes_ctx),
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index 624f9679f4b0..9622eb48f894 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -64,27 +64,31 @@ do {									\
 
 #define smp_load_acquire(p)                                             \
 ({                                                                      \
-        typeof(*p) ___p1;                                               \
+        union { typeof(*p) __val; char __c[1]; } __u;                   \
         compiletime_assert_atomic_type(*p);                             \
         switch (sizeof(*p)) {                                           \
         case 1:                                                         \
                 asm volatile ("ldarb %w0, %1"                           \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u8 *)__u.__c)                       \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 2:                                                         \
                 asm volatile ("ldarh %w0, %1"                           \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u16 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 4:                                                         \
                 asm volatile ("ldar %w0, %1"                            \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u32 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 8:                                                         \
                 asm volatile ("ldar %0, %1"                             \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u64 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         }                                                               \
-        ___p1;                                                          \
+        __u.__val;                                                      \
 })
 
 #define read_barrier_depends()          do { } while(0)
diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
index 7fbed6919b54..eb8432bb82b8 100644
--- a/arch/arm64/include/asm/compat.h
+++ b/arch/arm64/include/asm/compat.h
@@ -23,7 +23,6 @@
  */
 #include <linux/types.h>
 #include <linux/sched.h>
-#include <linux/ptrace.h>
 
 #define COMPAT_USER_HZ          100
 #ifdef __AARCH64EB__
@@ -234,7 +233,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-#define compat_user_stack_pointer() (user_stack_pointer(current_pt_regs()))
+#define compat_user_stack_pointer() (user_stack_pointer(task_pt_regs(current)))
 
 static inline void __user *arch_compat_alloc_user_space(long len)
 {
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 11d5bb0fdd54..52722ee73dba 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -29,8 +29,9 @@
 #define ARM64_HAS_PAN                           4
 #define ARM64_HAS_LSE_ATOMICS                   5
 #define ARM64_WORKAROUND_CAVIUM_23154           6
+#define ARM64_WORKAROUND_834220                 7
 
-#define ARM64_NCAPS                             7
+#define ARM64_NCAPS                             8
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index 54d0ead41afc..61e08f360e31 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -18,7 +18,6 @@
 
 #ifdef __KERNEL__
 
-#include <linux/acpi.h>
 #include <linux/types.h>
 #include <linux/vmalloc.h>
 
@@ -26,22 +25,16 @@
 #include <asm/xen/hypervisor.h>
 
 #define DMA_ERROR_CODE  (~(dma_addr_t)0)
-extern struct dma_map_ops *dma_ops;
 extern struct dma_map_ops dummy_dma_ops;
 
 static inline struct dma_map_ops *__generic_dma_ops(struct device *dev)
 {
-        if (unlikely(!dev))
-                return dma_ops;
-        else if (dev->archdata.dma_ops)
+        if (dev && dev->archdata.dma_ops)
                 return dev->archdata.dma_ops;
-        else if (acpi_disabled)
-                return dma_ops;
 
         /*
-         * When ACPI is enabled, if arch_set_dma_ops is not called,
-         * we will disable device DMA capability by setting it
-         * to dummy_dma_ops.
+         * We expect no ISA devices, and all other DMA masters are expected to
+         * have someone call arch_setup_dma_ops at device creation time.
          */
         return &dummy_dma_ops;
 }
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 17e92f05b1fe..3ca894ecf699 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -99,11 +99,13 @@ static inline void vcpu_set_thumb(struct kvm_vcpu *vcpu)
         *vcpu_cpsr(vcpu) |= COMPAT_PSR_T_BIT;
 }
 
+/*
+ * vcpu_reg should always be passed a register number coming from a
+ * read of ESR_EL2. Otherwise, it may give the wrong result on AArch32
+ * with banked registers.
+ */
 static inline unsigned long *vcpu_reg(const struct kvm_vcpu *vcpu, u8 reg_num)
 {
-        if (vcpu_mode_is_32bit(vcpu))
-                return vcpu_reg32(vcpu, reg_num);
-
         return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.regs[reg_num];
 }
 
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index c0e87898ba96..24165784b803 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -101,7 +101,7 @@ static inline void cpu_set_default_tcr_t0sz(void)
 #define destroy_context(mm)             do { } while(0)
 void check_and_switch_context(struct mm_struct *mm, unsigned int cpu);
 
-#define init_new_context(tsk,mm)        ({ atomic64_set(&mm->context.id, 0); 0; })
+#define init_new_context(tsk,mm)        ({ atomic64_set(&(mm)->context.id, 0); 0; })
 
 /*
  * This is called when "tsk" is about to enter lazy TLB mode.
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 9819a9426b69..7e074f93f383 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -81,6 +81,7 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 
 #define PAGE_KERNEL             __pgprot(_PAGE_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE)
 #define PAGE_KERNEL_RO          __pgprot(_PAGE_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_RDONLY)
+#define PAGE_KERNEL_ROX __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_RDONLY)
 #define PAGE_KERNEL_EXEC        __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_WRITE)
 #define PAGE_KERNEL_EXEC_CONT   __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_CONT)
 
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 24926f2504f7..feb6b4efa641 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -75,6 +75,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                            (1 << MIDR_VARIANT_SHIFT) | 2),
         },
 #endif
+#ifdef CONFIG_ARM64_ERRATUM_834220
+        {
+        /* Cortex-A57 r0p0 - r1p2 */
+                .desc = "ARM erratum 834220",
+                .capability = ARM64_WORKAROUND_834220,
+                MIDR_RANGE(MIDR_CORTEX_A57, 0x00,
+                           (1 << MIDR_VARIANT_SHIFT) | 2),
+        },
+#endif
 #ifdef CONFIG_ARM64_ERRATUM_845719
         {
         /* Cortex-A53 r0p[01234] */
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 706679d0a0b4..212ae6361d8b 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -30,6 +30,7 @@
 #include <linux/seq_file.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
+#include <linux/delay.h>
 
 /*
  * In case the boot CPU is hotpluggable, we record its initial state and
@@ -112,6 +113,10 @@ static int c_show(struct seq_file *m, void *v)
                  */
                 seq_printf(m, "processor\t: %d\n", i);
 
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           loops_per_jiffy / (500000UL/HZ),
+                           loops_per_jiffy / (5000UL/HZ) % 100);
+
                 /*
                  * Dump out the common processor features in a single line.
                  * Userspace should read the hwcaps with getauxval(AT_HWCAP)
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index de46b50f4cdf..fc5508e0df57 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -224,6 +224,8 @@ static bool __init efi_virtmap_init(void)
 {
         efi_memory_desc_t *md;
 
+        init_new_context(NULL, &efi_mm);
+
         for_each_efi_memory_desc(&memmap, md) {
                 u64 paddr, npages, size;
                 pgprot_t prot;
@@ -254,7 +256,8 @@ static bool __init efi_virtmap_init(void)
                 else
                         prot = PAGE_KERNEL;
 
-                create_pgd_mapping(&efi_mm, paddr, md->virt_addr, size, prot);
+                create_pgd_mapping(&efi_mm, paddr, md->virt_addr, size,
+                                   __pgprot(pgprot_val(prot) | PTE_NG));
         }
         return true;
 }
@@ -329,14 +332,7 @@ core_initcall(arm64_dmi_init);
 
 static void efi_set_pgd(struct mm_struct *mm)
 {
-        if (mm == &init_mm)
-                cpu_set_reserved_ttbr0();
-        else
-                cpu_switch_mm(mm->pgd, mm);
-
-        local_flush_tlb_all();
-        if (icache_is_aivivt())
-                __local_flush_icache_all();
+        switch_mm(NULL, mm, NULL);
 }
 
 void efi_virtmap_load(void)
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index fce95e17cf7f..1095aa483a1c 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,3 +1,4 @@
+#include <linux/ftrace.h>
 #include <linux/percpu.h>
 #include <linux/slab.h>
 #include <asm/cacheflush.h>
@@ -71,6 +72,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
         local_dbg_save(flags);
 
         /*
+         * Function graph tracer state gets incosistent when the kernel
+         * calls functions that never return (aka suspend finishers) hence
+         * disable graph tracing during their execution.
+         */
+        pause_graph_tracing();
+
+        /*
          * mm context saved on the stack, it will be restored when
          * the cpu comes out of reset through the identity mapped
          * page tables, so that the thread address space is properly
@@ -111,6 +119,8 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
                         hw_breakpoint_restore(NULL);
         }
 
+        unpause_graph_tracing();
+
         /*
          * Restore pstate flags. OS lock and mdscr have been already
          * restored, so from this point onwards, debugging is fully
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index 1599701ef044..86c289832272 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -864,6 +864,10 @@ ENTRY(__kvm_flush_vm_context)
 ENDPROC(__kvm_flush_vm_context)
 
 __kvm_hyp_panic:
+        // Stash PAR_EL1 before corrupting it in __restore_sysregs
+        mrs     x0, par_el1
+        push    x0, xzr
+
         // Guess the context by looking at VTTBR:
         // If zero, then we're already a host.
         // Otherwise restore a minimal host context before panicing.
@@ -898,7 +902,7 @@ __kvm_hyp_panic:
         mrs     x3, esr_el2
         mrs     x4, far_el2
         mrs     x5, hpfar_el2
-        mrs     x6, par_el1
+        pop     x6, xzr         // active context PAR_EL1
         mrs     x7, tpidr_el2
 
         mov     lr, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\
@@ -914,7 +918,7 @@ __kvm_hyp_panic:
 ENDPROC(__kvm_hyp_panic)
 
 __hyp_panic_str:
-        .ascii  "HYP panic:\nPS:%08x PC:%p ESR:%p\nFAR:%p HPFAR:%p PAR:%p\nVCPU:%p\n\0"
+        .ascii  "HYP panic:\nPS:%08x PC:%016x ESR:%08x\nFAR:%016x HPFAR:%016x PAR:%016x\nVCPU:%p\n\0"
 
         .align  2
 
@@ -1015,9 +1019,15 @@ el1_trap:
         b.ne    1f              // Not an abort we care about
 
         /* This is an abort. Check for permission fault */
+alternative_if_not ARM64_WORKAROUND_834220
         and     x2, x1, #ESR_ELx_FSC_TYPE
         cmp     x2, #FSC_PERM
         b.ne    1f              // Not a permission fault
+alternative_else
+        nop                     // Use the permission fault path to
+        nop                     // check for a valid S1 translation,
+        nop                     // regardless of the ESR value.
+alternative_endif
 
         /*
          * Check for Stage-1 page table walk, which is guaranteed
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index 85c57158dcd9..648112e90ed5 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -48,7 +48,7 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
 
         /* Note: These now point to the banked copies */
         *vcpu_spsr(vcpu) = new_spsr_value;
-        *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
+        *vcpu_reg32(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
 
         /* Branch to exception vector */
         if (sctlr & (1 << 13))
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 131a199114b4..7963aa4b5d28 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/gfp.h>
+#include <linux/acpi.h>
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/genalloc.h>
@@ -28,9 +29,6 @@
 
 #include <asm/cacheflush.h>
 
-struct dma_map_ops *dma_ops;
-EXPORT_SYMBOL(dma_ops);
-
 static pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot,
                                  bool coherent)
 {
@@ -515,13 +513,7 @@ EXPORT_SYMBOL(dummy_dma_ops);
 
 static int __init arm64_dma_init(void)
 {
-        int ret;
-
-        dma_ops = &swiotlb_dma_ops;
-
-        ret = atomic_pool_init();
-
-        return ret;
+        return atomic_pool_init();
 }
 arch_initcall(arm64_dma_init);
 
@@ -552,10 +544,14 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
 {
         bool coherent = is_device_dma_coherent(dev);
         int ioprot = dma_direction_to_prot(DMA_BIDIRECTIONAL, coherent);
+        size_t iosize = size;
         void *addr;
 
         if (WARN(!dev, "cannot create IOMMU mapping for unknown device\n"))
                 return NULL;
+
+        size = PAGE_ALIGN(size);
+
         /*
          * Some drivers rely on this, and we probably don't want the
          * possibility of stale kernel data being read by devices anyway.
@@ -566,7 +562,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 struct page **pages;
                 pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL, coherent);
 
-                pages = iommu_dma_alloc(dev, size, gfp, ioprot, handle,
+                pages = iommu_dma_alloc(dev, iosize, gfp, ioprot, handle,
                                         flush_page);
                 if (!pages)
                         return NULL;
@@ -574,7 +570,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 addr = dma_common_pages_remap(pages, size, VM_USERMAP, prot,
                                               __builtin_return_address(0));
                 if (!addr)
-                        iommu_dma_free(dev, pages, size, handle);
+                        iommu_dma_free(dev, pages, iosize, handle);
         } else {
                 struct page *page;
                 /*
@@ -591,7 +587,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 if (!addr)
                         return NULL;
 
-                *handle = iommu_dma_map_page(dev, page, 0, size, ioprot);
+                *handle = iommu_dma_map_page(dev, page, 0, iosize, ioprot);
                 if (iommu_dma_mapping_error(dev, *handle)) {
                         if (coherent)
                                 __free_pages(page, get_order(size));
@@ -606,6 +602,9 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
 static void __iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
                                dma_addr_t handle, struct dma_attrs *attrs)
 {
+        size_t iosize = size;
+
+        size = PAGE_ALIGN(size);
         /*
          * @cpu_addr will be one of 3 things depending on how it was allocated:
          * - A remapped array of pages from iommu_dma_alloc(), for all
@@ -617,17 +616,17 @@ static void __iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
          * Hence how dodgy the below logic looks...
          */
         if (__in_atomic_pool(cpu_addr, size)) {
-                iommu_dma_unmap_page(dev, handle, size, 0, NULL);
+                iommu_dma_unmap_page(dev, handle, iosize, 0, NULL);
                 __free_from_pool(cpu_addr, size);
         } else if (is_vmalloc_addr(cpu_addr)){
                 struct vm_struct *area = find_vm_area(cpu_addr);
 
                 if (WARN_ON(!area || !area->pages))
                         return;
-                iommu_dma_free(dev, area->pages, size, &handle);
+                iommu_dma_free(dev, area->pages, iosize, &handle);
                 dma_common_free_remap(cpu_addr, size, VM_USERMAP);
         } else {
-                iommu_dma_unmap_page(dev, handle, size, 0, NULL);
+                iommu_dma_unmap_page(dev, handle, iosize, 0, NULL);
                 __free_pages(virt_to_page(cpu_addr), get_order(size));
         }
 }
@@ -984,8 +983,8 @@ static void __iommu_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
 void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                         struct iommu_ops *iommu, bool coherent)
 {
-        if (!acpi_disabled && !dev->archdata.dma_ops)
-                dev->archdata.dma_ops = dma_ops;
+        if (!dev->archdata.dma_ops)
+                dev->archdata.dma_ops = &swiotlb_dma_ops;
 
         dev->archdata.dma_coherent = coherent;
         __iommu_setup_dma_ops(dev, dma_base, size, iommu);
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index e3f563c81c48..abb66f84d4ac 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -362,8 +362,8 @@ static void __init __map_memblock(phys_addr_t start, phys_addr_t end)
          * for now. This will get more fine grained later once all memory
          * is mapped
          */
-        unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
-        unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
+        unsigned long kernel_x_start = round_down(__pa(_stext), SWAPPER_BLOCK_SIZE);
+        unsigned long kernel_x_end = round_up(__pa(__init_end), SWAPPER_BLOCK_SIZE);
 
         if (end < kernel_x_start) {
                 create_mapping(start, __phys_to_virt(start),
@@ -451,18 +451,18 @@ static void __init fixup_executable(void)
 {
 #ifdef CONFIG_DEBUG_RODATA
         /* now that we are actually fully mapped, make the start/end more fine grained */
-        if (!IS_ALIGNED((unsigned long)_stext, SECTION_SIZE)) {
+        if (!IS_ALIGNED((unsigned long)_stext, SWAPPER_BLOCK_SIZE)) {
                 unsigned long aligned_start = round_down(__pa(_stext),
-                                                        SECTION_SIZE);
+                                                         SWAPPER_BLOCK_SIZE);
 
                 create_mapping(aligned_start, __phys_to_virt(aligned_start),
                                 __pa(_stext) - aligned_start,
                                 PAGE_KERNEL);
         }
 
-        if (!IS_ALIGNED((unsigned long)__init_end, SECTION_SIZE)) {
+        if (!IS_ALIGNED((unsigned long)__init_end, SWAPPER_BLOCK_SIZE)) {
                 unsigned long aligned_end = round_up(__pa(__init_end),
-                                                        SECTION_SIZE);
+                                                          SWAPPER_BLOCK_SIZE);
                 create_mapping(__pa(__init_end), (unsigned long)__init_end,
                                 aligned_end - __pa(__init_end),
                                 PAGE_KERNEL);
@@ -475,7 +475,7 @@ void mark_rodata_ro(void)
 {
         create_mapping_late(__pa(_stext), (unsigned long)_stext,
                                 (unsigned long)_etext - (unsigned long)_stext,
-                                PAGE_KERNEL_EXEC | PTE_RDONLY);
+                                PAGE_KERNEL_ROX);
 
 }
 #endif
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index 164efa009e5b..2b4c54c04cb6 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -118,9 +118,9 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
          * Increase core size to make room for GOT and set start
          * offset for GOT.
          */
-        module->core_size = ALIGN(module->core_size, 4);
-        module->arch.got_offset = module->core_size;
-        module->core_size += module->arch.got_size;
+        module->core_layout.size = ALIGN(module->core_layout.size, 4);
+        module->arch.got_offset = module->core_layout.size;
+        module->core_layout.size += module->arch.got_size;
 
         return 0;
 
@@ -177,7 +177,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                         if (!info->got_initialized) {
                                 Elf32_Addr *gotent;
 
-                                gotent = (module->module_core
+                                gotent = (module->core_layout.base
                                           + module->arch.got_offset
                                           + info->got_offset);
                                 *gotent = relocation;
@@ -255,8 +255,8 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                          */
                         pr_debug("GOTPC: PC=0x%x, got_offset=0x%lx, core=0x%p\n",
                                  relocation, module->arch.got_offset,
-                                 module->module_core);
-                        relocation -= ((unsigned long)module->module_core
+                                 module->core_layout.base);
+                        relocation -= ((unsigned long)module->core_layout.base
                                        + module->arch.got_offset);
                         *location = relocation;
                         break;
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index b15933c31b2f..6ab0ae7d6535 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -486,13 +486,13 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
 static inline int
 in_init (const struct module *mod, uint64_t addr)
 {
-        return addr - (uint64_t) mod->module_init < mod->init_size;
+        return addr - (uint64_t) mod->init_layout.base < mod->init_layout.size;
 }
 
 static inline int
 in_core (const struct module *mod, uint64_t addr)
 {
-        return addr - (uint64_t) mod->module_core < mod->core_size;
+        return addr - (uint64_t) mod->core_layout.base < mod->core_layout.size;
 }
 
 static inline int
@@ -675,7 +675,7 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
                 break;
 
               case RV_BDREL:
-                val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
+                val -= (uint64_t) (in_init(mod, val) ? mod->init_layout.base : mod->core_layout.base);
                 break;
 
               case RV_LTV:
@@ -810,15 +810,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
                  *     addresses have been selected...
                  */
                 uint64_t gp;
-                if (mod->core_size > MAX_LTOFF)
+                if (mod->core_layout.size > MAX_LTOFF)
                         /*
                          * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
                          * at the end of the module.
                          */
-                        gp = mod->core_size - MAX_LTOFF / 2;
+                        gp = mod->core_layout.size - MAX_LTOFF / 2;
                 else
-                        gp = mod->core_size / 2;
-                gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
+                        gp = mod->core_layout.size / 2;
+                gp = (uint64_t) mod->core_layout.base + ((gp + 7) & -8);
                 mod->arch.gp = gp;
                 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
         }
diff --git a/arch/metag/kernel/module.c b/arch/metag/kernel/module.c
index 986331cd0a52..bb8dfba9a763 100644
--- a/arch/metag/kernel/module.c
+++ b/arch/metag/kernel/module.c
@@ -176,8 +176,8 @@ static uint32_t do_plt_call(void *location, Elf32_Addr val,
         tramp[1] = 0xac000001 | ((val & 0x0000ffff) << 3);
 
         /* Init, or core PLT? */
-        if (location >= mod->module_core
-            && location < mod->module_core + mod->core_size)
+        if (location >= mod->core_layout.base
+            && location < mod->core_layout.base + mod->core_layout.size)
                 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
         else
                 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index 1ba21204ebe0..8755d618e116 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -216,9 +216,9 @@ void __init plat_mem_setup(void)
                                            AR71XX_RESET_SIZE);
         ath79_pll_base = ioremap_nocache(AR71XX_PLL_BASE,
                                          AR71XX_PLL_SIZE);
+        ath79_detect_sys_type();
         ath79_ddr_ctrl_init();
 
-        ath79_detect_sys_type();
         if (mips_machtype != ATH79_MACH_GENERIC_OF)
                 detect_memory_region(0, ATH79_MEM_SIZE_MIN, ATH79_MEM_SIZE_MAX);
 
@@ -281,3 +281,8 @@ MIPS_MACHINE(ATH79_MACH_GENERIC,
              "Generic",
              "Generic AR71XX/AR724X/AR913X based board",
              ath79_generic_init);
+
+MIPS_MACHINE(ATH79_MACH_GENERIC_OF,
+             "DTB",
+             "Generic AR71XX/AR724X/AR913X based board (DT)",
+             NULL);
diff --git a/arch/mips/boot/dts/qca/ar9132.dtsi b/arch/mips/boot/dts/qca/ar9132.dtsi
index fb7734eadbf0..13d0439496a9 100644
--- a/arch/mips/boot/dts/qca/ar9132.dtsi
+++ b/arch/mips/boot/dts/qca/ar9132.dtsi
@@ -107,7 +107,7 @@
                         miscintc: interrupt-controller@18060010 {
                                 compatible = "qca,ar9132-misc-intc",
                                            "qca,ar7100-misc-intc";
-                                reg = <0x18060010 0x4>;
+                                reg = <0x18060010 0x8>;
 
                                 interrupt-parent = <&cpuintc>;
                                 interrupts = <6>;
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index ad1fccdb8d13..2046c0230224 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -200,8 +200,9 @@ static inline int pfn_valid(unsigned long pfn)
 {
         /* avoid <linux/mm.h> include hell */
         extern unsigned long max_mapnr;
+        unsigned long pfn_offset = ARCH_PFN_OFFSET;
 
-        return pfn >= ARCH_PFN_OFFSET && pfn < max_mapnr;
+        return pfn >= pfn_offset && pfn < max_mapnr;
 }
 
 #elif defined(CONFIG_SPARSEMEM)
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 9067b651c7a2..544ea21bfef9 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -205,11 +205,11 @@ static void layout_sections(struct module *mod, const Elf_Ehdr *hdr,
                             || s->sh_entsize != ~0UL)
                                 continue;
                         s->sh_entsize =
-                                get_offset((unsigned long *)&mod->core_size, s);
+                                get_offset((unsigned long *)&mod->core_layout.size, s);
                 }
 
                 if (m == 0)
-                        mod->core_text_size = mod->core_size;
+                        mod->core_layout.text_size = mod->core_layout.size;
 
         }
 }
@@ -641,7 +641,7 @@ static int vpe_elfload(struct vpe *v)
                 layout_sections(&mod, hdr, sechdrs, secstrings);
         }
 
-        v->load_addr = alloc_progmem(mod.core_size);
+        v->load_addr = alloc_progmem(mod.core_layout.size);
         if (!v->load_addr)
                 return -ENOMEM;
 
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index d5fa3eaf39a1..41b1b090f56f 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -1581,7 +1581,7 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
 
         base = (inst >> 21) & 0x1f;
         op_inst = (inst >> 16) & 0x1f;
-        offset = inst & 0xffff;
+        offset = (int16_t)inst;
         cache = (inst >> 16) & 0x3;
         op = (inst >> 18) & 0x7;
 
diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
index 7bab3a4e8f7d..7e2210846b8b 100644
--- a/arch/mips/kvm/locore.S
+++ b/arch/mips/kvm/locore.S
@@ -157,9 +157,11 @@ FEXPORT(__kvm_mips_vcpu_run)
 
 FEXPORT(__kvm_mips_load_asid)
         /* Set the ASID for the Guest Kernel */
-        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
-                                /* addresses shift to 0x80000000 */
-        bltz    t0, 1f          /* If kernel */
+        PTR_L   t0, VCPU_COP0(k1)
+        LONG_L  t0, COP0_STATUS(t0)
+        andi    t0, KSU_USER | ST0_ERL | ST0_EXL
+        xori    t0, KSU_USER
+        bnez    t0, 1f          /* If kernel */
          INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
         INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
@@ -474,9 +476,11 @@ __kvm_mips_return_to_guest:
         mtc0    t0, CP0_EPC
 
         /* Set the ASID for the Guest Kernel */
-        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
-                                /* addresses shift to 0x80000000 */
-        bltz    t0, 1f          /* If kernel */
+        PTR_L   t0, VCPU_COP0(k1)
+        LONG_L  t0, COP0_STATUS(t0)
+        andi    t0, KSU_USER | ST0_ERL | ST0_EXL
+        xori    t0, KSU_USER
+        bnez    t0, 1f          /* If kernel */
          INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
         INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index 49ff3bfc007e..b9b803facdbf 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -279,7 +279,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
 
         if (!gebase) {
                 err = -ENOMEM;
-                goto out_free_cpu;
+                goto out_uninit_cpu;
         }
         kvm_debug("Allocated %d bytes for KVM Exception Handlers @ %p\n",
                   ALIGN(size, PAGE_SIZE), gebase);
@@ -343,6 +343,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
 out_free_gebase:
         kfree(gebase);
 
+out_uninit_cpu:
+        kvm_vcpu_uninit(vcpu);
+
 out_free_cpu:
         kfree(vcpu);
 
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index c36546959e86..729f89163bc3 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -108,6 +108,9 @@ config PGTABLE_LEVELS
         default 3 if 64BIT && PARISC_PAGE_SIZE_4KB
         default 2
 
+config SYS_SUPPORTS_HUGETLBFS
+        def_bool y if PA20
+
 source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
diff --git a/arch/parisc/include/asm/hugetlb.h b/arch/parisc/include/asm/hugetlb.h
new file mode 100644
index 000000000000..7d56a9ccb752
--- /dev/null
+++ b/arch/parisc/include/asm/hugetlb.h
@@ -0,0 +1,85 @@
+#ifndef _ASM_PARISC64_HUGETLB_H
+#define _ASM_PARISC64_HUGETLB_H
+
+#include <asm/page.h>
+#include <asm-generic/hugetlb.h>
+
+
+void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+                     pte_t *ptep, pte_t pte);
+
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+                              pte_t *ptep);
+
+static inline int is_hugepage_only_range(struct mm_struct *mm,
+                                         unsigned long addr,
+                                         unsigned long len) {
+        return 0;
+}
+
+/*
+ * If the arch doesn't supply something else, assume that hugepage
+ * size aligned regions are ok without further preparation.
+ */
+static inline int prepare_hugepage_range(struct file *file,
+                        unsigned long addr, unsigned long len)
+{
+        if (len & ~HPAGE_MASK)
+                return -EINVAL;
+        if (addr & ~HPAGE_MASK)
+                return -EINVAL;
+        return 0;
+}
+
+static inline void hugetlb_free_pgd_range(struct mmu_gather *tlb,
+                                          unsigned long addr, unsigned long end,
+                                          unsigned long floor,
+                                          unsigned long ceiling)
+{
+        free_pgd_range(tlb, addr, end, floor, ceiling);
+}
+
+static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+                                         unsigned long addr, pte_t *ptep)
+{
+}
+
+static inline int huge_pte_none(pte_t pte)
+{
+        return pte_none(pte);
+}
+
+static inline pte_t huge_pte_wrprotect(pte_t pte)
+{
+        return pte_wrprotect(pte);
+}
+
+static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
+                                           unsigned long addr, pte_t *ptep)
+{
+        pte_t old_pte = *ptep;
+        set_huge_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+}
+
+static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
+                                             unsigned long addr, pte_t *ptep,
+                                             pte_t pte, int dirty)
+{
+        int changed = !pte_same(*ptep, pte);
+        if (changed) {
+                set_huge_pte_at(vma->vm_mm, addr, ptep, pte);
+                flush_tlb_page(vma, addr);
+        }
+        return changed;
+}
+
+static inline pte_t huge_ptep_get(pte_t *ptep)
+{
+        return *ptep;
+}
+
+static inline void arch_clear_hugepage_flags(struct page *page)
+{
+}
+
+#endif /* _ASM_PARISC64_HUGETLB_H */
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 60d5d174dfe4..80e742a1c162 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -145,11 +145,22 @@ extern int npmem_ranges;
 #endif /* CONFIG_DISCONTIGMEM */
 
 #ifdef CONFIG_HUGETLB_PAGE
-#define HPAGE_SHIFT             22      /* 4MB (is this fixed?) */
+#define HPAGE_SHIFT             PMD_SHIFT /* fixed for transparent huge pages */
 #define HPAGE_SIZE              ((1UL) << HPAGE_SHIFT)
 #define HPAGE_MASK              (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
+
+#if defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define REAL_HPAGE_SHIFT       20 /* 20 = 1MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_1M
+#elif !defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define REAL_HPAGE_SHIFT       22 /* 22 = 4MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_4M
+#else
+# define REAL_HPAGE_SHIFT       24 /* 24 = 16MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_16M
 #endif
+#endif /* CONFIG_HUGETLB_PAGE */
 
 #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index 3edbb9fc91b4..f2fd327dce2e 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -35,7 +35,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
                                         PxD_FLAG_VALID | 
                                         PxD_FLAG_ATTACHED) 
                         + (__u32)(__pa((unsigned long)pgd) >> PxD_VALUE_SHIFT));
-                /* The first pmd entry also is marked with _PAGE_GATEWAY as
+                /* The first pmd entry also is marked with PxD_FLAG_ATTACHED as
                  * a signal that this pmd may not be freed */
                 __pgd_val_set(*pgd, PxD_FLAG_ATTACHED);
 #endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index f93c4a4e6580..d8534f95915a 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -83,7 +83,11 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
         printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, (unsigned long)pgd_val(e))
 
 /* This is the size of the initially mapped kernel memory */
-#define KERNEL_INITIAL_ORDER    24      /* 0 to 1<<24 = 16MB */
+#ifdef CONFIG_64BIT
+#define KERNEL_INITIAL_ORDER    25      /* 1<<25 = 32MB */
+#else
+#define KERNEL_INITIAL_ORDER    24      /* 1<<24 = 16MB */
+#endif
 #define KERNEL_INITIAL_SIZE     (1 << KERNEL_INITIAL_ORDER)
 
 #if CONFIG_PGTABLE_LEVELS == 3
@@ -167,7 +171,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define _PAGE_NO_CACHE_BIT 24   /* (0x080) Uncached Page (U bit) */
 #define _PAGE_ACCESSED_BIT 23   /* (0x100) Software: Page Accessed */
 #define _PAGE_PRESENT_BIT  22   /* (0x200) Software: translation valid */
-/* bit 21 was formerly the FLUSH bit but is now unused */
+#define _PAGE_HPAGE_BIT    21   /* (0x400) Software: Huge Page */
 #define _PAGE_USER_BIT     20   /* (0x800) Software: User accessible page */
 
 /* N.B. The bits are defined in terms of a 32 bit word above, so the */
@@ -194,6 +198,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define _PAGE_NO_CACHE (1 << xlate_pabit(_PAGE_NO_CACHE_BIT))
 #define _PAGE_ACCESSED (1 << xlate_pabit(_PAGE_ACCESSED_BIT))
 #define _PAGE_PRESENT  (1 << xlate_pabit(_PAGE_PRESENT_BIT))
+#define _PAGE_HUGE     (1 << xlate_pabit(_PAGE_HPAGE_BIT))
 #define _PAGE_USER     (1 << xlate_pabit(_PAGE_USER_BIT))
 
 #define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE |  _PAGE_DIRTY | _PAGE_ACCESSED)
@@ -217,7 +222,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define PxD_FLAG_VALID    (1 << xlate_pabit(_PxD_VALID_BIT))
 #define PxD_FLAG_MASK     (0xf)
 #define PxD_FLAG_SHIFT    (4)
-#define PxD_VALUE_SHIFT   (8) /* (PAGE_SHIFT-PxD_FLAG_SHIFT) */
+#define PxD_VALUE_SHIFT   (PFN_PTE_SHIFT-PxD_FLAG_SHIFT)
 
 #ifndef __ASSEMBLY__
 
@@ -363,6 +368,18 @@ static inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 static inline pte_t pte_mkspecial(pte_t pte)    { return pte; }
 
 /*
+ * Huge pte definitions.
+ */
+#ifdef CONFIG_HUGETLB_PAGE
+#define pte_huge(pte)           (pte_val(pte) & _PAGE_HUGE)
+#define pte_mkhuge(pte)         (__pte(pte_val(pte) | _PAGE_HUGE))
+#else
+#define pte_huge(pte)           (0)
+#define pte_mkhuge(pte)         (pte)
+#endif
+
+
+/*
  * Conversion functions: convert a page and protection to a page entry,
  * and a page entry and page directory to the page they refer to.
  */
@@ -410,8 +427,9 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 /* Find an entry in the second-level page table.. */
 
 #if CONFIG_PGTABLE_LEVELS == 3
+#define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 #define pmd_offset(dir,address) \
-((pmd_t *) pgd_page_vaddr(*(dir)) + (((address)>>PMD_SHIFT) & (PTRS_PER_PMD-1)))
+((pmd_t *) pgd_page_vaddr(*(dir)) + pmd_index(address))
 #else
 #define pmd_offset(dir,addr) ((pmd_t *) dir)
 #endif
diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
index 54adb60c0a42..7e759ecb1343 100644
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -192,33 +192,6 @@ void show_trace(struct task_struct *task, unsigned long *stack);
  */
 typedef unsigned int elf_caddr_t;
 
-#define start_thread_som(regs, new_pc, new_sp) do {     \
-        unsigned long *sp = (unsigned long *)new_sp;    \
-        __u32 spaceid = (__u32)current->mm->context;    \
-        unsigned long pc = (unsigned long)new_pc;       \
-        /* offset pc for priv. level */                 \
-        pc |= 3;                                        \
-                                                        \
-        regs->iasq[0] = spaceid;                        \
-        regs->iasq[1] = spaceid;                        \
-        regs->iaoq[0] = pc;                             \
-        regs->iaoq[1] = pc + 4;                         \
-        regs->sr[2] = LINUX_GATEWAY_SPACE;              \
-        regs->sr[3] = 0xffff;                           \
-        regs->sr[4] = spaceid;                          \
-        regs->sr[5] = spaceid;                          \
-        regs->sr[6] = spaceid;                          \
-        regs->sr[7] = spaceid;                          \
-        regs->gr[ 0] = USER_PSW;                        \
-        regs->gr[30] = ((new_sp)+63)&~63;               \
-        regs->gr[31] = pc;                              \
-                                                        \
-        get_user(regs->gr[26],&sp[0]);                  \
-        get_user(regs->gr[25],&sp[-1]);                 \
-        get_user(regs->gr[24],&sp[-2]);                 \
-        get_user(regs->gr[23],&sp[-3]);                 \
-} while(0)
-
 /* The ELF abi wants things done a "wee bit" differently than
  * som does.  Supporting this behavior here avoids
  * having our own version of create_elf_tables.
diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h
index ecc3ae1ca28e..dd4d1876a020 100644
--- a/arch/parisc/include/uapi/asm/mman.h
+++ b/arch/parisc/include/uapi/asm/mman.h
@@ -49,16 +49,6 @@
 #define MADV_DONTFORK   10              /* don't inherit across fork */
 #define MADV_DOFORK     11              /* do inherit across fork */
 
-/* The range 12-64 is reserved for page size specification. */
-#define MADV_4K_PAGES   12              /* Use 4K pages  */
-#define MADV_16K_PAGES  14              /* Use 16K pages */
-#define MADV_64K_PAGES  16              /* Use 64K pages */
-#define MADV_256K_PAGES 18              /* Use 256K pages */
-#define MADV_1M_PAGES   20              /* Use 1 Megabyte pages */
-#define MADV_4M_PAGES   22              /* Use 4 Megabyte pages */
-#define MADV_16M_PAGES  24              /* Use 16 Megabyte pages */
-#define MADV_64M_PAGES  26              /* Use 64 Megabyte pages */
-
 #define MADV_MERGEABLE   65             /* KSM may merge identical pages */
 #define MADV_UNMERGEABLE 66             /* KSM may not merge identical pages */
 
diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
index 59001cea13f9..d2f62570a7b1 100644
--- a/arch/parisc/kernel/asm-offsets.c
+++ b/arch/parisc/kernel/asm-offsets.c
@@ -290,6 +290,14 @@ int main(void)
         DEFINE(ASM_PFN_PTE_SHIFT, PFN_PTE_SHIFT);
         DEFINE(ASM_PT_INITIAL, PT_INITIAL);
         BLANK();
+        /* HUGEPAGE_SIZE is only used in vmlinux.lds.S to align kernel text
+         * and kernel data on physical huge pages */
+#ifdef CONFIG_HUGETLB_PAGE
+        DEFINE(HUGEPAGE_SIZE, 1UL << REAL_HPAGE_SHIFT);
+#else
+        DEFINE(HUGEPAGE_SIZE, PAGE_SIZE);
+#endif
+        BLANK();
         DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
         DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
         DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index c5ef4081b01d..623496c11756 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -502,21 +502,38 @@
         STREG           \pte,0(\ptp)
         .endm
 
+        /* We have (depending on the page size):
+         * - 38 to 52-bit Physical Page Number
+         * - 12 to 26-bit page offset
+         */
         /* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
          * to a CPU TLB 4k PFN (4k => 12 bits to shift) */
-        #define PAGE_ADD_SHIFT  (PAGE_SHIFT-12)
+        #define PAGE_ADD_SHIFT          (PAGE_SHIFT-12)
+        #define PAGE_ADD_HUGE_SHIFT     (REAL_HPAGE_SHIFT-12)
 
         /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
-        .macro          convert_for_tlb_insert20 pte
+        .macro          convert_for_tlb_insert20 pte,tmp
+#ifdef CONFIG_HUGETLB_PAGE
+        copy            \pte,\tmp
+        extrd,u         \tmp,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
+                                64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
+
+        depdi           _PAGE_SIZE_ENCODING_DEFAULT,63,\
+                                (63-58)+PAGE_ADD_SHIFT,\pte
+        extrd,u,*=      \tmp,_PAGE_HPAGE_BIT+32,1,%r0
+        depdi           _HUGE_PAGE_SIZE_ENCODING_DEFAULT,63,\
+                                (63-58)+PAGE_ADD_HUGE_SHIFT,\pte
+#else /* Huge pages disabled */
         extrd,u         \pte,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
                                 64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
         depdi           _PAGE_SIZE_ENCODING_DEFAULT,63,\
                                 (63-58)+PAGE_ADD_SHIFT,\pte
+#endif
         .endm
 
         /* Convert the pte and prot to tlb insertion values.  How
          * this happens is quite subtle, read below */
-        .macro          make_insert_tlb spc,pte,prot
+        .macro          make_insert_tlb spc,pte,prot,tmp
         space_to_prot   \spc \prot        /* create prot id from space */
         /* The following is the real subtlety.  This is depositing
          * T <-> _PAGE_REFTRAP
@@ -553,7 +570,7 @@
         depdi           1,12,1,\prot
 
         /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
-        convert_for_tlb_insert20 \pte
+        convert_for_tlb_insert20 \pte \tmp
         .endm
 
         /* Identical macro to make_insert_tlb above, except it
@@ -646,17 +663,12 @@
 
 
         /*
-         * Align fault_vector_20 on 4K boundary so that both
-         * fault_vector_11 and fault_vector_20 are on the
-         * same page. This is only necessary as long as we
-         * write protect the kernel text, which we may stop
-         * doing once we use large page translations to cover
-         * the static part of the kernel address space.
+         * Fault_vectors are architecturally required to be aligned on a 2K
+         * boundary
          */
 
         .text
-
-        .align 4096
+        .align 2048
 
 ENTRY(fault_vector_20)
         /* First vector is invalid (0) */
@@ -1147,7 +1159,7 @@ dtlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
         
         idtlbt          pte,prot
 
@@ -1173,7 +1185,7 @@ nadtlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         idtlbt          pte,prot
 
@@ -1267,7 +1279,7 @@ dtlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1295,7 +1307,7 @@ nadtlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
         
@@ -1404,7 +1416,7 @@ itlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
         
         iitlbt          pte,prot
 
@@ -1428,7 +1440,7 @@ naitlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         iitlbt          pte,prot
 
@@ -1514,7 +1526,7 @@ itlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1534,7 +1546,7 @@ naitlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1566,7 +1578,7 @@ dbit_trap_20w:
         tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
         update_dirty    ptp,pte,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
                 
         idtlbt          pte,prot
 
@@ -1610,7 +1622,7 @@ dbit_trap_20:
         tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
         update_dirty    ptp,pte,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
         
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index e7d64527aff9..75aa0db9f69e 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -69,7 +69,7 @@ $bss_loop:
         stw,ma          %arg2,4(%r1)
         stw,ma          %arg3,4(%r1)
 
-        /* Initialize startup VM. Just map first 8/16 MB of memory */
+        /* Initialize startup VM. Just map first 16/32 MB of memory */
         load32          PA(swapper_pg_dir),%r4
         mtctl           %r4,%cr24       /* Initialize kernel root pointer */
         mtctl           %r4,%cr25       /* Initialize user root pointer */
@@ -107,7 +107,7 @@ $bss_loop:
         /* Now initialize the PTEs themselves.  We use RWX for
          * everything ... it will get remapped correctly later */
         ldo             0+_PAGE_KERNEL_RWX(%r0),%r3 /* Hardwired 0 phys addr start */
-        ldi             (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
+        load32          (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
         load32          PA(pg0),%r1
 
 $pgt_fill_loop:
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 3c63a820fcda..b9d75d9fa9ac 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -42,9 +42,9 @@
  *      We are not doing SEGREL32 handling correctly. According to the ABI, we
  *      should do a value offset, like this:
  *                      if (in_init(me, (void *)val))
- *                              val -= (uint32_t)me->module_init;
+ *                              val -= (uint32_t)me->init_layout.base;
  *                      else
- *                              val -= (uint32_t)me->module_core;
+ *                              val -= (uint32_t)me->core_layout.base;
  *      However, SEGREL32 is used only for PARISC unwind entries, and we want
  *      those entries to have an absolute address, and not just an offset.
  *
@@ -100,14 +100,14 @@
  * or init pieces the location is */
 static inline int in_init(struct module *me, void *loc)
 {
-        return (loc >= me->module_init &&
-                loc <= (me->module_init + me->init_size));
+        return (loc >= me->init_layout.base &&
+                loc <= (me->init_layout.base + me->init_layout.size));
 }
 
 static inline int in_core(struct module *me, void *loc)
 {
-        return (loc >= me->module_core &&
-                loc <= (me->module_core + me->core_size));
+        return (loc >= me->core_layout.base &&
+                loc <= (me->core_layout.base + me->core_layout.size));
 }
 
 static inline int in_local(struct module *me, void *loc)
@@ -367,13 +367,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
         }
 
         /* align things a bit */
-        me->core_size = ALIGN(me->core_size, 16);
-        me->arch.got_offset = me->core_size;
-        me->core_size += gots * sizeof(struct got_entry);
+        me->core_layout.size = ALIGN(me->core_layout.size, 16);
+        me->arch.got_offset = me->core_layout.size;
+        me->core_layout.size += gots * sizeof(struct got_entry);
 
-        me->core_size = ALIGN(me->core_size, 16);
-        me->arch.fdesc_offset = me->core_size;
-        me->core_size += fdescs * sizeof(Elf_Fdesc);
+        me->core_layout.size = ALIGN(me->core_layout.size, 16);
+        me->arch.fdesc_offset = me->core_layout.size;
+        me->core_layout.size += fdescs * sizeof(Elf_Fdesc);
 
         me->arch.got_max = gots;
         me->arch.fdesc_max = fdescs;
@@ -391,7 +391,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
 
         BUG_ON(value == 0);
 
-        got = me->module_core + me->arch.got_offset;
+        got = me->core_layout.base + me->arch.got_offset;
         for (i = 0; got[i].addr; i++)
                 if (got[i].addr == value)
                         goto out;
@@ -409,7 +409,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
 #ifdef CONFIG_64BIT
 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
 {
-        Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
+        Elf_Fdesc *fdesc = me->core_layout.base + me->arch.fdesc_offset;
 
         if (!value) {
                 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
@@ -427,7 +427,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
 
         /* Create new one */
         fdesc->addr = value;
-        fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
+        fdesc->gp = (Elf_Addr)me->core_layout.base + me->arch.got_offset;
         return (Elf_Addr)fdesc;
 }
 #endif /* CONFIG_64BIT */
@@ -839,7 +839,7 @@ register_unwind_table(struct module *me,
 
         table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
         end = table + sechdrs[me->arch.unwind_section].sh_size;
-        gp = (Elf_Addr)me->module_core + me->arch.got_offset;
+        gp = (Elf_Addr)me->core_layout.base + me->arch.got_offset;
 
         DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
                me->arch.unwind_section, table, end, gp);
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index 72a3c658ad7b..f7ea626e29c9 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -130,7 +130,16 @@ void __init setup_arch(char **cmdline_p)
         printk(KERN_INFO "The 32-bit Kernel has started...\n");
 #endif
 
-        printk(KERN_INFO "Default page size is %dKB.\n", (int)(PAGE_SIZE / 1024));
+        printk(KERN_INFO "Kernel default page size is %d KB. Huge pages ",
+                (int)(PAGE_SIZE / 1024));
+#ifdef CONFIG_HUGETLB_PAGE
+        printk(KERN_CONT "enabled with %d MB physical and %d MB virtual size",
+                 1 << (REAL_HPAGE_SHIFT - 20), 1 << (HPAGE_SHIFT - 20));
+#else
+        printk(KERN_CONT "disabled");
+#endif
+        printk(KERN_CONT ".\n");
+
 
         pdc_console_init();
 
@@ -377,6 +386,7 @@ arch_initcall(parisc_init);
 void start_parisc(void)
 {
         extern void start_kernel(void);
+        extern void early_trap_init(void);
 
         int ret, cpunum;
         struct pdc_coproc_cfg coproc_cfg;
@@ -397,6 +407,8 @@ void start_parisc(void)
                 panic("must have an fpu to boot linux");
         }
 
+        early_trap_init(); /* initialize checksum of fault_vector */
+
         start_kernel();
         // not reached
 }
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 0b8d26d3ba43..3fbd7252a4b2 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -369,7 +369,7 @@ tracesys_exit:
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
         ldo     TASK_REGS(%r1),%r26
-        bl      do_syscall_trace_exit,%r2
+        BL      do_syscall_trace_exit,%r2
         STREG   %r28,TASK_PT_GR28(%r1)          /* save return value now */
         ldo     -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1      /* get task ptr */
         LDREG   TI_TASK(%r1), %r1
@@ -390,7 +390,7 @@ tracesys_sigexit:
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
-        bl      do_syscall_trace_exit,%r2
+        BL      do_syscall_trace_exit,%r2
         ldo     TASK_REGS(%r1),%r26
 
         ldil    L%syscall_exit_rfi,%r1
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index b99b39f1da02..553b09855cfd 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -807,7 +807,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
 }
 
 
-int __init check_ivt(void *iva)
+void __init initialize_ivt(const void *iva)
 {
         extern u32 os_hpmc_size;
         extern const u32 os_hpmc[];
@@ -818,8 +818,8 @@ int __init check_ivt(void *iva)
         u32 *hpmcp;
         u32 length;
 
-        if (strcmp((char *)iva, "cows can fly"))
-                return -1;
+        if (strcmp((const char *)iva, "cows can fly"))
+                panic("IVT invalid");
 
         ivap = (u32 *)iva;
 
@@ -839,28 +839,23 @@ int __init check_ivt(void *iva)
             check += ivap[i];
 
         ivap[5] = -check;
-
-        return 0;
 }
         
-#ifndef CONFIG_64BIT
-extern const void fault_vector_11;
-#endif
-extern const void fault_vector_20;
 
-void __init trap_init(void)
+/* early_trap_init() is called before we set up kernel mappings and
+ * write-protect the kernel */
+void  __init early_trap_init(void)
 {
-        void *iva;
+        extern const void fault_vector_20;
 
-        if (boot_cpu_data.cpu_type >= pcxu)
-                iva = (void *) &fault_vector_20;
-        else
-#ifdef CONFIG_64BIT
-                panic("Can't boot 64-bit OS on PA1.1 processor!");
-#else
-                iva = (void *) &fault_vector_11;
+#ifndef CONFIG_64BIT
+        extern const void fault_vector_11;
+        initialize_ivt(&fault_vector_11);
 #endif
 
-        if (check_ivt(iva))
-                panic("IVT invalid");
+        initialize_ivt(&fault_vector_20);
+}
+
+void __init trap_init(void)
+{
 }
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 0dacc5ca555a..308f29081d46 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -60,7 +60,7 @@ SECTIONS
                 EXIT_DATA
         }
         PERCPU_SECTION(8)
-        . = ALIGN(PAGE_SIZE);
+        . = ALIGN(HUGEPAGE_SIZE);
         __init_end = .;
         /* freed after init ends here */
 
@@ -116,7 +116,7 @@ SECTIONS
          * that we can properly leave these
          * as writable
          */
-        . = ALIGN(PAGE_SIZE);
+        . = ALIGN(HUGEPAGE_SIZE);
         data_start = .;
 
         EXCEPTION_TABLE(8)
@@ -135,8 +135,11 @@ SECTIONS
         _edata = .;
 
         /* BSS */
-        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 8)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE)
+
+        /* bootmap is allocated in setup_bootmem() directly behind bss. */
 
+        . = ALIGN(HUGEPAGE_SIZE);
         _end = . ;
 
         STABS_DEBUG
diff --git a/arch/parisc/mm/Makefile b/arch/parisc/mm/Makefile
index 758ceefb373a..134393de69d2 100644
--- a/arch/parisc/mm/Makefile
+++ b/arch/parisc/mm/Makefile
@@ -3,3 +3,4 @@
 #
 
 obj-y    := init.o fault.o ioremap.o
+obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
diff --git a/arch/parisc/mm/hugetlbpage.c b/arch/parisc/mm/hugetlbpage.c
new file mode 100644
index 000000000000..f6fdc77a72bd
--- /dev/null
+++ b/arch/parisc/mm/hugetlbpage.c
@@ -0,0 +1,161 @@
+/*
+ * PARISC64 Huge TLB page support.
+ *
+ * This parisc implementation is heavily based on the SPARC and x86 code.
+ *
+ * Copyright (C) 2015 Helge Deller <deller@gmx.de>
+ */
+
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/hugetlb.h>
+#include <linux/pagemap.h>
+#include <linux/sysctl.h>
+
+#include <asm/mman.h>
+#include <asm/pgalloc.h>
+#include <asm/tlb.h>
+#include <asm/tlbflush.h>
+#include <asm/cacheflush.h>
+#include <asm/mmu_context.h>
+
+
+unsigned long
+hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+                unsigned long len, unsigned long pgoff, unsigned long flags)
+{
+        struct hstate *h = hstate_file(file);
+
+        if (len & ~huge_page_mask(h))
+                return -EINVAL;
+        if (len > TASK_SIZE)
+                return -ENOMEM;
+
+        if (flags & MAP_FIXED)
+                if (prepare_hugepage_range(file, addr, len))
+                        return -EINVAL;
+
+        if (addr)
+                addr = ALIGN(addr, huge_page_size(h));
+
+        /* we need to make sure the colouring is OK */
+        return arch_get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
+
+pte_t *huge_pte_alloc(struct mm_struct *mm,
+                        unsigned long addr, unsigned long sz)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte = NULL;
+
+        /* We must align the address, because our caller will run
+         * set_huge_pte_at() on whatever we return, which writes out
+         * all of the sub-ptes for the hugepage range.  So we have
+         * to give it the first such sub-pte.
+         */
+        addr &= HPAGE_MASK;
+
+        pgd = pgd_offset(mm, addr);
+        pud = pud_alloc(mm, pgd, addr);
+        if (pud) {
+                pmd = pmd_alloc(mm, pud, addr);
+                if (pmd)
+                        pte = pte_alloc_map(mm, NULL, pmd, addr);
+        }
+        return pte;
+}
+
+pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte = NULL;
+
+        addr &= HPAGE_MASK;
+
+        pgd = pgd_offset(mm, addr);
+        if (!pgd_none(*pgd)) {
+                pud = pud_offset(pgd, addr);
+                if (!pud_none(*pud)) {
+                        pmd = pmd_offset(pud, addr);
+                        if (!pmd_none(*pmd))
+                                pte = pte_offset_map(pmd, addr);
+                }
+        }
+        return pte;
+}
+
+/* Purge data and instruction TLB entries.  Must be called holding
+ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
+ * machines since the purge must be broadcast to all CPUs.
+ */
+static inline void purge_tlb_entries_huge(struct mm_struct *mm, unsigned long addr)
+{
+        int i;
+
+        /* We may use multiple physical huge pages (e.g. 2x1 MB) to emulate
+         * Linux standard huge pages (e.g. 2 MB) */
+        BUILD_BUG_ON(REAL_HPAGE_SHIFT > HPAGE_SHIFT);
+
+        addr &= HPAGE_MASK;
+        addr |= _HUGE_PAGE_SIZE_ENCODING_DEFAULT;
+
+        for (i = 0; i < (1 << (HPAGE_SHIFT-REAL_HPAGE_SHIFT)); i++) {
+                mtsp(mm->context, 1);
+                pdtlb(addr);
+                if (unlikely(split_tlb))
+                        pitlb(addr);
+                addr += (1UL << REAL_HPAGE_SHIFT);
+        }
+}
+
+void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+                     pte_t *ptep, pte_t entry)
+{
+        unsigned long addr_start;
+        int i;
+
+        addr &= HPAGE_MASK;
+        addr_start = addr;
+
+        for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
+                /* Directly write pte entry.  We could call set_pte_at(mm, addr, ptep, entry)
+                 * instead, but then we get double locking on pa_tlb_lock. */
+                *ptep = entry;
+                ptep++;
+
+                /* Drop the PAGE_SIZE/non-huge tlb entry */
+                purge_tlb_entries(mm, addr);
+
+                addr += PAGE_SIZE;
+                pte_val(entry) += PAGE_SIZE;
+        }
+
+        purge_tlb_entries_huge(mm, addr_start);
+}
+
+
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+                              pte_t *ptep)
+{
+        pte_t entry;
+
+        entry = *ptep;
+        set_huge_pte_at(mm, addr, ptep, __pte(0));
+
+        return entry;
+}
+
+int pmd_huge(pmd_t pmd)
+{
+        return 0;
+}
+
+int pud_huge(pud_t pud)
+{
+        return 0;
+}
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index c5fec4890fdf..1b366c477687 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -409,15 +409,11 @@ static void __init map_pages(unsigned long start_vaddr,
         unsigned long vaddr;
         unsigned long ro_start;
         unsigned long ro_end;
-        unsigned long fv_addr;
-        unsigned long gw_addr;
-        extern const unsigned long fault_vector_20;
-        extern void * const linux_gateway_page;
+        unsigned long kernel_end;
 
         ro_start = __pa((unsigned long)_text);
         ro_end   = __pa((unsigned long)&data_start);
-        fv_addr  = __pa((unsigned long)&fault_vector_20) & PAGE_MASK;
-        gw_addr  = __pa((unsigned long)&linux_gateway_page) & PAGE_MASK;
+        kernel_end  = __pa((unsigned long)&_end);
 
         end_paddr = start_paddr + size;
 
@@ -475,24 +471,25 @@ static void __init map_pages(unsigned long start_vaddr,
                         for (tmp2 = start_pte; tmp2 < PTRS_PER_PTE; tmp2++, pg_table++) {
                                 pte_t pte;
 
-                                /*
-                                 * Map the fault vector writable so we can
-                                 * write the HPMC checksum.
-                                 */
                                 if (force)
                                         pte =  __mk_pte(address, pgprot);
-                                else if (parisc_text_address(vaddr) &&
-                                         address != fv_addr)
+                                else if (parisc_text_address(vaddr)) {
                                         pte = __mk_pte(address, PAGE_KERNEL_EXEC);
+                                        if (address >= ro_start && address < kernel_end)
+                                                pte = pte_mkhuge(pte);
+                                }
                                 else
 #if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
-                                if (address >= ro_start && address < ro_end
-                                                        && address != fv_addr
-                                                        && address != gw_addr)
-                                        pte = __mk_pte(address, PAGE_KERNEL_RO);
-                                else
+                                if (address >= ro_start && address < ro_end) {
+                                        pte = __mk_pte(address, PAGE_KERNEL_EXEC);
+                                        pte = pte_mkhuge(pte);
+                                } else
 #endif
+                                {
                                         pte = __mk_pte(address, pgprot);
+                                        if (address >= ro_start && address < kernel_end)
+                                                pte = pte_mkhuge(pte);
+                                }
 
                                 if (address >= end_paddr) {
                                         if (force)
@@ -536,15 +533,12 @@ void free_initmem(void)
 
         /* force the kernel to see the new TLB entries */
         __flush_tlb_range(0, init_begin, init_end);
-        /* Attempt to catch anyone trying to execute code here
-         * by filling the page with BRK insns.
-         */
-        memset((void *)init_begin, 0x00, init_end - init_begin);
+
         /* finally dump all the instructions which were cached, since the
          * pages are no-longer executable */
         flush_icache_range(init_begin, init_end);
         
-        free_initmem_default(-1);
+        free_initmem_default(POISON_FREE_INITMEM);
 
         /* set up a new led state on systems shipped LED State panel */
         pdc_chassis_send_status(PDC_CHASSIS_DIRECT_BCOMPLETE);
@@ -728,8 +722,8 @@ static void __init pagetable_init(void)
                 unsigned long size;
 
                 start_paddr = pmem_ranges[range].start_pfn << PAGE_SHIFT;
-                end_paddr = start_paddr + (pmem_ranges[range].pages << PAGE_SHIFT);
                 size = pmem_ranges[range].pages << PAGE_SHIFT;
+                end_paddr = start_paddr + size;
 
                 map_pages((unsigned long)__va(start_paddr), start_paddr,
                           size, PAGE_KERNEL, 0);
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index c9e26cb264f4..f2b0b1b0c72a 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -382,3 +382,4 @@ COMPAT_SYS(shmat)
 SYSCALL(shmdt)
 SYSCALL(shmget)
 COMPAT_SYS(shmctl)
+SYSCALL(mlock2)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 6d8f8023ac27..4b6b8ace18e0 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           378
+#define __NR_syscalls           379
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 81579e93c659..1effea5193d6 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -400,5 +400,6 @@
 #define __NR_shmdt              375
 #define __NR_shmget             376
 #define __NR_shmctl             377
+#define __NR_mlock2             378
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
index c94d2e018d84..2c01665eb410 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -188,8 +188,8 @@ static uint32_t do_plt_call(void *location,
 
         pr_debug("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
         /* Init, or core PLT? */
-        if (location >= mod->module_core
-            && location < mod->module_core + mod->core_size)
+        if (location >= mod->core_layout.base
+            && location < mod->core_layout.base + mod->core_layout.size)
                 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
         else
                 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
@@ -296,7 +296,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
         }
 #ifdef CONFIG_DYNAMIC_FTRACE
         module->arch.tramp =
-                do_plt_call(module->module_core,
+                do_plt_call(module->core_layout.base,
                             (unsigned long)ftrace_caller,
                             sechdrs, module);
 #endif
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 0c1a679314dd..7873e171457c 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -159,11 +159,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
 
         /* Increase core size by size of got & plt and set start
            offsets for got and plt. */
-        me->core_size = ALIGN(me->core_size, 4);
-        me->arch.got_offset = me->core_size;
-        me->core_size += me->arch.got_size;
-        me->arch.plt_offset = me->core_size;
-        me->core_size += me->arch.plt_size;
+        me->core_layout.size = ALIGN(me->core_layout.size, 4);
+        me->arch.got_offset = me->core_layout.size;
+        me->core_layout.size += me->arch.got_size;
+        me->arch.plt_offset = me->core_layout.size;
+        me->core_layout.size += me->arch.plt_size;
         return 0;
 }
 
@@ -279,7 +279,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
                 if (info->got_initialized == 0) {
                         Elf_Addr *gotent;
 
-                        gotent = me->module_core + me->arch.got_offset +
+                        gotent = me->core_layout.base + me->arch.got_offset +
                                 info->got_offset;
                         *gotent = val;
                         info->got_initialized = 1;
@@ -302,7 +302,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
                         rc = apply_rela_bits(loc, val, 0, 64, 0);
                 else if (r_type == R_390_GOTENT ||
                          r_type == R_390_GOTPLTENT) {
-                        val += (Elf_Addr) me->module_core - loc;
+                        val += (Elf_Addr) me->core_layout.base - loc;
                         rc = apply_rela_bits(loc, val, 1, 32, 1);
                 }
                 break;
@@ -315,7 +315,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
         case R_390_PLTOFF64:    /* 16 bit offset from GOT to PLT. */
                 if (info->plt_initialized == 0) {
                         unsigned int *ip;
-                        ip = me->module_core + me->arch.plt_offset +
+                        ip = me->core_layout.base + me->arch.plt_offset +
                                 info->plt_offset;
                         ip[0] = 0x0d10e310; /* basr 1,0; lg 1,10(1); br 1 */
                         ip[1] = 0x100a0004;
@@ -334,7 +334,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
                                val - loc + 0xffffUL < 0x1ffffeUL) ||
                               (r_type == R_390_PLT32DBL &&
                                val - loc + 0xffffffffULL < 0x1fffffffeULL)))
-                                val = (Elf_Addr) me->module_core +
+                                val = (Elf_Addr) me->core_layout.base +
                                         me->arch.plt_offset +
                                         info->plt_offset;
                         val += rela->r_addend - loc;
@@ -356,7 +356,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
         case R_390_GOTOFF32:    /* 32 bit offset to GOT.  */
         case R_390_GOTOFF64:    /* 64 bit offset to GOT. */
                 val = val + rela->r_addend -
-                        ((Elf_Addr) me->module_core + me->arch.got_offset);
+                        ((Elf_Addr) me->core_layout.base + me->arch.got_offset);
                 if (r_type == R_390_GOTOFF16)
                         rc = apply_rela_bits(loc, val, 0, 16, 0);
                 else if (r_type == R_390_GOTOFF32)
@@ -366,7 +366,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
                 break;
         case R_390_GOTPC:       /* 32 bit PC relative offset to GOT. */
         case R_390_GOTPCDBL:    /* 32 bit PC rel. off. to GOT shifted by 1. */
-                val = (Elf_Addr) me->module_core + me->arch.got_offset +
+                val = (Elf_Addr) me->core_layout.base + me->arch.got_offset +
                         rela->r_addend - loc;
                 if (r_type == R_390_GOTPC)
                         rc = apply_rela_bits(loc, val, 1, 32, 0);
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 373e32346d68..6a75352f453c 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1030,8 +1030,7 @@ static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
                                    src_id, 0);
 
         /* sending vcpu invalid */
-        if (src_id >= KVM_MAX_VCPUS ||
-            kvm_get_vcpu(vcpu->kvm, src_id) == NULL)
+        if (kvm_get_vcpu_by_id(vcpu->kvm, src_id) == NULL)
                 return -EINVAL;
 
         if (sclp.has_sigpif)
@@ -1110,6 +1109,10 @@ static int __inject_sigp_emergency(struct kvm_vcpu *vcpu,
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY,
                                    irq->u.emerg.code, 0);
 
+        /* sending vcpu invalid */
+        if (kvm_get_vcpu_by_id(vcpu->kvm, irq->u.emerg.code) == NULL)
+                return -EINVAL;
+
         set_bit(irq->u.emerg.code, li->sigp_emerg_pending);
         set_bit(IRQ_PEND_EXT_EMERGENCY, &li->pending_irqs);
         atomic_or(CPUSTAT_EXT_INT, li->cpuflags);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 8fe2f1c722dc..846589281b04 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -342,12 +342,16 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 r = 0;
                 break;
         case KVM_CAP_S390_VECTOR_REGISTERS:
-                if (MACHINE_HAS_VX) {
+                mutex_lock(&kvm->lock);
+                if (atomic_read(&kvm->online_vcpus)) {
+                        r = -EBUSY;
+                } else if (MACHINE_HAS_VX) {
                         set_kvm_facility(kvm->arch.model.fac->mask, 129);
                         set_kvm_facility(kvm->arch.model.fac->list, 129);
                         r = 0;
                 } else
                         r = -EINVAL;
+                mutex_unlock(&kvm->lock);
                 VM_EVENT(kvm, 3, "ENABLE: CAP_S390_VECTOR_REGISTERS %s",
                          r ? "(not available)" : "(success)");
                 break;
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 77191b85ea7a..d76b51cb4b62 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -660,7 +660,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
 
         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 
-        if (!MACHINE_HAS_PFMF)
+        if (!test_kvm_facility(vcpu->kvm, 8))
                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index da690b69f9fe..77c22d685c7a 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -291,12 +291,8 @@ static int handle_sigp_dst(struct kvm_vcpu *vcpu, u8 order_code,
                            u16 cpu_addr, u32 parameter, u64 *status_reg)
 {
         int rc;
-        struct kvm_vcpu *dst_vcpu;
+        struct kvm_vcpu *dst_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr);
 
-        if (cpu_addr >= KVM_MAX_VCPUS)
-                return SIGP_CC_NOT_OPERATIONAL;
-
-        dst_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr);
         if (!dst_vcpu)
                 return SIGP_CC_NOT_OPERATIONAL;
 
@@ -478,7 +474,7 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu)
         trace_kvm_s390_handle_sigp_pei(vcpu, order_code, cpu_addr);
 
         if (order_code == SIGP_EXTERNAL_CALL) {
-                dest_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr);
+                dest_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr);
                 BUG_ON(dest_vcpu == NULL);
 
                 kvm_s390_vcpu_wakeup(dest_vcpu);
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 9f3905697f12..690b4027e17c 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -35,7 +35,7 @@
 #define MSR_IA32_PERFCTR0               0x000000c1
 #define MSR_IA32_PERFCTR1               0x000000c2
 #define MSR_FSB_FREQ                    0x000000cd
-#define MSR_NHM_PLATFORM_INFO           0x000000ce
+#define MSR_PLATFORM_INFO               0x000000ce
 
 #define MSR_NHM_SNB_PKG_CST_CFG_CTL     0x000000e2
 #define NHM_C3_AUTO_DEMOTE              (1UL << 25)
@@ -44,7 +44,6 @@
 #define SNB_C1_AUTO_UNDEMOTE            (1UL << 27)
 #define SNB_C3_AUTO_UNDEMOTE            (1UL << 28)
 
-#define MSR_PLATFORM_INFO               0x000000ce
 #define MSR_MTRRcap                     0x000000fe
 #define MSR_IA32_BBL_CR_CTL             0x00000119
 #define MSR_IA32_BBL_CR_CTL3            0x0000011e
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 4ddd780aeac9..c2b7522cbf35 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -273,10 +273,9 @@ __setup("nosmap", setup_disable_smap);
 
 static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 {
-        unsigned long eflags;
+        unsigned long eflags = native_save_fl();
 
         /* This should have been cleared long ago */
-        raw_local_save_flags(eflags);
         BUG_ON(eflags & X86_EFLAGS_AC);
 
         if (cpu_has(c, X86_FEATURE_SMAP)) {
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index ef29b742cea7..31c6a60505e6 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -385,20 +385,19 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame,
  */
 void fpu__init_prepare_fx_sw_frame(void)
 {
-        int fsave_header_size = sizeof(struct fregs_state);
         int size = xstate_size + FP_XSTATE_MAGIC2_SIZE;
 
-        if (config_enabled(CONFIG_X86_32))
-                size += fsave_header_size;
-
         fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;
         fx_sw_reserved.extended_size = size;
         fx_sw_reserved.xfeatures = xfeatures_mask;
         fx_sw_reserved.xstate_size = xstate_size;
 
-        if (config_enabled(CONFIG_IA32_EMULATION)) {
+        if (config_enabled(CONFIG_IA32_EMULATION) ||
+            config_enabled(CONFIG_X86_32)) {
+                int fsave_header_size = sizeof(struct fregs_state);
+
                 fx_sw_reserved_ia32 = fx_sw_reserved;
-                fx_sw_reserved_ia32.extended_size += fsave_header_size;
+                fx_sw_reserved_ia32.extended_size = size + fsave_header_size;
         }
 }
 
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 6454f2731b56..70fc312221fc 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -694,7 +694,6 @@ void *get_xsave_addr(struct xregs_state *xsave, int xstate_feature)
         if (!boot_cpu_has(X86_FEATURE_XSAVE))
                 return NULL;
 
-        xsave = &current->thread.fpu.state.xsave;
         /*
          * We should not ever be requesting features that we
          * have not enabled.  Remember that pcntxt_mask is
diff --git a/arch/x86/kernel/livepatch.c b/arch/x86/kernel/livepatch.c
index d1d35ccffed3..bcc06e82a593 100644
--- a/arch/x86/kernel/livepatch.c
+++ b/arch/x86/kernel/livepatch.c
@@ -41,8 +41,8 @@ int klp_write_module_reloc(struct module *mod, unsigned long type,
         int ret, numpages, size = 4;
         bool readonly;
         unsigned long val;
-        unsigned long core = (unsigned long)mod->module_core;
-        unsigned long core_size = mod->core_size;
+        unsigned long core = (unsigned long)mod->core_layout.base;
+        unsigned long core_size = mod->core_layout.size;
 
         switch (type) {
         case R_X86_64_NONE:
@@ -72,7 +72,7 @@ int klp_write_module_reloc(struct module *mod, unsigned long type,
         readonly = false;
 
 #ifdef CONFIG_DEBUG_SET_MODULE_RONX
-        if (loc < core + mod->core_ro_size)
+        if (loc < core + mod->core_layout.ro_size)
                 readonly = true;
 #endif
 
diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S
index 94ea120fa21f..87e1762e2bca 100644
--- a/arch/x86/kernel/mcount_64.S
+++ b/arch/x86/kernel/mcount_64.S
@@ -278,6 +278,12 @@ trace:
         /* save_mcount_regs fills in first two parameters */
         save_mcount_regs
 
+        /*
+         * When DYNAMIC_FTRACE is not defined, ARCH_SUPPORTS_FTRACE_OPS is not
+         * set (see include/asm/ftrace.h and include/linux/ftrace.h).  Only the
+         * ip and parent ip are used and the list function is called when
+         * function tracing is enabled.
+         */
         call   *ftrace_trace_function
 
         restore_mcount_regs
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 87acc5221740..af823a388c19 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7394,11 +7394,6 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
 
         switch (type) {
         case VMX_VPID_EXTENT_ALL_CONTEXT:
-                if (get_vmcs12(vcpu)->virtual_processor_id == 0) {
-                        nested_vmx_failValid(vcpu,
-                                VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
-                        return 1;
-                }
                 __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02);
                 nested_vmx_succeed(vcpu);
                 break;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 00462bd63129..eed32283d22c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2763,6 +2763,26 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
         return 0;
 }
 
+static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
+{
+        return (!lapic_in_kernel(vcpu) ||
+                kvm_apic_accept_pic_intr(vcpu));
+}
+
+/*
+ * if userspace requested an interrupt window, check that the
+ * interrupt window is open.
+ *
+ * No need to exit to userspace if we already have an interrupt queued.
+ */
+static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
+{
+        return kvm_arch_interrupt_allowed(vcpu) &&
+                !kvm_cpu_has_interrupt(vcpu) &&
+                !kvm_event_needs_reinjection(vcpu) &&
+                kvm_cpu_accept_dm_intr(vcpu);
+}
+
 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
                                     struct kvm_interrupt *irq)
 {
@@ -2786,6 +2806,7 @@ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
                 return -EEXIST;
 
         vcpu->arch.pending_external_vector = irq->irq;
+        kvm_make_request(KVM_REQ_EVENT, vcpu);
         return 0;
 }
 
@@ -5910,23 +5931,10 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt)
         return emulator_write_emulated(ctxt, rip, instruction, 3, NULL);
 }
 
-/*
- * Check if userspace requested an interrupt window, and that the
- * interrupt window is open.
- *
- * No need to exit to userspace if we already have an interrupt queued.
- */
 static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->run->request_interrupt_window || pic_in_kernel(vcpu->kvm))
-                return false;
-
-        if (kvm_cpu_has_interrupt(vcpu))
-                return false;
-
-        return (irqchip_split(vcpu->kvm)
-                ? kvm_apic_accept_pic_intr(vcpu)
-                : kvm_arch_interrupt_allowed(vcpu));
+        return vcpu->run->request_interrupt_window &&
+                likely(!pic_in_kernel(vcpu->kvm));
 }
 
 static void post_kvm_run_save(struct kvm_vcpu *vcpu)
@@ -5937,17 +5945,9 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
         kvm_run->flags = is_smm(vcpu) ? KVM_RUN_X86_SMM : 0;
         kvm_run->cr8 = kvm_get_cr8(vcpu);
         kvm_run->apic_base = kvm_get_apic_base(vcpu);
-        if (!irqchip_in_kernel(vcpu->kvm))
-                kvm_run->ready_for_interrupt_injection =
-                        kvm_arch_interrupt_allowed(vcpu) &&
-                        !kvm_cpu_has_interrupt(vcpu) &&
-                        !kvm_event_needs_reinjection(vcpu);
-        else if (!pic_in_kernel(vcpu->kvm))
-                kvm_run->ready_for_interrupt_injection =
-                        kvm_apic_accept_pic_intr(vcpu) &&
-                        !kvm_cpu_has_interrupt(vcpu);
-        else
-                kvm_run->ready_for_interrupt_injection = 1;
+        kvm_run->ready_for_interrupt_injection =
+                pic_in_kernel(vcpu->kvm) ||
+                kvm_vcpu_ready_for_interrupt_injection(vcpu);
 }
 
 static void update_cr8_intercept(struct kvm_vcpu *vcpu)
@@ -6360,8 +6360,10 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
 static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 {
         int r;
-        bool req_int_win = !lapic_in_kernel(vcpu) &&
-                vcpu->run->request_interrupt_window;
+        bool req_int_win =
+                dm_request_for_irq_injection(vcpu) &&
+                kvm_cpu_accept_dm_intr(vcpu);
+
         bool req_immediate_exit = false;
 
         if (vcpu->requests) {
@@ -6663,7 +6665,8 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
                 if (kvm_cpu_has_pending_timer(vcpu))
                         kvm_inject_pending_timer_irqs(vcpu);
 
-                if (dm_request_for_irq_injection(vcpu)) {
+                if (dm_request_for_irq_injection(vcpu) &&
+                        kvm_vcpu_ready_for_interrupt_injection(vcpu)) {
                         r = 0;
                         vcpu->run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
                         ++vcpu->stat.request_irq_exits;
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index b0ae85f90f10..1202d5ca2fb5 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -586,6 +586,29 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
 }
 
 /*
+ * We only want to do a 4-byte get_user() on 32-bit.  Otherwise,
+ * we might run off the end of the bounds table if we are on
+ * a 64-bit kernel and try to get 8 bytes.
+ */
+int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
+                long __user *bd_entry_ptr)
+{
+        u32 bd_entry_32;
+        int ret;
+
+        if (is_64bit_mm(mm))
+                return get_user(*bd_entry_ret, bd_entry_ptr);
+
+        /*
+         * Note that get_user() uses the type of the *pointer* to
+         * establish the size of the get, not the destination.
+         */
+        ret = get_user(bd_entry_32, (u32 __user *)bd_entry_ptr);
+        *bd_entry_ret = bd_entry_32;
+        return ret;
+}
+
+/*
  * Get the base of bounds tables pointed by specific bounds
  * directory entry.
  */
@@ -605,7 +628,7 @@ static int get_bt_addr(struct mm_struct *mm,
                 int need_write = 0;
 
                 pagefault_disable();
-                ret = get_user(bd_entry, bd_entry_ptr);
+                ret = get_user_bd_entry(mm, &bd_entry, bd_entry_ptr);
                 pagefault_enable();
                 if (!ret)
                         break;
@@ -700,11 +723,23 @@ static unsigned long mpx_get_bt_entry_offset_bytes(struct mm_struct *mm,
  */
 static inline unsigned long bd_entry_virt_space(struct mm_struct *mm)
 {
-        unsigned long long virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
-        if (is_64bit_mm(mm))
-                return virt_space / MPX_BD_NR_ENTRIES_64;
-        else
-                return virt_space / MPX_BD_NR_ENTRIES_32;
+        unsigned long long virt_space;
+        unsigned long long GB = (1ULL << 30);
+
+        /*
+         * This covers 32-bit emulation as well as 32-bit kernels
+         * running on 64-bit harware.
+         */
+        if (!is_64bit_mm(mm))
+                return (4ULL * GB) / MPX_BD_NR_ENTRIES_32;
+
+        /*
+         * 'x86_virt_bits' returns what the hardware is capable
+         * of, and returns the full >32-bit adddress space when
+         * running 32-bit kernels on 64-bit hardware.
+         */
+        virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
+        return virt_space / MPX_BD_NR_ENTRIES_64;
 }
 
 /*
diff --git a/block/blk-merge.c b/block/blk-merge.c
index de5716d8e525..41a55ba0d78e 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -76,6 +76,9 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         struct bio_vec bv, bvprv, *bvprvp = NULL;
         struct bvec_iter iter;
         unsigned seg_size = 0, nsegs = 0, sectors = 0;
+        unsigned front_seg_size = bio->bi_seg_front_size;
+        bool do_split = true;
+        struct bio *new = NULL;
 
         bio_for_each_segment(bv, bio, iter) {
                 if (sectors + (bv.bv_len >> 9) > queue_max_sectors(q))
@@ -98,7 +101,7 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
 
                         seg_size += bv.bv_len;
                         bvprv = bv;
-                        bvprvp = &bv;
+                        bvprvp = &bvprv;
                         sectors += bv.bv_len >> 9;
                         continue;
                 }
@@ -108,16 +111,29 @@ new_segment:
 
                 nsegs++;
                 bvprv = bv;
-                bvprvp = &bv;
+                bvprvp = &bvprv;
                 seg_size = bv.bv_len;
                 sectors += bv.bv_len >> 9;
+
+                if (nsegs == 1 && seg_size > front_seg_size)
+                        front_seg_size = seg_size;
         }
 
-        *segs = nsegs;
-        return NULL;
+        do_split = false;
 split:
         *segs = nsegs;
-        return bio_split(bio, sectors, GFP_NOIO, bs);
+
+        if (do_split) {
+                new = bio_split(bio, sectors, GFP_NOIO, bs);
+                if (new)
+                        bio = new;
+        }
+
+        bio->bi_seg_front_size = front_seg_size;
+        if (seg_size > bio->bi_seg_back_size)
+                bio->bi_seg_back_size = seg_size;
+
+        return do_split ? new : NULL;
 }
 
 void blk_queue_split(struct request_queue *q, struct bio **bio,
@@ -412,6 +428,12 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq,
         if (sg)
                 sg_mark_end(sg);
 
+        /*
+         * Something must have been wrong if the figured number of
+         * segment is bigger than number of req's physical segments
+         */
+        WARN_ON(nsegs > rq->nr_phys_segments);
+
         return nsegs;
 }
 EXPORT_SYMBOL(blk_rq_map_sg);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ae09de62f19..6d6f8feb48c0 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1291,15 +1291,16 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
                 blk_mq_bio_to_request(rq, bio);
 
                 /*
-                 * we do limited pluging. If bio can be merged, do merge.
+                 * We do limited pluging. If the bio can be merged, do that.
                  * Otherwise the existing request in the plug list will be
                  * issued. So the plug list will have one request at most
                  */
                 if (plug) {
                         /*
                          * The plug list might get flushed before this. If that
-                         * happens, same_queue_rq is invalid and plug list is empty
-                         **/
+                         * happens, same_queue_rq is invalid and plug list is
+                         * empty
+                         */
                         if (same_queue_rq && !list_empty(&plug->mq_list)) {
                                 old_rq = same_queue_rq;
                                 list_del_init(&old_rq->queuelist);
@@ -1380,12 +1381,15 @@ static blk_qc_t blk_sq_make_request(struct request_queue *q, struct bio *bio)
                 blk_mq_bio_to_request(rq, bio);
                 if (!request_count)
                         trace_block_plug(q);
-                else if (request_count >= BLK_MAX_REQUEST_COUNT) {
+
+                blk_mq_put_ctx(data.ctx);
+
+                if (request_count >= BLK_MAX_REQUEST_COUNT) {
                         blk_flush_plug_list(plug, false);
                         trace_block_plug(q);
                 }
+
                 list_add_tail(&rq->queuelist, &plug->mq_list);
-                blk_mq_put_ctx(data.ctx);
                 return cookie;
         }
 
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 246dfb16c3d9..aa40aa93381b 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -158,11 +158,13 @@ void blk_abort_request(struct request *req)
 {
         if (blk_mark_rq_complete(req))
                 return;
-        blk_delete_timer(req);
-        if (req->q->mq_ops)
+
+        if (req->q->mq_ops) {
                 blk_mq_rq_timed_out(req, false);
-        else
+        } else {
+                blk_delete_timer(req);
                 blk_rq_timed_out(req);
+        }
 }
 EXPORT_SYMBOL_GPL(blk_abort_request);
 
diff --git a/block/blk.h b/block/blk.h
index da722eb786df..c43926d3d74d 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -72,8 +72,6 @@ void blk_dequeue_request(struct request *rq);
 void __blk_queue_free_tags(struct request_queue *q);
 bool __blk_end_bidi_request(struct request *rq, int error,
                             unsigned int nr_bytes, unsigned int bidi_bytes);
-int blk_queue_enter(struct request_queue *q, gfp_t gfp);
-void blk_queue_exit(struct request_queue *q);
 void blk_freeze_queue(struct request_queue *q);
 
 static inline void blk_queue_enter_live(struct request_queue *q)
diff --git a/block/noop-iosched.c b/block/noop-iosched.c
index 3de89d4690f3..a163c487cf38 100644
--- a/block/noop-iosched.c
+++ b/block/noop-iosched.c
@@ -21,10 +21,10 @@ static void noop_merged_requests(struct request_queue *q, struct request *rq,
 static int noop_dispatch(struct request_queue *q, int force)
 {
         struct noop_data *nd = q->elevator->elevator_data;
+        struct request *rq;
 
-        if (!list_empty(&nd->queue)) {
-                struct request *rq;
-                rq = list_entry(nd->queue.next, struct request, queuelist);
+        rq = list_first_entry_or_null(&nd->queue, struct request, queuelist);
+        if (rq) {
                 list_del_init(&rq->queuelist);
                 elv_dispatch_sort(q, rq);
                 return 1;
@@ -46,7 +46,7 @@ noop_former_request(struct request_queue *q, struct request *rq)
 
         if (rq->queuelist.prev == &nd->queue)
                 return NULL;
-        return list_entry(rq->queuelist.prev, struct request, queuelist);
+        return list_prev_entry(rq, queuelist);
 }
 
 static struct request *
@@ -56,7 +56,7 @@ noop_latter_request(struct request_queue *q, struct request *rq)
 
         if (rq->queuelist.next == &nd->queue)
                 return NULL;
-        return list_entry(rq->queuelist.next, struct request, queuelist);
+        return list_next_entry(rq, queuelist);
 }
 
 static int noop_init_queue(struct request_queue *q, struct elevator_type *e)
diff --git a/block/partitions/mac.c b/block/partitions/mac.c
index c2c48ec64b27..621317ac4d59 100644
--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -32,7 +32,7 @@ int mac_partition(struct parsed_partitions *state)
         Sector sect;
         unsigned char *data;
         int slot, blocks_in_map;
-        unsigned secsize;
+        unsigned secsize, datasize, partoffset;
 #ifdef CONFIG_PPC_PMAC
         int found_root = 0;
         int found_root_goodness = 0;
@@ -50,10 +50,14 @@ int mac_partition(struct parsed_partitions *state)
         }
         secsize = be16_to_cpu(md->block_size);
         put_dev_sector(sect);
-        data = read_part_sector(state, secsize/512, &sect);
+        datasize = round_down(secsize, 512);
+        data = read_part_sector(state, datasize / 512, &sect);
         if (!data)
                 return -1;
-        part = (struct mac_partition *) (data + secsize%512);
+        partoffset = secsize % 512;
+        if (partoffset + sizeof(*part) > datasize)
+                return -1;
+        part = (struct mac_partition *) (data + partoffset);
         if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
                 put_dev_sector(sect);
                 return 0;               /* not a MacOS disk */
diff --git a/drivers/Makefile b/drivers/Makefile
index 73d039156ea7..795d0ca714bf 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -63,6 +63,7 @@ obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
 obj-$(CONFIG_FB_INTEL)          += video/fbdev/intelfb/
 
 obj-$(CONFIG_PARPORT)           += parport/
+obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += base/ block/ misc/ mfd/ nfc/
 obj-$(CONFIG_LIBNVDIMM)         += nvdimm/
 obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf/
@@ -70,7 +71,6 @@ obj-$(CONFIG_NUBUS)		+= nubus/
 obj-y                           += macintosh/
 obj-$(CONFIG_IDE)               += ide/
 obj-$(CONFIG_SCSI)              += scsi/
-obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += nvme/
 obj-$(CONFIG_ATA)               += ata/
 obj-$(CONFIG_TARGET_CORE)       += target/
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 3c083d2cc434..6730f965b379 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -304,7 +304,7 @@ EXPORT_SYMBOL_GPL(acpi_get_psd_map);
 
 static int register_pcc_channel(int pcc_subspace_idx)
 {
-        struct acpi_pcct_subspace *cppc_ss;
+        struct acpi_pcct_hw_reduced *cppc_ss;
         unsigned int len;
 
         if (pcc_subspace_idx >= 0) {
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index f61a7c834540..b420fb46669d 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1103,7 +1103,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
         }
 
 err_exit:
-        if (result && q)
+        if (result)
                 acpi_ec_delete_query(q);
         if (data)
                 *data = value;
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index bf034f8b7c1a..2fa8304171e0 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -14,7 +14,6 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
-#include <linux/dmi.h>
 #include "sbshc.h"
 
 #define PREFIX "ACPI: "
@@ -30,6 +29,7 @@ struct acpi_smb_hc {
         u8 query_bit;
         smbus_alarm_callback callback;
         void *context;
+        bool done;
 };
 
 static int acpi_smbus_hc_add(struct acpi_device *device);
@@ -88,8 +88,6 @@ enum acpi_smb_offset {
         ACPI_SMB_ALARM_DATA = 0x26,     /* 2 bytes alarm data */
 };
 
-static bool macbook;
-
 static inline int smb_hc_read(struct acpi_smb_hc *hc, u8 address, u8 *data)
 {
         return ec_read(hc->offset + address, data);
@@ -100,27 +98,11 @@ static inline int smb_hc_write(struct acpi_smb_hc *hc, u8 address, u8 data)
         return ec_write(hc->offset + address, data);
 }
 
-static inline int smb_check_done(struct acpi_smb_hc *hc)
-{
-        union acpi_smb_status status = {.raw = 0};
-        smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw);
-        return status.fields.done && (status.fields.status == SMBUS_OK);
-}
-
 static int wait_transaction_complete(struct acpi_smb_hc *hc, int timeout)
 {
-        if (wait_event_timeout(hc->wait, smb_check_done(hc),
-                               msecs_to_jiffies(timeout)))
+        if (wait_event_timeout(hc->wait, hc->done, msecs_to_jiffies(timeout)))
                 return 0;
-        /*
-         * After the timeout happens, OS will try to check the status of SMbus.
-         * If the status is what OS expected, it will be regarded as the bogus
-         * timeout.
-         */
-        if (smb_check_done(hc))
-                return 0;
-        else
-                return -ETIME;
+        return -ETIME;
 }
 
 static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
@@ -135,8 +117,7 @@ static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
         }
 
         mutex_lock(&hc->lock);
-        if (macbook)
-                udelay(5);
+        hc->done = false;
         if (smb_hc_read(hc, ACPI_SMB_PROTOCOL, &temp))
                 goto end;
         if (temp) {
@@ -235,8 +216,10 @@ static int smbus_alarm(void *context)
         if (smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw))
                 return 0;
         /* Check if it is only a completion notify */
-        if (status.fields.done)
+        if (status.fields.done && status.fields.status == SMBUS_OK) {
+                hc->done = true;
                 wake_up(&hc->wait);
+        }
         if (!status.fields.alarm)
                 return 0;
         mutex_lock(&hc->lock);
@@ -262,29 +245,12 @@ extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
                               acpi_handle handle, acpi_ec_query_func func,
                               void *data);
 
-static int macbook_dmi_match(const struct dmi_system_id *d)
-{
-        pr_debug("Detected MacBook, enabling workaround\n");
-        macbook = true;
-        return 0;
-}
-
-static struct dmi_system_id acpi_smbus_dmi_table[] = {
-        { macbook_dmi_match, "Apple MacBook", {
-          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
-          DMI_MATCH(DMI_PRODUCT_NAME, "MacBook") },
-        },
-        { },
-};
-
 static int acpi_smbus_hc_add(struct acpi_device *device)
 {
         int status;
         unsigned long long val;
         struct acpi_smb_hc *hc;
 
-        dmi_check_system(acpi_smbus_dmi_table);
-
         if (!device)
                 return -EINVAL;
 
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index eb6e67451dec..0d77cd6fd8d1 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -68,6 +68,9 @@ int dev_pm_set_wake_irq(struct device *dev, int irq)
         struct wake_irq *wirq;
         int err;
 
+        if (irq < 0)
+                return -EINVAL;
+
         wirq = kzalloc(sizeof(*wirq), GFP_KERNEL);
         if (!wirq)
                 return -ENOMEM;
@@ -167,6 +170,9 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
         struct wake_irq *wirq;
         int err;
 
+        if (irq < 0)
+                return -EINVAL;
+
         wirq = kzalloc(sizeof(*wirq), GFP_KERNEL);
         if (!wirq)
                 return -ENOMEM;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a28a562f7b7f..3457ac8c03e2 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3810,7 +3810,6 @@ static int mtip_block_initialize(struct driver_data *dd)
         sector_t capacity;
         unsigned int index = 0;
         struct kobject *kobj;
-        unsigned char thd_name[16];
 
         if (dd->disk)
                 goto skip_create_disk; /* hw init done, before rebuild */
@@ -3958,10 +3957,9 @@ skip_create_disk:
         }
 
 start_service_thread:
-        sprintf(thd_name, "mtip_svc_thd_%02d", index);
         dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread,
-                                                dd, dd->numa_node, "%s",
-                                                thd_name);
+                                                dd, dd->numa_node,
+                                                "mtip_svc_thd_%02d", index);
 
         if (IS_ERR(dd->mtip_svc_handler)) {
                 dev_err(&dd->pdev->dev, "service thread failed to start\n");
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 6255d1c4bba4..5c8ba5484d86 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/blk-mq.h>
 #include <linux/hrtimer.h>
+#include <linux/lightnvm.h>
 
 struct nullb_cmd {
         struct list_head list;
@@ -39,12 +40,14 @@ struct nullb {
 
         struct nullb_queue *queues;
         unsigned int nr_queues;
+        char disk_name[DISK_NAME_LEN];
 };
 
 static LIST_HEAD(nullb_list);
 static struct mutex lock;
 static int null_major;
 static int nullb_indexes;
+static struct kmem_cache *ppa_cache;
 
 struct completion_queue {
         struct llist_head list;
@@ -119,6 +122,10 @@ static int nr_devices = 2;
 module_param(nr_devices, int, S_IRUGO);
 MODULE_PARM_DESC(nr_devices, "Number of devices to register");
 
+static bool use_lightnvm;
+module_param(use_lightnvm, bool, S_IRUGO);
+MODULE_PARM_DESC(use_lightnvm, "Register as a LightNVM device");
+
 static int irqmode = NULL_IRQ_SOFTIRQ;
 
 static int null_set_irqmode(const char *str, const struct kernel_param *kp)
@@ -427,15 +434,156 @@ static void null_del_dev(struct nullb *nullb)
 {
         list_del_init(&nullb->list);
 
-        del_gendisk(nullb->disk);
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
+        else
+                del_gendisk(nullb->disk);
         blk_cleanup_queue(nullb->q);
         if (queue_mode == NULL_Q_MQ)
                 blk_mq_free_tag_set(&nullb->tag_set);
-        put_disk(nullb->disk);
+        if (!use_lightnvm)
+                put_disk(nullb->disk);
         cleanup_queues(nullb);
         kfree(nullb);
 }
 
+#ifdef CONFIG_NVM
+
+static void null_lnvm_end_io(struct request *rq, int error)
+{
+        struct nvm_rq *rqd = rq->end_io_data;
+        struct nvm_dev *dev = rqd->dev;
+
+        dev->mt->end_io(rqd, error);
+
+        blk_put_request(rq);
+}
+
+static int null_lnvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
+{
+        struct request *rq;
+        struct bio *bio = rqd->bio;
+
+        rq = blk_mq_alloc_request(q, bio_rw(bio), GFP_KERNEL, 0);
+        if (IS_ERR(rq))
+                return -ENOMEM;
+
+        rq->cmd_type = REQ_TYPE_DRV_PRIV;
+        rq->__sector = bio->bi_iter.bi_sector;
+        rq->ioprio = bio_prio(bio);
+
+        if (bio_has_data(bio))
+                rq->nr_phys_segments = bio_phys_segments(q, bio);
+
+        rq->__data_len = bio->bi_iter.bi_size;
+        rq->bio = rq->biotail = bio;
+
+        rq->end_io_data = rqd;
+
+        blk_execute_rq_nowait(q, NULL, rq, 0, null_lnvm_end_io);
+
+        return 0;
+}
+
+static int null_lnvm_id(struct request_queue *q, struct nvm_id *id)
+{
+        sector_t size = gb * 1024 * 1024 * 1024ULL;
+        sector_t blksize;
+        struct nvm_id_group *grp;
+
+        id->ver_id = 0x1;
+        id->vmnt = 0;
+        id->cgrps = 1;
+        id->cap = 0x3;
+        id->dom = 0x1;
+
+        id->ppaf.blk_offset = 0;
+        id->ppaf.blk_len = 16;
+        id->ppaf.pg_offset = 16;
+        id->ppaf.pg_len = 16;
+        id->ppaf.sect_offset = 32;
+        id->ppaf.sect_len = 8;
+        id->ppaf.pln_offset = 40;
+        id->ppaf.pln_len = 8;
+        id->ppaf.lun_offset = 48;
+        id->ppaf.lun_len = 8;
+        id->ppaf.ch_offset = 56;
+        id->ppaf.ch_len = 8;
+
+        do_div(size, bs); /* convert size to pages */
+        do_div(size, 256); /* concert size to pgs pr blk */
+        grp = &id->groups[0];
+        grp->mtype = 0;
+        grp->fmtype = 0;
+        grp->num_ch = 1;
+        grp->num_pg = 256;
+        blksize = size;
+        do_div(size, (1 << 16));
+        grp->num_lun = size + 1;
+        do_div(blksize, grp->num_lun);
+        grp->num_blk = blksize;
+        grp->num_pln = 1;
+
+        grp->fpg_sz = bs;
+        grp->csecs = bs;
+        grp->trdt = 25000;
+        grp->trdm = 25000;
+        grp->tprt = 500000;
+        grp->tprm = 500000;
+        grp->tbet = 1500000;
+        grp->tbem = 1500000;
+        grp->mpos = 0x010101; /* single plane rwe */
+        grp->cpar = hw_queue_depth;
+
+        return 0;
+}
+
+static void *null_lnvm_create_dma_pool(struct request_queue *q, char *name)
+{
+        mempool_t *virtmem_pool;
+
+        virtmem_pool = mempool_create_slab_pool(64, ppa_cache);
+        if (!virtmem_pool) {
+                pr_err("null_blk: Unable to create virtual memory pool\n");
+                return NULL;
+        }
+
+        return virtmem_pool;
+}
+
+static void null_lnvm_destroy_dma_pool(void *pool)
+{
+        mempool_destroy(pool);
+}
+
+static void *null_lnvm_dev_dma_alloc(struct request_queue *q, void *pool,
+                                gfp_t mem_flags, dma_addr_t *dma_handler)
+{
+        return mempool_alloc(pool, mem_flags);
+}
+
+static void null_lnvm_dev_dma_free(void *pool, void *entry,
+                                                        dma_addr_t dma_handler)
+{
+        mempool_free(entry, pool);
+}
+
+static struct nvm_dev_ops null_lnvm_dev_ops = {
+        .identity               = null_lnvm_id,
+        .submit_io              = null_lnvm_submit_io,
+
+        .create_dma_pool        = null_lnvm_create_dma_pool,
+        .destroy_dma_pool       = null_lnvm_destroy_dma_pool,
+        .dev_dma_alloc          = null_lnvm_dev_dma_alloc,
+        .dev_dma_free           = null_lnvm_dev_dma_free,
+
+        /* Simulate nvme protocol restriction */
+        .max_phys_sect          = 64,
+};
+#else
+static struct nvm_dev_ops null_lnvm_dev_ops;
+#endif /* CONFIG_NVM */
+
 static int null_open(struct block_device *bdev, fmode_t mode)
 {
         return 0;
@@ -575,11 +723,6 @@ static int null_add_dev(void)
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, nullb->q);
         queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, nullb->q);
 
-        disk = nullb->disk = alloc_disk_node(1, home_node);
-        if (!disk) {
-                rv = -ENOMEM;
-                goto out_cleanup_blk_queue;
-        }
 
         mutex_lock(&lock);
         list_add_tail(&nullb->list, &nullb_list);
@@ -589,6 +732,21 @@ static int null_add_dev(void)
         blk_queue_logical_block_size(nullb->q, bs);
         blk_queue_physical_block_size(nullb->q, bs);
 
+        sprintf(nullb->disk_name, "nullb%d", nullb->index);
+
+        if (use_lightnvm) {
+                rv = nvm_register(nullb->q, nullb->disk_name,
+                                                        &null_lnvm_dev_ops);
+                if (rv)
+                        goto out_cleanup_blk_queue;
+                goto done;
+        }
+
+        disk = nullb->disk = alloc_disk_node(1, home_node);
+        if (!disk) {
+                rv = -ENOMEM;
+                goto out_cleanup_lightnvm;
+        }
         size = gb * 1024 * 1024 * 1024ULL;
         set_capacity(disk, size >> 9);
 
@@ -598,10 +756,15 @@ static int null_add_dev(void)
         disk->fops              = &null_fops;
         disk->private_data      = nullb;
         disk->queue             = nullb->q;
-        sprintf(disk->disk_name, "nullb%d", nullb->index);
+        strncpy(disk->disk_name, nullb->disk_name, DISK_NAME_LEN);
+
         add_disk(disk);
+done:
         return 0;
 
+out_cleanup_lightnvm:
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
 out_cleanup_blk_queue:
         blk_cleanup_queue(nullb->q);
 out_cleanup_tags:
@@ -625,6 +788,18 @@ static int __init null_init(void)
                 bs = PAGE_SIZE;
         }
 
+        if (use_lightnvm && bs != 4096) {
+                pr_warn("null_blk: LightNVM only supports 4k block size\n");
+                pr_warn("null_blk: defaults block size to 4k\n");
+                bs = 4096;
+        }
+
+        if (use_lightnvm && queue_mode != NULL_Q_MQ) {
+                pr_warn("null_blk: LightNVM only supported for blk-mq\n");
+                pr_warn("null_blk: defaults queue mode to blk-mq\n");
+                queue_mode = NULL_Q_MQ;
+        }
+
         if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
                 if (submit_queues < nr_online_nodes) {
                         pr_warn("null_blk: submit_queues param is set to %u.",
@@ -655,15 +830,27 @@ static int __init null_init(void)
         if (null_major < 0)
                 return null_major;
 
+        if (use_lightnvm) {
+                ppa_cache = kmem_cache_create("ppa_cache", 64 * sizeof(u64),
+                                                                0, 0, NULL);
+                if (!ppa_cache) {
+                        pr_err("null_blk: unable to create ppa cache\n");
+                        return -ENOMEM;
+                }
+        }
+
         for (i = 0; i < nr_devices; i++) {
                 if (null_add_dev()) {
                         unregister_blkdev(null_major, "nullb");
-                        return -EINVAL;
+                        goto err_ppa;
                 }
         }
 
         pr_info("null: module loaded\n");
         return 0;
+err_ppa:
+        kmem_cache_destroy(ppa_cache);
+        return -EINVAL;
 }
 
 static void __exit null_exit(void)
@@ -678,6 +865,8 @@ static void __exit null_exit(void)
                 null_del_dev(nullb);
         }
         mutex_unlock(&lock);
+
+        kmem_cache_destroy(ppa_cache);
 }
 
 module_init(null_init);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 654f6f36a071..55fe9020459f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -412,18 +412,42 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info)
         return rv;
 }
 
-static void start_check_enables(struct smi_info *smi_info)
+static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+{
+        smi_info->last_timeout_jiffies = jiffies;
+        mod_timer(&smi_info->si_timer, new_val);
+        smi_info->timer_running = true;
+}
+
+/*
+ * Start a new message and (re)start the timer and thread.
+ */
+static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
+                          unsigned int size)
+{
+        smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+
+        if (smi_info->thread)
+                wake_up_process(smi_info->thread);
+
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
+}
+
+static void start_check_enables(struct smi_info *smi_info, bool start_timer)
 {
         unsigned char msg[2];
 
         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
         msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+        if (start_timer)
+                start_new_msg(smi_info, msg, 2);
+        else
+                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
         smi_info->si_state = SI_CHECKING_ENABLES;
 }
 
-static void start_clear_flags(struct smi_info *smi_info)
+static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
 {
         unsigned char msg[3];
 
@@ -432,7 +456,10 @@ static void start_clear_flags(struct smi_info *smi_info)
         msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
         msg[2] = WDT_PRE_TIMEOUT_INT;
 
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+        if (start_timer)
+                start_new_msg(smi_info, msg, 3);
+        else
+                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
         smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
@@ -442,10 +469,8 @@ static void start_getting_msg_queue(struct smi_info *smi_info)
         smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
         smi_info->curr_msg->data_size = 2;
 
-        smi_info->handlers->start_transaction(
-                smi_info->si_sm,
-                smi_info->curr_msg->data,
-                smi_info->curr_msg->data_size);
+        start_new_msg(smi_info, smi_info->curr_msg->data,
+                      smi_info->curr_msg->data_size);
         smi_info->si_state = SI_GETTING_MESSAGES;
 }
 
@@ -455,20 +480,11 @@ static void start_getting_events(struct smi_info *smi_info)
         smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
         smi_info->curr_msg->data_size = 2;
 
-        smi_info->handlers->start_transaction(
-                smi_info->si_sm,
-                smi_info->curr_msg->data,
-                smi_info->curr_msg->data_size);
+        start_new_msg(smi_info, smi_info->curr_msg->data,
+                      smi_info->curr_msg->data_size);
         smi_info->si_state = SI_GETTING_EVENTS;
 }
 
-static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
-{
-        smi_info->last_timeout_jiffies = jiffies;
-        mod_timer(&smi_info->si_timer, new_val);
-        smi_info->timer_running = true;
-}
-
 /*
  * When we have a situtaion where we run out of memory and cannot
  * allocate messages, we just leave them in the BMC and run the system
@@ -478,11 +494,11 @@ static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
-static inline bool disable_si_irq(struct smi_info *smi_info)
+static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
 {
         if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = true;
-                start_check_enables(smi_info);
+                start_check_enables(smi_info, start_timer);
                 return true;
         }
         return false;
@@ -492,7 +508,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = false;
-                start_check_enables(smi_info);
+                start_check_enables(smi_info, true);
                 return true;
         }
         return false;
@@ -510,7 +526,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
 
         msg = ipmi_alloc_smi_msg();
         if (!msg) {
-                if (!disable_si_irq(smi_info))
+                if (!disable_si_irq(smi_info, true))
                         smi_info->si_state = SI_NORMAL;
         } else if (enable_si_irq(smi_info)) {
                 ipmi_free_smi_msg(msg);
@@ -526,7 +542,7 @@ static void handle_flags(struct smi_info *smi_info)
                 /* Watchdog pre-timeout */
                 smi_inc_stat(smi_info, watchdog_pretimeouts);
 
-                start_clear_flags(smi_info);
+                start_clear_flags(smi_info, true);
                 smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
                 if (smi_info->intf)
                         ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -879,8 +895,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
                         msg[1] = IPMI_GET_MSG_FLAGS_CMD;
 
-                        smi_info->handlers->start_transaction(
-                                smi_info->si_sm, msg, 2);
+                        start_new_msg(smi_info, msg, 2);
                         smi_info->si_state = SI_GETTING_FLAGS;
                         goto restart;
                 }
@@ -910,7 +925,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                  * disable and messages disabled.
                  */
                 if (smi_info->supports_event_msg_buff || smi_info->irq) {
-                        start_check_enables(smi_info);
+                        start_check_enables(smi_info, true);
                 } else {
                         smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
                         if (!smi_info->curr_msg)
@@ -920,6 +935,13 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                 }
                 goto restart;
         }
+
+        if (si_sm_result == SI_SM_IDLE && smi_info->timer_running) {
+                /* Ok it if fails, the timer will just go off. */
+                if (del_timer(&smi_info->si_timer))
+                        smi_info->timer_running = false;
+        }
+
  out:
         return si_sm_result;
 }
@@ -2560,6 +2582,7 @@ static const struct of_device_id of_ipmi_match[] = {
           .data = (void *)(unsigned long) SI_BT },
         {},
 };
+MODULE_DEVICE_TABLE(of, of_ipmi_match);
 
 static int of_ipmi_probe(struct platform_device *dev)
 {
@@ -2646,7 +2669,6 @@ static int of_ipmi_probe(struct platform_device *dev)
         }
         return 0;
 }
-MODULE_DEVICE_TABLE(of, of_ipmi_match);
 #else
 #define of_ipmi_match NULL
 static int of_ipmi_probe(struct platform_device *dev)
@@ -3613,7 +3635,7 @@ static int try_smi_init(struct smi_info *new_smi)
          * Start clearing the flags before we enable interrupts or the
          * timer to avoid racing with the timer.
          */
-        start_clear_flags(new_smi);
+        start_clear_flags(new_smi, false);
 
         /*
          * IRQ is defined to be set when non-zero.  req_events will
@@ -3908,7 +3930,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
         }
-        disable_si_irq(to_clean);
+        disable_si_irq(to_clean, false);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 0ac3bd1a5497..096f0cef4da1 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -153,6 +153,9 @@ static int timeout = 10;
 /* The pre-timeout is disabled by default. */
 static int pretimeout;
 
+/* Default timeout to set on panic */
+static int panic_wdt_timeout = 255;
+
 /* Default action is to reset the board on a timeout. */
 static unsigned char action_val = WDOG_TIMEOUT_RESET;
 
@@ -293,6 +296,9 @@ MODULE_PARM_DESC(timeout, "Timeout value in seconds.");
 module_param(pretimeout, timeout, 0644);
 MODULE_PARM_DESC(pretimeout, "Pretimeout value in seconds.");
 
+module_param(panic_wdt_timeout, timeout, 0644);
+MODULE_PARM_DESC(timeout, "Timeout value on kernel panic in seconds.");
+
 module_param_cb(action, &param_ops_str, action_op, 0644);
 MODULE_PARM_DESC(action, "Timeout action. One of: "
                  "reset, none, power_cycle, power_off.");
@@ -1189,7 +1195,7 @@ static int wdog_panic_handler(struct notifier_block *this,
                 /* Make sure we do this only once. */
                 panic_event_handled = 1;
 
-                timeout = 255;
+                timeout = panic_wdt_timeout;
                 pretimeout = 0;
                 panic_halt_ipmi_set_timeout();
         }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 71cfdf7c9708..2eb5f0efae90 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -1,4 +1,5 @@
 menu "Clock Source drivers"
+        depends on !ARCH_USES_GETTIMEOFFSET
 
 config CLKSRC_OF
         bool
diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
index 10202f1fdfd7..517e1c7624d4 100644
--- a/drivers/clocksource/fsl_ftm_timer.c
+++ b/drivers/clocksource/fsl_ftm_timer.c
@@ -203,7 +203,7 @@ static int __init ftm_clockevent_init(unsigned long freq, int irq)
         int err;
 
         ftm_writel(0x00, priv->clkevt_base + FTM_CNTIN);
-        ftm_writel(~0UL, priv->clkevt_base + FTM_MOD);
+        ftm_writel(~0u, priv->clkevt_base + FTM_MOD);
 
         ftm_reset_counter(priv->clkevt_base);
 
@@ -230,7 +230,7 @@ static int __init ftm_clocksource_init(unsigned long freq)
         int err;
 
         ftm_writel(0x00, priv->clksrc_base + FTM_CNTIN);
-        ftm_writel(~0UL, priv->clksrc_base + FTM_MOD);
+        ftm_writel(~0u, priv->clksrc_base + FTM_MOD);
 
         ftm_reset_counter(priv->clksrc_base);
 
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 1582c1c016b0..8014c2307332 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -84,6 +84,7 @@ config ARM_KIRKWOOD_CPUFREQ
 config ARM_MT8173_CPUFREQ
         bool "Mediatek MT8173 CPUFreq support"
         depends on ARCH_MEDIATEK && REGULATOR
+        depends on ARM64 || (ARM_CPU_TOPOLOGY && COMPILE_TEST)
         depends on !CPU_THERMAL || THERMAL=y
         select PM_OPP
         help
diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
index adbd1de1cea5..c59bdcb83217 100644
--- a/drivers/cpufreq/Kconfig.x86
+++ b/drivers/cpufreq/Kconfig.x86
@@ -5,7 +5,6 @@
 config X86_INTEL_PSTATE
        bool "Intel P state control"
        depends on X86
-       select ACPI_PROCESSOR if ACPI
        help
           This driver provides a P state for Intel core processors.
           The driver implements an internal governor and will become
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 2e31d097def6..001a532e342e 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -34,14 +34,10 @@
 #include <asm/cpu_device_id.h>
 #include <asm/cpufeature.h>
 
-#if IS_ENABLED(CONFIG_ACPI)
-#include <acpi/processor.h>
-#endif
-
-#define BYT_RATIOS              0x66a
-#define BYT_VIDS                0x66b
-#define BYT_TURBO_RATIOS        0x66c
-#define BYT_TURBO_VIDS          0x66d
+#define ATOM_RATIOS             0x66a
+#define ATOM_VIDS               0x66b
+#define ATOM_TURBO_RATIOS       0x66c
+#define ATOM_TURBO_VIDS         0x66d
 
 #define FRAC_BITS 8
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
@@ -117,9 +113,6 @@ struct cpudata {
         u64     prev_mperf;
         u64     prev_tsc;
         struct sample sample;
-#if IS_ENABLED(CONFIG_ACPI)
-        struct acpi_processor_performance acpi_perf_data;
-#endif
 };
 
 static struct cpudata **all_cpu_data;
@@ -150,7 +143,6 @@ struct cpu_defaults {
 static struct pstate_adjust_policy pid_params;
 static struct pstate_funcs pstate_funcs;
 static int hwp_active;
-static int no_acpi_perf;
 
 struct perf_limits {
         int no_turbo;
@@ -163,8 +155,6 @@ struct perf_limits {
         int max_sysfs_pct;
         int min_policy_pct;
         int min_sysfs_pct;
-        int max_perf_ctl;
-        int min_perf_ctl;
 };
 
 static struct perf_limits performance_limits = {
@@ -191,8 +181,6 @@ static struct perf_limits powersave_limits = {
         .max_sysfs_pct = 100,
         .min_policy_pct = 0,
         .min_sysfs_pct = 0,
-        .max_perf_ctl = 0,
-        .min_perf_ctl = 0,
 };
 
 #ifdef CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE
@@ -201,153 +189,6 @@ static struct perf_limits *limits = &performance_limits;
 static struct perf_limits *limits = &powersave_limits;
 #endif
 
-#if IS_ENABLED(CONFIG_ACPI)
-/*
- * The max target pstate ratio is a 8 bit value in both PLATFORM_INFO MSR and
- * in TURBO_RATIO_LIMIT MSR, which pstate driver stores in max_pstate and
- * max_turbo_pstate fields. The PERF_CTL MSR contains 16 bit value for P state
- * ratio, out of it only high 8 bits are used. For example 0x1700 is setting
- * target ratio 0x17. The _PSS control value stores in a format which can be
- * directly written to PERF_CTL MSR. But in intel_pstate driver this shift
- * occurs during write to PERF_CTL (E.g. for cores core_set_pstate()).
- * This function converts the _PSS control value to intel pstate driver format
- * for comparison and assignment.
- */
-static int convert_to_native_pstate_format(struct cpudata *cpu, int index)
-{
-        return cpu->acpi_perf_data.states[index].control >> 8;
-}
-
-static int intel_pstate_init_perf_limits(struct cpufreq_policy *policy)
-{
-        struct cpudata *cpu;
-        int ret;
-        bool turbo_absent = false;
-        int max_pstate_index;
-        int min_pss_ctl, max_pss_ctl, turbo_pss_ctl;
-        int i;
-
-        cpu = all_cpu_data[policy->cpu];
-
-        pr_debug("intel_pstate: default limits 0x%x 0x%x 0x%x\n",
-                 cpu->pstate.min_pstate, cpu->pstate.max_pstate,
-                 cpu->pstate.turbo_pstate);
-
-        if (!cpu->acpi_perf_data.shared_cpu_map &&
-            zalloc_cpumask_var_node(&cpu->acpi_perf_data.shared_cpu_map,
-                                    GFP_KERNEL, cpu_to_node(policy->cpu))) {
-                return -ENOMEM;
-        }
-
-        ret = acpi_processor_register_performance(&cpu->acpi_perf_data,
-                                                  policy->cpu);
-        if (ret)
-                return ret;
-
-        /*
-         * Check if the control value in _PSS is for PERF_CTL MSR, which should
-         * guarantee that the states returned by it map to the states in our
-         * list directly.
-         */
-        if (cpu->acpi_perf_data.control_register.space_id !=
-                                                ACPI_ADR_SPACE_FIXED_HARDWARE)
-                return -EIO;
-
-        pr_debug("intel_pstate: CPU%u - ACPI _PSS perf data\n", policy->cpu);
-        for (i = 0; i < cpu->acpi_perf_data.state_count; i++)
-                pr_debug("     %cP%d: %u MHz, %u mW, 0x%x\n",
-                         (i == cpu->acpi_perf_data.state ? '*' : ' '), i,
-                         (u32) cpu->acpi_perf_data.states[i].core_frequency,
-                         (u32) cpu->acpi_perf_data.states[i].power,
-                         (u32) cpu->acpi_perf_data.states[i].control);
-
-        /*
-         * If there is only one entry _PSS, simply ignore _PSS and continue as
-         * usual without taking _PSS into account
-         */
-        if (cpu->acpi_perf_data.state_count < 2)
-                return 0;
-
-        turbo_pss_ctl = convert_to_native_pstate_format(cpu, 0);
-        min_pss_ctl = convert_to_native_pstate_format(cpu,
-                                        cpu->acpi_perf_data.state_count - 1);
-        /* Check if there is a turbo freq in _PSS */
-        if (turbo_pss_ctl <= cpu->pstate.max_pstate &&
-            turbo_pss_ctl > cpu->pstate.min_pstate) {
-                pr_debug("intel_pstate: no turbo range exists in _PSS\n");
-                limits->no_turbo = limits->turbo_disabled = 1;
-                cpu->pstate.turbo_pstate = cpu->pstate.max_pstate;
-                turbo_absent = true;
-        }
-
-        /* Check if the max non turbo p state < Intel P state max */
-        max_pstate_index = turbo_absent ? 0 : 1;
-        max_pss_ctl = convert_to_native_pstate_format(cpu, max_pstate_index);
-        if (max_pss_ctl < cpu->pstate.max_pstate &&
-            max_pss_ctl > cpu->pstate.min_pstate)
-                cpu->pstate.max_pstate = max_pss_ctl;
-
-        /* check If min perf > Intel P State min */
-        if (min_pss_ctl > cpu->pstate.min_pstate &&
-            min_pss_ctl < cpu->pstate.max_pstate) {
-                cpu->pstate.min_pstate = min_pss_ctl;
-                policy->cpuinfo.min_freq = min_pss_ctl * cpu->pstate.scaling;
-        }
-
-        if (turbo_absent)
-                policy->cpuinfo.max_freq = cpu->pstate.max_pstate *
-                                                cpu->pstate.scaling;
-        else {
-                policy->cpuinfo.max_freq = cpu->pstate.turbo_pstate *
-                                                cpu->pstate.scaling;
-                /*
-                 * The _PSS table doesn't contain whole turbo frequency range.
-                 * This just contains +1 MHZ above the max non turbo frequency,
-                 * with control value corresponding to max turbo ratio. But
-                 * when cpufreq set policy is called, it will call with this
-                 * max frequency, which will cause a reduced performance as
-                 * this driver uses real max turbo frequency as the max
-                 * frequeny. So correct this frequency in _PSS table to
-                 * correct max turbo frequency based on the turbo ratio.
-                 * Also need to convert to MHz as _PSS freq is in MHz.
-                 */
-                cpu->acpi_perf_data.states[0].core_frequency =
-                                                turbo_pss_ctl * 100;
-        }
-
-        pr_debug("intel_pstate: Updated limits using _PSS 0x%x 0x%x 0x%x\n",
-                 cpu->pstate.min_pstate, cpu->pstate.max_pstate,
-                 cpu->pstate.turbo_pstate);
-        pr_debug("intel_pstate: policy max_freq=%d Khz min_freq = %d KHz\n",
-                 policy->cpuinfo.max_freq, policy->cpuinfo.min_freq);
-
-        return 0;
-}
-
-static int intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
-{
-        struct cpudata *cpu;
-
-        if (!no_acpi_perf)
-                return 0;
-
-        cpu = all_cpu_data[policy->cpu];
-        acpi_processor_unregister_performance(policy->cpu);
-        return 0;
-}
-
-#else
-static int intel_pstate_init_perf_limits(struct cpufreq_policy *policy)
-{
-        return 0;
-}
-
-static int intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
-{
-        return 0;
-}
-#endif
-
 static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
                              int deadband, int integral) {
         pid->setpoint = setpoint;
@@ -687,31 +528,31 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
         wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
 }
 
-static int byt_get_min_pstate(void)
+static int atom_get_min_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_RATIOS, value);
+        rdmsrl(ATOM_RATIOS, value);
         return (value >> 8) & 0x7F;
 }
 
-static int byt_get_max_pstate(void)
+static int atom_get_max_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_RATIOS, value);
+        rdmsrl(ATOM_RATIOS, value);
         return (value >> 16) & 0x7F;
 }
 
-static int byt_get_turbo_pstate(void)
+static int atom_get_turbo_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_TURBO_RATIOS, value);
+        rdmsrl(ATOM_TURBO_RATIOS, value);
         return value & 0x7F;
 }
 
-static void byt_set_pstate(struct cpudata *cpudata, int pstate)
+static void atom_set_pstate(struct cpudata *cpudata, int pstate)
 {
         u64 val;
         int32_t vid_fp;
@@ -736,27 +577,42 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
         wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
 }
 
-#define BYT_BCLK_FREQS 5
-static int byt_freq_table[BYT_BCLK_FREQS] = { 833, 1000, 1333, 1167, 800};
-
-static int byt_get_scaling(void)
+static int silvermont_get_scaling(void)
 {
         u64 value;
         int i;
+        /* Defined in Table 35-6 from SDM (Sept 2015) */
+        static int silvermont_freq_table[] = {
+                83300, 100000, 133300, 116700, 80000};
 
         rdmsrl(MSR_FSB_FREQ, value);
-        i = value & 0x3;
+        i = value & 0x7;
+        WARN_ON(i > 4);
 
-        BUG_ON(i > BYT_BCLK_FREQS);
+        return silvermont_freq_table[i];
+}
 
-        return byt_freq_table[i] * 100;
+static int airmont_get_scaling(void)
+{
+        u64 value;
+        int i;
+        /* Defined in Table 35-10 from SDM (Sept 2015) */
+        static int airmont_freq_table[] = {
+                83300, 100000, 133300, 116700, 80000,
+                93300, 90000, 88900, 87500};
+
+        rdmsrl(MSR_FSB_FREQ, value);
+        i = value & 0xF;
+        WARN_ON(i > 8);
+
+        return airmont_freq_table[i];
 }
 
-static void byt_get_vid(struct cpudata *cpudata)
+static void atom_get_vid(struct cpudata *cpudata)
 {
         u64 value;
 
-        rdmsrl(BYT_VIDS, value);
+        rdmsrl(ATOM_VIDS, value);
         cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
         cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
         cpudata->vid.ratio = div_fp(
@@ -764,7 +620,7 @@ static void byt_get_vid(struct cpudata *cpudata)
                 int_tofp(cpudata->pstate.max_pstate -
                         cpudata->pstate.min_pstate));
 
-        rdmsrl(BYT_TURBO_VIDS, value);
+        rdmsrl(ATOM_TURBO_VIDS, value);
         cpudata->vid.turbo = value & 0x7f;
 }
 
@@ -885,7 +741,7 @@ static struct cpu_defaults core_params = {
         },
 };
 
-static struct cpu_defaults byt_params = {
+static struct cpu_defaults silvermont_params = {
         .pid_policy = {
                 .sample_rate_ms = 10,
                 .deadband = 0,
@@ -895,13 +751,33 @@ static struct cpu_defaults byt_params = {
                 .i_gain_pct = 4,
         },
         .funcs = {
-                .get_max = byt_get_max_pstate,
-                .get_max_physical = byt_get_max_pstate,
-                .get_min = byt_get_min_pstate,
-                .get_turbo = byt_get_turbo_pstate,
-                .set = byt_set_pstate,
-                .get_scaling = byt_get_scaling,
-                .get_vid = byt_get_vid,
+                .get_max = atom_get_max_pstate,
+                .get_max_physical = atom_get_max_pstate,
+                .get_min = atom_get_min_pstate,
+                .get_turbo = atom_get_turbo_pstate,
+                .set = atom_set_pstate,
+                .get_scaling = silvermont_get_scaling,
+                .get_vid = atom_get_vid,
+        },
+};
+
+static struct cpu_defaults airmont_params = {
+        .pid_policy = {
+                .sample_rate_ms = 10,
+                .deadband = 0,
+                .setpoint = 60,
+                .p_gain_pct = 14,
+                .d_gain_pct = 0,
+                .i_gain_pct = 4,
+        },
+        .funcs = {
+                .get_max = atom_get_max_pstate,
+                .get_max_physical = atom_get_max_pstate,
+                .get_min = atom_get_min_pstate,
+                .get_turbo = atom_get_turbo_pstate,
+                .set = atom_set_pstate,
+                .get_scaling = airmont_get_scaling,
+                .get_vid = atom_get_vid,
         },
 };
 
@@ -938,23 +814,12 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
          * policy, or by cpu specific default values determined through
          * experimentation.
          */
-        if (limits->max_perf_ctl && limits->max_sysfs_pct >=
-                                                limits->max_policy_pct) {
-                *max = limits->max_perf_ctl;
-        } else {
-                max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf),
-                                        limits->max_perf));
-                *max = clamp_t(int, max_perf_adj, cpu->pstate.min_pstate,
-                               cpu->pstate.turbo_pstate);
-        }
+        max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits->max_perf));
+        *max = clamp_t(int, max_perf_adj,
+                        cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
 
-        if (limits->min_perf_ctl) {
-                *min = limits->min_perf_ctl;
-        } else {
-                min_perf = fp_toint(mul_fp(int_tofp(max_perf),
-                                    limits->min_perf));
-                *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
-        }
+        min_perf = fp_toint(mul_fp(int_tofp(max_perf), limits->min_perf));
+        *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
 }
 
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
@@ -1153,7 +1018,7 @@ static void intel_pstate_timer_func(unsigned long __data)
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x2a, core_params),
         ICPU(0x2d, core_params),
-        ICPU(0x37, byt_params),
+        ICPU(0x37, silvermont_params),
         ICPU(0x3a, core_params),
         ICPU(0x3c, core_params),
         ICPU(0x3d, core_params),
@@ -1162,7 +1027,7 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x45, core_params),
         ICPU(0x46, core_params),
         ICPU(0x47, core_params),
-        ICPU(0x4c, byt_params),
+        ICPU(0x4c, airmont_params),
         ICPU(0x4e, core_params),
         ICPU(0x4f, core_params),
         ICPU(0x5e, core_params),
@@ -1229,12 +1094,6 @@ static unsigned int intel_pstate_get(unsigned int cpu_num)
 
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
-#if IS_ENABLED(CONFIG_ACPI)
-        struct cpudata *cpu;
-        int i;
-#endif
-        pr_debug("intel_pstate: %s max %u policy->max %u\n", __func__,
-                 policy->cpuinfo.max_freq, policy->max);
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
 
@@ -1270,23 +1129,6 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         limits->max_perf = div_fp(int_tofp(limits->max_perf_pct),
                                   int_tofp(100));
 
-#if IS_ENABLED(CONFIG_ACPI)
-        cpu = all_cpu_data[policy->cpu];
-        for (i = 0; i < cpu->acpi_perf_data.state_count; i++) {
-                int control;
-
-                control = convert_to_native_pstate_format(cpu, i);
-                if (control * cpu->pstate.scaling == policy->max)
-                        limits->max_perf_ctl = control;
-                if (control * cpu->pstate.scaling == policy->min)
-                        limits->min_perf_ctl = control;
-        }
-
-        pr_debug("intel_pstate: max %u policy_max %u perf_ctl [0x%x-0x%x]\n",
-                 policy->cpuinfo.max_freq, policy->max, limits->min_perf_ctl,
-                 limits->max_perf_ctl);
-#endif
-
         if (hwp_active)
                 intel_pstate_hwp_set();
 
@@ -1341,30 +1183,18 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
         policy->cpuinfo.max_freq =
                 cpu->pstate.turbo_pstate * cpu->pstate.scaling;
-        if (!no_acpi_perf)
-                intel_pstate_init_perf_limits(policy);
-        /*
-         * If there is no acpi perf data or error, we ignore and use Intel P
-         * state calculated limits, So this is not fatal error.
-         */
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         cpumask_set_cpu(policy->cpu, policy->cpus);
 
         return 0;
 }
 
-static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
-{
-        return intel_pstate_exit_perf_limits(policy);
-}
-
 static struct cpufreq_driver intel_pstate_driver = {
         .flags          = CPUFREQ_CONST_LOOPS,
         .verify         = intel_pstate_verify_policy,
         .setpolicy      = intel_pstate_set_policy,
         .get            = intel_pstate_get,
         .init           = intel_pstate_cpu_init,
-        .exit           = intel_pstate_cpu_exit,
         .stop_cpu       = intel_pstate_stop_cpu,
         .name           = "intel_pstate",
 };
@@ -1406,6 +1236,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs)
 }
 
 #if IS_ENABLED(CONFIG_ACPI)
+#include <acpi/processor.h>
 
 static bool intel_pstate_no_acpi_pss(void)
 {
@@ -1601,9 +1432,6 @@ static int __init intel_pstate_setup(char *str)
                 force_load = 1;
         if (!strcmp(str, "hwp_only"))
                 hwp_only = 1;
-        if (!strcmp(str, "no_acpi"))
-                no_acpi_perf = 1;
-
         return 0;
 }
 early_param("intel_pstate", intel_pstate_setup);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 4e55239c7a30..53d22eb73b56 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -729,8 +729,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
                 return NULL;
 
         dev_info(chan2dev(chan),
-                 "%s: src=0x%08x, dest=0x%08x, numf=%d, frame_size=%d, flags=0x%lx\n",
-                __func__, xt->src_start, xt->dst_start, xt->numf,
+                 "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+                __func__, &xt->src_start, &xt->dst_start, xt->numf,
                 xt->frame_size, flags);
 
         /*
@@ -824,8 +824,8 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
         u32                     ctrla;
         u32                     ctrlb;
 
-        dev_vdbg(chan2dev(chan), "prep_dma_memcpy: d0x%x s0x%x l0x%zx f0x%lx\n",
-                        dest, src, len, flags);
+        dev_vdbg(chan2dev(chan), "prep_dma_memcpy: d%pad s%pad l0x%zx f0x%lx\n",
+                        &dest, &src, len, flags);
 
         if (unlikely(!len)) {
                 dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
@@ -938,8 +938,8 @@ atc_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value,
         void __iomem            *vaddr;
         dma_addr_t              paddr;
 
-        dev_vdbg(chan2dev(chan), "%s: d0x%x v0x%x l0x%zx f0x%lx\n", __func__,
-                dest, value, len, flags);
+        dev_vdbg(chan2dev(chan), "%s: d%pad v0x%x l0x%zx f0x%lx\n", __func__,
+                &dest, value, len, flags);
 
         if (unlikely(!len)) {
                 dev_dbg(chan2dev(chan), "%s: length is zero!\n", __func__);
@@ -1022,8 +1022,8 @@ atc_prep_dma_memset_sg(struct dma_chan *chan,
                 dma_addr_t dest = sg_dma_address(sg);
                 size_t len = sg_dma_len(sg);
 
-                dev_vdbg(chan2dev(chan), "%s: d0x%08x, l0x%zx\n",
-                         __func__, dest, len);
+                dev_vdbg(chan2dev(chan), "%s: d%pad, l0x%zx\n",
+                         __func__, &dest, len);
 
                 if (!is_dma_fill_aligned(chan->device, dest, 0, len)) {
                         dev_err(chan2dev(chan), "%s: buffer is not aligned\n",
@@ -1439,9 +1439,9 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
         unsigned int            periods = buf_len / period_len;
         unsigned int            i;
 
-        dev_vdbg(chan2dev(chan), "prep_dma_cyclic: %s buf@0x%08x - %d (%d/%d)\n",
+        dev_vdbg(chan2dev(chan), "prep_dma_cyclic: %s buf@%pad - %d (%d/%d)\n",
                         direction == DMA_MEM_TO_DEV ? "TO DEVICE" : "FROM DEVICE",
-                        buf_addr,
+                        &buf_addr,
                         periods, buf_len, period_len);
 
         if (unlikely(!atslave || !buf_len || !period_len)) {
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index d1cfc8c876f9..7f58f06157f6 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -385,9 +385,9 @@ static void vdbg_dump_regs(struct at_dma_chan *atchan) {}
 static void atc_dump_lli(struct at_dma_chan *atchan, struct at_lli *lli)
 {
         dev_crit(chan2dev(&atchan->chan_common),
-                 "  desc: s0x%x d0x%x ctrl0x%x:0x%x l0x%x\n",
-                 lli->saddr, lli->daddr,
-                 lli->ctrla, lli->ctrlb, lli->dscr);
+                 "  desc: s%pad d%pad ctrl0x%x:0x%x l0x%pad\n",
+                 &lli->saddr, &lli->daddr,
+                 lli->ctrla, lli->ctrlb, &lli->dscr);
 }
 
 
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index b5e132d4bae5..7f039de143f0 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -920,8 +920,8 @@ at_xdmac_interleaved_queue_desc(struct dma_chan *chan,
         desc->lld.mbr_cfg = chan_cc;
 
         dev_dbg(chan2dev(chan),
-                "%s: lld: mbr_sa=0x%08x, mbr_da=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-                __func__, desc->lld.mbr_sa, desc->lld.mbr_da,
+                "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+                __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da,
                 desc->lld.mbr_ubc, desc->lld.mbr_cfg);
 
         /* Chain lld. */
@@ -953,8 +953,8 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
         if ((xt->numf > 1) && (xt->frame_size > 1))
                 return NULL;
 
-        dev_dbg(chan2dev(chan), "%s: src=0x%08x, dest=0x%08x, numf=%d, frame_size=%d, flags=0x%lx\n",
-                __func__, xt->src_start, xt->dst_start, xt->numf,
+        dev_dbg(chan2dev(chan), "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+                __func__, &xt->src_start, &xt->dst_start,       xt->numf,
                 xt->frame_size, flags);
 
         src_addr = xt->src_start;
@@ -1179,8 +1179,8 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan,
         desc->lld.mbr_cfg = chan_cc;
 
         dev_dbg(chan2dev(chan),
-                "%s: lld: mbr_da=0x%08x, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-                __func__, desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
+                "%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+                __func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
                 desc->lld.mbr_cfg);
 
         return desc;
@@ -1193,8 +1193,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value,
         struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
         struct at_xdmac_desc    *desc;
 
-        dev_dbg(chan2dev(chan), "%s: dest=0x%08x, len=%d, pattern=0x%x, flags=0x%lx\n",
-                __func__, dest, len, value, flags);
+        dev_dbg(chan2dev(chan), "%s: dest=%pad, len=%d, pattern=0x%x, flags=0x%lx\n",
+                __func__, &dest, len, value, flags);
 
         if (unlikely(!len))
                 return NULL;
@@ -1229,8 +1229,8 @@ at_xdmac_prep_dma_memset_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
         /* Prepare descriptors. */
         for_each_sg(sgl, sg, sg_len, i) {
-                dev_dbg(chan2dev(chan), "%s: dest=0x%08x, len=%d, pattern=0x%x, flags=0x%lx\n",
-                        __func__, sg_dma_address(sg), sg_dma_len(sg),
+                dev_dbg(chan2dev(chan), "%s: dest=%pad, len=%d, pattern=0x%x, flags=0x%lx\n",
+                        __func__, &sg_dma_address(sg), sg_dma_len(sg),
                         value, flags);
                 desc = at_xdmac_memset_create_desc(chan, atchan,
                                                    sg_dma_address(sg),
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 6b03e4e84e6b..0675e268d577 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -107,7 +107,7 @@
 
 /* CCCFG register */
 #define GET_NUM_DMACH(x)        (x & 0x7) /* bits 0-2 */
-#define GET_NUM_QDMACH(x)       (x & 0x70 >> 4) /* bits 4-6 */
+#define GET_NUM_QDMACH(x)       ((x & 0x70) >> 4) /* bits 4-6 */
 #define GET_NUM_PAENTRY(x)      ((x & 0x7000) >> 12) /* bits 12-14 */
 #define GET_NUM_EVQUE(x)        ((x & 0x70000) >> 16) /* bits 16-18 */
 #define GET_NUM_REGN(x)         ((x & 0x300000) >> 20) /* bits 20-21 */
@@ -1565,7 +1565,7 @@ static void edma_tc_set_pm_state(struct edma_tc *tc, bool enable)
         struct platform_device *tc_pdev;
         int ret;
 
-        if (!tc)
+        if (!IS_ENABLED(CONFIG_OF) || !tc)
                 return;
 
         tc_pdev = of_find_device_by_node(tc->node);
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 7058d58ba588..0f6fd42f55ca 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1462,7 +1462,7 @@ err_firmware:
 
 #define EVENT_REMAP_CELLS 3
 
-static int __init sdma_event_remap(struct sdma_engine *sdma)
+static int sdma_event_remap(struct sdma_engine *sdma)
 {
         struct device_node *np = sdma->dev->of_node;
         struct device_node *gpr_np = of_parse_phandle(np, "gpr", 0);
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index ebd8a5f398b0..f1bcc2a163b3 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -679,8 +679,11 @@ static int usb_dmac_runtime_suspend(struct device *dev)
         struct usb_dmac *dmac = dev_get_drvdata(dev);
         int i;
 
-        for (i = 0; i < dmac->n_channels; ++i)
+        for (i = 0; i < dmac->n_channels; ++i) {
+                if (!dmac->channels[i].iomem)
+                        break;
                 usb_dmac_chan_halt(&dmac->channels[i]);
+        }
 
         return 0;
 }
@@ -799,11 +802,10 @@ static int usb_dmac_probe(struct platform_device *pdev)
         ret = pm_runtime_get_sync(&pdev->dev);
         if (ret < 0) {
                 dev_err(&pdev->dev, "runtime PM get sync failed (%d)\n", ret);
-                return ret;
+                goto error_pm;
         }
 
         ret = usb_dmac_init(dmac);
-        pm_runtime_put(&pdev->dev);
 
         if (ret) {
                 dev_err(&pdev->dev, "failed to reset device\n");
@@ -851,10 +853,13 @@ static int usb_dmac_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto error;
 
+        pm_runtime_put(&pdev->dev);
         return 0;
 
 error:
         of_dma_controller_free(pdev->dev.of_node);
+        pm_runtime_put(&pdev->dev);
+error_pm:
         pm_runtime_disable(&pdev->dev);
         return ret;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 615ce6d464fb..306f75700bf8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -389,7 +389,6 @@ struct amdgpu_clock {
  * Fences.
  */
 struct amdgpu_fence_driver {
-        struct amdgpu_ring              *ring;
         uint64_t                        gpu_addr;
         volatile uint32_t               *cpu_addr;
         /* sync_seq is protected by ring emission lock */
@@ -398,7 +397,7 @@ struct amdgpu_fence_driver {
         bool                            initialized;
         struct amdgpu_irq_src           *irq_src;
         unsigned                        irq_type;
-        struct delayed_work             lockup_work;
+        struct timer_list               fallback_timer;
         wait_queue_head_t               fence_queue;
 };
 
@@ -917,8 +916,8 @@ struct amdgpu_ring {
 #define AMDGPU_VM_FAULT_STOP_ALWAYS     2
 
 struct amdgpu_vm_pt {
-        struct amdgpu_bo                *bo;
-        uint64_t                        addr;
+        struct amdgpu_bo        *bo;
+        uint64_t                addr;
 };
 
 struct amdgpu_vm_id {
@@ -926,8 +925,6 @@ struct amdgpu_vm_id {
         uint64_t                pd_gpu_addr;
         /* last flushed PD/PT update */
         struct fence            *flushed_updates;
-        /* last use of vmid */
-        struct fence            *last_id_use;
 };
 
 struct amdgpu_vm {
@@ -957,24 +954,70 @@ struct amdgpu_vm {
 
         /* for id and flush management per ring */
         struct amdgpu_vm_id     ids[AMDGPU_MAX_RINGS];
+        /* for interval tree */
+        spinlock_t              it_lock;
 };
 
 struct amdgpu_vm_manager {
-        struct fence                    *active[AMDGPU_NUM_VM];
-        uint32_t                        max_pfn;
+        struct {
+                struct fence    *active;
+                atomic_long_t   owner;
+        } ids[AMDGPU_NUM_VM];
+
+        uint32_t                                max_pfn;
         /* number of VMIDs */
-        unsigned                        nvm;
+        unsigned                                nvm;
         /* vram base address for page table entry  */
-        u64                             vram_base_offset;
+        u64                                     vram_base_offset;
         /* is vm enabled? */
-        bool                            enabled;
-        /* for hw to save the PD addr on suspend/resume */
-        uint32_t                        saved_table_addr[AMDGPU_NUM_VM];
+        bool                                    enabled;
         /* vm pte handling */
         const struct amdgpu_vm_pte_funcs        *vm_pte_funcs;
         struct amdgpu_ring                      *vm_pte_funcs_ring;
 };
 
+void amdgpu_vm_manager_fini(struct amdgpu_device *adev);
+int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm);
+void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm);
+struct amdgpu_bo_list_entry *amdgpu_vm_get_bos(struct amdgpu_device *adev,
+                                               struct amdgpu_vm *vm,
+                                               struct list_head *head);
+int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
+                      struct amdgpu_sync *sync);
+void amdgpu_vm_flush(struct amdgpu_ring *ring,
+                     struct amdgpu_vm *vm,
+                     struct fence *updates);
+void amdgpu_vm_fence(struct amdgpu_device *adev,
+                     struct amdgpu_vm *vm,
+                     struct fence *fence);
+uint64_t amdgpu_vm_map_gart(struct amdgpu_device *adev, uint64_t addr);
+int amdgpu_vm_update_page_directory(struct amdgpu_device *adev,
+                                    struct amdgpu_vm *vm);
+int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
+                          struct amdgpu_vm *vm);
+int amdgpu_vm_clear_invalids(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+                             struct amdgpu_sync *sync);
+int amdgpu_vm_bo_update(struct amdgpu_device *adev,
+                        struct amdgpu_bo_va *bo_va,
+                        struct ttm_mem_reg *mem);
+void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev,
+                             struct amdgpu_bo *bo);
+struct amdgpu_bo_va *amdgpu_vm_bo_find(struct amdgpu_vm *vm,
+                                       struct amdgpu_bo *bo);
+struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
+                                      struct amdgpu_vm *vm,
+                                      struct amdgpu_bo *bo);
+int amdgpu_vm_bo_map(struct amdgpu_device *adev,
+                     struct amdgpu_bo_va *bo_va,
+                     uint64_t addr, uint64_t offset,
+                     uint64_t size, uint32_t flags);
+int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
+                       struct amdgpu_bo_va *bo_va,
+                       uint64_t addr);
+void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
+                      struct amdgpu_bo_va *bo_va);
+int amdgpu_vm_free_job(struct amdgpu_job *job);
+
 /*
  * context related structures
  */
@@ -1211,6 +1254,7 @@ struct amdgpu_cs_parser {
         /* relocations */
         struct amdgpu_bo_list_entry     *vm_bos;
         struct list_head        validated;
+        struct fence            *fence;
 
         struct amdgpu_ib        *ibs;
         uint32_t                num_ibs;
@@ -1226,7 +1270,7 @@ struct amdgpu_job {
         struct amdgpu_device    *adev;
         struct amdgpu_ib        *ibs;
         uint32_t                num_ibs;
-        struct mutex            job_lock;
+        void                    *owner;
         struct amdgpu_user_fence uf;
         int (*free_job)(struct amdgpu_job *job);
 };
@@ -2257,11 +2301,6 @@ void amdgpu_pci_config_reset(struct amdgpu_device *adev);
 bool amdgpu_card_posted(struct amdgpu_device *adev);
 void amdgpu_update_display_priority(struct amdgpu_device *adev);
 bool amdgpu_boot_test_post_card(struct amdgpu_device *adev);
-struct amdgpu_cs_parser *amdgpu_cs_parser_create(struct amdgpu_device *adev,
-                                                 struct drm_file *filp,
-                                                 struct amdgpu_ctx *ctx,
-                                                 struct amdgpu_ib *ibs,
-                                                 uint32_t num_ibs);
 
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data);
 int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
@@ -2319,49 +2358,6 @@ long amdgpu_kms_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
 
 /*
- * vm
- */
-int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm);
-void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm);
-struct amdgpu_bo_list_entry *amdgpu_vm_get_bos(struct amdgpu_device *adev,
-                                          struct amdgpu_vm *vm,
-                                          struct list_head *head);
-int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
-                      struct amdgpu_sync *sync);
-void amdgpu_vm_flush(struct amdgpu_ring *ring,
-                     struct amdgpu_vm *vm,
-                     struct fence *updates);
-void amdgpu_vm_fence(struct amdgpu_device *adev,
-                     struct amdgpu_vm *vm,
-                     struct amdgpu_fence *fence);
-uint64_t amdgpu_vm_map_gart(struct amdgpu_device *adev, uint64_t addr);
-int amdgpu_vm_update_page_directory(struct amdgpu_device *adev,
-                                    struct amdgpu_vm *vm);
-int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
-                                struct amdgpu_vm *vm);
-int amdgpu_vm_clear_invalids(struct amdgpu_device *adev,
-                                struct amdgpu_vm *vm, struct amdgpu_sync *sync);
-int amdgpu_vm_bo_update(struct amdgpu_device *adev,
-                        struct amdgpu_bo_va *bo_va,
-                        struct ttm_mem_reg *mem);
-void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev,
-                             struct amdgpu_bo *bo);
-struct amdgpu_bo_va *amdgpu_vm_bo_find(struct amdgpu_vm *vm,
-                                       struct amdgpu_bo *bo);
-struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
-                                      struct amdgpu_vm *vm,
-                                      struct amdgpu_bo *bo);
-int amdgpu_vm_bo_map(struct amdgpu_device *adev,
-                     struct amdgpu_bo_va *bo_va,
-                     uint64_t addr, uint64_t offset,
-                     uint64_t size, uint32_t flags);
-int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
-                       struct amdgpu_bo_va *bo_va,
-                       uint64_t addr);
-void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
-                      struct amdgpu_bo_va *bo_va);
-int amdgpu_vm_free_job(struct amdgpu_job *job);
-/*
  * functions used by amdgpu_encoder.c
  */
 struct amdgpu_afmt_acr {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index dfc4d02c7a38..3afcf0237c25 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -127,30 +127,6 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
         return 0;
 }
 
-struct amdgpu_cs_parser *amdgpu_cs_parser_create(struct amdgpu_device *adev,
-                                               struct drm_file *filp,
-                                               struct amdgpu_ctx *ctx,
-                                               struct amdgpu_ib *ibs,
-                                               uint32_t num_ibs)
-{
-        struct amdgpu_cs_parser *parser;
-        int i;
-
-        parser = kzalloc(sizeof(struct amdgpu_cs_parser), GFP_KERNEL);
-        if (!parser)
-                return NULL;
-
-        parser->adev = adev;
-        parser->filp = filp;
-        parser->ctx = ctx;
-        parser->ibs = ibs;
-        parser->num_ibs = num_ibs;
-        for (i = 0; i < num_ibs; i++)
-                ibs[i].ctx = ctx;
-
-        return parser;
-}
-
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 {
         union drm_amdgpu_cs *cs = data;
@@ -463,8 +439,18 @@ static int cmp_size_smaller_first(void *priv, struct list_head *a,
         return (int)la->robj->tbo.num_pages - (int)lb->robj->tbo.num_pages;
 }
 
-static void amdgpu_cs_parser_fini_early(struct amdgpu_cs_parser *parser, int error, bool backoff)
+/**
+ * cs_parser_fini() - clean parser states
+ * @parser:     parser structure holding parsing context.
+ * @error:      error number
+ *
+ * If error is set than unvalidate buffer, otherwise just free memory
+ * used by parsing context.
+ **/
+static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bool backoff)
 {
+        unsigned i;
+
         if (!error) {
                 /* Sort the buffer list from the smallest to largest buffer,
                  * which affects the order of buffers in the LRU list.
@@ -479,17 +465,14 @@ static void amdgpu_cs_parser_fini_early(struct amdgpu_cs_parser *parser, int err
                 list_sort(NULL, &parser->validated, cmp_size_smaller_first);
 
                 ttm_eu_fence_buffer_objects(&parser->ticket,
-                                &parser->validated,
-                                &parser->ibs[parser->num_ibs-1].fence->base);
+                                            &parser->validated,
+                                            parser->fence);
         } else if (backoff) {
                 ttm_eu_backoff_reservation(&parser->ticket,
                                            &parser->validated);
         }
-}
+        fence_put(parser->fence);
 
-static void amdgpu_cs_parser_fini_late(struct amdgpu_cs_parser *parser)
-{
-        unsigned i;
         if (parser->ctx)
                 amdgpu_ctx_put(parser->ctx);
         if (parser->bo_list)
@@ -499,31 +482,12 @@ static void amdgpu_cs_parser_fini_late(struct amdgpu_cs_parser *parser)
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
-        if (!amdgpu_enable_scheduler)
-        {
-                if (parser->ibs)
-                        for (i = 0; i < parser->num_ibs; i++)
-                                amdgpu_ib_free(parser->adev, &parser->ibs[i]);
-                kfree(parser->ibs);
-                if (parser->uf.bo)
-                        drm_gem_object_unreference_unlocked(&parser->uf.bo->gem_base);
-        }
-
-        kfree(parser);
-}
-
-/**
- * cs_parser_fini() - clean parser states
- * @parser:     parser structure holding parsing context.
- * @error:      error number
- *
- * If error is set than unvalidate buffer, otherwise just free memory
- * used by parsing context.
- **/
-static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bool backoff)
-{
-       amdgpu_cs_parser_fini_early(parser, error, backoff);
-       amdgpu_cs_parser_fini_late(parser);
+        if (parser->ibs)
+                for (i = 0; i < parser->num_ibs; i++)
+                        amdgpu_ib_free(parser->adev, &parser->ibs[i]);
+        kfree(parser->ibs);
+        if (parser->uf.bo)
+                drm_gem_object_unreference_unlocked(&parser->uf.bo->gem_base);
 }
 
 static int amdgpu_bo_vm_update_pte(struct amdgpu_cs_parser *p,
@@ -610,15 +574,9 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
         }
 
         r = amdgpu_bo_vm_update_pte(parser, vm);
-        if (r) {
-                goto out;
-        }
-        amdgpu_cs_sync_rings(parser);
-        if (!amdgpu_enable_scheduler)
-                r = amdgpu_ib_schedule(adev, parser->num_ibs, parser->ibs,
-                                       parser->filp);
+        if (!r)
+                amdgpu_cs_sync_rings(parser);
 
-out:
         return r;
 }
 
@@ -828,36 +786,36 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         union drm_amdgpu_cs *cs = data;
         struct amdgpu_fpriv *fpriv = filp->driver_priv;
         struct amdgpu_vm *vm = &fpriv->vm;
-        struct amdgpu_cs_parser *parser;
+        struct amdgpu_cs_parser parser = {};
         bool reserved_buffers = false;
         int i, r;
 
         if (!adev->accel_working)
                 return -EBUSY;
 
-        parser = amdgpu_cs_parser_create(adev, filp, NULL, NULL, 0);
-        if (!parser)
-                return -ENOMEM;
-        r = amdgpu_cs_parser_init(parser, data);
+        parser.adev = adev;
+        parser.filp = filp;
+
+        r = amdgpu_cs_parser_init(&parser, data);
         if (r) {
                 DRM_ERROR("Failed to initialize parser !\n");
-                amdgpu_cs_parser_fini(parser, r, false);
+                amdgpu_cs_parser_fini(&parser, r, false);
                 r = amdgpu_cs_handle_lockup(adev, r);
                 return r;
         }
         mutex_lock(&vm->mutex);
-        r = amdgpu_cs_parser_relocs(parser);
+        r = amdgpu_cs_parser_relocs(&parser);
         if (r == -ENOMEM)
                 DRM_ERROR("Not enough memory for command submission!\n");
         else if (r && r != -ERESTARTSYS)
                 DRM_ERROR("Failed to process the buffer list %d!\n", r);
         else if (!r) {
                 reserved_buffers = true;
-                r = amdgpu_cs_ib_fill(adev, parser);
+                r = amdgpu_cs_ib_fill(adev, &parser);
         }
 
         if (!r) {
-                r = amdgpu_cs_dependencies(adev, parser);
+                r = amdgpu_cs_dependencies(adev, &parser);
                 if (r)
                         DRM_ERROR("Failed in the dependencies handling %d!\n", r);
         }
@@ -865,62 +823,71 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         if (r)
                 goto out;
 
-        for (i = 0; i < parser->num_ibs; i++)
-                trace_amdgpu_cs(parser, i);
+        for (i = 0; i < parser.num_ibs; i++)
+                trace_amdgpu_cs(&parser, i);
 
-        r = amdgpu_cs_ib_vm_chunk(adev, parser);
+        r = amdgpu_cs_ib_vm_chunk(adev, &parser);
         if (r)
                 goto out;
 
-        if (amdgpu_enable_scheduler && parser->num_ibs) {
+        if (amdgpu_enable_scheduler && parser.num_ibs) {
+                struct amdgpu_ring * ring = parser.ibs->ring;
+                struct amd_sched_fence *fence;
                 struct amdgpu_job *job;
-                struct amdgpu_ring * ring =  parser->ibs->ring;
+
                 job = kzalloc(sizeof(struct amdgpu_job), GFP_KERNEL);
                 if (!job) {
                         r = -ENOMEM;
                         goto out;
                 }
+
                 job->base.sched = &ring->sched;
-                job->base.s_entity = &parser->ctx->rings[ring->idx].entity;
-                job->adev = parser->adev;
-                job->ibs = parser->ibs;
-                job->num_ibs = parser->num_ibs;
-                job->base.owner = parser->filp;
-                mutex_init(&job->job_lock);
+                job->base.s_entity = &parser.ctx->rings[ring->idx].entity;
+                job->adev = parser.adev;
+                job->owner = parser.filp;
+                job->free_job = amdgpu_cs_free_job;
+
+                job->ibs = parser.ibs;
+                job->num_ibs = parser.num_ibs;
+                parser.ibs = NULL;
+                parser.num_ibs = 0;
+
                 if (job->ibs[job->num_ibs - 1].user) {
-                        memcpy(&job->uf,  &parser->uf,
-                               sizeof(struct amdgpu_user_fence));
+                        job->uf = parser.uf;
                         job->ibs[job->num_ibs - 1].user = &job->uf;
+                        parser.uf.bo = NULL;
                 }
 
-                job->free_job = amdgpu_cs_free_job;
-                mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job(&job->base);
-                if (r) {
-                        mutex_unlock(&job->job_lock);
+                fence = amd_sched_fence_create(job->base.s_entity,
+                                               parser.filp);
+                if (!fence) {
+                        r = -ENOMEM;
                         amdgpu_cs_free_job(job);
                         kfree(job);
                         goto out;
                 }
-                cs->out.handle =
-                        amdgpu_ctx_add_fence(parser->ctx, ring,
-                                             &job->base.s_fence->base);
-                parser->ibs[parser->num_ibs - 1].sequence = cs->out.handle;
+                job->base.s_fence = fence;
+                parser.fence = fence_get(&fence->base);
 
-                list_sort(NULL, &parser->validated, cmp_size_smaller_first);
-                ttm_eu_fence_buffer_objects(&parser->ticket,
-                                &parser->validated,
-                                &job->base.s_fence->base);
+                cs->out.handle = amdgpu_ctx_add_fence(parser.ctx, ring,
+                                                      &fence->base);
+                job->ibs[job->num_ibs - 1].sequence = cs->out.handle;
 
-                mutex_unlock(&job->job_lock);
-                amdgpu_cs_parser_fini_late(parser);
-                mutex_unlock(&vm->mutex);
-                return 0;
+                trace_amdgpu_cs_ioctl(job);
+                amd_sched_entity_push_job(&job->base);
+
+        } else {
+                struct amdgpu_fence *fence;
+
+                r = amdgpu_ib_schedule(adev, parser.num_ibs, parser.ibs,
+                                       parser.filp);
+                fence = parser.ibs[parser.num_ibs - 1].fence;
+                parser.fence = fence_get(&fence->base);
+                cs->out.handle = parser.ibs[parser.num_ibs - 1].sequence;
         }
 
-        cs->out.handle = parser->ibs[parser->num_ibs - 1].sequence;
 out:
-        amdgpu_cs_parser_fini(parser, r, reserved_buffers);
+        amdgpu_cs_parser_fini(&parser, r, reserved_buffers);
         mutex_unlock(&vm->mutex);
         r = amdgpu_cs_handle_lockup(adev, r);
         return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 257d72205bb5..3671f9f220bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -47,6 +47,9 @@
  * that the the relevant GPU caches have been flushed.
  */
 
+static struct kmem_cache *amdgpu_fence_slab;
+static atomic_t amdgpu_fence_slab_ref = ATOMIC_INIT(0);
+
 /**
  * amdgpu_fence_write - write a fence value
  *
@@ -85,24 +88,6 @@ static u32 amdgpu_fence_read(struct amdgpu_ring *ring)
 }
 
 /**
- * amdgpu_fence_schedule_check - schedule lockup check
- *
- * @ring: pointer to struct amdgpu_ring
- *
- * Queues a delayed work item to check for lockups.
- */
-static void amdgpu_fence_schedule_check(struct amdgpu_ring *ring)
-{
-        /*
-         * Do not reset the timer here with mod_delayed_work,
-         * this can livelock in an interaction with TTM delayed destroy.
-         */
-        queue_delayed_work(system_power_efficient_wq,
-                &ring->fence_drv.lockup_work,
-                AMDGPU_FENCE_JIFFIES_TIMEOUT);
-}
-
-/**
  * amdgpu_fence_emit - emit a fence on the requested ring
  *
  * @ring: ring the fence is associated with
@@ -118,7 +103,7 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, void *owner,
         struct amdgpu_device *adev = ring->adev;
 
         /* we are protected by the ring emission mutex */
-        *fence = kmalloc(sizeof(struct amdgpu_fence), GFP_KERNEL);
+        *fence = kmem_cache_alloc(amdgpu_fence_slab, GFP_KERNEL);
         if ((*fence) == NULL) {
                 return -ENOMEM;
         }
@@ -132,11 +117,23 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, void *owner,
         amdgpu_ring_emit_fence(ring, ring->fence_drv.gpu_addr,
                                (*fence)->seq,
                                AMDGPU_FENCE_FLAG_INT);
-        trace_amdgpu_fence_emit(ring->adev->ddev, ring->idx, (*fence)->seq);
         return 0;
 }
 
 /**
+ * amdgpu_fence_schedule_fallback - schedule fallback check
+ *
+ * @ring: pointer to struct amdgpu_ring
+ *
+ * Start a timer as fallback to our interrupts.
+ */
+static void amdgpu_fence_schedule_fallback(struct amdgpu_ring *ring)
+{
+        mod_timer(&ring->fence_drv.fallback_timer,
+                  jiffies + AMDGPU_FENCE_JIFFIES_TIMEOUT);
+}
+
+/**
  * amdgpu_fence_activity - check for fence activity
  *
  * @ring: pointer to struct amdgpu_ring
@@ -202,45 +199,38 @@ static bool amdgpu_fence_activity(struct amdgpu_ring *ring)
         } while (atomic64_xchg(&ring->fence_drv.last_seq, seq) > seq);
 
         if (seq < last_emitted)
-                amdgpu_fence_schedule_check(ring);
+                amdgpu_fence_schedule_fallback(ring);
 
         return wake;
 }
 
 /**
- * amdgpu_fence_check_lockup - check for hardware lockup
+ * amdgpu_fence_process - process a fence
  *
- * @work: delayed work item
+ * @adev: amdgpu_device pointer
+ * @ring: ring index the fence is associated with
  *
- * Checks for fence activity and if there is none probe
- * the hardware if a lockup occured.
+ * Checks the current fence value and wakes the fence queue
+ * if the sequence number has increased (all asics).
  */
-static void amdgpu_fence_check_lockup(struct work_struct *work)
+void amdgpu_fence_process(struct amdgpu_ring *ring)
 {
-        struct amdgpu_fence_driver *fence_drv;
-        struct amdgpu_ring *ring;
-
-        fence_drv = container_of(work, struct amdgpu_fence_driver,
-                                lockup_work.work);
-        ring = fence_drv->ring;
-
         if (amdgpu_fence_activity(ring))
                 wake_up_all(&ring->fence_drv.fence_queue);
 }
 
 /**
- * amdgpu_fence_process - process a fence
+ * amdgpu_fence_fallback - fallback for hardware interrupts
  *
- * @adev: amdgpu_device pointer
- * @ring: ring index the fence is associated with
+ * @work: delayed work item
  *
- * Checks the current fence value and wakes the fence queue
- * if the sequence number has increased (all asics).
+ * Checks for fence activity.
  */
-void amdgpu_fence_process(struct amdgpu_ring *ring)
+static void amdgpu_fence_fallback(unsigned long arg)
 {
-        if (amdgpu_fence_activity(ring))
-                wake_up_all(&ring->fence_drv.fence_queue);
+        struct amdgpu_ring *ring = (void *)arg;
+
+        amdgpu_fence_process(ring);
 }
 
 /**
@@ -290,7 +280,7 @@ static int amdgpu_fence_ring_wait_seq(struct amdgpu_ring *ring, uint64_t seq)
         if (atomic64_read(&ring->fence_drv.last_seq) >= seq)
                 return 0;
 
-        amdgpu_fence_schedule_check(ring);
+        amdgpu_fence_schedule_fallback(ring);
         wait_event(ring->fence_drv.fence_queue, (
                    (signaled = amdgpu_fence_seq_signaled(ring, seq))));
 
@@ -491,9 +481,8 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
         atomic64_set(&ring->fence_drv.last_seq, 0);
         ring->fence_drv.initialized = false;
 
-        INIT_DELAYED_WORK(&ring->fence_drv.lockup_work,
-                        amdgpu_fence_check_lockup);
-        ring->fence_drv.ring = ring;
+        setup_timer(&ring->fence_drv.fallback_timer, amdgpu_fence_fallback,
+                    (unsigned long)ring);
 
         init_waitqueue_head(&ring->fence_drv.fence_queue);
 
@@ -536,6 +525,13 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
  */
 int amdgpu_fence_driver_init(struct amdgpu_device *adev)
 {
+        if (atomic_inc_return(&amdgpu_fence_slab_ref) == 1) {
+                amdgpu_fence_slab = kmem_cache_create(
+                        "amdgpu_fence", sizeof(struct amdgpu_fence), 0,
+                        SLAB_HWCACHE_ALIGN, NULL);
+                if (!amdgpu_fence_slab)
+                        return -ENOMEM;
+        }
         if (amdgpu_debugfs_fence_init(adev))
                 dev_err(adev->dev, "fence debugfs file creation failed\n");
 
@@ -554,9 +550,12 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
 {
         int i, r;
 
+        if (atomic_dec_and_test(&amdgpu_fence_slab_ref))
+                kmem_cache_destroy(amdgpu_fence_slab);
         mutex_lock(&adev->ring_lock);
         for (i = 0; i < AMDGPU_MAX_RINGS; i++) {
                 struct amdgpu_ring *ring = adev->rings[i];
+
                 if (!ring || !ring->fence_drv.initialized)
                         continue;
                 r = amdgpu_fence_wait_empty(ring);
@@ -568,6 +567,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
                 amdgpu_irq_put(adev, ring->fence_drv.irq_src,
                                ring->fence_drv.irq_type);
                 amd_sched_fini(&ring->sched);
+                del_timer_sync(&ring->fence_drv.fallback_timer);
                 ring->fence_drv.initialized = false;
         }
         mutex_unlock(&adev->ring_lock);
@@ -751,18 +751,25 @@ static bool amdgpu_fence_enable_signaling(struct fence *f)
         fence->fence_wake.func = amdgpu_fence_check_signaled;
         __add_wait_queue(&ring->fence_drv.fence_queue, &fence->fence_wake);
         fence_get(f);
-        amdgpu_fence_schedule_check(ring);
+        if (!timer_pending(&ring->fence_drv.fallback_timer))
+                amdgpu_fence_schedule_fallback(ring);
         FENCE_TRACE(&fence->base, "armed on ring %i!\n", ring->idx);
         return true;
 }
 
+static void amdgpu_fence_release(struct fence *f)
+{
+        struct amdgpu_fence *fence = to_amdgpu_fence(f);
+        kmem_cache_free(amdgpu_fence_slab, fence);
+}
+
 const struct fence_ops amdgpu_fence_ops = {
         .get_driver_name = amdgpu_fence_get_driver_name,
         .get_timeline_name = amdgpu_fence_get_timeline_name,
         .enable_signaling = amdgpu_fence_enable_signaling,
         .signaled = amdgpu_fence_is_signaled,
         .wait = fence_default_wait,
-        .release = NULL,
+        .release = amdgpu_fence_release,
 };
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 087332858853..00c5b580f56c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -483,6 +483,9 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
                 if (domain == AMDGPU_GEM_DOMAIN_CPU)
                         goto error_unreserve;
         }
+        r = amdgpu_vm_update_page_directory(adev, bo_va->vm);
+        if (r)
+                goto error_unreserve;
 
         r = amdgpu_vm_clear_freed(adev, bo_va->vm);
         if (r)
@@ -512,6 +515,9 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         struct amdgpu_fpriv *fpriv = filp->driver_priv;
         struct amdgpu_bo *rbo;
         struct amdgpu_bo_va *bo_va;
+        struct ttm_validate_buffer tv, tv_pd;
+        struct ww_acquire_ctx ticket;
+        struct list_head list, duplicates;
         uint32_t invalid_flags, va_flags = 0;
         int r = 0;
 
@@ -549,7 +555,18 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         mutex_lock(&fpriv->vm.mutex);
         rbo = gem_to_amdgpu_bo(gobj);
-        r = amdgpu_bo_reserve(rbo, false);
+        INIT_LIST_HEAD(&list);
+        INIT_LIST_HEAD(&duplicates);
+        tv.bo = &rbo->tbo;
+        tv.shared = true;
+        list_add(&tv.head, &list);
+
+        if (args->operation == AMDGPU_VA_OP_MAP) {
+                tv_pd.bo = &fpriv->vm.page_directory->tbo;
+                tv_pd.shared = true;
+                list_add(&tv_pd.head, &list);
+        }
+        r = ttm_eu_reserve_buffers(&ticket, &list, true, &duplicates);
         if (r) {
                 mutex_unlock(&fpriv->vm.mutex);
                 drm_gem_object_unreference_unlocked(gobj);
@@ -558,7 +575,8 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
 
         bo_va = amdgpu_vm_bo_find(&fpriv->vm, rbo);
         if (!bo_va) {
-                amdgpu_bo_unreserve(rbo);
+                ttm_eu_backoff_reservation(&ticket, &list);
+                drm_gem_object_unreference_unlocked(gobj);
                 mutex_unlock(&fpriv->vm.mutex);
                 return -ENOENT;
         }
@@ -581,7 +599,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         default:
                 break;
         }
-
+        ttm_eu_backoff_reservation(&ticket, &list);
         if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE))
                 amdgpu_gem_va_update_vm(adev, bo_va, args->operation);
         mutex_unlock(&fpriv->vm.mutex);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index e65987743871..9e25edafa721 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -62,7 +62,7 @@ int amdgpu_ib_get(struct amdgpu_ring *ring, struct amdgpu_vm *vm,
         int r;
 
         if (size) {
-                r = amdgpu_sa_bo_new(adev, &adev->ring_tmp_bo,
+                r = amdgpu_sa_bo_new(&adev->ring_tmp_bo,
                                       &ib->sa_bo, size, 256);
                 if (r) {
                         dev_err(adev->dev, "failed to get a new IB (%d)\n", r);
@@ -216,7 +216,7 @@ int amdgpu_ib_schedule(struct amdgpu_device *adev, unsigned num_ibs,
         }
 
         if (ib->vm)
-                amdgpu_vm_fence(adev, ib->vm, ib->fence);
+                amdgpu_vm_fence(adev, ib->vm, &ib->fence->base);
 
         amdgpu_ring_unlock_commit(ring);
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
index 3c2ff4567798..ea756e77b023 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
@@ -189,10 +189,9 @@ int amdgpu_sa_bo_manager_start(struct amdgpu_device *adev,
                                       struct amdgpu_sa_manager *sa_manager);
 int amdgpu_sa_bo_manager_suspend(struct amdgpu_device *adev,
                                         struct amdgpu_sa_manager *sa_manager);
-int amdgpu_sa_bo_new(struct amdgpu_device *adev,
-                            struct amdgpu_sa_manager *sa_manager,
-                            struct amdgpu_sa_bo **sa_bo,
-                            unsigned size, unsigned align);
+int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
+                     struct amdgpu_sa_bo **sa_bo,
+                     unsigned size, unsigned align);
 void amdgpu_sa_bo_free(struct amdgpu_device *adev,
                               struct amdgpu_sa_bo **sa_bo,
                               struct fence *fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 0212b31dc194..8b88edb0434b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -311,8 +311,7 @@ static bool amdgpu_sa_bo_next_hole(struct amdgpu_sa_manager *sa_manager,
         return false;
 }
 
-int amdgpu_sa_bo_new(struct amdgpu_device *adev,
-                     struct amdgpu_sa_manager *sa_manager,
+int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
                      struct amdgpu_sa_bo **sa_bo,
                      unsigned size, unsigned align)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
index dcf4a8aca680..438c05254695 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <drm/drmP.h>
 #include "amdgpu.h"
+#include "amdgpu_trace.h"
 
 static struct fence *amdgpu_sched_dependency(struct amd_sched_job *sched_job)
 {
@@ -44,11 +45,8 @@ static struct fence *amdgpu_sched_run_job(struct amd_sched_job *sched_job)
                 return NULL;
         }
         job = to_amdgpu_job(sched_job);
-        mutex_lock(&job->job_lock);
-        r = amdgpu_ib_schedule(job->adev,
-                               job->num_ibs,
-                               job->ibs,
-                               job->base.owner);
+        trace_amdgpu_sched_run_job(job);
+        r = amdgpu_ib_schedule(job->adev, job->num_ibs, job->ibs, job->owner);
         if (r) {
                 DRM_ERROR("Error scheduling IBs (%d)\n", r);
                 goto err;
@@ -61,8 +59,6 @@ err:
         if (job->free_job)
                 job->free_job(job);
 
-        mutex_unlock(&job->job_lock);
-        fence_put(&job->base.s_fence->base);
         kfree(job);
         return fence ? &fence->base : NULL;
 }
@@ -88,21 +84,19 @@ int amdgpu_sched_ib_submit_kernel_helper(struct amdgpu_device *adev,
                         return -ENOMEM;
                 job->base.sched = &ring->sched;
                 job->base.s_entity = &adev->kernel_ctx.rings[ring->idx].entity;
+                job->base.s_fence = amd_sched_fence_create(job->base.s_entity, owner);
+                if (!job->base.s_fence) {
+                        kfree(job);
+                        return -ENOMEM;
+                }
+                *f = fence_get(&job->base.s_fence->base);
+
                 job->adev = adev;
                 job->ibs = ibs;
                 job->num_ibs = num_ibs;
-                job->base.owner = owner;
-                mutex_init(&job->job_lock);
+                job->owner = owner;
                 job->free_job = free_job;
-                mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job(&job->base);
-                if (r) {
-                        mutex_unlock(&job->job_lock);
-                        kfree(job);
-                        return r;
-                }
-                *f = fence_get(&job->base.s_fence->base);
-                mutex_unlock(&job->job_lock);
+                amd_sched_entity_push_job(&job->base);
         } else {
                 r = amdgpu_ib_schedule(adev, num_ibs, ibs, owner);
                 if (r)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
index ff3ca52ec6fe..1caaf201b708 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
@@ -40,7 +40,7 @@ int amdgpu_semaphore_create(struct amdgpu_device *adev,
         if (*semaphore == NULL) {
                 return -ENOMEM;
         }
-        r = amdgpu_sa_bo_new(adev, &adev->ring_tmp_bo,
+        r = amdgpu_sa_bo_new(&adev->ring_tmp_bo,
                              &(*semaphore)->sa_bo, 8, 8);
         if (r) {
                 kfree(*semaphore);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6697fd05217..dd005c336c97 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -302,8 +302,14 @@ int amdgpu_sync_rings(struct amdgpu_sync *sync,
                         return -EINVAL;
                 }
 
-                if (amdgpu_enable_scheduler || !amdgpu_enable_semaphores ||
-                    (count >= AMDGPU_NUM_SYNCS)) {
+                if (amdgpu_enable_scheduler || !amdgpu_enable_semaphores) {
+                        r = fence_wait(&fence->base, true);
+                        if (r)
+                                return r;
+                        continue;
+                }
+
+                if (count >= AMDGPU_NUM_SYNCS) {
                         /* not enough room, wait manually */
                         r = fence_wait(&fence->base, false);
                         if (r)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
index 76ecbaf72a2e..8f9834ab1bd5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
@@ -48,6 +48,57 @@ TRACE_EVENT(amdgpu_cs,
                       __entry->fences)
 );
 
+TRACE_EVENT(amdgpu_cs_ioctl,
+            TP_PROTO(struct amdgpu_job *job),
+            TP_ARGS(job),
+            TP_STRUCT__entry(
+                             __field(struct amdgpu_device *, adev)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct amdgpu_ib *, ib)
+                             __field(struct fence *, fence)
+                             __field(char *, ring_name)
+                             __field(u32, num_ibs)
+                             ),
+
+            TP_fast_assign(
+                           __entry->adev = job->adev;
+                           __entry->sched_job = &job->base;
+                           __entry->ib = job->ibs;
+                           __entry->fence = &job->base.s_fence->base;
+                           __entry->ring_name = job->ibs[0].ring->name;
+                           __entry->num_ibs = job->num_ibs;
+                           ),
+            TP_printk("adev=%p, sched_job=%p, first ib=%p, sched fence=%p, ring name:%s, num_ibs:%u",
+                      __entry->adev, __entry->sched_job, __entry->ib,
+                      __entry->fence, __entry->ring_name, __entry->num_ibs)
+);
+
+TRACE_EVENT(amdgpu_sched_run_job,
+            TP_PROTO(struct amdgpu_job *job),
+            TP_ARGS(job),
+            TP_STRUCT__entry(
+                             __field(struct amdgpu_device *, adev)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct amdgpu_ib *, ib)
+                             __field(struct fence *, fence)
+                             __field(char *, ring_name)
+                             __field(u32, num_ibs)
+                             ),
+
+            TP_fast_assign(
+                           __entry->adev = job->adev;
+                           __entry->sched_job = &job->base;
+                           __entry->ib = job->ibs;
+                           __entry->fence = &job->base.s_fence->base;
+                           __entry->ring_name = job->ibs[0].ring->name;
+                           __entry->num_ibs = job->num_ibs;
+                           ),
+            TP_printk("adev=%p, sched_job=%p, first ib=%p, sched fence=%p, ring name:%s, num_ibs:%u",
+                      __entry->adev, __entry->sched_job, __entry->ib,
+                      __entry->fence, __entry->ring_name, __entry->num_ibs)
+);
+
+
 TRACE_EVENT(amdgpu_vm_grab_id,
             TP_PROTO(unsigned vmid, int ring),
             TP_ARGS(vmid, ring),
@@ -196,49 +247,6 @@ TRACE_EVENT(amdgpu_bo_list_set,
             TP_printk("list=%p, bo=%p", __entry->list, __entry->bo)
 );
 
-DECLARE_EVENT_CLASS(amdgpu_fence_request,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno),
-
-            TP_STRUCT__entry(
-                             __field(u32, dev)
-                             __field(int, ring)
-                             __field(u32, seqno)
-                             ),
-
-            TP_fast_assign(
-                           __entry->dev = dev->primary->index;
-                           __entry->ring = ring;
-                           __entry->seqno = seqno;
-                           ),
-
-            TP_printk("dev=%u, ring=%d, seqno=%u",
-                      __entry->dev, __entry->ring, __entry->seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_emit,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_wait_begin,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_wait_end,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
 DECLARE_EVENT_CLASS(amdgpu_semaphore_request,
 
             TP_PROTO(int ring, struct amdgpu_semaphore *sem),
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 81bb8e9fc26d..d4bac5f49939 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -1073,10 +1073,10 @@ static int amdgpu_mm_dump_table(struct seq_file *m, void *data)
         ret = drm_mm_dump_table(m, mm);
         spin_unlock(&glob->lru_lock);
         if (ttm_pl == TTM_PL_VRAM)
-                seq_printf(m, "man size:%llu pages, ram usage:%luMB, vis usage:%luMB\n",
+                seq_printf(m, "man size:%llu pages, ram usage:%lluMB, vis usage:%lluMB\n",
                            adev->mman.bdev.man[ttm_pl].size,
-                           atomic64_read(&adev->vram_usage) >> 20,
-                           atomic64_read(&adev->vram_vis_usage) >> 20);
+                           (u64)atomic64_read(&adev->vram_usage) >> 20,
+                           (u64)atomic64_read(&adev->vram_vis_usage) >> 20);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 633a32a48560..159ce54bbd8d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -143,10 +143,15 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
         unsigned i;
 
         /* check if the id is still valid */
-        if (vm_id->id && vm_id->last_id_use &&
-            vm_id->last_id_use == adev->vm_manager.active[vm_id->id]) {
-                trace_amdgpu_vm_grab_id(vm_id->id, ring->idx);
-                return 0;
+        if (vm_id->id) {
+                unsigned id = vm_id->id;
+                long owner;
+
+                owner = atomic_long_read(&adev->vm_manager.ids[id].owner);
+                if (owner == (long)vm) {
+                        trace_amdgpu_vm_grab_id(vm_id->id, ring->idx);
+                        return 0;
+                }
         }
 
         /* we definately need to flush */
@@ -154,7 +159,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 
         /* skip over VMID 0, since it is the system VM */
         for (i = 1; i < adev->vm_manager.nvm; ++i) {
-                struct fence *fence = adev->vm_manager.active[i];
+                struct fence *fence = adev->vm_manager.ids[i].active;
                 struct amdgpu_ring *fring;
 
                 if (fence == NULL) {
@@ -176,7 +181,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
                 if (choices[i]) {
                         struct fence *fence;
 
-                        fence  = adev->vm_manager.active[choices[i]];
+                        fence  = adev->vm_manager.ids[choices[i]].active;
                         vm_id->id = choices[i];
 
                         trace_amdgpu_vm_grab_id(choices[i], ring->idx);
@@ -207,24 +212,21 @@ void amdgpu_vm_flush(struct amdgpu_ring *ring,
         uint64_t pd_addr = amdgpu_bo_gpu_offset(vm->page_directory);
         struct amdgpu_vm_id *vm_id = &vm->ids[ring->idx];
         struct fence *flushed_updates = vm_id->flushed_updates;
-        bool is_earlier = false;
-
-        if (flushed_updates && updates) {
-                BUG_ON(flushed_updates->context != updates->context);
-                is_earlier = (updates->seqno - flushed_updates->seqno <=
-                              INT_MAX) ? true : false;
-        }
+        bool is_later;
 
-        if (pd_addr != vm_id->pd_gpu_addr || !flushed_updates ||
-            is_earlier) {
+        if (!flushed_updates)
+                is_later = true;
+        else if (!updates)
+                is_later = false;
+        else
+                is_later = fence_is_later(updates, flushed_updates);
 
+        if (pd_addr != vm_id->pd_gpu_addr || is_later) {
                 trace_amdgpu_vm_flush(pd_addr, ring->idx, vm_id->id);
-                if (is_earlier) {
+                if (is_later) {
                         vm_id->flushed_updates = fence_get(updates);
                         fence_put(flushed_updates);
                 }
-                if (!flushed_updates)
-                        vm_id->flushed_updates = fence_get(updates);
                 vm_id->pd_gpu_addr = pd_addr;
                 amdgpu_ring_emit_vm_flush(ring, vm_id->id, vm_id->pd_gpu_addr);
         }
@@ -244,16 +246,14 @@ void amdgpu_vm_flush(struct amdgpu_ring *ring,
  */
 void amdgpu_vm_fence(struct amdgpu_device *adev,
                      struct amdgpu_vm *vm,
-                     struct amdgpu_fence *fence)
+                     struct fence *fence)
 {
-        unsigned ridx = fence->ring->idx;
-        unsigned vm_id = vm->ids[ridx].id;
-
-        fence_put(adev->vm_manager.active[vm_id]);
-        adev->vm_manager.active[vm_id] = fence_get(&fence->base);
+        struct amdgpu_ring *ring = amdgpu_ring_from_fence(fence);
+        unsigned vm_id = vm->ids[ring->idx].id;
 
-        fence_put(vm->ids[ridx].last_id_use);
-        vm->ids[ridx].last_id_use = fence_get(&fence->base);
+        fence_put(adev->vm_manager.ids[vm_id].active);
+        adev->vm_manager.ids[vm_id].active = fence_get(fence);
+        atomic_long_set(&adev->vm_manager.ids[vm_id].owner, (long)vm);
 }
 
 /**
@@ -332,6 +332,8 @@ int amdgpu_vm_free_job(struct amdgpu_job *job)
  *
  * @adev: amdgpu_device pointer
  * @bo: bo to clear
+ *
+ * need to reserve bo first before calling it.
  */
 static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
                               struct amdgpu_bo *bo)
@@ -343,24 +345,20 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         uint64_t addr;
         int r;
 
-        r = amdgpu_bo_reserve(bo, false);
-        if (r)
-                return r;
-
         r = reservation_object_reserve_shared(bo->tbo.resv);
         if (r)
                 return r;
 
         r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
         if (r)
-                goto error_unreserve;
+                goto error;
 
         addr = amdgpu_bo_gpu_offset(bo);
         entries = amdgpu_bo_size(bo) / 8;
 
         ib = kzalloc(sizeof(struct amdgpu_ib), GFP_KERNEL);
         if (!ib)
-                goto error_unreserve;
+                goto error;
 
         r = amdgpu_ib_get(ring, NULL, entries * 2 + 64, ib);
         if (r)
@@ -378,16 +376,14 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         if (!r)
                 amdgpu_bo_fence(bo, fence, true);
         fence_put(fence);
-        if (amdgpu_enable_scheduler) {
-                amdgpu_bo_unreserve(bo);
+        if (amdgpu_enable_scheduler)
                 return 0;
-        }
+
 error_free:
         amdgpu_ib_free(adev, ib);
         kfree(ib);
 
-error_unreserve:
-        amdgpu_bo_unreserve(bo);
+error:
         return r;
 }
 
@@ -989,7 +985,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
  * Add a mapping of the BO at the specefied addr into the VM.
  * Returns 0 for success, error for failure.
  *
- * Object has to be reserved and gets unreserved by this function!
+ * Object has to be reserved and unreserved outside!
  */
 int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                      struct amdgpu_bo_va *bo_va,
@@ -1005,30 +1001,27 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
 
         /* validate the parameters */
         if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||
-            size == 0 || size & AMDGPU_GPU_PAGE_MASK) {
-                amdgpu_bo_unreserve(bo_va->bo);
+            size == 0 || size & AMDGPU_GPU_PAGE_MASK)
                 return -EINVAL;
-        }
 
         /* make sure object fit at this offset */
         eaddr = saddr + size;
-        if ((saddr >= eaddr) || (offset + size > amdgpu_bo_size(bo_va->bo))) {
-                amdgpu_bo_unreserve(bo_va->bo);
+        if ((saddr >= eaddr) || (offset + size > amdgpu_bo_size(bo_va->bo)))
                 return -EINVAL;
-        }
 
         last_pfn = eaddr / AMDGPU_GPU_PAGE_SIZE;
         if (last_pfn > adev->vm_manager.max_pfn) {
                 dev_err(adev->dev, "va above limit (0x%08X > 0x%08X)\n",
                         last_pfn, adev->vm_manager.max_pfn);
-                amdgpu_bo_unreserve(bo_va->bo);
                 return -EINVAL;
         }
 
         saddr /= AMDGPU_GPU_PAGE_SIZE;
         eaddr /= AMDGPU_GPU_PAGE_SIZE;
 
+        spin_lock(&vm->it_lock);
         it = interval_tree_iter_first(&vm->va, saddr, eaddr - 1);
+        spin_unlock(&vm->it_lock);
         if (it) {
                 struct amdgpu_bo_va_mapping *tmp;
                 tmp = container_of(it, struct amdgpu_bo_va_mapping, it);
@@ -1036,14 +1029,12 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 dev_err(adev->dev, "bo %p va 0x%010Lx-0x%010Lx conflict with "
                         "0x%010lx-0x%010lx\n", bo_va->bo, saddr, eaddr,
                         tmp->it.start, tmp->it.last + 1);
-                amdgpu_bo_unreserve(bo_va->bo);
                 r = -EINVAL;
                 goto error;
         }
 
         mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
         if (!mapping) {
-                amdgpu_bo_unreserve(bo_va->bo);
                 r = -ENOMEM;
                 goto error;
         }
@@ -1055,7 +1046,9 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
         mapping->flags = flags;
 
         list_add(&mapping->list, &bo_va->invalids);
+        spin_lock(&vm->it_lock);
         interval_tree_insert(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_map(bo_va, mapping);
 
         /* Make sure the page tables are allocated */
@@ -1067,8 +1060,6 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
         if (eaddr > vm->max_pde_used)
                 vm->max_pde_used = eaddr;
 
-        amdgpu_bo_unreserve(bo_va->bo);
-
         /* walk over the address space and allocate the page tables */
         for (pt_idx = saddr; pt_idx <= eaddr; ++pt_idx) {
                 struct reservation_object *resv = vm->page_directory->tbo.resv;
@@ -1077,13 +1068,11 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 if (vm->page_tables[pt_idx].bo)
                         continue;
 
-                ww_mutex_lock(&resv->lock, NULL);
                 r = amdgpu_bo_create(adev, AMDGPU_VM_PTE_COUNT * 8,
                                      AMDGPU_GPU_PAGE_SIZE, true,
                                      AMDGPU_GEM_DOMAIN_VRAM,
                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS,
                                      NULL, resv, &pt);
-                ww_mutex_unlock(&resv->lock);
                 if (r)
                         goto error_free;
 
@@ -1101,7 +1090,9 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
 
 error_free:
         list_del(&mapping->list);
+        spin_lock(&vm->it_lock);
         interval_tree_remove(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_unmap(bo_va, mapping);
         kfree(mapping);
 
@@ -1119,7 +1110,7 @@ error:
  * Remove a mapping of the BO at the specefied addr from the VM.
  * Returns 0 for success, error for failure.
  *
- * Object has to be reserved and gets unreserved by this function!
+ * Object has to be reserved and unreserved outside!
  */
 int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                        struct amdgpu_bo_va *bo_va,
@@ -1144,21 +1135,20 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                                 break;
                 }
 
-                if (&mapping->list == &bo_va->invalids) {
-                        amdgpu_bo_unreserve(bo_va->bo);
+                if (&mapping->list == &bo_va->invalids)
                         return -ENOENT;
-                }
         }
 
         list_del(&mapping->list);
+        spin_lock(&vm->it_lock);
         interval_tree_remove(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_unmap(bo_va, mapping);
 
         if (valid)
                 list_add(&mapping->list, &vm->freed);
         else
                 kfree(mapping);
-        amdgpu_bo_unreserve(bo_va->bo);
 
         return 0;
 }
@@ -1187,13 +1177,17 @@ void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
 
         list_for_each_entry_safe(mapping, next, &bo_va->valids, list) {
                 list_del(&mapping->list);
+                spin_lock(&vm->it_lock);
                 interval_tree_remove(&mapping->it, &vm->va);
+                spin_unlock(&vm->it_lock);
                 trace_amdgpu_vm_bo_unmap(bo_va, mapping);
                 list_add(&mapping->list, &vm->freed);
         }
         list_for_each_entry_safe(mapping, next, &bo_va->invalids, list) {
                 list_del(&mapping->list);
+                spin_lock(&vm->it_lock);
                 interval_tree_remove(&mapping->it, &vm->va);
+                spin_unlock(&vm->it_lock);
                 kfree(mapping);
         }
 
@@ -1241,7 +1235,6 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                 vm->ids[i].id = 0;
                 vm->ids[i].flushed_updates = NULL;
-                vm->ids[i].last_id_use = NULL;
         }
         mutex_init(&vm->mutex);
         vm->va = RB_ROOT;
@@ -1249,7 +1242,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         INIT_LIST_HEAD(&vm->invalidated);
         INIT_LIST_HEAD(&vm->cleared);
         INIT_LIST_HEAD(&vm->freed);
-
+        spin_lock_init(&vm->it_lock);
         pd_size = amdgpu_vm_directory_size(adev);
         pd_entries = amdgpu_vm_num_pdes(adev);
 
@@ -1269,8 +1262,14 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
                              NULL, NULL, &vm->page_directory);
         if (r)
                 return r;
-
+        r = amdgpu_bo_reserve(vm->page_directory, false);
+        if (r) {
+                amdgpu_bo_unref(&vm->page_directory);
+                vm->page_directory = NULL;
+                return r;
+        }
         r = amdgpu_vm_clear_bo(adev, vm->page_directory);
+        amdgpu_bo_unreserve(vm->page_directory);
         if (r) {
                 amdgpu_bo_unref(&vm->page_directory);
                 vm->page_directory = NULL;
@@ -1313,11 +1312,28 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm)
 
         amdgpu_bo_unref(&vm->page_directory);
         fence_put(vm->page_directory_fence);
-
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
+                unsigned id = vm->ids[i].id;
+
+                atomic_long_cmpxchg(&adev->vm_manager.ids[id].owner,
+                                    (long)vm, 0);
                 fence_put(vm->ids[i].flushed_updates);
-                fence_put(vm->ids[i].last_id_use);
         }
 
         mutex_destroy(&vm->mutex);
 }
+
+/**
+ * amdgpu_vm_manager_fini - cleanup VM manager
+ *
+ * @adev: amdgpu_device pointer
+ *
+ * Cleanup the VM manager and free resources.
+ */
+void amdgpu_vm_manager_fini(struct amdgpu_device *adev)
+{
+        unsigned i;
+
+        for (i = 0; i < AMDGPU_NUM_VM; ++i)
+                fence_put(adev->vm_manager.ids[i].active);
+}
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index a1a35a5df8e7..57a2e347f04d 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -6569,12 +6569,12 @@ static int ci_dpm_set_interrupt_state(struct amdgpu_device *adev,
                 switch (state) {
                 case AMDGPU_IRQ_STATE_DISABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
+                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 case AMDGPU_IRQ_STATE_ENABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
+                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 default:
@@ -6586,12 +6586,12 @@ static int ci_dpm_set_interrupt_state(struct amdgpu_device *adev,
                 switch (state) {
                 case AMDGPU_IRQ_STATE_DISABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
+                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 case AMDGPU_IRQ_STATE_ENABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
+                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 default:
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 6776cf756d40..e1dcab98e249 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -268,7 +268,6 @@ static const u32 fiji_mgcg_cgcg_init[] =
         mmCGTT_CP_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_CPC_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_CPF_CLK_CTRL, 0xffffffff, 0x40000100,
-        mmCGTT_DRM_CLK_CTRL0, 0xffffffff, 0x00600100,
         mmCGTT_GDS_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_IA_CLK_CTRL, 0xffffffff, 0x06000100,
         mmCGTT_PA_CLK_CTRL, 0xffffffff, 0x00000100,
@@ -296,10 +295,6 @@ static const u32 fiji_mgcg_cgcg_init[] =
         mmCGTS_SM_CTRL_REG, 0xffffffff, 0x96e00200,
         mmCP_RB_WPTR_POLL_CNTL, 0xffffffff, 0x00900100,
         mmRLC_CGCG_CGLS_CTRL, 0xffffffff, 0x0020003c,
-        mmPCIE_INDEX, 0xffffffff, 0x0140001c,
-        mmPCIE_DATA, 0x000f0000, 0x00000000,
-        mmCGTT_DRM_CLK_CTRL0, 0xff000fff, 0x00000100,
-        mmHDP_XDP_CGTT_BLK_CTRL, 0xc0000fff, 0x00000104,
         mmCP_MEM_SLP_CNTL, 0x00000001, 0x00000001,
 };
 
@@ -1000,7 +995,7 @@ static void gfx_v8_0_gpu_early_init(struct amdgpu_device *adev)
                 adev->gfx.config.max_cu_per_sh = 16;
                 adev->gfx.config.max_sh_per_se = 1;
                 adev->gfx.config.max_backends_per_se = 4;
-                adev->gfx.config.max_texture_channel_caches = 8;
+                adev->gfx.config.max_texture_channel_caches = 16;
                 adev->gfx.config.max_gprs = 256;
                 adev->gfx.config.max_gs_threads = 32;
                 adev->gfx.config.max_hw_contexts = 8;
@@ -1613,6 +1608,296 @@ static void gfx_v8_0_tiling_mode_table_init(struct amdgpu_device *adev)
                         WREG32(mmGB_MACROTILE_MODE0 + reg_offset, gb_tile_moden);
                 }
         case CHIP_FIJI:
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++) {
+                        switch (reg_offset) {
+                        case 0:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 1:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 2:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 3:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 4:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 5:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 6:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 7:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 8:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16));
+                                break;
+                        case 9:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 10:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 11:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 12:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 13:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 14:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 15:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 16:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 17:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 18:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 19:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 20:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 21:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 22:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 23:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 24:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 25:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_XTHICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 26:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_XTHICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 27:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 28:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 29:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 30:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        default:
+                                gb_tile_moden = 0;
+                                break;
+                        }
+                        adev->gfx.config.tile_mode_array[reg_offset] = gb_tile_moden;
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, gb_tile_moden);
+                }
+                for (reg_offset = 0; reg_offset < num_secondary_tile_mode_states; reg_offset++) {
+                        switch (reg_offset) {
+                        case 0:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 1:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 2:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 3:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 4:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 5:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 6:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 8:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_8) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 9:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 10:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 11:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 12:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 13:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 14:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_4_BANK));
+                                break;
+                        case 7:
+                                /* unused idx */
+                                continue;
+                        default:
+                                gb_tile_moden = 0;
+                                break;
+                        }
+                        adev->gfx.config.macrotile_mode_array[reg_offset] = gb_tile_moden;
+                        WREG32(mmGB_MACROTILE_MODE0 + reg_offset, gb_tile_moden);
+                }
+                break;
         case CHIP_TONGA:
                 for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++) {
                         switch (reg_offset) {
@@ -2971,10 +3256,13 @@ static int gfx_v8_0_cp_gfx_start(struct amdgpu_device *adev)
         amdgpu_ring_write(ring, mmPA_SC_RASTER_CONFIG - PACKET3_SET_CONTEXT_REG_START);
         switch (adev->asic_type) {
         case CHIP_TONGA:
-        case CHIP_FIJI:
                 amdgpu_ring_write(ring, 0x16000012);
                 amdgpu_ring_write(ring, 0x0000002A);
                 break;
+        case CHIP_FIJI:
+                amdgpu_ring_write(ring, 0x3a00161a);
+                amdgpu_ring_write(ring, 0x0000002e);
+                break;
         case CHIP_TOPAZ:
         case CHIP_CARRIZO:
                 amdgpu_ring_write(ring, 0x00000002);
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 85bbcdc73fff..7427d8cd4c43 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -40,7 +40,7 @@
 static void gmc_v7_0_set_gart_funcs(struct amdgpu_device *adev);
 static void gmc_v7_0_set_irq_funcs(struct amdgpu_device *adev);
 
-MODULE_FIRMWARE("radeon/boniare_mc.bin");
+MODULE_FIRMWARE("radeon/bonaire_mc.bin");
 MODULE_FIRMWARE("radeon/hawaii_mc.bin");
 
 /**
@@ -501,6 +501,7 @@ static int gmc_v7_0_gart_enable(struct amdgpu_device *adev)
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_L2_PDE0_CACHE_LRU_UPDATE_BY_WRITE, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, EFFECTIVE_L2_QUEUE_SIZE, 7);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, CONTEXT1_IDENTITY_ACCESS_MODE, 1);
+        tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_DEFAULT_PAGE_OUT_TO_SYSTEM_MEMORY, 1);
         WREG32(mmVM_L2_CNTL, tmp);
         tmp = REG_SET_FIELD(0, VM_L2_CNTL2, INVALIDATE_ALL_L1_TLBS, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1);
@@ -960,12 +961,10 @@ static int gmc_v7_0_sw_init(void *handle)
 
 static int gmc_v7_0_sw_fini(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v7_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
@@ -1010,12 +1009,10 @@ static int gmc_v7_0_hw_fini(void *handle)
 
 static int gmc_v7_0_suspend(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v7_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 1bcc4e74e3b4..cb0e50ebb528 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -629,6 +629,7 @@ static int gmc_v8_0_gart_enable(struct amdgpu_device *adev)
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_L2_PDE0_CACHE_LRU_UPDATE_BY_WRITE, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, EFFECTIVE_L2_QUEUE_SIZE, 7);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, CONTEXT1_IDENTITY_ACCESS_MODE, 1);
+        tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_DEFAULT_PAGE_OUT_TO_SYSTEM_MEMORY, 1);
         WREG32(mmVM_L2_CNTL, tmp);
         tmp = RREG32(mmVM_L2_CNTL2);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_ALL_L1_TLBS, 1);
@@ -979,12 +980,10 @@ static int gmc_v8_0_sw_init(void *handle)
 
 static int gmc_v8_0_sw_fini(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v8_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
@@ -1031,12 +1030,10 @@ static int gmc_v8_0_hw_fini(void *handle)
 
 static int gmc_v8_0_suspend(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v8_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
index 144f50acc971..c89dc777768f 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
@@ -16,6 +16,8 @@ TRACE_EVENT(amd_sched_job,
             TP_ARGS(sched_job),
             TP_STRUCT__entry(
                              __field(struct amd_sched_entity *, entity)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct fence *, fence)
                              __field(const char *, name)
                              __field(u32, job_count)
                              __field(int, hw_job_count)
@@ -23,16 +25,32 @@ TRACE_EVENT(amd_sched_job,
 
             TP_fast_assign(
                            __entry->entity = sched_job->s_entity;
+                           __entry->sched_job = sched_job;
+                           __entry->fence = &sched_job->s_fence->base;
                            __entry->name = sched_job->sched->name;
                            __entry->job_count = kfifo_len(
                                    &sched_job->s_entity->job_queue) / sizeof(sched_job);
                            __entry->hw_job_count = atomic_read(
                                    &sched_job->sched->hw_rq_count);
                            ),
-            TP_printk("entity=%p, ring=%s, job count:%u, hw job count:%d",
-                      __entry->entity, __entry->name, __entry->job_count,
-                      __entry->hw_job_count)
+            TP_printk("entity=%p, sched job=%p, fence=%p, ring=%s, job count:%u, hw job count:%d",
+                      __entry->entity, __entry->sched_job, __entry->fence, __entry->name,
+                      __entry->job_count, __entry->hw_job_count)
 );
+
+TRACE_EVENT(amd_sched_process_job,
+            TP_PROTO(struct amd_sched_fence *fence),
+            TP_ARGS(fence),
+            TP_STRUCT__entry(
+                    __field(struct fence *, fence)
+                    ),
+
+            TP_fast_assign(
+                    __entry->fence = &fence->base;
+                    ),
+            TP_printk("fence=%p signaled", __entry->fence)
+);
+
 #endif
 
 /* This part must be outside protection */
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 89619a5a4289..ea30d6ad4c13 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -34,6 +34,9 @@ static struct amd_sched_job *
 amd_sched_entity_pop_job(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
 
+struct kmem_cache *sched_fence_slab;
+atomic_t sched_fence_slab_ref = ATOMIC_INIT(0);
+
 /* Initialize a given run queue struct */
 static void amd_sched_rq_init(struct amd_sched_rq *rq)
 {
@@ -273,22 +276,13 @@ static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
  *
  * Returns 0 for success, negative error code otherwise.
  */
-int amd_sched_entity_push_job(struct amd_sched_job *sched_job)
+void amd_sched_entity_push_job(struct amd_sched_job *sched_job)
 {
         struct amd_sched_entity *entity = sched_job->s_entity;
-        struct amd_sched_fence *fence = amd_sched_fence_create(
-                entity, sched_job->owner);
-
-        if (!fence)
-                return -ENOMEM;
-
-        fence_get(&fence->base);
-        sched_job->s_fence = fence;
 
         wait_event(entity->sched->job_scheduled,
                    amd_sched_entity_in(sched_job));
         trace_amd_sched_job(sched_job);
-        return 0;
 }
 
 /**
@@ -343,6 +337,7 @@ static void amd_sched_process_job(struct fence *f, struct fence_cb *cb)
                 list_del_init(&s_fence->list);
                 spin_unlock_irqrestore(&sched->fence_list_lock, flags);
         }
+        trace_amd_sched_process_job(s_fence);
         fence_put(&s_fence->base);
         wake_up_interruptible(&sched->wake_up_worker);
 }
@@ -450,6 +445,13 @@ int amd_sched_init(struct amd_gpu_scheduler *sched,
         init_waitqueue_head(&sched->wake_up_worker);
         init_waitqueue_head(&sched->job_scheduled);
         atomic_set(&sched->hw_rq_count, 0);
+        if (atomic_inc_return(&sched_fence_slab_ref) == 1) {
+                sched_fence_slab = kmem_cache_create(
+                        "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
+                        SLAB_HWCACHE_ALIGN, NULL);
+                if (!sched_fence_slab)
+                        return -ENOMEM;
+        }
 
         /* Each scheduler will run on a seperate kernel thread */
         sched->thread = kthread_run(amd_sched_main, sched, sched->name);
@@ -470,4 +472,6 @@ void amd_sched_fini(struct amd_gpu_scheduler *sched)
 {
         if (sched->thread)
                 kthread_stop(sched->thread);
+        if (atomic_dec_and_test(&sched_fence_slab_ref))
+                kmem_cache_destroy(sched_fence_slab);
 }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 929e9aced041..939692b14f4b 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -30,6 +30,9 @@
 struct amd_gpu_scheduler;
 struct amd_sched_rq;
 
+extern struct kmem_cache *sched_fence_slab;
+extern atomic_t sched_fence_slab_ref;
+
 /**
  * A scheduler entity is a wrapper around a job queue or a group
  * of other entities. Entities take turns emitting jobs from their 
@@ -76,7 +79,6 @@ struct amd_sched_job {
         struct amd_gpu_scheduler        *sched;
         struct amd_sched_entity         *s_entity;
         struct amd_sched_fence          *s_fence;
-        void                            *owner;
 };
 
 extern const struct fence_ops amd_sched_fence_ops;
@@ -128,7 +130,7 @@ int amd_sched_entity_init(struct amd_gpu_scheduler *sched,
                           uint32_t jobs);
 void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                            struct amd_sched_entity *entity);
-int amd_sched_entity_push_job(struct amd_sched_job *sched_job);
+void amd_sched_entity_push_job(struct amd_sched_job *sched_job);
 
 struct amd_sched_fence *amd_sched_fence_create(
         struct amd_sched_entity *s_entity, void *owner);
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index d802638094f4..8d2130b9ff05 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -32,7 +32,7 @@ struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *s_entity
         struct amd_sched_fence *fence = NULL;
         unsigned seq;
 
-        fence = kzalloc(sizeof(struct amd_sched_fence), GFP_KERNEL);
+        fence = kmem_cache_zalloc(sched_fence_slab, GFP_KERNEL);
         if (fence == NULL)
                 return NULL;
         fence->owner = owner;
@@ -71,11 +71,17 @@ static bool amd_sched_fence_enable_signaling(struct fence *f)
         return true;
 }
 
+static void amd_sched_fence_release(struct fence *f)
+{
+        struct amd_sched_fence *fence = to_amd_sched_fence(f);
+        kmem_cache_free(sched_fence_slab, fence);
+}
+
 const struct fence_ops amd_sched_fence_ops = {
         .get_driver_name = amd_sched_fence_get_driver_name,
         .get_timeline_name = amd_sched_fence_get_timeline_name,
         .enable_signaling = amd_sched_fence_enable_signaling,
         .signaled = NULL,
         .wait = fence_default_wait,
-        .release = NULL,
+        .release = amd_sched_fence_release,
 };
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 7bb3845d9974..aeee083c7f95 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1432,6 +1432,45 @@ static int atomic_set_prop(struct drm_atomic_state *state,
         return ret;
 }
 
+/**
+ * drm_atomic_update_old_fb -- Unset old_fb pointers and set plane->fb pointers.
+ *
+ * @dev: drm device to check.
+ * @plane_mask: plane mask for planes that were updated.
+ * @ret: return value, can be -EDEADLK for a retry.
+ *
+ * Before doing an update plane->old_fb is set to plane->fb,
+ * but before dropping the locks old_fb needs to be set to NULL
+ * and plane->fb updated. This is a common operation for each
+ * atomic update, so this call is split off as a helper.
+ */
+void drm_atomic_clean_old_fb(struct drm_device *dev,
+                             unsigned plane_mask,
+                             int ret)
+{
+        struct drm_plane *plane;
+
+        /* if succeeded, fixup legacy plane crtc/fb ptrs before dropping
+         * locks (ie. while it is still safe to deref plane->state).  We
+         * need to do this here because the driver entry points cannot
+         * distinguish between legacy and atomic ioctls.
+         */
+        drm_for_each_plane_mask(plane, dev, plane_mask) {
+                if (ret == 0) {
+                        struct drm_framebuffer *new_fb = plane->state->fb;
+                        if (new_fb)
+                                drm_framebuffer_reference(new_fb);
+                        plane->fb = new_fb;
+                        plane->crtc = plane->state->crtc;
+
+                        if (plane->old_fb)
+                                drm_framebuffer_unreference(plane->old_fb);
+                }
+                plane->old_fb = NULL;
+        }
+}
+EXPORT_SYMBOL(drm_atomic_clean_old_fb);
+
 int drm_mode_atomic_ioctl(struct drm_device *dev,
                           void *data, struct drm_file *file_priv)
 {
@@ -1446,7 +1485,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         struct drm_plane *plane;
         struct drm_crtc *crtc;
         struct drm_crtc_state *crtc_state;
-        unsigned plane_mask = 0;
+        unsigned plane_mask;
         int ret = 0;
         unsigned int i, j;
 
@@ -1486,6 +1525,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         state->allow_modeset = !!(arg->flags & DRM_MODE_ATOMIC_ALLOW_MODESET);
 
 retry:
+        plane_mask = 0;
         copied_objs = 0;
         copied_props = 0;
 
@@ -1576,24 +1616,7 @@ retry:
         }
 
 out:
-        /* if succeeded, fixup legacy plane crtc/fb ptrs before dropping
-         * locks (ie. while it is still safe to deref plane->state).  We
-         * need to do this here because the driver entry points cannot
-         * distinguish between legacy and atomic ioctls.
-         */
-        drm_for_each_plane_mask(plane, dev, plane_mask) {
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
                 /*
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 0c6f62168776..e5aec45bf985 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -210,6 +210,14 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
                 return -EINVAL;
         }
 
+        if (!drm_encoder_crtc_ok(new_encoder, connector_state->crtc)) {
+                DRM_DEBUG_ATOMIC("[ENCODER:%d:%s] incompatible with [CRTC:%d]\n",
+                                 new_encoder->base.id,
+                                 new_encoder->name,
+                                 connector_state->crtc->base.id);
+                return -EINVAL;
+        }
+
         if (new_encoder == connector_state->best_encoder) {
                 DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] keeps [ENCODER:%d:%s], now on [CRTC:%d]\n",
                                  connector->base.id,
@@ -1553,6 +1561,9 @@ retry:
                 goto fail;
         }
 
+        if (plane_state->crtc && (plane == plane->crtc->cursor))
+                plane_state->state->legacy_cursor_update = true;
+
         ret = __drm_atomic_helper_disable_plane(plane, plane_state);
         if (ret != 0)
                 goto fail;
@@ -1605,9 +1616,6 @@ int __drm_atomic_helper_disable_plane(struct drm_plane *plane,
         plane_state->src_h = 0;
         plane_state->src_w = 0;
 
-        if (plane->crtc && (plane == plane->crtc->cursor))
-                plane_state->state->legacy_cursor_update = true;
-
         return 0;
 }
 
@@ -1741,6 +1749,7 @@ int __drm_atomic_helper_set_config(struct drm_mode_set *set,
         struct drm_crtc_state *crtc_state;
         struct drm_plane_state *primary_state;
         struct drm_crtc *crtc = set->crtc;
+        int hdisplay, vdisplay;
         int ret;
 
         crtc_state = drm_atomic_get_crtc_state(state, crtc);
@@ -1783,19 +1792,21 @@ int __drm_atomic_helper_set_config(struct drm_mode_set *set,
         if (ret != 0)
                 return ret;
 
+        drm_crtc_get_hv_timing(set->mode, &hdisplay, &vdisplay);
+
         drm_atomic_set_fb_for_plane(primary_state, set->fb);
         primary_state->crtc_x = 0;
         primary_state->crtc_y = 0;
-        primary_state->crtc_h = set->mode->vdisplay;
-        primary_state->crtc_w = set->mode->hdisplay;
+        primary_state->crtc_h = vdisplay;
+        primary_state->crtc_w = hdisplay;
         primary_state->src_x = set->x << 16;
         primary_state->src_y = set->y << 16;
         if (primary_state->rotation & (BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_270))) {
-                primary_state->src_h = set->mode->hdisplay << 16;
-                primary_state->src_w = set->mode->vdisplay << 16;
+                primary_state->src_h = hdisplay << 16;
+                primary_state->src_w = vdisplay << 16;
         } else {
-                primary_state->src_h = set->mode->vdisplay << 16;
-                primary_state->src_w = set->mode->hdisplay << 16;
+                primary_state->src_h = vdisplay << 16;
+                primary_state->src_w = hdisplay << 16;
         }
 
 commit:
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index e673c13c7391..69cbab5e5c81 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,6 +342,7 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
         struct drm_plane *plane;
         struct drm_atomic_state *state;
         int i, ret;
+        unsigned plane_mask;
 
         state = drm_atomic_state_alloc(dev);
         if (!state)
@@ -349,11 +350,10 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
 
         state->acquire_ctx = dev->mode_config.acquire_ctx;
 retry:
+        plane_mask = 0;
         drm_for_each_plane(plane, dev) {
                 struct drm_plane_state *plane_state;
 
-                plane->old_fb = plane->fb;
-
                 plane_state = drm_atomic_get_plane_state(state, plane);
                 if (IS_ERR(plane_state)) {
                         ret = PTR_ERR(plane_state);
@@ -362,6 +362,9 @@ retry:
 
                 plane_state->rotation = BIT(DRM_ROTATE_0);
 
+                plane->old_fb = plane->fb;
+                plane_mask |= 1 << drm_plane_index(plane);
+
                 /* disable non-primary: */
                 if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                         continue;
@@ -382,19 +385,7 @@ retry:
         ret = drm_atomic_commit(state);
 
 fail:
-        drm_for_each_plane(plane, dev) {
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret == -EDEADLK)
                 goto backoff;
@@ -1236,7 +1227,9 @@ static int pan_display_atomic(struct fb_var_screeninfo *var,
         struct drm_fb_helper *fb_helper = info->par;
         struct drm_device *dev = fb_helper->dev;
         struct drm_atomic_state *state;
+        struct drm_plane *plane;
         int i, ret;
+        unsigned plane_mask;
 
         state = drm_atomic_state_alloc(dev);
         if (!state)
@@ -1244,19 +1237,22 @@ static int pan_display_atomic(struct fb_var_screeninfo *var,
 
         state->acquire_ctx = dev->mode_config.acquire_ctx;
 retry:
+        plane_mask = 0;
         for(i = 0; i < fb_helper->crtc_count; i++) {
                 struct drm_mode_set *mode_set;
 
                 mode_set = &fb_helper->crtc_info[i].mode_set;
 
-                mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb;
-
                 mode_set->x = var->xoffset;
                 mode_set->y = var->yoffset;
 
                 ret = __drm_atomic_helper_set_config(mode_set, state);
                 if (ret != 0)
                         goto fail;
+
+                plane = mode_set->crtc->primary;
+                plane_mask |= drm_plane_index(plane);
+                plane->old_fb = plane->fb;
         }
 
         ret = drm_atomic_commit(state);
@@ -1268,26 +1264,7 @@ retry:
 
 
 fail:
-        for(i = 0; i < fb_helper->crtc_count; i++) {
-                struct drm_mode_set *mode_set;
-                struct drm_plane *plane;
-
-                mode_set = &fb_helper->crtc_info[i].mode_set;
-                plane = mode_set->crtc->primary;
-
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret == -EDEADLK)
                 goto backoff;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8afda459a26e..95bb27de774f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -351,6 +351,8 @@ enum intel_dpll_id {
         /* hsw/bdw */
         DPLL_ID_WRPLL1 = 0,
         DPLL_ID_WRPLL2 = 1,
+        DPLL_ID_SPLL = 2,
+
         /* skl */
         DPLL_ID_SKL_DPLL1 = 0,
         DPLL_ID_SKL_DPLL2 = 1,
@@ -367,6 +369,7 @@ struct intel_dpll_hw_state {
 
         /* hsw, bdw */
         uint32_t wrpll;
+        uint32_t spll;
 
         /* skl */
         /*
@@ -2648,6 +2651,7 @@ struct i915_params {
         int enable_cmd_parser;
         /* leave bools at the end to not create holes */
         bool enable_hangcheck;
+        bool fastboot;
         bool prefault_disable;
         bool load_detect_test;
         bool reset;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5cf4a1998273..91bb1fc27420 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3809,6 +3809,7 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data,
 int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_caching *args = data;
         struct drm_i915_gem_object *obj;
         enum i915_cache_level level;
@@ -3837,9 +3838,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
+        intel_runtime_pm_get(dev_priv);
+
         ret = i915_mutex_lock_interruptible(dev);
         if (ret)
-                return ret;
+                goto rpm_put;
 
         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
         if (&obj->base == NULL) {
@@ -3852,6 +3855,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
         drm_gem_object_unreference(&obj->base);
 unlock:
         mutex_unlock(&dev->struct_mutex);
+rpm_put:
+        intel_runtime_pm_put(dev_priv);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_params.c b/drivers/gpu/drm/i915/i915_params.c
index 96bb23865eac..4be13a5eb932 100644
--- a/drivers/gpu/drm/i915/i915_params.c
+++ b/drivers/gpu/drm/i915/i915_params.c
@@ -40,6 +40,7 @@ struct i915_params i915 __read_mostly = {
         .preliminary_hw_support = IS_ENABLED(CONFIG_DRM_I915_PRELIMINARY_HW_SUPPORT),
         .disable_power_well = -1,
         .enable_ips = 1,
+        .fastboot = 0,
         .prefault_disable = 0,
         .load_detect_test = 0,
         .reset = true,
@@ -133,6 +134,10 @@ MODULE_PARM_DESC(disable_power_well,
 module_param_named_unsafe(enable_ips, i915.enable_ips, int, 0600);
 MODULE_PARM_DESC(enable_ips, "Enable IPS (default: true)");
 
+module_param_named(fastboot, i915.fastboot, bool, 0600);
+MODULE_PARM_DESC(fastboot,
+        "Try to skip unnecessary mode sets at boot time (default: false)");
+
 module_param_named_unsafe(prefault_disable, i915.prefault_disable, bool, 0600);
 MODULE_PARM_DESC(prefault_disable,
         "Disable page prefaulting for pread/pwrite/reloc (default:false). "
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index b84aaa0bb48a..6a2c76e367a5 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -138,18 +138,6 @@ static void hsw_crt_get_config(struct intel_encoder *encoder,
         pipe_config->base.adjusted_mode.flags |= intel_crt_get_flags(encoder);
 }
 
-static void hsw_crt_pre_enable(struct intel_encoder *encoder)
-{
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-
-        WARN(I915_READ(SPLL_CTL) & SPLL_PLL_ENABLE, "SPLL already enabled\n");
-        I915_WRITE(SPLL_CTL,
-                   SPLL_PLL_ENABLE | SPLL_PLL_FREQ_1350MHz | SPLL_PLL_SSC);
-        POSTING_READ(SPLL_CTL);
-        udelay(20);
-}
-
 /* Note: The caller is required to filter out dpms modes not supported by the
  * platform. */
 static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
@@ -216,19 +204,6 @@ static void pch_post_disable_crt(struct intel_encoder *encoder)
         intel_disable_crt(encoder);
 }
 
-static void hsw_crt_post_disable(struct intel_encoder *encoder)
-{
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t val;
-
-        DRM_DEBUG_KMS("Disabling SPLL\n");
-        val = I915_READ(SPLL_CTL);
-        WARN_ON(!(val & SPLL_PLL_ENABLE));
-        I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
-        POSTING_READ(SPLL_CTL);
-}
-
 static void intel_enable_crt(struct intel_encoder *encoder)
 {
         struct intel_crt *crt = intel_encoder_to_crt(encoder);
@@ -280,6 +255,10 @@ static bool intel_crt_compute_config(struct intel_encoder *encoder,
         if (HAS_DDI(dev)) {
                 pipe_config->ddi_pll_sel = PORT_CLK_SEL_SPLL;
                 pipe_config->port_clock = 135000 * 2;
+
+                pipe_config->dpll_hw_state.wrpll = 0;
+                pipe_config->dpll_hw_state.spll =
+                        SPLL_PLL_ENABLE | SPLL_PLL_FREQ_1350MHz | SPLL_PLL_SSC;
         }
 
         return true;
@@ -860,8 +839,6 @@ void intel_crt_init(struct drm_device *dev)
         if (HAS_DDI(dev)) {
                 crt->base.get_config = hsw_crt_get_config;
                 crt->base.get_hw_state = intel_ddi_get_hw_state;
-                crt->base.pre_enable = hsw_crt_pre_enable;
-                crt->base.post_disable = hsw_crt_post_disable;
         } else {
                 crt->base.get_config = intel_crt_get_config;
                 crt->base.get_hw_state = intel_crt_get_hw_state;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index b25e99a432fb..a6752a61d99f 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1286,6 +1286,18 @@ hsw_ddi_pll_select(struct intel_crtc *intel_crtc,
                 }
 
                 crtc_state->ddi_pll_sel = PORT_CLK_SEL_WRPLL(pll->id);
+        } else if (crtc_state->ddi_pll_sel == PORT_CLK_SEL_SPLL) {
+                struct drm_atomic_state *state = crtc_state->base.state;
+                struct intel_shared_dpll_config *spll =
+                        &intel_atomic_get_shared_dpll_state(state)[DPLL_ID_SPLL];
+
+                if (spll->crtc_mask &&
+                    WARN_ON(spll->hw_state.spll != crtc_state->dpll_hw_state.spll))
+                        return false;
+
+                crtc_state->shared_dpll = DPLL_ID_SPLL;
+                spll->hw_state.spll = crtc_state->dpll_hw_state.spll;
+                spll->crtc_mask |= 1 << intel_crtc->pipe;
         }
 
         return true;
@@ -2437,7 +2449,7 @@ static void intel_disable_ddi(struct intel_encoder *intel_encoder)
         }
 }
 
-static void hsw_ddi_pll_enable(struct drm_i915_private *dev_priv,
+static void hsw_ddi_wrpll_enable(struct drm_i915_private *dev_priv,
                                struct intel_shared_dpll *pll)
 {
         I915_WRITE(WRPLL_CTL(pll->id), pll->config.hw_state.wrpll);
@@ -2445,9 +2457,17 @@ static void hsw_ddi_pll_enable(struct drm_i915_private *dev_priv,
         udelay(20);
 }
 
-static void hsw_ddi_pll_disable(struct drm_i915_private *dev_priv,
+static void hsw_ddi_spll_enable(struct drm_i915_private *dev_priv,
                                 struct intel_shared_dpll *pll)
 {
+        I915_WRITE(SPLL_CTL, pll->config.hw_state.spll);
+        POSTING_READ(SPLL_CTL);
+        udelay(20);
+}
+
+static void hsw_ddi_wrpll_disable(struct drm_i915_private *dev_priv,
+                                  struct intel_shared_dpll *pll)
+{
         uint32_t val;
 
         val = I915_READ(WRPLL_CTL(pll->id));
@@ -2455,9 +2475,19 @@ static void hsw_ddi_pll_disable(struct drm_i915_private *dev_priv,
         POSTING_READ(WRPLL_CTL(pll->id));
 }
 
-static bool hsw_ddi_pll_get_hw_state(struct drm_i915_private *dev_priv,
-                                     struct intel_shared_dpll *pll,
-                                     struct intel_dpll_hw_state *hw_state)
+static void hsw_ddi_spll_disable(struct drm_i915_private *dev_priv,
+                                 struct intel_shared_dpll *pll)
+{
+        uint32_t val;
+
+        val = I915_READ(SPLL_CTL);
+        I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
+        POSTING_READ(SPLL_CTL);
+}
+
+static bool hsw_ddi_wrpll_get_hw_state(struct drm_i915_private *dev_priv,
+                                       struct intel_shared_dpll *pll,
+                                       struct intel_dpll_hw_state *hw_state)
 {
         uint32_t val;
 
@@ -2470,25 +2500,50 @@ static bool hsw_ddi_pll_get_hw_state(struct drm_i915_private *dev_priv,
         return val & WRPLL_PLL_ENABLE;
 }
 
+static bool hsw_ddi_spll_get_hw_state(struct drm_i915_private *dev_priv,
+                                      struct intel_shared_dpll *pll,
+                                      struct intel_dpll_hw_state *hw_state)
+{
+        uint32_t val;
+
+        if (!intel_display_power_is_enabled(dev_priv, POWER_DOMAIN_PLLS))
+                return false;
+
+        val = I915_READ(SPLL_CTL);
+        hw_state->spll = val;
+
+        return val & SPLL_PLL_ENABLE;
+}
+
+
 static const char * const hsw_ddi_pll_names[] = {
         "WRPLL 1",
         "WRPLL 2",
+        "SPLL"
 };
 
 static void hsw_shared_dplls_init(struct drm_i915_private *dev_priv)
 {
         int i;
 
-        dev_priv->num_shared_dpll = 2;
+        dev_priv->num_shared_dpll = 3;
 
-        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+        for (i = 0; i < 2; i++) {
                 dev_priv->shared_dplls[i].id = i;
                 dev_priv->shared_dplls[i].name = hsw_ddi_pll_names[i];
-                dev_priv->shared_dplls[i].disable = hsw_ddi_pll_disable;
-                dev_priv->shared_dplls[i].enable = hsw_ddi_pll_enable;
+                dev_priv->shared_dplls[i].disable = hsw_ddi_wrpll_disable;
+                dev_priv->shared_dplls[i].enable = hsw_ddi_wrpll_enable;
                 dev_priv->shared_dplls[i].get_hw_state =
-                        hsw_ddi_pll_get_hw_state;
+                        hsw_ddi_wrpll_get_hw_state;
         }
+
+        /* SPLL is special, but needs to be initialized anyway.. */
+        dev_priv->shared_dplls[i].id = i;
+        dev_priv->shared_dplls[i].name = hsw_ddi_pll_names[i];
+        dev_priv->shared_dplls[i].disable = hsw_ddi_spll_disable;
+        dev_priv->shared_dplls[i].enable = hsw_ddi_spll_enable;
+        dev_priv->shared_dplls[i].get_hw_state = hsw_ddi_spll_get_hw_state;
+
 }
 
 static const char * const skl_ddi_pll_names[] = {
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f62ffc04c21d..71860f8680f9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2646,11 +2646,13 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
-        plane_state->src_x = plane_state->src_y = 0;
+        plane_state->src_x = 0;
+        plane_state->src_y = 0;
         plane_state->src_w = fb->width << 16;
         plane_state->src_h = fb->height << 16;
 
-        plane_state->crtc_x = plane_state->src_y = 0;
+        plane_state->crtc_x = 0;
+        plane_state->crtc_y = 0;
         plane_state->crtc_w = fb->width;
         plane_state->crtc_h = fb->height;
 
@@ -4237,6 +4239,7 @@ struct intel_shared_dpll *intel_get_shared_dpll(struct intel_crtc *crtc,
         struct intel_shared_dpll *pll;
         struct intel_shared_dpll_config *shared_dpll;
         enum intel_dpll_id i;
+        int max = dev_priv->num_shared_dpll;
 
         shared_dpll = intel_atomic_get_shared_dpll_state(crtc_state->base.state);
 
@@ -4271,9 +4274,11 @@ struct intel_shared_dpll *intel_get_shared_dpll(struct intel_crtc *crtc,
                 WARN_ON(shared_dpll[i].crtc_mask);
 
                 goto found;
-        }
+        } else if (INTEL_INFO(dev_priv)->gen < 9 && HAS_DDI(dev_priv))
+                /* Do not consider SPLL */
+                max = 2;
 
-        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+        for (i = 0; i < max; i++) {
                 pll = &dev_priv->shared_dplls[i];
 
                 /* Only want to check enabled timings first */
@@ -9723,6 +9728,8 @@ static void haswell_get_ddi_pll(struct drm_i915_private *dev_priv,
         case PORT_CLK_SEL_WRPLL2:
                 pipe_config->shared_dpll = DPLL_ID_WRPLL2;
                 break;
+        case PORT_CLK_SEL_SPLL:
+                pipe_config->shared_dpll = DPLL_ID_SPLL;
         }
 }
 
@@ -12003,9 +12010,10 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc,
                               pipe_config->dpll_hw_state.cfgcr1,
                               pipe_config->dpll_hw_state.cfgcr2);
         } else if (HAS_DDI(dev)) {
-                DRM_DEBUG_KMS("ddi_pll_sel: %u; dpll_hw_state: wrpll: 0x%x\n",
+                DRM_DEBUG_KMS("ddi_pll_sel: %u; dpll_hw_state: wrpll: 0x%x spll: 0x%x\n",
                               pipe_config->ddi_pll_sel,
-                              pipe_config->dpll_hw_state.wrpll);
+                              pipe_config->dpll_hw_state.wrpll,
+                              pipe_config->dpll_hw_state.spll);
         } else {
                 DRM_DEBUG_KMS("dpll_hw_state: dpll: 0x%x, dpll_md: 0x%x, "
                               "fp0: 0x%x, fp1: 0x%x\n",
@@ -12528,6 +12536,7 @@ intel_pipe_config_compare(struct drm_device *dev,
         PIPE_CONF_CHECK_X(dpll_hw_state.fp0);
         PIPE_CONF_CHECK_X(dpll_hw_state.fp1);
         PIPE_CONF_CHECK_X(dpll_hw_state.wrpll);
+        PIPE_CONF_CHECK_X(dpll_hw_state.spll);
         PIPE_CONF_CHECK_X(dpll_hw_state.ctrl1);
         PIPE_CONF_CHECK_X(dpll_hw_state.cfgcr1);
         PIPE_CONF_CHECK_X(dpll_hw_state.cfgcr2);
@@ -13032,6 +13041,9 @@ static int intel_atomic_check(struct drm_device *dev,
                 struct intel_crtc_state *pipe_config =
                         to_intel_crtc_state(crtc_state);
 
+                memset(&to_intel_crtc(crtc)->atomic, 0,
+                       sizeof(struct intel_crtc_atomic_commit));
+
                 /* Catch I915_MODE_FLAG_INHERITED */
                 if (crtc_state->mode.private_flags != crtc->state->mode.private_flags)
                         crtc_state->mode_changed = true;
@@ -13056,7 +13068,8 @@ static int intel_atomic_check(struct drm_device *dev,
                 if (ret)
                         return ret;
 
-                if (intel_pipe_config_compare(state->dev,
+                if (i915.fastboot &&
+                    intel_pipe_config_compare(state->dev,
                                         to_intel_crtc_state(crtc->state),
                                         pipe_config, true)) {
                         crtc_state->mode_changed = false;
@@ -14364,16 +14377,17 @@ static int intel_framebuffer_init(struct drm_device *dev,
 static struct drm_framebuffer *
 intel_user_framebuffer_create(struct drm_device *dev,
                               struct drm_file *filp,
-                              struct drm_mode_fb_cmd2 *mode_cmd)
+                              struct drm_mode_fb_cmd2 *user_mode_cmd)
 {
         struct drm_i915_gem_object *obj;
+        struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
 
         obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
-                                                mode_cmd->handles[0]));
+                                                mode_cmd.handles[0]));
         if (&obj->base == NULL)
                 return ERR_PTR(-ENOENT);
 
-        return intel_framebuffer_create(dev, mode_cmd, obj);
+        return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
 
 #ifndef CONFIG_DRM_FBDEV_EMULATION
@@ -14705,6 +14719,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Apple Macbook 2,1 (Core 2 T7400) */
         { 0x27a2, 0x8086, 0x7270, quirk_backlight_present },
 
+        /* Apple Macbook 4,1 */
+        { 0x2a02, 0x106b, 0x00a1, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d52a15df6917..071a76b9ac52 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4449,7 +4449,7 @@ static void gen6_set_rps(struct drm_device *dev, u8 val)
         POSTING_READ(GEN6_RPNSWREQ);
 
         dev_priv->rps.cur_freq = val;
-        trace_intel_gpu_freq_change(val * 50);
+        trace_intel_gpu_freq_change(intel_gpu_freq(dev_priv, val));
 }
 
 static void valleyview_set_rps(struct drm_device *dev, u8 val)
@@ -7255,7 +7255,8 @@ static int chv_freq_opcode(struct drm_i915_private *dev_priv, int val)
 int intel_gpu_freq(struct drm_i915_private *dev_priv, int val)
 {
         if (IS_GEN9(dev_priv->dev))
-                return (val * GT_FREQUENCY_MULTIPLIER) / GEN9_FREQ_SCALER;
+                return DIV_ROUND_CLOSEST(val * GT_FREQUENCY_MULTIPLIER,
+                                         GEN9_FREQ_SCALER);
         else if (IS_CHERRYVIEW(dev_priv->dev))
                 return chv_gpu_freq(dev_priv, val);
         else if (IS_VALLEYVIEW(dev_priv->dev))
@@ -7267,13 +7268,14 @@ int intel_gpu_freq(struct drm_i915_private *dev_priv, int val)
 int intel_freq_opcode(struct drm_i915_private *dev_priv, int val)
 {
         if (IS_GEN9(dev_priv->dev))
-                return (val * GEN9_FREQ_SCALER) / GT_FREQUENCY_MULTIPLIER;
+                return DIV_ROUND_CLOSEST(val * GEN9_FREQ_SCALER,
+                                         GT_FREQUENCY_MULTIPLIER);
         else if (IS_CHERRYVIEW(dev_priv->dev))
                 return chv_freq_opcode(dev_priv, val);
         else if (IS_VALLEYVIEW(dev_priv->dev))
                 return byt_freq_opcode(dev_priv, val);
         else
-                return val / GT_FREQUENCY_MULTIPLIER;
+                return DIV_ROUND_CLOSEST(val, GT_FREQUENCY_MULTIPLIER);
 }
 
 struct request_boost {
diff --git a/drivers/gpu/drm/mgag200/mgag200_cursor.c b/drivers/gpu/drm/mgag200/mgag200_cursor.c
index 4f2068fe5d88..a7bf6a90eae5 100644
--- a/drivers/gpu/drm/mgag200/mgag200_cursor.c
+++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c
@@ -70,6 +70,11 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
         BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev);
         BUG_ON(pixels_current == pixels_prev);
 
+        if (!handle || !file_priv) {
+                mga_hide_cursor(mdev);
+                return 0;
+        }
+
         obj = drm_gem_object_lookup(dev, file_priv, handle);
         if (!obj)
                 return -ENOENT;
@@ -88,12 +93,6 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
                 goto out_unreserve1;
         }
 
-        if (!handle) {
-                mga_hide_cursor(mdev);
-                ret = 0;
-                goto out1;
-        }
-
         /* Move cursor buffers into VRAM if they aren't already */
         if (!pixels_1->pin_count) {
                 ret = mgag200_bo_pin(pixels_1, TTM_PL_FLAG_VRAM,
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index d3024883b844..84d45633d28c 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -221,11 +221,17 @@ int radeon_bo_create(struct radeon_device *rdev,
         if (!(rdev->flags & RADEON_IS_PCIE))
                 bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 
+        /* Write-combined CPU mappings of GTT cause GPU hangs with RV6xx
+         * See https://bugs.freedesktop.org/show_bug.cgi?id=91268
+         */
+        if (rdev->family >= CHIP_RV610 && rdev->family <= CHIP_RV635)
+                bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
+
 #ifdef CONFIG_X86_32
         /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
          * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
          */
-        bo->flags &= ~RADEON_GEM_GTT_WC;
+        bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 #elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
         /* Don't try to enable write-combining when it can't work, or things
          * may be slow
@@ -235,9 +241,10 @@ int radeon_bo_create(struct radeon_device *rdev,
 #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \
          thanks to write-combining
 
-        DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
-                      "better performance thanks to write-combining\n");
-        bo->flags &= ~RADEON_GEM_GTT_WC;
+        if (bo->flags & RADEON_GEM_GTT_WC)
+                DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
+                              "better performance thanks to write-combining\n");
+        bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 #endif
 
         radeon_ttm_placement_from_domain(bo, domain);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 6d80dde23400..f4f03dcc1530 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1542,8 +1542,7 @@ int radeon_pm_late_init(struct radeon_device *rdev)
                                 ret = device_create_file(rdev->dev, &dev_attr_power_method);
                                 if (ret)
                                         DRM_ERROR("failed to create device file for power method\n");
-                                if (!ret)
-                                        rdev->pm.sysfs_initialized = true;
+                                rdev->pm.sysfs_initialized = true;
                         }
 
                         mutex_lock(&rdev->pm.mutex);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index e72bf46042e0..a82b891ae1fe 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2927,7 +2927,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
         { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
-        { PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
+        { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
         { 0, 0, 0, 0 },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 7a9f4768591e..265064c62d49 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -168,7 +168,7 @@ static int vc4_get_clock_select(struct drm_crtc *crtc)
         struct drm_connector *connector;
 
         drm_for_each_connector(connector, crtc->dev) {
-                if (connector && connector->state->crtc == crtc) {
+                if (connector->state->crtc == crtc) {
                         struct drm_encoder *encoder = connector->encoder;
                         struct vc4_encoder *vc4_encoder =
                                 to_vc4_encoder(encoder);
@@ -401,7 +401,8 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
                 dlist_next++;
 
                 HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
-                          (u32 *)vc4_crtc->dlist - (u32 *)vc4->hvs->dlist);
+                          (u32 __iomem *)vc4_crtc->dlist -
+                          (u32 __iomem *)vc4->hvs->dlist);
 
                 /* Make the next display list start after ours. */
                 vc4_crtc->dlist_size -= (dlist_next - vc4_crtc->dlist);
@@ -591,14 +592,14 @@ static int vc4_crtc_bind(struct device *dev, struct device *master, void *data)
          * that will take too much.
          */
         primary_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_PRIMARY);
-        if (!primary_plane) {
+        if (IS_ERR(primary_plane)) {
                 dev_err(dev, "failed to construct primary plane\n");
                 ret = PTR_ERR(primary_plane);
                 goto err;
         }
 
         cursor_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_CURSOR);
-        if (!cursor_plane) {
+        if (IS_ERR(cursor_plane)) {
                 dev_err(dev, "failed to construct cursor plane\n");
                 ret = PTR_ERR(cursor_plane);
                 goto err_primary;
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 6e730605edcc..d5db9e0f3b73 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -259,7 +259,6 @@ static struct platform_driver vc4_platform_driver = {
         .remove         = vc4_platform_drm_remove,
         .driver         = {
                 .name   = "vc4-drm",
-                .owner  = THIS_MODULE,
                 .of_match_table = vc4_of_match,
         },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
index ab1673f672a4..8098c5b21ba4 100644
--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -75,10 +75,10 @@ void vc4_hvs_dump_state(struct drm_device *dev)
         for (i = 0; i < 64; i += 4) {
                 DRM_INFO("0x%08x (%s): 0x%08x 0x%08x 0x%08x 0x%08x\n",
                          i * 4, i < HVS_BOOTLOADER_DLIST_END ? "B" : "D",
-                         ((uint32_t *)vc4->hvs->dlist)[i + 0],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 1],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 2],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 3]);
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 0),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 1),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 2),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 3));
         }
 }
 
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index cdd8b10c0147..887f3caad0be 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -70,7 +70,7 @@ static bool plane_enabled(struct drm_plane_state *state)
         return state->fb && state->crtc;
 }
 
-struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
+static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
 {
         struct vc4_plane_state *vc4_state;
 
@@ -97,8 +97,8 @@ struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
         return &vc4_state->base;
 }
 
-void vc4_plane_destroy_state(struct drm_plane *plane,
-                             struct drm_plane_state *state)
+static void vc4_plane_destroy_state(struct drm_plane *plane,
+                                    struct drm_plane_state *state)
 {
         struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
 
@@ -108,7 +108,7 @@ void vc4_plane_destroy_state(struct drm_plane *plane,
 }
 
 /* Called during init to allocate the plane's atomic state. */
-void vc4_plane_reset(struct drm_plane *plane)
+static void vc4_plane_reset(struct drm_plane *plane)
 {
         struct vc4_plane_state *vc4_state;
 
@@ -157,6 +157,16 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
         int crtc_w = state->crtc_w;
         int crtc_h = state->crtc_h;
 
+        if (state->crtc_w << 16 != state->src_w ||
+            state->crtc_h << 16 != state->src_h) {
+                /* We don't support scaling yet, which involves
+                 * allocating the LBM memory for scaling temporary
+                 * storage, and putting filter kernels in the HVS
+                 * context.
+                 */
+                return -EINVAL;
+        }
+
         if (crtc_x < 0) {
                 offset += drm_format_plane_cpp(fb->pixel_format, 0) * -crtc_x;
                 crtc_w += crtc_x;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index e24c2b680b47..7b0aa82ea38b 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -126,6 +126,7 @@ config I2C_I801
             Sunrise Point-LP (PCH)
             DNV (SOC)
             Broxton (SOC)
+            Lewisburg (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index c306751ceadb..f62d69799a9c 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -62,6 +62,8 @@
  * Sunrise Point-LP (PCH)       0x9d23  32      hard    yes     yes     yes
  * DNV (SOC)                    0x19df  32      hard    yes     yes     yes
  * Broxton (SOC)                0x5ad4  32      hard    yes     yes     yes
+ * Lewisburg (PCH)              0xa1a3  32      hard    yes     yes     yes
+ * Lewisburg Supersku (PCH)     0xa223  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -206,6 +208,8 @@
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS       0x9d23
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS               0x5ad4
+#define PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS             0xa1a3
+#define PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS        0xa223
 
 struct i801_mux_config {
         char *gpio_chip;
@@ -869,6 +873,8 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS) },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 1e4d99da4164..9bb0b056b25f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -50,6 +50,7 @@
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
 #include <linux/of_gpio.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_data/i2c-imx.h>
 #include <linux/platform_device.h>
 #include <linux/sched.h>
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index e23a7b068c60..0b20449e48cf 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -662,8 +662,10 @@ static void __xiic_start_xfer(struct xiic_i2c *i2c)
 
 static void xiic_start_xfer(struct xiic_i2c *i2c)
 {
-
+        spin_lock(&i2c->lock);
+        xiic_reinit(i2c);
         __xiic_start_xfer(i2c);
+        spin_unlock(&i2c->lock);
 }
 
 static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 040af5cc8143..ba8eb087f224 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -715,7 +715,7 @@ static int i2c_device_probe(struct device *dev)
                 if (wakeirq > 0 && wakeirq != client->irq)
                         status = dev_pm_set_dedicated_wake_irq(dev, wakeirq);
                 else if (client->irq > 0)
-                        status = dev_pm_set_wake_irq(dev, wakeirq);
+                        status = dev_pm_set_wake_irq(dev, client->irq);
                 else
                         status = 0;
 
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index eea0c79111e7..4d960d3b93c0 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -101,7 +101,7 @@
 #define AD7795_CH_AIN1M_AIN1M   8 /* AIN1(-) - AIN1(-) */
 
 /* ID Register Bit Designations (AD7793_REG_ID) */
-#define AD7785_ID               0xB
+#define AD7785_ID               0x3
 #define AD7792_ID               0xA
 #define AD7793_ID               0xB
 #define AD7794_ID               0xF
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 599cde3d03a1..b10f629cc44b 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -106,6 +106,13 @@
 
 #define DEFAULT_SAMPLE_TIME             1000
 
+/* V at 25°C of 696 mV */
+#define VF610_VTEMP25_3V0               950
+/* V at 25°C of 699 mV */
+#define VF610_VTEMP25_3V3               867
+/* Typical sensor slope coefficient at all temperatures */
+#define VF610_TEMP_SLOPE_COEFF          1840
+
 enum clk_sel {
         VF610_ADCIOC_BUSCLK_SET,
         VF610_ADCIOC_ALTCLK_SET,
@@ -197,6 +204,8 @@ static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
                 adc_feature->clk_div = 8;
         }
 
+        adck_rate = ipg_rate / adc_feature->clk_div;
+
         /*
          * Determine the long sample time adder value to be used based
          * on the default minimum sample time provided.
@@ -221,7 +230,6 @@ static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
          * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
          * LSTAdder(Long Sample Time): 3, 5, 7, 9, 13, 17, 21, 25 ADCK cycles
          */
-        adck_rate = ipg_rate / info->adc_feature.clk_div;
         for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
                 info->sample_freq_avail[i] =
                         adck_rate / (6 + vf610_hw_avgs[i] *
@@ -663,11 +671,13 @@ static int vf610_read_raw(struct iio_dev *indio_dev,
                         break;
                 case IIO_TEMP:
                         /*
-                        * Calculate in degree Celsius times 1000
-                        * Using sensor slope of 1.84 mV/°C and
-                        * V at 25°C of 696 mV
-                        */
-                        *val = 25000 - ((int)info->value - 864) * 1000000 / 1840;
+                         * Calculate in degree Celsius times 1000
+                         * Using the typical sensor slope of 1.84 mV/°C
+                         * and VREFH_ADC at 3.3V, V at 25°C of 699 mV
+                         */
+                        *val = 25000 - ((int)info->value - VF610_VTEMP25_3V3) *
+                                        1000000 / VF610_TEMP_SLOPE_COEFF;
+
                         break;
                 default:
                         mutex_unlock(&indio_dev->mlock);
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 0370624a35db..02e636a1c49a 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -841,6 +841,7 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
                         case XADC_REG_VCCINT:
                         case XADC_REG_VCCAUX:
                         case XADC_REG_VREFP:
+                        case XADC_REG_VREFN:
                         case XADC_REG_VCCBRAM:
                         case XADC_REG_VCCPINT:
                         case XADC_REG_VCCPAUX:
diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
index 9e4d2c18b554..81ca0081a019 100644
--- a/drivers/iio/dac/ad5064.c
+++ b/drivers/iio/dac/ad5064.c
@@ -113,12 +113,16 @@ enum ad5064_type {
         ID_AD5065,
         ID_AD5628_1,
         ID_AD5628_2,
+        ID_AD5629_1,
+        ID_AD5629_2,
         ID_AD5648_1,
         ID_AD5648_2,
         ID_AD5666_1,
         ID_AD5666_2,
         ID_AD5668_1,
         ID_AD5668_2,
+        ID_AD5669_1,
+        ID_AD5669_2,
 };
 
 static int ad5064_write(struct ad5064_state *st, unsigned int cmd,
@@ -291,7 +295,7 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = {
         { },
 };
 
-#define AD5064_CHANNEL(chan, addr, bits) {                      \
+#define AD5064_CHANNEL(chan, addr, bits, _shift) {              \
         .type = IIO_VOLTAGE,                                    \
         .indexed = 1,                                           \
         .output = 1,                                            \
@@ -303,36 +307,39 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = {
                 .sign = 'u',                                    \
                 .realbits = (bits),                             \
                 .storagebits = 16,                              \
-                .shift = 20 - bits,                             \
+                .shift = (_shift),                              \
         },                                                      \
         .ext_info = ad5064_ext_info,                            \
 }
 
-#define DECLARE_AD5064_CHANNELS(name, bits) \
+#define DECLARE_AD5064_CHANNELS(name, bits, shift) \
 const struct iio_chan_spec name[] = { \
-        AD5064_CHANNEL(0, 0, bits), \
-        AD5064_CHANNEL(1, 1, bits), \
-        AD5064_CHANNEL(2, 2, bits), \
-        AD5064_CHANNEL(3, 3, bits), \
-        AD5064_CHANNEL(4, 4, bits), \
-        AD5064_CHANNEL(5, 5, bits), \
-        AD5064_CHANNEL(6, 6, bits), \
-        AD5064_CHANNEL(7, 7, bits), \
+        AD5064_CHANNEL(0, 0, bits, shift), \
+        AD5064_CHANNEL(1, 1, bits, shift), \
+        AD5064_CHANNEL(2, 2, bits, shift), \
+        AD5064_CHANNEL(3, 3, bits, shift), \
+        AD5064_CHANNEL(4, 4, bits, shift), \
+        AD5064_CHANNEL(5, 5, bits, shift), \
+        AD5064_CHANNEL(6, 6, bits, shift), \
+        AD5064_CHANNEL(7, 7, bits, shift), \
 }
 
-#define DECLARE_AD5065_CHANNELS(name, bits) \
+#define DECLARE_AD5065_CHANNELS(name, bits, shift) \
 const struct iio_chan_spec name[] = { \
-        AD5064_CHANNEL(0, 0, bits), \
-        AD5064_CHANNEL(1, 3, bits), \
+        AD5064_CHANNEL(0, 0, bits, shift), \
+        AD5064_CHANNEL(1, 3, bits, shift), \
 }
 
-static DECLARE_AD5064_CHANNELS(ad5024_channels, 12);
-static DECLARE_AD5064_CHANNELS(ad5044_channels, 14);
-static DECLARE_AD5064_CHANNELS(ad5064_channels, 16);
+static DECLARE_AD5064_CHANNELS(ad5024_channels, 12, 8);
+static DECLARE_AD5064_CHANNELS(ad5044_channels, 14, 6);
+static DECLARE_AD5064_CHANNELS(ad5064_channels, 16, 4);
 
-static DECLARE_AD5065_CHANNELS(ad5025_channels, 12);
-static DECLARE_AD5065_CHANNELS(ad5045_channels, 14);
-static DECLARE_AD5065_CHANNELS(ad5065_channels, 16);
+static DECLARE_AD5065_CHANNELS(ad5025_channels, 12, 8);
+static DECLARE_AD5065_CHANNELS(ad5045_channels, 14, 6);
+static DECLARE_AD5065_CHANNELS(ad5065_channels, 16, 4);
+
+static DECLARE_AD5064_CHANNELS(ad5629_channels, 12, 4);
+static DECLARE_AD5064_CHANNELS(ad5669_channels, 16, 0);
 
 static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
         [ID_AD5024] = {
@@ -382,6 +389,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
                 .channels = ad5024_channels,
                 .num_channels = 8,
         },
+        [ID_AD5629_1] = {
+                .shared_vref = true,
+                .internal_vref = 2500000,
+                .channels = ad5629_channels,
+                .num_channels = 8,
+        },
+        [ID_AD5629_2] = {
+                .shared_vref = true,
+                .internal_vref = 5000000,
+                .channels = ad5629_channels,
+                .num_channels = 8,
+        },
         [ID_AD5648_1] = {
                 .shared_vref = true,
                 .internal_vref = 2500000,
@@ -418,6 +437,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
                 .channels = ad5064_channels,
                 .num_channels = 8,
         },
+        [ID_AD5669_1] = {
+                .shared_vref = true,
+                .internal_vref = 2500000,
+                .channels = ad5669_channels,
+                .num_channels = 8,
+        },
+        [ID_AD5669_2] = {
+                .shared_vref = true,
+                .internal_vref = 5000000,
+                .channels = ad5669_channels,
+                .num_channels = 8,
+        },
 };
 
 static inline unsigned int ad5064_num_vref(struct ad5064_state *st)
@@ -597,10 +628,16 @@ static int ad5064_i2c_write(struct ad5064_state *st, unsigned int cmd,
         unsigned int addr, unsigned int val)
 {
         struct i2c_client *i2c = to_i2c_client(st->dev);
+        int ret;
 
         st->data.i2c[0] = (cmd << 4) | addr;
         put_unaligned_be16(val, &st->data.i2c[1]);
-        return i2c_master_send(i2c, st->data.i2c, 3);
+
+        ret = i2c_master_send(i2c, st->data.i2c, 3);
+        if (ret < 0)
+                return ret;
+
+        return 0;
 }
 
 static int ad5064_i2c_probe(struct i2c_client *i2c,
@@ -616,12 +653,12 @@ static int ad5064_i2c_remove(struct i2c_client *i2c)
 }
 
 static const struct i2c_device_id ad5064_i2c_ids[] = {
-        {"ad5629-1", ID_AD5628_1},
-        {"ad5629-2", ID_AD5628_2},
-        {"ad5629-3", ID_AD5628_2}, /* similar enough to ad5629-2 */
-        {"ad5669-1", ID_AD5668_1},
-        {"ad5669-2", ID_AD5668_2},
-        {"ad5669-3", ID_AD5668_2}, /* similar enough to ad5669-2 */
+        {"ad5629-1", ID_AD5629_1},
+        {"ad5629-2", ID_AD5629_2},
+        {"ad5629-3", ID_AD5629_2}, /* similar enough to ad5629-2 */
+        {"ad5669-1", ID_AD5669_1},
+        {"ad5669-2", ID_AD5669_2},
+        {"ad5669-3", ID_AD5669_2}, /* similar enough to ad5669-2 */
         {}
 };
 MODULE_DEVICE_TABLE(i2c, ad5064_i2c_ids);
diff --git a/drivers/iio/humidity/si7020.c b/drivers/iio/humidity/si7020.c
index 12128d1ca570..71991b5c0658 100644
--- a/drivers/iio/humidity/si7020.c
+++ b/drivers/iio/humidity/si7020.c
@@ -50,10 +50,10 @@ static int si7020_read_raw(struct iio_dev *indio_dev,
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                ret = i2c_smbus_read_word_data(*client,
-                                               chan->type == IIO_TEMP ?
-                                               SI7020CMD_TEMP_HOLD :
-                                               SI7020CMD_RH_HOLD);
+                ret = i2c_smbus_read_word_swapped(*client,
+                                                  chan->type == IIO_TEMP ?
+                                                  SI7020CMD_TEMP_HOLD :
+                                                  SI7020CMD_RH_HOLD);
                 if (ret < 0)
                         return ret;
                 *val = ret >> 2;
diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c
index 44a077f3a4a2..f174ce0ca361 100644
--- a/drivers/irqchip/irq-gic-common.c
+++ b/drivers/irqchip/irq-gic-common.c
@@ -84,12 +84,15 @@ void __init gic_dist_config(void __iomem *base, int gic_irqs,
                 writel_relaxed(GICD_INT_DEF_PRI_X4, base + GIC_DIST_PRI + i);
 
         /*
-         * Disable all interrupts.  Leave the PPI and SGIs alone
-         * as they are enabled by redistributor registers.
+         * Deactivate and disable all SPIs. Leave the PPI and SGIs
+         * alone as they are in the redistributor registers on GICv3.
          */
-        for (i = 32; i < gic_irqs; i += 32)
+        for (i = 32; i < gic_irqs; i += 32) {
                 writel_relaxed(GICD_INT_EN_CLR_X32,
-                                        base + GIC_DIST_ENABLE_CLEAR + i / 8);
+                               base + GIC_DIST_ACTIVE_CLEAR + i / 8);
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               base + GIC_DIST_ENABLE_CLEAR + i / 8);
+        }
 
         if (sync_access)
                 sync_access();
@@ -102,7 +105,9 @@ void gic_cpu_config(void __iomem *base, void (*sync_access)(void))
         /*
          * Deal with the banked PPI and SGI interrupts - disable all
          * PPI interrupts, ensure all SGI interrupts are enabled.
+         * Make sure everything is deactivated.
          */
+        writel_relaxed(GICD_INT_EN_CLR_X32, base + GIC_DIST_ACTIVE_CLEAR);
         writel_relaxed(GICD_INT_EN_CLR_PPI, base + GIC_DIST_ENABLE_CLEAR);
         writel_relaxed(GICD_INT_EN_SET_SGI, base + GIC_DIST_ENABLE_SET);
 
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 515c823c1c95..abf2ffaed392 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -73,9 +73,11 @@ struct gic_chip_data {
         union gic_base cpu_base;
 #ifdef CONFIG_CPU_PM
         u32 saved_spi_enable[DIV_ROUND_UP(1020, 32)];
+        u32 saved_spi_active[DIV_ROUND_UP(1020, 32)];
         u32 saved_spi_conf[DIV_ROUND_UP(1020, 16)];
         u32 saved_spi_target[DIV_ROUND_UP(1020, 4)];
         u32 __percpu *saved_ppi_enable;
+        u32 __percpu *saved_ppi_active;
         u32 __percpu *saved_ppi_conf;
 #endif
         struct irq_domain *domain;
@@ -566,6 +568,10 @@ static void gic_dist_save(unsigned int gic_nr)
         for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
                 gic_data[gic_nr].saved_spi_enable[i] =
                         readl_relaxed(dist_base + GIC_DIST_ENABLE_SET + i * 4);
+
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
+                gic_data[gic_nr].saved_spi_active[i] =
+                        readl_relaxed(dist_base + GIC_DIST_ACTIVE_SET + i * 4);
 }
 
 /*
@@ -604,9 +610,19 @@ static void gic_dist_restore(unsigned int gic_nr)
                 writel_relaxed(gic_data[gic_nr].saved_spi_target[i],
                         dist_base + GIC_DIST_TARGET + i * 4);
 
-        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                        dist_base + GIC_DIST_ENABLE_CLEAR + i * 4);
                 writel_relaxed(gic_data[gic_nr].saved_spi_enable[i],
                         dist_base + GIC_DIST_ENABLE_SET + i * 4);
+        }
+
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                        dist_base + GIC_DIST_ACTIVE_CLEAR + i * 4);
+                writel_relaxed(gic_data[gic_nr].saved_spi_active[i],
+                        dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+        }
 
         writel_relaxed(GICD_ENABLE, dist_base + GIC_DIST_CTRL);
 }
@@ -631,6 +647,10 @@ static void gic_cpu_save(unsigned int gic_nr)
         for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
                 ptr[i] = readl_relaxed(dist_base + GIC_DIST_ENABLE_SET + i * 4);
 
+        ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_active);
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
+                ptr[i] = readl_relaxed(dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_conf);
         for (i = 0; i < DIV_ROUND_UP(32, 16); i++)
                 ptr[i] = readl_relaxed(dist_base + GIC_DIST_CONFIG + i * 4);
@@ -654,8 +674,18 @@ static void gic_cpu_restore(unsigned int gic_nr)
                 return;
 
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_enable);
-        for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               dist_base + GIC_DIST_ENABLE_CLEAR + i * 4);
                 writel_relaxed(ptr[i], dist_base + GIC_DIST_ENABLE_SET + i * 4);
+        }
+
+        ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_active);
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               dist_base + GIC_DIST_ACTIVE_CLEAR + i * 4);
+                writel_relaxed(ptr[i], dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+        }
 
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_conf);
         for (i = 0; i < DIV_ROUND_UP(32, 16); i++)
@@ -710,6 +740,10 @@ static void __init gic_pm_init(struct gic_chip_data *gic)
                 sizeof(u32));
         BUG_ON(!gic->saved_ppi_enable);
 
+        gic->saved_ppi_active = __alloc_percpu(DIV_ROUND_UP(32, 32) * 4,
+                sizeof(u32));
+        BUG_ON(!gic->saved_ppi_active);
+
         gic->saved_ppi_conf = __alloc_percpu(DIV_ROUND_UP(32, 16) * 4,
                 sizeof(u32));
         BUG_ON(!gic->saved_ppi_conf);
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index f659e605a406..5178645ac42b 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -160,11 +160,6 @@ int nvm_erase_blk(struct nvm_dev *dev, struct nvm_block *blk)
 }
 EXPORT_SYMBOL(nvm_erase_blk);
 
-static void nvm_core_free(struct nvm_dev *dev)
-{
-        kfree(dev);
-}
-
 static int nvm_core_init(struct nvm_dev *dev)
 {
         struct nvm_id *id = &dev->identity;
@@ -179,12 +174,21 @@ static int nvm_core_init(struct nvm_dev *dev)
         dev->sec_size = grp->csecs;
         dev->oob_size = grp->sos;
         dev->sec_per_pg = grp->fpg_sz / grp->csecs;
-        dev->addr_mode = id->ppat;
-        dev->addr_format = id->ppaf;
+        memcpy(&dev->ppaf, &id->ppaf, sizeof(struct nvm_addr_format));
 
         dev->plane_mode = NVM_PLANE_SINGLE;
         dev->max_rq_size = dev->ops->max_phys_sect * dev->sec_size;
 
+        if (grp->mtype != 0) {
+                pr_err("nvm: memory type not supported\n");
+                return -EINVAL;
+        }
+
+        if (grp->fmtype != 0 && grp->fmtype != 1) {
+                pr_err("nvm: flash type not supported\n");
+                return -EINVAL;
+        }
+
         if (grp->mpos & 0x020202)
                 dev->plane_mode = NVM_PLANE_DOUBLE;
         if (grp->mpos & 0x040404)
@@ -213,21 +217,18 @@ static void nvm_free(struct nvm_dev *dev)
 
         if (dev->mt)
                 dev->mt->unregister_mgr(dev);
-
-        nvm_core_free(dev);
 }
 
 static int nvm_init(struct nvm_dev *dev)
 {
         struct nvmm_type *mt;
-        int ret = 0;
+        int ret = -EINVAL;
 
         if (!dev->q || !dev->ops)
-                return -EINVAL;
+                return ret;
 
         if (dev->ops->identity(dev->q, &dev->identity)) {
                 pr_err("nvm: device could not be identified\n");
-                ret = -EINVAL;
                 goto err;
         }
 
@@ -273,7 +274,6 @@ static int nvm_init(struct nvm_dev *dev)
                         dev->nr_chnls);
         return 0;
 err:
-        nvm_free(dev);
         pr_err("nvm: failed to initialize nvm\n");
         return ret;
 }
@@ -308,22 +308,24 @@ int nvm_register(struct request_queue *q, char *disk_name,
         if (ret)
                 goto err_init;
 
-        down_write(&nvm_lock);
-        list_add(&dev->devices, &nvm_devices);
-        up_write(&nvm_lock);
-
         if (dev->ops->max_phys_sect > 1) {
                 dev->ppalist_pool = dev->ops->create_dma_pool(dev->q,
                                                                 "ppalist");
                 if (!dev->ppalist_pool) {
                         pr_err("nvm: could not create ppa pool\n");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err_init;
                 }
         } else if (dev->ops->max_phys_sect > 256) {
                 pr_info("nvm: max sectors supported is 256.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_init;
         }
 
+        down_write(&nvm_lock);
+        list_add(&dev->devices, &nvm_devices);
+        up_write(&nvm_lock);
+
         return 0;
 err_init:
         kfree(dev);
@@ -341,11 +343,12 @@ void nvm_unregister(char *disk_name)
                 return;
         }
 
-        nvm_exit(dev);
-
         down_write(&nvm_lock);
         list_del(&dev->devices);
         up_write(&nvm_lock);
+
+        nvm_exit(dev);
+        kfree(dev);
 }
 EXPORT_SYMBOL(nvm_unregister);
 
@@ -457,11 +460,11 @@ static void nvm_remove_target(struct nvm_target *t)
         lockdep_assert_held(&nvm_lock);
 
         del_gendisk(tdisk);
+        blk_cleanup_queue(q);
+
         if (tt->exit)
                 tt->exit(tdisk->private_data);
 
-        blk_cleanup_queue(q);
-
         put_disk(tdisk);
 
         list_del(&t->list);
@@ -541,7 +544,7 @@ static int nvm_configure_show(const char *val)
         if (!dev->mt)
                 return 0;
 
-        dev->mt->free_blocks_print(dev);
+        dev->mt->lun_info_print(dev);
 
         return 0;
 }
diff --git a/drivers/lightnvm/gennvm.c b/drivers/lightnvm/gennvm.c
index ae1fb2bdc5f4..e20e74ec6b91 100644
--- a/drivers/lightnvm/gennvm.c
+++ b/drivers/lightnvm/gennvm.c
@@ -60,23 +60,28 @@ static int gennvm_luns_init(struct nvm_dev *dev, struct gen_nvm *gn)
                 lun->vlun.lun_id = i % dev->luns_per_chnl;
                 lun->vlun.chnl_id = i / dev->luns_per_chnl;
                 lun->vlun.nr_free_blocks = dev->blks_per_lun;
+                lun->vlun.nr_inuse_blocks = 0;
+                lun->vlun.nr_bad_blocks = 0;
         }
         return 0;
 }
 
-static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
+static int gennvm_block_bb(struct ppa_addr ppa, int nr_blocks, u8 *blks,
                                                                 void *private)
 {
         struct gen_nvm *gn = private;
-        struct gen_lun *lun = &gn->luns[lun_id];
+        struct nvm_dev *dev = gn->dev;
+        struct gen_lun *lun;
         struct nvm_block *blk;
         int i;
 
-        if (unlikely(bitmap_empty(bb_bitmap, nr_blocks)))
-                return 0;
+        ppa = dev_to_generic_addr(gn->dev, ppa);
+        lun = &gn->luns[(dev->nr_luns * ppa.g.ch) + ppa.g.lun];
+
+        for (i = 0; i < nr_blocks; i++) {
+                if (blks[i] == 0)
+                        continue;
 
-        i = -1;
-        while ((i = find_next_bit(bb_bitmap, nr_blocks, i + 1)) < nr_blocks) {
                 blk = &lun->vlun.blocks[i];
                 if (!blk) {
                         pr_err("gennvm: BB data is out of bounds.\n");
@@ -84,6 +89,7 @@ static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
                 }
 
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
         }
 
         return 0;
@@ -136,6 +142,7 @@ static int gennvm_block_map(u64 slba, u32 nlb, __le64 *entries, void *private)
                         list_move_tail(&blk->list, &lun->used_list);
                         blk->type = 1;
                         lun->vlun.nr_free_blocks--;
+                        lun->vlun.nr_inuse_blocks++;
                 }
         }
 
@@ -164,15 +171,25 @@ static int gennvm_blocks_init(struct nvm_dev *dev, struct gen_nvm *gn)
                         block->id = cur_block_id++;
 
                         /* First block is reserved for device */
-                        if (unlikely(lun_iter == 0 && blk_iter == 0))
+                        if (unlikely(lun_iter == 0 && blk_iter == 0)) {
+                                lun->vlun.nr_free_blocks--;
                                 continue;
+                        }
 
                         list_add_tail(&block->list, &lun->free_list);
                 }
 
                 if (dev->ops->get_bb_tbl) {
-                        ret = dev->ops->get_bb_tbl(dev->q, lun->vlun.id,
-                                        dev->blks_per_lun, gennvm_block_bb, gn);
+                        struct ppa_addr ppa;
+
+                        ppa.ppa = 0;
+                        ppa.g.ch = lun->vlun.chnl_id;
+                        ppa.g.lun = lun->vlun.id;
+                        ppa = generic_to_dev_addr(dev, ppa);
+
+                        ret = dev->ops->get_bb_tbl(dev->q, ppa,
+                                                dev->blks_per_lun,
+                                                gennvm_block_bb, gn);
                         if (ret)
                                 pr_err("gennvm: could not read BB table\n");
                 }
@@ -199,6 +216,7 @@ static int gennvm_register(struct nvm_dev *dev)
         if (!gn)
                 return -ENOMEM;
 
+        gn->dev = dev;
         gn->nr_luns = dev->nr_luns;
         dev->mp = gn;
 
@@ -254,6 +272,7 @@ static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
         blk->type = 1;
 
         lun->vlun.nr_free_blocks--;
+        lun->vlun.nr_inuse_blocks++;
 
         spin_unlock(&vlun->lock);
 out:
@@ -271,16 +290,21 @@ static void gennvm_put_blk(struct nvm_dev *dev, struct nvm_block *blk)
         case 1:
                 list_move_tail(&blk->list, &lun->free_list);
                 lun->vlun.nr_free_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 blk->type = 0;
                 break;
         case 2:
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 break;
         default:
                 WARN_ON_ONCE(1);
                 pr_err("gennvm: erroneous block type (%lu -> %u)\n",
                                                         blk->id, blk->type);
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
         }
 
         spin_unlock(&vlun->lock);
@@ -292,10 +316,10 @@ static void gennvm_addr_to_generic_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = addr_to_generic_mode(dev,
+                        rqd->ppa_list[i] = dev_to_generic_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = addr_to_generic_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = dev_to_generic_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -305,10 +329,10 @@ static void gennvm_generic_to_addr_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = generic_to_addr_mode(dev,
+                        rqd->ppa_list[i] = generic_to_dev_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = generic_to_addr_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = generic_to_dev_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -354,10 +378,10 @@ static void gennvm_mark_blk_bad(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
         int i;
 
-        if (!dev->ops->set_bb)
+        if (!dev->ops->set_bb_tbl)
                 return;
 
-        if (dev->ops->set_bb(dev->q, rqd, 1))
+        if (dev->ops->set_bb_tbl(dev->q, rqd, 1))
                 return;
 
         gennvm_addr_to_generic_mode(dev, rqd);
@@ -440,15 +464,24 @@ static struct nvm_lun *gennvm_get_lun(struct nvm_dev *dev, int lunid)
         return &gn->luns[lunid].vlun;
 }
 
-static void gennvm_free_blocks_print(struct nvm_dev *dev)
+static void gennvm_lun_info_print(struct nvm_dev *dev)
 {
         struct gen_nvm *gn = dev->mp;
         struct gen_lun *lun;
         unsigned int i;
 
-        gennvm_for_each_lun(gn, lun, i)
-                pr_info("%s: lun%8u\t%u\n",
-                                        dev->name, i, lun->vlun.nr_free_blocks);
+
+        gennvm_for_each_lun(gn, lun, i) {
+                spin_lock(&lun->vlun.lock);
+
+                pr_info("%s: lun%8u\t%u\t%u\t%u\n",
+                                dev->name, i,
+                                lun->vlun.nr_free_blocks,
+                                lun->vlun.nr_inuse_blocks,
+                                lun->vlun.nr_bad_blocks);
+
+                spin_unlock(&lun->vlun.lock);
+        }
 }
 
 static struct nvmm_type gennvm = {
@@ -466,7 +499,7 @@ static struct nvmm_type gennvm = {
         .erase_blk      = gennvm_erase_blk,
 
         .get_lun        = gennvm_get_lun,
-        .free_blocks_print = gennvm_free_blocks_print,
+        .lun_info_print = gennvm_lun_info_print,
 };
 
 static int __init gennvm_module_init(void)
diff --git a/drivers/lightnvm/gennvm.h b/drivers/lightnvm/gennvm.h
index d23bd3501ddc..9c24b5b32dac 100644
--- a/drivers/lightnvm/gennvm.h
+++ b/drivers/lightnvm/gennvm.h
@@ -35,6 +35,8 @@ struct gen_lun {
 };
 
 struct gen_nvm {
+        struct nvm_dev *dev;
+
         int nr_luns;
         struct gen_lun *luns;
 };
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index 7ba64c87ba1c..75e59c3a3f96 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -123,12 +123,42 @@ static u64 block_to_addr(struct rrpc *rrpc, struct rrpc_block *rblk)
         return blk->id * rrpc->dev->pgs_per_blk;
 }
 
+static struct ppa_addr linear_to_generic_addr(struct nvm_dev *dev,
+                                                        struct ppa_addr r)
+{
+        struct ppa_addr l;
+        int secs, pgs, blks, luns;
+        sector_t ppa = r.ppa;
+
+        l.ppa = 0;
+
+        div_u64_rem(ppa, dev->sec_per_pg, &secs);
+        l.g.sec = secs;
+
+        sector_div(ppa, dev->sec_per_pg);
+        div_u64_rem(ppa, dev->sec_per_blk, &pgs);
+        l.g.pg = pgs;
+
+        sector_div(ppa, dev->pgs_per_blk);
+        div_u64_rem(ppa, dev->blks_per_lun, &blks);
+        l.g.blk = blks;
+
+        sector_div(ppa, dev->blks_per_lun);
+        div_u64_rem(ppa, dev->luns_per_chnl, &luns);
+        l.g.lun = luns;
+
+        sector_div(ppa, dev->luns_per_chnl);
+        l.g.ch = ppa;
+
+        return l;
+}
+
 static struct ppa_addr rrpc_ppa_to_gaddr(struct nvm_dev *dev, u64 addr)
 {
         struct ppa_addr paddr;
 
         paddr.ppa = addr;
-        return __linear_to_generic_addr(dev, paddr);
+        return linear_to_generic_addr(dev, paddr);
 }
 
 /* requires lun->lock taken */
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 917d47e290ae..3147c8d09ea8 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -112,7 +112,8 @@ struct iv_tcw_private {
  * and encrypts / decrypts at the same time.
  */
 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
-             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD };
+             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
+             DM_CRYPT_EXIT_THREAD};
 
 /*
  * The fields in here must be read only after initialization.
@@ -1203,20 +1204,18 @@ continue_locked:
                 if (!RB_EMPTY_ROOT(&cc->write_tree))
                         goto pop_from_list;
 
+                if (unlikely(test_bit(DM_CRYPT_EXIT_THREAD, &cc->flags))) {
+                        spin_unlock_irq(&cc->write_thread_wait.lock);
+                        break;
+                }
+
                 __set_current_state(TASK_INTERRUPTIBLE);
                 __add_wait_queue(&cc->write_thread_wait, &wait);
 
                 spin_unlock_irq(&cc->write_thread_wait.lock);
 
-                if (unlikely(kthread_should_stop())) {
-                        set_task_state(current, TASK_RUNNING);
-                        remove_wait_queue(&cc->write_thread_wait, &wait);
-                        break;
-                }
-
                 schedule();
 
-                set_task_state(current, TASK_RUNNING);
                 spin_lock_irq(&cc->write_thread_wait.lock);
                 __remove_wait_queue(&cc->write_thread_wait, &wait);
                 goto continue_locked;
@@ -1531,8 +1530,13 @@ static void crypt_dtr(struct dm_target *ti)
         if (!cc)
                 return;
 
-        if (cc->write_thread)
+        if (cc->write_thread) {
+                spin_lock_irq(&cc->write_thread_wait.lock);
+                set_bit(DM_CRYPT_EXIT_THREAD, &cc->flags);
+                wake_up_locked(&cc->write_thread_wait);
+                spin_unlock_irq(&cc->write_thread_wait.lock);
                 kthread_stop(cc->write_thread);
+        }
 
         if (cc->io_queue)
                 destroy_workqueue(cc->io_queue);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index aaa6caa46a9f..cfa29f574c2a 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1537,32 +1537,34 @@ static int multipath_prepare_ioctl(struct dm_target *ti,
                 struct block_device **bdev, fmode_t *mode)
 {
         struct multipath *m = ti->private;
-        struct pgpath *pgpath;
         unsigned long flags;
         int r;
 
-        r = 0;
-
         spin_lock_irqsave(&m->lock, flags);
 
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        pgpath = m->current_pgpath;
-
-        if (pgpath) {
-                *bdev = pgpath->path.dev->bdev;
-                *mode = pgpath->path.dev->mode;
+        if (m->current_pgpath) {
+                if (!m->queue_io) {
+                        *bdev = m->current_pgpath->path.dev->bdev;
+                        *mode = m->current_pgpath->path.dev->mode;
+                        r = 0;
+                } else {
+                        /* pg_init has not started or completed */
+                        r = -ENOTCONN;
+                }
+        } else {
+                /* No path is available */
+                if (m->queue_if_no_path)
+                        r = -ENOTCONN;
+                else
+                        r = -EIO;
         }
 
-        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
-                r = -ENOTCONN;
-        else if (!*bdev)
-                r = -EIO;
-
         spin_unlock_irqrestore(&m->lock, flags);
 
-        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
+        if (r == -ENOTCONN) {
                 spin_lock_irqsave(&m->lock, flags);
                 if (!m->current_pg) {
                         /* Path status changed, redo selection */
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 3897b90bd462..63903a5a5d9e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2432,6 +2432,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         case PM_WRITE:
                 if (old_mode != new_mode)
                         notify_of_pool_mode_change(pool, "write");
+                pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard_bio;
@@ -4249,10 +4250,9 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
         struct pool *pool = tc->pool;
-        struct queue_limits *pool_limits = dm_get_queue_limits(pool->pool_md);
 
-        if (!pool_limits->discard_granularity)
-                return; /* pool's discard support is disabled */
+        if (!pool->pf.discard_enabled)
+                return;
 
         limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
         limits->max_discard_sectors = 2048 * 1024 * 16; /* 16G */
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e15f3565892..5df40480228b 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -591,7 +591,7 @@ retry:
 
 out:
         dm_put_live_table(md, *srcu_idx);
-        if (r == -ENOTCONN) {
+        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
                 msleep(10);
                 goto retry;
         }
@@ -603,9 +603,10 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 {
         struct mapped_device *md = bdev->bd_disk->private_data;
         struct dm_target *tgt;
+        struct block_device *tgt_bdev = NULL;
         int srcu_idx, r;
 
-        r = dm_get_live_table_for_ioctl(md, &tgt, &bdev, &mode, &srcu_idx);
+        r = dm_get_live_table_for_ioctl(md, &tgt, &tgt_bdev, &mode, &srcu_idx);
         if (r < 0)
                 return r;
 
@@ -620,7 +621,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
                         goto out;
         }
 
-        r =  __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+        r =  __blkdev_driver_ioctl(tgt_bdev, mode, cmd, arg);
 out:
         dm_put_live_table(md, srcu_idx);
         return r;
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 35759a91d47d..e8f847226a19 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -1992,9 +1992,9 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
                 (unsigned long long)pci_resource_start(pci_dev, 0));
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail_context;
         }
 
diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
index dbc695f32760..0042803a9de7 100644
--- a/drivers/media/pci/cx25821/cx25821-core.c
+++ b/drivers/media/pci/cx25821/cx25821-core.c
@@ -1319,7 +1319,8 @@ static int cx25821_initdev(struct pci_dev *pci_dev,
                 dev->pci_lat, (unsigned long long)dev->base_io_addr);
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 pr_err("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
                 err = -EIO;
                 goto fail_irq;
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 0ed1b6530374..1b5268f9bb24 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -890,9 +890,9 @@ static int snd_cx88_create(struct snd_card *card, struct pci_dev *pci,
                 return err;
         }
 
-        if (!pci_set_dma_mask(pci,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci,DMA_BIT_MASK(32));
+        if (err) {
                 dprintk(0, "%s/1: Oops: no 32bit PCI DMA ???\n",core->name);
-                err = -EIO;
                 cx88_core_put(core, pci);
                 return err;
         }
diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
index 9db7767d1fe0..f34c229f9b37 100644
--- a/drivers/media/pci/cx88/cx88-mpeg.c
+++ b/drivers/media/pci/cx88/cx88-mpeg.c
@@ -393,7 +393,8 @@ static int cx8802_init_common(struct cx8802_dev *dev)
         if (pci_enable_device(dev->pci))
                 return -EIO;
         pci_set_master(dev->pci);
-        if (!pci_set_dma_mask(dev->pci,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(dev->pci,DMA_BIT_MASK(32));
+        if (err) {
                 printk("%s/2: Oops: no 32bit PCI DMA ???\n",dev->core->name);
                 return -EIO;
         }
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 0de1ad5a977d..aef9acf351f6 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -1314,9 +1314,9 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
                dev->pci_lat,(unsigned long long)pci_resource_start(pci_dev,0));
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev,DMA_BIT_MASK(32));
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n",core->name);
-                err = -EIO;
                 goto fail_core;
         }
         dev->alloc_ctx = vb2_dma_sg_init_ctx(&pci_dev->dev);
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index 60b2d462f98d..3fdbd81b5580 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -810,7 +810,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
                 "%s(): board vendor 0x%x, revision 0x%x\n",
                 __func__, board_vendor, board_revision);
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        if (pci_set_dma_mask(pci_dev, 0xffffffff) < 0) {
                 dev_err(&pci_dev->dev,
                         "%s(): 32bit PCI DMA is not supported\n", __func__);
                 goto pci_detect_err;
diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c
index e79d63eb774e..f720cea80e28 100644
--- a/drivers/media/pci/saa7134/saa7134-core.c
+++ b/drivers/media/pci/saa7134/saa7134-core.c
@@ -951,9 +951,9 @@ static int saa7134_initdev(struct pci_dev *pci_dev,
                pci_name(pci_dev), dev->pci_rev, pci_dev->irq,
                dev->pci_lat,(unsigned long long)pci_resource_start(pci_dev,0));
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
+        if (err) {
                 pr_warn("%s: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail1;
         }
 
diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 8f36b48ef733..8bbd092fbe1d 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1264,9 +1264,9 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
 
         pci_set_master(pci_dev);
         /* TODO */
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail_irq;
         }
 
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index 8c5655d351d3..4e77618fbb2b 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -257,9 +257,9 @@ static int tw68_initdev(struct pci_dev *pci_dev,
                 dev->name, pci_name(pci_dev), dev->pci_rev, pci_dev->irq,
                 dev->pci_lat, (u64)pci_resource_start(pci_dev, 0));
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
+        if (err) {
                 pr_info("%s: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail1;
         }
 
diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
index dc4e8446f1ff..5a99a93ed025 100644
--- a/drivers/mtd/nand/jz4740_nand.c
+++ b/drivers/mtd/nand/jz4740_nand.c
@@ -25,6 +25,7 @@
 
 #include <linux/gpio.h>
 
+#include <asm/mach-jz4740/gpio.h>
 #include <asm/mach-jz4740/jz4740_nand.h>
 
 #define JZ_REG_NAND_CTRL        0x50
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index cc74142938b0..ece544efccc3 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -3110,7 +3110,7 @@ static void nand_resume(struct mtd_info *mtd)
  */
 static void nand_shutdown(struct mtd_info *mtd)
 {
-        nand_get_device(mtd, FL_SHUTDOWN);
+        nand_get_device(mtd, FL_PM_SUSPENDED);
 }
 
 /* Set default functions */
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index e2afabf3a465..7ccebae9cb48 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1500,10 +1500,11 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        if (!pci_set_dma_mask(pdev, PCNET32_DMA_MASK)) {
+        err = pci_set_dma_mask(pdev, PCNET32_DMA_MASK);
+        if (err) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
                         pr_err("architecture does not support 32bit PCI busmaster DMA\n");
-                return -ENODEV;
+                return err;
         }
         if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index e0b7b95813bc..9202d1a468d0 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -93,7 +93,7 @@ struct nvme_nvm_l2ptbl {
         __le16                  cdw14[6];
 };
 
-struct nvme_nvm_bbtbl {
+struct nvme_nvm_getbbtbl {
         __u8                    opcode;
         __u8                    flags;
         __u16                   command_id;
@@ -101,10 +101,23 @@ struct nvme_nvm_bbtbl {
         __u64                   rsvd[2];
         __le64                  prp1;
         __le64                  prp2;
-        __le32                  prp1_len;
-        __le32                  prp2_len;
-        __le32                  lbb;
-        __u32                   rsvd11[3];
+        __le64                  spba;
+        __u32                   rsvd4[4];
+};
+
+struct nvme_nvm_setbbtbl {
+        __u8                    opcode;
+        __u8                    flags;
+        __u16                   command_id;
+        __le32                  nsid;
+        __le64                  rsvd[2];
+        __le64                  prp1;
+        __le64                  prp2;
+        __le64                  spba;
+        __le16                  nlb;
+        __u8                    value;
+        __u8                    rsvd3;
+        __u32                   rsvd4[3];
 };
 
 struct nvme_nvm_erase_blk {
@@ -129,8 +142,8 @@ struct nvme_nvm_command {
                 struct nvme_nvm_hb_rw hb_rw;
                 struct nvme_nvm_ph_rw ph_rw;
                 struct nvme_nvm_l2ptbl l2p;
-                struct nvme_nvm_bbtbl get_bb;
-                struct nvme_nvm_bbtbl set_bb;
+                struct nvme_nvm_getbbtbl get_bb;
+                struct nvme_nvm_setbbtbl set_bb;
                 struct nvme_nvm_erase_blk erase;
         };
 };
@@ -142,11 +155,13 @@ struct nvme_nvm_id_group {
         __u8                    num_ch;
         __u8                    num_lun;
         __u8                    num_pln;
+        __u8                    rsvd1;
         __le16                  num_blk;
         __le16                  num_pg;
         __le16                  fpg_sz;
         __le16                  csecs;
         __le16                  sos;
+        __le16                  rsvd2;
         __le32                  trdt;
         __le32                  trdm;
         __le32                  tprt;
@@ -154,8 +169,9 @@ struct nvme_nvm_id_group {
         __le32                  tbet;
         __le32                  tbem;
         __le32                  mpos;
+        __le32                  mccap;
         __le16                  cpar;
-        __u8                    reserved[913];
+        __u8                    reserved[906];
 } __packed;
 
 struct nvme_nvm_addr_format {
@@ -178,15 +194,28 @@ struct nvme_nvm_id {
         __u8                    ver_id;
         __u8                    vmnt;
         __u8                    cgrps;
-        __u8                    res[5];
+        __u8                    res;
         __le32                  cap;
         __le32                  dom;
         struct nvme_nvm_addr_format ppaf;
-        __u8                    ppat;
-        __u8                    resv[223];
+        __u8                    resv[228];
         struct nvme_nvm_id_group groups[4];
 } __packed;
 
+struct nvme_nvm_bb_tbl {
+        __u8    tblid[4];
+        __le16  verid;
+        __le16  revid;
+        __le32  rvsd1;
+        __le32  tblks;
+        __le32  tfact;
+        __le32  tgrown;
+        __le32  tdresv;
+        __le32  thresv;
+        __le32  rsvd2[8];
+        __u8    blk[0];
+};
+
 /*
  * Check we didn't inadvertently grow the command struct
  */
@@ -195,12 +224,14 @@ static inline void _nvme_nvm_check_size(void)
         BUILD_BUG_ON(sizeof(struct nvme_nvm_identity) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_hb_rw) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_ph_rw) != 64);
-        BUILD_BUG_ON(sizeof(struct nvme_nvm_bbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_getbbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_setbbtbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_l2ptbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_erase_blk) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id_group) != 960);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_addr_format) != 128);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id) != 4096);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_bb_tbl) != 512);
 }
 
 static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
@@ -234,6 +265,7 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
                 dst->tbet = le32_to_cpu(src->tbet);
                 dst->tbem = le32_to_cpu(src->tbem);
                 dst->mpos = le32_to_cpu(src->mpos);
+                dst->mccap = le32_to_cpu(src->mccap);
 
                 dst->cpar = le16_to_cpu(src->cpar);
         }
@@ -244,6 +276,7 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
 static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
 {
         struct nvme_ns *ns = q->queuedata;
+        struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_id *nvme_nvm_id;
         struct nvme_nvm_command c = {};
         int ret;
@@ -256,8 +289,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         if (!nvme_nvm_id)
                 return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, nvme_nvm_id,
-                                                sizeof(struct nvme_nvm_id));
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                nvme_nvm_id, sizeof(struct nvme_nvm_id));
         if (ret) {
                 ret = -EIO;
                 goto out;
@@ -268,6 +301,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         nvm_id->cgrps = nvme_nvm_id->cgrps;
         nvm_id->cap = le32_to_cpu(nvme_nvm_id->cap);
         nvm_id->dom = le32_to_cpu(nvme_nvm_id->dom);
+        memcpy(&nvm_id->ppaf, &nvme_nvm_id->ppaf,
+                                        sizeof(struct nvme_nvm_addr_format));
 
         ret = init_grps(nvm_id, nvme_nvm_id);
 out:
@@ -281,7 +316,7 @@ static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
         struct nvme_ns *ns = q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        u32 len = queue_max_hw_sectors(q) << 9;
+        u32 len = queue_max_hw_sectors(dev->admin_q) << 9;
         u32 nlb_pr_rq = len / sizeof(u64);
         u64 cmd_slba = slba;
         void *entries;
@@ -299,8 +334,8 @@ static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
                 c.l2p.slba = cpu_to_le64(cmd_slba);
                 c.l2p.nlb = cpu_to_le32(cmd_nlb);
 
-                ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c,
-                                                                entries, len);
+                ret = nvme_submit_sync_cmd(dev->admin_q,
+                                (struct nvme_command *)&c, entries, len);
                 if (ret) {
                         dev_err(dev->dev, "L2P table transfer failed (%d)\n",
                                                                         ret);
@@ -322,43 +357,82 @@ out:
         return ret;
 }
 
-static int nvme_nvm_get_bb_tbl(struct request_queue *q, int lunid,
-                                unsigned int nr_blocks,
-                                nvm_bb_update_fn *update_bbtbl, void *priv)
+static int nvme_nvm_get_bb_tbl(struct request_queue *q, struct ppa_addr ppa,
+                                int nr_blocks, nvm_bb_update_fn *update_bbtbl,
+                                void *priv)
 {
         struct nvme_ns *ns = q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        void *bb_bitmap;
-        u16 bb_bitmap_size;
+        struct nvme_nvm_bb_tbl *bb_tbl;
+        int tblsz = sizeof(struct nvme_nvm_bb_tbl) + nr_blocks;
         int ret = 0;
 
         c.get_bb.opcode = nvme_nvm_admin_get_bb_tbl;
         c.get_bb.nsid = cpu_to_le32(ns->ns_id);
-        c.get_bb.lbb = cpu_to_le32(lunid);
-        bb_bitmap_size = ((nr_blocks >> 15) + 1) * PAGE_SIZE;
-        bb_bitmap = kmalloc(bb_bitmap_size, GFP_KERNEL);
-        if (!bb_bitmap)
-                return -ENOMEM;
+        c.get_bb.spba = cpu_to_le64(ppa.ppa);
 
-        bitmap_zero(bb_bitmap, nr_blocks);
+        bb_tbl = kzalloc(tblsz, GFP_KERNEL);
+        if (!bb_tbl)
+                return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, bb_bitmap,
-                                                                bb_bitmap_size);
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                bb_tbl, tblsz);
         if (ret) {
                 dev_err(dev->dev, "get bad block table failed (%d)\n", ret);
                 ret = -EIO;
                 goto out;
         }
 
-        ret = update_bbtbl(lunid, bb_bitmap, nr_blocks, priv);
+        if (bb_tbl->tblid[0] != 'B' || bb_tbl->tblid[1] != 'B' ||
+                bb_tbl->tblid[2] != 'L' || bb_tbl->tblid[3] != 'T') {
+                dev_err(dev->dev, "bbt format mismatch\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (le16_to_cpu(bb_tbl->verid) != 1) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt version not supported\n");
+                goto out;
+        }
+
+        if (le32_to_cpu(bb_tbl->tblks) != nr_blocks) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt unsuspected blocks returned (%u!=%u)",
+                                        le32_to_cpu(bb_tbl->tblks), nr_blocks);
+                goto out;
+        }
+
+        ret = update_bbtbl(ppa, nr_blocks, bb_tbl->blk, priv);
         if (ret) {
                 ret = -EINTR;
                 goto out;
         }
 
 out:
-        kfree(bb_bitmap);
+        kfree(bb_tbl);
+        return ret;
+}
+
+static int nvme_nvm_set_bb_tbl(struct request_queue *q, struct nvm_rq *rqd,
+                                                                int type)
+{
+        struct nvme_ns *ns = q->queuedata;
+        struct nvme_dev *dev = ns->dev;
+        struct nvme_nvm_command c = {};
+        int ret = 0;
+
+        c.set_bb.opcode = nvme_nvm_admin_set_bb_tbl;
+        c.set_bb.nsid = cpu_to_le32(ns->ns_id);
+        c.set_bb.spba = cpu_to_le64(rqd->ppa_addr.ppa);
+        c.set_bb.nlb = cpu_to_le16(rqd->nr_pages - 1);
+        c.set_bb.value = type;
+
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                NULL, 0);
+        if (ret)
+                dev_err(dev->dev, "set bad block table failed (%d)\n", ret);
         return ret;
 }
 
@@ -474,6 +548,7 @@ static struct nvm_dev_ops nvme_nvm_dev_ops = {
         .get_l2p_tbl            = nvme_nvm_get_l2p_tbl,
 
         .get_bb_tbl             = nvme_nvm_get_bb_tbl,
+        .set_bb_tbl             = nvme_nvm_set_bb_tbl,
 
         .submit_io              = nvme_nvm_submit_io,
         .erase_block            = nvme_nvm_erase_block,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8187df204695..f3b53af789ef 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -896,19 +896,28 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
                         goto retry_cmd;
                 }
                 if (blk_integrity_rq(req)) {
-                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1)
+                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         sg_init_table(iod->meta_sg, 1);
                         if (blk_rq_map_integrity_sg(
-                                        req->q, req->bio, iod->meta_sg) != 1)
+                                        req->q, req->bio, iod->meta_sg) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         if (rq_data_dir(req))
                                 nvme_dif_remap(req, nvme_dif_prep);
 
-                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir))
+                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir)) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
                 }
         }
 
@@ -968,7 +977,8 @@ static void __nvme_process_cq(struct nvme_queue *nvmeq, unsigned int *tag)
         if (head == nvmeq->cq_head && phase == nvmeq->cq_phase)
                 return;
 
-        writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
+        if (likely(nvmeq->cq_vector >= 0))
+                writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
         nvmeq->cq_head = head;
         nvmeq->cq_phase = phase;
 
@@ -1727,9 +1737,13 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
         u32 aqa;
         u64 cap = lo_hi_readq(&dev->bar->cap);
         struct nvme_queue *nvmeq;
-        unsigned page_shift = PAGE_SHIFT;
+        /*
+         * default to a 4K page size, with the intention to update this
+         * path in the future to accomodate architectures with differing
+         * kernel and IO page sizes.
+         */
+        unsigned page_shift = 12;
         unsigned dev_page_min = NVME_CAP_MPSMIN(cap) + 12;
-        unsigned dev_page_max = NVME_CAP_MPSMAX(cap) + 12;
 
         if (page_shift < dev_page_min) {
                 dev_err(dev->dev,
@@ -1738,13 +1752,6 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
                                 1 << page_shift);
                 return -ENODEV;
         }
-        if (page_shift > dev_page_max) {
-                dev_info(dev->dev,
-                                "Device maximum page size (%u) smaller than "
-                                "host (%u); enabling work-around\n",
-                                1 << dev_page_max, 1 << page_shift);
-                page_shift = dev_page_max;
-        }
 
         dev->subsystem = readl(&dev->bar->vs) >= NVME_VS(1, 1) ?
                                                 NVME_CAP_NSSRC(cap) : 0;
@@ -2268,7 +2275,7 @@ static void nvme_alloc_ns(struct nvme_dev *dev, unsigned nsid)
         if (dev->max_hw_sectors) {
                 blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
                 blk_queue_max_segments(ns->queue,
-                        ((dev->max_hw_sectors << 9) / dev->page_size) + 1);
+                        (dev->max_hw_sectors / (dev->page_size >> 9)) + 1);
         }
         if (dev->stripe_size)
                 blk_queue_chunk_sectors(ns->queue, dev->stripe_size >> 9);
@@ -2787,6 +2794,10 @@ static void nvme_del_queue_end(struct nvme_queue *nvmeq)
 {
         struct nvme_delq_ctx *dq = nvmeq->cmdinfo.ctx;
         nvme_put_dq(dq);
+
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_process_cq(nvmeq);
+        spin_unlock_irq(&nvmeq->q_lock);
 }
 
 static int adapter_async_del_queue(struct nvme_queue *nvmeq, u8 opcode,
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index e735c728e3b3..edb1984201e9 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1685,8 +1685,8 @@ static void pci_dma_configure(struct pci_dev *dev)
 {
         struct device *bridge = pci_get_host_bridge_device(dev);
 
-        if (IS_ENABLED(CONFIG_OF) && dev->dev.of_node) {
-                if (bridge->parent)
+        if (IS_ENABLED(CONFIG_OF) &&
+                bridge->parent && bridge->parent->of_node) {
                         of_dma_configure(&dev->dev, bridge->parent->of_node);
         } else if (has_acpi_companion(bridge)) {
                 struct acpi_device *adev = to_acpi_device_node(bridge->fwnode);
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index 25abd4eb7d10..91a003011acf 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
 
 static int __init sh_pm_runtime_init(void)
 {
-        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE_MULTI)) {
+        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
                 if (!of_find_compatible_node(NULL, NULL,
                                              "renesas,cpg-mstp-clocks"))
                         return 0;
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 6d5b38d69578..9d7f0004d2d7 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -18,7 +18,8 @@ source "drivers/staging/iio/resolver/Kconfig"
 source "drivers/staging/iio/trigger/Kconfig"
 
 config IIO_DUMMY_EVGEN
-       tristate
+        tristate
+        select IRQ_WORK
 
 config IIO_SIMPLE_DUMMY
        tristate "An example driver with no hardware requirements"
diff --git a/drivers/staging/iio/adc/lpc32xx_adc.c b/drivers/staging/iio/adc/lpc32xx_adc.c
index d11c54b72186..b51f237cd817 100644
--- a/drivers/staging/iio/adc/lpc32xx_adc.c
+++ b/drivers/staging/iio/adc/lpc32xx_adc.c
@@ -76,7 +76,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
 
         if (mask == IIO_CHAN_INFO_RAW) {
                 mutex_lock(&indio_dev->mlock);
-                clk_enable(info->clk);
+                clk_prepare_enable(info->clk);
                 /* Measurement setup */
                 __raw_writel(AD_INTERNAL | (chan->address) | AD_REFp | AD_REFm,
                              LPC32XX_ADC_SELECT(info->adc_base));
@@ -84,7 +84,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
                 __raw_writel(AD_PDN_CTRL | AD_STROBE,
                              LPC32XX_ADC_CTRL(info->adc_base));
                 wait_for_completion(&info->completion); /* set by ISR */
-                clk_disable(info->clk);
+                clk_disable_unprepare(info->clk);
                 *val = info->value;
                 mutex_unlock(&indio_dev->mlock);
 
diff --git a/drivers/staging/wilc1000/coreconfigurator.c b/drivers/staging/wilc1000/coreconfigurator.c
index e10c6ffa698a..9568bdb6319b 100644
--- a/drivers/staging/wilc1000/coreconfigurator.c
+++ b/drivers/staging/wilc1000/coreconfigurator.c
@@ -13,12 +13,8 @@
 #include "wilc_wlan.h"
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/etherdevice.h>
 #define TAG_PARAM_OFFSET        (MAC_HDR_LEN + TIME_STAMP_LEN + \
                                                         BEACON_INTERVAL_LEN + CAP_INFO_LEN)
-#define ADDR1 4
-#define ADDR2 10
-#define ADDR3 16
 
 /* Basic Frame Type Codes (2-bit) */
 enum basic_frame_type {
@@ -175,32 +171,38 @@ static inline u8 get_from_ds(u8 *header)
         return ((header[1] & 0x02) >> 1);
 }
 
+/* This function extracts the MAC Address in 'address1' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address1(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 4, 6);
+}
+
+/* This function extracts the MAC Address in 'address2' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address2(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 10, 6);
+}
+
+/* This function extracts the MAC Address in 'address3' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address3(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 16, 6);
+}
+
 /* This function extracts the BSSID from the incoming WLAN packet based on   */
-/* the 'from ds' bit, and updates the MAC Address in the allocated 'data'    */
+/* the 'from ds' bit, and updates the MAC Address in the allocated 'addr'    */
 /* variable.                                                                 */
 static inline void get_BSSID(u8 *data, u8 *bssid)
 {
         if (get_from_ds(data) == 1)
-                /*
-                 * Extract the MAC Address in 'address2' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 *  variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR2);
+                get_address2(data, bssid);
         else if (get_to_ds(data) == 1)
-                /*
-                 * Extract the MAC Address in 'address1' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 * variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR1);
+                get_address1(data, bssid);
         else
-                /*
-                 * Extract the MAC Address in 'address3' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 * variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR3);
+                get_address3(data, bssid);
 }
 
 /* This function extracts the SSID from a beacon/probe response frame        */
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 13844261cd5f..ed776149261e 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -169,7 +169,7 @@ static inline int tty_copy_to_user(struct tty_struct *tty,
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        tty_audit_add_data(tty, to, n, ldata->icanon);
+        tty_audit_add_data(tty, from, n, ldata->icanon);
         return copy_to_user(to, from, n);
 }
 
diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
index c0533a57ec53..910bfee5a88b 100644
--- a/drivers/tty/serial/8250/8250_fsl.c
+++ b/drivers/tty/serial/8250/8250_fsl.c
@@ -60,3 +60,4 @@ int fsl8250_handle_irq(struct uart_port *port)
         spin_unlock_irqrestore(&up->port.lock, flags);
         return 1;
 }
+EXPORT_SYMBOL_GPL(fsl8250_handle_irq);
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index e6f5e12a2d83..6412f1455beb 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -373,6 +373,7 @@ config SERIAL_8250_MID
         depends on SERIAL_8250 && PCI
         select HSU_DMA if SERIAL_8250_DMA
         select HSU_DMA_PCI if X86_INTEL_MID
+        select RATIONAL
         help
           Selecting this option will enable handling of the extra features
           present on the UART found on Intel Medfield SOC and various other
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 1aec4404062d..f38beb28e7ae 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1539,7 +1539,6 @@ config SERIAL_FSL_LPUART
         tristate "Freescale lpuart serial port support"
         depends on HAS_DMA
         select SERIAL_CORE
-        select SERIAL_EARLYCON
         help
           Support for the on-chip lpuart on some Freescale SOCs.
 
@@ -1547,6 +1546,7 @@ config SERIAL_FSL_LPUART_CONSOLE
         bool "Console on Freescale lpuart serial port"
         depends on SERIAL_FSL_LPUART=y
         select SERIAL_CORE_CONSOLE
+        select SERIAL_EARLYCON
         help
           If you have enabled the lpuart serial port on the Freescale SoCs,
           you can make it the console by answering Y to this option.
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 681e0f3d5e0e..a1c0a89d9c7f 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -474,7 +474,7 @@ static int bcm_uart_startup(struct uart_port *port)
 
         /* register irq and enable rx interrupts */
         ret = request_irq(port->irq, bcm_uart_interrupt, 0,
-                          bcm_uart_type(port), port);
+                          dev_name(port->dev), port);
         if (ret)
                 return ret;
         bcm_uart_writel(port, UART_RX_INT_MASK, UART_IR_REG);
diff --git a/drivers/tty/serial/etraxfs-uart.c b/drivers/tty/serial/etraxfs-uart.c
index 6813e316e9ff..2f80bc7e44fb 100644
--- a/drivers/tty/serial/etraxfs-uart.c
+++ b/drivers/tty/serial/etraxfs-uart.c
@@ -894,7 +894,7 @@ static int etraxfs_uart_probe(struct platform_device *pdev)
         up->regi_ser = of_iomap(np, 0);
         up->port.dev = &pdev->dev;
 
-        up->gpios = mctrl_gpio_init(&pdev->dev, 0);
+        up->gpios = mctrl_gpio_init_noauto(&pdev->dev, 0);
         if (IS_ERR(up->gpios))
                 return PTR_ERR(up->gpios);
 
diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c
index 90ca082935f6..3d245cd3d8e6 100644
--- a/drivers/tty/tty_audit.c
+++ b/drivers/tty/tty_audit.c
@@ -265,7 +265,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty,
  *
  *      Audit @data of @size from @tty, if necessary.
  */
-void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
+void tty_audit_add_data(struct tty_struct *tty, const void *data,
                         size_t size, unsigned icanon)
 {
         struct tty_audit_buf *buf;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 0c41dbcb90b8..bcc8e1e8bb72 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1282,18 +1282,22 @@ int tty_send_xchar(struct tty_struct *tty, char ch)
         int     was_stopped = tty->stopped;
 
         if (tty->ops->send_xchar) {
+                down_read(&tty->termios_rwsem);
                 tty->ops->send_xchar(tty, ch);
+                up_read(&tty->termios_rwsem);
                 return 0;
         }
 
         if (tty_write_lock(tty, 0) < 0)
                 return -ERESTARTSYS;
 
+        down_read(&tty->termios_rwsem);
         if (was_stopped)
                 start_tty(tty);
         tty->ops->write(tty, &ch, 1);
         if (was_stopped)
                 stop_tty(tty);
+        up_read(&tty->termios_rwsem);
         tty_write_unlock(tty);
         return 0;
 }
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 9c5aebfe7053..1445dd39aa62 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1147,16 +1147,12 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                         spin_unlock_irq(&tty->flow_lock);
                         break;
                 case TCIOFF:
-                        down_read(&tty->termios_rwsem);
                         if (STOP_CHAR(tty) != __DISABLED_CHAR)
                                 retval = tty_send_xchar(tty, STOP_CHAR(tty));
-                        up_read(&tty->termios_rwsem);
                         break;
                 case TCION:
-                        down_read(&tty->termios_rwsem);
                         if (START_CHAR(tty) != __DISABLED_CHAR)
                                 retval = tty_send_xchar(tty, START_CHAR(tty));
-                        up_read(&tty->termios_rwsem);
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 5af8f1874c1a..629e3c865072 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -592,7 +592,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         /* Restart the work queue in case no characters kick it off. Safe if
            already running */
-        schedule_work(&tty->port->buf.work);
+        tty_buffer_restart_work(tty->port);
 
         tty_unlock(tty);
         return retval;
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 6ccbf60cdd5c..5a048b7b92e8 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -84,6 +84,12 @@ struct ci_hdrc_imx_data {
         struct imx_usbmisc_data *usbmisc_data;
         bool supports_runtime_pm;
         bool in_lpm;
+        /* SoC before i.mx6 (except imx23/imx28) needs three clks */
+        bool need_three_clks;
+        struct clk *clk_ipg;
+        struct clk *clk_ahb;
+        struct clk *clk_per;
+        /* --------------------------------- */
 };
 
 /* Common functions shared by usbmisc drivers */
@@ -135,6 +141,102 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev)
 }
 
 /* End of common functions shared by usbmisc drivers*/
+static int imx_get_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+        int ret = 0;
+
+        data->clk_ipg = devm_clk_get(dev, "ipg");
+        if (IS_ERR(data->clk_ipg)) {
+                /* If the platform only needs one clocks */
+                data->clk = devm_clk_get(dev, NULL);
+                if (IS_ERR(data->clk)) {
+                        ret = PTR_ERR(data->clk);
+                        dev_err(dev,
+                                "Failed to get clks, err=%ld,%ld\n",
+                                PTR_ERR(data->clk), PTR_ERR(data->clk_ipg));
+                        return ret;
+                }
+                return ret;
+        }
+
+        data->clk_ahb = devm_clk_get(dev, "ahb");
+        if (IS_ERR(data->clk_ahb)) {
+                ret = PTR_ERR(data->clk_ahb);
+                dev_err(dev,
+                        "Failed to get ahb clock, err=%d\n", ret);
+                return ret;
+        }
+
+        data->clk_per = devm_clk_get(dev, "per");
+        if (IS_ERR(data->clk_per)) {
+                ret = PTR_ERR(data->clk_per);
+                dev_err(dev,
+                        "Failed to get per clock, err=%d\n", ret);
+                return ret;
+        }
+
+        data->need_three_clks = true;
+        return ret;
+}
+
+static int imx_prepare_enable_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (data->need_three_clks) {
+                ret = clk_prepare_enable(data->clk_ipg);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable ipg clk, err=%d\n",
+                                ret);
+                        return ret;
+                }
+
+                ret = clk_prepare_enable(data->clk_ahb);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable ahb clk, err=%d\n",
+                                ret);
+                        clk_disable_unprepare(data->clk_ipg);
+                        return ret;
+                }
+
+                ret = clk_prepare_enable(data->clk_per);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable per clk, err=%d\n",
+                                ret);
+                        clk_disable_unprepare(data->clk_ahb);
+                        clk_disable_unprepare(data->clk_ipg);
+                        return ret;
+                }
+        } else {
+                ret = clk_prepare_enable(data->clk);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable clk, err=%d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+static void imx_disable_unprepare_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+
+        if (data->need_three_clks) {
+                clk_disable_unprepare(data->clk_per);
+                clk_disable_unprepare(data->clk_ahb);
+                clk_disable_unprepare(data->clk_ipg);
+        } else {
+                clk_disable_unprepare(data->clk);
+        }
+}
 
 static int ci_hdrc_imx_probe(struct platform_device *pdev)
 {
@@ -145,31 +247,31 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 .flags          = CI_HDRC_SET_NON_ZERO_TTHA,
         };
         int ret;
-        const struct of_device_id *of_id =
-                        of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
-        const struct ci_hdrc_imx_platform_flag *imx_platform_flag = of_id->data;
+        const struct of_device_id *of_id;
+        const struct ci_hdrc_imx_platform_flag *imx_platform_flag;
+
+        of_id = of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
+        imx_platform_flag = of_id->data;
 
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, data);
         data->usbmisc_data = usbmisc_get_init_data(&pdev->dev);
         if (IS_ERR(data->usbmisc_data))
                 return PTR_ERR(data->usbmisc_data);
 
-        data->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(data->clk)) {
-                dev_err(&pdev->dev,
-                        "Failed to get clock, err=%ld\n", PTR_ERR(data->clk));
-                return PTR_ERR(data->clk);
-        }
+        ret = imx_get_clks(&pdev->dev);
+        if (ret)
+                return ret;
 
-        ret = clk_prepare_enable(data->clk);
-        if (ret) {
-                dev_err(&pdev->dev,
-                        "Failed to prepare or enable clock, err=%d\n", ret);
+        ret = imx_prepare_enable_clks(&pdev->dev);
+        if (ret)
                 return ret;
-        }
 
         data->phy = devm_usb_get_phy_by_phandle(&pdev->dev, "fsl,usbphy", 0);
         if (IS_ERR(data->phy)) {
@@ -212,8 +314,6 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 goto disable_device;
         }
 
-        platform_set_drvdata(pdev, data);
-
         if (data->supports_runtime_pm) {
                 pm_runtime_set_active(&pdev->dev);
                 pm_runtime_enable(&pdev->dev);
@@ -226,7 +326,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 disable_device:
         ci_hdrc_remove_device(data->ci_pdev);
 err_clk:
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(&pdev->dev);
         return ret;
 }
 
@@ -240,7 +340,7 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
                 pm_runtime_put_noidle(&pdev->dev);
         }
         ci_hdrc_remove_device(data->ci_pdev);
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(&pdev->dev);
 
         return 0;
 }
@@ -252,7 +352,7 @@ static int imx_controller_suspend(struct device *dev)
 
         dev_dbg(dev, "at %s\n", __func__);
 
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(dev);
         data->in_lpm = true;
 
         return 0;
@@ -270,7 +370,7 @@ static int imx_controller_resume(struct device *dev)
                 return 0;
         }
 
-        ret = clk_prepare_enable(data->clk);
+        ret = imx_prepare_enable_clks(dev);
         if (ret)
                 return ret;
 
@@ -285,7 +385,7 @@ static int imx_controller_resume(struct device *dev)
         return 0;
 
 clk_disable:
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(dev);
         return ret;
 }
 
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 080b7be3daf0..58c8485a0715 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -322,8 +322,10 @@ static ssize_t ci_role_write(struct file *file, const char __user *ubuf,
                 return -EINVAL;
 
         pm_runtime_get_sync(ci->dev);
+        disable_irq(ci->irq);
         ci_role_stop(ci);
         ret = ci_role_start(ci, role);
+        enable_irq(ci->irq);
         pm_runtime_put_sync(ci->dev);
 
         return ret ? ret : count;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 8223fe73ea85..391a1225b0ba 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1751,6 +1751,22 @@ static int ci_udc_start(struct usb_gadget *gadget,
         return retval;
 }
 
+static void ci_udc_stop_for_otg_fsm(struct ci_hdrc *ci)
+{
+        if (!ci_otg_is_fsm_mode(ci))
+                return;
+
+        mutex_lock(&ci->fsm.lock);
+        if (ci->fsm.otg->state == OTG_STATE_A_PERIPHERAL) {
+                ci->fsm.a_bidl_adis_tmout = 1;
+                ci_hdrc_otg_fsm_start(ci);
+        } else if (ci->fsm.otg->state == OTG_STATE_B_PERIPHERAL) {
+                ci->fsm.protocol = PROTO_UNDEF;
+                ci->fsm.otg->state = OTG_STATE_UNDEFINED;
+        }
+        mutex_unlock(&ci->fsm.lock);
+}
+
 /**
  * ci_udc_stop: unregister a gadget driver
  */
@@ -1775,6 +1791,7 @@ static int ci_udc_stop(struct usb_gadget *gadget)
         ci->driver = NULL;
         spin_unlock_irqrestore(&ci->lock, flags);
 
+        ci_udc_stop_for_otg_fsm(ci);
         return 0;
 }
 
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index fcea4eb36eee..ab8b027e8cc8 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -500,7 +500,11 @@ static int usbmisc_imx_probe(struct platform_device *pdev)
 {
         struct resource *res;
         struct imx_usbmisc *data;
-        struct of_device_id *tmp_dev;
+        const struct of_device_id *of_id;
+
+        of_id = of_match_device(usbmisc_imx_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
 
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -513,9 +517,7 @@ static int usbmisc_imx_probe(struct platform_device *pdev)
         if (IS_ERR(data->base))
                 return PTR_ERR(data->base);
 
-        tmp_dev = (struct of_device_id *)
-                of_match_device(usbmisc_imx_dt_ids, &pdev->dev);
-        data->ops = (const struct usbmisc_ops *)tmp_dev->data;
+        data->ops = (const struct usbmisc_ops *)of_id->data;
         platform_set_drvdata(pdev, data);
 
         return 0;
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 433bbc34a8a4..071964c7847f 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -884,11 +884,11 @@ static int usblp_wwait(struct usblp *usblp, int nonblock)
 
         add_wait_queue(&usblp->wwait, &waita);
         for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
                 if (mutex_lock_interruptible(&usblp->mut)) {
                         rc = -EINTR;
                         break;
                 }
+                set_current_state(TASK_INTERRUPTIBLE);
                 rc = usblp_wtest(usblp, nonblock);
                 mutex_unlock(&usblp->mut);
                 if (rc <= 0)
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index a99c89e78126..dd280108758f 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -77,8 +77,7 @@ config USB_OTG_BLACKLIST_HUB
 
 config USB_OTG_FSM
         tristate "USB 2.0 OTG FSM implementation"
-        depends on USB
-        select USB_OTG
+        depends on USB && USB_OTG
         select USB_PHY
         help
           Implements OTG Finite State Machine as specified in On-The-Go
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index e79baf73c234..571c21727ff9 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -324,12 +324,13 @@ void dwc2_hcd_disconnect(struct dwc2_hsotg *hsotg)
  */
 static void dwc2_hcd_rem_wakeup(struct dwc2_hsotg *hsotg)
 {
-        if (hsotg->lx_state == DWC2_L2) {
+        if (hsotg->bus_suspended) {
                 hsotg->flags.b.port_suspend_change = 1;
                 usb_hcd_resume_root_hub(hsotg->priv);
-        } else {
-                hsotg->flags.b.port_l1_change = 1;
         }
+
+        if (hsotg->lx_state == DWC2_L1)
+                hsotg->flags.b.port_l1_change = 1;
 }
 
 /**
@@ -1428,8 +1429,8 @@ static void dwc2_wakeup_detected(unsigned long data)
         dev_dbg(hsotg->dev, "Clear Resume: HPRT0=%0x\n",
                 dwc2_readl(hsotg->regs + HPRT0));
 
-        hsotg->bus_suspended = 0;
         dwc2_hcd_rem_wakeup(hsotg);
+        hsotg->bus_suspended = 0;
 
         /* Change to L0 state */
         hsotg->lx_state = DWC2_L0;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 5859b0fa19ee..e61d773cf65e 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -108,7 +108,8 @@ static const struct dwc2_core_params params_rk3066 = {
         .host_ls_low_power_phy_clk      = -1,
         .ts_dline                       = -1,
         .reload_ctl                     = -1,
-        .ahbcfg                         = 0x7, /* INCR16 */
+        .ahbcfg                         = GAHBCFG_HBSTLEN_INCR16 <<
+                                          GAHBCFG_HBSTLEN_SHIFT,
         .uframe_sched                   = -1,
         .external_id_pin_ctl            = -1,
         .hibernation                    = -1,
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 77a622cb48ab..009d83048c8c 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -34,6 +34,8 @@
 #define PCI_DEVICE_ID_INTEL_BSW                 0x22b7
 #define PCI_DEVICE_ID_INTEL_SPTLP               0x9d30
 #define PCI_DEVICE_ID_INTEL_SPTH                0xa130
+#define PCI_DEVICE_ID_INTEL_BXT                 0x0aaa
+#define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 
 static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
 static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -210,6 +212,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTLP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTH), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 55ba447fdf8b..e24a01cc98df 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2744,12 +2744,34 @@ int dwc3_gadget_init(struct dwc3 *dwc)
         }
 
         dwc->gadget.ops                 = &dwc3_gadget_ops;
-        dwc->gadget.max_speed           = USB_SPEED_SUPER;
         dwc->gadget.speed               = USB_SPEED_UNKNOWN;
         dwc->gadget.sg_supported        = true;
         dwc->gadget.name                = "dwc3-gadget";
 
         /*
+         * FIXME We might be setting max_speed to <SUPER, however versions
+         * <2.20a of dwc3 have an issue with metastability (documented
+         * elsewhere in this driver) which tells us we can't set max speed to
+         * anything lower than SUPER.
+         *
+         * Because gadget.max_speed is only used by composite.c and function
+         * drivers (i.e. it won't go into dwc3's registers) we are allowing this
+         * to happen so we avoid sending SuperSpeed Capability descriptor
+         * together with our BOS descriptor as that could confuse host into
+         * thinking we can handle super speed.
+         *
+         * Note that, in fact, we won't even support GetBOS requests when speed
+         * is less than super speed because we don't have means, yet, to tell
+         * composite.c that we are USB 2.0 + LPM ECN.
+         */
+        if (dwc->revision < DWC3_REVISION_220A)
+                dwc3_trace(trace_dwc3_gadget,
+                                "Changing max_speed on rev %08x\n",
+                                dwc->revision);
+
+        dwc->gadget.max_speed           = dwc->maximum_speed;
+
+        /*
          * Per databook, DWC3 needs buffer size to be aligned to MaxPacketSize
          * on ep out.
          */
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 23933bdf2d9d..ddc3aad886b7 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -329,7 +329,7 @@ static int alloc_requests(struct usb_composite_dev *cdev,
         for (i = 0; i < loop->qlen && result == 0; i++) {
                 result = -ENOMEM;
 
-                in_req = usb_ep_alloc_request(loop->in_ep, GFP_KERNEL);
+                in_req = usb_ep_alloc_request(loop->in_ep, GFP_ATOMIC);
                 if (!in_req)
                         goto fail;
 
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index f0f2b066ac08..f92f5aff0dd5 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1633,7 +1633,7 @@ static irqreturn_t usba_udc_irq(int irq, void *devid)
         spin_lock(&udc->lock);
 
         int_enb = usba_int_enb_get(udc);
-        status = usba_readl(udc, INT_STA) & int_enb;
+        status = usba_readl(udc, INT_STA) & (int_enb | USBA_HIGH_SPEED);
         DBG(DBG_INT, "irq, status=%#08x\n", status);
 
         if (status & USBA_DET_SUSPEND) {
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5d2d7e954bd4..0230965fb78c 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -782,12 +782,15 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
                 }
         }
-        if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0
-                        && (raw_port_status & PORT_POWER)
-                        && (bus_state->suspended_ports & (1 << wIndex))) {
-                bus_state->suspended_ports &= ~(1 << wIndex);
-                if (hcd->speed < HCD_USB3)
-                        bus_state->port_c_suspend |= 1 << wIndex;
+        if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 &&
+            (raw_port_status & PORT_POWER)) {
+                if (bus_state->suspended_ports & (1 << wIndex)) {
+                        bus_state->suspended_ports &= ~(1 << wIndex);
+                        if (hcd->speed < HCD_USB3)
+                                bus_state->port_c_suspend |= 1 << wIndex;
+                }
+                bus_state->resume_done[wIndex] = 0;
+                clear_bit(wIndex, &bus_state->resuming_ports);
         }
         if (raw_port_status & PORT_CONNECT) {
                 status |= USB_PORT_STAT_CONNECTION;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fa836251ca21..6c5e8133cf87 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3896,28 +3896,6 @@ cleanup:
         return ret;
 }
 
-static int ep_ring_is_processing(struct xhci_hcd *xhci,
-                int slot_id, unsigned int ep_index)
-{
-        struct xhci_virt_device *xdev;
-        struct xhci_ring *ep_ring;
-        struct xhci_ep_ctx *ep_ctx;
-        struct xhci_virt_ep *xep;
-        dma_addr_t hw_deq;
-
-        xdev = xhci->devs[slot_id];
-        xep = &xhci->devs[slot_id]->eps[ep_index];
-        ep_ring = xep->ring;
-        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
-
-        if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) != EP_STATE_RUNNING)
-                return 0;
-
-        hw_deq = le64_to_cpu(ep_ctx->deq) & ~EP_CTX_CYCLE_MASK;
-        return (hw_deq !=
-                xhci_trb_virt_to_dma(ep_ring->enq_seg, ep_ring->enqueue));
-}
-
 /*
  * Check transfer ring to guarantee there is enough room for the urb.
  * Update ISO URB start_frame and interval.
@@ -3983,10 +3961,12 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
         }
 
         /* Calculate the start frame and put it in urb->start_frame. */
-        if (HCC_CFC(xhci->hcc_params) &&
-                        ep_ring_is_processing(xhci, slot_id, ep_index)) {
-                urb->start_frame = xep->next_frame_id;
-                goto skip_start_over;
+        if (HCC_CFC(xhci->hcc_params) && !list_empty(&ep_ring->td_list)) {
+                if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) ==
+                                EP_STATE_RUNNING) {
+                        urb->start_frame = xep->next_frame_id;
+                        goto skip_start_over;
+                }
         }
 
         start_frame = readl(&xhci->run_regs->microframe_index);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6e7dc6f93978..dfa44d3e8eee 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -175,6 +175,16 @@ int xhci_reset(struct xhci_hcd *xhci)
         command |= CMD_RESET;
         writel(command, &xhci->op_regs->command);
 
+        /* Existing Intel xHCI controllers require a delay of 1 mS,
+         * after setting the CMD_RESET bit, and before accessing any
+         * HC registers. This allows the HC to complete the
+         * reset operation and be ready for HC register access.
+         * Without this delay, the subsequent HC register access,
+         * may result in a system hang very rarely.
+         */
+        if (xhci->quirks & XHCI_INTEL_HOST)
+                udelay(1000);
+
         ret = xhci_handshake(&xhci->op_regs->command,
                         CMD_RESET, 0, 10 * 1000 * 1000);
         if (ret)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index ba13529cbd52..18cfc0a361cb 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -132,7 +132,7 @@ static inline struct musb *dev_to_musb(struct device *dev)
 /*-------------------------------------------------------------------------*/
 
 #ifndef CONFIG_BLACKFIN
-static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
+static int musb_ulpi_read(struct usb_phy *phy, u32 reg)
 {
         void __iomem *addr = phy->io_priv;
         int     i = 0;
@@ -151,7 +151,7 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
          * ULPICarKitControlDisableUTMI after clearing POWER_SUSPENDM.
          */
 
-        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
+        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL,
                         MUSB_ULPI_REG_REQ | MUSB_ULPI_RDN_WR);
 
@@ -176,7 +176,7 @@ out:
         return ret;
 }
 
-static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
+static int musb_ulpi_write(struct usb_phy *phy, u32 val, u32 reg)
 {
         void __iomem *addr = phy->io_priv;
         int     i = 0;
@@ -191,8 +191,8 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
         power &= ~MUSB_POWER_SUSPENDM;
         musb_writeb(addr, MUSB_POWER, power);
 
-        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
-        musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)data);
+        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
+        musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)val);
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL, MUSB_ULPI_REG_REQ);
 
         while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL)
@@ -1668,7 +1668,7 @@ EXPORT_SYMBOL_GPL(musb_interrupt);
 static bool use_dma = 1;
 
 /* "modprobe ... use_dma=0" etc */
-module_param(use_dma, bool, 0);
+module_param(use_dma, bool, 0644);
 MODULE_PARM_DESC(use_dma, "enable/disable use of DMA");
 
 void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit)
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 26c65e66cc0f..795a45b1b25b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -112,22 +112,32 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
         struct musb     *musb = ep->musb;
         void __iomem    *epio = ep->regs;
         u16             csr;
-        u16             lastcsr = 0;
         int             retries = 1000;
 
         csr = musb_readw(epio, MUSB_TXCSR);
         while (csr & MUSB_TXCSR_FIFONOTEMPTY) {
-                if (csr != lastcsr)
-                        dev_dbg(musb->controller, "Host TX FIFONOTEMPTY csr: %02x\n", csr);
-                lastcsr = csr;
                 csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_TXPKTRDY;
                 musb_writew(epio, MUSB_TXCSR, csr);
                 csr = musb_readw(epio, MUSB_TXCSR);
-                if (WARN(retries-- < 1,
+
+                /*
+                 * FIXME: sometimes the tx fifo flush failed, it has been
+                 * observed during device disconnect on AM335x.
+                 *
+                 * To reproduce the issue, ensure tx urb(s) are queued when
+                 * unplug the usb device which is connected to AM335x usb
+                 * host port.
+                 *
+                 * I found using a usb-ethernet device and running iperf
+                 * (client on AM335x) has very high chance to trigger it.
+                 *
+                 * Better to turn on dev_dbg() in musb_cleanup_urb() with
+                 * CPPI enabled to see the issue when aborting the tx channel.
+                 */
+                if (dev_WARN_ONCE(musb->controller, retries-- < 1,
                                 "Could not flush host TX%d fifo: csr: %04x\n",
                                 ep->epnum, csr))
                         return;
-                mdelay(1);
         }
 }
 
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 173132416170..22e8ecb6bfbd 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -21,7 +21,6 @@ config AB8500_USB
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
         depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
-        select USB_OTG
         select USB_PHY
         help
           Enable this to support Freescale USB OTG transceiver.
@@ -168,8 +167,7 @@ config USB_QCOM_8X16_PHY
 
 config USB_MV_OTG
         tristate "Marvell USB OTG support"
-        depends on USB_EHCI_MV && USB_MV_UDC && PM
-        select USB_OTG
+        depends on USB_EHCI_MV && USB_MV_UDC && PM && USB_OTG
         select USB_PHY
         help
           Say Y here if you want to build Marvell USB OTG transciever
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 4d863ebc117c..b7536af777ab 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -452,10 +452,13 @@ static int mxs_phy_probe(struct platform_device *pdev)
         struct clk *clk;
         struct mxs_phy *mxs_phy;
         int ret;
-        const struct of_device_id *of_id =
-                        of_match_device(mxs_phy_dt_ids, &pdev->dev);
+        const struct of_device_id *of_id;
         struct device_node *np = pdev->dev.of_node;
 
+        of_id = of_match_device(mxs_phy_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index 1270906ccb95..c4bf2de6d14e 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -105,7 +105,6 @@ static int omap_otg_probe(struct platform_device *pdev)
         extcon = extcon_get_extcon_dev(config->extcon);
         if (!extcon)
                 return -EPROBE_DEFER;
-        otg_dev->extcon = extcon;
 
         otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
         if (!otg_dev)
@@ -115,6 +114,7 @@ static int omap_otg_probe(struct platform_device *pdev)
         if (IS_ERR(otg_dev->base))
                 return PTR_ERR(otg_dev->base);
 
+        otg_dev->extcon = extcon;
         otg_dev->id_nb.notifier_call = omap_otg_id_notifier;
         otg_dev->vbus_nb.notifier_call = omap_otg_vbus_notifier;
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 685fef71d3d1..f2280606b73c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
 #define NOVATELWIRELESS_PRODUCT_E362            0x9010
 #define NOVATELWIRELESS_PRODUCT_E371            0x9011
+#define NOVATELWIRELESS_PRODUCT_U620L           0x9022
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
 #define NOVATELWIRELESS_PRODUCT_MC551           0xB001
 
@@ -354,6 +355,7 @@ static void option_instat_callback(struct urb *urb);
 /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
 #define FOUR_G_SYSTEMS_PRODUCT_W14              0x9603
+#define FOUR_G_SYSTEMS_PRODUCT_W100             0x9b01
 
 /* iBall 3.5G connect wireless modem */
 #define IBALL_3_5G_CONNECT                      0x9605
@@ -519,6 +521,11 @@ static const struct option_blacklist_info four_g_w14_blacklist = {
         .sendsetup = BIT(0) | BIT(1),
 };
 
+static const struct option_blacklist_info four_g_w100_blacklist = {
+        .sendsetup = BIT(1) | BIT(2),
+        .reserved = BIT(3),
+};
+
 static const struct option_blacklist_info alcatel_x200_blacklist = {
         .sendsetup = BIT(0) | BIT(1),
         .reserved = BIT(4),
@@ -1052,6 +1059,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U620L, 0xff, 0x00, 0x00) },
 
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
@@ -1641,6 +1649,9 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
           .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
         },
+        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
+          .driver_info = (kernel_ulong_t)&four_g_w100_blacklist
+        },
         { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 5022fcfa0260..9919d2a9faf2 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -22,6 +22,8 @@
 #define DRIVER_AUTHOR "Qualcomm Inc"
 #define DRIVER_DESC "Qualcomm USB Serial driver"
 
+#define QUECTEL_EC20_PID        0x9215
+
 /* standard device layouts supported by this driver */
 enum qcserial_layouts {
         QCSERIAL_G2K = 0,       /* Gobi 2000 */
@@ -171,6 +173,38 @@ static const struct usb_device_id id_table[] = {
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
+static int handle_quectel_ec20(struct device *dev, int ifnum)
+{
+        int altsetting = 0;
+
+        /*
+         * Quectel EC20 Mini PCIe LTE module layout:
+         * 0: DM/DIAG (use libqcdm from ModemManager for communication)
+         * 1: NMEA
+         * 2: AT-capable modem port
+         * 3: Modem interface
+         * 4: NDIS
+         */
+        switch (ifnum) {
+        case 0:
+                dev_dbg(dev, "Quectel EC20 DM/DIAG interface found\n");
+                break;
+        case 1:
+                dev_dbg(dev, "Quectel EC20 NMEA GPS interface found\n");
+                break;
+        case 2:
+        case 3:
+                dev_dbg(dev, "Quectel EC20 Modem port found\n");
+                break;
+        case 4:
+                /* Don't claim the QMI/net interface */
+                altsetting = -1;
+                break;
+        }
+
+        return altsetting;
+}
+
 static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 {
         struct usb_host_interface *intf = serial->interface->cur_altsetting;
@@ -181,6 +215,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         int altsetting = -1;
         bool sendsetup = false;
 
+        /* we only support vendor specific functions */
+        if (intf->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                goto done;
+
         nintf = serial->dev->actconfig->desc.bNumInterfaces;
         dev_dbg(dev, "Num Interfaces = %d\n", nintf);
         ifnum = intf->desc.bInterfaceNumber;
@@ -240,6 +278,12 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                         altsetting = -1;
                 break;
         case QCSERIAL_G2K:
+                /* handle non-standard layouts */
+                if (nintf == 5 && id->idProduct == QUECTEL_EC20_PID) {
+                        altsetting = handle_quectel_ec20(dev, ifnum);
+                        goto done;
+                }
+
                 /*
                  * Gobi 2K+ USB layout:
                  * 0: QMI/net
@@ -301,29 +345,39 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                 break;
         case QCSERIAL_HWI:
                 /*
-                 * Huawei layout:
-                 * 0: AT-capable modem port
-                 * 1: DM/DIAG
-                 * 2: AT-capable modem port
-                 * 3: CCID-compatible PCSC interface
-                 * 4: QMI/net
-                 * 5: NMEA
+                 * Huawei devices map functions by subclass + protocol
+                 * instead of interface numbers. The protocol identify
+                 * a specific function, while the subclass indicate a
+                 * specific firmware source
+                 *
+                 * This is a blacklist of functions known to be
+                 * non-serial.  The rest are assumed to be serial and
+                 * will be handled by this driver
                  */
-                switch (ifnum) {
-                case 0:
-                case 2:
-                        dev_dbg(dev, "Modem port found\n");
-                        break;
-                case 1:
-                        dev_dbg(dev, "DM/DIAG interface found\n");
-                        break;
-                case 5:
-                        dev_dbg(dev, "NMEA GPS interface found\n");
-                        break;
-                default:
-                        /* don't claim any unsupported interface */
+                switch (intf->desc.bInterfaceProtocol) {
+                        /* QMI combined (qmi_wwan) */
+                case 0x07:
+                case 0x37:
+                case 0x67:
+                        /* QMI data (qmi_wwan) */
+                case 0x08:
+                case 0x38:
+                case 0x68:
+                        /* QMI control (qmi_wwan) */
+                case 0x09:
+                case 0x39:
+                case 0x69:
+                        /* NCM like (huawei_cdc_ncm) */
+                case 0x16:
+                case 0x46:
+                case 0x76:
                         altsetting = -1;
                         break;
+                default:
+                        dev_dbg(dev, "Huawei type serial port found (%02x/%02x/%02x)\n",
+                                intf->desc.bInterfaceClass,
+                                intf->desc.bInterfaceSubClass,
+                                intf->desc.bInterfaceProtocol);
                 }
                 break;
         default:
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index e9da41d9fe7f..2694df2f4559 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -159,6 +159,7 @@ static const struct usb_device_id ti_id_table_3410[] = {
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) },
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+        { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) },
         { }     /* terminator */
 };
 
@@ -191,6 +192,7 @@ static const struct usb_device_id ti_id_table_combined[] = {
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+        { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) },
         { }     /* terminator */
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index 4a2423e84d55..98f35c656c02 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -56,6 +56,10 @@
 #define ABBOTT_PRODUCT_ID               ABBOTT_STEREO_PLUG_ID
 #define ABBOTT_STRIP_PORT_ID            0x3420
 
+/* Honeywell vendor and product IDs */
+#define HONEYWELL_VENDOR_ID             0x10ac
+#define HONEYWELL_HGI80_PRODUCT_ID      0x0102  /* Honeywell HGI80 */
+
 /* Commands */
 #define TI_GET_VERSION                  0x01
 #define TI_GET_PORT_STATUS              0x02
diff --git a/fs/Kconfig b/fs/Kconfig
index da3f32f1a4e4..6ce72d8d1ee1 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -46,6 +46,12 @@ config FS_DAX
           or if unsure, say N.  Saying Y will increase the size of the kernel
           by about 5kB.
 
+config FS_DAX_PMD
+        bool
+        default FS_DAX
+        depends on FS_DAX
+        depends on BROKEN
+
 endif # BLOCK
 
 # Posix ACL utility routines
diff --git a/fs/block_dev.c b/fs/block_dev.c
index bb0dfb1c7af1..c25639e907bd 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -390,9 +390,17 @@ int bdev_read_page(struct block_device *bdev, sector_t sector,
                         struct page *page)
 {
         const struct block_device_operations *ops = bdev->bd_disk->fops;
+        int result = -EOPNOTSUPP;
+
         if (!ops->rw_page || bdev_get_integrity(bdev))
-                return -EOPNOTSUPP;
-        return ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);
+                return result;
+
+        result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);
+        if (result)
+                return result;
+        result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);
+        blk_queue_exit(bdev->bd_queue);
+        return result;
 }
 EXPORT_SYMBOL_GPL(bdev_read_page);
 
@@ -421,14 +429,20 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
         int result;
         int rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE;
         const struct block_device_operations *ops = bdev->bd_disk->fops;
+
         if (!ops->rw_page || bdev_get_integrity(bdev))
                 return -EOPNOTSUPP;
+        result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);
+        if (result)
+                return result;
+
         set_page_writeback(page);
         result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw);
         if (result)
                 end_page_writeback(page);
         else
                 unlock_page(page);
+        blk_queue_exit(bdev->bd_queue);
         return result;
 }
 EXPORT_SYMBOL_GPL(bdev_write_page);
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index c81ce7f200a6..a7a1b218f308 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1636,6 +1636,116 @@ const struct file_operations configfs_dir_operations = {
         .iterate        = configfs_readdir,
 };
 
+/**
+ * configfs_register_group - creates a parent-child relation between two groups
+ * @parent_group:       parent group
+ * @group:              child group
+ *
+ * link groups, creates dentry for the child and attaches it to the
+ * parent dentry.
+ *
+ * Return: 0 on success, negative errno code on error
+ */
+int configfs_register_group(struct config_group *parent_group,
+                            struct config_group *group)
+{
+        struct configfs_subsystem *subsys = parent_group->cg_subsys;
+        struct dentry *parent;
+        int ret;
+
+        mutex_lock(&subsys->su_mutex);
+        link_group(parent_group, group);
+        mutex_unlock(&subsys->su_mutex);
+
+        parent = parent_group->cg_item.ci_dentry;
+
+        mutex_lock_nested(&d_inode(parent)->i_mutex, I_MUTEX_PARENT);
+        ret = create_default_group(parent_group, group);
+        if (!ret) {
+                spin_lock(&configfs_dirent_lock);
+                configfs_dir_set_ready(group->cg_item.ci_dentry->d_fsdata);
+                spin_unlock(&configfs_dirent_lock);
+        }
+        mutex_unlock(&d_inode(parent)->i_mutex);
+        return ret;
+}
+EXPORT_SYMBOL(configfs_register_group);
+
+/**
+ * configfs_unregister_group() - unregisters a child group from its parent
+ * @group: parent group to be unregistered
+ *
+ * Undoes configfs_register_group()
+ */
+void configfs_unregister_group(struct config_group *group)
+{
+        struct configfs_subsystem *subsys = group->cg_subsys;
+        struct dentry *dentry = group->cg_item.ci_dentry;
+        struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
+
+        mutex_lock_nested(&d_inode(parent)->i_mutex, I_MUTEX_PARENT);
+        spin_lock(&configfs_dirent_lock);
+        configfs_detach_prep(dentry, NULL);
+        spin_unlock(&configfs_dirent_lock);
+
+        configfs_detach_group(&group->cg_item);
+        d_inode(dentry)->i_flags |= S_DEAD;
+        dont_mount(dentry);
+        d_delete(dentry);
+        mutex_unlock(&d_inode(parent)->i_mutex);
+
+        dput(dentry);
+
+        mutex_lock(&subsys->su_mutex);
+        unlink_group(group);
+        mutex_unlock(&subsys->su_mutex);
+}
+EXPORT_SYMBOL(configfs_unregister_group);
+
+/**
+ * configfs_register_default_group() - allocates and registers a child group
+ * @parent_group:       parent group
+ * @name:               child group name
+ * @item_type:          child item type description
+ *
+ * boilerplate to allocate and register a child group with its parent. We need
+ * kzalloc'ed memory because child's default_group is initially empty.
+ *
+ * Return: allocated config group or ERR_PTR() on error
+ */
+struct config_group *
+configfs_register_default_group(struct config_group *parent_group,
+                                const char *name,
+                                struct config_item_type *item_type)
+{
+        int ret;
+        struct config_group *group;
+
+        group = kzalloc(sizeof(*group), GFP_KERNEL);
+        if (!group)
+                return ERR_PTR(-ENOMEM);
+        config_group_init_type_name(group, name, item_type);
+
+        ret = configfs_register_group(parent_group, group);
+        if (ret) {
+                kfree(group);
+                return ERR_PTR(ret);
+        }
+        return group;
+}
+EXPORT_SYMBOL(configfs_register_default_group);
+
+/**
+ * configfs_unregister_default_group() - unregisters and frees a child group
+ * @group:      the group to act on
+ */
+void configfs_unregister_default_group(struct config_group *group)
+{
+        configfs_unregister_group(group);
+        kfree(group);
+}
+EXPORT_SYMBOL(configfs_unregister_default_group);
+
 int configfs_register_subsystem(struct configfs_subsystem *subsys)
 {
         int err;
diff --git a/fs/dax.c b/fs/dax.c
index d1e5cb7311a1..43671b68220e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -541,6 +541,10 @@ int __dax_pmd_fault(struct vm_area_struct *vma, unsigned long address,
         unsigned long pfn;
         int result = 0;
 
+        /* dax pmd mappings are broken wrt gup and fork */
+        if (!IS_ENABLED(CONFIG_FS_DAX_PMD))
+                return VM_FAULT_FALLBACK;
+
         /* Fall back to PTEs if we're going to COW */
         if (write && !(vma->vm_flags & VM_SHARED))
                 return VM_FAULT_FALLBACK;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 3a71cea68420..748d35afc902 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -569,6 +569,8 @@ static int parse_options(char *options, struct super_block *sb)
                         /* Fall through */
                 case Opt_dax:
 #ifdef CONFIG_FS_DAX
+                        ext2_msg(sb, KERN_WARNING,
+                "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
                         set_opt(sbi->s_mount_opt, DAX);
 #else
                         ext2_msg(sb, KERN_INFO, "dax option not supported");
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 753f4e68b820..c9ab67da6e5a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1664,8 +1664,12 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
                 }
                 sbi->s_jquota_fmt = m->mount_opt;
 #endif
-#ifndef CONFIG_FS_DAX
         } else if (token == Opt_dax) {
+#ifdef CONFIG_FS_DAX
+                ext4_msg(sb, KERN_WARNING,
+                "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
+                        sbi->s_mount_opt |= m->mount_opt;
+#else
                 ext4_msg(sb, KERN_INFO, "dax option not supported");
                 return -1;
 #endif
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 4afc4d9d2e41..8b2127ffb226 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -610,9 +610,9 @@ parse_record:
                 int status = fat_parse_long(inode, &cpos, &bh, &de,
                                             &unicode, &nr_slots);
                 if (status < 0) {
-                        ctx->pos = cpos;
+                        bh = NULL;
                         ret = status;
-                        goto out;
+                        goto end_of_dir;
                 } else if (status == PARSE_INVALID)
                         goto record_end;
                 else if (status == PARSE_NOT_LONGNAME)
@@ -654,8 +654,9 @@ parse_record:
         fill_len = short_len;
 
 start_filldir:
-        if (!fake_offset)
-                ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+        ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+        if (fake_offset && ctx->pos < 2)
+                ctx->pos = 2;
 
         if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) {
                 if (!dir_emit_dot(file, ctx))
@@ -681,14 +682,19 @@ record_end:
         fake_offset = 0;
         ctx->pos = cpos;
         goto get_new;
+
 end_of_dir:
-        ctx->pos = cpos;
+        if (fake_offset && cpos < 2)
+                ctx->pos = 2;
+        else
+                ctx->pos = cpos;
 fill_failed:
         brelse(bh);
         if (unicode)
                 __putname(unicode);
 out:
         mutex_unlock(&sbi->s_lock);
+
         return ret;
 }
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 316adb968b65..de4bdfac0cec 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -332,12 +332,17 @@ static void remove_huge_page(struct page *page)
  * truncation is indicated by end of range being LLONG_MAX
  *      In this case, we first scan the range and release found pages.
  *      After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
- *      maps and global counts.
+ *      maps and global counts.  Page faults can not race with truncation
+ *      in this routine.  hugetlb_no_page() prevents page faults in the
+ *      truncated range.  It checks i_size before allocation, and again after
+ *      with the page table lock for the page held.  The same lock must be
+ *      acquired to unmap a page.
  * hole punch is indicated if end is not LLONG_MAX
  *      In the hole punch case we scan the range and release found pages.
  *      Only when releasing a page is the associated region/reserv map
  *      deleted.  The region/reserv map for ranges without associated
- *      pages are not modified.
+ *      pages are not modified.  Page faults can race with hole punch.
+ *      This is indicated if we find a mapped page.
  * Note: If the passed end of range value is beyond the end of file, but
  * not LLONG_MAX this routine still performs a hole punch operation.
  */
@@ -361,46 +366,37 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
         next = start;
         while (next < end) {
                 /*
-                 * Make sure to never grab more pages that we
-                 * might possibly need.
+                 * Don't grab more pages than the number left in the range.
                  */
                 if (end - next < lookup_nr)
                         lookup_nr = end - next;
 
                 /*
-                 * This pagevec_lookup() may return pages past 'end',
-                 * so we must check for page->index > end.
+                 * When no more pages are found, we are done.
                  */
-                if (!pagevec_lookup(&pvec, mapping, next, lookup_nr)) {
-                        if (next == start)
-                                break;
-                        next = start;
-                        continue;
-                }
+                if (!pagevec_lookup(&pvec, mapping, next, lookup_nr))
+                        break;
 
                 for (i = 0; i < pagevec_count(&pvec); ++i) {
                         struct page *page = pvec.pages[i];
                         u32 hash;
 
+                        /*
+                         * The page (index) could be beyond end.  This is
+                         * only possible in the punch hole case as end is
+                         * max page offset in the truncate case.
+                         */
+                        next = page->index;
+                        if (next >= end)
+                                break;
+
                         hash = hugetlb_fault_mutex_hash(h, current->mm,
                                                         &pseudo_vma,
                                                         mapping, next, 0);
                         mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
                         lock_page(page);
-                        if (page->index >= end) {
-                                unlock_page(page);
-                                mutex_unlock(&hugetlb_fault_mutex_table[hash]);
-                                next = end;     /* we are done */
-                                break;
-                        }
-
-                        /*
-                         * If page is mapped, it was faulted in after being
-                         * unmapped.  Do nothing in this race case.  In the
-                         * normal case page is not mapped.
-                         */
-                        if (!page_mapped(page)) {
+                        if (likely(!page_mapped(page))) {
                                 bool rsv_on_error = !PagePrivate(page);
                                 /*
                                  * We must free the huge page and remove
@@ -421,17 +417,23 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
                                                 hugetlb_fix_reserve_counts(
                                                         inode, rsv_on_error);
                                 }
+                        } else {
+                                /*
+                                 * If page is mapped, it was faulted in after
+                                 * being unmapped.  It indicates a race between
+                                 * hole punch and page fault.  Do nothing in
+                                 * this case.  Getting here in a truncate
+                                 * operation is a bug.
+                                 */
+                                BUG_ON(truncate_op);
                         }
 
-                        if (page->index > next)
-                                next = page->index;
-
-                        ++next;
                         unlock_page(page);
-
                         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
                 }
+                ++next;
                 huge_pagevec_release(&pvec);
+                cond_resched();
         }
 
         if (truncate_op)
@@ -647,9 +649,6 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
         if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
                 i_size_write(inode, offset + len);
         inode->i_ctime = CURRENT_TIME;
-        spin_lock(&inode->i_lock);
-        inode->i_private = NULL;
-        spin_unlock(&inode->i_lock);
 out:
         mutex_unlock(&inode->i_mutex);
         return error;
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index 79b113048eac..0a3f9b594602 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -525,6 +525,8 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg
                         switch (rqdata.cmd) {
                                 case NCP_LOCK_EX:
                                 case NCP_LOCK_SH:
+                                                if (rqdata.timeout < 0)
+                                                        return -EINVAL;
                                                 if (rqdata.timeout == 0)
                                                         rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT;
                                                 else if (rqdata.timeout > NCP_LOCK_MAX_TIMEOUT)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 3b48ac25d8a7..a03f6f433075 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -372,6 +372,8 @@ static int ocfs2_mknod(struct inode *dir,
                 mlog_errno(status);
                 goto leave;
         }
+        /* update inode->i_mode after mask with "umask". */
+        inode->i_mode = mode;
 
         handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
                                                             S_ISDIR(mode),
diff --git a/fs/splice.c b/fs/splice.c
index 801c21cd77fe..4cf700d50b40 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -809,6 +809,13 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
  */
 static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
 {
+        /*
+         * Check for signal early to make process killable when there are
+         * always buffers available
+         */
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
         while (!pipe->nrbufs) {
                 if (!pipe->writers)
                         return 0;
@@ -884,6 +891,7 @@ ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
 
         splice_from_pipe_begin(sd);
         do {
+                cond_resched();
                 ret = splice_from_pipe_next(pipe, sd);
                 if (ret > 0)
                         ret = splice_from_pipe_feed(pipe, sd, actor);
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 590ad9206e3f..02fa1dcc5969 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -162,15 +162,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev)
                 inode->i_fop = &sysv_dir_operations;
                 inode->i_mapping->a_ops = &sysv_aops;
         } else if (S_ISLNK(inode->i_mode)) {
-                if (inode->i_blocks) {
-                        inode->i_op = &sysv_symlink_inode_operations;
-                        inode->i_mapping->a_ops = &sysv_aops;
-                } else {
-                        inode->i_op = &simple_symlink_inode_operations;
-                        inode->i_link = (char *)SYSV_I(inode)->i_data;
-                        nd_terminate_link(inode->i_link, inode->i_size,
-                                sizeof(SYSV_I(inode)->i_data) - 1);
-                }
+                inode->i_op = &sysv_symlink_inode_operations;
+                inode->i_mapping->a_ops = &sysv_aops;
         } else
                 init_special_inode(inode, inode->i_mode, rdev);
 }
diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
index e67aeac2aee0..4b74c97d297a 100644
--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -136,6 +136,9 @@ drm_atomic_connectors_for_crtc(struct drm_atomic_state *state,
 
 void drm_atomic_legacy_backoff(struct drm_atomic_state *state);
 
+void
+drm_atomic_clean_old_fb(struct drm_device *dev, unsigned plane_mask, int ret);
+
 int __must_check drm_atomic_check_only(struct drm_atomic_state *state);
 int __must_check drm_atomic_commit(struct drm_atomic_state *state);
 int __must_check drm_atomic_async_commit(struct drm_atomic_state *state);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 9c747cb14ad8..d2f41477f8ae 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -342,10 +342,10 @@ int kvm_vgic_inject_mapped_irq(struct kvm *kvm, int cpuid,
                                struct irq_phys_map *map, bool level);
 void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg);
 int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu);
-int kvm_vgic_vcpu_active_irq(struct kvm_vcpu *vcpu);
 struct irq_phys_map *kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu,
                                            int virt_irq, int irq);
 int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, struct irq_phys_map *map);
+bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, struct irq_phys_map *map);
 
 #define irqchip_in_kernel(k)    (!!((k)->arch.vgic.in_kernel))
 #define vgic_initialized(k)     (!!((k)->arch.vgic.nr_cpus))
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 3fe27f8d91f0..c0d2b7927c1f 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -794,6 +794,8 @@ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
 extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
                          struct scsi_ioctl_command __user *);
 
+extern int blk_queue_enter(struct request_queue *q, gfp_t gfp);
+extern void blk_queue_exit(struct request_queue *q);
 extern void blk_start_queue(struct request_queue *q);
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index a8a335b7fce0..758a029011b1 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -197,6 +197,16 @@ static inline struct configfs_subsystem *to_configfs_subsystem(struct config_gro
 int configfs_register_subsystem(struct configfs_subsystem *subsys);
 void configfs_unregister_subsystem(struct configfs_subsystem *subsys);
 
+int configfs_register_group(struct config_group *parent_group,
+                            struct config_group *group);
+void configfs_unregister_group(struct config_group *group);
+
+struct config_group *
+configfs_register_default_group(struct config_group *parent_group,
+                                const char *name,
+                                struct config_item_type *item_type);
+void configfs_unregister_default_group(struct config_group *group);
+
 /* These functions can sleep and can alloc with GFP_KERNEL */
 /* WARNING: These cannot be called underneath configfs callbacks!! */
 int configfs_depend_item(struct configfs_subsystem *subsys, struct config_item *target);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 6523109e136d..8942af0813e3 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -271,7 +271,7 @@ static inline int gfpflags_to_migratetype(const gfp_t gfp_flags)
 
 static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
 {
-        return gfp_flags & __GFP_DIRECT_RECLAIM;
+        return (bool __force)(gfp_flags & __GFP_DIRECT_RECLAIM);
 }
 
 #ifdef CONFIG_HIGHMEM
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 5706a2108f0a..c923350ca20a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -460,6 +460,17 @@ static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
              (vcpup = kvm_get_vcpu(kvm, idx)) != NULL; \
              idx++)
 
+static inline struct kvm_vcpu *kvm_get_vcpu_by_id(struct kvm *kvm, int id)
+{
+        struct kvm_vcpu *vcpu;
+        int i;
+
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                if (vcpu->vcpu_id == id)
+                        return vcpu;
+        return NULL;
+}
+
 #define kvm_for_each_memslot(memslot, slots)    \
         for (memslot = &slots->memslots[0];     \
               memslot < slots->memslots + KVM_MEM_SLOTS_NUM && memslot->npages;\
diff --git a/include/linux/lightnvm.h b/include/linux/lightnvm.h
index 69c9057e1ab8..3db5552b17d5 100644
--- a/include/linux/lightnvm.h
+++ b/include/linux/lightnvm.h
@@ -58,7 +58,6 @@ enum {
 struct nvm_id_group {
         u8      mtype;
         u8      fmtype;
-        u16     res16;
         u8      num_ch;
         u8      num_lun;
         u8      num_pln;
@@ -74,9 +73,9 @@ struct nvm_id_group {
         u32     tbet;
         u32     tbem;
         u32     mpos;
+        u32     mccap;
         u16     cpar;
-        u8      res[913];
-} __packed;
+};
 
 struct nvm_addr_format {
         u8      ch_offset;
@@ -91,19 +90,15 @@ struct nvm_addr_format {
         u8      pg_len;
         u8      sect_offset;
         u8      sect_len;
-        u8      res[4];
 };
 
 struct nvm_id {
         u8      ver_id;
         u8      vmnt;
         u8      cgrps;
-        u8      res[5];
         u32     cap;
         u32     dom;
         struct nvm_addr_format ppaf;
-        u8      ppat;
-        u8      resv[224];
         struct nvm_id_group groups[4];
 } __packed;
 
@@ -123,39 +118,28 @@ struct nvm_tgt_instance {
 #define NVM_VERSION_MINOR 0
 #define NVM_VERSION_PATCH 0
 
-#define NVM_SEC_BITS (8)
-#define NVM_PL_BITS  (6)
-#define NVM_PG_BITS  (16)
 #define NVM_BLK_BITS (16)
-#define NVM_LUN_BITS (10)
+#define NVM_PG_BITS  (16)
+#define NVM_SEC_BITS (8)
+#define NVM_PL_BITS  (8)
+#define NVM_LUN_BITS (8)
 #define NVM_CH_BITS  (8)
 
 struct ppa_addr {
+        /* Generic structure for all addresses */
         union {
-                /* Channel-based PPA format in nand 4x2x2x2x8x10 */
-                struct {
-                        u64 ch          : 4;
-                        u64 sec         : 2; /* 4 sectors per page */
-                        u64 pl          : 2; /* 4 planes per LUN */
-                        u64 lun         : 2; /* 4 LUNs per channel */
-                        u64 pg          : 8; /* 256 pages per block */
-                        u64 blk         : 10;/* 1024 blocks per plane */
-                        u64 resved              : 36;
-                } chnl;
-
-                /* Generic structure for all addresses */
                 struct {
+                        u64 blk         : NVM_BLK_BITS;
+                        u64 pg          : NVM_PG_BITS;
                         u64 sec         : NVM_SEC_BITS;
                         u64 pl          : NVM_PL_BITS;
-                        u64 pg          : NVM_PG_BITS;
-                        u64 blk         : NVM_BLK_BITS;
                         u64 lun         : NVM_LUN_BITS;
                         u64 ch          : NVM_CH_BITS;
                 } g;
 
                 u64 ppa;
         };
-} __packed;
+};
 
 struct nvm_rq {
         struct nvm_tgt_instance *ins;
@@ -191,11 +175,11 @@ static inline void *nvm_rq_to_pdu(struct nvm_rq *rqdata)
 struct nvm_block;
 
 typedef int (nvm_l2p_update_fn)(u64, u32, __le64 *, void *);
-typedef int (nvm_bb_update_fn)(u32, void *, unsigned int, void *);
+typedef int (nvm_bb_update_fn)(struct ppa_addr, int, u8 *, void *);
 typedef int (nvm_id_fn)(struct request_queue *, struct nvm_id *);
 typedef int (nvm_get_l2p_tbl_fn)(struct request_queue *, u64, u32,
                                 nvm_l2p_update_fn *, void *);
-typedef int (nvm_op_bb_tbl_fn)(struct request_queue *, int, unsigned int,
+typedef int (nvm_op_bb_tbl_fn)(struct request_queue *, struct ppa_addr, int,
                                 nvm_bb_update_fn *, void *);
 typedef int (nvm_op_set_bb_fn)(struct request_queue *, struct nvm_rq *, int);
 typedef int (nvm_submit_io_fn)(struct request_queue *, struct nvm_rq *);
@@ -210,7 +194,7 @@ struct nvm_dev_ops {
         nvm_id_fn               *identity;
         nvm_get_l2p_tbl_fn      *get_l2p_tbl;
         nvm_op_bb_tbl_fn        *get_bb_tbl;
-        nvm_op_set_bb_fn        *set_bb;
+        nvm_op_set_bb_fn        *set_bb_tbl;
 
         nvm_submit_io_fn        *submit_io;
         nvm_erase_blk_fn        *erase_block;
@@ -220,7 +204,7 @@ struct nvm_dev_ops {
         nvm_dev_dma_alloc_fn    *dev_dma_alloc;
         nvm_dev_dma_free_fn     *dev_dma_free;
 
-        uint8_t                 max_phys_sect;
+        unsigned int            max_phys_sect;
 };
 
 struct nvm_lun {
@@ -229,7 +213,9 @@ struct nvm_lun {
         int lun_id;
         int chnl_id;
 
+        unsigned int nr_inuse_blocks;   /* Number of used blocks */
         unsigned int nr_free_blocks;    /* Number of unused blocks */
+        unsigned int nr_bad_blocks;     /* Number of bad blocks */
         struct nvm_block *blocks;
 
         spinlock_t lock;
@@ -263,8 +249,7 @@ struct nvm_dev {
         int blks_per_lun;
         int sec_size;
         int oob_size;
-        int addr_mode;
-        struct nvm_addr_format addr_format;
+        struct nvm_addr_format ppaf;
 
         /* Calculated/Cached values. These do not reflect the actual usable
          * blocks at run-time.
@@ -290,118 +275,45 @@ struct nvm_dev {
         char name[DISK_NAME_LEN];
 };
 
-/* fallback conversion */
-static struct ppa_addr __generic_to_linear_addr(struct nvm_dev *dev,
-                                                        struct ppa_addr r)
-{
-        struct ppa_addr l;
-
-        l.ppa = r.g.sec +
-                r.g.pg  * dev->sec_per_pg +
-                r.g.blk * (dev->pgs_per_blk *
-                                dev->sec_per_pg) +
-                r.g.lun * (dev->blks_per_lun *
-                                dev->pgs_per_blk *
-                                dev->sec_per_pg) +
-                r.g.ch * (dev->blks_per_lun *
-                                dev->pgs_per_blk *
-                                dev->luns_per_chnl *
-                                dev->sec_per_pg);
-
-        return l;
-}
-
-/* fallback conversion */
-static struct ppa_addr __linear_to_generic_addr(struct nvm_dev *dev,
-                                                        struct ppa_addr r)
+static inline struct ppa_addr generic_to_dev_addr(struct nvm_dev *dev,
+                                                struct ppa_addr r)
 {
         struct ppa_addr l;
-        int secs, pgs, blks, luns;
-        sector_t ppa = r.ppa;
 
-        l.ppa = 0;
-
-        div_u64_rem(ppa, dev->sec_per_pg, &secs);
-        l.g.sec = secs;
-
-        sector_div(ppa, dev->sec_per_pg);
-        div_u64_rem(ppa, dev->sec_per_blk, &pgs);
-        l.g.pg = pgs;
-
-        sector_div(ppa, dev->pgs_per_blk);
-        div_u64_rem(ppa, dev->blks_per_lun, &blks);
-        l.g.blk = blks;
-
-        sector_div(ppa, dev->blks_per_lun);
-        div_u64_rem(ppa, dev->luns_per_chnl, &luns);
-        l.g.lun = luns;
-
-        sector_div(ppa, dev->luns_per_chnl);
-        l.g.ch = ppa;
+        l.ppa = ((u64)r.g.blk) << dev->ppaf.blk_offset;
+        l.ppa |= ((u64)r.g.pg) << dev->ppaf.pg_offset;
+        l.ppa |= ((u64)r.g.sec) << dev->ppaf.sect_offset;
+        l.ppa |= ((u64)r.g.pl) << dev->ppaf.pln_offset;
+        l.ppa |= ((u64)r.g.lun) << dev->ppaf.lun_offset;
+        l.ppa |= ((u64)r.g.ch) << dev->ppaf.ch_offset;
 
         return l;
 }
 
-static struct ppa_addr __generic_to_chnl_addr(struct ppa_addr r)
+static inline struct ppa_addr dev_to_generic_addr(struct nvm_dev *dev,
+                                                struct ppa_addr r)
 {
         struct ppa_addr l;
 
-        l.ppa = 0;
-
-        l.chnl.sec = r.g.sec;
-        l.chnl.pl = r.g.pl;
-        l.chnl.pg = r.g.pg;
-        l.chnl.blk = r.g.blk;
-        l.chnl.lun = r.g.lun;
-        l.chnl.ch = r.g.ch;
-
-        return l;
-}
-
-static struct ppa_addr __chnl_to_generic_addr(struct ppa_addr r)
-{
-        struct ppa_addr l;
-
-        l.ppa = 0;
-
-        l.g.sec = r.chnl.sec;
-        l.g.pl = r.chnl.pl;
-        l.g.pg = r.chnl.pg;
-        l.g.blk = r.chnl.blk;
-        l.g.lun = r.chnl.lun;
-        l.g.ch = r.chnl.ch;
+        /*
+         * (r.ppa << X offset) & X len bitmask. X eq. blk, pg, etc.
+         */
+        l.g.blk = (r.ppa >> dev->ppaf.blk_offset) &
+                                        (((1 << dev->ppaf.blk_len) - 1));
+        l.g.pg |= (r.ppa >> dev->ppaf.pg_offset) &
+                                        (((1 << dev->ppaf.pg_len) - 1));
+        l.g.sec |= (r.ppa >> dev->ppaf.sect_offset) &
+                                        (((1 << dev->ppaf.sect_len) - 1));
+        l.g.pl |= (r.ppa >> dev->ppaf.pln_offset) &
+                                        (((1 << dev->ppaf.pln_len) - 1));
+        l.g.lun |= (r.ppa >> dev->ppaf.lun_offset) &
+                                        (((1 << dev->ppaf.lun_len) - 1));
+        l.g.ch |= (r.ppa >> dev->ppaf.ch_offset) &
+                                        (((1 << dev->ppaf.ch_len) - 1));
 
         return l;
 }
 
-static inline struct ppa_addr addr_to_generic_mode(struct nvm_dev *dev,
-                                                struct ppa_addr gppa)
-{
-        switch (dev->addr_mode) {
-        case NVM_ADDRMODE_LINEAR:
-                return __linear_to_generic_addr(dev, gppa);
-        case NVM_ADDRMODE_CHANNEL:
-                return __chnl_to_generic_addr(gppa);
-        default:
-                BUG();
-        }
-        return gppa;
-}
-
-static inline struct ppa_addr generic_to_addr_mode(struct nvm_dev *dev,
-                                                struct ppa_addr gppa)
-{
-        switch (dev->addr_mode) {
-        case NVM_ADDRMODE_LINEAR:
-                return __generic_to_linear_addr(dev, gppa);
-        case NVM_ADDRMODE_CHANNEL:
-                return __generic_to_chnl_addr(gppa);
-        default:
-                BUG();
-        }
-        return gppa;
-}
-
 static inline int ppa_empty(struct ppa_addr ppa_addr)
 {
         return (ppa_addr.ppa == ADDR_EMPTY);
@@ -468,7 +380,7 @@ typedef int (nvmm_end_io_fn)(struct nvm_rq *, int);
 typedef int (nvmm_erase_blk_fn)(struct nvm_dev *, struct nvm_block *,
                                                                 unsigned long);
 typedef struct nvm_lun *(nvmm_get_lun_fn)(struct nvm_dev *, int);
-typedef void (nvmm_free_blocks_print_fn)(struct nvm_dev *);
+typedef void (nvmm_lun_info_print_fn)(struct nvm_dev *);
 
 struct nvmm_type {
         const char *name;
@@ -492,7 +404,7 @@ struct nvmm_type {
         nvmm_get_lun_fn *get_lun;
 
         /* Statistics */
-        nvmm_free_blocks_print_fn *free_blocks_print;
+        nvmm_lun_info_print_fn *lun_info_print;
         struct list_head list;
 };
 
diff --git a/include/linux/module.h b/include/linux/module.h
index 3a19c79918e0..4560d8f1545d 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -302,6 +302,28 @@ struct mod_tree_node {
         struct latch_tree_node node;
 };
 
+struct module_layout {
+        /* The actual code + data. */
+        void *base;
+        /* Total size. */
+        unsigned int size;
+        /* The size of the executable code.  */
+        unsigned int text_size;
+        /* Size of RO section of the module (text+rodata) */
+        unsigned int ro_size;
+
+#ifdef CONFIG_MODULES_TREE_LOOKUP
+        struct mod_tree_node mtn;
+#endif
+};
+
+#ifdef CONFIG_MODULES_TREE_LOOKUP
+/* Only touch one cacheline for common rbtree-for-core-layout case. */
+#define __module_layout_align ____cacheline_aligned
+#else
+#define __module_layout_align
+#endif
+
 struct module {
         enum module_state state;
 
@@ -366,37 +388,9 @@ struct module {
         /* Startup function. */
         int (*init)(void);
 
-        /*
-         * If this is non-NULL, vfree() after init() returns.
-         *
-         * Cacheline align here, such that:
-         *   module_init, module_core, init_size, core_size,
-         *   init_text_size, core_text_size and mtn_core::{mod,node[0]}
-         * are on the same cacheline.
-         */
-        void *module_init       ____cacheline_aligned;
-
-        /* Here is the actual code + data, vfree'd on unload. */
-        void *module_core;
-
-        /* Here are the sizes of the init and core sections */
-        unsigned int init_size, core_size;
-
-        /* The size of the executable code in each section.  */
-        unsigned int init_text_size, core_text_size;
-
-#ifdef CONFIG_MODULES_TREE_LOOKUP
-        /*
-         * We want mtn_core::{mod,node[0]} to be in the same cacheline as the
-         * above entries such that a regular lookup will only touch one
-         * cacheline.
-         */
-        struct mod_tree_node    mtn_core;
-        struct mod_tree_node    mtn_init;
-#endif
-
-        /* Size of RO sections of the module (text+rodata) */
-        unsigned int init_ro_size, core_ro_size;
+        /* Core layout: rbtree is accessed frequently, so keep together. */
+        struct module_layout core_layout __module_layout_align;
+        struct module_layout init_layout;
 
         /* Arch-specific module values */
         struct mod_arch_specific arch;
@@ -505,15 +499,15 @@ bool is_module_text_address(unsigned long addr);
 static inline bool within_module_core(unsigned long addr,
                                       const struct module *mod)
 {
-        return (unsigned long)mod->module_core <= addr &&
-               addr < (unsigned long)mod->module_core + mod->core_size;
+        return (unsigned long)mod->core_layout.base <= addr &&
+               addr < (unsigned long)mod->core_layout.base + mod->core_layout.size;
 }
 
 static inline bool within_module_init(unsigned long addr,
                                       const struct module *mod)
 {
-        return (unsigned long)mod->module_init <= addr &&
-               addr < (unsigned long)mod->module_init + mod->init_size;
+        return (unsigned long)mod->init_layout.base <= addr &&
+               addr < (unsigned long)mod->init_layout.base + mod->init_layout.size;
 }
 
 static inline bool within_module(unsigned long addr, const struct module *mod)
@@ -768,9 +762,13 @@ extern int module_sysfs_initialized;
 #ifdef CONFIG_DEBUG_SET_MODULE_RONX
 extern void set_all_modules_text_rw(void);
 extern void set_all_modules_text_ro(void);
+extern void module_enable_ro(const struct module *mod);
+extern void module_disable_ro(const struct module *mod);
 #else
 static inline void set_all_modules_text_rw(void) { }
 static inline void set_all_modules_text_ro(void) { }
+static inline void module_enable_ro(const struct module *mod) { }
+static inline void module_disable_ro(const struct module *mod) { }
 #endif
 
 #ifdef CONFIG_GENERIC_BUG
diff --git a/include/linux/of_dma.h b/include/linux/of_dma.h
index 36112cdd665a..b90d8ec57c1f 100644
--- a/include/linux/of_dma.h
+++ b/include/linux/of_dma.h
@@ -80,7 +80,7 @@ static inline int of_dma_router_register(struct device_node *np,
 static inline struct dma_chan *of_dma_request_slave_channel(struct device_node *np,
                                                      const char *name)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline struct dma_chan *of_dma_simple_xlate(struct of_phandle_args *dma_spec,
diff --git a/include/linux/signal.h b/include/linux/signal.h
index ab1e0392b5ac..92557bbce7e7 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -239,7 +239,6 @@ extern int sigprocmask(int, sigset_t *, sigset_t *);
 extern void set_current_blocked(sigset_t *);
 extern void __set_current_blocked(const sigset_t *);
 extern int show_unhandled_signals;
-extern int sigsuspend(sigset_t *);
 
 struct sigaction {
 #ifndef __ARCH_HAS_IRIX_SIGACTION
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 7c82e3b307a3..2037a861e367 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -158,6 +158,24 @@ size_t ksize(const void *);
 #endif
 
 /*
+ * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
+ * Intended for arches that get misalignment faults even for 64 bit integer
+ * aligned buffers.
+ */
+#ifndef ARCH_SLAB_MINALIGN
+#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
+#endif
+
+/*
+ * kmalloc and friends return ARCH_KMALLOC_MINALIGN aligned
+ * pointers. kmem_cache_alloc and friends return ARCH_SLAB_MINALIGN
+ * aligned pointers.
+ */
+#define __assume_kmalloc_alignment __assume_aligned(ARCH_KMALLOC_MINALIGN)
+#define __assume_slab_alignment __assume_aligned(ARCH_SLAB_MINALIGN)
+#define __assume_page_alignment __assume_aligned(PAGE_SIZE)
+
+/*
  * Kmalloc array related definitions
  */
 
@@ -286,8 +304,8 @@ static __always_inline int kmalloc_index(size_t size)
 }
 #endif /* !CONFIG_SLOB */
 
-void *__kmalloc(size_t size, gfp_t flags);
-void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags);
+void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment;
+void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment;
 void kmem_cache_free(struct kmem_cache *, void *);
 
 /*
@@ -298,11 +316,11 @@ void kmem_cache_free(struct kmem_cache *, void *);
  * Note that interrupts must be enabled when calling these functions.
  */
 void kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
-bool kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
+int kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
 
 #ifdef CONFIG_NUMA
-void *__kmalloc_node(size_t size, gfp_t flags, int node);
-void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
+void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment;
+void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment;
 #else
 static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
 {
@@ -316,12 +334,12 @@ static __always_inline void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t f
 #endif
 
 #ifdef CONFIG_TRACING
-extern void *kmem_cache_alloc_trace(struct kmem_cache *, gfp_t, size_t);
+extern void *kmem_cache_alloc_trace(struct kmem_cache *, gfp_t, size_t) __assume_slab_alignment;
 
 #ifdef CONFIG_NUMA
 extern void *kmem_cache_alloc_node_trace(struct kmem_cache *s,
                                            gfp_t gfpflags,
-                                           int node, size_t size);
+                                           int node, size_t size) __assume_slab_alignment;
 #else
 static __always_inline void *
 kmem_cache_alloc_node_trace(struct kmem_cache *s,
@@ -354,10 +372,10 @@ kmem_cache_alloc_node_trace(struct kmem_cache *s,
 }
 #endif /* CONFIG_TRACING */
 
-extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order);
+extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order) __assume_page_alignment;
 
 #ifdef CONFIG_TRACING
-extern void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order);
+extern void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order) __assume_page_alignment;
 #else
 static __always_inline void *
 kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
@@ -482,15 +500,6 @@ static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
         return __kmalloc_node(size, flags, node);
 }
 
-/*
- * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
- * Intended for arches that get misalignment faults even for 64 bit integer
- * aligned buffers.
- */
-#ifndef ARCH_SLAB_MINALIGN
-#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
-#endif
-
 struct memcg_cache_array {
         struct rcu_head rcu;
         struct kmem_cache *entries[0];
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 5b04b0a5375b..5e31f1b99037 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -607,7 +607,7 @@ extern void n_tty_inherit_ops(struct tty_ldisc_ops *ops);
 
 /* tty_audit.c */
 #ifdef CONFIG_AUDIT
-extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
+extern void tty_audit_add_data(struct tty_struct *tty, const void *data,
                                size_t size, unsigned icanon);
 extern void tty_audit_exit(void);
 extern void tty_audit_fork(struct signal_struct *sig);
@@ -615,8 +615,8 @@ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch);
 extern void tty_audit_push(struct tty_struct *tty);
 extern int tty_audit_push_current(void);
 #else
-static inline void tty_audit_add_data(struct tty_struct *tty,
-                unsigned char *data, size_t size, unsigned icanon)
+static inline void tty_audit_add_data(struct tty_struct *tty, const void *data,
+                                      size_t size, unsigned icanon)
 {
 }
 static inline void tty_audit_tiocsti(struct tty_struct *tty, char ch)
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 4121345498e0..2a20c0dfdafc 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -2021,7 +2021,7 @@ static int kdb_lsmod(int argc, const char **argv)
                         continue;
 
                 kdb_printf("%-20s%8u  0x%p ", mod->name,
-                           mod->core_size, (void *)mod);
+                           mod->core_layout.size, (void *)mod);
 #ifdef CONFIG_MODULE_UNLOAD
                 kdb_printf("%4d ", module_refcount(mod));
 #endif
@@ -2031,7 +2031,7 @@ static int kdb_lsmod(int argc, const char **argv)
                         kdb_printf(" (Loading)");
                 else
                         kdb_printf(" (Live)");
-                kdb_printf(" 0x%p", mod->module_core);
+                kdb_printf(" 0x%p", mod->core_layout.base);
 
 #ifdef CONFIG_MODULE_UNLOAD
                 {
diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
index 7080ae1eb6c1..2f9df37940a0 100644
--- a/kernel/gcov/base.c
+++ b/kernel/gcov/base.c
@@ -123,11 +123,6 @@ void gcov_enable_events(void)
 }
 
 #ifdef CONFIG_MODULES
-static inline int within(void *addr, void *start, unsigned long size)
-{
-        return ((addr >= start) && (addr < start + size));
-}
-
 /* Update list and generate events when modules are unloaded. */
 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
                                 void *data)
@@ -142,7 +137,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
 
         /* Remove entries located in module from linked list. */
         while ((info = gcov_info_next(info))) {
-                if (within(info, mod->module_core, mod->core_size)) {
+                if (within_module((unsigned long)info, mod)) {
                         gcov_info_unlink(prev, info);
                         if (gcov_events_enabled)
                                 gcov_event(GCOV_REMOVE, info);
diff --git a/kernel/module.c b/kernel/module.c
index 8f051a106676..912e891e0e2f 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -80,15 +80,6 @@
 # define debug_align(X) (X)
 #endif
 
-/*
- * Given BASE and SIZE this macro calculates the number of pages the
- * memory regions occupies
- */
-#define MOD_NUMBER_OF_PAGES(BASE, SIZE) (((SIZE) > 0) ?         \
-                (PFN_DOWN((unsigned long)(BASE) + (SIZE) - 1) - \
-                         PFN_DOWN((unsigned long)BASE) + 1)     \
-                : (0UL))
-
 /* If this is set, the section belongs in the init part of the module */
 #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
 
@@ -108,13 +99,6 @@ static LIST_HEAD(modules);
  * Use a latched RB-tree for __module_address(); this allows us to use
  * RCU-sched lookups of the address from any context.
  *
- * Because modules have two address ranges: init and core, we need two
- * latch_tree_nodes entries. Therefore we need the back-pointer from
- * mod_tree_node.
- *
- * Because init ranges are short lived we mark them unlikely and have placed
- * them outside the critical cacheline in struct module.
- *
  * This is conditional on PERF_EVENTS || TRACING because those can really hit
  * __module_address() hard by doing a lot of stack unwinding; potentially from
  * NMI context.
@@ -122,24 +106,16 @@ static LIST_HEAD(modules);
 
 static __always_inline unsigned long __mod_tree_val(struct latch_tree_node *n)
 {
-        struct mod_tree_node *mtn = container_of(n, struct mod_tree_node, node);
-        struct module *mod = mtn->mod;
+        struct module_layout *layout = container_of(n, struct module_layout, mtn.node);
 
-        if (unlikely(mtn == &mod->mtn_init))
-                return (unsigned long)mod->module_init;
-
-        return (unsigned long)mod->module_core;
+        return (unsigned long)layout->base;
 }
 
 static __always_inline unsigned long __mod_tree_size(struct latch_tree_node *n)
 {
-        struct mod_tree_node *mtn = container_of(n, struct mod_tree_node, node);
-        struct module *mod = mtn->mod;
-
-        if (unlikely(mtn == &mod->mtn_init))
-                return (unsigned long)mod->init_size;
+        struct module_layout *layout = container_of(n, struct module_layout, mtn.node);
 
-        return (unsigned long)mod->core_size;
+        return (unsigned long)layout->size;
 }
 
 static __always_inline bool
@@ -197,23 +173,23 @@ static void __mod_tree_remove(struct mod_tree_node *node)
  */
 static void mod_tree_insert(struct module *mod)
 {
-        mod->mtn_core.mod = mod;
-        mod->mtn_init.mod = mod;
+        mod->core_layout.mtn.mod = mod;
+        mod->init_layout.mtn.mod = mod;
 
-        __mod_tree_insert(&mod->mtn_core);
-        if (mod->init_size)
-                __mod_tree_insert(&mod->mtn_init);
+        __mod_tree_insert(&mod->core_layout.mtn);
+        if (mod->init_layout.size)
+                __mod_tree_insert(&mod->init_layout.mtn);
 }
 
 static void mod_tree_remove_init(struct module *mod)
 {
-        if (mod->init_size)
-                __mod_tree_remove(&mod->mtn_init);
+        if (mod->init_layout.size)
+                __mod_tree_remove(&mod->init_layout.mtn);
 }
 
 static void mod_tree_remove(struct module *mod)
 {
-        __mod_tree_remove(&mod->mtn_core);
+        __mod_tree_remove(&mod->core_layout.mtn);
         mod_tree_remove_init(mod);
 }
 
@@ -267,9 +243,9 @@ static void __mod_update_bounds(void *base, unsigned int size)
 
 static void mod_update_bounds(struct module *mod)
 {
-        __mod_update_bounds(mod->module_core, mod->core_size);
-        if (mod->init_size)
-                __mod_update_bounds(mod->module_init, mod->init_size);
+        __mod_update_bounds(mod->core_layout.base, mod->core_layout.size);
+        if (mod->init_layout.size)
+                __mod_update_bounds(mod->init_layout.base, mod->init_layout.size);
 }
 
 #ifdef CONFIG_KGDB_KDB
@@ -1214,7 +1190,7 @@ struct module_attribute module_uevent =
 static ssize_t show_coresize(struct module_attribute *mattr,
                              struct module_kobject *mk, char *buffer)
 {
-        return sprintf(buffer, "%u\n", mk->mod->core_size);
+        return sprintf(buffer, "%u\n", mk->mod->core_layout.size);
 }
 
 static struct module_attribute modinfo_coresize =
@@ -1223,7 +1199,7 @@ static struct module_attribute modinfo_coresize =
 static ssize_t show_initsize(struct module_attribute *mattr,
                              struct module_kobject *mk, char *buffer)
 {
-        return sprintf(buffer, "%u\n", mk->mod->init_size);
+        return sprintf(buffer, "%u\n", mk->mod->init_layout.size);
 }
 
 static struct module_attribute modinfo_initsize =
@@ -1873,64 +1849,75 @@ static void mod_sysfs_teardown(struct module *mod)
 /*
  * LKM RO/NX protection: protect module's text/ro-data
  * from modification and any data from execution.
+ *
+ * General layout of module is:
+ *          [text] [read-only-data] [writable data]
+ * text_size -----^                ^               ^
+ * ro_size ------------------------|               |
+ * size -------------------------------------------|
+ *
+ * These values are always page-aligned (as is base)
  */
-void set_page_attributes(void *start, void *end, int (*set)(unsigned long start, int num_pages))
+static void frob_text(const struct module_layout *layout,
+                      int (*set_memory)(unsigned long start, int num_pages))
 {
-        unsigned long begin_pfn = PFN_DOWN((unsigned long)start);
-        unsigned long end_pfn = PFN_DOWN((unsigned long)end);
+        BUG_ON((unsigned long)layout->base & (PAGE_SIZE-1));
+        BUG_ON((unsigned long)layout->text_size & (PAGE_SIZE-1));
+        set_memory((unsigned long)layout->base,
+                   layout->text_size >> PAGE_SHIFT);
+}
 
-        if (end_pfn > begin_pfn)
-                set(begin_pfn << PAGE_SHIFT, end_pfn - begin_pfn);
+static void frob_rodata(const struct module_layout *layout,
+                        int (*set_memory)(unsigned long start, int num_pages))
+{
+        BUG_ON((unsigned long)layout->base & (PAGE_SIZE-1));
+        BUG_ON((unsigned long)layout->text_size & (PAGE_SIZE-1));
+        BUG_ON((unsigned long)layout->ro_size & (PAGE_SIZE-1));
+        set_memory((unsigned long)layout->base + layout->text_size,
+                   (layout->ro_size - layout->text_size) >> PAGE_SHIFT);
 }
 
-static void set_section_ro_nx(void *base,
-                        unsigned long text_size,
-                        unsigned long ro_size,
-                        unsigned long total_size)
+static void frob_writable_data(const struct module_layout *layout,
+                               int (*set_memory)(unsigned long start, int num_pages))
 {
-        /* begin and end PFNs of the current subsection */
-        unsigned long begin_pfn;
-        unsigned long end_pfn;
+        BUG_ON((unsigned long)layout->base & (PAGE_SIZE-1));
+        BUG_ON((unsigned long)layout->ro_size & (PAGE_SIZE-1));
+        BUG_ON((unsigned long)layout->size & (PAGE_SIZE-1));
+        set_memory((unsigned long)layout->base + layout->ro_size,
+                   (layout->size - layout->ro_size) >> PAGE_SHIFT);
+}
 
-        /*
-         * Set RO for module text and RO-data:
-         * - Always protect first page.
-         * - Do not protect last partial page.
-         */
-        if (ro_size > 0)
-                set_page_attributes(base, base + ro_size, set_memory_ro);
+/* livepatching wants to disable read-only so it can frob module. */
+void module_disable_ro(const struct module *mod)
+{
+        frob_text(&mod->core_layout, set_memory_rw);
+        frob_rodata(&mod->core_layout, set_memory_rw);
+        frob_text(&mod->init_layout, set_memory_rw);
+        frob_rodata(&mod->init_layout, set_memory_rw);
+}
 
-        /*
-         * Set NX permissions for module data:
-         * - Do not protect first partial page.
-         * - Always protect last page.
-         */
-        if (total_size > text_size) {
-                begin_pfn = PFN_UP((unsigned long)base + text_size);
-                end_pfn = PFN_UP((unsigned long)base + total_size);
-                if (end_pfn > begin_pfn)
-                        set_memory_nx(begin_pfn << PAGE_SHIFT, end_pfn - begin_pfn);
-        }
+void module_enable_ro(const struct module *mod)
+{
+        frob_text(&mod->core_layout, set_memory_ro);
+        frob_rodata(&mod->core_layout, set_memory_ro);
+        frob_text(&mod->init_layout, set_memory_ro);
+        frob_rodata(&mod->init_layout, set_memory_ro);
 }
 
-static void unset_module_core_ro_nx(struct module *mod)
+static void module_enable_nx(const struct module *mod)
 {
-        set_page_attributes(mod->module_core + mod->core_text_size,
-                mod->module_core + mod->core_size,
-                set_memory_x);
-        set_page_attributes(mod->module_core,
-                mod->module_core + mod->core_ro_size,
-                set_memory_rw);
+        frob_rodata(&mod->core_layout, set_memory_nx);
+        frob_writable_data(&mod->core_layout, set_memory_nx);
+        frob_rodata(&mod->init_layout, set_memory_nx);
+        frob_writable_data(&mod->init_layout, set_memory_nx);
 }
 
-static void unset_module_init_ro_nx(struct module *mod)
+static void module_disable_nx(const struct module *mod)
 {
-        set_page_attributes(mod->module_init + mod->init_text_size,
-                mod->module_init + mod->init_size,
-                set_memory_x);
-        set_page_attributes(mod->module_init,
-                mod->module_init + mod->init_ro_size,
-                set_memory_rw);
+        frob_rodata(&mod->core_layout, set_memory_x);
+        frob_writable_data(&mod->core_layout, set_memory_x);
+        frob_rodata(&mod->init_layout, set_memory_x);
+        frob_writable_data(&mod->init_layout, set_memory_x);
 }
 
 /* Iterate through all modules and set each module's text as RW */
@@ -1942,16 +1929,9 @@ void set_all_modules_text_rw(void)
         list_for_each_entry_rcu(mod, &modules, list) {
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
-                if ((mod->module_core) && (mod->core_text_size)) {
-                        set_page_attributes(mod->module_core,
-                                                mod->module_core + mod->core_text_size,
-                                                set_memory_rw);
-                }
-                if ((mod->module_init) && (mod->init_text_size)) {
-                        set_page_attributes(mod->module_init,
-                                                mod->module_init + mod->init_text_size,
-                                                set_memory_rw);
-                }
+
+                frob_text(&mod->core_layout, set_memory_rw);
+                frob_text(&mod->init_layout, set_memory_rw);
         }
         mutex_unlock(&module_mutex);
 }
@@ -1965,23 +1945,25 @@ void set_all_modules_text_ro(void)
         list_for_each_entry_rcu(mod, &modules, list) {
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
-                if ((mod->module_core) && (mod->core_text_size)) {
-                        set_page_attributes(mod->module_core,
-                                                mod->module_core + mod->core_text_size,
-                                                set_memory_ro);
-                }
-                if ((mod->module_init) && (mod->init_text_size)) {
-                        set_page_attributes(mod->module_init,
-                                                mod->module_init + mod->init_text_size,
-                                                set_memory_ro);
-                }
+
+                frob_text(&mod->core_layout, set_memory_ro);
+                frob_text(&mod->init_layout, set_memory_ro);
         }
         mutex_unlock(&module_mutex);
 }
+
+static void disable_ro_nx(const struct module_layout *layout)
+{
+        frob_text(layout, set_memory_rw);
+        frob_rodata(layout, set_memory_rw);
+        frob_rodata(layout, set_memory_x);
+        frob_writable_data(layout, set_memory_x);
+}
+
 #else
-static inline void set_section_ro_nx(void *base, unsigned long text_size, unsigned long ro_size, unsigned long total_size) { }
-static void unset_module_core_ro_nx(struct module *mod) { }
-static void unset_module_init_ro_nx(struct module *mod) { }
+static void disable_ro_nx(const struct module_layout *layout) { }
+static void module_enable_nx(const struct module *mod) { }
+static void module_disable_nx(const struct module *mod) { }
 #endif
 
 void __weak module_memfree(void *module_region)
@@ -2033,19 +2015,19 @@ static void free_module(struct module *mod)
         synchronize_sched();
         mutex_unlock(&module_mutex);
 
-        /* This may be NULL, but that's OK */
-        unset_module_init_ro_nx(mod);
+        /* This may be empty, but that's OK */
+        disable_ro_nx(&mod->init_layout);
         module_arch_freeing_init(mod);
-        module_memfree(mod->module_init);
+        module_memfree(mod->init_layout.base);
         kfree(mod->args);
         percpu_modfree(mod);
 
         /* Free lock-classes; relies on the preceding sync_rcu(). */
-        lockdep_free_key_range(mod->module_core, mod->core_size);
+        lockdep_free_key_range(mod->core_layout.base, mod->core_layout.size);
 
         /* Finally, free the core (containing the module structure) */
-        unset_module_core_ro_nx(mod);
-        module_memfree(mod->module_core);
+        disable_ro_nx(&mod->core_layout);
+        module_memfree(mod->core_layout.base);
 
 #ifdef CONFIG_MPU
         update_protections(current->mm);
@@ -2248,20 +2230,20 @@ static void layout_sections(struct module *mod, struct load_info *info)
                             || s->sh_entsize != ~0UL
                             || strstarts(sname, ".init"))
                                 continue;
-                        s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
+                        s->sh_entsize = get_offset(mod, &mod->core_layout.size, s, i);
                         pr_debug("\t%s\n", sname);
                 }
                 switch (m) {
                 case 0: /* executable */
-                        mod->core_size = debug_align(mod->core_size);
-                        mod->core_text_size = mod->core_size;
+                        mod->core_layout.size = debug_align(mod->core_layout.size);
+                        mod->core_layout.text_size = mod->core_layout.size;
                         break;
                 case 1: /* RO: text and ro-data */
-                        mod->core_size = debug_align(mod->core_size);
-                        mod->core_ro_size = mod->core_size;
+                        mod->core_layout.size = debug_align(mod->core_layout.size);
+                        mod->core_layout.ro_size = mod->core_layout.size;
                         break;
                 case 3: /* whole core */
-                        mod->core_size = debug_align(mod->core_size);
+                        mod->core_layout.size = debug_align(mod->core_layout.size);
                         break;
                 }
         }
@@ -2277,21 +2259,21 @@ static void layout_sections(struct module *mod, struct load_info *info)
                             || s->sh_entsize != ~0UL
                             || !strstarts(sname, ".init"))
                                 continue;
-                        s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
+                        s->sh_entsize = (get_offset(mod, &mod->init_layout.size, s, i)
                                          | INIT_OFFSET_MASK);
                         pr_debug("\t%s\n", sname);
                 }
                 switch (m) {
                 case 0: /* executable */
-                        mod->init_size = debug_align(mod->init_size);
-                        mod->init_text_size = mod->init_size;
+                        mod->init_layout.size = debug_align(mod->init_layout.size);
+                        mod->init_layout.text_size = mod->init_layout.size;
                         break;
                 case 1: /* RO: text and ro-data */
-                        mod->init_size = debug_align(mod->init_size);
-                        mod->init_ro_size = mod->init_size;
+                        mod->init_layout.size = debug_align(mod->init_layout.size);
+                        mod->init_layout.ro_size = mod->init_layout.size;
                         break;
                 case 3: /* whole init */
-                        mod->init_size = debug_align(mod->init_size);
+                        mod->init_layout.size = debug_align(mod->init_layout.size);
                         break;
                 }
         }
@@ -2401,7 +2383,7 @@ static char elf_type(const Elf_Sym *sym, const struct load_info *info)
         }
         if (sym->st_shndx == SHN_UNDEF)
                 return 'U';
-        if (sym->st_shndx == SHN_ABS)
+        if (sym->st_shndx == SHN_ABS || sym->st_shndx == info->index.pcpu)
                 return 'a';
         if (sym->st_shndx >= SHN_LORESERVE)
                 return '?';
@@ -2430,7 +2412,7 @@ static char elf_type(const Elf_Sym *sym, const struct load_info *info)
 }
 
 static bool is_core_symbol(const Elf_Sym *src, const Elf_Shdr *sechdrs,
-                        unsigned int shnum)
+                        unsigned int shnum, unsigned int pcpundx)
 {
         const Elf_Shdr *sec;
 
@@ -2439,6 +2421,11 @@ static bool is_core_symbol(const Elf_Sym *src, const Elf_Shdr *sechdrs,
             || !src->st_name)
                 return false;
 
+#ifdef CONFIG_KALLSYMS_ALL
+        if (src->st_shndx == pcpundx)
+                return true;
+#endif
+
         sec = sechdrs + src->st_shndx;
         if (!(sec->sh_flags & SHF_ALLOC)
 #ifndef CONFIG_KALLSYMS_ALL
@@ -2466,7 +2453,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
 
         /* Put symbol section at end of init part of module. */
         symsect->sh_flags |= SHF_ALLOC;
-        symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
+        symsect->sh_entsize = get_offset(mod, &mod->init_layout.size, symsect,
                                          info->index.sym) | INIT_OFFSET_MASK;
         pr_debug("\t%s\n", info->secstrings + symsect->sh_name);
 
@@ -2476,23 +2463,24 @@ static void layout_symtab(struct module *mod, struct load_info *info)
         /* Compute total space required for the core symbols' strtab. */
         for (ndst = i = 0; i < nsrc; i++) {
                 if (i == 0 ||
-                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum,
+                                   info->index.pcpu)) {
                         strtab_size += strlen(&info->strtab[src[i].st_name])+1;
                         ndst++;
                 }
         }
 
         /* Append room for core symbols at end of core part. */
-        info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
-        info->stroffs = mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
-        mod->core_size += strtab_size;
-        mod->core_size = debug_align(mod->core_size);
+        info->symoffs = ALIGN(mod->core_layout.size, symsect->sh_addralign ?: 1);
+        info->stroffs = mod->core_layout.size = info->symoffs + ndst * sizeof(Elf_Sym);
+        mod->core_layout.size += strtab_size;
+        mod->core_layout.size = debug_align(mod->core_layout.size);
 
         /* Put string table section at end of init part of module. */
         strsect->sh_flags |= SHF_ALLOC;
-        strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
+        strsect->sh_entsize = get_offset(mod, &mod->init_layout.size, strsect,
                                          info->index.str) | INIT_OFFSET_MASK;
-        mod->init_size = debug_align(mod->init_size);
+        mod->init_layout.size = debug_align(mod->init_layout.size);
         pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
 }
 
@@ -2513,12 +2501,13 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
         for (i = 0; i < mod->num_symtab; i++)
                 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
 
-        mod->core_symtab = dst = mod->module_core + info->symoffs;
-        mod->core_strtab = s = mod->module_core + info->stroffs;
+        mod->core_symtab = dst = mod->core_layout.base + info->symoffs;
+        mod->core_strtab = s = mod->core_layout.base + info->stroffs;
         src = mod->symtab;
         for (ndst = i = 0; i < mod->num_symtab; i++) {
                 if (i == 0 ||
-                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) {
+                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum,
+                                   info->index.pcpu)) {
                         dst[ndst] = src[i];
                         dst[ndst++].st_name = s - mod->core_strtab;
                         s += strlcpy(s, &mod->strtab[src[i].st_name],
@@ -2964,7 +2953,7 @@ static int move_module(struct module *mod, struct load_info *info)
         void *ptr;
 
         /* Do the allocs. */
-        ptr = module_alloc(mod->core_size);
+        ptr = module_alloc(mod->core_layout.size);
         /*
          * The pointer to this block is stored in the module structure
          * which is inside the block. Just mark it as not being a
@@ -2974,11 +2963,11 @@ static int move_module(struct module *mod, struct load_info *info)
         if (!ptr)
                 return -ENOMEM;
 
-        memset(ptr, 0, mod->core_size);
-        mod->module_core = ptr;
+        memset(ptr, 0, mod->core_layout.size);
+        mod->core_layout.base = ptr;
 
-        if (mod->init_size) {
-                ptr = module_alloc(mod->init_size);
+        if (mod->init_layout.size) {
+                ptr = module_alloc(mod->init_layout.size);
                 /*
                  * The pointer to this block is stored in the module structure
                  * which is inside the block. This block doesn't need to be
@@ -2987,13 +2976,13 @@ static int move_module(struct module *mod, struct load_info *info)
                  */
                 kmemleak_ignore(ptr);
                 if (!ptr) {
-                        module_memfree(mod->module_core);
+                        module_memfree(mod->core_layout.base);
                         return -ENOMEM;
                 }
-                memset(ptr, 0, mod->init_size);
-                mod->module_init = ptr;
+                memset(ptr, 0, mod->init_layout.size);
+                mod->init_layout.base = ptr;
         } else
-                mod->module_init = NULL;
+                mod->init_layout.base = NULL;
 
         /* Transfer each section which specifies SHF_ALLOC */
         pr_debug("final section addresses:\n");
@@ -3005,10 +2994,10 @@ static int move_module(struct module *mod, struct load_info *info)
                         continue;
 
                 if (shdr->sh_entsize & INIT_OFFSET_MASK)
-                        dest = mod->module_init
+                        dest = mod->init_layout.base
                                 + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
                 else
-                        dest = mod->module_core + shdr->sh_entsize;
+                        dest = mod->core_layout.base + shdr->sh_entsize;
 
                 if (shdr->sh_type != SHT_NOBITS)
                         memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
@@ -3070,12 +3059,12 @@ static void flush_module_icache(const struct module *mod)
          * Do it before processing of module parameters, so the module
          * can provide parameter accessor functions of its own.
          */
-        if (mod->module_init)
-                flush_icache_range((unsigned long)mod->module_init,
-                                   (unsigned long)mod->module_init
-                                   + mod->init_size);
-        flush_icache_range((unsigned long)mod->module_core,
-                           (unsigned long)mod->module_core + mod->core_size);
+        if (mod->init_layout.base)
+                flush_icache_range((unsigned long)mod->init_layout.base,
+                                   (unsigned long)mod->init_layout.base
+                                   + mod->init_layout.size);
+        flush_icache_range((unsigned long)mod->core_layout.base,
+                           (unsigned long)mod->core_layout.base + mod->core_layout.size);
 
         set_fs(old_fs);
 }
@@ -3133,8 +3122,8 @@ static void module_deallocate(struct module *mod, struct load_info *info)
 {
         percpu_modfree(mod);
         module_arch_freeing_init(mod);
-        module_memfree(mod->module_init);
-        module_memfree(mod->module_core);
+        module_memfree(mod->init_layout.base);
+        module_memfree(mod->core_layout.base);
 }
 
 int __weak module_finalize(const Elf_Ehdr *hdr,
@@ -3221,7 +3210,7 @@ static noinline int do_init_module(struct module *mod)
                 ret = -ENOMEM;
                 goto fail;
         }
-        freeinit->module_init = mod->module_init;
+        freeinit->module_init = mod->init_layout.base;
 
         /*
          * We want to find out whether @mod uses async during init.  Clear
@@ -3279,12 +3268,12 @@ static noinline int do_init_module(struct module *mod)
         mod->strtab = mod->core_strtab;
 #endif
         mod_tree_remove_init(mod);
-        unset_module_init_ro_nx(mod);
+        disable_ro_nx(&mod->init_layout);
         module_arch_freeing_init(mod);
-        mod->module_init = NULL;
-        mod->init_size = 0;
-        mod->init_ro_size = 0;
-        mod->init_text_size = 0;
+        mod->init_layout.base = NULL;
+        mod->init_layout.size = 0;
+        mod->init_layout.ro_size = 0;
+        mod->init_layout.text_size = 0;
         /*
          * We want to free module_init, but be aware that kallsyms may be
          * walking this with preempt disabled.  In all the failure paths, we
@@ -3373,17 +3362,9 @@ static int complete_formation(struct module *mod, struct load_info *info)
         /* This relies on module_mutex for list integrity. */
         module_bug_finalize(info->hdr, info->sechdrs, mod);
 
-        /* Set RO and NX regions for core */
-        set_section_ro_nx(mod->module_core,
-                                mod->core_text_size,
-                                mod->core_ro_size,
-                                mod->core_size);
-
-        /* Set RO and NX regions for init */
-        set_section_ro_nx(mod->module_init,
-                                mod->init_text_size,
-                                mod->init_ro_size,
-                                mod->init_size);
+        /* Set RO and NX regions */
+        module_enable_ro(mod);
+        module_enable_nx(mod);
 
         /* Mark state as coming so strong_try_module_get() ignores us,
          * but kallsyms etc. can see us. */
@@ -3548,8 +3529,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
                                      MODULE_STATE_GOING, mod);
 
         /* we can't deallocate the module until we clear memory protection */
-        unset_module_init_ro_nx(mod);
-        unset_module_core_ro_nx(mod);
+        module_disable_ro(mod);
+        module_disable_nx(mod);
 
  ddebug_cleanup:
         dynamic_debug_remove(info->debug);
@@ -3572,7 +3553,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
         mutex_unlock(&module_mutex);
  free_module:
         /* Free lock-classes; relies on the preceding sync_rcu() */
-        lockdep_free_key_range(mod->module_core, mod->core_size);
+        lockdep_free_key_range(mod->core_layout.base, mod->core_layout.size);
 
         module_deallocate(mod, info);
  free_copy:
@@ -3650,9 +3631,9 @@ static const char *get_ksymbol(struct module *mod,
 
         /* At worse, next value is at end of module */
         if (within_module_init(addr, mod))
-                nextval = (unsigned long)mod->module_init+mod->init_text_size;
+                nextval = (unsigned long)mod->init_layout.base+mod->init_layout.text_size;
         else
-                nextval = (unsigned long)mod->module_core+mod->core_text_size;
+                nextval = (unsigned long)mod->core_layout.base+mod->core_layout.text_size;
 
         /* Scan for closest preceding symbol, and next symbol. (ELF
            starts real symbols at 1). */
@@ -3899,7 +3880,7 @@ static int m_show(struct seq_file *m, void *p)
                 return 0;
 
         seq_printf(m, "%s %u",
-                   mod->name, mod->init_size + mod->core_size);
+                   mod->name, mod->init_layout.size + mod->core_layout.size);
         print_unload_info(m, mod);
 
         /* Informative for users. */
@@ -3908,7 +3889,7 @@ static int m_show(struct seq_file *m, void *p)
                    mod->state == MODULE_STATE_COMING ? "Loading" :
                    "Live");
         /* Used by oprofile and other similar tools. */
-        seq_printf(m, " 0x%pK", mod->module_core);
+        seq_printf(m, " 0x%pK", mod->core_layout.base);
 
         /* Taints info */
         if (mod->taints)
@@ -4051,8 +4032,8 @@ struct module *__module_text_address(unsigned long addr)
         struct module *mod = __module_address(addr);
         if (mod) {
                 /* Make sure it's within the text section. */
-                if (!within(addr, mod->module_init, mod->init_text_size)
-                    && !within(addr, mod->module_core, mod->core_text_size))
+                if (!within(addr, mod->init_layout.base, mod->init_layout.text_size)
+                    && !within(addr, mod->core_layout.base, mod->core_layout.text_size))
                         mod = NULL;
         }
         return mod;
diff --git a/kernel/panic.c b/kernel/panic.c
index 4579dbb7ed87..4b150bc0c6c1 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -152,8 +152,11 @@ void panic(const char *fmt, ...)
          * We may have ended up stopping the CPU holding the lock (in
          * smp_send_stop()) while still having some valuable data in the console
          * buffer.  Try to acquire the lock then release it regardless of the
-         * result.  The release will also print the buffers out.
+         * result.  The release will also print the buffers out.  Locks debug
+         * should be disabled to avoid reporting bad unlock balance when
+         * panic() is not being callled from OOPS.
          */
+        debug_locks_off();
         console_trylock();
         console_unlock();
 
diff --git a/kernel/pid.c b/kernel/pid.c
index ca368793808e..78b3d9f80d44 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -467,7 +467,7 @@ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
         rcu_read_lock();
         if (type != PIDTYPE_PID)
                 task = task->group_leader;
-        pid = get_pid(task->pids[type].pid);
+        pid = get_pid(rcu_dereference(task->pids[type].pid));
         rcu_read_unlock();
         return pid;
 }
@@ -528,7 +528,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
         if (likely(pid_alive(task))) {
                 if (type != PIDTYPE_PID)
                         task = task->group_leader;
-                nr = pid_nr_ns(task->pids[type].pid, ns);
+                nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
         }
         rcu_read_unlock();
 
diff --git a/kernel/signal.c b/kernel/signal.c
index c0b01fe24bbd..f3f1f7a972fd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3503,7 +3503,7 @@ SYSCALL_DEFINE0(pause)
 
 #endif
 
-int sigsuspend(sigset_t *set)
+static int sigsuspend(sigset_t *set)
 {
         current->saved_sigmask = current->blocked;
         set_current_blocked(set);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c29ddebc8705..62fe06bb7d04 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2009,7 +2009,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
+                if (*vm_flags & VM_NO_THP)
                         return -EINVAL;
                 *vm_flags &= ~VM_NOHUGEPAGE;
                 *vm_flags |= VM_HUGEPAGE;
@@ -2025,7 +2025,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
+                if (*vm_flags & VM_NO_THP)
                         return -EINVAL;
                 *vm_flags &= ~VM_HUGEPAGE;
                 *vm_flags |= VM_NOHUGEPAGE;
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index d41b21bce6a0..bc0a8d8b8f42 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -19,6 +19,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/kmemleak.h>
 #include <linux/memblock.h>
 #include <linux/memory.h>
 #include <linux/mm.h>
@@ -444,6 +445,7 @@ int kasan_module_alloc(void *addr, size_t size)
 
         if (ret) {
                 find_vm_area(addr)->flags |= VM_KASAN;
+                kmemleak_ignore(ret);
                 return 0;
         }
 
diff --git a/mm/memory.c b/mm/memory.c
index deb679c31f2a..c387430f06c3 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3015,9 +3015,9 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 } else {
                         /*
                          * The fault handler has no page to lock, so it holds
-                         * i_mmap_lock for write to protect against truncate.
+                         * i_mmap_lock for read to protect against truncate.
                          */
-                        i_mmap_unlock_write(vma->vm_file->f_mapping);
+                        i_mmap_unlock_read(vma->vm_file->f_mapping);
                 }
                 goto uncharge_out;
         }
@@ -3031,9 +3031,9 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         } else {
                 /*
                  * The fault handler has no page to lock, so it holds
-                 * i_mmap_lock for write to protect against truncate.
+                 * i_mmap_lock for read to protect against truncate.
                  */
-                i_mmap_unlock_write(vma->vm_file->f_mapping);
+                i_mmap_unlock_read(vma->vm_file->f_mapping);
         }
         return ret;
 uncharge_out:
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 2c90357c34ea..3e4d65445fa7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1542,7 +1542,9 @@ static void balance_dirty_pages(struct address_space *mapping,
         for (;;) {
                 unsigned long now = jiffies;
                 unsigned long dirty, thresh, bg_thresh;
-                unsigned long m_dirty, m_thresh, m_bg_thresh;
+                unsigned long m_dirty = 0;      /* stop bogus uninit warnings */
+                unsigned long m_thresh = 0;
+                unsigned long m_bg_thresh = 0;
 
                 /*
                  * Unstable writes are a feature of certain networked
diff --git a/mm/slab.c b/mm/slab.c
index e0819fa96559..4765c97ce690 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3419,7 +3419,7 @@ void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                                                                 void **p)
 {
         return __kmem_cache_alloc_bulk(s, flags, size, p);
diff --git a/mm/slab.h b/mm/slab.h
index 27492eb678f7..7b6087197997 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -170,7 +170,7 @@ ssize_t slabinfo_write(struct file *file, const char __user *buffer,
  * may be allocated or freed using these operations.
  */
 void __kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
-bool __kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
+int __kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
 
 #ifdef CONFIG_MEMCG_KMEM
 /*
diff --git a/mm/slab_common.c b/mm/slab_common.c
index d88e97c10a2e..3c6a86b4ec25 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -112,7 +112,7 @@ void __kmem_cache_free_bulk(struct kmem_cache *s, size_t nr, void **p)
                 kmem_cache_free(s, p[i]);
 }
 
-bool __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
+int __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
                                                                 void **p)
 {
         size_t i;
@@ -121,10 +121,10 @@ bool __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
                 void *x = p[i] = kmem_cache_alloc(s, flags);
                 if (!x) {
                         __kmem_cache_free_bulk(s, i, p);
-                        return false;
+                        return 0;
                 }
         }
-        return true;
+        return i;
 }
 
 #ifdef CONFIG_MEMCG_KMEM
diff --git a/mm/slob.c b/mm/slob.c
index 0d7e5df74d1f..17e8f8cc7c53 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -617,7 +617,7 @@ void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                                                                 void **p)
 {
         return __kmem_cache_alloc_bulk(s, flags, size, p);
diff --git a/mm/slub.c b/mm/slub.c
index 7cb4bf9ae320..46997517406e 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1065,11 +1065,15 @@ bad:
         return 0;
 }
 
+/* Supports checking bulk free of a constructed freelist */
 static noinline struct kmem_cache_node *free_debug_processing(
-        struct kmem_cache *s, struct page *page, void *object,
+        struct kmem_cache *s, struct page *page,
+        void *head, void *tail, int bulk_cnt,
         unsigned long addr, unsigned long *flags)
 {
         struct kmem_cache_node *n = get_node(s, page_to_nid(page));
+        void *object = head;
+        int cnt = 0;
 
         spin_lock_irqsave(&n->list_lock, *flags);
         slab_lock(page);
@@ -1077,6 +1081,9 @@ static noinline struct kmem_cache_node *free_debug_processing(
         if (!check_slab(s, page))
                 goto fail;
 
+next_object:
+        cnt++;
+
         if (!check_valid_pointer(s, page, object)) {
                 slab_err(s, page, "Invalid object pointer 0x%p", object);
                 goto fail;
@@ -1107,8 +1114,19 @@ static noinline struct kmem_cache_node *free_debug_processing(
         if (s->flags & SLAB_STORE_USER)
                 set_track(s, object, TRACK_FREE, addr);
         trace(s, page, object, 0);
+        /* Freepointer not overwritten by init_object(), SLAB_POISON moved it */
         init_object(s, object, SLUB_RED_INACTIVE);
+
+        /* Reached end of constructed freelist yet? */
+        if (object != tail) {
+                object = get_freepointer(s, object);
+                goto next_object;
+        }
 out:
+        if (cnt != bulk_cnt)
+                slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
+                         bulk_cnt, cnt);
+
         slab_unlock(page);
         /*
          * Keep node_lock to preserve integrity
@@ -1204,7 +1222,7 @@ unsigned long kmem_cache_flags(unsigned long object_size,
 
         return flags;
 }
-#else
+#else /* !CONFIG_SLUB_DEBUG */
 static inline void setup_object_debug(struct kmem_cache *s,
                         struct page *page, void *object) {}
 
@@ -1212,7 +1230,8 @@ static inline int alloc_debug_processing(struct kmem_cache *s,
         struct page *page, void *object, unsigned long addr) { return 0; }
 
 static inline struct kmem_cache_node *free_debug_processing(
-        struct kmem_cache *s, struct page *page, void *object,
+        struct kmem_cache *s, struct page *page,
+        void *head, void *tail, int bulk_cnt,
         unsigned long addr, unsigned long *flags) { return NULL; }
 
 static inline int slab_pad_check(struct kmem_cache *s, struct page *page)
@@ -1273,14 +1292,21 @@ static inline struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s,
         return memcg_kmem_get_cache(s, flags);
 }
 
-static inline void slab_post_alloc_hook(struct kmem_cache *s,
-                                        gfp_t flags, void *object)
+static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
+                                        size_t size, void **p)
 {
+        size_t i;
+
         flags &= gfp_allowed_mask;
-        kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
-        kmemleak_alloc_recursive(object, s->object_size, 1, s->flags, flags);
+        for (i = 0; i < size; i++) {
+                void *object = p[i];
+
+                kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
+                kmemleak_alloc_recursive(object, s->object_size, 1,
+                                         s->flags, flags);
+                kasan_slab_alloc(s, object);
+        }
         memcg_kmem_put_cache(s);
-        kasan_slab_alloc(s, object);
 }
 
 static inline void slab_free_hook(struct kmem_cache *s, void *x)
@@ -1308,6 +1334,29 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
         kasan_slab_free(s, x);
 }
 
+static inline void slab_free_freelist_hook(struct kmem_cache *s,
+                                           void *head, void *tail)
+{
+/*
+ * Compiler cannot detect this function can be removed if slab_free_hook()
+ * evaluates to nothing.  Thus, catch all relevant config debug options here.
+ */
+#if defined(CONFIG_KMEMCHECK) ||                \
+        defined(CONFIG_LOCKDEP) ||              \
+        defined(CONFIG_DEBUG_KMEMLEAK) ||       \
+        defined(CONFIG_DEBUG_OBJECTS_FREE) ||   \
+        defined(CONFIG_KASAN)
+
+        void *object = head;
+        void *tail_obj = tail ? : head;
+
+        do {
+                slab_free_hook(s, object);
+        } while ((object != tail_obj) &&
+                 (object = get_freepointer(s, object)));
+#endif
+}
+
 static void setup_object(struct kmem_cache *s, struct page *page,
                                 void *object)
 {
@@ -2295,23 +2344,15 @@ static inline void *get_freelist(struct kmem_cache *s, struct page *page)
  * And if we were unable to get a new slab from the partial slab lists then
  * we need to allocate a new slab. This is the slowest path since it involves
  * a call to the page allocator and the setup of a new slab.
+ *
+ * Version of __slab_alloc to use when we know that interrupts are
+ * already disabled (which is the case for bulk allocation).
  */
-static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
                           unsigned long addr, struct kmem_cache_cpu *c)
 {
         void *freelist;
         struct page *page;
-        unsigned long flags;
-
-        local_irq_save(flags);
-#ifdef CONFIG_PREEMPT
-        /*
-         * We may have been preempted and rescheduled on a different
-         * cpu before disabling interrupts. Need to reload cpu area
-         * pointer.
-         */
-        c = this_cpu_ptr(s->cpu_slab);
-#endif
 
         page = c->page;
         if (!page)
@@ -2369,7 +2410,6 @@ load_freelist:
         VM_BUG_ON(!c->page->frozen);
         c->freelist = get_freepointer(s, freelist);
         c->tid = next_tid(c->tid);
-        local_irq_restore(flags);
         return freelist;
 
 new_slab:
@@ -2386,7 +2426,6 @@ new_slab:
 
         if (unlikely(!freelist)) {
                 slab_out_of_memory(s, gfpflags, node);
-                local_irq_restore(flags);
                 return NULL;
         }
 
@@ -2402,11 +2441,35 @@ new_slab:
         deactivate_slab(s, page, get_freepointer(s, freelist));
         c->page = NULL;
         c->freelist = NULL;
-        local_irq_restore(flags);
         return freelist;
 }
 
 /*
+ * Another one that disabled interrupt and compensates for possible
+ * cpu changes by refetching the per cpu area pointer.
+ */
+static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+                          unsigned long addr, struct kmem_cache_cpu *c)
+{
+        void *p;
+        unsigned long flags;
+
+        local_irq_save(flags);
+#ifdef CONFIG_PREEMPT
+        /*
+         * We may have been preempted and rescheduled on a different
+         * cpu before disabling interrupts. Need to reload cpu area
+         * pointer.
+         */
+        c = this_cpu_ptr(s->cpu_slab);
+#endif
+
+        p = ___slab_alloc(s, gfpflags, node, addr, c);
+        local_irq_restore(flags);
+        return p;
+}
+
+/*
  * Inlined fastpath so that allocation functions (kmalloc, kmem_cache_alloc)
  * have the fastpath folded into their functions. So no function call
  * overhead for requests that can be satisfied on the fastpath.
@@ -2419,7 +2482,7 @@ new_slab:
 static __always_inline void *slab_alloc_node(struct kmem_cache *s,
                 gfp_t gfpflags, int node, unsigned long addr)
 {
-        void **object;
+        void *object;
         struct kmem_cache_cpu *c;
         struct page *page;
         unsigned long tid;
@@ -2498,7 +2561,7 @@ redo:
         if (unlikely(gfpflags & __GFP_ZERO) && object)
                 memset(object, 0, s->object_size);
 
-        slab_post_alloc_hook(s, gfpflags, object);
+        slab_post_alloc_hook(s, gfpflags, 1, &object);
 
         return object;
 }
@@ -2569,10 +2632,11 @@ EXPORT_SYMBOL(kmem_cache_alloc_node_trace);
  * handling required then we can return immediately.
  */
 static void __slab_free(struct kmem_cache *s, struct page *page,
-                        void *x, unsigned long addr)
+                        void *head, void *tail, int cnt,
+                        unsigned long addr)
+
 {
         void *prior;
-        void **object = (void *)x;
         int was_frozen;
         struct page new;
         unsigned long counters;
@@ -2582,7 +2646,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
         stat(s, FREE_SLOWPATH);
 
         if (kmem_cache_debug(s) &&
-                !(n = free_debug_processing(s, page, x, addr, &flags)))
+            !(n = free_debug_processing(s, page, head, tail, cnt,
+                                        addr, &flags)))
                 return;
 
         do {
@@ -2592,10 +2657,10 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
                 }
                 prior = page->freelist;
                 counters = page->counters;
-                set_freepointer(s, object, prior);
+                set_freepointer(s, tail, prior);
                 new.counters = counters;
                 was_frozen = new.frozen;
-                new.inuse--;
+                new.inuse -= cnt;
                 if ((!new.inuse || !prior) && !was_frozen) {
 
                         if (kmem_cache_has_cpu_partial(s) && !prior) {
@@ -2626,7 +2691,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
 
         } while (!cmpxchg_double_slab(s, page,
                 prior, counters,
-                object, new.counters,
+                head, new.counters,
                 "__slab_free"));
 
         if (likely(!n)) {
@@ -2691,15 +2756,20 @@ slab_empty:
  *
  * If fastpath is not possible then fall back to __slab_free where we deal
  * with all sorts of special processing.
+ *
+ * Bulk free of a freelist with several objects (all pointing to the
+ * same page) possible by specifying head and tail ptr, plus objects
+ * count (cnt). Bulk free indicated by tail pointer being set.
  */
-static __always_inline void slab_free(struct kmem_cache *s,
-                        struct page *page, void *x, unsigned long addr)
+static __always_inline void slab_free(struct kmem_cache *s, struct page *page,
+                                      void *head, void *tail, int cnt,
+                                      unsigned long addr)
 {
-        void **object = (void *)x;
+        void *tail_obj = tail ? : head;
         struct kmem_cache_cpu *c;
         unsigned long tid;
 
-        slab_free_hook(s, x);
+        slab_free_freelist_hook(s, head, tail);
 
 redo:
         /*
@@ -2718,19 +2788,19 @@ redo:
         barrier();
 
         if (likely(page == c->page)) {
-                set_freepointer(s, object, c->freelist);
+                set_freepointer(s, tail_obj, c->freelist);
 
                 if (unlikely(!this_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 c->freelist, tid,
-                                object, next_tid(tid)))) {
+                                head, next_tid(tid)))) {
 
                         note_cmpxchg_failure("slab_free", s, tid);
                         goto redo;
                 }
                 stat(s, FREE_FASTPATH);
         } else
-                __slab_free(s, page, x, addr);
+                __slab_free(s, page, head, tail_obj, cnt, addr);
 
 }
 
@@ -2739,59 +2809,116 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
         s = cache_from_obj(s, x);
         if (!s)
                 return;
-        slab_free(s, virt_to_head_page(x), x, _RET_IP_);
+        slab_free(s, virt_to_head_page(x), x, NULL, 1, _RET_IP_);
         trace_kmem_cache_free(_RET_IP_, x);
 }
 EXPORT_SYMBOL(kmem_cache_free);
 
-/* Note that interrupts must be enabled when calling this function. */
-void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
-{
-        struct kmem_cache_cpu *c;
+struct detached_freelist {
         struct page *page;
-        int i;
+        void *tail;
+        void *freelist;
+        int cnt;
+};
 
-        local_irq_disable();
-        c = this_cpu_ptr(s->cpu_slab);
+/*
+ * This function progressively scans the array with free objects (with
+ * a limited look ahead) and extract objects belonging to the same
+ * page.  It builds a detached freelist directly within the given
+ * page/objects.  This can happen without any need for
+ * synchronization, because the objects are owned by running process.
+ * The freelist is build up as a single linked list in the objects.
+ * The idea is, that this detached freelist can then be bulk
+ * transferred to the real freelist(s), but only requiring a single
+ * synchronization primitive.  Look ahead in the array is limited due
+ * to performance reasons.
+ */
+static int build_detached_freelist(struct kmem_cache *s, size_t size,
+                                   void **p, struct detached_freelist *df)
+{
+        size_t first_skipped_index = 0;
+        int lookahead = 3;
+        void *object;
 
-        for (i = 0; i < size; i++) {
-                void *object = p[i];
+        /* Always re-init detached_freelist */
+        df->page = NULL;
 
-                BUG_ON(!object);
-                /* kmem cache debug support */
-                s = cache_from_obj(s, object);
-                if (unlikely(!s))
-                        goto exit;
-                slab_free_hook(s, object);
+        do {
+                object = p[--size];
+        } while (!object && size);
 
-                page = virt_to_head_page(object);
+        if (!object)
+                return 0;
 
-                if (c->page == page) {
-                        /* Fastpath: local CPU free */
-                        set_freepointer(s, object, c->freelist);
-                        c->freelist = object;
-                } else {
-                        c->tid = next_tid(c->tid);
-                        local_irq_enable();
-                        /* Slowpath: overhead locked cmpxchg_double_slab */
-                        __slab_free(s, page, object, _RET_IP_);
-                        local_irq_disable();
-                        c = this_cpu_ptr(s->cpu_slab);
+        /* Start new detached freelist */
+        set_freepointer(s, object, NULL);
+        df->page = virt_to_head_page(object);
+        df->tail = object;
+        df->freelist = object;
+        p[size] = NULL; /* mark object processed */
+        df->cnt = 1;
+
+        while (size) {
+                object = p[--size];
+                if (!object)
+                        continue; /* Skip processed objects */
+
+                /* df->page is always set at this point */
+                if (df->page == virt_to_head_page(object)) {
+                        /* Opportunity build freelist */
+                        set_freepointer(s, object, df->freelist);
+                        df->freelist = object;
+                        df->cnt++;
+                        p[size] = NULL; /* mark object processed */
+
+                        continue;
                 }
+
+                /* Limit look ahead search */
+                if (!--lookahead)
+                        break;
+
+                if (!first_skipped_index)
+                        first_skipped_index = size + 1;
         }
-exit:
-        c->tid = next_tid(c->tid);
-        local_irq_enable();
+
+        return first_skipped_index;
+}
+
+
+/* Note that interrupts must be enabled when calling this function. */
+void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p)
+{
+        if (WARN_ON(!size))
+                return;
+
+        do {
+                struct detached_freelist df;
+                struct kmem_cache *s;
+
+                /* Support for memcg */
+                s = cache_from_obj(orig_s, p[size - 1]);
+
+                size = build_detached_freelist(s, size, p, &df);
+                if (unlikely(!df.page))
+                        continue;
+
+                slab_free(s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_);
+        } while (likely(size));
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
 /* Note that interrupts must be enabled when calling this function. */
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
-                           void **p)
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+                          void **p)
 {
         struct kmem_cache_cpu *c;
         int i;
 
+        /* memcg and kmem_cache debug support */
+        s = slab_pre_alloc_hook(s, flags);
+        if (unlikely(!s))
+                return false;
         /*
          * Drain objects in the per cpu slab, while disabling local
          * IRQs, which protects against PREEMPT and interrupts
@@ -2804,36 +2931,20 @@ bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                 void *object = c->freelist;
 
                 if (unlikely(!object)) {
-                        local_irq_enable();
                         /*
                          * Invoking slow path likely have side-effect
                          * of re-populating per CPU c->freelist
                          */
-                        p[i] = __slab_alloc(s, flags, NUMA_NO_NODE,
+                        p[i] = ___slab_alloc(s, flags, NUMA_NO_NODE,
                                             _RET_IP_, c);
-                        if (unlikely(!p[i])) {
-                                __kmem_cache_free_bulk(s, i, p);
-                                return false;
-                        }
-                        local_irq_disable();
+                        if (unlikely(!p[i]))
+                                goto error;
+
                         c = this_cpu_ptr(s->cpu_slab);
                         continue; /* goto for-loop */
                 }
-
-                /* kmem_cache debug support */
-                s = slab_pre_alloc_hook(s, flags);
-                if (unlikely(!s)) {
-                        __kmem_cache_free_bulk(s, i, p);
-                        c->tid = next_tid(c->tid);
-                        local_irq_enable();
-                        return false;
-                }
-
                 c->freelist = get_freepointer(s, object);
                 p[i] = object;
-
-                /* kmem_cache debug support */
-                slab_post_alloc_hook(s, flags, object);
         }
         c->tid = next_tid(c->tid);
         local_irq_enable();
@@ -2846,7 +2957,14 @@ bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                         memset(p[j], 0, s->object_size);
         }
 
-        return true;
+        /* memcg and kmem_cache debug support */
+        slab_post_alloc_hook(s, flags, size, p);
+        return i;
+error:
+        local_irq_enable();
+        slab_post_alloc_hook(s, flags, i, p);
+        __kmem_cache_free_bulk(s, i, p);
+        return 0;
 }
 EXPORT_SYMBOL(kmem_cache_alloc_bulk);
 
@@ -3511,7 +3629,7 @@ void kfree(const void *x)
                 __free_kmem_pages(page, compound_order(page));
                 return;
         }
-        slab_free(page->slab_cache, page, object, _RET_IP_);
+        slab_free(page->slab_cache, page, object, NULL, 1, _RET_IP_);
 }
 EXPORT_SYMBOL(kfree);
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index d04563480c94..8e3c9c5a3042 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1443,7 +1443,6 @@ struct vm_struct *remove_vm_area(const void *addr)
                 vmap_debug_free_range(va->va_start, va->va_end);
                 kasan_free_shadow(vm);
                 free_unmap_vmap_area(va);
-                vm->size -= PAGE_SIZE;
 
                 return vm;
         }
@@ -1468,8 +1467,8 @@ static void __vunmap(const void *addr, int deallocate_pages)
                 return;
         }
 
-        debug_check_no_locks_freed(addr, area->size);
-        debug_check_no_obj_freed(addr, area->size);
+        debug_check_no_locks_freed(addr, get_vm_area_size(area));
+        debug_check_no_obj_freed(addr, get_vm_area_size(area));
 
         if (deallocate_pages) {
                 int i;
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 125b906cd1d4..638a38e1b419 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -2711,7 +2711,7 @@ $kernelversion = get_kernel_version();
 
 # generate a sequence of code that will splice in highlighting information
 # using the s// operator.
-foreach my $k (keys @highlights) {
+for (my $k = 0; $k < @highlights; $k++) {
     my $pattern = $highlights[$k][0];
     my $result = $highlights[$k][1];
 #   print STDERR "scanning pattern:$pattern, highlight:($result)\n";
diff --git a/tools/Makefile b/tools/Makefile
index d6f307dfb1a3..7dc820a8c1f1 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -32,6 +32,10 @@ help:
         @echo '  from the kernel command line to build and install one of'
         @echo '  the tools above'
         @echo ''
+        @echo '  $$ make tools/all'
+        @echo ''
+        @echo '  builds all tools.'
+        @echo ''
         @echo '  $$ make tools/install'
         @echo ''
         @echo '  installs all tools.'
@@ -77,6 +81,11 @@ tmon: FORCE
 freefall: FORCE
         $(call descend,laptop/$@)
 
+all: acpi cgroup cpupower hv firewire lguest \
+                perf selftests turbostat usb \
+                virtio vm net x86_energy_perf_policy \
+                tmon freefall
+
 acpi_install:
         $(call descend,power/$(@:_install=),install)
 
@@ -101,7 +110,7 @@ freefall_install:
 install: acpi_install cgroup_install cpupower_install hv_install firewire_install lguest_install \
                 perf_install selftests_install turbostat_install usb_install \
                 virtio_install vm_install net_install x86_energy_perf_policy_install \
-                tmon freefall_install
+                tmon_install freefall_install
 
 acpi_clean:
         $(call descend,power/acpi,clean)
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 0a945d2e8ca5..99d127fe9c35 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -675,6 +675,7 @@ int cmd_inject(int argc, const char **argv, const char *prefix __maybe_unused)
                         .fork           = perf_event__repipe,
                         .exit           = perf_event__repipe,
                         .lost           = perf_event__repipe,
+                        .lost_samples   = perf_event__repipe,
                         .aux            = perf_event__repipe,
                         .itrace_start   = perf_event__repipe,
                         .context_switch = perf_event__repipe,
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 2853ad2bd435..f256fac1e722 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -44,7 +44,7 @@
 struct report {
         struct perf_tool        tool;
         struct perf_session     *session;
-        bool                    force, use_tui, use_gtk, use_stdio;
+        bool                    use_tui, use_gtk, use_stdio;
         bool                    hide_unresolved;
         bool                    dont_use_callchains;
         bool                    show_full_info;
@@ -678,7 +678,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
                    "file", "vmlinux pathname"),
         OPT_STRING(0, "kallsyms", &symbol_conf.kallsyms_name,
                    "file", "kallsyms pathname"),
-        OPT_BOOLEAN('f', "force", &report.force, "don't complain, do it"),
+        OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
         OPT_BOOLEAN('m', "modules", &symbol_conf.use_modules,
                     "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
@@ -832,7 +832,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
         }
 
         file.path  = input_name;
-        file.force = report.force;
+        file.force = symbol_conf.force;
 
 repeat:
         session = perf_session__new(&file, false, &report.tool);
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index e5afb8936040..fa9eb92c9e24 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1430,7 +1430,6 @@ close_file_and_continue:
 
 struct popup_action {
         struct thread           *thread;
-        struct dso              *dso;
         struct map_symbol       ms;
         int                     socket;
 
@@ -1565,7 +1564,6 @@ add_dso_opt(struct hist_browser *browser, struct popup_action *act,
                 return 0;
 
         act->ms.map = map;
-        act->dso = map->dso;
         act->fn = do_zoom_dso;
         return 1;
 }
@@ -1827,7 +1825,6 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
         while (1) {
                 struct thread *thread = NULL;
-                struct dso *dso = NULL;
                 struct map *map = NULL;
                 int choice = 0;
                 int socked_id = -1;
@@ -1839,8 +1836,6 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
                         map = browser->selection->map;
-                        if (map)
-                                dso = map->dso;
                         socked_id = browser->he_selection->socket;
                 }
                 switch (key) {
@@ -1874,7 +1869,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         hist_browser__dump(browser);
                         continue;
                 case 'd':
-                        actions->dso = dso;
+                        actions->ms.map = map;
                         do_zoom_dso(browser, actions);
                         continue;
                 case 'V':
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index d909459fb54c..217b5a60e2ab 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -76,6 +76,7 @@ struct perf_tool build_id__mark_dso_hit_ops = {
         .exit   = perf_event__exit_del_thread,
         .attr            = perf_event__process_attr,
         .build_id        = perf_event__process_build_id,
+        .ordered_events  = true,
 };
 
 int build_id__sprintf(const u8 *build_id, int len, char *bf)
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index 7c0c08386a1d..425df5c86c9c 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -933,6 +933,7 @@ static struct dso *__dso__findlink_by_longname(struct rb_root *root,
                 /* Add new node and rebalance tree */
                 rb_link_node(&dso->rb_node, parent, p);
                 rb_insert_color(&dso->rb_node, root);
+                dso->root = root;
         }
         return NULL;
 }
@@ -945,15 +946,30 @@ static inline struct dso *__dso__find_by_longname(struct rb_root *root,
 
 void dso__set_long_name(struct dso *dso, const char *name, bool name_allocated)
 {
+        struct rb_root *root = dso->root;
+
         if (name == NULL)
                 return;
 
         if (dso->long_name_allocated)
                 free((char *)dso->long_name);
 
+        if (root) {
+                rb_erase(&dso->rb_node, root);
+                /*
+                 * __dso__findlink_by_longname() isn't guaranteed to add it
+                 * back, so a clean removal is required here.
+                 */
+                RB_CLEAR_NODE(&dso->rb_node);
+                dso->root = NULL;
+        }
+
         dso->long_name           = name;
         dso->long_name_len       = strlen(name);
         dso->long_name_allocated = name_allocated;
+
+        if (root)
+                __dso__findlink_by_longname(root, dso, NULL);
 }
 
 void dso__set_short_name(struct dso *dso, const char *name, bool name_allocated)
@@ -1046,6 +1062,7 @@ struct dso *dso__new(const char *name)
                 dso->kernel = DSO_TYPE_USER;
                 dso->needs_swap = DSO_SWAP__UNSET;
                 RB_CLEAR_NODE(&dso->rb_node);
+                dso->root = NULL;
                 INIT_LIST_HEAD(&dso->node);
                 INIT_LIST_HEAD(&dso->data.open_entry);
                 pthread_mutex_init(&dso->lock, NULL);
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index fc8db9c764ac..45ec4d0a50ed 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -135,6 +135,7 @@ struct dso {
         pthread_mutex_t  lock;
         struct list_head node;
         struct rb_node   rb_node;       /* rbtree node sorted by long name */
+        struct rb_root   *root;         /* root of rbtree that rb_node is in */
         struct rb_root   symbols[MAP__NR_TYPES];
         struct rb_root   symbol_names[MAP__NR_TYPES];
         struct {
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 5ef90be2a249..8b303ff20289 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -91,6 +91,7 @@ static void dsos__purge(struct dsos *dsos)
 
         list_for_each_entry_safe(pos, n, &dsos->head, node) {
                 RB_CLEAR_NODE(&pos->rb_node);
+                pos->root = NULL;
                 list_del_init(&pos->node);
                 dso__put(pos);
         }
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index bd8f03de5e40..05012bb178d7 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1183,7 +1183,7 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
                         container_of(pf, struct trace_event_finder, pf);
         struct perf_probe_point *pp = &pf->pev->point;
         struct probe_trace_event *tev;
-        struct perf_probe_arg *args;
+        struct perf_probe_arg *args = NULL;
         int ret, i;
 
         /* Check number of tevs */
@@ -1198,19 +1198,23 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
         ret = convert_to_trace_point(&pf->sp_die, tf->mod, pf->addr,
                                      pp->retprobe, pp->function, &tev->point);
         if (ret < 0)
-                return ret;
+                goto end;
 
         tev->point.realname = strdup(dwarf_diename(sc_die));
-        if (!tev->point.realname)
-                return -ENOMEM;
+        if (!tev->point.realname) {
+                ret = -ENOMEM;
+                goto end;
+        }
 
         pr_debug("Probe point found: %s+%lu\n", tev->point.symbol,
                  tev->point.offset);
 
         /* Expand special probe argument if exist */
         args = zalloc(sizeof(struct perf_probe_arg) * MAX_PROBE_ARGS);
-        if (args == NULL)
-                return -ENOMEM;
+        if (args == NULL) {
+                ret = -ENOMEM;
+                goto end;
+        }
 
         ret = expand_probe_args(sc_die, pf, args);
         if (ret < 0)
@@ -1234,6 +1238,10 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
         }
 
 end:
+        if (ret) {
+                clear_probe_trace_event(tev);
+                tf->ntevs--;
+        }
         free(args);
         return ret;
 }
@@ -1246,7 +1254,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
         struct trace_event_finder tf = {
                         .pf = {.pev = pev, .callback = add_probe_trace_event},
                         .max_tevs = probe_conf.max_probes, .mod = dbg->mod};
-        int ret;
+        int ret, i;
 
         /* Allocate result tevs array */
         *tevs = zalloc(sizeof(struct probe_trace_event) * tf.max_tevs);
@@ -1258,6 +1266,8 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
 
         ret = debuginfo__find_probes(dbg, &tf.pf);
         if (ret < 0) {
+                for (i = 0; i < tf.ntevs; i++)
+                        clear_probe_trace_event(&tf.tevs[i]);
                 zfree(tevs);
                 return ret;
         }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index b4cc7662677e..cd08027a6d2c 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -654,19 +654,24 @@ static int dso__split_kallsyms_for_kcore(struct dso *dso, struct map *map,
         struct map_groups *kmaps = map__kmaps(map);
         struct map *curr_map;
         struct symbol *pos;
-        int count = 0, moved = 0;
+        int count = 0;
+        struct rb_root old_root = dso->symbols[map->type];
         struct rb_root *root = &dso->symbols[map->type];
         struct rb_node *next = rb_first(root);
 
         if (!kmaps)
                 return -1;
 
+        *root = RB_ROOT;
+
         while (next) {
                 char *module;
 
                 pos = rb_entry(next, struct symbol, rb_node);
                 next = rb_next(&pos->rb_node);
 
+                rb_erase_init(&pos->rb_node, &old_root);
+
                 module = strchr(pos->name, '\t');
                 if (module)
                         *module = '\0';
@@ -674,28 +679,21 @@ static int dso__split_kallsyms_for_kcore(struct dso *dso, struct map *map,
                 curr_map = map_groups__find(kmaps, map->type, pos->start);
 
                 if (!curr_map || (filter && filter(curr_map, pos))) {
-                        rb_erase_init(&pos->rb_node, root);
                         symbol__delete(pos);
-                } else {
-                        pos->start -= curr_map->start - curr_map->pgoff;
-                        if (pos->end)
-                                pos->end -= curr_map->start - curr_map->pgoff;
-                        if (curr_map->dso != map->dso) {
-                                rb_erase_init(&pos->rb_node, root);
-                                symbols__insert(
-                                        &curr_map->dso->symbols[curr_map->type],
-                                        pos);
-                                ++moved;
-                        } else {
-                                ++count;
-                        }
+                        continue;
                 }
+
+                pos->start -= curr_map->start - curr_map->pgoff;
+                if (pos->end)
+                        pos->end -= curr_map->start - curr_map->pgoff;
+                symbols__insert(&curr_map->dso->symbols[curr_map->type], pos);
+                ++count;
         }
 
         /* Symbols have been adjusted */
         dso->adjust_symbols = 1;
 
-        return count + moved;
+        return count;
 }
 
 /*
@@ -1438,9 +1436,9 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
                 if (lstat(dso->name, &st) < 0)
                         goto out;
 
-                if (st.st_uid && (st.st_uid != geteuid())) {
+                if (!symbol_conf.force && st.st_uid && (st.st_uid != geteuid())) {
                         pr_warning("File %s not owned by current user or root, "
-                                "ignoring it.\n", dso->name);
+                                   "ignoring it (use -f to override).\n", dso->name);
                         goto out;
                 }
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 40073c60b83d..dcd786e364f2 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -84,6 +84,7 @@ struct symbol_conf {
         unsigned short  priv_size;
         unsigned short  nr_events;
         bool            try_vmlinux_path,
+                        force,
                         ignore_vmlinux,
                         ignore_vmlinux_buildid,
                         show_kernel_path,
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index d8e4b20b6d54..0dac7e05a6ac 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1173,9 +1173,9 @@ dump_nhm_platform_info(void)
         unsigned long long msr;
         unsigned int ratio;
 
-        get_msr(base_cpu, MSR_NHM_PLATFORM_INFO, &msr);
+        get_msr(base_cpu, MSR_PLATFORM_INFO, &msr);
 
-        fprintf(stderr, "cpu%d: MSR_NHM_PLATFORM_INFO: 0x%08llx\n", base_cpu, msr);
+        fprintf(stderr, "cpu%d: MSR_PLATFORM_INFO: 0x%08llx\n", base_cpu, msr);
 
         ratio = (msr >> 40) & 0xFF;
         fprintf(stderr, "%d * %.0f = %.0f MHz max efficiency frequency\n",
@@ -1807,7 +1807,7 @@ void check_permissions()
  *
  * MSR_SMI_COUNT                   0x00000034
  *
- * MSR_NHM_PLATFORM_INFO           0x000000ce
+ * MSR_PLATFORM_INFO               0x000000ce
  * MSR_NHM_SNB_PKG_CST_CFG_CTL     0x000000e2
  *
  * MSR_PKG_C3_RESIDENCY            0x000003f8
@@ -1876,7 +1876,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
         get_msr(base_cpu, MSR_NHM_SNB_PKG_CST_CFG_CTL, &msr);
         pkg_cstate_limit = pkg_cstate_limits[msr & 0xF];
 
-        get_msr(base_cpu, MSR_NHM_PLATFORM_INFO, &msr);
+        get_msr(base_cpu, MSR_PLATFORM_INFO, &msr);
         base_ratio = (msr >> 8) & 0xFF;
 
         base_hz = base_ratio * bclk * 1000000;
diff --git a/tools/testing/selftests/futex/README b/tools/testing/selftests/futex/README
index 3224a049b196..0558bb9ce0a6 100644
--- a/tools/testing/selftests/futex/README
+++ b/tools/testing/selftests/futex/README
@@ -27,7 +27,7 @@ o The build system shall remain as simple as possible, avoiding any archive or
 o Where possible, any helper functions or other package-wide code shall be
   implemented in header files, avoiding the need to compile intermediate object
   files.
-o External dependendencies shall remain as minimal as possible. Currently gcc
+o External dependencies shall remain as minimal as possible. Currently gcc
   and glibc are the only dependencies.
 o Tests return 0 for success and < 0 for failure.
 
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index e38cc54942db..882fe83a3554 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -492,6 +492,9 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
         pid_t parent = getppid();
         int fd;
         void *map1, *map2;
+        int page_size = sysconf(_SC_PAGESIZE);
+
+        ASSERT_LT(0, page_size);
 
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
@@ -504,16 +507,16 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 
         EXPECT_EQ(parent, syscall(__NR_getppid));
         map1 = (void *)syscall(sysno,
-                NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, PAGE_SIZE);
+                NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
         EXPECT_NE(MAP_FAILED, map1);
         /* mmap2() should never return. */
         map2 = (void *)syscall(sysno,
-                 NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
+                 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
         EXPECT_EQ(MAP_FAILED, map2);
 
         /* The test failed, so clean up the resources. */
-        munmap(map1, PAGE_SIZE);
-        munmap(map2, PAGE_SIZE);
+        munmap(map1, page_size);
+        munmap(map2, page_size);
         close(fd);
 }
 
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index bcf5ec760eb9..5a6016224bb9 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -128,6 +128,7 @@ static const char * const page_flag_names[] = {
         [KPF_THP]               = "t:thp",
         [KPF_BALLOON]           = "o:balloon",
         [KPF_ZERO_PAGE]         = "z:zero_page",
+        [KPF_IDLE]              = "i:idle_page",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 21a0ab2d8919..69bca185c471 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -221,17 +221,23 @@ void kvm_timer_flush_hwstate(struct kvm_vcpu *vcpu)
         kvm_timer_update_state(vcpu);
 
         /*
-         * If we enter the guest with the virtual input level to the VGIC
-         * asserted, then we have already told the VGIC what we need to, and
-         * we don't need to exit from the guest until the guest deactivates
-         * the already injected interrupt, so therefore we should set the
-         * hardware active state to prevent unnecessary exits from the guest.
-         *
-         * Conversely, if the virtual input level is deasserted, then always
-         * clear the hardware active state to ensure that hardware interrupts
-         * from the timer triggers a guest exit.
-         */
-        if (timer->irq.level)
+        * If we enter the guest with the virtual input level to the VGIC
+        * asserted, then we have already told the VGIC what we need to, and
+        * we don't need to exit from the guest until the guest deactivates
+        * the already injected interrupt, so therefore we should set the
+        * hardware active state to prevent unnecessary exits from the guest.
+        *
+        * Also, if we enter the guest with the virtual timer interrupt active,
+        * then it must be active on the physical distributor, because we set
+        * the HW bit and the guest must be able to deactivate the virtual and
+        * physical interrupt at the same time.
+        *
+        * Conversely, if the virtual input level is deasserted and the virtual
+        * interrupt is not active, then always clear the hardware active state
+        * to ensure that hardware interrupts from the timer triggers a guest
+        * exit.
+        */
+        if (timer->irq.level || kvm_vgic_map_is_active(vcpu, timer->map))
                 phys_active = true;
         else
                 phys_active = false;
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 533538385d5d..65461f821a75 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1096,6 +1096,27 @@ static void vgic_retire_lr(int lr_nr, struct kvm_vcpu *vcpu)
         vgic_set_lr(vcpu, lr_nr, vlr);
 }
 
+static bool dist_active_irq(struct kvm_vcpu *vcpu)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        return test_bit(vcpu->vcpu_id, dist->irq_active_on_cpu);
+}
+
+bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, struct irq_phys_map *map)
+{
+        int i;
+
+        for (i = 0; i < vcpu->arch.vgic_cpu.nr_lr; i++) {
+                struct vgic_lr vlr = vgic_get_lr(vcpu, i);
+
+                if (vlr.irq == map->virt_irq && vlr.state & LR_STATE_ACTIVE)
+                        return true;
+        }
+
+        return dist_active_irq(vcpu);
+}
+
 /*
  * An interrupt may have been disabled after being made pending on the
  * CPU interface (the classic case is a timer running while we're
@@ -1248,7 +1269,7 @@ static void __kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
          * may have been serviced from another vcpu. In all cases,
          * move along.
          */
-        if (!kvm_vgic_vcpu_pending_irq(vcpu) && !kvm_vgic_vcpu_active_irq(vcpu))
+        if (!kvm_vgic_vcpu_pending_irq(vcpu) && !dist_active_irq(vcpu))
                 goto epilog;
 
         /* SGIs */
@@ -1396,25 +1417,13 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
 static bool vgic_sync_hwirq(struct kvm_vcpu *vcpu, int lr, struct vgic_lr vlr)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
-        struct irq_phys_map *map;
-        bool phys_active;
         bool level_pending;
-        int ret;
 
         if (!(vlr.state & LR_HW))
                 return false;
 
-        map = vgic_irq_map_search(vcpu, vlr.irq);
-        BUG_ON(!map);
-
-        ret = irq_get_irqchip_state(map->irq,
-                                    IRQCHIP_STATE_ACTIVE,
-                                    &phys_active);
-
-        WARN_ON(ret);
-
-        if (phys_active)
-                return 0;
+        if (vlr.state & LR_STATE_ACTIVE)
+                return false;
 
         spin_lock(&dist->lock);
         level_pending = process_queued_irq(vcpu, lr, vlr);
@@ -1479,17 +1488,6 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
         return test_bit(vcpu->vcpu_id, dist->irq_pending_on_cpu);
 }
 
-int kvm_vgic_vcpu_active_irq(struct kvm_vcpu *vcpu)
-{
-        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
-
-        if (!irqchip_in_kernel(vcpu->kvm))
-                return 0;
-
-        return test_bit(vcpu->vcpu_id, dist->irq_active_on_cpu);
-}
-
-
 void vgic_kick_vcpus(struct kvm *kvm)
 {
         struct kvm_vcpu *vcpu;