576 files changed, 7572 insertions, 7901 deletions

diff --git a/Documentation/IPMI.txt b/Documentation/IPMI.txt
index 31d1d658827f..c0d8788e75d3 100644
--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -587,7 +587,7 @@ used to control it:
 
   modprobe ipmi_watchdog timeout=<t> pretimeout=<t> action=<action type>
       preaction=<preaction type> preop=<preop type> start_now=x
-      nowayout=x ifnum_to_use=n
+      nowayout=x ifnum_to_use=n panic_wdt_timeout=<t>
 
 ifnum_to_use specifies which interface the watchdog timer should use.
 The default is -1, which means to pick the first one registered.
@@ -597,7 +597,9 @@ is the amount of seconds before the reset that the pre-timeout panic will
 occur (if pretimeout is zero, then pretimeout will not be enabled).  Note
 that the pretimeout is the time before the final timeout.  So if the
 timeout is 50 seconds and the pretimeout is 10 seconds, then the pretimeout
-will occur in 40 second (10 seconds before the timeout).
+will occur in 40 second (10 seconds before the timeout). The panic_wdt_timeout
+is the value of timeout which is set on kernel panic, in order to let actions
+such as kdump to occur during panic.
 
 The action may be "reset", "power_cycle", or "power_off", and
 specifies what to do when the timer times out, and defaults to
@@ -634,6 +636,7 @@ for configuring the watchdog:
         ipmi_watchdog.preop=<preop type>
         ipmi_watchdog.start_now=x
         ipmi_watchdog.nowayout=x
+        ipmi_watchdog.panic_wdt_timeout=<t>
 
 The options are the same as the module parameter options.
 
diff --git a/Documentation/arm/keystone/Overview.txt b/Documentation/arm/keystone/Overview.txt
index f17bc4c9dff9..400c0c270d2e 100644
--- a/Documentation/arm/keystone/Overview.txt
+++ b/Documentation/arm/keystone/Overview.txt
@@ -49,24 +49,6 @@ specified through DTS. Following are the DTS used:-
 The device tree documentation for the keystone machines are located at
         Documentation/devicetree/bindings/arm/keystone/keystone.txt
 
-Known issues & workaround
--------------------------
-
-Some of the device drivers used on keystone are re-used from that from
-DaVinci and other TI SoCs. These device drivers may use clock APIs directly.
-Some of the keystone specific drivers such as netcp uses run time power
-management API instead to enable clock. As this API has limitations on
-keystone, following workaround is needed to boot Linux.
-
-   Add 'clk_ignore_unused' to the bootargs env variable in u-boot. Otherwise
-   clock frameworks will try to disable clocks that are unused and disable
-   the hardware. This is because netcp related power domain and clock
-   domains are enabled in u-boot as run time power management API currently
-   doesn't enable clocks for netcp due to a limitation. This workaround is
-   expected to be removed in the future when proper API support becomes
-   available. Until then, this work around is needed.
-
-
 Document Author
 ---------------
 Murali Karicheri <m-karicheri2@ti.com>
diff --git a/Documentation/block/null_blk.txt b/Documentation/block/null_blk.txt
index 2f6c6ff7161d..d8880ca30af4 100644
--- a/Documentation/block/null_blk.txt
+++ b/Documentation/block/null_blk.txt
@@ -70,3 +70,6 @@ use_per_node_hctx=[0/1]: Default: 0
      parameter.
   1: The multi-queue block layer is instantiated with a hardware dispatch
      queue for each CPU node in the system.
+
+use_lightnvm=[0/1]: Default: 0
+  Register device with LightNVM. Requires blk-mq to be used.
diff --git a/Documentation/devicetree/bindings/thermal/rockchip-thermal.txt b/Documentation/devicetree/bindings/thermal/rockchip-thermal.txt
index b38200d2583a..0dfa60d88dd3 100644
--- a/Documentation/devicetree/bindings/thermal/rockchip-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/rockchip-thermal.txt
@@ -1,7 +1,9 @@
 * Temperature Sensor ADC (TSADC) on rockchip SoCs
 
 Required properties:
-- compatible : "rockchip,rk3288-tsadc"
+- compatible : should be "rockchip,<name>-tsadc"
+   "rockchip,rk3288-tsadc": found on RK3288 SoCs
+   "rockchip,rk3368-tsadc": found on RK3368 SoCs
 - reg : physical base address of the controller and length of memory mapped
         region.
 - interrupts : The interrupt number to the cpu. The interrupt specifier format
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 6a4b1af724f8..1bba38dd2637 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -32,6 +32,7 @@ Supported adapters:
   * Intel Sunrise Point-LP (PCH)
   * Intel DNV (SOC)
   * Intel Broxton (SOC)
+  * Intel Lewisburg (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index f8aae632f02f..742f69d18fc8 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1583,9 +1583,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 hwp_only
                         Only load intel_pstate on systems which support
                         hardware P state control (HWP) if available.
-                no_acpi
-                        Don't use ACPI processor performance control objects
-                        _PSS and _PPC specified limits.
 
         intremap=       [X86-64, Intel-IOMMU]
                         on      enable Interrupt Remapping (default)
diff --git a/MAINTAINERS b/MAINTAINERS
index e9caa4b28828..cba790b42f23 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1931,7 +1931,7 @@ S:	Supported
 F:      drivers/i2c/busses/i2c-at91.c
 
 ATMEL ISI DRIVER
-M:      Josh Wu <josh.wu@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-media@vger.kernel.org
 S:      Supported
 F:      drivers/media/platform/soc_camera/atmel-isi.c
@@ -1950,7 +1950,8 @@ S:	Supported
 F:      drivers/net/ethernet/cadence/
 
 ATMEL NAND DRIVER
-M:      Josh Wu <josh.wu@atmel.com>
+M:      Wenyou Yang <wenyou.yang@atmel.com>
+M:      Josh Wu <rainyfeeling@outlook.com>
 L:      linux-mtd@lists.infradead.org
 S:      Supported
 F:      drivers/mtd/nand/atmel_nand*
@@ -2449,7 +2450,9 @@ F:	drivers/firmware/broadcom/*
 
 BROADCOM STB NAND FLASH DRIVER
 M:      Brian Norris <computersforpeace@gmail.com>
+M:      Kamal Dasu <kdasu.kdev@gmail.com>
 L:      linux-mtd@lists.infradead.org
+L:      bcm-kernel-feedback-list@broadcom.com
 S:      Maintained
 F:      drivers/mtd/nand/brcmnand/
 
@@ -2546,7 +2549,7 @@ F:	arch/c6x/
 
 CACHEFILES: FS-CACHE BACKEND FOR CACHING ON MOUNTED FILESYSTEMS
 M:      David Howells <dhowells@redhat.com>
-L:      linux-cachefs@redhat.com
+L:      linux-cachefs@redhat.com (moderated for non-subscribers)
 S:      Supported
 F:      Documentation/filesystems/caching/cachefiles.txt
 F:      fs/cachefiles/
@@ -2929,10 +2932,9 @@ S:	Maintained
 F:      drivers/platform/x86/compal-laptop.c
 
 CONEXANT ACCESSRUNNER USB DRIVER
-M:      Simon Arlott <cxacru@fire.lp0.eu>
 L:      accessrunner-general@lists.sourceforge.net
 W:      http://accessrunner.sourceforge.net/
-S:      Maintained
+S:      Orphan
 F:      drivers/usb/atm/cxacru.c
 
 CONFIGFS
@@ -4409,6 +4411,7 @@ K:	fmc_d.*register
 
 FPGA MANAGER FRAMEWORK
 M:      Alan Tull <atull@opensource.altera.com>
+R:      Moritz Fischer <moritz.fischer@ettus.com>
 S:      Maintained
 F:      drivers/fpga/
 F:      include/linux/fpga/fpga-mgr.h
@@ -4559,7 +4562,7 @@ F:	include/linux/frontswap.h
 
 FS-CACHE: LOCAL CACHING FOR NETWORK FILESYSTEMS
 M:      David Howells <dhowells@redhat.com>
-L:      linux-cachefs@redhat.com
+L:      linux-cachefs@redhat.com (moderated for non-subscribers)
 S:      Supported
 F:      Documentation/filesystems/caching/
 F:      fs/fscache/
@@ -5711,13 +5714,6 @@ M:	Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
 S:      Maintained
 F:      net/ipv4/netfilter/ipt_MASQUERADE.c
 
-IP1000A 10/100/1000 GIGABIT ETHERNET DRIVER
-M:      Francois Romieu <romieu@fr.zoreil.com>
-M:      Sorbica Shieh <sorbica@icplus.com.tw>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/icplus/ipg.*
-
 IPATH DRIVER
 M:      Mike Marciniszyn <infinipath@intel.com>
 L:      linux-rdma@vger.kernel.org
@@ -6371,6 +6367,7 @@ F:	arch/*/include/asm/pmem.h
 LIGHTNVM PLATFORM SUPPORT
 M:      Matias Bjorling <mb@lightnvm.io>
 W:      http://github/OpenChannelSSD
+L:      linux-block@vger.kernel.org
 S:      Maintained
 F:      drivers/lightnvm/
 F:      include/linux/lightnvm.h
@@ -6923,13 +6920,21 @@ F:	drivers/scsi/megaraid.*
 F:      drivers/scsi/megaraid/
 
 MELLANOX ETHERNET DRIVER (mlx4_en)
-M:      Amir Vadai <amirv@mellanox.com>
+M:      Eugenia Emantayev <eugenia@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlx4/en_*
 
+MELLANOX ETHERNET DRIVER (mlx5e)
+M:      Saeed Mahameed <saeedm@mellanox.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+W:      http://www.mellanox.com
+Q:      http://patchwork.ozlabs.org/project/netdev/list/
+F:      drivers/net/ethernet/mellanox/mlx5/core/en_*
+
 MELLANOX ETHERNET SWITCH DRIVERS
 M:      Jiri Pirko <jiri@mellanox.com>
 M:      Ido Schimmel <idosch@mellanox.com>
@@ -7901,6 +7906,18 @@ S:	Maintained
 F:      net/openvswitch/
 F:      include/uapi/linux/openvswitch.h
 
+OPERATING PERFORMANCE POINTS (OPP)
+M:      Viresh Kumar <vireshk@kernel.org>
+M:      Nishanth Menon <nm@ti.com>
+M:      Stephen Boyd <sboyd@codeaurora.org>
+L:      linux-pm@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm.git
+F:      drivers/base/power/opp/
+F:      include/linux/pm_opp.h
+F:      Documentation/power/opp.txt
+F:      Documentation/devicetree/bindings/opp/
+
 OPL4 DRIVER
 M:      Clemens Ladisch <clemens@ladisch.de>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -9314,7 +9331,6 @@ F:	drivers/i2c/busses/i2c-designware-*
 F:      include/linux/platform_data/i2c-designware.h
 
 SYNOPSYS DESIGNWARE MMC/SD/SDIO DRIVER
-M:      Seungwon Jeon <tgih.jun@samsung.com>
 M:      Jaehoon Chung <jh80.chung@samsung.com>
 L:      linux-mmc@vger.kernel.org
 S:      Maintained
diff --git a/Makefile b/Makefile
index 3a0234f50f36..904a1d65df30 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Blurry Fish Butt
 
 # *DOCUMENTATION*
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index c92c0ef1e9d2..f1ac9818b751 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index cfac24e0e7b6..323486d6ee83 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index 9922a118a15a..66191cd0447e 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index f761a7c70761..f68838e8068a 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index dc6f74f41283..96bd1c20fb0b 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index 3fef0a210c56..fcae66683ca0 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index 51784837daae..b01b659168ea 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index ef35ef3923dd..a07f20de221b 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index 634509e5e572..f36c047b33ca 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -1,4 +1,4 @@
-CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+CONFIG_CROSS_COMPILE="arc-linux-"
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
diff --git a/arch/arc/include/asm/irqflags-arcv2.h b/arch/arc/include/asm/irqflags-arcv2.h
index ad481c24070d..258b0e5ad332 100644
--- a/arch/arc/include/asm/irqflags-arcv2.h
+++ b/arch/arc/include/asm/irqflags-arcv2.h
@@ -37,6 +37,9 @@
 #define ISA_INIT_STATUS_BITS    (STATUS_IE_MASK | STATUS_AD_MASK | \
                                         (ARCV2_IRQ_DEF_PRIO << 1))
 
+/* SLEEP needs default irq priority (<=) which can interrupt the doze */
+#define ISA_SLEEP_ARG           (0x10 | ARCV2_IRQ_DEF_PRIO)
+
 #ifndef __ASSEMBLY__
 
 /*
diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h
index d8c608174617..c1d36458bfb7 100644
--- a/arch/arc/include/asm/irqflags-compact.h
+++ b/arch/arc/include/asm/irqflags-compact.h
@@ -43,6 +43,8 @@
 
 #define ISA_INIT_STATUS_BITS    STATUS_IE_MASK
 
+#define ISA_SLEEP_ARG           0x3
+
 #ifndef __ASSEMBLY__
 
 /******************************************************************
diff --git a/arch/arc/kernel/ctx_sw.c b/arch/arc/kernel/ctx_sw.c
index c14a5bea0c76..5d446df2c413 100644
--- a/arch/arc/kernel/ctx_sw.c
+++ b/arch/arc/kernel/ctx_sw.c
@@ -58,8 +58,6 @@ __switch_to(struct task_struct *prev_task, struct task_struct *next_task)
                 "st      sp, [r24]       \n\t"
 #endif
 
-                "sync   \n\t"
-
                 /*
                  * setup _current_task with incoming tsk.
                  * optionally, set r25 to that as well
diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S
index e248594097e7..e6890b1f8650 100644
--- a/arch/arc/kernel/ctx_sw_asm.S
+++ b/arch/arc/kernel/ctx_sw_asm.S
@@ -44,9 +44,6 @@ __switch_to:
         * don't need to do anything special to return it
         */
 
-        /* hardware memory barrier */
-        sync
-
         /*
          * switch to new task, contained in r1
          * Temp reg r3 is required to get the ptr to store val
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 91d5a0f1f3f7..a3f750e76b68 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -44,11 +44,10 @@ SYSCALL_DEFINE0(arc_gettls)
 void arch_cpu_idle(void)
 {
         /* sleep, but enable all interrupts before committing */
-        if (is_isa_arcompact()) {
-                __asm__("sleep 0x3");
-        } else {
-                __asm__("sleep 0x10");
-        }
+        __asm__ __volatile__(
+                "sleep %0       \n"
+                :
+                :"I"(ISA_SLEEP_ARG)); /* can't be "r" has to be embedded const */
 }
 
 asmlinkage void ret_from_fork(void);
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 93c6ea52b671..7352475451f6 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -986,42 +986,13 @@ int arc_unwind(struct unwind_frame_info *frame)
                                                             (const u8 *)(fde +
                                                                          1) +
                                                             *fde, ptrType);
-                                if (pc >= endLoc)
+                                if (pc >= endLoc) {
                                         fde = NULL;
-                        } else
-                                fde = NULL;
-                }
-                if (fde == NULL) {
-                        for (fde = table->address, tableSize = table->size;
-                             cie = NULL, tableSize > sizeof(*fde)
-                             && tableSize - sizeof(*fde) >= *fde;
-                             tableSize -= sizeof(*fde) + *fde,
-                             fde += 1 + *fde / sizeof(*fde)) {
-                                cie = cie_for_fde(fde, table);
-                                if (cie == &bad_cie) {
                                         cie = NULL;
-                                        break;
                                 }
-                                if (cie == NULL
-                                    || cie == &not_fde
-                                    || (ptrType = fde_pointer_type(cie)) < 0)
-                                        continue;
-                                ptr = (const u8 *)(fde + 2);
-                                startLoc = read_pointer(&ptr,
-                                                        (const u8 *)(fde + 1) +
-                                                        *fde, ptrType);
-                                if (!startLoc)
-                                        continue;
-                                if (!(ptrType & DW_EH_PE_indirect))
-                                        ptrType &=
-                                            DW_EH_PE_FORM | DW_EH_PE_signed;
-                                endLoc =
-                                    startLoc + read_pointer(&ptr,
-                                                            (const u8 *)(fde +
-                                                                         1) +
-                                                            *fde, ptrType);
-                                if (pc >= startLoc && pc < endLoc)
-                                        break;
+                        } else {
+                                fde = NULL;
+                                cie = NULL;
                         }
                 }
         }
diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
index 0ee739846847..daf2bf52b984 100644
--- a/arch/arc/mm/tlb.c
+++ b/arch/arc/mm/tlb.c
@@ -619,10 +619,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long vaddr_unaligned,
 
                 int dirty = !test_and_set_bit(PG_dc_clean, &page->flags);
                 if (dirty) {
-                        /* wback + inv dcache lines */
+                        /* wback + inv dcache lines (K-mapping) */
                         __flush_dcache_page(paddr, paddr);
 
-                        /* invalidate any existing icache lines */
+                        /* invalidate any existing icache lines (U-mapping) */
                         if (vma->vm_flags & VM_EXEC)
                                 __inv_icache_page(paddr, vaddr);
                 }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 0365cbbc9179..34e1569a11ee 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -76,6 +76,8 @@ config ARM
         select IRQ_FORCED_THREADING
         select MODULES_USE_ELF_REL
         select NO_BOOTMEM
+        select OF_EARLY_FLATTREE if OF
+        select OF_RESERVED_MEM if OF
         select OLD_SIGACTION
         select OLD_SIGSUSPEND3
         select PERF_USE_VMALLOC
@@ -1822,8 +1824,6 @@ config USE_OF
         bool "Flattened Device Tree support"
         select IRQ_DOMAIN
         select OF
-        select OF_EARLY_FLATTREE
-        select OF_RESERVED_MEM
         help
           Include support for flattened device tree machine descriptions.
 
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
index d9ba6b879fc1..00352e761b8c 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -604,6 +604,7 @@
                 reg = <0x6f>;
                 interrupts-extended = <&crossbar_mpu GIC_SPI 2 IRQ_TYPE_EDGE_RISING>,
                                       <&dra7_pmx_core 0x424>;
+                interrupt-names = "irq", "wakeup";
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&mcp79410_pins_default>;
diff --git a/arch/arm/boot/dts/animeo_ip.dts b/arch/arm/boot/dts/animeo_ip.dts
index 4e0ad3b82796..0962f2fa3f6e 100644
--- a/arch/arm/boot/dts/animeo_ip.dts
+++ b/arch/arm/boot/dts/animeo_ip.dts
@@ -155,21 +155,21 @@
                         label = "keyswitch_in";
                         gpios = <&pioB 1 GPIO_ACTIVE_HIGH>;
                         linux,code = <28>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 error_in {
                         label = "error_in";
                         gpios = <&pioB 2 GPIO_ACTIVE_HIGH>;
                         linux,code = <29>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 btn {
                         label = "btn";
                         gpios = <&pioC 23 GPIO_ACTIVE_HIGH>;
                         linux,code = <31>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/at91-foxg20.dts b/arch/arm/boot/dts/at91-foxg20.dts
index f89598af4c2b..6bf873e7d96c 100644
--- a/arch/arm/boot/dts/at91-foxg20.dts
+++ b/arch/arm/boot/dts/at91-foxg20.dts
@@ -159,7 +159,7 @@
                         label = "Button";
                         gpios = <&pioC 4 GPIO_ACTIVE_LOW>;
                         linux,code = <0x103>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/at91-kizbox.dts b/arch/arm/boot/dts/at91-kizbox.dts
index bf18ece0c027..229e989eb60d 100644
--- a/arch/arm/boot/dts/at91-kizbox.dts
+++ b/arch/arm/boot/dts/at91-kizbox.dts
@@ -24,15 +24,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <18432000>;
-                };
-
                 main_xtal {
                         clock-frequency = <18432000>;
                 };
@@ -94,14 +85,14 @@
                         label = "PB_RST";
                         gpios = <&pioB 30 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 user {
                         label = "PB_USER";
                         gpios = <&pioB 31 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x101>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-kizbox2.dts b/arch/arm/boot/dts/at91-kizbox2.dts
index f0b1563cb3f1..50a14568f094 100644
--- a/arch/arm/boot/dts/at91-kizbox2.dts
+++ b/arch/arm/boot/dts/at91-kizbox2.dts
@@ -171,21 +171,21 @@
                         label = "PB_PROG";
                         gpios = <&pioE 27 GPIO_ACTIVE_LOW>;
                         linux,code = <0x102>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 reset {
                         label = "PB_RST";
                         gpios = <&pioE 29 GPIO_ACTIVE_LOW>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 user {
                         label = "PB_USER";
                         gpios = <&pioE 31 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x101>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-kizboxmini.dts b/arch/arm/boot/dts/at91-kizboxmini.dts
index 9f72b4932634..9682d105d4d8 100644
--- a/arch/arm/boot/dts/at91-kizboxmini.dts
+++ b/arch/arm/boot/dts/at91-kizboxmini.dts
@@ -98,14 +98,14 @@
                         label = "PB_PROG";
                         gpios = <&pioC 17 GPIO_ACTIVE_LOW>;
                         linux,code = <0x102>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 reset {
                         label = "PB_RST";
                         gpios = <&pioC 16 GPIO_ACTIVE_LOW>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-qil_a9260.dts b/arch/arm/boot/dts/at91-qil_a9260.dts
index a9aef53ab764..4f2eebf4a560 100644
--- a/arch/arm/boot/dts/at91-qil_a9260.dts
+++ b/arch/arm/boot/dts/at91-qil_a9260.dts
@@ -183,7 +183,7 @@
                         label = "user_pb";
                         gpios = <&pioB 10 GPIO_ACTIVE_LOW>;
                         linux,code = <28>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
index e07c2b206beb..ad6de73ed5a5 100644
--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
@@ -45,6 +45,7 @@
 /dts-v1/;
 #include "sama5d2.dtsi"
 #include "sama5d2-pinfunc.h"
+#include <dt-bindings/mfd/atmel-flexcom.h>
 
 / {
         model = "Atmel SAMA5D2 Xplained";
@@ -59,15 +60,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -91,6 +83,22 @@
                         status = "okay";
                 };
 
+                sdmmc0: sdio-host@a0000000 {
+                        bus-width = <8>;
+                        pinctrl-names = "default";
+                        pinctrl-0 = <&pinctrl_sdmmc0_default>;
+                        non-removable;
+                        mmc-ddr-1_8v;
+                        status = "okay";
+                };
+
+                sdmmc1: sdio-host@b0000000 {
+                        bus-width = <4>;
+                        pinctrl-names = "default";
+                        pinctrl-0 = <&pinctrl_sdmmc1_default>;
+                        status = "okay"; /* conflict with qspi0 */
+                };
+
                 apb {
                         spi0: spi@f8000000 {
                                 pinctrl-names = "default";
@@ -181,12 +189,49 @@
                                 };
                         };
 
+                        flx0: flexcom@f8034000 {
+                                atmel,flexcom-mode = <ATMEL_FLEXCOM_MODE_USART>;
+                                status = "disabled"; /* conflict with ISC_D2 & ISC_D3 data pins */
+
+                                uart5: serial@200 {
+                                        compatible = "atmel,at91sam9260-usart";
+                                        reg = <0x200 0x200>;
+                                        interrupts = <19 IRQ_TYPE_LEVEL_HIGH 7>;
+                                        clocks = <&flx0_clk>;
+                                        clock-names = "usart";
+                                        pinctrl-names = "default";
+                                        pinctrl-0 = <&pinctrl_flx0_default>;
+                                        atmel,fifo-size = <32>;
+                                        status = "okay";
+                                };
+                        };
+
                         uart3: serial@fc008000 {
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_uart3_default>;
                                 status = "okay";
                         };
 
+                        flx4: flexcom@fc018000 {
+                                atmel,flexcom-mode = <ATMEL_FLEXCOM_MODE_TWI>;
+                                status = "okay";
+
+                                i2c2: i2c@600 {
+                                        compatible = "atmel,sama5d2-i2c";
+                                        reg = <0x600 0x200>;
+                                        interrupts = <23 IRQ_TYPE_LEVEL_HIGH 7>;
+                                        dmas = <0>, <0>;
+                                        dma-names = "tx", "rx";
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        clocks = <&flx4_clk>;
+                                        pinctrl-names = "default";
+                                        pinctrl-0 = <&pinctrl_flx4_default>;
+                                        atmel,fifo-size = <16>;
+                                        status = "okay";
+                                };
+                        };
+
                         i2c1: i2c@fc028000 {
                                 dmas = <0>, <0>;
                                 pinctrl-names = "default";
@@ -201,6 +246,18 @@
                         };
 
                         pinctrl@fc038000 {
+                                pinctrl_flx0_default: flx0_default {
+                                        pinmux = <PIN_PB28__FLEXCOM0_IO0>,
+                                                 <PIN_PB29__FLEXCOM0_IO1>;
+                                        bias-disable;
+                                };
+
+                                pinctrl_flx4_default: flx4_default {
+                                        pinmux = <PIN_PD12__FLEXCOM4_IO0>,
+                                                 <PIN_PD13__FLEXCOM4_IO1>;
+                                        bias-disable;
+                                };
+
                                 pinctrl_i2c0_default: i2c0_default {
                                         pinmux = <PIN_PD21__TWD0>,
                                                  <PIN_PD22__TWCK0>;
@@ -227,6 +284,46 @@
                                         bias-disable;
                                 };
 
+                                pinctrl_sdmmc0_default: sdmmc0_default {
+                                        cmd_data {
+                                                pinmux = <PIN_PA1__SDMMC0_CMD>,
+                                                         <PIN_PA2__SDMMC0_DAT0>,
+                                                         <PIN_PA3__SDMMC0_DAT1>,
+                                                         <PIN_PA4__SDMMC0_DAT2>,
+                                                         <PIN_PA5__SDMMC0_DAT3>,
+                                                         <PIN_PA6__SDMMC0_DAT4>,
+                                                         <PIN_PA7__SDMMC0_DAT5>,
+                                                         <PIN_PA8__SDMMC0_DAT6>,
+                                                         <PIN_PA9__SDMMC0_DAT7>;
+                                                bias-pull-up;
+                                        };
+
+                                        ck_cd_rstn_vddsel {
+                                                pinmux = <PIN_PA0__SDMMC0_CK>,
+                                                         <PIN_PA10__SDMMC0_RSTN>,
+                                                         <PIN_PA11__SDMMC0_VDDSEL>,
+                                                         <PIN_PA13__SDMMC0_CD>;
+                                                bias-disable;
+                                        };
+                                };
+
+                                pinctrl_sdmmc1_default: sdmmc1_default {
+                                        cmd_data {
+                                                pinmux = <PIN_PA28__SDMMC1_CMD>,
+                                                         <PIN_PA18__SDMMC1_DAT0>,
+                                                         <PIN_PA19__SDMMC1_DAT1>,
+                                                         <PIN_PA20__SDMMC1_DAT2>,
+                                                         <PIN_PA21__SDMMC1_DAT3>;
+                                                bias-pull-up;
+                                        };
+
+                                        conf-ck_cd {
+                                                pinmux = <PIN_PA22__SDMMC1_CK>,
+                                                         <PIN_PA30__SDMMC1_CD>;
+                                                bias-disable;
+                                        };
+                                };
+
                                 pinctrl_spi0_default: spi0_default {
                                         pinmux = <PIN_PA14__SPI0_SPCK>,
                                                  <PIN_PA15__SPI0_MOSI>,
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 8488ac53d22d..ff888d21c786 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -315,7 +315,7 @@
                         label = "PB_USER";
                         gpios = <&pioE 29 GPIO_ACTIVE_LOW>;
                         linux,code = <0x104>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index 45371a1b61b3..131614f28e75 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -50,7 +50,6 @@
         compatible = "atmel,sama5d4-xplained", "atmel,sama5d4", "atmel,sama5";
 
         chosen {
-                bootargs = "ignore_loglevel earlyprintk";
                 stdout-path = "serial0:115200n8";
         };
 
@@ -59,15 +58,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -235,7 +225,7 @@
                         label = "pb_user1";
                         gpios = <&pioE 8 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
index 6d272c0125e3..2d4a33100af6 100644
--- a/arch/arm/boot/dts/at91-sama5d4ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
@@ -50,7 +50,6 @@
         compatible = "atmel,sama5d4ek", "atmel,sama5d4", "atmel,sama5";
 
         chosen {
-                bootargs = "ignore_loglevel earlyprintk";
                 stdout-path = "serial0:115200n8";
         };
 
@@ -59,15 +58,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -304,7 +294,7 @@
                         label = "pb_user1";
                         gpios = <&pioE 13 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91rm9200ek.dts b/arch/arm/boot/dts/at91rm9200ek.dts
index 8dab4b75ca97..f90e1c2d3caa 100644
--- a/arch/arm/boot/dts/at91rm9200ek.dts
+++ b/arch/arm/boot/dts/at91rm9200ek.dts
@@ -21,15 +21,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <18432000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
index 2e92ac020f23..55bd51f07fa6 100644
--- a/arch/arm/boot/dts/at91sam9261ek.dts
+++ b/arch/arm/boot/dts/at91sam9261ek.dts
@@ -22,15 +22,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <18432000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -149,7 +140,7 @@
                                         ti,debounce-tol = /bits/ 16 <65535>;
                                         ti,debounce-max = /bits/ 16 <1>;
 
-                                        linux,wakeup;
+                                        wakeup-source;
                                 };
                         };
 
@@ -193,28 +184,28 @@
                         label = "button_0";
                         gpios = <&pioA 27 GPIO_ACTIVE_LOW>;
                         linux,code = <256>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button_1 {
                         label = "button_1";
                         gpios = <&pioA 26 GPIO_ACTIVE_LOW>;
                         linux,code = <257>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button_2 {
                         label = "button_2";
                         gpios = <&pioA 25 GPIO_ACTIVE_LOW>;
                         linux,code = <258>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button_3 {
                         label = "button_3";
                         gpios = <&pioA 24 GPIO_ACTIVE_LOW>;
                         linux,code = <259>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/at91sam9263ek.dts b/arch/arm/boot/dts/at91sam9263ek.dts
index 23381276ffb8..59df9d73d276 100644
--- a/arch/arm/boot/dts/at91sam9263ek.dts
+++ b/arch/arm/boot/dts/at91sam9263ek.dts
@@ -22,15 +22,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <16367660>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -213,14 +204,14 @@
                         label = "left_click";
                         gpios = <&pioC 5 GPIO_ACTIVE_LOW>;
                         linux,code = <272>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 right_click {
                         label = "right_click";
                         gpios = <&pioC 4 GPIO_ACTIVE_LOW>;
                         linux,code = <273>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
index 57548a2c5a1e..e9cc99b6353a 100644
--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
@@ -19,15 +19,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <18432000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -206,14 +197,14 @@
                         label = "Button 3";
                         gpios = <&pioA 30 GPIO_ACTIVE_LOW>;
                         linux,code = <0x103>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 btn4 {
                         label = "Button 4";
                         gpios = <&pioA 31 GPIO_ACTIVE_LOW>;
                         linux,code = <0x104>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91sam9m10g45ek.dts b/arch/arm/boot/dts/at91sam9m10g45ek.dts
index 9d16ef8453c5..2400c99134f7 100644
--- a/arch/arm/boot/dts/at91sam9m10g45ek.dts
+++ b/arch/arm/boot/dts/at91sam9m10g45ek.dts
@@ -24,15 +24,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-
                 slow_xtal {
                       clock-frequency = <32768>;
                 };
@@ -323,14 +314,14 @@
                         label = "left_click";
                         gpios = <&pioB 6 GPIO_ACTIVE_LOW>;
                         linux,code = <272>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 right_click {
                         label = "right_click";
                         gpios = <&pioB 7 GPIO_ACTIVE_LOW>;
                         linux,code = <273>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 left {
diff --git a/arch/arm/boot/dts/at91sam9n12ek.dts b/arch/arm/boot/dts/at91sam9n12ek.dts
index acf3451a332d..ca4ddf86817a 100644
--- a/arch/arm/boot/dts/at91sam9n12ek.dts
+++ b/arch/arm/boot/dts/at91sam9n12ek.dts
@@ -23,15 +23,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <16000000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -219,7 +210,7 @@
                         label = "Enter";
                         gpios = <&pioB 3 GPIO_ACTIVE_LOW>;
                         linux,code = <28>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91sam9rlek.dts b/arch/arm/boot/dts/at91sam9rlek.dts
index 558c9f220bed..f10566f759cd 100644
--- a/arch/arm/boot/dts/at91sam9rlek.dts
+++ b/arch/arm/boot/dts/at91sam9rlek.dts
@@ -22,15 +22,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
@@ -225,14 +216,14 @@
                         label = "right_click";
                         gpios = <&pioB 0 GPIO_ACTIVE_LOW>;
                         linux,code = <273>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 left_click {
                         label = "left_click";
                         gpios = <&pioB 1 GPIO_ACTIVE_LOW>;
                         linux,code = <272>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/at91sam9x5cm.dtsi b/arch/arm/boot/dts/at91sam9x5cm.dtsi
index 26112ebd15fc..b098ad8cd93a 100644
--- a/arch/arm/boot/dts/at91sam9x5cm.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5cm.dtsi
@@ -13,17 +13,6 @@
         };
 
         clocks {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges;
-
-                main_clock: clock@0 {
-                        compatible = "atmel,osc", "fixed-clock";
-                        clock-frequency = <12000000>;
-                };
-        };
-
-        clocks {
                 slow_xtal {
                         clock-frequency = <32768>;
                 };
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index bc672fb91466..fe99231cbde5 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1459,8 +1459,8 @@
                         interrupt-names = "tx", "rx";
                         dmas = <&sdma_xbar 133>, <&sdma_xbar 132>;
                         dma-names = "tx", "rx";
-                        clocks = <&mcasp3_ahclkx_mux>;
-                        clock-names = "fck";
+                        clocks = <&mcasp3_aux_gfclk_mux>, <&mcasp3_ahclkx_mux>;
+                        clock-names = "fck", "ahclkx";
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index feb9d34b239c..f818ea483aeb 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -486,7 +486,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024000 0x200>;
                                 interrupts = <56>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 0>;
                                 status = "disabled";
                         };
@@ -495,7 +498,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024200 0x200>;
                                 interrupts = <54>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 1>;
                                 dr_mode = "host";
                                 status = "disabled";
@@ -505,7 +511,10 @@
                                 compatible = "fsl,imx27-usb";
                                 reg = <0x10024400 0x200>;
                                 interrupts = <55>;
-                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>;
+                                clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
+                                        <&clks IMX27_CLK_USB_AHB_GATE>,
+                                        <&clks IMX27_CLK_USB_DIV>;
+                                clock-names = "ipg", "ahb", "per";
                                 fsl,usbmisc = <&usbmisc 2>;
                                 dr_mode = "host";
                                 status = "disabled";
@@ -515,7 +524,6 @@
                                 #index-cells = <1>;
                                 compatible = "fsl,imx27-usbmisc";
                                 reg = <0x10024600 0x200>;
-                                clocks = <&clks IMX27_CLK_USB_AHB_GATE>;
                         };
 
                         sahara2: sahara@10025000 {
diff --git a/arch/arm/boot/dts/k2l-netcp.dtsi b/arch/arm/boot/dts/k2l-netcp.dtsi
index 01aef230773d..5acbd0dcc2ab 100644
--- a/arch/arm/boot/dts/k2l-netcp.dtsi
+++ b/arch/arm/boot/dts/k2l-netcp.dtsi
@@ -137,7 +137,7 @@ netcp: netcp@26000000 {
         /* NetCP address range */
         ranges = <0 0x26000000 0x1000000>;
 
-        clocks = <&papllclk>, <&clkcpgmac>, <&chipclk12>;
+        clocks = <&clkosr>, <&papllclk>, <&clkcpgmac>, <&chipclk12>;
         dma-coherent;
 
         ti,navigator-dmas = <&dma_gbe 0>,
diff --git a/arch/arm/boot/dts/kirkwood-ts219.dtsi b/arch/arm/boot/dts/kirkwood-ts219.dtsi
index c56ab6bbfe3c..0e46560551f4 100644
--- a/arch/arm/boot/dts/kirkwood-ts219.dtsi
+++ b/arch/arm/boot/dts/kirkwood-ts219.dtsi
@@ -40,7 +40,7 @@
                 };
                 poweroff@12100 {
                         compatible = "qnap,power-off";
-                        reg = <0x12000 0x100>;
+                        reg = <0x12100 0x100>;
                         clocks = <&gate_clk 7>;
                 };
                 spi@10600 {
diff --git a/arch/arm/boot/dts/rk3288-veyron-minnie.dts b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
index 8fd8ef2c72da..85f0373df498 100644
--- a/arch/arm/boot/dts/rk3288-veyron-minnie.dts
+++ b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
@@ -86,6 +86,10 @@
         };
 };
 
+&emmc {
+        /delete-property/mmc-hs200-1_8v;
+};
+
 &gpio_keys {
         pinctrl-0 = <&pwr_key_l &ap_lid_int_l &volum_down_l &volum_up_l>;
 
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index 6a79c9c526b8..04ea209f1737 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -452,8 +452,10 @@
                 clock-names = "tsadc", "apb_pclk";
                 resets = <&cru SRST_TSADC>;
                 reset-names = "tsadc-apb";
-                pinctrl-names = "default";
-                pinctrl-0 = <&otp_out>;
+                pinctrl-names = "init", "default", "sleep";
+                pinctrl-0 = <&otp_gpio>;
+                pinctrl-1 = <&otp_out>;
+                pinctrl-2 = <&otp_gpio>;
                 #thermal-sensor-cells = <1>;
                 rockchip,hw-tshut-temp = <95000>;
                 status = "disabled";
@@ -1395,6 +1397,10 @@
                 };
 
                 tsadc {
+                        otp_gpio: otp-gpio {
+                                rockchip,pins = <0 10 RK_FUNC_GPIO &pcfg_pull_none>;
+                        };
+
                         otp_out: otp-out {
                                 rockchip,pins = <0 10 RK_FUNC_1 &pcfg_pull_none>;
                         };
diff --git a/arch/arm/boot/dts/sama5d35ek.dts b/arch/arm/boot/dts/sama5d35ek.dts
index d9a9aca1ccfd..e812f5c1bf70 100644
--- a/arch/arm/boot/dts/sama5d35ek.dts
+++ b/arch/arm/boot/dts/sama5d35ek.dts
@@ -49,7 +49,7 @@
                         label = "pb_user1";
                         gpios = <&pioE 27 GPIO_ACTIVE_HIGH>;
                         linux,code = <0x100>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index 15bbaf690047..2193637b9cd2 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -1300,7 +1300,7 @@
                         };
 
                         watchdog@fc068640 {
-                                compatible = "atmel,at91sam9260-wdt";
+                                compatible = "atmel,sama5d4-wdt";
                                 reg = <0xfc068640 0x10>;
                                 clocks = <&clk32k>;
                                 status = "disabled";
diff --git a/arch/arm/boot/dts/usb_a9260_common.dtsi b/arch/arm/boot/dts/usb_a9260_common.dtsi
index 12edafefd44a..9beea8976584 100644
--- a/arch/arm/boot/dts/usb_a9260_common.dtsi
+++ b/arch/arm/boot/dts/usb_a9260_common.dtsi
@@ -115,7 +115,7 @@
                         label = "user_pb";
                         gpios = <&pioB 10 GPIO_ACTIVE_LOW>;
                         linux,code = <28>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/usb_a9263.dts b/arch/arm/boot/dts/usb_a9263.dts
index 68c0de36c339..8cc6edb29694 100644
--- a/arch/arm/boot/dts/usb_a9263.dts
+++ b/arch/arm/boot/dts/usb_a9263.dts
@@ -143,7 +143,7 @@
                         label = "user_pb";
                         gpios = <&pioB 10 GPIO_ACTIVE_LOW>;
                         linux,code = <28>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
         };
 
diff --git a/arch/arm/boot/dts/vfxxx.dtsi b/arch/arm/boot/dts/vfxxx.dtsi
index 6736bae43a5b..0d5acc2cdc8e 100644
--- a/arch/arm/boot/dts/vfxxx.dtsi
+++ b/arch/arm/boot/dts/vfxxx.dtsi
@@ -158,7 +158,7 @@
                                 interrupts = <67 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks VF610_CLK_DSPI0>;
                                 clock-names = "dspi";
-                                spi-num-chipselects = <5>;
+                                spi-num-chipselects = <6>;
                                 status = "disabled";
                         };
 
@@ -170,7 +170,7 @@
                                 interrupts = <68 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks VF610_CLK_DSPI1>;
                                 clock-names = "dspi";
-                                spi-num-chipselects = <5>;
+                                spi-num-chipselects = <4>;
                                 status = "disabled";
                         };
 
@@ -461,6 +461,8 @@
                                 clock-names = "adc";
                                 #io-channel-cells = <1>;
                                 status = "disabled";
+                                fsl,adck-max-frequency = <30000000>, <40000000>,
+                                                        <20000000>;
                         };
 
                         esdhc0: esdhc@400b1000 {
@@ -472,8 +474,6 @@
                                         <&clks VF610_CLK_ESDHC0>;
                                 clock-names = "ipg", "ahb", "per";
                                 status = "disabled";
-                                fsl,adck-max-frequency = <30000000>, <40000000>,
-                                                        <20000000>;
                         };
 
                         esdhc1: esdhc@400b2000 {
diff --git a/arch/arm/configs/at91_dt_defconfig b/arch/arm/configs/at91_dt_defconfig
index 1b1e5acd76e2..e4b1be66b3f5 100644
--- a/arch/arm/configs/at91_dt_defconfig
+++ b/arch/arm/configs/at91_dt_defconfig
@@ -125,7 +125,6 @@ CONFIG_POWER_RESET=y
 # CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_AT91SAM9X_WATCHDOG=y
-CONFIG_SSB=m
 CONFIG_MFD_ATMEL_HLCDC=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
diff --git a/arch/arm/configs/sama5_defconfig b/arch/arm/configs/sama5_defconfig
index a0c57ac88b27..63f7e6ce649a 100644
--- a/arch/arm/configs/sama5_defconfig
+++ b/arch/arm/configs/sama5_defconfig
@@ -129,7 +129,6 @@ CONFIG_GPIO_SYSFS=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_POWER_RESET=y
 # CONFIG_HWMON is not set
-CONFIG_SSB=m
 CONFIG_MFD_ATMEL_FLEXCOM=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h
index be1d07d59ee9..1bd9510de1b9 100644
--- a/arch/arm/include/asm/irq.h
+++ b/arch/arm/include/asm/irq.h
@@ -40,6 +40,11 @@ extern void arch_trigger_all_cpu_backtrace(bool);
 #define arch_trigger_all_cpu_backtrace(x) arch_trigger_all_cpu_backtrace(x)
 #endif
 
+static inline int nr_legacy_irqs(void)
+{
+        return NR_IRQS_LEGACY;
+}
+
 #endif
 
 #endif
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 7a2a32a1d5a8..ede692ffa32e 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -416,6 +416,7 @@
 #define __NR_execveat                   (__NR_SYSCALL_BASE+387)
 #define __NR_userfaultfd                (__NR_SYSCALL_BASE+388)
 #define __NR_membarrier                 (__NR_SYSCALL_BASE+389)
+#define __NR_mlock2                     (__NR_SYSCALL_BASE+390)
 
 /*
  * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/bios32.c b/arch/arm/kernel/bios32.c
index 6551d28c27e6..066f7f9ba411 100644
--- a/arch/arm/kernel/bios32.c
+++ b/arch/arm/kernel/bios32.c
@@ -17,11 +17,6 @@
 #include <asm/mach/pci.h>
 
 static int debug_pci;
-static resource_size_t (*align_resource)(struct pci_dev *dev,
-                  const struct resource *res,
-                  resource_size_t start,
-                  resource_size_t size,
-                  resource_size_t align) = NULL;
 
 /*
  * We can't use pci_get_device() here since we are
@@ -461,7 +456,6 @@ static void pcibios_init_hw(struct device *parent, struct hw_pci *hw,
                 sys->busnr   = busnr;
                 sys->swizzle = hw->swizzle;
                 sys->map_irq = hw->map_irq;
-                align_resource = hw->align_resource;
                 INIT_LIST_HEAD(&sys->resources);
 
                 if (hw->private_data)
@@ -470,6 +464,8 @@ static void pcibios_init_hw(struct device *parent, struct hw_pci *hw,
                 ret = hw->setup(nr, sys);
 
                 if (ret > 0) {
+                        struct pci_host_bridge *host_bridge;
+
                         ret = pcibios_init_resources(nr, sys);
                         if (ret)  {
                                 kfree(sys);
@@ -491,6 +487,9 @@ static void pcibios_init_hw(struct device *parent, struct hw_pci *hw,
                         busnr = sys->bus->busn_res.end + 1;
 
                         list_add(&sys->node, head);
+
+                        host_bridge = pci_find_host_bridge(sys->bus);
+                        host_bridge->align_resource = hw->align_resource;
                 } else {
                         kfree(sys);
                         if (ret < 0)
@@ -578,14 +577,18 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
 {
         struct pci_dev *dev = data;
         resource_size_t start = res->start;
+        struct pci_host_bridge *host_bridge;
 
         if (res->flags & IORESOURCE_IO && start & 0x300)
                 start = (start + 0x3ff) & ~0x3ff;
 
         start = (start + align - 1) & ~(align - 1);
 
-        if (align_resource)
-                return align_resource(dev, res, start, size, align);
+        host_bridge = pci_find_host_bridge(dev->bus);
+
+        if (host_bridge->align_resource)
+                return host_bridge->align_resource(dev, res,
+                                start, size, align);
 
         return start;
 }
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index fde6c88d560c..ac368bb068d1 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -399,6 +399,7 @@
                 CALL(sys_execveat)
                 CALL(sys_userfaultfd)
                 CALL(sys_membarrier)
+                CALL(sys_mlock2)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index eab83b2435b8..e06fd299de08 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -564,17 +564,12 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                         vcpu_sleep(vcpu);
 
                 /*
-                 * Disarming the background timer must be done in a
-                 * preemptible context, as this call may sleep.
-                 */
-                kvm_timer_flush_hwstate(vcpu);
-
-                /*
                  * Preparing the interrupts to be injected also
                  * involves poking the GIC, which must be done in a
                  * non-preemptible context.
                  */
                 preempt_disable();
+                kvm_timer_flush_hwstate(vcpu);
                 kvm_vgic_flush_hwstate(vcpu);
 
                 local_irq_disable();
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 6984342da13d..7dace909d5cf 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -98,6 +98,11 @@ static void kvm_flush_dcache_pud(pud_t pud)
         __kvm_flush_dcache_pud(pud);
 }
 
+static bool kvm_is_device_pfn(unsigned long pfn)
+{
+        return !pfn_valid(pfn);
+}
+
 /**
  * stage2_dissolve_pmd() - clear and flush huge PMD entry
  * @kvm:        pointer to kvm structure.
@@ -213,7 +218,7 @@ static void unmap_ptes(struct kvm *kvm, pmd_t *pmd,
                         kvm_tlb_flush_vmid_ipa(kvm, addr);
 
                         /* No need to invalidate the cache for device mappings */
-                        if ((pte_val(old_pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                        if (!kvm_is_device_pfn(__phys_to_pfn(addr)))
                                 kvm_flush_dcache_pte(old_pte);
 
                         put_page(virt_to_page(pte));
@@ -305,8 +310,7 @@ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
 
         pte = pte_offset_kernel(pmd, addr);
         do {
-                if (!pte_none(*pte) &&
-                    (pte_val(*pte) & PAGE_S2_DEVICE) != PAGE_S2_DEVICE)
+                if (!pte_none(*pte) && !kvm_is_device_pfn(__phys_to_pfn(addr)))
                         kvm_flush_dcache_pte(*pte);
         } while (pte++, addr += PAGE_SIZE, addr != end);
 }
@@ -1037,11 +1041,6 @@ static bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
         return kvm_vcpu_dabt_iswrite(vcpu);
 }
 
-static bool kvm_is_device_pfn(unsigned long pfn)
-{
-        return !pfn_valid(pfn);
-}
-
 /**
  * stage2_wp_ptes - write protect PMD range
  * @pmd:        pointer to pmd entry
diff --git a/arch/arm/mach-dove/include/mach/entry-macro.S b/arch/arm/mach-dove/include/mach/entry-macro.S
index 72d622baaad3..df1d44bdc375 100644
--- a/arch/arm/mach-dove/include/mach/entry-macro.S
+++ b/arch/arm/mach-dove/include/mach/entry-macro.S
@@ -18,13 +18,13 @@
         @ check low interrupts
         ldr     \irqstat, [\base, #IRQ_CAUSE_LOW_OFF]
         ldr     \tmp, [\base, #IRQ_MASK_LOW_OFF]
-        mov     \irqnr, #31
+        mov     \irqnr, #32
         ands    \irqstat, \irqstat, \tmp
 
         @ if no low interrupts set, check high interrupts
         ldreq   \irqstat, [\base, #IRQ_CAUSE_HIGH_OFF]
         ldreq   \tmp, [\base, #IRQ_MASK_HIGH_OFF]
-        moveq   \irqnr, #63
+        moveq   \irqnr, #64
         andeqs  \irqstat, \irqstat, \tmp
 
         @ find first active interrupt source
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index 8e7976a4c3e7..cfc696b972f3 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -177,6 +177,7 @@ static struct irq_chip imx_gpc_chip = {
         .irq_unmask             = imx_gpc_irq_unmask,
         .irq_retrigger          = irq_chip_retrigger_hierarchy,
         .irq_set_wake           = imx_gpc_irq_set_wake,
+        .irq_set_type           = irq_chip_set_type_parent,
 #ifdef CONFIG_SMP
         .irq_set_affinity       = irq_chip_set_affinity_parent,
 #endif
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 5305ec7341ec..79e1f876d1c9 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -143,9 +143,9 @@ static int omap4_boot_secondary(unsigned int cpu, struct task_struct *idle)
                  * Ensure that CPU power state is set to ON to avoid CPU
                  * powerdomain transition on wfi
                  */
-                clkdm_wakeup(cpu1_clkdm);
-                omap_set_pwrdm_state(cpu1_pwrdm, PWRDM_POWER_ON);
-                clkdm_allow_idle(cpu1_clkdm);
+                clkdm_wakeup_nolock(cpu1_clkdm);
+                pwrdm_set_next_pwrst(cpu1_pwrdm, PWRDM_POWER_ON);
+                clkdm_allow_idle_nolock(cpu1_clkdm);
 
                 if (IS_PM44XX_ERRATUM(PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD)) {
                         while (gic_dist_disabled()) {
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index cc8a987149e2..48495ad82aba 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -890,6 +890,36 @@ static int _init_opt_clks(struct omap_hwmod *oh)
         return ret;
 }
 
+static void _enable_optional_clocks(struct omap_hwmod *oh)
+{
+        struct omap_hwmod_opt_clk *oc;
+        int i;
+
+        pr_debug("omap_hwmod: %s: enabling optional clocks\n", oh->name);
+
+        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
+                if (oc->_clk) {
+                        pr_debug("omap_hwmod: enable %s:%s\n", oc->role,
+                                 __clk_get_name(oc->_clk));
+                        clk_enable(oc->_clk);
+                }
+}
+
+static void _disable_optional_clocks(struct omap_hwmod *oh)
+{
+        struct omap_hwmod_opt_clk *oc;
+        int i;
+
+        pr_debug("omap_hwmod: %s: disabling optional clocks\n", oh->name);
+
+        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
+                if (oc->_clk) {
+                        pr_debug("omap_hwmod: disable %s:%s\n", oc->role,
+                                 __clk_get_name(oc->_clk));
+                        clk_disable(oc->_clk);
+                }
+}
+
 /**
  * _enable_clocks - enable hwmod main clock and interface clocks
  * @oh: struct omap_hwmod *
@@ -917,6 +947,9 @@ static int _enable_clocks(struct omap_hwmod *oh)
                         clk_enable(os->_clk);
         }
 
+        if (oh->flags & HWMOD_OPT_CLKS_NEEDED)
+                _enable_optional_clocks(oh);
+
         /* The opt clocks are controlled by the device driver. */
 
         return 0;
@@ -948,41 +981,14 @@ static int _disable_clocks(struct omap_hwmod *oh)
                         clk_disable(os->_clk);
         }
 
+        if (oh->flags & HWMOD_OPT_CLKS_NEEDED)
+                _disable_optional_clocks(oh);
+
         /* The opt clocks are controlled by the device driver. */
 
         return 0;
 }
 
-static void _enable_optional_clocks(struct omap_hwmod *oh)
-{
-        struct omap_hwmod_opt_clk *oc;
-        int i;
-
-        pr_debug("omap_hwmod: %s: enabling optional clocks\n", oh->name);
-
-        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
-                if (oc->_clk) {
-                        pr_debug("omap_hwmod: enable %s:%s\n", oc->role,
-                                 __clk_get_name(oc->_clk));
-                        clk_enable(oc->_clk);
-                }
-}
-
-static void _disable_optional_clocks(struct omap_hwmod *oh)
-{
-        struct omap_hwmod_opt_clk *oc;
-        int i;
-
-        pr_debug("omap_hwmod: %s: disabling optional clocks\n", oh->name);
-
-        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
-                if (oc->_clk) {
-                        pr_debug("omap_hwmod: disable %s:%s\n", oc->role,
-                                 __clk_get_name(oc->_clk));
-                        clk_disable(oc->_clk);
-                }
-}
-
 /**
  * _omap4_enable_module - enable CLKCTRL modulemode on OMAP4
  * @oh: struct omap_hwmod *
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index ca6df1a73475..76bce11c85a4 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -523,6 +523,8 @@ struct omap_hwmod_omap4_prcm {
  * HWMOD_RECONFIG_IO_CHAIN: omap_hwmod code needs to reconfigure wake-up 
  *     events by calling _reconfigure_io_chain() when a device is enabled
  *     or idled.
+ * HWMOD_OPT_CLKS_NEEDED: The optional clocks are needed for the module to
+ *     operate and they need to be handled at the same time as the main_clk.
  */
 #define HWMOD_SWSUP_SIDLE                       (1 << 0)
 #define HWMOD_SWSUP_MSTANDBY                    (1 << 1)
@@ -538,6 +540,7 @@ struct omap_hwmod_omap4_prcm {
 #define HWMOD_FORCE_MSTANDBY                    (1 << 11)
 #define HWMOD_SWSUP_SIDLE_ACT                   (1 << 12)
 #define HWMOD_RECONFIG_IO_CHAIN                 (1 << 13)
+#define HWMOD_OPT_CLKS_NEEDED                   (1 << 14)
 
 /*
  * omap_hwmod._int_flags definitions
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 51d1ecb384bd..ee4e04434a94 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1298,6 +1298,44 @@ static struct omap_hwmod dra7xx_mcspi4_hwmod = {
 };
 
 /*
+ * 'mcasp' class
+ *
+ */
+static struct omap_hwmod_class_sysconfig dra7xx_mcasp_sysc = {
+        .sysc_offs      = 0x0004,
+        .sysc_flags     = SYSC_HAS_SIDLEMODE,
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+        .sysc_fields    = &omap_hwmod_sysc_type3,
+};
+
+static struct omap_hwmod_class dra7xx_mcasp_hwmod_class = {
+        .name   = "mcasp",
+        .sysc   = &dra7xx_mcasp_sysc,
+};
+
+/* mcasp3 */
+static struct omap_hwmod_opt_clk mcasp3_opt_clks[] = {
+        { .role = "ahclkx", .clk = "mcasp3_ahclkx_mux" },
+};
+
+static struct omap_hwmod dra7xx_mcasp3_hwmod = {
+        .name           = "mcasp3",
+        .class          = &dra7xx_mcasp_hwmod_class,
+        .clkdm_name     = "l4per2_clkdm",
+        .main_clk       = "mcasp3_aux_gfclk_mux",
+        .flags          = HWMOD_OPT_CLKS_NEEDED,
+        .prcm = {
+                .omap4 = {
+                        .clkctrl_offs = DRA7XX_CM_L4PER2_MCASP3_CLKCTRL_OFFSET,
+                        .context_offs = DRA7XX_RM_L4PER2_MCASP3_CONTEXT_OFFSET,
+                        .modulemode   = MODULEMODE_SWCTRL,
+                },
+        },
+        .opt_clks       = mcasp3_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(mcasp3_opt_clks),
+};
+
+/*
  * 'mmc' class
  *
  */
@@ -2566,6 +2604,22 @@ static struct omap_hwmod_ocp_if dra7xx_l3_main_1__hdmi = {
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
+/* l4_per2 -> mcasp3 */
+static struct omap_hwmod_ocp_if dra7xx_l4_per2__mcasp3 = {
+        .master         = &dra7xx_l4_per2_hwmod,
+        .slave          = &dra7xx_mcasp3_hwmod,
+        .clk            = "l4_root_clk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
+
+/* l3_main_1 -> mcasp3 */
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__mcasp3 = {
+        .master         = &dra7xx_l3_main_1_hwmod,
+        .slave          = &dra7xx_mcasp3_hwmod,
+        .clk            = "l3_iclk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
+
 /* l4_per1 -> elm */
 static struct omap_hwmod_ocp_if dra7xx_l4_per1__elm = {
         .master         = &dra7xx_l4_per1_hwmod,
@@ -3308,6 +3362,8 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l4_wkup__dcan1,
         &dra7xx_l4_per2__dcan2,
         &dra7xx_l4_per2__cpgmac0,
+        &dra7xx_l4_per2__mcasp3,
+        &dra7xx_l3_main_1__mcasp3,
         &dra7xx_gmac__mdio,
         &dra7xx_l4_cfg__dma_system,
         &dra7xx_l3_main_1__dss,
diff --git a/arch/arm/mach-omap2/omap_hwmod_81xx_data.c b/arch/arm/mach-omap2/omap_hwmod_81xx_data.c
index b1288f56d509..6256052893ec 100644
--- a/arch/arm/mach-omap2/omap_hwmod_81xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_81xx_data.c
@@ -144,6 +144,7 @@ static struct omap_hwmod dm81xx_l4_ls_hwmod = {
         .name           = "l4_ls",
         .clkdm_name     = "alwon_l3s_clkdm",
         .class          = &l4_hwmod_class,
+        .flags          = HWMOD_NO_IDLEST,
 };
 
 /*
@@ -155,6 +156,7 @@ static struct omap_hwmod dm81xx_l4_hs_hwmod = {
         .name           = "l4_hs",
         .clkdm_name     = "alwon_l3_med_clkdm",
         .class          = &l4_hwmod_class,
+        .flags          = HWMOD_NO_IDLEST,
 };
 
 /* L3 slow -> L4 ls peripheral interface running at 125MHz */
@@ -850,6 +852,7 @@ static struct omap_hwmod dm816x_emac0_hwmod = {
         .name           = "emac0",
         .clkdm_name     = "alwon_ethernet_clkdm",
         .class          = &dm816x_emac_hwmod_class,
+        .flags          = HWMOD_NO_IDLEST,
 };
 
 static struct omap_hwmod_ocp_if dm81xx_l4_hs__emac0 = {
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 1dfe34654c43..58144779dec4 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -24,9 +24,6 @@
 #include <linux/platform_data/iommu-omap.h>
 #include <linux/platform_data/wkup_m3.h>
 
-#include <asm/siginfo.h>
-#include <asm/signal.h>
-
 #include "common.h"
 #include "common-board-devices.h"
 #include "dss-common.h"
@@ -385,29 +382,6 @@ static void __init omap3_pandora_legacy_init(void)
 }
 #endif /* CONFIG_ARCH_OMAP3 */
 
-#ifdef CONFIG_SOC_TI81XX
-static int fault_fixed_up;
-
-static int t410_abort_handler(unsigned long addr, unsigned int fsr,
-                              struct pt_regs *regs)
-{
-        if ((fsr == 0x406 || fsr == 0xc06) && !fault_fixed_up) {
-                pr_warn("External imprecise Data abort at addr=%#lx, fsr=%#x ignored.\n",
-                        addr, fsr);
-                fault_fixed_up = 1;
-                return 0;
-        }
-
-        return 1;
-}
-
-static void __init t410_abort_init(void)
-{
-        hook_fault_code(16 + 6, t410_abort_handler, SIGBUS, BUS_OBJERR,
-                        "imprecise external abort");
-}
-#endif
-
 #if defined(CONFIG_ARCH_OMAP4) || defined(CONFIG_SOC_OMAP5)
 static struct iommu_platform_data omap4_iommu_pdata = {
         .reset_name = "mmu_cache",
@@ -536,9 +510,6 @@ static struct pdata_init pdata_quirks[] __initdata = {
         { "openpandora,omap3-pandora-600mhz", omap3_pandora_legacy_init, },
         { "openpandora,omap3-pandora-1ghz", omap3_pandora_legacy_init, },
 #endif
-#ifdef CONFIG_SOC_TI81XX
-        { "hp,t410", t410_abort_init, },
-#endif
 #ifdef CONFIG_SOC_OMAP5
         { "ti,omap5-uevm", omap5_uevm_legacy_init, },
 #endif
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 87b98bf92366..2dbd3785ee6f 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -301,11 +301,11 @@ static void omap3_pm_idle(void)
         if (omap_irq_pending())
                 return;
 
-        trace_cpu_idle(1, smp_processor_id());
+        trace_cpu_idle_rcuidle(1, smp_processor_id());
 
         omap_sram_idle();
 
-        trace_cpu_idle(PWR_EVENT_EXIT, smp_processor_id());
+        trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
 }
 
 #ifdef CONFIG_SUSPEND
diff --git a/arch/arm/mach-orion5x/include/mach/entry-macro.S b/arch/arm/mach-orion5x/include/mach/entry-macro.S
index 79eb502a1e64..73919a36b577 100644
--- a/arch/arm/mach-orion5x/include/mach/entry-macro.S
+++ b/arch/arm/mach-orion5x/include/mach/entry-macro.S
@@ -21,5 +21,5 @@
         @ find cause bits that are unmasked
         ands    \irqstat, \irqstat, \tmp        @ clear Z flag if any
         clzne   \irqnr, \irqstat                @ calc irqnr
-        rsbne   \irqnr, \irqnr, #31
+        rsbne   \irqnr, \irqnr, #32
         .endm
diff --git a/arch/arm/mach-pxa/palm27x.c b/arch/arm/mach-pxa/palm27x.c
index 13eba2b26e0a..8fbfb10047ec 100644
--- a/arch/arm/mach-pxa/palm27x.c
+++ b/arch/arm/mach-pxa/palm27x.c
@@ -344,7 +344,7 @@ void __init palm27x_pwm_init(int bl, int lcd)
 {
         palm_bl_power   = bl;
         palm_lcd_power  = lcd;
-        pwm_add_lookup(palm27x_pwm_lookup, ARRAY_SIZE(palm27x_pwm_lookup));
+        pwm_add_table(palm27x_pwm_lookup, ARRAY_SIZE(palm27x_pwm_lookup));
         platform_device_register(&palm27x_backlight);
 }
 #endif
diff --git a/arch/arm/mach-pxa/palmtc.c b/arch/arm/mach-pxa/palmtc.c
index aebf6de62468..0b5c3876720c 100644
--- a/arch/arm/mach-pxa/palmtc.c
+++ b/arch/arm/mach-pxa/palmtc.c
@@ -169,7 +169,7 @@ static inline void palmtc_keys_init(void) {}
 #if defined(CONFIG_BACKLIGHT_PWM) || defined(CONFIG_BACKLIGHT_PWM_MODULE)
 static struct pwm_lookup palmtc_pwm_lookup[] = {
         PWM_LOOKUP("pxa25x-pwm.1", 0, "pwm-backlight.0", NULL, PALMTC_PERIOD_NS,
-                   PWM_PERIOD_NORMAL),
+                   PWM_POLARITY_NORMAL),
 };
 
 static struct platform_pwm_backlight_data palmtc_backlight_data = {
diff --git a/arch/arm/mach-shmobile/setup-r8a7793.c b/arch/arm/mach-shmobile/setup-r8a7793.c
index 1d2825cb7a65..5fce87f7f254 100644
--- a/arch/arm/mach-shmobile/setup-r8a7793.c
+++ b/arch/arm/mach-shmobile/setup-r8a7793.c
@@ -19,7 +19,7 @@
 #include "common.h"
 #include "rcar-gen2.h"
 
-static const char *r8a7793_boards_compat_dt[] __initconst = {
+static const char * const r8a7793_boards_compat_dt[] __initconst = {
         "renesas,r8a7793",
         NULL,
 };
diff --git a/arch/arm/mach-zx/Kconfig b/arch/arm/mach-zx/Kconfig
index 7fdc5bf24f9b..446334a25cf5 100644
--- a/arch/arm/mach-zx/Kconfig
+++ b/arch/arm/mach-zx/Kconfig
@@ -13,7 +13,7 @@ config SOC_ZX296702
         select ARM_GLOBAL_TIMER
         select HAVE_ARM_SCU if SMP
         select HAVE_ARM_TWD if SMP
-        select PM_GENERIC_DOMAINS
+        select PM_GENERIC_DOMAINS if PM
         help
           Support for ZTE ZX296702 SoC which is a dual core CortexA9MP
 endif
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 2f4b14cfddb4..591f9db3bf40 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -1061,7 +1061,7 @@ void bpf_jit_compile(struct bpf_prog *fp)
         }
         build_epilogue(&ctx);
 
-        flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx));
+        flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));
 
 #if __LINUX_ARM_ARCH__ < 7
         if (ctx.imm_count)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 9ac16a482ff1..871f21783866 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -49,7 +49,7 @@ config ARM64
         select HAVE_ARCH_AUDITSYSCALL
         select HAVE_ARCH_BITREVERSE
         select HAVE_ARCH_JUMP_LABEL
-        select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP
+        select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_SECCOMP_FILTER
         select HAVE_ARCH_TRACEHOOK
@@ -316,6 +316,27 @@ config ARM64_ERRATUM_832075
 
           If unsure, say Y.
 
+config ARM64_ERRATUM_834220
+        bool "Cortex-A57: 834220: Stage 2 translation fault might be incorrectly reported in presence of a Stage 1 fault"
+        depends on KVM
+        default y
+        help
+          This option adds an alternative code sequence to work around ARM
+          erratum 834220 on Cortex-A57 parts up to r1p2.
+
+          Affected Cortex-A57 parts might report a Stage 2 translation
+          fault as the result of a Stage 1 fault for load crossing a
+          page boundary when there is a permission or device memory
+          alignment fault at Stage 1 and a translation fault at Stage 2.
+
+          The workaround is to verify that the Stage 1 translation
+          doesn't generate a fault before handling the Stage 2 fault.
+          Please note that this does not necessarily enable the workaround,
+          as it depends on the alternative framework, which will only patch
+          the kernel if an affected CPU is detected.
+
+          If unsure, say Y.
+
 config ARM64_ERRATUM_845719
         bool "Cortex-A53: 845719: a load might read incorrect data"
         depends on COMPAT
diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c
index ce47792a983d..f7bd9bf0bbb3 100644
--- a/arch/arm64/crypto/aes-ce-cipher.c
+++ b/arch/arm64/crypto/aes-ce-cipher.c
@@ -237,7 +237,7 @@ EXPORT_SYMBOL(ce_aes_setkey);
 static struct crypto_alg aes_alg = {
         .cra_name               = "aes",
         .cra_driver_name        = "aes-ce",
-        .cra_priority           = 300,
+        .cra_priority           = 250,
         .cra_flags              = CRYPTO_ALG_TYPE_CIPHER,
         .cra_blocksize          = AES_BLOCK_SIZE,
         .cra_ctxsize            = sizeof(struct crypto_aes_ctx),
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index 624f9679f4b0..9622eb48f894 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -64,27 +64,31 @@ do {									\
 
 #define smp_load_acquire(p)                                             \
 ({                                                                      \
-        typeof(*p) ___p1;                                               \
+        union { typeof(*p) __val; char __c[1]; } __u;                   \
         compiletime_assert_atomic_type(*p);                             \
         switch (sizeof(*p)) {                                           \
         case 1:                                                         \
                 asm volatile ("ldarb %w0, %1"                           \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u8 *)__u.__c)                       \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 2:                                                         \
                 asm volatile ("ldarh %w0, %1"                           \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u16 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 4:                                                         \
                 asm volatile ("ldar %w0, %1"                            \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u32 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         case 8:                                                         \
                 asm volatile ("ldar %0, %1"                             \
-                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                        : "=r" (*(__u64 *)__u.__c)                      \
+                        : "Q" (*p) : "memory");                         \
                 break;                                                  \
         }                                                               \
-        ___p1;                                                          \
+        __u.__val;                                                      \
 })
 
 #define read_barrier_depends()          do { } while(0)
diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
index 7fbed6919b54..eb8432bb82b8 100644
--- a/arch/arm64/include/asm/compat.h
+++ b/arch/arm64/include/asm/compat.h
@@ -23,7 +23,6 @@
  */
 #include <linux/types.h>
 #include <linux/sched.h>
-#include <linux/ptrace.h>
 
 #define COMPAT_USER_HZ          100
 #ifdef __AARCH64EB__
@@ -234,7 +233,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-#define compat_user_stack_pointer() (user_stack_pointer(current_pt_regs()))
+#define compat_user_stack_pointer() (user_stack_pointer(task_pt_regs(current)))
 
 static inline void __user *arch_compat_alloc_user_space(long len)
 {
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 11d5bb0fdd54..8f271b83f910 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -29,8 +29,9 @@
 #define ARM64_HAS_PAN                           4
 #define ARM64_HAS_LSE_ATOMICS                   5
 #define ARM64_WORKAROUND_CAVIUM_23154           6
+#define ARM64_WORKAROUND_834220                 7
 
-#define ARM64_NCAPS                             7
+#define ARM64_NCAPS                             8
 
 #ifndef __ASSEMBLY__
 
@@ -46,8 +47,12 @@ enum ftr_type {
 #define FTR_STRICT      true    /* SANITY check strict matching required */
 #define FTR_NONSTRICT   false   /* SANITY check ignored */
 
+#define FTR_SIGNED      true    /* Value should be treated as signed */
+#define FTR_UNSIGNED    false   /* Value should be treated as unsigned */
+
 struct arm64_ftr_bits {
-        bool            strict;   /* CPU Sanity check: strict matching required ? */
+        bool            sign;   /* Value is signed ? */
+        bool            strict; /* CPU Sanity check: strict matching required ? */
         enum ftr_type   type;
         u8              shift;
         u8              width;
@@ -123,6 +128,18 @@ cpuid_feature_extract_field(u64 features, int field)
         return cpuid_feature_extract_field_width(features, field, 4);
 }
 
+static inline unsigned int __attribute_const__
+cpuid_feature_extract_unsigned_field_width(u64 features, int field, int width)
+{
+        return (u64)(features << (64 - width - field)) >> (64 - width);
+}
+
+static inline unsigned int __attribute_const__
+cpuid_feature_extract_unsigned_field(u64 features, int field)
+{
+        return cpuid_feature_extract_unsigned_field_width(features, field, 4);
+}
+
 static inline u64 arm64_ftr_mask(struct arm64_ftr_bits *ftrp)
 {
         return (u64)GENMASK(ftrp->shift + ftrp->width - 1, ftrp->shift);
@@ -130,7 +147,9 @@ static inline u64 arm64_ftr_mask(struct arm64_ftr_bits *ftrp)
 
 static inline s64 arm64_ftr_value(struct arm64_ftr_bits *ftrp, u64 val)
 {
-        return cpuid_feature_extract_field_width(val, ftrp->shift, ftrp->width);
+        return ftrp->sign ?
+                cpuid_feature_extract_field_width(val, ftrp->shift, ftrp->width) :
+                cpuid_feature_extract_unsigned_field_width(val, ftrp->shift, ftrp->width);
 }
 
 static inline bool id_aa64mmfr0_mixed_endian_el0(u64 mmfr0)
diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index 54d0ead41afc..61e08f360e31 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -18,7 +18,6 @@
 
 #ifdef __KERNEL__
 
-#include <linux/acpi.h>
 #include <linux/types.h>
 #include <linux/vmalloc.h>
 
@@ -26,22 +25,16 @@
 #include <asm/xen/hypervisor.h>
 
 #define DMA_ERROR_CODE  (~(dma_addr_t)0)
-extern struct dma_map_ops *dma_ops;
 extern struct dma_map_ops dummy_dma_ops;
 
 static inline struct dma_map_ops *__generic_dma_ops(struct device *dev)
 {
-        if (unlikely(!dev))
-                return dma_ops;
-        else if (dev->archdata.dma_ops)
+        if (dev && dev->archdata.dma_ops)
                 return dev->archdata.dma_ops;
-        else if (acpi_disabled)
-                return dma_ops;
 
         /*
-         * When ACPI is enabled, if arch_set_dma_ops is not called,
-         * we will disable device DMA capability by setting it
-         * to dummy_dma_ops.
+         * We expect no ISA devices, and all other DMA masters are expected to
+         * have someone call arch_setup_dma_ops at device creation time.
          */
         return &dummy_dma_ops;
 }
diff --git a/arch/arm64/include/asm/hw_breakpoint.h b/arch/arm64/include/asm/hw_breakpoint.h
index e54415ec6935..9732908bfc8a 100644
--- a/arch/arm64/include/asm/hw_breakpoint.h
+++ b/arch/arm64/include/asm/hw_breakpoint.h
@@ -138,16 +138,18 @@ extern struct pmu perf_ops_bp;
 /* Determine number of BRP registers available. */
 static inline int get_num_brps(void)
 {
+        u64 dfr0 = read_system_reg(SYS_ID_AA64DFR0_EL1);
         return 1 +
-                cpuid_feature_extract_field(read_system_reg(SYS_ID_AA64DFR0_EL1),
+                cpuid_feature_extract_unsigned_field(dfr0,
                                                 ID_AA64DFR0_BRPS_SHIFT);
 }
 
 /* Determine number of WRP registers available. */
 static inline int get_num_wrps(void)
 {
+        u64 dfr0 = read_system_reg(SYS_ID_AA64DFR0_EL1);
         return 1 +
-                cpuid_feature_extract_field(read_system_reg(SYS_ID_AA64DFR0_EL1),
+                cpuid_feature_extract_unsigned_field(dfr0,
                                                 ID_AA64DFR0_WRPS_SHIFT);
 }
 
diff --git a/arch/arm64/include/asm/irq.h b/arch/arm64/include/asm/irq.h
index 23eb450b820b..8e8d30684392 100644
--- a/arch/arm64/include/asm/irq.h
+++ b/arch/arm64/include/asm/irq.h
@@ -7,4 +7,9 @@ struct pt_regs;
 
 extern void set_handle_irq(void (*handle_irq)(struct pt_regs *));
 
+static inline int nr_legacy_irqs(void)
+{
+        return 0;
+}
+
 #endif
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 17e92f05b1fe..3ca894ecf699 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -99,11 +99,13 @@ static inline void vcpu_set_thumb(struct kvm_vcpu *vcpu)
         *vcpu_cpsr(vcpu) |= COMPAT_PSR_T_BIT;
 }
 
+/*
+ * vcpu_reg should always be passed a register number coming from a
+ * read of ESR_EL2. Otherwise, it may give the wrong result on AArch32
+ * with banked registers.
+ */
 static inline unsigned long *vcpu_reg(const struct kvm_vcpu *vcpu, u8 reg_num)
 {
-        if (vcpu_mode_is_32bit(vcpu))
-                return vcpu_reg32(vcpu, reg_num);
-
         return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.regs[reg_num];
 }
 
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index c0e87898ba96..24165784b803 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -101,7 +101,7 @@ static inline void cpu_set_default_tcr_t0sz(void)
 #define destroy_context(mm)             do { } while(0)
 void check_and_switch_context(struct mm_struct *mm, unsigned int cpu);
 
-#define init_new_context(tsk,mm)        ({ atomic64_set(&mm->context.id, 0); 0; })
+#define init_new_context(tsk,mm)        ({ atomic64_set(&(mm)->context.id, 0); 0; })
 
 /*
  * This is called when "tsk" is about to enter lazy TLB mode.
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 9819a9426b69..7e074f93f383 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -81,6 +81,7 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 
 #define PAGE_KERNEL             __pgprot(_PAGE_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE)
 #define PAGE_KERNEL_RO          __pgprot(_PAGE_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_RDONLY)
+#define PAGE_KERNEL_ROX __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_RDONLY)
 #define PAGE_KERNEL_EXEC        __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_WRITE)
 #define PAGE_KERNEL_EXEC_CONT   __pgprot(_PAGE_DEFAULT | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_CONT)
 
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 24926f2504f7..feb6b4efa641 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -75,6 +75,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                            (1 << MIDR_VARIANT_SHIFT) | 2),
         },
 #endif
+#ifdef CONFIG_ARM64_ERRATUM_834220
+        {
+        /* Cortex-A57 r0p0 - r1p2 */
+                .desc = "ARM erratum 834220",
+                .capability = ARM64_WORKAROUND_834220,
+                MIDR_RANGE(MIDR_CORTEX_A57, 0x00,
+                           (1 << MIDR_VARIANT_SHIFT) | 2),
+        },
+#endif
 #ifdef CONFIG_ARM64_ERRATUM_845719
         {
         /* Cortex-A53 r0p[01234] */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index c8cf89223b5a..0669c63281ea 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -44,8 +44,9 @@ unsigned int compat_elf_hwcap2 __read_mostly;
 
 DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
 
-#define ARM64_FTR_BITS(STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL) \
+#define __ARM64_FTR_BITS(SIGNED, STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL) \
         {                                               \
+                .sign = SIGNED,                         \
                 .strict = STRICT,                       \
                 .type = TYPE,                           \
                 .shift = SHIFT,                         \
@@ -53,6 +54,14 @@ DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
                 .safe_val = SAFE_VAL,                   \
         }
 
+/* Define a feature with signed values */
+#define ARM64_FTR_BITS(STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL) \
+        __ARM64_FTR_BITS(FTR_SIGNED, STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL)
+
+/* Define a feature with unsigned value */
+#define U_ARM64_FTR_BITS(STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL) \
+        __ARM64_FTR_BITS(FTR_UNSIGNED, STRICT, TYPE, SHIFT, WIDTH, SAFE_VAL)
+
 #define ARM64_FTR_END                                   \
         {                                               \
                 .width = 0,                             \
@@ -99,7 +108,7 @@ static struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
          * Differing PARange is fine as long as all peripherals and memory are mapped
          * within the minimum PARange of all CPUs
          */
-        ARM64_FTR_BITS(FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_PARANGE_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_PARANGE_SHIFT, 4, 0),
         ARM64_FTR_END,
 };
 
@@ -115,18 +124,18 @@ static struct arm64_ftr_bits ftr_id_aa64mmfr1[] = {
 };
 
 static struct arm64_ftr_bits ftr_ctr[] = {
-        ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 31, 1, 1),        /* RAO */
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 31, 1, 1),      /* RAO */
         ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 28, 3, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0),  /* CWG */
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),   /* ERG */
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1),   /* DminLine */
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0),        /* CWG */
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0), /* ERG */
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1), /* DminLine */
         /*
          * Linux can handle differing I-cache policies. Userspace JITs will
          * make use of *minLine
          */
-        ARM64_FTR_BITS(FTR_NONSTRICT, FTR_EXACT, 14, 2, 0),     /* L1Ip */
+        U_ARM64_FTR_BITS(FTR_NONSTRICT, FTR_EXACT, 14, 2, 0),   /* L1Ip */
         ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 4, 10, 0),        /* RAZ */
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 0, 4, 0),    /* IminLine */
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 0, 4, 0),  /* IminLine */
         ARM64_FTR_END,
 };
 
@@ -144,12 +153,12 @@ static struct arm64_ftr_bits ftr_id_mmfr0[] = {
 
 static struct arm64_ftr_bits ftr_id_aa64dfr0[] = {
         ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 32, 32, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_CTX_CMPS_SHIFT, 4, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_WRPS_SHIFT, 4, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_BRPS_SHIFT, 4, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_PMUVER_SHIFT, 4, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_TRACEVER_SHIFT, 4, 0),
-        ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_DEBUGVER_SHIFT, 4, 0x6),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_CTX_CMPS_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_WRPS_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, ID_AA64DFR0_BRPS_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_PMUVER_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_TRACEVER_SHIFT, 4, 0),
+        U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, ID_AA64DFR0_DEBUGVER_SHIFT, 4, 0x6),
         ARM64_FTR_END,
 };
 
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 706679d0a0b4..212ae6361d8b 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -30,6 +30,7 @@
 #include <linux/seq_file.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
+#include <linux/delay.h>
 
 /*
  * In case the boot CPU is hotpluggable, we record its initial state and
@@ -112,6 +113,10 @@ static int c_show(struct seq_file *m, void *v)
                  */
                 seq_printf(m, "processor\t: %d\n", i);
 
+                seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+                           loops_per_jiffy / (500000UL/HZ),
+                           loops_per_jiffy / (5000UL/HZ) % 100);
+
                 /*
                  * Dump out the common processor features in a single line.
                  * Userspace should read the hwcaps with getauxval(AT_HWCAP)
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index de46b50f4cdf..4eeb17198cfa 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -127,7 +127,11 @@ static int __init uefi_init(void)
         table_size = sizeof(efi_config_table_64_t) * efi.systab->nr_tables;
         config_tables = early_memremap(efi_to_phys(efi.systab->tables),
                                        table_size);
-
+        if (config_tables == NULL) {
+                pr_warn("Unable to map EFI config table array.\n");
+                retval = -ENOMEM;
+                goto out;
+        }
         retval = efi_config_parse_tables(config_tables, efi.systab->nr_tables,
                                          sizeof(efi_config_table_64_t), NULL);
 
@@ -209,6 +213,14 @@ void __init efi_init(void)
                          PAGE_ALIGN(params.mmap_size + (params.mmap & ~PAGE_MASK)));
         memmap.phys_map = params.mmap;
         memmap.map = early_memremap(params.mmap, params.mmap_size);
+        if (memmap.map == NULL) {
+                /*
+                * If we are booting via UEFI, the UEFI memory map is the only
+                * description of memory we have, so there is little point in
+                * proceeding if we cannot access it.
+                */
+                panic("Unable to map EFI memory map.\n");
+        }
         memmap.map_end = memmap.map + params.mmap_size;
         memmap.desc_size = params.desc_size;
         memmap.desc_version = params.desc_ver;
@@ -224,8 +236,9 @@ static bool __init efi_virtmap_init(void)
 {
         efi_memory_desc_t *md;
 
+        init_new_context(NULL, &efi_mm);
+
         for_each_efi_memory_desc(&memmap, md) {
-                u64 paddr, npages, size;
                 pgprot_t prot;
 
                 if (!(md->attribute & EFI_MEMORY_RUNTIME))
@@ -233,11 +246,6 @@ static bool __init efi_virtmap_init(void)
                 if (md->virt_addr == 0)
                         return false;
 
-                paddr = md->phys_addr;
-                npages = md->num_pages;
-                memrange_efi_to_native(&paddr, &npages);
-                size = npages << PAGE_SHIFT;
-
                 pr_info("  EFI remap 0x%016llx => %p\n",
                         md->phys_addr, (void *)md->virt_addr);
 
@@ -254,7 +262,9 @@ static bool __init efi_virtmap_init(void)
                 else
                         prot = PAGE_KERNEL;
 
-                create_pgd_mapping(&efi_mm, paddr, md->virt_addr, size, prot);
+                create_pgd_mapping(&efi_mm, md->phys_addr, md->virt_addr,
+                                   md->num_pages << EFI_PAGE_SHIFT, 
+                                   __pgprot(pgprot_val(prot) | PTE_NG));
         }
         return true;
 }
@@ -270,12 +280,12 @@ static int __init arm64_enable_runtime_services(void)
 
         if (!efi_enabled(EFI_BOOT)) {
                 pr_info("EFI services will not be available.\n");
-                return -1;
+                return 0;
         }
 
         if (efi_runtime_disabled()) {
                 pr_info("EFI runtime services will be disabled.\n");
-                return -1;
+                return 0;
         }
 
         pr_info("Remapping and enabling EFI services.\n");
@@ -285,7 +295,7 @@ static int __init arm64_enable_runtime_services(void)
                                                    mapsize);
         if (!memmap.map) {
                 pr_err("Failed to remap EFI memory map\n");
-                return -1;
+                return -ENOMEM;
         }
         memmap.map_end = memmap.map + mapsize;
         efi.memmap = &memmap;
@@ -294,13 +304,13 @@ static int __init arm64_enable_runtime_services(void)
                                                    sizeof(efi_system_table_t));
         if (!efi.systab) {
                 pr_err("Failed to remap EFI System Table\n");
-                return -1;
+                return -ENOMEM;
         }
         set_bit(EFI_SYSTEM_TABLES, &efi.flags);
 
         if (!efi_virtmap_init()) {
                 pr_err("No UEFI virtual mapping was installed -- runtime services will not be available\n");
-                return -1;
+                return -ENOMEM;
         }
 
         /* Set up runtime services function pointers */
@@ -329,14 +339,7 @@ core_initcall(arm64_dmi_init);
 
 static void efi_set_pgd(struct mm_struct *mm)
 {
-        if (mm == &init_mm)
-                cpu_set_reserved_ttbr0();
-        else
-                cpu_switch_mm(mm->pgd, mm);
-
-        local_flush_tlb_all();
-        if (icache_is_aivivt())
-                __local_flush_icache_all();
+        switch_mm(NULL, mm, NULL);
 }
 
 void efi_virtmap_load(void)
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index fce95e17cf7f..1095aa483a1c 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,3 +1,4 @@
+#include <linux/ftrace.h>
 #include <linux/percpu.h>
 #include <linux/slab.h>
 #include <asm/cacheflush.h>
@@ -71,6 +72,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
         local_dbg_save(flags);
 
         /*
+         * Function graph tracer state gets incosistent when the kernel
+         * calls functions that never return (aka suspend finishers) hence
+         * disable graph tracing during their execution.
+         */
+        pause_graph_tracing();
+
+        /*
          * mm context saved on the stack, it will be restored when
          * the cpu comes out of reset through the identity mapped
          * page tables, so that the thread address space is properly
@@ -111,6 +119,8 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
                         hw_breakpoint_restore(NULL);
         }
 
+        unpause_graph_tracing();
+
         /*
          * Restore pstate flags. OS lock and mdscr have been already
          * restored, so from this point onwards, debugging is fully
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index 1599701ef044..86c289832272 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -864,6 +864,10 @@ ENTRY(__kvm_flush_vm_context)
 ENDPROC(__kvm_flush_vm_context)
 
 __kvm_hyp_panic:
+        // Stash PAR_EL1 before corrupting it in __restore_sysregs
+        mrs     x0, par_el1
+        push    x0, xzr
+
         // Guess the context by looking at VTTBR:
         // If zero, then we're already a host.
         // Otherwise restore a minimal host context before panicing.
@@ -898,7 +902,7 @@ __kvm_hyp_panic:
         mrs     x3, esr_el2
         mrs     x4, far_el2
         mrs     x5, hpfar_el2
-        mrs     x6, par_el1
+        pop     x6, xzr         // active context PAR_EL1
         mrs     x7, tpidr_el2
 
         mov     lr, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\
@@ -914,7 +918,7 @@ __kvm_hyp_panic:
 ENDPROC(__kvm_hyp_panic)
 
 __hyp_panic_str:
-        .ascii  "HYP panic:\nPS:%08x PC:%p ESR:%p\nFAR:%p HPFAR:%p PAR:%p\nVCPU:%p\n\0"
+        .ascii  "HYP panic:\nPS:%08x PC:%016x ESR:%08x\nFAR:%016x HPFAR:%016x PAR:%016x\nVCPU:%p\n\0"
 
         .align  2
 
@@ -1015,9 +1019,15 @@ el1_trap:
         b.ne    1f              // Not an abort we care about
 
         /* This is an abort. Check for permission fault */
+alternative_if_not ARM64_WORKAROUND_834220
         and     x2, x1, #ESR_ELx_FSC_TYPE
         cmp     x2, #FSC_PERM
         b.ne    1f              // Not a permission fault
+alternative_else
+        nop                     // Use the permission fault path to
+        nop                     // check for a valid S1 translation,
+        nop                     // regardless of the ESR value.
+alternative_endif
 
         /*
          * Check for Stage-1 page table walk, which is guaranteed
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index 85c57158dcd9..648112e90ed5 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -48,7 +48,7 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
 
         /* Note: These now point to the banked copies */
         *vcpu_spsr(vcpu) = new_spsr_value;
-        *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
+        *vcpu_reg32(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
 
         /* Branch to exception vector */
         if (sctlr & (1 << 13))
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index f636a2639f03..e87f53ff5f58 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -76,13 +76,28 @@ static void flush_context(unsigned int cpu)
                 __flush_icache_all();
 }
 
-static int is_reserved_asid(u64 asid)
+static bool check_update_reserved_asid(u64 asid, u64 newasid)
 {
         int cpu;
-        for_each_possible_cpu(cpu)
-                if (per_cpu(reserved_asids, cpu) == asid)
-                        return 1;
-        return 0;
+        bool hit = false;
+
+        /*
+         * Iterate over the set of reserved ASIDs looking for a match.
+         * If we find one, then we can update our mm to use newasid
+         * (i.e. the same ASID in the current generation) but we can't
+         * exit the loop early, since we need to ensure that all copies
+         * of the old ASID are updated to reflect the mm. Failure to do
+         * so could result in us missing the reserved ASID in a future
+         * generation.
+         */
+        for_each_possible_cpu(cpu) {
+                if (per_cpu(reserved_asids, cpu) == asid) {
+                        hit = true;
+                        per_cpu(reserved_asids, cpu) = newasid;
+                }
+        }
+
+        return hit;
 }
 
 static u64 new_context(struct mm_struct *mm, unsigned int cpu)
@@ -92,12 +107,14 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
         u64 generation = atomic64_read(&asid_generation);
 
         if (asid != 0) {
+                u64 newasid = generation | (asid & ~ASID_MASK);
+
                 /*
                  * If our current ASID was active during a rollover, we
                  * can continue to use it and this was just a false alarm.
                  */
-                if (is_reserved_asid(asid))
-                        return generation | (asid & ~ASID_MASK);
+                if (check_update_reserved_asid(asid, newasid))
+                        return newasid;
 
                 /*
                  * We had a valid ASID in a previous life, so try to re-use
@@ -105,7 +122,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
                  */
                 asid &= ~ASID_MASK;
                 if (!__test_and_set_bit(asid, asid_map))
-                        goto bump_gen;
+                        return newasid;
         }
 
         /*
@@ -129,10 +146,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
 set_asid:
         __set_bit(asid, asid_map);
         cur_idx = asid;
-
-bump_gen:
-        asid |= generation;
-        return asid;
+        return asid | generation;
 }
 
 void check_and_switch_context(struct mm_struct *mm, unsigned int cpu)
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 131a199114b4..7963aa4b5d28 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/gfp.h>
+#include <linux/acpi.h>
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/genalloc.h>
@@ -28,9 +29,6 @@
 
 #include <asm/cacheflush.h>
 
-struct dma_map_ops *dma_ops;
-EXPORT_SYMBOL(dma_ops);
-
 static pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot,
                                  bool coherent)
 {
@@ -515,13 +513,7 @@ EXPORT_SYMBOL(dummy_dma_ops);
 
 static int __init arm64_dma_init(void)
 {
-        int ret;
-
-        dma_ops = &swiotlb_dma_ops;
-
-        ret = atomic_pool_init();
-
-        return ret;
+        return atomic_pool_init();
 }
 arch_initcall(arm64_dma_init);
 
@@ -552,10 +544,14 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
 {
         bool coherent = is_device_dma_coherent(dev);
         int ioprot = dma_direction_to_prot(DMA_BIDIRECTIONAL, coherent);
+        size_t iosize = size;
         void *addr;
 
         if (WARN(!dev, "cannot create IOMMU mapping for unknown device\n"))
                 return NULL;
+
+        size = PAGE_ALIGN(size);
+
         /*
          * Some drivers rely on this, and we probably don't want the
          * possibility of stale kernel data being read by devices anyway.
@@ -566,7 +562,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 struct page **pages;
                 pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL, coherent);
 
-                pages = iommu_dma_alloc(dev, size, gfp, ioprot, handle,
+                pages = iommu_dma_alloc(dev, iosize, gfp, ioprot, handle,
                                         flush_page);
                 if (!pages)
                         return NULL;
@@ -574,7 +570,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 addr = dma_common_pages_remap(pages, size, VM_USERMAP, prot,
                                               __builtin_return_address(0));
                 if (!addr)
-                        iommu_dma_free(dev, pages, size, handle);
+                        iommu_dma_free(dev, pages, iosize, handle);
         } else {
                 struct page *page;
                 /*
@@ -591,7 +587,7 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                 if (!addr)
                         return NULL;
 
-                *handle = iommu_dma_map_page(dev, page, 0, size, ioprot);
+                *handle = iommu_dma_map_page(dev, page, 0, iosize, ioprot);
                 if (iommu_dma_mapping_error(dev, *handle)) {
                         if (coherent)
                                 __free_pages(page, get_order(size));
@@ -606,6 +602,9 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
 static void __iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
                                dma_addr_t handle, struct dma_attrs *attrs)
 {
+        size_t iosize = size;
+
+        size = PAGE_ALIGN(size);
         /*
          * @cpu_addr will be one of 3 things depending on how it was allocated:
          * - A remapped array of pages from iommu_dma_alloc(), for all
@@ -617,17 +616,17 @@ static void __iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
          * Hence how dodgy the below logic looks...
          */
         if (__in_atomic_pool(cpu_addr, size)) {
-                iommu_dma_unmap_page(dev, handle, size, 0, NULL);
+                iommu_dma_unmap_page(dev, handle, iosize, 0, NULL);
                 __free_from_pool(cpu_addr, size);
         } else if (is_vmalloc_addr(cpu_addr)){
                 struct vm_struct *area = find_vm_area(cpu_addr);
 
                 if (WARN_ON(!area || !area->pages))
                         return;
-                iommu_dma_free(dev, area->pages, size, &handle);
+                iommu_dma_free(dev, area->pages, iosize, &handle);
                 dma_common_free_remap(cpu_addr, size, VM_USERMAP);
         } else {
-                iommu_dma_unmap_page(dev, handle, size, 0, NULL);
+                iommu_dma_unmap_page(dev, handle, iosize, 0, NULL);
                 __free_pages(virt_to_page(cpu_addr), get_order(size));
         }
 }
@@ -984,8 +983,8 @@ static void __iommu_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
 void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                         struct iommu_ops *iommu, bool coherent)
 {
-        if (!acpi_disabled && !dev->archdata.dma_ops)
-                dev->archdata.dma_ops = dma_ops;
+        if (!dev->archdata.dma_ops)
+                dev->archdata.dma_ops = &swiotlb_dma_ops;
 
         dev->archdata.dma_coherent = coherent;
         __iommu_setup_dma_ops(dev, dma_base, size, iommu);
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 19211c4a8911..92ddac1e8ca2 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -393,16 +393,16 @@ static struct fault_info {
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 1 translation fault"     },
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 2 translation fault"     },
         { do_page_fault,        SIGSEGV, SEGV_MAPERR,   "level 3 translation fault"     },
-        { do_bad,               SIGBUS,  0,             "reserved access flag fault"    },
+        { do_bad,               SIGBUS,  0,             "unknown 8"                     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 1 access flag fault"     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 2 access flag fault"     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 3 access flag fault"     },
-        { do_bad,               SIGBUS,  0,             "reserved permission fault"     },
+        { do_bad,               SIGBUS,  0,             "unknown 12"                    },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 1 permission fault"      },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 2 permission fault"      },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 3 permission fault"      },
         { do_bad,               SIGBUS,  0,             "synchronous external abort"    },
-        { do_bad,               SIGBUS,  0,             "asynchronous external abort"   },
+        { do_bad,               SIGBUS,  0,             "unknown 17"                    },
         { do_bad,               SIGBUS,  0,             "unknown 18"                    },
         { do_bad,               SIGBUS,  0,             "unknown 19"                    },
         { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
@@ -410,16 +410,16 @@ static struct fault_info {
         { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
         { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
         { do_bad,               SIGBUS,  0,             "synchronous parity error"      },
-        { do_bad,               SIGBUS,  0,             "asynchronous parity error"     },
+        { do_bad,               SIGBUS,  0,             "unknown 25"                    },
         { do_bad,               SIGBUS,  0,             "unknown 26"                    },
         { do_bad,               SIGBUS,  0,             "unknown 27"                    },
-        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk" },
-        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk" },
-        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk" },
-        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk" },
+        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
         { do_bad,               SIGBUS,  0,             "unknown 32"                    },
         { do_bad,               SIGBUS,  BUS_ADRALN,    "alignment fault"               },
-        { do_bad,               SIGBUS,  0,             "debug event"                   },
+        { do_bad,               SIGBUS,  0,             "unknown 34"                    },
         { do_bad,               SIGBUS,  0,             "unknown 35"                    },
         { do_bad,               SIGBUS,  0,             "unknown 36"                    },
         { do_bad,               SIGBUS,  0,             "unknown 37"                    },
@@ -433,21 +433,21 @@ static struct fault_info {
         { do_bad,               SIGBUS,  0,             "unknown 45"                    },
         { do_bad,               SIGBUS,  0,             "unknown 46"                    },
         { do_bad,               SIGBUS,  0,             "unknown 47"                    },
-        { do_bad,               SIGBUS,  0,             "unknown 48"                    },
+        { do_bad,               SIGBUS,  0,             "TLB conflict abort"            },
         { do_bad,               SIGBUS,  0,             "unknown 49"                    },
         { do_bad,               SIGBUS,  0,             "unknown 50"                    },
         { do_bad,               SIGBUS,  0,             "unknown 51"                    },
         { do_bad,               SIGBUS,  0,             "implementation fault (lockdown abort)" },
-        { do_bad,               SIGBUS,  0,             "unknown 53"                    },
+        { do_bad,               SIGBUS,  0,             "implementation fault (unsupported exclusive)" },
         { do_bad,               SIGBUS,  0,             "unknown 54"                    },
         { do_bad,               SIGBUS,  0,             "unknown 55"                    },
         { do_bad,               SIGBUS,  0,             "unknown 56"                    },
         { do_bad,               SIGBUS,  0,             "unknown 57"                    },
-        { do_bad,               SIGBUS,  0,             "implementation fault (coprocessor abort)" },
+        { do_bad,               SIGBUS,  0,             "unknown 58"                    },
         { do_bad,               SIGBUS,  0,             "unknown 59"                    },
         { do_bad,               SIGBUS,  0,             "unknown 60"                    },
-        { do_bad,               SIGBUS,  0,             "unknown 61"                    },
-        { do_bad,               SIGBUS,  0,             "unknown 62"                    },
+        { do_bad,               SIGBUS,  0,             "section domain fault"          },
+        { do_bad,               SIGBUS,  0,             "page domain fault"             },
         { do_bad,               SIGBUS,  0,             "unknown 63"                    },
 };
 
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index e3f563c81c48..873e363048c6 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -64,8 +64,12 @@ EXPORT_SYMBOL(phys_mem_access_prot);
 
 static void __init *early_alloc(unsigned long sz)
 {
-        void *ptr = __va(memblock_alloc(sz, sz));
-        BUG_ON(!ptr);
+        phys_addr_t phys;
+        void *ptr;
+
+        phys = memblock_alloc(sz, sz);
+        BUG_ON(!phys);
+        ptr = __va(phys);
         memset(ptr, 0, sz);
         return ptr;
 }
@@ -81,55 +85,19 @@ static void split_pmd(pmd_t *pmd, pte_t *pte)
         do {
                 /*
                  * Need to have the least restrictive permissions available
-                 * permissions will be fixed up later. Default the new page
-                 * range as contiguous ptes.
+                 * permissions will be fixed up later
                  */
-                set_pte(pte, pfn_pte(pfn, PAGE_KERNEL_EXEC_CONT));
+                set_pte(pte, pfn_pte(pfn, PAGE_KERNEL_EXEC));
                 pfn++;
         } while (pte++, i++, i < PTRS_PER_PTE);
 }
 
-/*
- * Given a PTE with the CONT bit set, determine where the CONT range
- * starts, and clear the entire range of PTE CONT bits.
- */
-static void clear_cont_pte_range(pte_t *pte, unsigned long addr)
-{
-        int i;
-
-        pte -= CONT_RANGE_OFFSET(addr);
-        for (i = 0; i < CONT_PTES; i++) {
-                set_pte(pte, pte_mknoncont(*pte));
-                pte++;
-        }
-        flush_tlb_all();
-}
-
-/*
- * Given a range of PTEs set the pfn and provided page protection flags
- */
-static void __populate_init_pte(pte_t *pte, unsigned long addr,
-                                unsigned long end, phys_addr_t phys,
-                                pgprot_t prot)
-{
-        unsigned long pfn = __phys_to_pfn(phys);
-
-        do {
-                /* clear all the bits except the pfn, then apply the prot */
-                set_pte(pte, pfn_pte(pfn, prot));
-                pte++;
-                pfn++;
-                addr += PAGE_SIZE;
-        } while (addr != end);
-}
-
 static void alloc_init_pte(pmd_t *pmd, unsigned long addr,
-                                  unsigned long end, phys_addr_t phys,
+                                  unsigned long end, unsigned long pfn,
                                   pgprot_t prot,
                                   void *(*alloc)(unsigned long size))
 {
         pte_t *pte;
-        unsigned long next;
 
         if (pmd_none(*pmd) || pmd_sect(*pmd)) {
                 pte = alloc(PTRS_PER_PTE * sizeof(pte_t));
@@ -142,27 +110,9 @@ static void alloc_init_pte(pmd_t *pmd, unsigned long addr,
 
         pte = pte_offset_kernel(pmd, addr);
         do {
-                next = min(end, (addr + CONT_SIZE) & CONT_MASK);
-                if (((addr | next | phys) & ~CONT_MASK) == 0) {
-                        /* a block of CONT_PTES  */
-                        __populate_init_pte(pte, addr, next, phys,
-                                            __pgprot(pgprot_val(prot) | PTE_CONT));
-                } else {
-                        /*
-                         * If the range being split is already inside of a
-                         * contiguous range but this PTE isn't going to be
-                         * contiguous, then we want to unmark the adjacent
-                         * ranges, then update the portion of the range we
-                         * are interrested in.
-                         */
-                         clear_cont_pte_range(pte, addr);
-                         __populate_init_pte(pte, addr, next, phys, prot);
-                }
-
-                pte += (next - addr) >> PAGE_SHIFT;
-                phys += next - addr;
-                addr = next;
-        } while (addr != end);
+                set_pte(pte, pfn_pte(pfn, prot));
+                pfn++;
+        } while (pte++, addr += PAGE_SIZE, addr != end);
 }
 
 static void split_pud(pud_t *old_pud, pmd_t *pmd)
@@ -223,7 +173,8 @@ static void alloc_init_pmd(struct mm_struct *mm, pud_t *pud,
                                 }
                         }
                 } else {
-                        alloc_init_pte(pmd, addr, next, phys, prot, alloc);
+                        alloc_init_pte(pmd, addr, next, __phys_to_pfn(phys),
+                                       prot, alloc);
                 }
                 phys += next - addr;
         } while (pmd++, addr = next, addr != end);
@@ -362,8 +313,8 @@ static void __init __map_memblock(phys_addr_t start, phys_addr_t end)
          * for now. This will get more fine grained later once all memory
          * is mapped
          */
-        unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
-        unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
+        unsigned long kernel_x_start = round_down(__pa(_stext), SWAPPER_BLOCK_SIZE);
+        unsigned long kernel_x_end = round_up(__pa(__init_end), SWAPPER_BLOCK_SIZE);
 
         if (end < kernel_x_start) {
                 create_mapping(start, __phys_to_virt(start),
@@ -451,18 +402,18 @@ static void __init fixup_executable(void)
 {
 #ifdef CONFIG_DEBUG_RODATA
         /* now that we are actually fully mapped, make the start/end more fine grained */
-        if (!IS_ALIGNED((unsigned long)_stext, SECTION_SIZE)) {
+        if (!IS_ALIGNED((unsigned long)_stext, SWAPPER_BLOCK_SIZE)) {
                 unsigned long aligned_start = round_down(__pa(_stext),
-                                                        SECTION_SIZE);
+                                                         SWAPPER_BLOCK_SIZE);
 
                 create_mapping(aligned_start, __phys_to_virt(aligned_start),
                                 __pa(_stext) - aligned_start,
                                 PAGE_KERNEL);
         }
 
-        if (!IS_ALIGNED((unsigned long)__init_end, SECTION_SIZE)) {
+        if (!IS_ALIGNED((unsigned long)__init_end, SWAPPER_BLOCK_SIZE)) {
                 unsigned long aligned_end = round_up(__pa(__init_end),
-                                                        SECTION_SIZE);
+                                                          SWAPPER_BLOCK_SIZE);
                 create_mapping(__pa(__init_end), (unsigned long)__init_end,
                                 aligned_end - __pa(__init_end),
                                 PAGE_KERNEL);
@@ -475,7 +426,7 @@ void mark_rodata_ro(void)
 {
         create_mapping_late(__pa(_stext), (unsigned long)_stext,
                                 (unsigned long)_etext - (unsigned long)_stext,
-                                PAGE_KERNEL_EXEC | PTE_RDONLY);
+                                PAGE_KERNEL_ROX);
 
 }
 #endif
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index cf3c7d4a1b58..d6a53ef2350b 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -50,7 +50,7 @@ static const int bpf2a64[] = {
         [BPF_REG_8] = A64_R(21),
         [BPF_REG_9] = A64_R(22),
         /* read-only frame pointer to access stack */
-        [BPF_REG_FP] = A64_FP,
+        [BPF_REG_FP] = A64_R(25),
         /* temporary register for internal BPF JIT */
         [TMP_REG_1] = A64_R(23),
         [TMP_REG_2] = A64_R(24),
@@ -155,18 +155,49 @@ static void build_prologue(struct jit_ctx *ctx)
         stack_size += 4; /* extra for skb_copy_bits buffer */
         stack_size = STACK_ALIGN(stack_size);
 
+        /*
+         * BPF prog stack layout
+         *
+         *                         high
+         * original A64_SP =>   0:+-----+ BPF prologue
+         *                        |FP/LR|
+         * current A64_FP =>  -16:+-----+
+         *                        | ... | callee saved registers
+         *                        +-----+
+         *                        |     | x25/x26
+         * BPF fp register => -80:+-----+
+         *                        |     |
+         *                        | ... | BPF prog stack
+         *                        |     |
+         *                        |     |
+         * current A64_SP =>      +-----+
+         *                        |     |
+         *                        | ... | Function call stack
+         *                        |     |
+         *                        +-----+
+         *                          low
+         *
+         */
+
+        /* Save FP and LR registers to stay align with ARM64 AAPCS */
+        emit(A64_PUSH(A64_FP, A64_LR, A64_SP), ctx);
+        emit(A64_MOV(1, A64_FP, A64_SP), ctx);
+
         /* Save callee-saved register */
         emit(A64_PUSH(r6, r7, A64_SP), ctx);
         emit(A64_PUSH(r8, r9, A64_SP), ctx);
         if (ctx->tmp_used)
                 emit(A64_PUSH(tmp1, tmp2, A64_SP), ctx);
 
-        /* Set up BPF stack */
-        emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx);
+        /* Save fp (x25) and x26. SP requires 16 bytes alignment */
+        emit(A64_PUSH(fp, A64_R(26), A64_SP), ctx);
 
-        /* Set up frame pointer */
+        /* Set up BPF prog stack base register (x25) */
         emit(A64_MOV(1, fp, A64_SP), ctx);
 
+        /* Set up function call stack */
+        emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx);
+
         /* Clear registers A and X */
         emit_a64_mov_i64(ra, 0, ctx);
         emit_a64_mov_i64(rx, 0, ctx);
@@ -190,14 +221,17 @@ static void build_epilogue(struct jit_ctx *ctx)
         /* We're done with BPF stack */
         emit(A64_ADD_I(1, A64_SP, A64_SP, stack_size), ctx);
 
+        /* Restore fs (x25) and x26 */
+        emit(A64_POP(fp, A64_R(26), A64_SP), ctx);
+
         /* Restore callee-saved register */
         if (ctx->tmp_used)
                 emit(A64_POP(tmp1, tmp2, A64_SP), ctx);
         emit(A64_POP(r8, r9, A64_SP), ctx);
         emit(A64_POP(r6, r7, A64_SP), ctx);
 
-        /* Restore frame pointer */
-        emit(A64_MOV(1, fp, A64_SP), ctx);
+        /* Restore FP/LR registers */
+        emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
 
         /* Set return value */
         emit(A64_MOV(1, A64_R(0), r0), ctx);
@@ -758,7 +792,7 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
         if (bpf_jit_enable > 1)
                 bpf_jit_dump(prog->len, image_size, 2, ctx.image);
 
-        bpf_flush_icache(ctx.image, ctx.image + ctx.idx);
+        bpf_flush_icache(header, ctx.image + ctx.idx);
 
         set_memory_ro((unsigned long)header, header->pages);
         prog->bpf_func = (void *)ctx.image;
diff --git a/arch/m68k/coldfire/m54xx.c b/arch/m68k/coldfire/m54xx.c
index f7836c6a6b60..c32f76791f48 100644
--- a/arch/m68k/coldfire/m54xx.c
+++ b/arch/m68k/coldfire/m54xx.c
@@ -98,7 +98,7 @@ static void __init mcf54xx_bootmem_alloc(void)
         memstart = PAGE_ALIGN(_ramstart);
         min_low_pfn = PFN_DOWN(_rambase);
         start_pfn = PFN_DOWN(memstart);
-        max_low_pfn = PFN_DOWN(_ramend);
+        max_pfn = max_low_pfn = PFN_DOWN(_ramend);
         high_memory = (void *)_ramend;
 
         m68k_virt_to_node_shift = fls(_ramend - _rambase - 1) - 6;
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 0793a7f17417..f9d96bf86910 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             375
+#define NR_syscalls             376
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 5e6fae6c275f..36cf129de663 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -380,5 +380,6 @@
 #define __NR_sendmmsg           372
 #define __NR_userfaultfd        373
 #define __NR_membarrier         374
+#define __NR_mlock2             375
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/setup_no.c b/arch/m68k/kernel/setup_no.c
index 88c27d94a721..76b9113f3092 100644
--- a/arch/m68k/kernel/setup_no.c
+++ b/arch/m68k/kernel/setup_no.c
@@ -238,11 +238,14 @@ void __init setup_arch(char **cmdline_p)
          * Give all the memory to the bootmap allocator, tell it to put the
          * boot mem_map at the start of memory.
          */
+        min_low_pfn = PFN_DOWN(memory_start);
+        max_pfn = max_low_pfn = PFN_DOWN(memory_end);
+
         bootmap_size = init_bootmem_node(
                         NODE_DATA(0),
-                        memory_start >> PAGE_SHIFT, /* map goes here */
-                        PAGE_OFFSET >> PAGE_SHIFT,      /* 0 on coldfire */
-                        memory_end >> PAGE_SHIFT);
+                        min_low_pfn,            /* map goes here */
+                        PFN_DOWN(PAGE_OFFSET),
+                        max_pfn);
         /*
          * Free the usable memory, we have to make sure we do not free
          * the bootmem bitmap so we then reserve it after freeing it :-)
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 5dd0e80042f5..282cd903f4c4 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -395,3 +395,4 @@ ENTRY(sys_call_table)
         .long sys_sendmmsg
         .long sys_userfaultfd
         .long sys_membarrier
+        .long sys_mlock2                /* 375 */
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index b958916e5eac..8f37fdd80be9 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -250,7 +250,7 @@ void __init paging_init(void)
         high_memory = phys_to_virt(max_addr);
 
         min_low_pfn = availmem >> PAGE_SHIFT;
-        max_low_pfn = max_addr >> PAGE_SHIFT;
+        max_pfn = max_low_pfn = max_addr >> PAGE_SHIFT;
 
         for (i = 0; i < m68k_num_memory; i++) {
                 addr = m68k_memory[i].addr;
diff --git a/arch/m68k/sun3/config.c b/arch/m68k/sun3/config.c
index a8b942bf7163..2a5f43a68ae3 100644
--- a/arch/m68k/sun3/config.c
+++ b/arch/m68k/sun3/config.c
@@ -118,13 +118,13 @@ static void __init sun3_bootmem_alloc(unsigned long memory_start,
         memory_end = memory_end & PAGE_MASK;
 
         start_page = __pa(memory_start) >> PAGE_SHIFT;
-        num_pages = __pa(memory_end) >> PAGE_SHIFT;
+        max_pfn = num_pages = __pa(memory_end) >> PAGE_SHIFT;
 
         high_memory = (void *)memory_end;
         availmem = memory_start;
 
         m68k_setup_node(0);
-        availmem += init_bootmem_node(NODE_DATA(0), start_page, 0, num_pages);
+        availmem += init_bootmem(start_page, num_pages);
         availmem = (availmem + (PAGE_SIZE-1)) & PAGE_MASK;
 
         free_bootmem(__pa(availmem), memory_end - (availmem));
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index 1ba21204ebe0..8755d618e116 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -216,9 +216,9 @@ void __init plat_mem_setup(void)
                                            AR71XX_RESET_SIZE);
         ath79_pll_base = ioremap_nocache(AR71XX_PLL_BASE,
                                          AR71XX_PLL_SIZE);
+        ath79_detect_sys_type();
         ath79_ddr_ctrl_init();
 
-        ath79_detect_sys_type();
         if (mips_machtype != ATH79_MACH_GENERIC_OF)
                 detect_memory_region(0, ATH79_MEM_SIZE_MIN, ATH79_MEM_SIZE_MAX);
 
@@ -281,3 +281,8 @@ MIPS_MACHINE(ATH79_MACH_GENERIC,
              "Generic",
              "Generic AR71XX/AR724X/AR913X based board",
              ath79_generic_init);
+
+MIPS_MACHINE(ATH79_MACH_GENERIC_OF,
+             "DTB",
+             "Generic AR71XX/AR724X/AR913X based board (DT)",
+             NULL);
diff --git a/arch/mips/boot/dts/qca/ar9132.dtsi b/arch/mips/boot/dts/qca/ar9132.dtsi
index fb7734eadbf0..13d0439496a9 100644
--- a/arch/mips/boot/dts/qca/ar9132.dtsi
+++ b/arch/mips/boot/dts/qca/ar9132.dtsi
@@ -107,7 +107,7 @@
                         miscintc: interrupt-controller@18060010 {
                                 compatible = "qca,ar9132-misc-intc",
                                            "qca,ar7100-misc-intc";
-                                reg = <0x18060010 0x4>;
+                                reg = <0x18060010 0x8>;
 
                                 interrupt-parent = <&cpuintc>;
                                 interrupts = <6>;
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index ad1fccdb8d13..2046c0230224 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -200,8 +200,9 @@ static inline int pfn_valid(unsigned long pfn)
 {
         /* avoid <linux/mm.h> include hell */
         extern unsigned long max_mapnr;
+        unsigned long pfn_offset = ARCH_PFN_OFFSET;
 
-        return pfn >= ARCH_PFN_OFFSET && pfn < max_mapnr;
+        return pfn >= pfn_offset && pfn < max_mapnr;
 }
 
 #elif defined(CONFIG_SPARSEMEM)
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index d5fa3eaf39a1..41b1b090f56f 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -1581,7 +1581,7 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
 
         base = (inst >> 21) & 0x1f;
         op_inst = (inst >> 16) & 0x1f;
-        offset = inst & 0xffff;
+        offset = (int16_t)inst;
         cache = (inst >> 16) & 0x3;
         op = (inst >> 18) & 0x7;
 
diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
index 7bab3a4e8f7d..7e2210846b8b 100644
--- a/arch/mips/kvm/locore.S
+++ b/arch/mips/kvm/locore.S
@@ -157,9 +157,11 @@ FEXPORT(__kvm_mips_vcpu_run)
 
 FEXPORT(__kvm_mips_load_asid)
         /* Set the ASID for the Guest Kernel */
-        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
-                                /* addresses shift to 0x80000000 */
-        bltz    t0, 1f          /* If kernel */
+        PTR_L   t0, VCPU_COP0(k1)
+        LONG_L  t0, COP0_STATUS(t0)
+        andi    t0, KSU_USER | ST0_ERL | ST0_EXL
+        xori    t0, KSU_USER
+        bnez    t0, 1f          /* If kernel */
          INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
         INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
@@ -474,9 +476,11 @@ __kvm_mips_return_to_guest:
         mtc0    t0, CP0_EPC
 
         /* Set the ASID for the Guest Kernel */
-        INT_SLL t0, t0, 1       /* with kseg0 @ 0x40000000, kernel */
-                                /* addresses shift to 0x80000000 */
-        bltz    t0, 1f          /* If kernel */
+        PTR_L   t0, VCPU_COP0(k1)
+        LONG_L  t0, COP0_STATUS(t0)
+        andi    t0, KSU_USER | ST0_ERL | ST0_EXL
+        xori    t0, KSU_USER
+        bnez    t0, 1f          /* If kernel */
          INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID  /* (BD)  */
         INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID    /* else user */
 1:
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index 49ff3bfc007e..b9b803facdbf 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -279,7 +279,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
 
         if (!gebase) {
                 err = -ENOMEM;
-                goto out_free_cpu;
+                goto out_uninit_cpu;
         }
         kvm_debug("Allocated %d bytes for KVM Exception Handlers @ %p\n",
                   ALIGN(size, PAGE_SIZE), gebase);
@@ -343,6 +343,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
 out_free_gebase:
         kfree(gebase);
 
+out_uninit_cpu:
+        kvm_vcpu_uninit(vcpu);
+
 out_free_cpu:
         kfree(vcpu);
 
diff --git a/arch/mips/pci/pci-rt2880.c b/arch/mips/pci/pci-rt2880.c
index 8a978022630b..dbbeccc3d714 100644
--- a/arch/mips/pci/pci-rt2880.c
+++ b/arch/mips/pci/pci-rt2880.c
@@ -11,6 +11,7 @@
  *  by the Free Software Foundation.
  */
 
+#include <linux/delay.h>
 #include <linux/types.h>
 #include <linux/pci.h>
 #include <linux/io.h>
@@ -232,8 +233,7 @@ static int rt288x_pci_probe(struct platform_device *pdev)
         ioport_resource.end = RT2880_PCI_IO_BASE + RT2880_PCI_IO_SIZE - 1;
 
         rt2880_pci_reg_write(0, RT2880_PCI_REG_PCICFG_ADDR);
-        for (i = 0; i < 0xfffff; i++)
-                ;
+        udelay(1);
 
         rt2880_pci_reg_write(0x79, RT2880_PCI_REG_ARBCTL);
         rt2880_pci_reg_write(0x07FF0001, RT2880_PCI_REG_BAR0SETUP_ADDR);
diff --git a/arch/mips/pmcs-msp71xx/msp_setup.c b/arch/mips/pmcs-msp71xx/msp_setup.c
index 4f925e06c414..78b2ef49dbc7 100644
--- a/arch/mips/pmcs-msp71xx/msp_setup.c
+++ b/arch/mips/pmcs-msp71xx/msp_setup.c
@@ -10,6 +10,8 @@
  * option) any later version.
  */
 
+#include <linux/delay.h>
+
 #include <asm/bootinfo.h>
 #include <asm/cacheflush.h>
 #include <asm/idle.h>
@@ -77,7 +79,7 @@ void msp7120_reset(void)
          */
 
         /* Wait a bit for the DDRC to settle */
-        for (i = 0; i < 100000000; i++);
+        mdelay(125);
 
 #if defined(CONFIG_PMC_MSP7120_GW)
         /*
diff --git a/arch/mips/sni/reset.c b/arch/mips/sni/reset.c
index 244f9427625b..db8f88b6a3af 100644
--- a/arch/mips/sni/reset.c
+++ b/arch/mips/sni/reset.c
@@ -3,6 +3,8 @@
  *
  *  Reset a SNI machine.
  */
+#include <linux/delay.h>
+
 #include <asm/io.h>
 #include <asm/reboot.h>
 #include <asm/sni.h>
@@ -32,9 +34,9 @@ void sni_machine_restart(char *command)
         for (;;) {
                 for (i = 0; i < 100; i++) {
                         kb_wait();
-                        for (j = 0; j < 100000 ; j++)
-                                /* nothing */;
+                        udelay(50);
                         outb_p(0xfe, 0x64);      /* pulse reset low */
+                        udelay(50);
                 }
         }
 }
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index 4434b54e1d87..78ae5552fdb8 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -1,6 +1,7 @@
 config MN10300
         def_bool y
         select HAVE_OPROFILE
+        select HAVE_UID16
         select GENERIC_IRQ_SHOW
         select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_ARCH_TRACEHOOK
@@ -37,9 +38,6 @@ config HIGHMEM
 config NUMA
         def_bool n
 
-config UID16
-        def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
         def_bool y
 
diff --git a/arch/nios2/mm/cacheflush.c b/arch/nios2/mm/cacheflush.c
index 223cdcc8203f..87bf88ed04c6 100644
--- a/arch/nios2/mm/cacheflush.c
+++ b/arch/nios2/mm/cacheflush.c
@@ -23,22 +23,6 @@ static void __flush_dcache(unsigned long start, unsigned long end)
         end += (cpuinfo.dcache_line_size - 1);
         end &= ~(cpuinfo.dcache_line_size - 1);
 
-        for (addr = start; addr < end; addr += cpuinfo.dcache_line_size) {
-                __asm__ __volatile__ ("   flushda 0(%0)\n"
-                                        : /* Outputs */
-                                        : /* Inputs  */ "r"(addr)
-                                        /* : No clobber */);
-        }
-}
-
-static void __flush_dcache_all(unsigned long start, unsigned long end)
-{
-        unsigned long addr;
-
-        start &= ~(cpuinfo.dcache_line_size - 1);
-        end += (cpuinfo.dcache_line_size - 1);
-        end &= ~(cpuinfo.dcache_line_size - 1);
-
         if (end > start + cpuinfo.dcache_size)
                 end = start + cpuinfo.dcache_size;
 
@@ -112,7 +96,7 @@ static void flush_aliases(struct address_space *mapping, struct page *page)
 
 void flush_cache_all(void)
 {
-        __flush_dcache_all(0, cpuinfo.dcache_size);
+        __flush_dcache(0, cpuinfo.dcache_size);
         __flush_icache(0, cpuinfo.icache_size);
 }
 
@@ -182,7 +166,7 @@ void __flush_dcache_page(struct address_space *mapping, struct page *page)
          */
         unsigned long start = (unsigned long)page_address(page);
 
-        __flush_dcache_all(start, start + PAGE_SIZE);
+        __flush_dcache(start, start + PAGE_SIZE);
 }
 
 void flush_dcache_page(struct page *page)
@@ -268,7 +252,7 @@ void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
 {
         flush_cache_page(vma, user_vaddr, page_to_pfn(page));
         memcpy(dst, src, len);
-        __flush_dcache_all((unsigned long)src, (unsigned long)src + len);
+        __flush_dcache((unsigned long)src, (unsigned long)src + len);
         if (vma->vm_flags & VM_EXEC)
                 __flush_icache((unsigned long)src, (unsigned long)src + len);
 }
@@ -279,7 +263,7 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
 {
         flush_cache_page(vma, user_vaddr, page_to_pfn(page));
         memcpy(dst, src, len);
-        __flush_dcache_all((unsigned long)dst, (unsigned long)dst + len);
+        __flush_dcache((unsigned long)dst, (unsigned long)dst + len);
         if (vma->vm_flags & VM_EXEC)
                 __flush_icache((unsigned long)dst, (unsigned long)dst + len);
 }
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index c36546959e86..729f89163bc3 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -108,6 +108,9 @@ config PGTABLE_LEVELS
         default 3 if 64BIT && PARISC_PAGE_SIZE_4KB
         default 2
 
+config SYS_SUPPORTS_HUGETLBFS
+        def_bool y if PA20
+
 source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
diff --git a/arch/parisc/include/asm/hugetlb.h b/arch/parisc/include/asm/hugetlb.h
new file mode 100644
index 000000000000..7d56a9ccb752
--- /dev/null
+++ b/arch/parisc/include/asm/hugetlb.h
@@ -0,0 +1,85 @@
+#ifndef _ASM_PARISC64_HUGETLB_H
+#define _ASM_PARISC64_HUGETLB_H
+
+#include <asm/page.h>
+#include <asm-generic/hugetlb.h>
+
+
+void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+                     pte_t *ptep, pte_t pte);
+
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+                              pte_t *ptep);
+
+static inline int is_hugepage_only_range(struct mm_struct *mm,
+                                         unsigned long addr,
+                                         unsigned long len) {
+        return 0;
+}
+
+/*
+ * If the arch doesn't supply something else, assume that hugepage
+ * size aligned regions are ok without further preparation.
+ */
+static inline int prepare_hugepage_range(struct file *file,
+                        unsigned long addr, unsigned long len)
+{
+        if (len & ~HPAGE_MASK)
+                return -EINVAL;
+        if (addr & ~HPAGE_MASK)
+                return -EINVAL;
+        return 0;
+}
+
+static inline void hugetlb_free_pgd_range(struct mmu_gather *tlb,
+                                          unsigned long addr, unsigned long end,
+                                          unsigned long floor,
+                                          unsigned long ceiling)
+{
+        free_pgd_range(tlb, addr, end, floor, ceiling);
+}
+
+static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+                                         unsigned long addr, pte_t *ptep)
+{
+}
+
+static inline int huge_pte_none(pte_t pte)
+{
+        return pte_none(pte);
+}
+
+static inline pte_t huge_pte_wrprotect(pte_t pte)
+{
+        return pte_wrprotect(pte);
+}
+
+static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
+                                           unsigned long addr, pte_t *ptep)
+{
+        pte_t old_pte = *ptep;
+        set_huge_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+}
+
+static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
+                                             unsigned long addr, pte_t *ptep,
+                                             pte_t pte, int dirty)
+{
+        int changed = !pte_same(*ptep, pte);
+        if (changed) {
+                set_huge_pte_at(vma->vm_mm, addr, ptep, pte);
+                flush_tlb_page(vma, addr);
+        }
+        return changed;
+}
+
+static inline pte_t huge_ptep_get(pte_t *ptep)
+{
+        return *ptep;
+}
+
+static inline void arch_clear_hugepage_flags(struct page *page)
+{
+}
+
+#endif /* _ASM_PARISC64_HUGETLB_H */
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 60d5d174dfe4..80e742a1c162 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -145,11 +145,22 @@ extern int npmem_ranges;
 #endif /* CONFIG_DISCONTIGMEM */
 
 #ifdef CONFIG_HUGETLB_PAGE
-#define HPAGE_SHIFT             22      /* 4MB (is this fixed?) */
+#define HPAGE_SHIFT             PMD_SHIFT /* fixed for transparent huge pages */
 #define HPAGE_SIZE              ((1UL) << HPAGE_SHIFT)
 #define HPAGE_MASK              (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
+
+#if defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define REAL_HPAGE_SHIFT       20 /* 20 = 1MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_1M
+#elif !defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define REAL_HPAGE_SHIFT       22 /* 22 = 4MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_4M
+#else
+# define REAL_HPAGE_SHIFT       24 /* 24 = 16MB */
+# define _HUGE_PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_16M
 #endif
+#endif /* CONFIG_HUGETLB_PAGE */
 
 #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index 3edbb9fc91b4..f2fd327dce2e 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -35,7 +35,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
                                         PxD_FLAG_VALID | 
                                         PxD_FLAG_ATTACHED) 
                         + (__u32)(__pa((unsigned long)pgd) >> PxD_VALUE_SHIFT));
-                /* The first pmd entry also is marked with _PAGE_GATEWAY as
+                /* The first pmd entry also is marked with PxD_FLAG_ATTACHED as
                  * a signal that this pmd may not be freed */
                 __pgd_val_set(*pgd, PxD_FLAG_ATTACHED);
 #endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index f93c4a4e6580..d8534f95915a 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -83,7 +83,11 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
         printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, (unsigned long)pgd_val(e))
 
 /* This is the size of the initially mapped kernel memory */
-#define KERNEL_INITIAL_ORDER    24      /* 0 to 1<<24 = 16MB */
+#ifdef CONFIG_64BIT
+#define KERNEL_INITIAL_ORDER    25      /* 1<<25 = 32MB */
+#else
+#define KERNEL_INITIAL_ORDER    24      /* 1<<24 = 16MB */
+#endif
 #define KERNEL_INITIAL_SIZE     (1 << KERNEL_INITIAL_ORDER)
 
 #if CONFIG_PGTABLE_LEVELS == 3
@@ -167,7 +171,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define _PAGE_NO_CACHE_BIT 24   /* (0x080) Uncached Page (U bit) */
 #define _PAGE_ACCESSED_BIT 23   /* (0x100) Software: Page Accessed */
 #define _PAGE_PRESENT_BIT  22   /* (0x200) Software: translation valid */
-/* bit 21 was formerly the FLUSH bit but is now unused */
+#define _PAGE_HPAGE_BIT    21   /* (0x400) Software: Huge Page */
 #define _PAGE_USER_BIT     20   /* (0x800) Software: User accessible page */
 
 /* N.B. The bits are defined in terms of a 32 bit word above, so the */
@@ -194,6 +198,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define _PAGE_NO_CACHE (1 << xlate_pabit(_PAGE_NO_CACHE_BIT))
 #define _PAGE_ACCESSED (1 << xlate_pabit(_PAGE_ACCESSED_BIT))
 #define _PAGE_PRESENT  (1 << xlate_pabit(_PAGE_PRESENT_BIT))
+#define _PAGE_HUGE     (1 << xlate_pabit(_PAGE_HPAGE_BIT))
 #define _PAGE_USER     (1 << xlate_pabit(_PAGE_USER_BIT))
 
 #define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_READ | _PAGE_WRITE |  _PAGE_DIRTY | _PAGE_ACCESSED)
@@ -217,7 +222,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #define PxD_FLAG_VALID    (1 << xlate_pabit(_PxD_VALID_BIT))
 #define PxD_FLAG_MASK     (0xf)
 #define PxD_FLAG_SHIFT    (4)
-#define PxD_VALUE_SHIFT   (8) /* (PAGE_SHIFT-PxD_FLAG_SHIFT) */
+#define PxD_VALUE_SHIFT   (PFN_PTE_SHIFT-PxD_FLAG_SHIFT)
 
 #ifndef __ASSEMBLY__
 
@@ -363,6 +368,18 @@ static inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 static inline pte_t pte_mkspecial(pte_t pte)    { return pte; }
 
 /*
+ * Huge pte definitions.
+ */
+#ifdef CONFIG_HUGETLB_PAGE
+#define pte_huge(pte)           (pte_val(pte) & _PAGE_HUGE)
+#define pte_mkhuge(pte)         (__pte(pte_val(pte) | _PAGE_HUGE))
+#else
+#define pte_huge(pte)           (0)
+#define pte_mkhuge(pte)         (pte)
+#endif
+
+
+/*
  * Conversion functions: convert a page and protection to a page entry,
  * and a page entry and page directory to the page they refer to.
  */
@@ -410,8 +427,9 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 /* Find an entry in the second-level page table.. */
 
 #if CONFIG_PGTABLE_LEVELS == 3
+#define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 #define pmd_offset(dir,address) \
-((pmd_t *) pgd_page_vaddr(*(dir)) + (((address)>>PMD_SHIFT) & (PTRS_PER_PMD-1)))
+((pmd_t *) pgd_page_vaddr(*(dir)) + pmd_index(address))
 #else
 #define pmd_offset(dir,addr) ((pmd_t *) dir)
 #endif
diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
index 54adb60c0a42..7e759ecb1343 100644
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -192,33 +192,6 @@ void show_trace(struct task_struct *task, unsigned long *stack);
  */
 typedef unsigned int elf_caddr_t;
 
-#define start_thread_som(regs, new_pc, new_sp) do {     \
-        unsigned long *sp = (unsigned long *)new_sp;    \
-        __u32 spaceid = (__u32)current->mm->context;    \
-        unsigned long pc = (unsigned long)new_pc;       \
-        /* offset pc for priv. level */                 \
-        pc |= 3;                                        \
-                                                        \
-        regs->iasq[0] = spaceid;                        \
-        regs->iasq[1] = spaceid;                        \
-        regs->iaoq[0] = pc;                             \
-        regs->iaoq[1] = pc + 4;                         \
-        regs->sr[2] = LINUX_GATEWAY_SPACE;              \
-        regs->sr[3] = 0xffff;                           \
-        regs->sr[4] = spaceid;                          \
-        regs->sr[5] = spaceid;                          \
-        regs->sr[6] = spaceid;                          \
-        regs->sr[7] = spaceid;                          \
-        regs->gr[ 0] = USER_PSW;                        \
-        regs->gr[30] = ((new_sp)+63)&~63;               \
-        regs->gr[31] = pc;                              \
-                                                        \
-        get_user(regs->gr[26],&sp[0]);                  \
-        get_user(regs->gr[25],&sp[-1]);                 \
-        get_user(regs->gr[24],&sp[-2]);                 \
-        get_user(regs->gr[23],&sp[-3]);                 \
-} while(0)
-
 /* The ELF abi wants things done a "wee bit" differently than
  * som does.  Supporting this behavior here avoids
  * having our own version of create_elf_tables.
diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h
index ecc3ae1ca28e..dd4d1876a020 100644
--- a/arch/parisc/include/uapi/asm/mman.h
+++ b/arch/parisc/include/uapi/asm/mman.h
@@ -49,16 +49,6 @@
 #define MADV_DONTFORK   10              /* don't inherit across fork */
 #define MADV_DOFORK     11              /* do inherit across fork */
 
-/* The range 12-64 is reserved for page size specification. */
-#define MADV_4K_PAGES   12              /* Use 4K pages  */
-#define MADV_16K_PAGES  14              /* Use 16K pages */
-#define MADV_64K_PAGES  16              /* Use 64K pages */
-#define MADV_256K_PAGES 18              /* Use 256K pages */
-#define MADV_1M_PAGES   20              /* Use 1 Megabyte pages */
-#define MADV_4M_PAGES   22              /* Use 4 Megabyte pages */
-#define MADV_16M_PAGES  24              /* Use 16 Megabyte pages */
-#define MADV_64M_PAGES  26              /* Use 64 Megabyte pages */
-
 #define MADV_MERGEABLE   65             /* KSM may merge identical pages */
 #define MADV_UNMERGEABLE 66             /* KSM may not merge identical pages */
 
diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
index 59001cea13f9..d2f62570a7b1 100644
--- a/arch/parisc/kernel/asm-offsets.c
+++ b/arch/parisc/kernel/asm-offsets.c
@@ -290,6 +290,14 @@ int main(void)
         DEFINE(ASM_PFN_PTE_SHIFT, PFN_PTE_SHIFT);
         DEFINE(ASM_PT_INITIAL, PT_INITIAL);
         BLANK();
+        /* HUGEPAGE_SIZE is only used in vmlinux.lds.S to align kernel text
+         * and kernel data on physical huge pages */
+#ifdef CONFIG_HUGETLB_PAGE
+        DEFINE(HUGEPAGE_SIZE, 1UL << REAL_HPAGE_SHIFT);
+#else
+        DEFINE(HUGEPAGE_SIZE, PAGE_SIZE);
+#endif
+        BLANK();
         DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
         DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
         DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index c5ef4081b01d..623496c11756 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -502,21 +502,38 @@
         STREG           \pte,0(\ptp)
         .endm
 
+        /* We have (depending on the page size):
+         * - 38 to 52-bit Physical Page Number
+         * - 12 to 26-bit page offset
+         */
         /* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
          * to a CPU TLB 4k PFN (4k => 12 bits to shift) */
-        #define PAGE_ADD_SHIFT  (PAGE_SHIFT-12)
+        #define PAGE_ADD_SHIFT          (PAGE_SHIFT-12)
+        #define PAGE_ADD_HUGE_SHIFT     (REAL_HPAGE_SHIFT-12)
 
         /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
-        .macro          convert_for_tlb_insert20 pte
+        .macro          convert_for_tlb_insert20 pte,tmp
+#ifdef CONFIG_HUGETLB_PAGE
+        copy            \pte,\tmp
+        extrd,u         \tmp,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
+                                64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
+
+        depdi           _PAGE_SIZE_ENCODING_DEFAULT,63,\
+                                (63-58)+PAGE_ADD_SHIFT,\pte
+        extrd,u,*=      \tmp,_PAGE_HPAGE_BIT+32,1,%r0
+        depdi           _HUGE_PAGE_SIZE_ENCODING_DEFAULT,63,\
+                                (63-58)+PAGE_ADD_HUGE_SHIFT,\pte
+#else /* Huge pages disabled */
         extrd,u         \pte,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
                                 64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
         depdi           _PAGE_SIZE_ENCODING_DEFAULT,63,\
                                 (63-58)+PAGE_ADD_SHIFT,\pte
+#endif
         .endm
 
         /* Convert the pte and prot to tlb insertion values.  How
          * this happens is quite subtle, read below */
-        .macro          make_insert_tlb spc,pte,prot
+        .macro          make_insert_tlb spc,pte,prot,tmp
         space_to_prot   \spc \prot        /* create prot id from space */
         /* The following is the real subtlety.  This is depositing
          * T <-> _PAGE_REFTRAP
@@ -553,7 +570,7 @@
         depdi           1,12,1,\prot
 
         /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
-        convert_for_tlb_insert20 \pte
+        convert_for_tlb_insert20 \pte \tmp
         .endm
 
         /* Identical macro to make_insert_tlb above, except it
@@ -646,17 +663,12 @@
 
 
         /*
-         * Align fault_vector_20 on 4K boundary so that both
-         * fault_vector_11 and fault_vector_20 are on the
-         * same page. This is only necessary as long as we
-         * write protect the kernel text, which we may stop
-         * doing once we use large page translations to cover
-         * the static part of the kernel address space.
+         * Fault_vectors are architecturally required to be aligned on a 2K
+         * boundary
          */
 
         .text
-
-        .align 4096
+        .align 2048
 
 ENTRY(fault_vector_20)
         /* First vector is invalid (0) */
@@ -1147,7 +1159,7 @@ dtlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
         
         idtlbt          pte,prot
 
@@ -1173,7 +1185,7 @@ nadtlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         idtlbt          pte,prot
 
@@ -1267,7 +1279,7 @@ dtlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1295,7 +1307,7 @@ nadtlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
         
@@ -1404,7 +1416,7 @@ itlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
         
         iitlbt          pte,prot
 
@@ -1428,7 +1440,7 @@ naitlb_miss_20w:
         tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20w
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         iitlbt          pte,prot
 
@@ -1514,7 +1526,7 @@ itlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1534,7 +1546,7 @@ naitlb_miss_20:
         tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20
         update_accessed ptp,pte,t0,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
 
@@ -1566,7 +1578,7 @@ dbit_trap_20w:
         tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
         update_dirty    ptp,pte,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
                 
         idtlbt          pte,prot
 
@@ -1610,7 +1622,7 @@ dbit_trap_20:
         tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
         update_dirty    ptp,pte,t1
 
-        make_insert_tlb spc,pte,prot
+        make_insert_tlb spc,pte,prot,t1
 
         f_extend        pte,t1
         
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index e7d64527aff9..75aa0db9f69e 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -69,7 +69,7 @@ $bss_loop:
         stw,ma          %arg2,4(%r1)
         stw,ma          %arg3,4(%r1)
 
-        /* Initialize startup VM. Just map first 8/16 MB of memory */
+        /* Initialize startup VM. Just map first 16/32 MB of memory */
         load32          PA(swapper_pg_dir),%r4
         mtctl           %r4,%cr24       /* Initialize kernel root pointer */
         mtctl           %r4,%cr25       /* Initialize user root pointer */
@@ -107,7 +107,7 @@ $bss_loop:
         /* Now initialize the PTEs themselves.  We use RWX for
          * everything ... it will get remapped correctly later */
         ldo             0+_PAGE_KERNEL_RWX(%r0),%r3 /* Hardwired 0 phys addr start */
-        ldi             (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
+        load32          (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
         load32          PA(pg0),%r1
 
 $pgt_fill_loop:
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index 72a3c658ad7b..f7ea626e29c9 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -130,7 +130,16 @@ void __init setup_arch(char **cmdline_p)
         printk(KERN_INFO "The 32-bit Kernel has started...\n");
 #endif
 
-        printk(KERN_INFO "Default page size is %dKB.\n", (int)(PAGE_SIZE / 1024));
+        printk(KERN_INFO "Kernel default page size is %d KB. Huge pages ",
+                (int)(PAGE_SIZE / 1024));
+#ifdef CONFIG_HUGETLB_PAGE
+        printk(KERN_CONT "enabled with %d MB physical and %d MB virtual size",
+                 1 << (REAL_HPAGE_SHIFT - 20), 1 << (HPAGE_SHIFT - 20));
+#else
+        printk(KERN_CONT "disabled");
+#endif
+        printk(KERN_CONT ".\n");
+
 
         pdc_console_init();
 
@@ -377,6 +386,7 @@ arch_initcall(parisc_init);
 void start_parisc(void)
 {
         extern void start_kernel(void);
+        extern void early_trap_init(void);
 
         int ret, cpunum;
         struct pdc_coproc_cfg coproc_cfg;
@@ -397,6 +407,8 @@ void start_parisc(void)
                 panic("must have an fpu to boot linux");
         }
 
+        early_trap_init(); /* initialize checksum of fault_vector */
+
         start_kernel();
         // not reached
 }
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 0b8d26d3ba43..3fbd7252a4b2 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -369,7 +369,7 @@ tracesys_exit:
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
         ldo     TASK_REGS(%r1),%r26
-        bl      do_syscall_trace_exit,%r2
+        BL      do_syscall_trace_exit,%r2
         STREG   %r28,TASK_PT_GR28(%r1)          /* save return value now */
         ldo     -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1      /* get task ptr */
         LDREG   TI_TASK(%r1), %r1
@@ -390,7 +390,7 @@ tracesys_sigexit:
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
-        bl      do_syscall_trace_exit,%r2
+        BL      do_syscall_trace_exit,%r2
         ldo     TASK_REGS(%r1),%r26
 
         ldil    L%syscall_exit_rfi,%r1
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index b99b39f1da02..553b09855cfd 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -807,7 +807,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
 }
 
 
-int __init check_ivt(void *iva)
+void __init initialize_ivt(const void *iva)
 {
         extern u32 os_hpmc_size;
         extern const u32 os_hpmc[];
@@ -818,8 +818,8 @@ int __init check_ivt(void *iva)
         u32 *hpmcp;
         u32 length;
 
-        if (strcmp((char *)iva, "cows can fly"))
-                return -1;
+        if (strcmp((const char *)iva, "cows can fly"))
+                panic("IVT invalid");
 
         ivap = (u32 *)iva;
 
@@ -839,28 +839,23 @@ int __init check_ivt(void *iva)
             check += ivap[i];
 
         ivap[5] = -check;
-
-        return 0;
 }
         
-#ifndef CONFIG_64BIT
-extern const void fault_vector_11;
-#endif
-extern const void fault_vector_20;
 
-void __init trap_init(void)
+/* early_trap_init() is called before we set up kernel mappings and
+ * write-protect the kernel */
+void  __init early_trap_init(void)
 {
-        void *iva;
+        extern const void fault_vector_20;
 
-        if (boot_cpu_data.cpu_type >= pcxu)
-                iva = (void *) &fault_vector_20;
-        else
-#ifdef CONFIG_64BIT
-                panic("Can't boot 64-bit OS on PA1.1 processor!");
-#else
-                iva = (void *) &fault_vector_11;
+#ifndef CONFIG_64BIT
+        extern const void fault_vector_11;
+        initialize_ivt(&fault_vector_11);
 #endif
 
-        if (check_ivt(iva))
-                panic("IVT invalid");
+        initialize_ivt(&fault_vector_20);
+}
+
+void __init trap_init(void)
+{
 }
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 0dacc5ca555a..308f29081d46 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -60,7 +60,7 @@ SECTIONS
                 EXIT_DATA
         }
         PERCPU_SECTION(8)
-        . = ALIGN(PAGE_SIZE);
+        . = ALIGN(HUGEPAGE_SIZE);
         __init_end = .;
         /* freed after init ends here */
 
@@ -116,7 +116,7 @@ SECTIONS
          * that we can properly leave these
          * as writable
          */
-        . = ALIGN(PAGE_SIZE);
+        . = ALIGN(HUGEPAGE_SIZE);
         data_start = .;
 
         EXCEPTION_TABLE(8)
@@ -135,8 +135,11 @@ SECTIONS
         _edata = .;
 
         /* BSS */
-        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 8)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE)
+
+        /* bootmap is allocated in setup_bootmem() directly behind bss. */
 
+        . = ALIGN(HUGEPAGE_SIZE);
         _end = . ;
 
         STABS_DEBUG
diff --git a/arch/parisc/mm/Makefile b/arch/parisc/mm/Makefile
index 758ceefb373a..134393de69d2 100644
--- a/arch/parisc/mm/Makefile
+++ b/arch/parisc/mm/Makefile
@@ -3,3 +3,4 @@
 #
 
 obj-y    := init.o fault.o ioremap.o
+obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
diff --git a/arch/parisc/mm/hugetlbpage.c b/arch/parisc/mm/hugetlbpage.c
new file mode 100644
index 000000000000..f6fdc77a72bd
--- /dev/null
+++ b/arch/parisc/mm/hugetlbpage.c
@@ -0,0 +1,161 @@
+/*
+ * PARISC64 Huge TLB page support.
+ *
+ * This parisc implementation is heavily based on the SPARC and x86 code.
+ *
+ * Copyright (C) 2015 Helge Deller <deller@gmx.de>
+ */
+
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/hugetlb.h>
+#include <linux/pagemap.h>
+#include <linux/sysctl.h>
+
+#include <asm/mman.h>
+#include <asm/pgalloc.h>
+#include <asm/tlb.h>
+#include <asm/tlbflush.h>
+#include <asm/cacheflush.h>
+#include <asm/mmu_context.h>
+
+
+unsigned long
+hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+                unsigned long len, unsigned long pgoff, unsigned long flags)
+{
+        struct hstate *h = hstate_file(file);
+
+        if (len & ~huge_page_mask(h))
+                return -EINVAL;
+        if (len > TASK_SIZE)
+                return -ENOMEM;
+
+        if (flags & MAP_FIXED)
+                if (prepare_hugepage_range(file, addr, len))
+                        return -EINVAL;
+
+        if (addr)
+                addr = ALIGN(addr, huge_page_size(h));
+
+        /* we need to make sure the colouring is OK */
+        return arch_get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
+
+pte_t *huge_pte_alloc(struct mm_struct *mm,
+                        unsigned long addr, unsigned long sz)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte = NULL;
+
+        /* We must align the address, because our caller will run
+         * set_huge_pte_at() on whatever we return, which writes out
+         * all of the sub-ptes for the hugepage range.  So we have
+         * to give it the first such sub-pte.
+         */
+        addr &= HPAGE_MASK;
+
+        pgd = pgd_offset(mm, addr);
+        pud = pud_alloc(mm, pgd, addr);
+        if (pud) {
+                pmd = pmd_alloc(mm, pud, addr);
+                if (pmd)
+                        pte = pte_alloc_map(mm, NULL, pmd, addr);
+        }
+        return pte;
+}
+
+pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte = NULL;
+
+        addr &= HPAGE_MASK;
+
+        pgd = pgd_offset(mm, addr);
+        if (!pgd_none(*pgd)) {
+                pud = pud_offset(pgd, addr);
+                if (!pud_none(*pud)) {
+                        pmd = pmd_offset(pud, addr);
+                        if (!pmd_none(*pmd))
+                                pte = pte_offset_map(pmd, addr);
+                }
+        }
+        return pte;
+}
+
+/* Purge data and instruction TLB entries.  Must be called holding
+ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
+ * machines since the purge must be broadcast to all CPUs.
+ */
+static inline void purge_tlb_entries_huge(struct mm_struct *mm, unsigned long addr)
+{
+        int i;
+
+        /* We may use multiple physical huge pages (e.g. 2x1 MB) to emulate
+         * Linux standard huge pages (e.g. 2 MB) */
+        BUILD_BUG_ON(REAL_HPAGE_SHIFT > HPAGE_SHIFT);
+
+        addr &= HPAGE_MASK;
+        addr |= _HUGE_PAGE_SIZE_ENCODING_DEFAULT;
+
+        for (i = 0; i < (1 << (HPAGE_SHIFT-REAL_HPAGE_SHIFT)); i++) {
+                mtsp(mm->context, 1);
+                pdtlb(addr);
+                if (unlikely(split_tlb))
+                        pitlb(addr);
+                addr += (1UL << REAL_HPAGE_SHIFT);
+        }
+}
+
+void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+                     pte_t *ptep, pte_t entry)
+{
+        unsigned long addr_start;
+        int i;
+
+        addr &= HPAGE_MASK;
+        addr_start = addr;
+
+        for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
+                /* Directly write pte entry.  We could call set_pte_at(mm, addr, ptep, entry)
+                 * instead, but then we get double locking on pa_tlb_lock. */
+                *ptep = entry;
+                ptep++;
+
+                /* Drop the PAGE_SIZE/non-huge tlb entry */
+                purge_tlb_entries(mm, addr);
+
+                addr += PAGE_SIZE;
+                pte_val(entry) += PAGE_SIZE;
+        }
+
+        purge_tlb_entries_huge(mm, addr_start);
+}
+
+
+pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+                              pte_t *ptep)
+{
+        pte_t entry;
+
+        entry = *ptep;
+        set_huge_pte_at(mm, addr, ptep, __pte(0));
+
+        return entry;
+}
+
+int pmd_huge(pmd_t pmd)
+{
+        return 0;
+}
+
+int pud_huge(pud_t pud)
+{
+        return 0;
+}
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index c5fec4890fdf..1b366c477687 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -409,15 +409,11 @@ static void __init map_pages(unsigned long start_vaddr,
         unsigned long vaddr;
         unsigned long ro_start;
         unsigned long ro_end;
-        unsigned long fv_addr;
-        unsigned long gw_addr;
-        extern const unsigned long fault_vector_20;
-        extern void * const linux_gateway_page;
+        unsigned long kernel_end;
 
         ro_start = __pa((unsigned long)_text);
         ro_end   = __pa((unsigned long)&data_start);
-        fv_addr  = __pa((unsigned long)&fault_vector_20) & PAGE_MASK;
-        gw_addr  = __pa((unsigned long)&linux_gateway_page) & PAGE_MASK;
+        kernel_end  = __pa((unsigned long)&_end);
 
         end_paddr = start_paddr + size;
 
@@ -475,24 +471,25 @@ static void __init map_pages(unsigned long start_vaddr,
                         for (tmp2 = start_pte; tmp2 < PTRS_PER_PTE; tmp2++, pg_table++) {
                                 pte_t pte;
 
-                                /*
-                                 * Map the fault vector writable so we can
-                                 * write the HPMC checksum.
-                                 */
                                 if (force)
                                         pte =  __mk_pte(address, pgprot);
-                                else if (parisc_text_address(vaddr) &&
-                                         address != fv_addr)
+                                else if (parisc_text_address(vaddr)) {
                                         pte = __mk_pte(address, PAGE_KERNEL_EXEC);
+                                        if (address >= ro_start && address < kernel_end)
+                                                pte = pte_mkhuge(pte);
+                                }
                                 else
 #if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
-                                if (address >= ro_start && address < ro_end
-                                                        && address != fv_addr
-                                                        && address != gw_addr)
-                                        pte = __mk_pte(address, PAGE_KERNEL_RO);
-                                else
+                                if (address >= ro_start && address < ro_end) {
+                                        pte = __mk_pte(address, PAGE_KERNEL_EXEC);
+                                        pte = pte_mkhuge(pte);
+                                } else
 #endif
+                                {
                                         pte = __mk_pte(address, pgprot);
+                                        if (address >= ro_start && address < kernel_end)
+                                                pte = pte_mkhuge(pte);
+                                }
 
                                 if (address >= end_paddr) {
                                         if (force)
@@ -536,15 +533,12 @@ void free_initmem(void)
 
         /* force the kernel to see the new TLB entries */
         __flush_tlb_range(0, init_begin, init_end);
-        /* Attempt to catch anyone trying to execute code here
-         * by filling the page with BRK insns.
-         */
-        memset((void *)init_begin, 0x00, init_end - init_begin);
+
         /* finally dump all the instructions which were cached, since the
          * pages are no-longer executable */
         flush_icache_range(init_begin, init_end);
         
-        free_initmem_default(-1);
+        free_initmem_default(POISON_FREE_INITMEM);
 
         /* set up a new led state on systems shipped LED State panel */
         pdc_chassis_send_status(PDC_CHASSIS_DIRECT_BCOMPLETE);
@@ -728,8 +722,8 @@ static void __init pagetable_init(void)
                 unsigned long size;
 
                 start_paddr = pmem_ranges[range].start_pfn << PAGE_SHIFT;
-                end_paddr = start_paddr + (pmem_ranges[range].pages << PAGE_SHIFT);
                 size = pmem_ranges[range].pages << PAGE_SHIFT;
+                end_paddr = start_paddr + size;
 
                 map_pages((unsigned long)__va(start_paddr), start_paddr,
                           size, PAGE_KERNEL, 0);
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index a908ada8e0a5..2220f7a60def 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -108,6 +108,7 @@
 #define MSR_TS_T        __MASK(MSR_TS_T_LG)     /*  Transaction Transactional */
 #define MSR_TS_MASK     (MSR_TS_T | MSR_TS_S)   /* Transaction State bits */
 #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
+#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */
 #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T)
 #define MSR_TM_SUSPENDED(x)     (((x) & MSR_TS_MASK) == MSR_TS_S)
 
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index c9e26cb264f4..f2b0b1b0c72a 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -382,3 +382,4 @@ COMPAT_SYS(shmat)
 SYSCALL(shmdt)
 SYSCALL(shmget)
 COMPAT_SYS(shmctl)
+SYSCALL(mlock2)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 6d8f8023ac27..4b6b8ace18e0 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           378
+#define __NR_syscalls           379
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 81579e93c659..1effea5193d6 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -400,5 +400,6 @@
 #define __NR_shmdt              375
 #define __NR_shmget             376
 #define __NR_shmctl             377
+#define __NR_mlock2             378
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 75b6676c1a0b..646bf4d222c1 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -551,6 +551,24 @@ static void tm_reclaim_thread(struct thread_struct *thr,
                 msr_diff &= MSR_FP | MSR_VEC | MSR_VSX | MSR_FE0 | MSR_FE1;
         }
 
+        /*
+         * Use the current MSR TM suspended bit to track if we have
+         * checkpointed state outstanding.
+         * On signal delivery, we'd normally reclaim the checkpointed
+         * state to obtain stack pointer (see:get_tm_stackpointer()).
+         * This will then directly return to userspace without going
+         * through __switch_to(). However, if the stack frame is bad,
+         * we need to exit this thread which calls __switch_to() which
+         * will again attempt to reclaim the already saved tm state.
+         * Hence we need to check that we've not already reclaimed
+         * this state.
+         * We do this using the current MSR, rather tracking it in
+         * some specific thread_struct bit, as it has the additional
+         * benifit of checking for a potential TM bad thing exception.
+         */
+        if (!MSR_TM_SUSPENDED(mfmsr()))
+                return;
+
         tm_reclaim(thr, thr->regs->msr, cause);
 
         /* Having done the reclaim, we now have the checkpointed
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 0dbee465af7a..ef7c24e84a62 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -875,6 +875,15 @@ static long restore_tm_user_regs(struct pt_regs *regs,
                 return 1;
 #endif /* CONFIG_SPE */
 
+        /* Get the top half of the MSR from the user context */
+        if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
+                return 1;
+        msr_hi <<= 32;
+        /* If TM bits are set to the reserved value, it's an invalid context */
+        if (MSR_TM_RESV(msr_hi))
+                return 1;
+        /* Pull in the MSR TM bits from the user context */
+        regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
         /* Now, recheckpoint.  This loads up all of the checkpointed (older)
          * registers, including FP and V[S]Rs.  After recheckpointing, the
          * transactional versions should be loaded.
@@ -884,11 +893,6 @@ static long restore_tm_user_regs(struct pt_regs *regs,
         current->thread.tm_texasr |= TEXASR_FS;
         /* This loads the checkpointed FP/VEC state, if used */
         tm_recheckpoint(&current->thread, msr);
-        /* Get the top half of the MSR */
-        if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
-                return 1;
-        /* Pull in MSR TM from user context */
-        regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
 
         /* This loads the speculative FP/VEC state, if used */
         if (msr & MSR_FP) {
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 20756dfb9f34..c676ecec0869 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -438,6 +438,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
 
         /* get MSR separately, transfer the LE bit if doing signal return */
         err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
+        /* Don't allow reserved mode. */
+        if (MSR_TM_RESV(msr))
+                return -EINVAL;
+
         /* pull in MSR TM from user context */
         regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
 
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 0c5d8ee657f0..d1e7b0a0feeb 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -312,6 +312,7 @@ extern void css_schedule_reprobe(void);
 extern void reipl_ccw_dev(struct ccw_dev_id *id);
 
 struct cio_iplinfo {
+        u8 ssid;
         u16 devno;
         int is_qdio;
 };
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 3ad48f22de78..bab6739a1154 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -206,9 +206,16 @@ do {								\
 } while (0)
 #endif /* CONFIG_COMPAT */
 
-extern unsigned long mmap_rnd_mask;
-
-#define STACK_RND_MASK  (test_thread_flag(TIF_31BIT) ? 0x7ff : mmap_rnd_mask)
+/*
+ * Cache aliasing on the latest machines calls for a mapping granularity
+ * of 512KB. For 64-bit processes use a 512KB alignment and a randomization
+ * of up to 1GB. For 31-bit processes the virtual address space is limited,
+ * use no alignment and limit the randomization to 8MB.
+ */
+#define BRK_RND_MASK    (is_32bit_task() ? 0x7ffUL : 0x3ffffUL)
+#define MMAP_RND_MASK   (is_32bit_task() ? 0x7ffUL : 0x3ff80UL)
+#define MMAP_ALIGN_MASK (is_32bit_task() ? 0 : 0x7fUL)
+#define STACK_RND_MASK  MMAP_RND_MASK
 
 #define ARCH_DLINFO                                                         \
 do {                                                                        \
diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
index 39ae6a359747..86634e71b69f 100644
--- a/arch/s390/include/asm/ipl.h
+++ b/arch/s390/include/asm/ipl.h
@@ -64,7 +64,8 @@ struct ipl_block_fcp {
 
 struct ipl_block_ccw {
         u8  reserved1[84];
-        u8  reserved2[2];
+        u16 reserved2 : 13;
+        u8  ssid : 3;
         u16 devno;
         u8  vm_flags;
         u8  reserved3[3];
diff --git a/arch/s390/include/asm/pci_dma.h b/arch/s390/include/asm/pci_dma.h
index 7a7abf1a5537..1aac41e83ea1 100644
--- a/arch/s390/include/asm/pci_dma.h
+++ b/arch/s390/include/asm/pci_dma.h
@@ -195,5 +195,7 @@ void zpci_dma_exit_device(struct zpci_dev *);
 void dma_free_seg_table(unsigned long);
 unsigned long *dma_alloc_cpu_table(void);
 void dma_cleanup_tables(unsigned long *);
-void dma_update_cpu_trans(unsigned long *, void *, dma_addr_t, int);
+unsigned long *dma_walk_cpu_trans(unsigned long *rto, dma_addr_t dma_addr);
+void dma_update_cpu_trans(unsigned long *entry, void *page_addr, int flags);
+
 #endif
diff --git a/arch/s390/include/asm/trace/diag.h b/arch/s390/include/asm/trace/diag.h
index 776f307960cc..cc6cfe7889da 100644
--- a/arch/s390/include/asm/trace/diag.h
+++ b/arch/s390/include/asm/trace/diag.h
@@ -19,7 +19,7 @@
 #define TRACE_INCLUDE_PATH asm/trace
 #define TRACE_INCLUDE_FILE diag
 
-TRACE_EVENT(diagnose,
+TRACE_EVENT(s390_diagnose,
         TP_PROTO(unsigned short nr),
         TP_ARGS(nr),
         TP_STRUCT__entry(
@@ -32,9 +32,9 @@ TRACE_EVENT(diagnose,
 );
 
 #ifdef CONFIG_TRACEPOINTS
-void trace_diagnose_norecursion(int diag_nr);
+void trace_s390_diagnose_norecursion(int diag_nr);
 #else
-static inline void trace_diagnose_norecursion(int diag_nr) { }
+static inline void trace_s390_diagnose_norecursion(int diag_nr) { }
 #endif
 
 #endif /* _TRACE_S390_DIAG_H */
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index a848adba1504..34ec202472c6 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -192,14 +192,14 @@
 #define __NR_set_tid_address    252
 #define __NR_fadvise64          253
 #define __NR_timer_create       254
-#define __NR_timer_settime      (__NR_timer_create+1)
-#define __NR_timer_gettime      (__NR_timer_create+2)
-#define __NR_timer_getoverrun   (__NR_timer_create+3)
-#define __NR_timer_delete       (__NR_timer_create+4)
-#define __NR_clock_settime      (__NR_timer_create+5)
-#define __NR_clock_gettime      (__NR_timer_create+6)
-#define __NR_clock_getres       (__NR_timer_create+7)
-#define __NR_clock_nanosleep    (__NR_timer_create+8)
+#define __NR_timer_settime      255
+#define __NR_timer_gettime      256
+#define __NR_timer_getoverrun   257
+#define __NR_timer_delete       258
+#define __NR_clock_settime      259
+#define __NR_clock_gettime      260
+#define __NR_clock_getres       261
+#define __NR_clock_nanosleep    262
 /* Number 263 is reserved for vserver */
 #define __NR_statfs64           265
 #define __NR_fstatfs64          266
@@ -309,7 +309,8 @@
 #define __NR_recvfrom           371
 #define __NR_recvmsg            372
 #define __NR_shutdown           373
-#define NR_syscalls 374
+#define __NR_mlock2             374
+#define NR_syscalls 375
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index 09f194052df3..fac4eeddef91 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -176,3 +176,4 @@ COMPAT_SYSCALL_WRAP4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
 COMPAT_SYSCALL_WRAP3(getsockname, int, fd, struct sockaddr __user *, usockaddr, int __user *, usockaddr_len);
 COMPAT_SYSCALL_WRAP3(getpeername, int, fd, struct sockaddr __user *, usockaddr, int __user *, usockaddr_len);
 COMPAT_SYSCALL_WRAP6(sendto, int, fd, void __user *, buff, size_t, len, unsigned int, flags, struct sockaddr __user *, addr, int, addr_len);
+COMPAT_SYSCALL_WRAP3(mlock2, unsigned long, start, size_t, len, int, flags);
diff --git a/arch/s390/kernel/diag.c b/arch/s390/kernel/diag.c
index f98766ede4e1..48b37b8357e6 100644
--- a/arch/s390/kernel/diag.c
+++ b/arch/s390/kernel/diag.c
@@ -121,14 +121,14 @@ device_initcall(show_diag_stat_init);
 void diag_stat_inc(enum diag_stat_enum nr)
 {
         this_cpu_inc(diag_stat.counter[nr]);
-        trace_diagnose(diag_map[nr].code);
+        trace_s390_diagnose(diag_map[nr].code);
 }
 EXPORT_SYMBOL(diag_stat_inc);
 
 void diag_stat_inc_norecursion(enum diag_stat_enum nr)
 {
         this_cpu_inc(diag_stat.counter[nr]);
-        trace_diagnose_norecursion(diag_map[nr].code);
+        trace_s390_diagnose_norecursion(diag_map[nr].code);
 }
 EXPORT_SYMBOL(diag_stat_inc_norecursion);
 
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 1255c6c5353e..301ee9c70688 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -26,6 +26,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/thread_info.h>
 #include <asm/page.h>
+#include <asm/ptrace.h>
 
 #define ARCH_OFFSET     4
 
@@ -59,19 +60,6 @@ __HEAD
         .long   0x020006e0,0x20000050
 
         .org    0x200
-#
-# subroutine to set architecture mode
-#
-.Lsetmode:
-        mvi     __LC_AR_MODE_ID,1       # set esame flag
-        slr     %r0,%r0                 # set cpuid to zero
-        lhi     %r1,2                   # mode 2 = esame (dump)
-        sigp    %r1,%r0,0x12            # switch to esame mode
-        bras    %r13,0f
-        .fill   16,4,0x0
-0:      lmh     %r0,%r15,0(%r13)        # clear high-order half of gprs
-        sam31                           # switch to 31 bit addressing mode
-        br      %r14
 
 #
 # subroutine to wait for end I/O
@@ -159,7 +147,14 @@ __HEAD
         .long   0x02200050,0x00000000
 
 iplstart:
-        bas     %r14,.Lsetmode          # Immediately switch to 64 bit mode
+        mvi     __LC_AR_MODE_ID,1       # set esame flag
+        slr     %r0,%r0                 # set cpuid to zero
+        lhi     %r1,2                   # mode 2 = esame (dump)
+        sigp    %r1,%r0,0x12            # switch to esame mode
+        bras    %r13,0f
+        .fill   16,4,0x0
+0:      lmh     %r0,%r15,0(%r13)        # clear high-order half of gprs
+        sam31                           # switch to 31 bit addressing mode
         lh      %r1,0xb8                # test if subchannel number
         bct     %r1,.Lnoload            #  is valid
         l       %r1,0xb8                # load ipl subchannel number
@@ -269,71 +264,6 @@ iplstart:
 .Lcpuid:.fill   8,1,0
 
 #
-# SALIPL loader support. Based on a patch by Rob van der Heij.
-# This entry point is called directly from the SALIPL loader and
-# doesn't need a builtin ipl record.
-#
-        .org    0x800
-ENTRY(start)
-        stm     %r0,%r15,0x07b0         # store registers
-        bas     %r14,.Lsetmode          # Immediately switch to 64 bit mode
-        basr    %r12,%r0
-.base:
-        l       %r11,.parm
-        l       %r8,.cmd                # pointer to command buffer
-
-        ltr     %r9,%r9                 # do we have SALIPL parameters?
-        bp      .sk8x8
-
-        mvc     0(64,%r8),0x00b0        # copy saved registers
-        xc      64(240-64,%r8),0(%r8)   # remainder of buffer
-        tr      0(64,%r8),.lowcase
-        b       .gotr
-.sk8x8:
-        mvc     0(240,%r8),0(%r9)       # copy iplparms into buffer
-.gotr:
-        slr     %r0,%r0
-        st      %r0,INITRD_SIZE+ARCH_OFFSET-PARMAREA(%r11)
-        st      %r0,INITRD_START+ARCH_OFFSET-PARMAREA(%r11)
-        j       startup                 # continue with startup
-.cmd:   .long   COMMAND_LINE            # address of command line buffer
-.parm:  .long   PARMAREA
-.lowcase:
-        .byte 0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07
-        .byte 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f
-        .byte 0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17
-        .byte 0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f
-        .byte 0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27
-        .byte 0x28,0x29,0x2a,0x2b,0x2c,0x2d,0x2e,0x2f
-        .byte 0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37
-        .byte 0x38,0x39,0x3a,0x3b,0x3c,0x3d,0x3e,0x3f
-        .byte 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47
-        .byte 0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f
-        .byte 0x50,0x51,0x52,0x53,0x54,0x55,0x56,0x57
-        .byte 0x58,0x59,0x5a,0x5b,0x5c,0x5d,0x5e,0x5f
-        .byte 0x60,0x61,0x62,0x63,0x64,0x65,0x66,0x67
-        .byte 0x68,0x69,0x6a,0x6b,0x6c,0x6d,0x6e,0x6f
-        .byte 0x70,0x71,0x72,0x73,0x74,0x75,0x76,0x77
-        .byte 0x78,0x79,0x7a,0x7b,0x7c,0x7d,0x7e,0x7f
-
-        .byte 0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87
-        .byte 0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8e,0x8f
-        .byte 0x90,0x91,0x92,0x93,0x94,0x95,0x96,0x97
-        .byte 0x98,0x99,0x9a,0x9b,0x9c,0x9d,0x9e,0x9f
-        .byte 0xa0,0xa1,0xa2,0xa3,0xa4,0xa5,0xa6,0xa7
-        .byte 0xa8,0xa9,0xaa,0xab,0xac,0xad,0xae,0xaf
-        .byte 0xb0,0xb1,0xb2,0xb3,0xb4,0xb5,0xb6,0xb7
-        .byte 0xb8,0xb9,0xba,0xbb,0xbc,0xbd,0xbe,0xbf
-        .byte 0xc0,0x81,0x82,0x83,0x84,0x85,0x86,0x87   # .abcdefg
-        .byte 0x88,0x89,0xca,0xcb,0xcc,0xcd,0xce,0xcf   # hi
-        .byte 0xd0,0x91,0x92,0x93,0x94,0x95,0x96,0x97   # .jklmnop
-        .byte 0x98,0x99,0xda,0xdb,0xdc,0xdd,0xde,0xdf   # qr
-        .byte 0xe0,0xe1,0xa2,0xa3,0xa4,0xa5,0xa6,0xa7   # ..stuvwx
-        .byte 0xa8,0xa9,0xea,0xeb,0xec,0xed,0xee,0xef   # yz
-        .byte 0xf0,0xf1,0xf2,0xf3,0xf4,0xf5,0xf6,0xf7
-        .byte 0xf8,0xf9,0xfa,0xfb,0xfc,0xfd,0xfe,0xff
-
-#
 # startup-code at 0x10000, running in absolute addressing mode
 # this is called either by the ipl loader or directly by PSW restart
 # or linload or SALIPL
@@ -364,7 +294,7 @@ ENTRY(startup_kdump)
         bras    %r13,0f
         .fill   16,4,0x0
 0:      lmh     %r0,%r15,0(%r13)        # clear high-order half of gprs
-        sam31                           # switch to 31 bit addressing mode
+        sam64                           # switch to 64 bit addressing mode
         basr    %r13,0                  # get base
 .LPG0:
         xc      0x200(256),0x200        # partially clear lowcore
@@ -395,7 +325,7 @@ ENTRY(startup_kdump)
         jnz     1b
         j       4f
 2:      l       %r15,.Lstack-.LPG0(%r13)
-        ahi     %r15,-96
+        ahi     %r15,-STACK_FRAME_OVERHEAD
         la      %r2,.Lals_string-.LPG0(%r13)
         l       %r3,.Lsclp_print-.LPG0(%r13)
         basr    %r14,%r3
@@ -429,8 +359,7 @@ ENTRY(startup_kdump)
         .long 1, 0xc0000000
 #endif
 4:
-        /* Continue with 64bit startup code in head64.S */
-        sam64                           # switch to 64 bit mode
+        /* Continue with startup code in head64.S */
         jg      startup_continue
 
         .align  8
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index f6d8acd7e136..b1f0a90f933b 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -121,6 +121,7 @@ static char *dump_type_str(enum dump_type type)
  * Must be in data section since the bss section
  * is not cleared when these are accessed.
  */
+static u8 ipl_ssid __attribute__((__section__(".data"))) = 0;
 static u16 ipl_devno __attribute__((__section__(".data"))) = 0;
 u32 ipl_flags __attribute__((__section__(".data"))) = 0;
 
@@ -197,6 +198,33 @@ static ssize_t sys_##_prefix##_##_name##_show(struct kobject *kobj,	\
         return snprintf(page, PAGE_SIZE, _format, ##args);              \
 }
 
+#define IPL_ATTR_CCW_STORE_FN(_prefix, _name, _ipl_blk)                 \
+static ssize_t sys_##_prefix##_##_name##_store(struct kobject *kobj,    \
+                struct kobj_attribute *attr,                            \
+                const char *buf, size_t len)                            \
+{                                                                       \
+        unsigned long long ssid, devno;                                 \
+                                                                        \
+        if (sscanf(buf, "0.%llx.%llx\n", &ssid, &devno) != 2)           \
+                return -EINVAL;                                         \
+                                                                        \
+        if (ssid > __MAX_SSID || devno > __MAX_SUBCHANNEL)              \
+                return -EINVAL;                                         \
+                                                                        \
+        _ipl_blk.ssid = ssid;                                           \
+        _ipl_blk.devno = devno;                                         \
+        return len;                                                     \
+}
+
+#define DEFINE_IPL_CCW_ATTR_RW(_prefix, _name, _ipl_blk)                \
+IPL_ATTR_SHOW_FN(_prefix, _name, "0.%x.%04x\n",                         \
+                 _ipl_blk.ssid, _ipl_blk.devno);                        \
+IPL_ATTR_CCW_STORE_FN(_prefix, _name, _ipl_blk);                        \
+static struct kobj_attribute sys_##_prefix##_##_name##_attr =           \
+        __ATTR(_name, (S_IRUGO | S_IWUSR),                              \
+               sys_##_prefix##_##_name##_show,                          \
+               sys_##_prefix##_##_name##_store)                         \
+
 #define DEFINE_IPL_ATTR_RO(_prefix, _name, _format, _value)             \
 IPL_ATTR_SHOW_FN(_prefix, _name, _format, _value)                       \
 static struct kobj_attribute sys_##_prefix##_##_name##_attr =           \
@@ -395,7 +423,7 @@ static ssize_t sys_ipl_device_show(struct kobject *kobj,
 
         switch (ipl_info.type) {
         case IPL_TYPE_CCW:
-                return sprintf(page, "0.0.%04x\n", ipl_devno);
+                return sprintf(page, "0.%x.%04x\n", ipl_ssid, ipl_devno);
         case IPL_TYPE_FCP:
         case IPL_TYPE_FCP_DUMP:
                 return sprintf(page, "0.0.%04x\n", ipl->ipl_info.fcp.devno);
@@ -687,21 +715,14 @@ static ssize_t reipl_fcp_scpdata_write(struct file *filp, struct kobject *kobj,
                                        struct bin_attribute *attr,
                                        char *buf, loff_t off, size_t count)
 {
+        size_t scpdata_len = count;
         size_t padding;
-        size_t scpdata_len;
-
-        if (off < 0)
-                return -EINVAL;
 
-        if (off >= DIAG308_SCPDATA_SIZE)
-                return -ENOSPC;
 
-        if (count > DIAG308_SCPDATA_SIZE - off)
-                count = DIAG308_SCPDATA_SIZE - off;
-
-        memcpy(reipl_block_fcp->ipl_info.fcp.scp_data, buf + off, count);
-        scpdata_len = off + count;
+        if (off)
+                return -EINVAL;
 
+        memcpy(reipl_block_fcp->ipl_info.fcp.scp_data, buf, count);
         if (scpdata_len % 8) {
                 padding = 8 - (scpdata_len % 8);
                 memset(reipl_block_fcp->ipl_info.fcp.scp_data + scpdata_len,
@@ -717,7 +738,7 @@ static ssize_t reipl_fcp_scpdata_write(struct file *filp, struct kobject *kobj,
 }
 static struct bin_attribute sys_reipl_fcp_scp_data_attr =
         __BIN_ATTR(scp_data, (S_IRUGO | S_IWUSR), reipl_fcp_scpdata_read,
-                   reipl_fcp_scpdata_write, PAGE_SIZE);
+                   reipl_fcp_scpdata_write, DIAG308_SCPDATA_SIZE);
 
 static struct bin_attribute *reipl_fcp_bin_attrs[] = {
         &sys_reipl_fcp_scp_data_attr,
@@ -814,9 +835,7 @@ static struct attribute_group reipl_fcp_attr_group = {
 };
 
 /* CCW reipl device attributes */
-
-DEFINE_IPL_ATTR_RW(reipl_ccw, device, "0.0.%04llx\n", "0.0.%llx\n",
-        reipl_block_ccw->ipl_info.ccw.devno);
+DEFINE_IPL_CCW_ATTR_RW(reipl_ccw, device, reipl_block_ccw->ipl_info.ccw);
 
 /* NSS wrapper */
 static ssize_t reipl_nss_loadparm_show(struct kobject *kobj,
@@ -1056,8 +1075,8 @@ static void __reipl_run(void *unused)
 
         switch (reipl_method) {
         case REIPL_METHOD_CCW_CIO:
+                devid.ssid  = reipl_block_ccw->ipl_info.ccw.ssid;
                 devid.devno = reipl_block_ccw->ipl_info.ccw.devno;
-                devid.ssid  = 0;
                 reipl_ccw_dev(&devid);
                 break;
         case REIPL_METHOD_CCW_VM:
@@ -1192,6 +1211,7 @@ static int __init reipl_ccw_init(void)
 
         reipl_block_ccw_init(reipl_block_ccw);
         if (ipl_info.type == IPL_TYPE_CCW) {
+                reipl_block_ccw->ipl_info.ccw.ssid = ipl_ssid;
                 reipl_block_ccw->ipl_info.ccw.devno = ipl_devno;
                 reipl_block_ccw_fill_parms(reipl_block_ccw);
         }
@@ -1336,9 +1356,7 @@ static struct attribute_group dump_fcp_attr_group = {
 };
 
 /* CCW dump device attributes */
-
-DEFINE_IPL_ATTR_RW(dump_ccw, device, "0.0.%04llx\n", "0.0.%llx\n",
-                   dump_block_ccw->ipl_info.ccw.devno);
+DEFINE_IPL_CCW_ATTR_RW(dump_ccw, device, dump_block_ccw->ipl_info.ccw);
 
 static struct attribute *dump_ccw_attrs[] = {
         &sys_dump_ccw_device_attr.attr,
@@ -1418,8 +1436,8 @@ static void __dump_run(void *unused)
 
         switch (dump_method) {
         case DUMP_METHOD_CCW_CIO:
+                devid.ssid  = dump_block_ccw->ipl_info.ccw.ssid;
                 devid.devno = dump_block_ccw->ipl_info.ccw.devno;
-                devid.ssid  = 0;
                 reipl_ccw_dev(&devid);
                 break;
         case DUMP_METHOD_CCW_VM:
@@ -1939,14 +1957,14 @@ void __init setup_ipl(void)
         ipl_info.type = get_ipl_type();
         switch (ipl_info.type) {
         case IPL_TYPE_CCW:
+                ipl_info.data.ccw.dev_id.ssid = ipl_ssid;
                 ipl_info.data.ccw.dev_id.devno = ipl_devno;
-                ipl_info.data.ccw.dev_id.ssid = 0;
                 break;
         case IPL_TYPE_FCP:
         case IPL_TYPE_FCP_DUMP:
+                ipl_info.data.fcp.dev_id.ssid = 0;
                 ipl_info.data.fcp.dev_id.devno =
                         IPL_PARMBLOCK_START->ipl_info.fcp.devno;
-                ipl_info.data.fcp.dev_id.ssid = 0;
                 ipl_info.data.fcp.wwpn = IPL_PARMBLOCK_START->ipl_info.fcp.wwpn;
                 ipl_info.data.fcp.lun = IPL_PARMBLOCK_START->ipl_info.fcp.lun;
                 break;
@@ -1978,6 +1996,7 @@ void __init ipl_save_parameters(void)
         if (cio_get_iplinfo(&iplinfo))
                 return;
 
+        ipl_ssid = iplinfo.ssid;
         ipl_devno = iplinfo.devno;
         ipl_flags |= IPL_DEVNO_VALID;
         if (!iplinfo.is_qdio)
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 688a3aad9c79..114ee8b96f17 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -243,11 +243,7 @@ unsigned long arch_align_stack(unsigned long sp)
 
 static inline unsigned long brk_rnd(void)
 {
-        /* 8MB for 32bit, 1GB for 64bit */
-        if (is_32bit_task())
-                return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
-        else
-                return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
+        return (get_random_int() & BRK_RND_MASK) << PAGE_SHIFT;
 }
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
diff --git a/arch/s390/kernel/sclp.c b/arch/s390/kernel/sclp.c
index fa0bdff1d413..9fe7781a45cd 100644
--- a/arch/s390/kernel/sclp.c
+++ b/arch/s390/kernel/sclp.c
@@ -21,7 +21,7 @@ static void _sclp_wait_int(void)
         __ctl_load(cr0_new, 0, 0);
 
         psw_ext_save = S390_lowcore.external_new_psw;
-        psw_mask = __extract_psw() & (PSW_MASK_EA | PSW_MASK_BA);
+        psw_mask = __extract_psw();
         S390_lowcore.external_new_psw.mask = psw_mask;
         psw_wait.mask = psw_mask | PSW_MASK_EXT | PSW_MASK_WAIT;
         S390_lowcore.ext_int_code = 0;
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ce0cbd6ba7ca..c837bcacf218 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -764,9 +764,6 @@ static int __init setup_hwcaps(void)
         get_cpu_id(&cpu_id);
         add_device_randomness(&cpu_id, sizeof(cpu_id));
         switch (cpu_id.machine) {
-        case 0x9672:
-                strcpy(elf_platform, "g5");
-                break;
         case 0x2064:
         case 0x2066:
         default:        /* Use "z900" as default for 64 bit kernels. */
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 8c56929c8d82..5378c3ea1b98 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -382,3 +382,4 @@ SYSCALL(sys_sendmsg,compat_sys_sendmsg)			/* 370 */
 SYSCALL(sys_recvfrom,compat_sys_recvfrom)
 SYSCALL(sys_recvmsg,compat_sys_recvmsg)
 SYSCALL(sys_shutdown,sys_shutdown)
+SYSCALL(sys_mlock2,compat_sys_mlock2)
diff --git a/arch/s390/kernel/trace.c b/arch/s390/kernel/trace.c
index 73239bb576c4..21a5df99552b 100644
--- a/arch/s390/kernel/trace.c
+++ b/arch/s390/kernel/trace.c
@@ -9,11 +9,11 @@
 #define CREATE_TRACE_POINTS
 #include <asm/trace/diag.h>
 
-EXPORT_TRACEPOINT_SYMBOL(diagnose);
+EXPORT_TRACEPOINT_SYMBOL(s390_diagnose);
 
 static DEFINE_PER_CPU(unsigned int, diagnose_trace_depth);
 
-void trace_diagnose_norecursion(int diag_nr)
+void trace_s390_diagnose_norecursion(int diag_nr)
 {
         unsigned long flags;
         unsigned int *depth;
@@ -22,7 +22,7 @@ void trace_diagnose_norecursion(int diag_nr)
         depth = this_cpu_ptr(&diagnose_trace_depth);
         if (*depth == 0) {
                 (*depth)++;
-                trace_diagnose(diag_nr);
+                trace_s390_diagnose(diag_nr);
                 (*depth)--;
         }
         local_irq_restore(flags);
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 373e32346d68..6a75352f453c 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1030,8 +1030,7 @@ static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
                                    src_id, 0);
 
         /* sending vcpu invalid */
-        if (src_id >= KVM_MAX_VCPUS ||
-            kvm_get_vcpu(vcpu->kvm, src_id) == NULL)
+        if (kvm_get_vcpu_by_id(vcpu->kvm, src_id) == NULL)
                 return -EINVAL;
 
         if (sclp.has_sigpif)
@@ -1110,6 +1109,10 @@ static int __inject_sigp_emergency(struct kvm_vcpu *vcpu,
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY,
                                    irq->u.emerg.code, 0);
 
+        /* sending vcpu invalid */
+        if (kvm_get_vcpu_by_id(vcpu->kvm, irq->u.emerg.code) == NULL)
+                return -EINVAL;
+
         set_bit(irq->u.emerg.code, li->sigp_emerg_pending);
         set_bit(IRQ_PEND_EXT_EMERGENCY, &li->pending_irqs);
         atomic_or(CPUSTAT_EXT_INT, li->cpuflags);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 8fe2f1c722dc..846589281b04 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -342,12 +342,16 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 r = 0;
                 break;
         case KVM_CAP_S390_VECTOR_REGISTERS:
-                if (MACHINE_HAS_VX) {
+                mutex_lock(&kvm->lock);
+                if (atomic_read(&kvm->online_vcpus)) {
+                        r = -EBUSY;
+                } else if (MACHINE_HAS_VX) {
                         set_kvm_facility(kvm->arch.model.fac->mask, 129);
                         set_kvm_facility(kvm->arch.model.fac->list, 129);
                         r = 0;
                 } else
                         r = -EINVAL;
+                mutex_unlock(&kvm->lock);
                 VM_EVENT(kvm, 3, "ENABLE: CAP_S390_VECTOR_REGISTERS %s",
                          r ? "(not available)" : "(success)");
                 break;
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 77191b85ea7a..d76b51cb4b62 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -660,7 +660,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
 
         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 
-        if (!MACHINE_HAS_PFMF)
+        if (!test_kvm_facility(vcpu->kvm, 8))
                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index da690b69f9fe..77c22d685c7a 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -291,12 +291,8 @@ static int handle_sigp_dst(struct kvm_vcpu *vcpu, u8 order_code,
                            u16 cpu_addr, u32 parameter, u64 *status_reg)
 {
         int rc;
-        struct kvm_vcpu *dst_vcpu;
+        struct kvm_vcpu *dst_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr);
 
-        if (cpu_addr >= KVM_MAX_VCPUS)
-                return SIGP_CC_NOT_OPERATIONAL;
-
-        dst_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr);
         if (!dst_vcpu)
                 return SIGP_CC_NOT_OPERATIONAL;
 
@@ -478,7 +474,7 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu)
         trace_kvm_s390_handle_sigp_pei(vcpu, order_code, cpu_addr);
 
         if (order_code == SIGP_EXTERNAL_CALL) {
-                dest_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr);
+                dest_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr);
                 BUG_ON(dest_vcpu == NULL);
 
                 kvm_s390_vcpu_wakeup(dest_vcpu);
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index c3c07d3505ba..c722400c7697 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -48,37 +48,13 @@ EXPORT_SYMBOL(zero_page_mask);
 
 static void __init setup_zero_pages(void)
 {
-        struct cpuid cpu_id;
         unsigned int order;
         struct page *page;
         int i;
 
-        get_cpu_id(&cpu_id);
-        switch (cpu_id.machine) {
-        case 0x9672:    /* g5 */
-        case 0x2064:    /* z900 */
-        case 0x2066:    /* z900 */
-        case 0x2084:    /* z990 */
-        case 0x2086:    /* z990 */
-        case 0x2094:    /* z9-109 */
-        case 0x2096:    /* z9-109 */
-                order = 0;
-                break;
-        case 0x2097:    /* z10 */
-        case 0x2098:    /* z10 */
-        case 0x2817:    /* z196 */
-        case 0x2818:    /* z196 */
-                order = 2;
-                break;
-        case 0x2827:    /* zEC12 */
-        case 0x2828:    /* zEC12 */
-                order = 5;
-                break;
-        case 0x2964:    /* z13 */
-        default:
-                order = 7;
-                break;
-        }
+        /* Latest machines require a mapping granularity of 512KB */
+        order = 7;
+
         /* Limit number of empty zero pages for small memory sizes */
         while (order > 2 && (totalram_pages >> 10) < (1UL << order))
                 order--;
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 6e552af08c76..ea01477b4aa6 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -31,9 +31,6 @@
 #include <linux/security.h>
 #include <asm/pgalloc.h>
 
-unsigned long mmap_rnd_mask;
-static unsigned long mmap_align_mask;
-
 static unsigned long stack_maxrandom_size(void)
 {
         if (!(current->flags & PF_RANDOMIZE))
@@ -62,10 +59,7 @@ static inline int mmap_is_legacy(void)
 
 unsigned long arch_mmap_rnd(void)
 {
-        if (is_32bit_task())
-                return (get_random_int() & 0x7ff) << PAGE_SHIFT;
-        else
-                return (get_random_int() & mmap_rnd_mask) << PAGE_SHIFT;
+        return (get_random_int() & MMAP_RND_MASK) << PAGE_SHIFT;
 }
 
 static unsigned long mmap_base_legacy(unsigned long rnd)
@@ -92,7 +86,6 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
         struct vm_unmapped_area_info info;
-        int do_color_align;
 
         if (len > TASK_SIZE - mmap_min_addr)
                 return -ENOMEM;
@@ -108,15 +101,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                         return addr;
         }
 
-        do_color_align = 0;
-        if (filp || (flags & MAP_SHARED))
-                do_color_align = !is_32bit_task();
-
         info.flags = 0;
         info.length = len;
         info.low_limit = mm->mmap_base;
         info.high_limit = TASK_SIZE;
-        info.align_mask = do_color_align ? (mmap_align_mask << PAGE_SHIFT) : 0;
+        if (filp || (flags & MAP_SHARED))
+                info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT;
+        else
+                info.align_mask = 0;
         info.align_offset = pgoff << PAGE_SHIFT;
         return vm_unmapped_area(&info);
 }
@@ -130,7 +122,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         struct vm_unmapped_area_info info;
-        int do_color_align;
 
         /* requested length too big for entire address space */
         if (len > TASK_SIZE - mmap_min_addr)
@@ -148,15 +139,14 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         return addr;
         }
 
-        do_color_align = 0;
-        if (filp || (flags & MAP_SHARED))
-                do_color_align = !is_32bit_task();
-
         info.flags = VM_UNMAPPED_AREA_TOPDOWN;
         info.length = len;
         info.low_limit = max(PAGE_SIZE, mmap_min_addr);
         info.high_limit = mm->mmap_base;
-        info.align_mask = do_color_align ? (mmap_align_mask << PAGE_SHIFT) : 0;
+        if (filp || (flags & MAP_SHARED))
+                info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT;
+        else
+                info.align_mask = 0;
         info.align_offset = pgoff << PAGE_SHIFT;
         addr = vm_unmapped_area(&info);
 
@@ -254,35 +244,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
                 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
         }
 }
-
-static int __init setup_mmap_rnd(void)
-{
-        struct cpuid cpu_id;
-
-        get_cpu_id(&cpu_id);
-        switch (cpu_id.machine) {
-        case 0x9672:
-        case 0x2064:
-        case 0x2066:
-        case 0x2084:
-        case 0x2086:
-        case 0x2094:
-        case 0x2096:
-        case 0x2097:
-        case 0x2098:
-        case 0x2817:
-        case 0x2818:
-        case 0x2827:
-        case 0x2828:
-                mmap_rnd_mask = 0x7ffUL;
-                mmap_align_mask = 0UL;
-                break;
-        case 0x2964:    /* z13 */
-        default:
-                mmap_rnd_mask = 0x3ff80UL;
-                mmap_align_mask = 0x7fUL;
-                break;
-        }
-        return 0;
-}
-early_initcall(setup_mmap_rnd);
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 37d10f74425a..d348f2c09a1e 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -33,7 +33,7 @@ unsigned long *dma_alloc_cpu_table(void)
                 return NULL;
 
         for (entry = table; entry < table + ZPCI_TABLE_ENTRIES; entry++)
-                *entry = ZPCI_TABLE_INVALID | ZPCI_TABLE_PROTECTED;
+                *entry = ZPCI_TABLE_INVALID;
         return table;
 }
 
@@ -51,7 +51,7 @@ static unsigned long *dma_alloc_page_table(void)
                 return NULL;
 
         for (entry = table; entry < table + ZPCI_PT_ENTRIES; entry++)
-                *entry = ZPCI_PTE_INVALID | ZPCI_TABLE_PROTECTED;
+                *entry = ZPCI_PTE_INVALID;
         return table;
 }
 
@@ -95,7 +95,7 @@ static unsigned long *dma_get_page_table_origin(unsigned long *entry)
         return pto;
 }
 
-static unsigned long *dma_walk_cpu_trans(unsigned long *rto, dma_addr_t dma_addr)
+unsigned long *dma_walk_cpu_trans(unsigned long *rto, dma_addr_t dma_addr)
 {
         unsigned long *sto, *pto;
         unsigned int rtx, sx, px;
@@ -114,20 +114,10 @@ static unsigned long *dma_walk_cpu_trans(unsigned long *rto, dma_addr_t dma_addr
         return &pto[px];
 }
 
-void dma_update_cpu_trans(unsigned long *dma_table, void *page_addr,
-                          dma_addr_t dma_addr, int flags)
+void dma_update_cpu_trans(unsigned long *entry, void *page_addr, int flags)
 {
-        unsigned long *entry;
-
-        entry = dma_walk_cpu_trans(dma_table, dma_addr);
-        if (!entry) {
-                WARN_ON_ONCE(1);
-                return;
-        }
-
         if (flags & ZPCI_PTE_INVALID) {
                 invalidate_pt_entry(entry);
-                return;
         } else {
                 set_pt_pfaa(entry, page_addr);
                 validate_pt_entry(entry);
@@ -146,18 +136,25 @@ static int dma_update_trans(struct zpci_dev *zdev, unsigned long pa,
         u8 *page_addr = (u8 *) (pa & PAGE_MASK);
         dma_addr_t start_dma_addr = dma_addr;
         unsigned long irq_flags;
+        unsigned long *entry;
         int i, rc = 0;
 
         if (!nr_pages)
                 return -EINVAL;
 
         spin_lock_irqsave(&zdev->dma_table_lock, irq_flags);
-        if (!zdev->dma_table)
+        if (!zdev->dma_table) {
+                rc = -EINVAL;
                 goto no_refresh;
+        }
 
         for (i = 0; i < nr_pages; i++) {
-                dma_update_cpu_trans(zdev->dma_table, page_addr, dma_addr,
-                                     flags);
+                entry = dma_walk_cpu_trans(zdev->dma_table, dma_addr);
+                if (!entry) {
+                        rc = -ENOMEM;
+                        goto undo_cpu_trans;
+                }
+                dma_update_cpu_trans(entry, page_addr, flags);
                 page_addr += PAGE_SIZE;
                 dma_addr += PAGE_SIZE;
         }
@@ -176,6 +173,18 @@ static int dma_update_trans(struct zpci_dev *zdev, unsigned long pa,
 
         rc = zpci_refresh_trans((u64) zdev->fh << 32, start_dma_addr,
                                 nr_pages * PAGE_SIZE);
+undo_cpu_trans:
+        if (rc && ((flags & ZPCI_PTE_VALID_MASK) == ZPCI_PTE_VALID)) {
+                flags = ZPCI_PTE_INVALID;
+                while (i-- > 0) {
+                        page_addr -= PAGE_SIZE;
+                        dma_addr -= PAGE_SIZE;
+                        entry = dma_walk_cpu_trans(zdev->dma_table, dma_addr);
+                        if (!entry)
+                                break;
+                        dma_update_cpu_trans(entry, page_addr, flags);
+                }
+        }
 
 no_refresh:
         spin_unlock_irqrestore(&zdev->dma_table_lock, irq_flags);
@@ -260,6 +269,16 @@ out:
         spin_unlock_irqrestore(&zdev->iommu_bitmap_lock, flags);
 }
 
+static inline void zpci_err_dma(unsigned long rc, unsigned long addr)
+{
+        struct {
+                unsigned long rc;
+                unsigned long addr;
+        } __packed data = {rc, addr};
+
+        zpci_err_hex(&data, sizeof(data));
+}
+
 static dma_addr_t s390_dma_map_pages(struct device *dev, struct page *page,
                                      unsigned long offset, size_t size,
                                      enum dma_data_direction direction,
@@ -270,33 +289,40 @@ static dma_addr_t s390_dma_map_pages(struct device *dev, struct page *page,
         unsigned long pa = page_to_phys(page) + offset;
         int flags = ZPCI_PTE_VALID;
         dma_addr_t dma_addr;
+        int ret;
 
         /* This rounds up number of pages based on size and offset */
         nr_pages = iommu_num_pages(pa, size, PAGE_SIZE);
         iommu_page_index = dma_alloc_iommu(zdev, nr_pages);
-        if (iommu_page_index == -1)
+        if (iommu_page_index == -1) {
+                ret = -ENOSPC;
                 goto out_err;
+        }
 
         /* Use rounded up size */
         size = nr_pages * PAGE_SIZE;
 
         dma_addr = zdev->start_dma + iommu_page_index * PAGE_SIZE;
-        if (dma_addr + size > zdev->end_dma)
+        if (dma_addr + size > zdev->end_dma) {
+                ret = -ERANGE;
                 goto out_free;
+        }
 
         if (direction == DMA_NONE || direction == DMA_TO_DEVICE)
                 flags |= ZPCI_TABLE_PROTECTED;
 
-        if (!dma_update_trans(zdev, pa, dma_addr, size, flags)) {
-                atomic64_add(nr_pages, &zdev->mapped_pages);
-                return dma_addr + (offset & ~PAGE_MASK);
-        }
+        ret = dma_update_trans(zdev, pa, dma_addr, size, flags);
+        if (ret)
+                goto out_free;
+
+        atomic64_add(nr_pages, &zdev->mapped_pages);
+        return dma_addr + (offset & ~PAGE_MASK);
 
 out_free:
         dma_free_iommu(zdev, iommu_page_index, nr_pages);
 out_err:
         zpci_err("map error:\n");
-        zpci_err_hex(&pa, sizeof(pa));
+        zpci_err_dma(ret, pa);
         return DMA_ERROR_CODE;
 }
 
@@ -306,14 +332,16 @@ static void s390_dma_unmap_pages(struct device *dev, dma_addr_t dma_addr,
 {
         struct zpci_dev *zdev = to_zpci(to_pci_dev(dev));
         unsigned long iommu_page_index;
-        int npages;
+        int npages, ret;
 
         npages = iommu_num_pages(dma_addr, size, PAGE_SIZE);
         dma_addr = dma_addr & PAGE_MASK;
-        if (dma_update_trans(zdev, 0, dma_addr, npages * PAGE_SIZE,
-                             ZPCI_TABLE_PROTECTED | ZPCI_PTE_INVALID)) {
+        ret = dma_update_trans(zdev, 0, dma_addr, npages * PAGE_SIZE,
+                               ZPCI_PTE_INVALID);
+        if (ret) {
                 zpci_err("unmap error:\n");
-                zpci_err_hex(&dma_addr, sizeof(dma_addr));
+                zpci_err_dma(ret, dma_addr);
+                return;
         }
 
         atomic64_add(npages, &zdev->unmapped_pages);
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 9f3905697f12..690b4027e17c 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -35,7 +35,7 @@
 #define MSR_IA32_PERFCTR0               0x000000c1
 #define MSR_IA32_PERFCTR1               0x000000c2
 #define MSR_FSB_FREQ                    0x000000cd
-#define MSR_NHM_PLATFORM_INFO           0x000000ce
+#define MSR_PLATFORM_INFO               0x000000ce
 
 #define MSR_NHM_SNB_PKG_CST_CFG_CTL     0x000000e2
 #define NHM_C3_AUTO_DEMOTE              (1UL << 25)
@@ -44,7 +44,6 @@
 #define SNB_C1_AUTO_UNDEMOTE            (1UL << 27)
 #define SNB_C3_AUTO_UNDEMOTE            (1UL << 28)
 
-#define MSR_PLATFORM_INFO               0x000000ce
 #define MSR_MTRRcap                     0x000000fe
 #define MSR_IA32_BBL_CR_CTL             0x00000119
 #define MSR_IA32_BBL_CR_CTL3            0x0000011e
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 4ddd780aeac9..c2b7522cbf35 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -273,10 +273,9 @@ __setup("nosmap", setup_disable_smap);
 
 static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 {
-        unsigned long eflags;
+        unsigned long eflags = native_save_fl();
 
         /* This should have been cleared long ago */
-        raw_local_save_flags(eflags);
         BUG_ON(eflags & X86_EFLAGS_AC);
 
         if (cpu_has(c, X86_FEATURE_SMAP)) {
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index ef29b742cea7..31c6a60505e6 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -385,20 +385,19 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame,
  */
 void fpu__init_prepare_fx_sw_frame(void)
 {
-        int fsave_header_size = sizeof(struct fregs_state);
         int size = xstate_size + FP_XSTATE_MAGIC2_SIZE;
 
-        if (config_enabled(CONFIG_X86_32))
-                size += fsave_header_size;
-
         fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;
         fx_sw_reserved.extended_size = size;
         fx_sw_reserved.xfeatures = xfeatures_mask;
         fx_sw_reserved.xstate_size = xstate_size;
 
-        if (config_enabled(CONFIG_IA32_EMULATION)) {
+        if (config_enabled(CONFIG_IA32_EMULATION) ||
+            config_enabled(CONFIG_X86_32)) {
+                int fsave_header_size = sizeof(struct fregs_state);
+
                 fx_sw_reserved_ia32 = fx_sw_reserved;
-                fx_sw_reserved_ia32.extended_size += fsave_header_size;
+                fx_sw_reserved_ia32.extended_size = size + fsave_header_size;
         }
 }
 
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 6454f2731b56..70fc312221fc 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -694,7 +694,6 @@ void *get_xsave_addr(struct xregs_state *xsave, int xstate_feature)
         if (!boot_cpu_has(X86_FEATURE_XSAVE))
                 return NULL;
 
-        xsave = &current->thread.fpu.state.xsave;
         /*
          * We should not ever be requesting features that we
          * have not enabled.  Remember that pcntxt_mask is
diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S
index 94ea120fa21f..87e1762e2bca 100644
--- a/arch/x86/kernel/mcount_64.S
+++ b/arch/x86/kernel/mcount_64.S
@@ -278,6 +278,12 @@ trace:
         /* save_mcount_regs fills in first two parameters */
         save_mcount_regs
 
+        /*
+         * When DYNAMIC_FTRACE is not defined, ARCH_SUPPORTS_FTRACE_OPS is not
+         * set (see include/asm/ftrace.h and include/linux/ftrace.h).  Only the
+         * ip and parent ip are used and the list function is called when
+         * function tracing is enabled.
+         */
         call   *ftrace_trace_function
 
         restore_mcount_regs
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 87acc5221740..af823a388c19 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7394,11 +7394,6 @@ static int handle_invvpid(struct kvm_vcpu *vcpu)
 
         switch (type) {
         case VMX_VPID_EXTENT_ALL_CONTEXT:
-                if (get_vmcs12(vcpu)->virtual_processor_id == 0) {
-                        nested_vmx_failValid(vcpu,
-                                VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
-                        return 1;
-                }
                 __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02);
                 nested_vmx_succeed(vcpu);
                 break;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 00462bd63129..eed32283d22c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2763,6 +2763,26 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
         return 0;
 }
 
+static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
+{
+        return (!lapic_in_kernel(vcpu) ||
+                kvm_apic_accept_pic_intr(vcpu));
+}
+
+/*
+ * if userspace requested an interrupt window, check that the
+ * interrupt window is open.
+ *
+ * No need to exit to userspace if we already have an interrupt queued.
+ */
+static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
+{
+        return kvm_arch_interrupt_allowed(vcpu) &&
+                !kvm_cpu_has_interrupt(vcpu) &&
+                !kvm_event_needs_reinjection(vcpu) &&
+                kvm_cpu_accept_dm_intr(vcpu);
+}
+
 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
                                     struct kvm_interrupt *irq)
 {
@@ -2786,6 +2806,7 @@ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
                 return -EEXIST;
 
         vcpu->arch.pending_external_vector = irq->irq;
+        kvm_make_request(KVM_REQ_EVENT, vcpu);
         return 0;
 }
 
@@ -5910,23 +5931,10 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt)
         return emulator_write_emulated(ctxt, rip, instruction, 3, NULL);
 }
 
-/*
- * Check if userspace requested an interrupt window, and that the
- * interrupt window is open.
- *
- * No need to exit to userspace if we already have an interrupt queued.
- */
 static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->run->request_interrupt_window || pic_in_kernel(vcpu->kvm))
-                return false;
-
-        if (kvm_cpu_has_interrupt(vcpu))
-                return false;
-
-        return (irqchip_split(vcpu->kvm)
-                ? kvm_apic_accept_pic_intr(vcpu)
-                : kvm_arch_interrupt_allowed(vcpu));
+        return vcpu->run->request_interrupt_window &&
+                likely(!pic_in_kernel(vcpu->kvm));
 }
 
 static void post_kvm_run_save(struct kvm_vcpu *vcpu)
@@ -5937,17 +5945,9 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
         kvm_run->flags = is_smm(vcpu) ? KVM_RUN_X86_SMM : 0;
         kvm_run->cr8 = kvm_get_cr8(vcpu);
         kvm_run->apic_base = kvm_get_apic_base(vcpu);
-        if (!irqchip_in_kernel(vcpu->kvm))
-                kvm_run->ready_for_interrupt_injection =
-                        kvm_arch_interrupt_allowed(vcpu) &&
-                        !kvm_cpu_has_interrupt(vcpu) &&
-                        !kvm_event_needs_reinjection(vcpu);
-        else if (!pic_in_kernel(vcpu->kvm))
-                kvm_run->ready_for_interrupt_injection =
-                        kvm_apic_accept_pic_intr(vcpu) &&
-                        !kvm_cpu_has_interrupt(vcpu);
-        else
-                kvm_run->ready_for_interrupt_injection = 1;
+        kvm_run->ready_for_interrupt_injection =
+                pic_in_kernel(vcpu->kvm) ||
+                kvm_vcpu_ready_for_interrupt_injection(vcpu);
 }
 
 static void update_cr8_intercept(struct kvm_vcpu *vcpu)
@@ -6360,8 +6360,10 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
 static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 {
         int r;
-        bool req_int_win = !lapic_in_kernel(vcpu) &&
-                vcpu->run->request_interrupt_window;
+        bool req_int_win =
+                dm_request_for_irq_injection(vcpu) &&
+                kvm_cpu_accept_dm_intr(vcpu);
+
         bool req_immediate_exit = false;
 
         if (vcpu->requests) {
@@ -6663,7 +6665,8 @@ static int vcpu_run(struct kvm_vcpu *vcpu)
                 if (kvm_cpu_has_pending_timer(vcpu))
                         kvm_inject_pending_timer_irqs(vcpu);
 
-                if (dm_request_for_irq_injection(vcpu)) {
+                if (dm_request_for_irq_injection(vcpu) &&
+                        kvm_vcpu_ready_for_interrupt_injection(vcpu)) {
                         r = 0;
                         vcpu->run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
                         ++vcpu->stat.request_irq_exits;
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index b0ae85f90f10..1202d5ca2fb5 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -586,6 +586,29 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
 }
 
 /*
+ * We only want to do a 4-byte get_user() on 32-bit.  Otherwise,
+ * we might run off the end of the bounds table if we are on
+ * a 64-bit kernel and try to get 8 bytes.
+ */
+int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
+                long __user *bd_entry_ptr)
+{
+        u32 bd_entry_32;
+        int ret;
+
+        if (is_64bit_mm(mm))
+                return get_user(*bd_entry_ret, bd_entry_ptr);
+
+        /*
+         * Note that get_user() uses the type of the *pointer* to
+         * establish the size of the get, not the destination.
+         */
+        ret = get_user(bd_entry_32, (u32 __user *)bd_entry_ptr);
+        *bd_entry_ret = bd_entry_32;
+        return ret;
+}
+
+/*
  * Get the base of bounds tables pointed by specific bounds
  * directory entry.
  */
@@ -605,7 +628,7 @@ static int get_bt_addr(struct mm_struct *mm,
                 int need_write = 0;
 
                 pagefault_disable();
-                ret = get_user(bd_entry, bd_entry_ptr);
+                ret = get_user_bd_entry(mm, &bd_entry, bd_entry_ptr);
                 pagefault_enable();
                 if (!ret)
                         break;
@@ -700,11 +723,23 @@ static unsigned long mpx_get_bt_entry_offset_bytes(struct mm_struct *mm,
  */
 static inline unsigned long bd_entry_virt_space(struct mm_struct *mm)
 {
-        unsigned long long virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
-        if (is_64bit_mm(mm))
-                return virt_space / MPX_BD_NR_ENTRIES_64;
-        else
-                return virt_space / MPX_BD_NR_ENTRIES_32;
+        unsigned long long virt_space;
+        unsigned long long GB = (1ULL << 30);
+
+        /*
+         * This covers 32-bit emulation as well as 32-bit kernels
+         * running on 64-bit harware.
+         */
+        if (!is_64bit_mm(mm))
+                return (4ULL * GB) / MPX_BD_NR_ENTRIES_32;
+
+        /*
+         * 'x86_virt_bits' returns what the hardware is capable
+         * of, and returns the full >32-bit adddress space when
+         * running 32-bit kernels on 64-bit hardware.
+         */
+        virt_space = (1ULL << boot_cpu_data.x86_virt_bits);
+        return virt_space / MPX_BD_NR_ENTRIES_64;
 }
 
 /*
diff --git a/block/blk-merge.c b/block/blk-merge.c
index de5716d8e525..41a55ba0d78e 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -76,6 +76,9 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         struct bio_vec bv, bvprv, *bvprvp = NULL;
         struct bvec_iter iter;
         unsigned seg_size = 0, nsegs = 0, sectors = 0;
+        unsigned front_seg_size = bio->bi_seg_front_size;
+        bool do_split = true;
+        struct bio *new = NULL;
 
         bio_for_each_segment(bv, bio, iter) {
                 if (sectors + (bv.bv_len >> 9) > queue_max_sectors(q))
@@ -98,7 +101,7 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
 
                         seg_size += bv.bv_len;
                         bvprv = bv;
-                        bvprvp = &bv;
+                        bvprvp = &bvprv;
                         sectors += bv.bv_len >> 9;
                         continue;
                 }
@@ -108,16 +111,29 @@ new_segment:
 
                 nsegs++;
                 bvprv = bv;
-                bvprvp = &bv;
+                bvprvp = &bvprv;
                 seg_size = bv.bv_len;
                 sectors += bv.bv_len >> 9;
+
+                if (nsegs == 1 && seg_size > front_seg_size)
+                        front_seg_size = seg_size;
         }
 
-        *segs = nsegs;
-        return NULL;
+        do_split = false;
 split:
         *segs = nsegs;
-        return bio_split(bio, sectors, GFP_NOIO, bs);
+
+        if (do_split) {
+                new = bio_split(bio, sectors, GFP_NOIO, bs);
+                if (new)
+                        bio = new;
+        }
+
+        bio->bi_seg_front_size = front_seg_size;
+        if (seg_size > bio->bi_seg_back_size)
+                bio->bi_seg_back_size = seg_size;
+
+        return do_split ? new : NULL;
 }
 
 void blk_queue_split(struct request_queue *q, struct bio **bio,
@@ -412,6 +428,12 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq,
         if (sg)
                 sg_mark_end(sg);
 
+        /*
+         * Something must have been wrong if the figured number of
+         * segment is bigger than number of req's physical segments
+         */
+        WARN_ON(nsegs > rq->nr_phys_segments);
+
         return nsegs;
 }
 EXPORT_SYMBOL(blk_rq_map_sg);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ae09de62f19..6d6f8feb48c0 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1291,15 +1291,16 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
                 blk_mq_bio_to_request(rq, bio);
 
                 /*
-                 * we do limited pluging. If bio can be merged, do merge.
+                 * We do limited pluging. If the bio can be merged, do that.
                  * Otherwise the existing request in the plug list will be
                  * issued. So the plug list will have one request at most
                  */
                 if (plug) {
                         /*
                          * The plug list might get flushed before this. If that
-                         * happens, same_queue_rq is invalid and plug list is empty
-                         **/
+                         * happens, same_queue_rq is invalid and plug list is
+                         * empty
+                         */
                         if (same_queue_rq && !list_empty(&plug->mq_list)) {
                                 old_rq = same_queue_rq;
                                 list_del_init(&old_rq->queuelist);
@@ -1380,12 +1381,15 @@ static blk_qc_t blk_sq_make_request(struct request_queue *q, struct bio *bio)
                 blk_mq_bio_to_request(rq, bio);
                 if (!request_count)
                         trace_block_plug(q);
-                else if (request_count >= BLK_MAX_REQUEST_COUNT) {
+
+                blk_mq_put_ctx(data.ctx);
+
+                if (request_count >= BLK_MAX_REQUEST_COUNT) {
                         blk_flush_plug_list(plug, false);
                         trace_block_plug(q);
                 }
+
                 list_add_tail(&rq->queuelist, &plug->mq_list);
-                blk_mq_put_ctx(data.ctx);
                 return cookie;
         }
 
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 246dfb16c3d9..aa40aa93381b 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -158,11 +158,13 @@ void blk_abort_request(struct request *req)
 {
         if (blk_mark_rq_complete(req))
                 return;
-        blk_delete_timer(req);
-        if (req->q->mq_ops)
+
+        if (req->q->mq_ops) {
                 blk_mq_rq_timed_out(req, false);
-        else
+        } else {
+                blk_delete_timer(req);
                 blk_rq_timed_out(req);
+        }
 }
 EXPORT_SYMBOL_GPL(blk_abort_request);
 
diff --git a/block/blk.h b/block/blk.h
index da722eb786df..c43926d3d74d 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -72,8 +72,6 @@ void blk_dequeue_request(struct request *rq);
 void __blk_queue_free_tags(struct request_queue *q);
 bool __blk_end_bidi_request(struct request *rq, int error,
                             unsigned int nr_bytes, unsigned int bidi_bytes);
-int blk_queue_enter(struct request_queue *q, gfp_t gfp);
-void blk_queue_exit(struct request_queue *q);
 void blk_freeze_queue(struct request_queue *q);
 
 static inline void blk_queue_enter_live(struct request_queue *q)
diff --git a/block/noop-iosched.c b/block/noop-iosched.c
index 3de89d4690f3..a163c487cf38 100644
--- a/block/noop-iosched.c
+++ b/block/noop-iosched.c
@@ -21,10 +21,10 @@ static void noop_merged_requests(struct request_queue *q, struct request *rq,
 static int noop_dispatch(struct request_queue *q, int force)
 {
         struct noop_data *nd = q->elevator->elevator_data;
+        struct request *rq;
 
-        if (!list_empty(&nd->queue)) {
-                struct request *rq;
-                rq = list_entry(nd->queue.next, struct request, queuelist);
+        rq = list_first_entry_or_null(&nd->queue, struct request, queuelist);
+        if (rq) {
                 list_del_init(&rq->queuelist);
                 elv_dispatch_sort(q, rq);
                 return 1;
@@ -46,7 +46,7 @@ noop_former_request(struct request_queue *q, struct request *rq)
 
         if (rq->queuelist.prev == &nd->queue)
                 return NULL;
-        return list_entry(rq->queuelist.prev, struct request, queuelist);
+        return list_prev_entry(rq, queuelist);
 }
 
 static struct request *
@@ -56,7 +56,7 @@ noop_latter_request(struct request_queue *q, struct request *rq)
 
         if (rq->queuelist.next == &nd->queue)
                 return NULL;
-        return list_entry(rq->queuelist.next, struct request, queuelist);
+        return list_next_entry(rq, queuelist);
 }
 
 static int noop_init_queue(struct request_queue *q, struct elevator_type *e)
diff --git a/block/partitions/mac.c b/block/partitions/mac.c
index c2c48ec64b27..621317ac4d59 100644
--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -32,7 +32,7 @@ int mac_partition(struct parsed_partitions *state)
         Sector sect;
         unsigned char *data;
         int slot, blocks_in_map;
-        unsigned secsize;
+        unsigned secsize, datasize, partoffset;
 #ifdef CONFIG_PPC_PMAC
         int found_root = 0;
         int found_root_goodness = 0;
@@ -50,10 +50,14 @@ int mac_partition(struct parsed_partitions *state)
         }
         secsize = be16_to_cpu(md->block_size);
         put_dev_sector(sect);
-        data = read_part_sector(state, secsize/512, &sect);
+        datasize = round_down(secsize, 512);
+        data = read_part_sector(state, datasize / 512, &sect);
         if (!data)
                 return -1;
-        part = (struct mac_partition *) (data + secsize%512);
+        partoffset = secsize % 512;
+        if (partoffset + sizeof(*part) > datasize)
+                return -1;
+        part = (struct mac_partition *) (data + partoffset);
         if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
                 put_dev_sector(sect);
                 return 0;               /* not a MacOS disk */
diff --git a/drivers/Makefile b/drivers/Makefile
index 73d039156ea7..795d0ca714bf 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -63,6 +63,7 @@ obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
 obj-$(CONFIG_FB_INTEL)          += video/fbdev/intelfb/
 
 obj-$(CONFIG_PARPORT)           += parport/
+obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += base/ block/ misc/ mfd/ nfc/
 obj-$(CONFIG_LIBNVDIMM)         += nvdimm/
 obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf/
@@ -70,7 +71,6 @@ obj-$(CONFIG_NUBUS)		+= nubus/
 obj-y                           += macintosh/
 obj-$(CONFIG_IDE)               += ide/
 obj-$(CONFIG_SCSI)              += scsi/
-obj-$(CONFIG_NVM)               += lightnvm/
 obj-y                           += nvme/
 obj-$(CONFIG_ATA)               += ata/
 obj-$(CONFIG_TARGET_CORE)       += target/
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 3c083d2cc434..6730f965b379 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -304,7 +304,7 @@ EXPORT_SYMBOL_GPL(acpi_get_psd_map);
 
 static int register_pcc_channel(int pcc_subspace_idx)
 {
-        struct acpi_pcct_subspace *cppc_ss;
+        struct acpi_pcct_hw_reduced *cppc_ss;
         unsigned int len;
 
         if (pcc_subspace_idx >= 0) {
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index f61a7c834540..b420fb46669d 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1103,7 +1103,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
         }
 
 err_exit:
-        if (result && q)
+        if (result)
                 acpi_ec_delete_query(q);
         if (data)
                 *data = value;
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index bf034f8b7c1a..2fa8304171e0 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -14,7 +14,6 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
-#include <linux/dmi.h>
 #include "sbshc.h"
 
 #define PREFIX "ACPI: "
@@ -30,6 +29,7 @@ struct acpi_smb_hc {
         u8 query_bit;
         smbus_alarm_callback callback;
         void *context;
+        bool done;
 };
 
 static int acpi_smbus_hc_add(struct acpi_device *device);
@@ -88,8 +88,6 @@ enum acpi_smb_offset {
         ACPI_SMB_ALARM_DATA = 0x26,     /* 2 bytes alarm data */
 };
 
-static bool macbook;
-
 static inline int smb_hc_read(struct acpi_smb_hc *hc, u8 address, u8 *data)
 {
         return ec_read(hc->offset + address, data);
@@ -100,27 +98,11 @@ static inline int smb_hc_write(struct acpi_smb_hc *hc, u8 address, u8 data)
         return ec_write(hc->offset + address, data);
 }
 
-static inline int smb_check_done(struct acpi_smb_hc *hc)
-{
-        union acpi_smb_status status = {.raw = 0};
-        smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw);
-        return status.fields.done && (status.fields.status == SMBUS_OK);
-}
-
 static int wait_transaction_complete(struct acpi_smb_hc *hc, int timeout)
 {
-        if (wait_event_timeout(hc->wait, smb_check_done(hc),
-                               msecs_to_jiffies(timeout)))
+        if (wait_event_timeout(hc->wait, hc->done, msecs_to_jiffies(timeout)))
                 return 0;
-        /*
-         * After the timeout happens, OS will try to check the status of SMbus.
-         * If the status is what OS expected, it will be regarded as the bogus
-         * timeout.
-         */
-        if (smb_check_done(hc))
-                return 0;
-        else
-                return -ETIME;
+        return -ETIME;
 }
 
 static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
@@ -135,8 +117,7 @@ static int acpi_smbus_transaction(struct acpi_smb_hc *hc, u8 protocol,
         }
 
         mutex_lock(&hc->lock);
-        if (macbook)
-                udelay(5);
+        hc->done = false;
         if (smb_hc_read(hc, ACPI_SMB_PROTOCOL, &temp))
                 goto end;
         if (temp) {
@@ -235,8 +216,10 @@ static int smbus_alarm(void *context)
         if (smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw))
                 return 0;
         /* Check if it is only a completion notify */
-        if (status.fields.done)
+        if (status.fields.done && status.fields.status == SMBUS_OK) {
+                hc->done = true;
                 wake_up(&hc->wait);
+        }
         if (!status.fields.alarm)
                 return 0;
         mutex_lock(&hc->lock);
@@ -262,29 +245,12 @@ extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
                               acpi_handle handle, acpi_ec_query_func func,
                               void *data);
 
-static int macbook_dmi_match(const struct dmi_system_id *d)
-{
-        pr_debug("Detected MacBook, enabling workaround\n");
-        macbook = true;
-        return 0;
-}
-
-static struct dmi_system_id acpi_smbus_dmi_table[] = {
-        { macbook_dmi_match, "Apple MacBook", {
-          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
-          DMI_MATCH(DMI_PRODUCT_NAME, "MacBook") },
-        },
-        { },
-};
-
 static int acpi_smbus_hc_add(struct acpi_device *device)
 {
         int status;
         unsigned long long val;
         struct acpi_smb_hc *hc;
 
-        dmi_check_system(acpi_smbus_dmi_table);
-
         if (!device)
                 return -EINVAL;
 
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index eb6e67451dec..0d77cd6fd8d1 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -68,6 +68,9 @@ int dev_pm_set_wake_irq(struct device *dev, int irq)
         struct wake_irq *wirq;
         int err;
 
+        if (irq < 0)
+                return -EINVAL;
+
         wirq = kzalloc(sizeof(*wirq), GFP_KERNEL);
         if (!wirq)
                 return -ENOMEM;
@@ -167,6 +170,9 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
         struct wake_irq *wirq;
         int err;
 
+        if (irq < 0)
+                return -EINVAL;
+
         wirq = kzalloc(sizeof(*wirq), GFP_KERNEL);
         if (!wirq)
                 return -ENOMEM;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a28a562f7b7f..3457ac8c03e2 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3810,7 +3810,6 @@ static int mtip_block_initialize(struct driver_data *dd)
         sector_t capacity;
         unsigned int index = 0;
         struct kobject *kobj;
-        unsigned char thd_name[16];
 
         if (dd->disk)
                 goto skip_create_disk; /* hw init done, before rebuild */
@@ -3958,10 +3957,9 @@ skip_create_disk:
         }
 
 start_service_thread:
-        sprintf(thd_name, "mtip_svc_thd_%02d", index);
         dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread,
-                                                dd, dd->numa_node, "%s",
-                                                thd_name);
+                                                dd, dd->numa_node,
+                                                "mtip_svc_thd_%02d", index);
 
         if (IS_ERR(dd->mtip_svc_handler)) {
                 dev_err(&dd->pdev->dev, "service thread failed to start\n");
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 6255d1c4bba4..5c8ba5484d86 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/blk-mq.h>
 #include <linux/hrtimer.h>
+#include <linux/lightnvm.h>
 
 struct nullb_cmd {
         struct list_head list;
@@ -39,12 +40,14 @@ struct nullb {
 
         struct nullb_queue *queues;
         unsigned int nr_queues;
+        char disk_name[DISK_NAME_LEN];
 };
 
 static LIST_HEAD(nullb_list);
 static struct mutex lock;
 static int null_major;
 static int nullb_indexes;
+static struct kmem_cache *ppa_cache;
 
 struct completion_queue {
         struct llist_head list;
@@ -119,6 +122,10 @@ static int nr_devices = 2;
 module_param(nr_devices, int, S_IRUGO);
 MODULE_PARM_DESC(nr_devices, "Number of devices to register");
 
+static bool use_lightnvm;
+module_param(use_lightnvm, bool, S_IRUGO);
+MODULE_PARM_DESC(use_lightnvm, "Register as a LightNVM device");
+
 static int irqmode = NULL_IRQ_SOFTIRQ;
 
 static int null_set_irqmode(const char *str, const struct kernel_param *kp)
@@ -427,15 +434,156 @@ static void null_del_dev(struct nullb *nullb)
 {
         list_del_init(&nullb->list);
 
-        del_gendisk(nullb->disk);
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
+        else
+                del_gendisk(nullb->disk);
         blk_cleanup_queue(nullb->q);
         if (queue_mode == NULL_Q_MQ)
                 blk_mq_free_tag_set(&nullb->tag_set);
-        put_disk(nullb->disk);
+        if (!use_lightnvm)
+                put_disk(nullb->disk);
         cleanup_queues(nullb);
         kfree(nullb);
 }
 
+#ifdef CONFIG_NVM
+
+static void null_lnvm_end_io(struct request *rq, int error)
+{
+        struct nvm_rq *rqd = rq->end_io_data;
+        struct nvm_dev *dev = rqd->dev;
+
+        dev->mt->end_io(rqd, error);
+
+        blk_put_request(rq);
+}
+
+static int null_lnvm_submit_io(struct request_queue *q, struct nvm_rq *rqd)
+{
+        struct request *rq;
+        struct bio *bio = rqd->bio;
+
+        rq = blk_mq_alloc_request(q, bio_rw(bio), GFP_KERNEL, 0);
+        if (IS_ERR(rq))
+                return -ENOMEM;
+
+        rq->cmd_type = REQ_TYPE_DRV_PRIV;
+        rq->__sector = bio->bi_iter.bi_sector;
+        rq->ioprio = bio_prio(bio);
+
+        if (bio_has_data(bio))
+                rq->nr_phys_segments = bio_phys_segments(q, bio);
+
+        rq->__data_len = bio->bi_iter.bi_size;
+        rq->bio = rq->biotail = bio;
+
+        rq->end_io_data = rqd;
+
+        blk_execute_rq_nowait(q, NULL, rq, 0, null_lnvm_end_io);
+
+        return 0;
+}
+
+static int null_lnvm_id(struct request_queue *q, struct nvm_id *id)
+{
+        sector_t size = gb * 1024 * 1024 * 1024ULL;
+        sector_t blksize;
+        struct nvm_id_group *grp;
+
+        id->ver_id = 0x1;
+        id->vmnt = 0;
+        id->cgrps = 1;
+        id->cap = 0x3;
+        id->dom = 0x1;
+
+        id->ppaf.blk_offset = 0;
+        id->ppaf.blk_len = 16;
+        id->ppaf.pg_offset = 16;
+        id->ppaf.pg_len = 16;
+        id->ppaf.sect_offset = 32;
+        id->ppaf.sect_len = 8;
+        id->ppaf.pln_offset = 40;
+        id->ppaf.pln_len = 8;
+        id->ppaf.lun_offset = 48;
+        id->ppaf.lun_len = 8;
+        id->ppaf.ch_offset = 56;
+        id->ppaf.ch_len = 8;
+
+        do_div(size, bs); /* convert size to pages */
+        do_div(size, 256); /* concert size to pgs pr blk */
+        grp = &id->groups[0];
+        grp->mtype = 0;
+        grp->fmtype = 0;
+        grp->num_ch = 1;
+        grp->num_pg = 256;
+        blksize = size;
+        do_div(size, (1 << 16));
+        grp->num_lun = size + 1;
+        do_div(blksize, grp->num_lun);
+        grp->num_blk = blksize;
+        grp->num_pln = 1;
+
+        grp->fpg_sz = bs;
+        grp->csecs = bs;
+        grp->trdt = 25000;
+        grp->trdm = 25000;
+        grp->tprt = 500000;
+        grp->tprm = 500000;
+        grp->tbet = 1500000;
+        grp->tbem = 1500000;
+        grp->mpos = 0x010101; /* single plane rwe */
+        grp->cpar = hw_queue_depth;
+
+        return 0;
+}
+
+static void *null_lnvm_create_dma_pool(struct request_queue *q, char *name)
+{
+        mempool_t *virtmem_pool;
+
+        virtmem_pool = mempool_create_slab_pool(64, ppa_cache);
+        if (!virtmem_pool) {
+                pr_err("null_blk: Unable to create virtual memory pool\n");
+                return NULL;
+        }
+
+        return virtmem_pool;
+}
+
+static void null_lnvm_destroy_dma_pool(void *pool)
+{
+        mempool_destroy(pool);
+}
+
+static void *null_lnvm_dev_dma_alloc(struct request_queue *q, void *pool,
+                                gfp_t mem_flags, dma_addr_t *dma_handler)
+{
+        return mempool_alloc(pool, mem_flags);
+}
+
+static void null_lnvm_dev_dma_free(void *pool, void *entry,
+                                                        dma_addr_t dma_handler)
+{
+        mempool_free(entry, pool);
+}
+
+static struct nvm_dev_ops null_lnvm_dev_ops = {
+        .identity               = null_lnvm_id,
+        .submit_io              = null_lnvm_submit_io,
+
+        .create_dma_pool        = null_lnvm_create_dma_pool,
+        .destroy_dma_pool       = null_lnvm_destroy_dma_pool,
+        .dev_dma_alloc          = null_lnvm_dev_dma_alloc,
+        .dev_dma_free           = null_lnvm_dev_dma_free,
+
+        /* Simulate nvme protocol restriction */
+        .max_phys_sect          = 64,
+};
+#else
+static struct nvm_dev_ops null_lnvm_dev_ops;
+#endif /* CONFIG_NVM */
+
 static int null_open(struct block_device *bdev, fmode_t mode)
 {
         return 0;
@@ -575,11 +723,6 @@ static int null_add_dev(void)
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, nullb->q);
         queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, nullb->q);
 
-        disk = nullb->disk = alloc_disk_node(1, home_node);
-        if (!disk) {
-                rv = -ENOMEM;
-                goto out_cleanup_blk_queue;
-        }
 
         mutex_lock(&lock);
         list_add_tail(&nullb->list, &nullb_list);
@@ -589,6 +732,21 @@ static int null_add_dev(void)
         blk_queue_logical_block_size(nullb->q, bs);
         blk_queue_physical_block_size(nullb->q, bs);
 
+        sprintf(nullb->disk_name, "nullb%d", nullb->index);
+
+        if (use_lightnvm) {
+                rv = nvm_register(nullb->q, nullb->disk_name,
+                                                        &null_lnvm_dev_ops);
+                if (rv)
+                        goto out_cleanup_blk_queue;
+                goto done;
+        }
+
+        disk = nullb->disk = alloc_disk_node(1, home_node);
+        if (!disk) {
+                rv = -ENOMEM;
+                goto out_cleanup_lightnvm;
+        }
         size = gb * 1024 * 1024 * 1024ULL;
         set_capacity(disk, size >> 9);
 
@@ -598,10 +756,15 @@ static int null_add_dev(void)
         disk->fops              = &null_fops;
         disk->private_data      = nullb;
         disk->queue             = nullb->q;
-        sprintf(disk->disk_name, "nullb%d", nullb->index);
+        strncpy(disk->disk_name, nullb->disk_name, DISK_NAME_LEN);
+
         add_disk(disk);
+done:
         return 0;
 
+out_cleanup_lightnvm:
+        if (use_lightnvm)
+                nvm_unregister(nullb->disk_name);
 out_cleanup_blk_queue:
         blk_cleanup_queue(nullb->q);
 out_cleanup_tags:
@@ -625,6 +788,18 @@ static int __init null_init(void)
                 bs = PAGE_SIZE;
         }
 
+        if (use_lightnvm && bs != 4096) {
+                pr_warn("null_blk: LightNVM only supports 4k block size\n");
+                pr_warn("null_blk: defaults block size to 4k\n");
+                bs = 4096;
+        }
+
+        if (use_lightnvm && queue_mode != NULL_Q_MQ) {
+                pr_warn("null_blk: LightNVM only supported for blk-mq\n");
+                pr_warn("null_blk: defaults queue mode to blk-mq\n");
+                queue_mode = NULL_Q_MQ;
+        }
+
         if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
                 if (submit_queues < nr_online_nodes) {
                         pr_warn("null_blk: submit_queues param is set to %u.",
@@ -655,15 +830,27 @@ static int __init null_init(void)
         if (null_major < 0)
                 return null_major;
 
+        if (use_lightnvm) {
+                ppa_cache = kmem_cache_create("ppa_cache", 64 * sizeof(u64),
+                                                                0, 0, NULL);
+                if (!ppa_cache) {
+                        pr_err("null_blk: unable to create ppa cache\n");
+                        return -ENOMEM;
+                }
+        }
+
         for (i = 0; i < nr_devices; i++) {
                 if (null_add_dev()) {
                         unregister_blkdev(null_major, "nullb");
-                        return -EINVAL;
+                        goto err_ppa;
                 }
         }
 
         pr_info("null: module loaded\n");
         return 0;
+err_ppa:
+        kmem_cache_destroy(ppa_cache);
+        return -EINVAL;
 }
 
 static void __exit null_exit(void)
@@ -678,6 +865,8 @@ static void __exit null_exit(void)
                 null_del_dev(nullb);
         }
         mutex_unlock(&lock);
+
+        kmem_cache_destroy(ppa_cache);
 }
 
 module_init(null_init);
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index 9f1856948758..bf500e0e7362 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -117,7 +117,7 @@ static struct platform_driver omap_ocp2scp_driver = {
 
 module_platform_driver(omap_ocp2scp_driver);
 
-MODULE_ALIAS("platform: omap-ocp2scp");
+MODULE_ALIAS("platform:omap-ocp2scp");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP OCP2SCP driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 654f6f36a071..55fe9020459f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -412,18 +412,42 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info)
         return rv;
 }
 
-static void start_check_enables(struct smi_info *smi_info)
+static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+{
+        smi_info->last_timeout_jiffies = jiffies;
+        mod_timer(&smi_info->si_timer, new_val);
+        smi_info->timer_running = true;
+}
+
+/*
+ * Start a new message and (re)start the timer and thread.
+ */
+static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
+                          unsigned int size)
+{
+        smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+
+        if (smi_info->thread)
+                wake_up_process(smi_info->thread);
+
+        smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
+}
+
+static void start_check_enables(struct smi_info *smi_info, bool start_timer)
 {
         unsigned char msg[2];
 
         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
         msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+        if (start_timer)
+                start_new_msg(smi_info, msg, 2);
+        else
+                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
         smi_info->si_state = SI_CHECKING_ENABLES;
 }
 
-static void start_clear_flags(struct smi_info *smi_info)
+static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
 {
         unsigned char msg[3];
 
@@ -432,7 +456,10 @@ static void start_clear_flags(struct smi_info *smi_info)
         msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
         msg[2] = WDT_PRE_TIMEOUT_INT;
 
-        smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+        if (start_timer)
+                start_new_msg(smi_info, msg, 3);
+        else
+                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
         smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
@@ -442,10 +469,8 @@ static void start_getting_msg_queue(struct smi_info *smi_info)
         smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
         smi_info->curr_msg->data_size = 2;
 
-        smi_info->handlers->start_transaction(
-                smi_info->si_sm,
-                smi_info->curr_msg->data,
-                smi_info->curr_msg->data_size);
+        start_new_msg(smi_info, smi_info->curr_msg->data,
+                      smi_info->curr_msg->data_size);
         smi_info->si_state = SI_GETTING_MESSAGES;
 }
 
@@ -455,20 +480,11 @@ static void start_getting_events(struct smi_info *smi_info)
         smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
         smi_info->curr_msg->data_size = 2;
 
-        smi_info->handlers->start_transaction(
-                smi_info->si_sm,
-                smi_info->curr_msg->data,
-                smi_info->curr_msg->data_size);
+        start_new_msg(smi_info, smi_info->curr_msg->data,
+                      smi_info->curr_msg->data_size);
         smi_info->si_state = SI_GETTING_EVENTS;
 }
 
-static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
-{
-        smi_info->last_timeout_jiffies = jiffies;
-        mod_timer(&smi_info->si_timer, new_val);
-        smi_info->timer_running = true;
-}
-
 /*
  * When we have a situtaion where we run out of memory and cannot
  * allocate messages, we just leave them in the BMC and run the system
@@ -478,11 +494,11 @@ static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
-static inline bool disable_si_irq(struct smi_info *smi_info)
+static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
 {
         if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = true;
-                start_check_enables(smi_info);
+                start_check_enables(smi_info, start_timer);
                 return true;
         }
         return false;
@@ -492,7 +508,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = false;
-                start_check_enables(smi_info);
+                start_check_enables(smi_info, true);
                 return true;
         }
         return false;
@@ -510,7 +526,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
 
         msg = ipmi_alloc_smi_msg();
         if (!msg) {
-                if (!disable_si_irq(smi_info))
+                if (!disable_si_irq(smi_info, true))
                         smi_info->si_state = SI_NORMAL;
         } else if (enable_si_irq(smi_info)) {
                 ipmi_free_smi_msg(msg);
@@ -526,7 +542,7 @@ static void handle_flags(struct smi_info *smi_info)
                 /* Watchdog pre-timeout */
                 smi_inc_stat(smi_info, watchdog_pretimeouts);
 
-                start_clear_flags(smi_info);
+                start_clear_flags(smi_info, true);
                 smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
                 if (smi_info->intf)
                         ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -879,8 +895,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
                         msg[1] = IPMI_GET_MSG_FLAGS_CMD;
 
-                        smi_info->handlers->start_transaction(
-                                smi_info->si_sm, msg, 2);
+                        start_new_msg(smi_info, msg, 2);
                         smi_info->si_state = SI_GETTING_FLAGS;
                         goto restart;
                 }
@@ -910,7 +925,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                  * disable and messages disabled.
                  */
                 if (smi_info->supports_event_msg_buff || smi_info->irq) {
-                        start_check_enables(smi_info);
+                        start_check_enables(smi_info, true);
                 } else {
                         smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
                         if (!smi_info->curr_msg)
@@ -920,6 +935,13 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
                 }
                 goto restart;
         }
+
+        if (si_sm_result == SI_SM_IDLE && smi_info->timer_running) {
+                /* Ok it if fails, the timer will just go off. */
+                if (del_timer(&smi_info->si_timer))
+                        smi_info->timer_running = false;
+        }
+
  out:
         return si_sm_result;
 }
@@ -2560,6 +2582,7 @@ static const struct of_device_id of_ipmi_match[] = {
           .data = (void *)(unsigned long) SI_BT },
         {},
 };
+MODULE_DEVICE_TABLE(of, of_ipmi_match);
 
 static int of_ipmi_probe(struct platform_device *dev)
 {
@@ -2646,7 +2669,6 @@ static int of_ipmi_probe(struct platform_device *dev)
         }
         return 0;
 }
-MODULE_DEVICE_TABLE(of, of_ipmi_match);
 #else
 #define of_ipmi_match NULL
 static int of_ipmi_probe(struct platform_device *dev)
@@ -3613,7 +3635,7 @@ static int try_smi_init(struct smi_info *new_smi)
          * Start clearing the flags before we enable interrupts or the
          * timer to avoid racing with the timer.
          */
-        start_clear_flags(new_smi);
+        start_clear_flags(new_smi, false);
 
         /*
          * IRQ is defined to be set when non-zero.  req_events will
@@ -3908,7 +3930,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
         }
-        disable_si_irq(to_clean);
+        disable_si_irq(to_clean, false);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 0ac3bd1a5497..096f0cef4da1 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -153,6 +153,9 @@ static int timeout = 10;
 /* The pre-timeout is disabled by default. */
 static int pretimeout;
 
+/* Default timeout to set on panic */
+static int panic_wdt_timeout = 255;
+
 /* Default action is to reset the board on a timeout. */
 static unsigned char action_val = WDOG_TIMEOUT_RESET;
 
@@ -293,6 +296,9 @@ MODULE_PARM_DESC(timeout, "Timeout value in seconds.");
 module_param(pretimeout, timeout, 0644);
 MODULE_PARM_DESC(pretimeout, "Pretimeout value in seconds.");
 
+module_param(panic_wdt_timeout, timeout, 0644);
+MODULE_PARM_DESC(timeout, "Timeout value on kernel panic in seconds.");
+
 module_param_cb(action, &param_ops_str, action_op, 0644);
 MODULE_PARM_DESC(action, "Timeout action. One of: "
                  "reset, none, power_cycle, power_off.");
@@ -1189,7 +1195,7 @@ static int wdog_panic_handler(struct notifier_block *this,
                 /* Make sure we do this only once. */
                 panic_event_handled = 1;
 
-                timeout = 255;
+                timeout = panic_wdt_timeout;
                 pretimeout = 0;
                 panic_halt_ipmi_set_timeout();
         }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 71cfdf7c9708..2eb5f0efae90 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -1,4 +1,5 @@
 menu "Clock Source drivers"
+        depends on !ARCH_USES_GETTIMEOFFSET
 
 config CLKSRC_OF
         bool
diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
index 10202f1fdfd7..517e1c7624d4 100644
--- a/drivers/clocksource/fsl_ftm_timer.c
+++ b/drivers/clocksource/fsl_ftm_timer.c
@@ -203,7 +203,7 @@ static int __init ftm_clockevent_init(unsigned long freq, int irq)
         int err;
 
         ftm_writel(0x00, priv->clkevt_base + FTM_CNTIN);
-        ftm_writel(~0UL, priv->clkevt_base + FTM_MOD);
+        ftm_writel(~0u, priv->clkevt_base + FTM_MOD);
 
         ftm_reset_counter(priv->clkevt_base);
 
@@ -230,7 +230,7 @@ static int __init ftm_clocksource_init(unsigned long freq)
         int err;
 
         ftm_writel(0x00, priv->clksrc_base + FTM_CNTIN);
-        ftm_writel(~0UL, priv->clksrc_base + FTM_MOD);
+        ftm_writel(~0u, priv->clksrc_base + FTM_MOD);
 
         ftm_reset_counter(priv->clksrc_base);
 
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 1582c1c016b0..235a1ba73d92 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -84,6 +84,7 @@ config ARM_KIRKWOOD_CPUFREQ
 config ARM_MT8173_CPUFREQ
         bool "Mediatek MT8173 CPUFreq support"
         depends on ARCH_MEDIATEK && REGULATOR
+        depends on ARM64 || (ARM_CPU_TOPOLOGY && COMPILE_TEST)
         depends on !CPU_THERMAL || THERMAL=y
         select PM_OPP
         help
@@ -201,7 +202,7 @@ config ARM_SA1110_CPUFREQ
 
 config ARM_SCPI_CPUFREQ
         tristate "SCPI based CPUfreq driver"
-        depends on ARM_BIG_LITTLE_CPUFREQ && ARM_SCPI_PROTOCOL
+        depends on ARM_BIG_LITTLE_CPUFREQ && ARM_SCPI_PROTOCOL && COMMON_CLK_SCPI
         help
           This adds the CPUfreq driver support for ARM big.LITTLE platforms
           using SCPI protocol for CPU power management.
diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
index adbd1de1cea5..c59bdcb83217 100644
--- a/drivers/cpufreq/Kconfig.x86
+++ b/drivers/cpufreq/Kconfig.x86
@@ -5,7 +5,6 @@
 config X86_INTEL_PSTATE
        bool "Intel P state control"
        depends on X86
-       select ACPI_PROCESSOR if ACPI
        help
           This driver provides a P state for Intel core processors.
           The driver implements an internal governor and will become
diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
index e8cb334094b0..7c0bdfb1a2ca 100644
--- a/drivers/cpufreq/cppc_cpufreq.c
+++ b/drivers/cpufreq/cppc_cpufreq.c
@@ -98,10 +98,11 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
         policy->max = cpu->perf_caps.highest_perf;
         policy->cpuinfo.min_freq = policy->min;
         policy->cpuinfo.max_freq = policy->max;
+        policy->shared_type = cpu->shared_type;
 
         if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY)
                 cpumask_copy(policy->cpus, cpu->shared_cpu_map);
-        else {
+        else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
                 /* Support only SW_ANY for now. */
                 pr_debug("Unsupported CPU co-ord type\n");
                 return -EFAULT;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 7c48e7316d91..a83c995a62df 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1401,13 +1401,10 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)
         }
 
         cpumask_clear_cpu(cpu, policy->real_cpus);
+        remove_cpu_dev_symlink(policy, cpu);
 
-        if (cpumask_empty(policy->real_cpus)) {
+        if (cpumask_empty(policy->real_cpus))
                 cpufreq_policy_free(policy, true);
-                return;
-        }
-
-        remove_cpu_dev_symlink(policy, cpu);
 }
 
 static void handle_update(struct work_struct *work)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 2e31d097def6..4d07cbd2b23c 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -34,14 +34,10 @@
 #include <asm/cpu_device_id.h>
 #include <asm/cpufeature.h>
 
-#if IS_ENABLED(CONFIG_ACPI)
-#include <acpi/processor.h>
-#endif
-
-#define BYT_RATIOS              0x66a
-#define BYT_VIDS                0x66b
-#define BYT_TURBO_RATIOS        0x66c
-#define BYT_TURBO_VIDS          0x66d
+#define ATOM_RATIOS             0x66a
+#define ATOM_VIDS               0x66b
+#define ATOM_TURBO_RATIOS       0x66c
+#define ATOM_TURBO_VIDS         0x66d
 
 #define FRAC_BITS 8
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
@@ -117,9 +113,6 @@ struct cpudata {
         u64     prev_mperf;
         u64     prev_tsc;
         struct sample sample;
-#if IS_ENABLED(CONFIG_ACPI)
-        struct acpi_processor_performance acpi_perf_data;
-#endif
 };
 
 static struct cpudata **all_cpu_data;
@@ -150,7 +143,6 @@ struct cpu_defaults {
 static struct pstate_adjust_policy pid_params;
 static struct pstate_funcs pstate_funcs;
 static int hwp_active;
-static int no_acpi_perf;
 
 struct perf_limits {
         int no_turbo;
@@ -163,8 +155,6 @@ struct perf_limits {
         int max_sysfs_pct;
         int min_policy_pct;
         int min_sysfs_pct;
-        int max_perf_ctl;
-        int min_perf_ctl;
 };
 
 static struct perf_limits performance_limits = {
@@ -191,8 +181,6 @@ static struct perf_limits powersave_limits = {
         .max_sysfs_pct = 100,
         .min_policy_pct = 0,
         .min_sysfs_pct = 0,
-        .max_perf_ctl = 0,
-        .min_perf_ctl = 0,
 };
 
 #ifdef CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE
@@ -201,153 +189,6 @@ static struct perf_limits *limits = &performance_limits;
 static struct perf_limits *limits = &powersave_limits;
 #endif
 
-#if IS_ENABLED(CONFIG_ACPI)
-/*
- * The max target pstate ratio is a 8 bit value in both PLATFORM_INFO MSR and
- * in TURBO_RATIO_LIMIT MSR, which pstate driver stores in max_pstate and
- * max_turbo_pstate fields. The PERF_CTL MSR contains 16 bit value for P state
- * ratio, out of it only high 8 bits are used. For example 0x1700 is setting
- * target ratio 0x17. The _PSS control value stores in a format which can be
- * directly written to PERF_CTL MSR. But in intel_pstate driver this shift
- * occurs during write to PERF_CTL (E.g. for cores core_set_pstate()).
- * This function converts the _PSS control value to intel pstate driver format
- * for comparison and assignment.
- */
-static int convert_to_native_pstate_format(struct cpudata *cpu, int index)
-{
-        return cpu->acpi_perf_data.states[index].control >> 8;
-}
-
-static int intel_pstate_init_perf_limits(struct cpufreq_policy *policy)
-{
-        struct cpudata *cpu;
-        int ret;
-        bool turbo_absent = false;
-        int max_pstate_index;
-        int min_pss_ctl, max_pss_ctl, turbo_pss_ctl;
-        int i;
-
-        cpu = all_cpu_data[policy->cpu];
-
-        pr_debug("intel_pstate: default limits 0x%x 0x%x 0x%x\n",
-                 cpu->pstate.min_pstate, cpu->pstate.max_pstate,
-                 cpu->pstate.turbo_pstate);
-
-        if (!cpu->acpi_perf_data.shared_cpu_map &&
-            zalloc_cpumask_var_node(&cpu->acpi_perf_data.shared_cpu_map,
-                                    GFP_KERNEL, cpu_to_node(policy->cpu))) {
-                return -ENOMEM;
-        }
-
-        ret = acpi_processor_register_performance(&cpu->acpi_perf_data,
-                                                  policy->cpu);
-        if (ret)
-                return ret;
-
-        /*
-         * Check if the control value in _PSS is for PERF_CTL MSR, which should
-         * guarantee that the states returned by it map to the states in our
-         * list directly.
-         */
-        if (cpu->acpi_perf_data.control_register.space_id !=
-                                                ACPI_ADR_SPACE_FIXED_HARDWARE)
-                return -EIO;
-
-        pr_debug("intel_pstate: CPU%u - ACPI _PSS perf data\n", policy->cpu);
-        for (i = 0; i < cpu->acpi_perf_data.state_count; i++)
-                pr_debug("     %cP%d: %u MHz, %u mW, 0x%x\n",
-                         (i == cpu->acpi_perf_data.state ? '*' : ' '), i,
-                         (u32) cpu->acpi_perf_data.states[i].core_frequency,
-                         (u32) cpu->acpi_perf_data.states[i].power,
-                         (u32) cpu->acpi_perf_data.states[i].control);
-
-        /*
-         * If there is only one entry _PSS, simply ignore _PSS and continue as
-         * usual without taking _PSS into account
-         */
-        if (cpu->acpi_perf_data.state_count < 2)
-                return 0;
-
-        turbo_pss_ctl = convert_to_native_pstate_format(cpu, 0);
-        min_pss_ctl = convert_to_native_pstate_format(cpu,
-                                        cpu->acpi_perf_data.state_count - 1);
-        /* Check if there is a turbo freq in _PSS */
-        if (turbo_pss_ctl <= cpu->pstate.max_pstate &&
-            turbo_pss_ctl > cpu->pstate.min_pstate) {
-                pr_debug("intel_pstate: no turbo range exists in _PSS\n");
-                limits->no_turbo = limits->turbo_disabled = 1;
-                cpu->pstate.turbo_pstate = cpu->pstate.max_pstate;
-                turbo_absent = true;
-        }
-
-        /* Check if the max non turbo p state < Intel P state max */
-        max_pstate_index = turbo_absent ? 0 : 1;
-        max_pss_ctl = convert_to_native_pstate_format(cpu, max_pstate_index);
-        if (max_pss_ctl < cpu->pstate.max_pstate &&
-            max_pss_ctl > cpu->pstate.min_pstate)
-                cpu->pstate.max_pstate = max_pss_ctl;
-
-        /* check If min perf > Intel P State min */
-        if (min_pss_ctl > cpu->pstate.min_pstate &&
-            min_pss_ctl < cpu->pstate.max_pstate) {
-                cpu->pstate.min_pstate = min_pss_ctl;
-                policy->cpuinfo.min_freq = min_pss_ctl * cpu->pstate.scaling;
-        }
-
-        if (turbo_absent)
-                policy->cpuinfo.max_freq = cpu->pstate.max_pstate *
-                                                cpu->pstate.scaling;
-        else {
-                policy->cpuinfo.max_freq = cpu->pstate.turbo_pstate *
-                                                cpu->pstate.scaling;
-                /*
-                 * The _PSS table doesn't contain whole turbo frequency range.
-                 * This just contains +1 MHZ above the max non turbo frequency,
-                 * with control value corresponding to max turbo ratio. But
-                 * when cpufreq set policy is called, it will call with this
-                 * max frequency, which will cause a reduced performance as
-                 * this driver uses real max turbo frequency as the max
-                 * frequeny. So correct this frequency in _PSS table to
-                 * correct max turbo frequency based on the turbo ratio.
-                 * Also need to convert to MHz as _PSS freq is in MHz.
-                 */
-                cpu->acpi_perf_data.states[0].core_frequency =
-                                                turbo_pss_ctl * 100;
-        }
-
-        pr_debug("intel_pstate: Updated limits using _PSS 0x%x 0x%x 0x%x\n",
-                 cpu->pstate.min_pstate, cpu->pstate.max_pstate,
-                 cpu->pstate.turbo_pstate);
-        pr_debug("intel_pstate: policy max_freq=%d Khz min_freq = %d KHz\n",
-                 policy->cpuinfo.max_freq, policy->cpuinfo.min_freq);
-
-        return 0;
-}
-
-static int intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
-{
-        struct cpudata *cpu;
-
-        if (!no_acpi_perf)
-                return 0;
-
-        cpu = all_cpu_data[policy->cpu];
-        acpi_processor_unregister_performance(policy->cpu);
-        return 0;
-}
-
-#else
-static int intel_pstate_init_perf_limits(struct cpufreq_policy *policy)
-{
-        return 0;
-}
-
-static int intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
-{
-        return 0;
-}
-#endif
-
 static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
                              int deadband, int integral) {
         pid->setpoint = setpoint;
@@ -687,31 +528,31 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
         wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
 }
 
-static int byt_get_min_pstate(void)
+static int atom_get_min_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_RATIOS, value);
+        rdmsrl(ATOM_RATIOS, value);
         return (value >> 8) & 0x7F;
 }
 
-static int byt_get_max_pstate(void)
+static int atom_get_max_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_RATIOS, value);
+        rdmsrl(ATOM_RATIOS, value);
         return (value >> 16) & 0x7F;
 }
 
-static int byt_get_turbo_pstate(void)
+static int atom_get_turbo_pstate(void)
 {
         u64 value;
 
-        rdmsrl(BYT_TURBO_RATIOS, value);
+        rdmsrl(ATOM_TURBO_RATIOS, value);
         return value & 0x7F;
 }
 
-static void byt_set_pstate(struct cpudata *cpudata, int pstate)
+static void atom_set_pstate(struct cpudata *cpudata, int pstate)
 {
         u64 val;
         int32_t vid_fp;
@@ -736,27 +577,42 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
         wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
 }
 
-#define BYT_BCLK_FREQS 5
-static int byt_freq_table[BYT_BCLK_FREQS] = { 833, 1000, 1333, 1167, 800};
-
-static int byt_get_scaling(void)
+static int silvermont_get_scaling(void)
 {
         u64 value;
         int i;
+        /* Defined in Table 35-6 from SDM (Sept 2015) */
+        static int silvermont_freq_table[] = {
+                83300, 100000, 133300, 116700, 80000};
 
         rdmsrl(MSR_FSB_FREQ, value);
-        i = value & 0x3;
+        i = value & 0x7;
+        WARN_ON(i > 4);
 
-        BUG_ON(i > BYT_BCLK_FREQS);
+        return silvermont_freq_table[i];
+}
 
-        return byt_freq_table[i] * 100;
+static int airmont_get_scaling(void)
+{
+        u64 value;
+        int i;
+        /* Defined in Table 35-10 from SDM (Sept 2015) */
+        static int airmont_freq_table[] = {
+                83300, 100000, 133300, 116700, 80000,
+                93300, 90000, 88900, 87500};
+
+        rdmsrl(MSR_FSB_FREQ, value);
+        i = value & 0xF;
+        WARN_ON(i > 8);
+
+        return airmont_freq_table[i];
 }
 
-static void byt_get_vid(struct cpudata *cpudata)
+static void atom_get_vid(struct cpudata *cpudata)
 {
         u64 value;
 
-        rdmsrl(BYT_VIDS, value);
+        rdmsrl(ATOM_VIDS, value);
         cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
         cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
         cpudata->vid.ratio = div_fp(
@@ -764,7 +620,7 @@ static void byt_get_vid(struct cpudata *cpudata)
                 int_tofp(cpudata->pstate.max_pstate -
                         cpudata->pstate.min_pstate));
 
-        rdmsrl(BYT_TURBO_VIDS, value);
+        rdmsrl(ATOM_TURBO_VIDS, value);
         cpudata->vid.turbo = value & 0x7f;
 }
 
@@ -885,7 +741,7 @@ static struct cpu_defaults core_params = {
         },
 };
 
-static struct cpu_defaults byt_params = {
+static struct cpu_defaults silvermont_params = {
         .pid_policy = {
                 .sample_rate_ms = 10,
                 .deadband = 0,
@@ -895,13 +751,33 @@ static struct cpu_defaults byt_params = {
                 .i_gain_pct = 4,
         },
         .funcs = {
-                .get_max = byt_get_max_pstate,
-                .get_max_physical = byt_get_max_pstate,
-                .get_min = byt_get_min_pstate,
-                .get_turbo = byt_get_turbo_pstate,
-                .set = byt_set_pstate,
-                .get_scaling = byt_get_scaling,
-                .get_vid = byt_get_vid,
+                .get_max = atom_get_max_pstate,
+                .get_max_physical = atom_get_max_pstate,
+                .get_min = atom_get_min_pstate,
+                .get_turbo = atom_get_turbo_pstate,
+                .set = atom_set_pstate,
+                .get_scaling = silvermont_get_scaling,
+                .get_vid = atom_get_vid,
+        },
+};
+
+static struct cpu_defaults airmont_params = {
+        .pid_policy = {
+                .sample_rate_ms = 10,
+                .deadband = 0,
+                .setpoint = 60,
+                .p_gain_pct = 14,
+                .d_gain_pct = 0,
+                .i_gain_pct = 4,
+        },
+        .funcs = {
+                .get_max = atom_get_max_pstate,
+                .get_max_physical = atom_get_max_pstate,
+                .get_min = atom_get_min_pstate,
+                .get_turbo = atom_get_turbo_pstate,
+                .set = atom_set_pstate,
+                .get_scaling = airmont_get_scaling,
+                .get_vid = atom_get_vid,
         },
 };
 
@@ -938,23 +814,12 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
          * policy, or by cpu specific default values determined through
          * experimentation.
          */
-        if (limits->max_perf_ctl && limits->max_sysfs_pct >=
-                                                limits->max_policy_pct) {
-                *max = limits->max_perf_ctl;
-        } else {
-                max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf),
-                                        limits->max_perf));
-                *max = clamp_t(int, max_perf_adj, cpu->pstate.min_pstate,
-                               cpu->pstate.turbo_pstate);
-        }
+        max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits->max_perf));
+        *max = clamp_t(int, max_perf_adj,
+                        cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
 
-        if (limits->min_perf_ctl) {
-                *min = limits->min_perf_ctl;
-        } else {
-                min_perf = fp_toint(mul_fp(int_tofp(max_perf),
-                                    limits->min_perf));
-                *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
-        }
+        min_perf = fp_toint(mul_fp(int_tofp(max_perf), limits->min_perf));
+        *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
 }
 
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
@@ -1153,7 +1018,7 @@ static void intel_pstate_timer_func(unsigned long __data)
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x2a, core_params),
         ICPU(0x2d, core_params),
-        ICPU(0x37, byt_params),
+        ICPU(0x37, silvermont_params),
         ICPU(0x3a, core_params),
         ICPU(0x3c, core_params),
         ICPU(0x3d, core_params),
@@ -1162,7 +1027,7 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
         ICPU(0x45, core_params),
         ICPU(0x46, core_params),
         ICPU(0x47, core_params),
-        ICPU(0x4c, byt_params),
+        ICPU(0x4c, airmont_params),
         ICPU(0x4e, core_params),
         ICPU(0x4f, core_params),
         ICPU(0x5e, core_params),
@@ -1229,12 +1094,6 @@ static unsigned int intel_pstate_get(unsigned int cpu_num)
 
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
-#if IS_ENABLED(CONFIG_ACPI)
-        struct cpudata *cpu;
-        int i;
-#endif
-        pr_debug("intel_pstate: %s max %u policy->max %u\n", __func__,
-                 policy->cpuinfo.max_freq, policy->max);
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
 
@@ -1242,6 +1101,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
             policy->max >= policy->cpuinfo.max_freq) {
                 pr_debug("intel_pstate: set performance\n");
                 limits = &performance_limits;
+                if (hwp_active)
+                        intel_pstate_hwp_set();
                 return 0;
         }
 
@@ -1249,7 +1110,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         limits = &powersave_limits;
         limits->min_policy_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
         limits->min_policy_pct = clamp_t(int, limits->min_policy_pct, 0 , 100);
-        limits->max_policy_pct = (policy->max * 100) / policy->cpuinfo.max_freq;
+        limits->max_policy_pct = DIV_ROUND_UP(policy->max * 100,
+                                              policy->cpuinfo.max_freq);
         limits->max_policy_pct = clamp_t(int, limits->max_policy_pct, 0 , 100);
 
         /* Normalize user input to [min_policy_pct, max_policy_pct] */
@@ -1261,6 +1123,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                                    limits->max_sysfs_pct);
         limits->max_perf_pct = max(limits->min_policy_pct,
                                    limits->max_perf_pct);
+        limits->max_perf = round_up(limits->max_perf, 8);
 
         /* Make sure min_perf_pct <= max_perf_pct */
         limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
@@ -1270,23 +1133,6 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         limits->max_perf = div_fp(int_tofp(limits->max_perf_pct),
                                   int_tofp(100));
 
-#if IS_ENABLED(CONFIG_ACPI)
-        cpu = all_cpu_data[policy->cpu];
-        for (i = 0; i < cpu->acpi_perf_data.state_count; i++) {
-                int control;
-
-                control = convert_to_native_pstate_format(cpu, i);
-                if (control * cpu->pstate.scaling == policy->max)
-                        limits->max_perf_ctl = control;
-                if (control * cpu->pstate.scaling == policy->min)
-                        limits->min_perf_ctl = control;
-        }
-
-        pr_debug("intel_pstate: max %u policy_max %u perf_ctl [0x%x-0x%x]\n",
-                 policy->cpuinfo.max_freq, policy->max, limits->min_perf_ctl,
-                 limits->max_perf_ctl);
-#endif
-
         if (hwp_active)
                 intel_pstate_hwp_set();
 
@@ -1341,30 +1187,18 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
         policy->cpuinfo.max_freq =
                 cpu->pstate.turbo_pstate * cpu->pstate.scaling;
-        if (!no_acpi_perf)
-                intel_pstate_init_perf_limits(policy);
-        /*
-         * If there is no acpi perf data or error, we ignore and use Intel P
-         * state calculated limits, So this is not fatal error.
-         */
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         cpumask_set_cpu(policy->cpu, policy->cpus);
 
         return 0;
 }
 
-static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
-{
-        return intel_pstate_exit_perf_limits(policy);
-}
-
 static struct cpufreq_driver intel_pstate_driver = {
         .flags          = CPUFREQ_CONST_LOOPS,
         .verify         = intel_pstate_verify_policy,
         .setpolicy      = intel_pstate_set_policy,
         .get            = intel_pstate_get,
         .init           = intel_pstate_cpu_init,
-        .exit           = intel_pstate_cpu_exit,
         .stop_cpu       = intel_pstate_stop_cpu,
         .name           = "intel_pstate",
 };
@@ -1406,6 +1240,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs)
 }
 
 #if IS_ENABLED(CONFIG_ACPI)
+#include <acpi/processor.h>
 
 static bool intel_pstate_no_acpi_pss(void)
 {
@@ -1601,9 +1436,6 @@ static int __init intel_pstate_setup(char *str)
                 force_load = 1;
         if (!strcmp(str, "hwp_only"))
                 hwp_only = 1;
-        if (!strcmp(str, "no_acpi"))
-                no_acpi_perf = 1;
-
         return 0;
 }
 early_param("intel_pstate", intel_pstate_setup);
diff --git a/drivers/crypto/qat/qat_common/adf_ctl_drv.c b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
index 03856ad280b9..473d36d91644 100644
--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
@@ -198,7 +198,7 @@ static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev,
                         goto out_err;
                 }
 
-                params_head = section_head->params;
+                params_head = section.params;
 
                 while (params_head) {
                         if (copy_from_user(&key_val, (void __user *)params_head,
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 4e55239c7a30..53d22eb73b56 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -729,8 +729,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
                 return NULL;
 
         dev_info(chan2dev(chan),
-                 "%s: src=0x%08x, dest=0x%08x, numf=%d, frame_size=%d, flags=0x%lx\n",
-                __func__, xt->src_start, xt->dst_start, xt->numf,
+                 "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+                __func__, &xt->src_start, &xt->dst_start, xt->numf,
                 xt->frame_size, flags);
 
         /*
@@ -824,8 +824,8 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
         u32                     ctrla;
         u32                     ctrlb;
 
-        dev_vdbg(chan2dev(chan), "prep_dma_memcpy: d0x%x s0x%x l0x%zx f0x%lx\n",
-                        dest, src, len, flags);
+        dev_vdbg(chan2dev(chan), "prep_dma_memcpy: d%pad s%pad l0x%zx f0x%lx\n",
+                        &dest, &src, len, flags);
 
         if (unlikely(!len)) {
                 dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
@@ -938,8 +938,8 @@ atc_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value,
         void __iomem            *vaddr;
         dma_addr_t              paddr;
 
-        dev_vdbg(chan2dev(chan), "%s: d0x%x v0x%x l0x%zx f0x%lx\n", __func__,
-                dest, value, len, flags);
+        dev_vdbg(chan2dev(chan), "%s: d%pad v0x%x l0x%zx f0x%lx\n", __func__,
+                &dest, value, len, flags);
 
         if (unlikely(!len)) {
                 dev_dbg(chan2dev(chan), "%s: length is zero!\n", __func__);
@@ -1022,8 +1022,8 @@ atc_prep_dma_memset_sg(struct dma_chan *chan,
                 dma_addr_t dest = sg_dma_address(sg);
                 size_t len = sg_dma_len(sg);
 
-                dev_vdbg(chan2dev(chan), "%s: d0x%08x, l0x%zx\n",
-                         __func__, dest, len);
+                dev_vdbg(chan2dev(chan), "%s: d%pad, l0x%zx\n",
+                         __func__, &dest, len);
 
                 if (!is_dma_fill_aligned(chan->device, dest, 0, len)) {
                         dev_err(chan2dev(chan), "%s: buffer is not aligned\n",
@@ -1439,9 +1439,9 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
         unsigned int            periods = buf_len / period_len;
         unsigned int            i;
 
-        dev_vdbg(chan2dev(chan), "prep_dma_cyclic: %s buf@0x%08x - %d (%d/%d)\n",
+        dev_vdbg(chan2dev(chan), "prep_dma_cyclic: %s buf@%pad - %d (%d/%d)\n",
                         direction == DMA_MEM_TO_DEV ? "TO DEVICE" : "FROM DEVICE",
-                        buf_addr,
+                        &buf_addr,
                         periods, buf_len, period_len);
 
         if (unlikely(!atslave || !buf_len || !period_len)) {
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index d1cfc8c876f9..7f58f06157f6 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -385,9 +385,9 @@ static void vdbg_dump_regs(struct at_dma_chan *atchan) {}
 static void atc_dump_lli(struct at_dma_chan *atchan, struct at_lli *lli)
 {
         dev_crit(chan2dev(&atchan->chan_common),
-                 "  desc: s0x%x d0x%x ctrl0x%x:0x%x l0x%x\n",
-                 lli->saddr, lli->daddr,
-                 lli->ctrla, lli->ctrlb, lli->dscr);
+                 "  desc: s%pad d%pad ctrl0x%x:0x%x l0x%pad\n",
+                 &lli->saddr, &lli->daddr,
+                 lli->ctrla, lli->ctrlb, &lli->dscr);
 }
 
 
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index b5e132d4bae5..7f039de143f0 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -920,8 +920,8 @@ at_xdmac_interleaved_queue_desc(struct dma_chan *chan,
         desc->lld.mbr_cfg = chan_cc;
 
         dev_dbg(chan2dev(chan),
-                "%s: lld: mbr_sa=0x%08x, mbr_da=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-                __func__, desc->lld.mbr_sa, desc->lld.mbr_da,
+                "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+                __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da,
                 desc->lld.mbr_ubc, desc->lld.mbr_cfg);
 
         /* Chain lld. */
@@ -953,8 +953,8 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
         if ((xt->numf > 1) && (xt->frame_size > 1))
                 return NULL;
 
-        dev_dbg(chan2dev(chan), "%s: src=0x%08x, dest=0x%08x, numf=%d, frame_size=%d, flags=0x%lx\n",
-                __func__, xt->src_start, xt->dst_start, xt->numf,
+        dev_dbg(chan2dev(chan), "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+                __func__, &xt->src_start, &xt->dst_start,       xt->numf,
                 xt->frame_size, flags);
 
         src_addr = xt->src_start;
@@ -1179,8 +1179,8 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan,
         desc->lld.mbr_cfg = chan_cc;
 
         dev_dbg(chan2dev(chan),
-                "%s: lld: mbr_da=0x%08x, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-                __func__, desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
+                "%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+                __func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
                 desc->lld.mbr_cfg);
 
         return desc;
@@ -1193,8 +1193,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value,
         struct at_xdmac_chan    *atchan = to_at_xdmac_chan(chan);
         struct at_xdmac_desc    *desc;
 
-        dev_dbg(chan2dev(chan), "%s: dest=0x%08x, len=%d, pattern=0x%x, flags=0x%lx\n",
-                __func__, dest, len, value, flags);
+        dev_dbg(chan2dev(chan), "%s: dest=%pad, len=%d, pattern=0x%x, flags=0x%lx\n",
+                __func__, &dest, len, value, flags);
 
         if (unlikely(!len))
                 return NULL;
@@ -1229,8 +1229,8 @@ at_xdmac_prep_dma_memset_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
         /* Prepare descriptors. */
         for_each_sg(sgl, sg, sg_len, i) {
-                dev_dbg(chan2dev(chan), "%s: dest=0x%08x, len=%d, pattern=0x%x, flags=0x%lx\n",
-                        __func__, sg_dma_address(sg), sg_dma_len(sg),
+                dev_dbg(chan2dev(chan), "%s: dest=%pad, len=%d, pattern=0x%x, flags=0x%lx\n",
+                        __func__, &sg_dma_address(sg), sg_dma_len(sg),
                         value, flags);
                 desc = at_xdmac_memset_create_desc(chan, atchan,
                                                    sg_dma_address(sg),
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 6b03e4e84e6b..0675e268d577 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -107,7 +107,7 @@
 
 /* CCCFG register */
 #define GET_NUM_DMACH(x)        (x & 0x7) /* bits 0-2 */
-#define GET_NUM_QDMACH(x)       (x & 0x70 >> 4) /* bits 4-6 */
+#define GET_NUM_QDMACH(x)       ((x & 0x70) >> 4) /* bits 4-6 */
 #define GET_NUM_PAENTRY(x)      ((x & 0x7000) >> 12) /* bits 12-14 */
 #define GET_NUM_EVQUE(x)        ((x & 0x70000) >> 16) /* bits 16-18 */
 #define GET_NUM_REGN(x)         ((x & 0x300000) >> 20) /* bits 20-21 */
@@ -1565,7 +1565,7 @@ static void edma_tc_set_pm_state(struct edma_tc *tc, bool enable)
         struct platform_device *tc_pdev;
         int ret;
 
-        if (!tc)
+        if (!IS_ENABLED(CONFIG_OF) || !tc)
                 return;
 
         tc_pdev = of_find_device_by_node(tc->node);
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 7058d58ba588..0f6fd42f55ca 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1462,7 +1462,7 @@ err_firmware:
 
 #define EVENT_REMAP_CELLS 3
 
-static int __init sdma_event_remap(struct sdma_engine *sdma)
+static int sdma_event_remap(struct sdma_engine *sdma)
 {
         struct device_node *np = sdma->dev->of_node;
         struct device_node *gpr_np = of_parse_phandle(np, "gpr", 0);
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index ebd8a5f398b0..f1bcc2a163b3 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -679,8 +679,11 @@ static int usb_dmac_runtime_suspend(struct device *dev)
         struct usb_dmac *dmac = dev_get_drvdata(dev);
         int i;
 
-        for (i = 0; i < dmac->n_channels; ++i)
+        for (i = 0; i < dmac->n_channels; ++i) {
+                if (!dmac->channels[i].iomem)
+                        break;
                 usb_dmac_chan_halt(&dmac->channels[i]);
+        }
 
         return 0;
 }
@@ -799,11 +802,10 @@ static int usb_dmac_probe(struct platform_device *pdev)
         ret = pm_runtime_get_sync(&pdev->dev);
         if (ret < 0) {
                 dev_err(&pdev->dev, "runtime PM get sync failed (%d)\n", ret);
-                return ret;
+                goto error_pm;
         }
 
         ret = usb_dmac_init(dmac);
-        pm_runtime_put(&pdev->dev);
 
         if (ret) {
                 dev_err(&pdev->dev, "failed to reset device\n");
@@ -851,10 +853,13 @@ static int usb_dmac_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto error;
 
+        pm_runtime_put(&pdev->dev);
         return 0;
 
 error:
         of_dma_controller_free(pdev->dev.of_node);
+        pm_runtime_put(&pdev->dev);
+error_pm:
         pm_runtime_disable(&pdev->dev);
         return ret;
 }
diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
index 6ed7c0fb3378..6b186829087c 100644
--- a/drivers/gpio/gpio-74xx-mmio.c
+++ b/drivers/gpio/gpio-74xx-mmio.c
@@ -113,13 +113,16 @@ static int mmio_74xx_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 
 static int mmio_74xx_gpio_probe(struct platform_device *pdev)
 {
-        const struct of_device_id *of_id =
-                of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+        const struct of_device_id *of_id;
         struct mmio_74xx_gpio_priv *priv;
         struct resource *res;
         void __iomem *dat;
         int err;
 
+        of_id = of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 56d2d026e62e..f7fbb46d5d79 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1122,8 +1122,6 @@ static int omap_gpio_chip_init(struct gpio_bank *bank, struct irq_chip *irqc)
         /* MPUIO is a bit different, reading IRQ status clears it */
         if (bank->is_mpuio) {
                 irqc->irq_ack = dummy_irq_chip.irq_ack;
-                irqc->irq_mask = irq_gc_mask_set_bit;
-                irqc->irq_unmask = irq_gc_mask_clr_bit;
                 if (!bank->regs->wkup_en)
                         irqc->irq_set_wake = NULL;
         }
diff --git a/drivers/gpio/gpio-palmas.c b/drivers/gpio/gpio-palmas.c
index 171a6389f9ce..52b447c071cb 100644
--- a/drivers/gpio/gpio-palmas.c
+++ b/drivers/gpio/gpio-palmas.c
@@ -167,6 +167,8 @@ static int palmas_gpio_probe(struct platform_device *pdev)
         const struct palmas_device_data *dev_data;
 
         match = of_match_device(of_palmas_gpio_match, &pdev->dev);
+        if (!match)
+                return -ENODEV;
         dev_data = match->data;
         if (!dev_data)
                 dev_data = &palmas_dev_data;
diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
index 045a952576c7..7b25fdf64802 100644
--- a/drivers/gpio/gpio-syscon.c
+++ b/drivers/gpio/gpio-syscon.c
@@ -187,11 +187,15 @@ MODULE_DEVICE_TABLE(of, syscon_gpio_ids);
 static int syscon_gpio_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        const struct of_device_id *of_id = of_match_device(syscon_gpio_ids, dev);
+        const struct of_device_id *of_id;
         struct syscon_gpio_priv *priv;
         struct device_node *np = dev->of_node;
         int ret;
 
+        of_id = of_match_device(syscon_gpio_ids, dev);
+        if (!of_id)
+                return -ENODEV;
+
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 027e5f47dd28..896bf29776b0 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -375,6 +375,60 @@ static int tegra_gpio_irq_set_wake(struct irq_data *d, unsigned int enable)
 }
 #endif
 
+#ifdef  CONFIG_DEBUG_FS
+
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+static int dbg_gpio_show(struct seq_file *s, void *unused)
+{
+        int i;
+        int j;
+
+        for (i = 0; i < tegra_gpio_bank_count; i++) {
+                for (j = 0; j < 4; j++) {
+                        int gpio = tegra_gpio_compose(i, j, 0);
+                        seq_printf(s,
+                                "%d:%d %02x %02x %02x %02x %02x %02x %06x\n",
+                                i, j,
+                                tegra_gpio_readl(GPIO_CNF(gpio)),
+                                tegra_gpio_readl(GPIO_OE(gpio)),
+                                tegra_gpio_readl(GPIO_OUT(gpio)),
+                                tegra_gpio_readl(GPIO_IN(gpio)),
+                                tegra_gpio_readl(GPIO_INT_STA(gpio)),
+                                tegra_gpio_readl(GPIO_INT_ENB(gpio)),
+                                tegra_gpio_readl(GPIO_INT_LVL(gpio)));
+                }
+        }
+        return 0;
+}
+
+static int dbg_gpio_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, dbg_gpio_show, &inode->i_private);
+}
+
+static const struct file_operations debug_fops = {
+        .open           = dbg_gpio_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static void tegra_gpio_debuginit(void)
+{
+        (void) debugfs_create_file("tegra_gpio", S_IRUGO,
+                                        NULL, NULL, &debug_fops);
+}
+
+#else
+
+static inline void tegra_gpio_debuginit(void)
+{
+}
+
+#endif
+
 static struct irq_chip tegra_gpio_irq_chip = {
         .name           = "GPIO",
         .irq_ack        = tegra_gpio_irq_ack,
@@ -519,6 +573,8 @@ static int tegra_gpio_probe(struct platform_device *pdev)
                         spin_lock_init(&bank->lvl_lock[j]);
         }
 
+        tegra_gpio_debuginit();
+
         return 0;
 }
 
@@ -536,52 +592,3 @@ static int __init tegra_gpio_init(void)
         return platform_driver_register(&tegra_gpio_driver);
 }
 postcore_initcall(tegra_gpio_init);
-
-#ifdef  CONFIG_DEBUG_FS
-
-#include <linux/debugfs.h>
-#include <linux/seq_file.h>
-
-static int dbg_gpio_show(struct seq_file *s, void *unused)
-{
-        int i;
-        int j;
-
-        for (i = 0; i < tegra_gpio_bank_count; i++) {
-                for (j = 0; j < 4; j++) {
-                        int gpio = tegra_gpio_compose(i, j, 0);
-                        seq_printf(s,
-                                "%d:%d %02x %02x %02x %02x %02x %02x %06x\n",
-                                i, j,
-                                tegra_gpio_readl(GPIO_CNF(gpio)),
-                                tegra_gpio_readl(GPIO_OE(gpio)),
-                                tegra_gpio_readl(GPIO_OUT(gpio)),
-                                tegra_gpio_readl(GPIO_IN(gpio)),
-                                tegra_gpio_readl(GPIO_INT_STA(gpio)),
-                                tegra_gpio_readl(GPIO_INT_ENB(gpio)),
-                                tegra_gpio_readl(GPIO_INT_LVL(gpio)));
-                }
-        }
-        return 0;
-}
-
-static int dbg_gpio_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, dbg_gpio_show, &inode->i_private);
-}
-
-static const struct file_operations debug_fops = {
-        .open           = dbg_gpio_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-
-static int __init tegra_gpio_debuginit(void)
-{
-        (void) debugfs_create_file("tegra_gpio", S_IRUGO,
-                                        NULL, NULL, &debug_fops);
-        return 0;
-}
-late_initcall(tegra_gpio_debuginit);
-#endif
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index a18f00fc1bb8..2a91f3287e3b 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -233,7 +233,7 @@ static struct gpio_desc *gpio_name_to_desc(const char * const name)
                 for (i = 0; i != chip->ngpio; ++i) {
                         struct gpio_desc *gpio = &chip->desc[i];
 
-                        if (!gpio->name)
+                        if (!gpio->name || !name)
                                 continue;
 
                         if (!strcmp(gpio->name, name)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 615ce6d464fb..251b14736de9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -389,7 +389,6 @@ struct amdgpu_clock {
  * Fences.
  */
 struct amdgpu_fence_driver {
-        struct amdgpu_ring              *ring;
         uint64_t                        gpu_addr;
         volatile uint32_t               *cpu_addr;
         /* sync_seq is protected by ring emission lock */
@@ -398,7 +397,7 @@ struct amdgpu_fence_driver {
         bool                            initialized;
         struct amdgpu_irq_src           *irq_src;
         unsigned                        irq_type;
-        struct delayed_work             lockup_work;
+        struct timer_list               fallback_timer;
         wait_queue_head_t               fence_queue;
 };
 
@@ -497,6 +496,7 @@ struct amdgpu_bo_va_mapping {
 
 /* bo virtual addresses in a specific vm */
 struct amdgpu_bo_va {
+        struct mutex                    mutex;
         /* protected by bo being reserved */
         struct list_head                bo_list;
         struct fence                    *last_pt_update;
@@ -917,8 +917,8 @@ struct amdgpu_ring {
 #define AMDGPU_VM_FAULT_STOP_ALWAYS     2
 
 struct amdgpu_vm_pt {
-        struct amdgpu_bo                *bo;
-        uint64_t                        addr;
+        struct amdgpu_bo        *bo;
+        uint64_t                addr;
 };
 
 struct amdgpu_vm_id {
@@ -926,13 +926,9 @@ struct amdgpu_vm_id {
         uint64_t                pd_gpu_addr;
         /* last flushed PD/PT update */
         struct fence            *flushed_updates;
-        /* last use of vmid */
-        struct fence            *last_id_use;
 };
 
 struct amdgpu_vm {
-        struct mutex            mutex;
-
         struct rb_root          va;
 
         /* protecting invalidated */
@@ -957,24 +953,70 @@ struct amdgpu_vm {
 
         /* for id and flush management per ring */
         struct amdgpu_vm_id     ids[AMDGPU_MAX_RINGS];
+        /* for interval tree */
+        spinlock_t              it_lock;
 };
 
 struct amdgpu_vm_manager {
-        struct fence                    *active[AMDGPU_NUM_VM];
-        uint32_t                        max_pfn;
+        struct {
+                struct fence    *active;
+                atomic_long_t   owner;
+        } ids[AMDGPU_NUM_VM];
+
+        uint32_t                                max_pfn;
         /* number of VMIDs */
-        unsigned                        nvm;
+        unsigned                                nvm;
         /* vram base address for page table entry  */
-        u64                             vram_base_offset;
+        u64                                     vram_base_offset;
         /* is vm enabled? */
-        bool                            enabled;
-        /* for hw to save the PD addr on suspend/resume */
-        uint32_t                        saved_table_addr[AMDGPU_NUM_VM];
+        bool                                    enabled;
         /* vm pte handling */
         const struct amdgpu_vm_pte_funcs        *vm_pte_funcs;
         struct amdgpu_ring                      *vm_pte_funcs_ring;
 };
 
+void amdgpu_vm_manager_fini(struct amdgpu_device *adev);
+int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm);
+void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm);
+struct amdgpu_bo_list_entry *amdgpu_vm_get_bos(struct amdgpu_device *adev,
+                                               struct amdgpu_vm *vm,
+                                               struct list_head *head);
+int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
+                      struct amdgpu_sync *sync);
+void amdgpu_vm_flush(struct amdgpu_ring *ring,
+                     struct amdgpu_vm *vm,
+                     struct fence *updates);
+void amdgpu_vm_fence(struct amdgpu_device *adev,
+                     struct amdgpu_vm *vm,
+                     struct fence *fence);
+uint64_t amdgpu_vm_map_gart(struct amdgpu_device *adev, uint64_t addr);
+int amdgpu_vm_update_page_directory(struct amdgpu_device *adev,
+                                    struct amdgpu_vm *vm);
+int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
+                          struct amdgpu_vm *vm);
+int amdgpu_vm_clear_invalids(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+                             struct amdgpu_sync *sync);
+int amdgpu_vm_bo_update(struct amdgpu_device *adev,
+                        struct amdgpu_bo_va *bo_va,
+                        struct ttm_mem_reg *mem);
+void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev,
+                             struct amdgpu_bo *bo);
+struct amdgpu_bo_va *amdgpu_vm_bo_find(struct amdgpu_vm *vm,
+                                       struct amdgpu_bo *bo);
+struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
+                                      struct amdgpu_vm *vm,
+                                      struct amdgpu_bo *bo);
+int amdgpu_vm_bo_map(struct amdgpu_device *adev,
+                     struct amdgpu_bo_va *bo_va,
+                     uint64_t addr, uint64_t offset,
+                     uint64_t size, uint32_t flags);
+int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
+                       struct amdgpu_bo_va *bo_va,
+                       uint64_t addr);
+void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
+                      struct amdgpu_bo_va *bo_va);
+int amdgpu_vm_free_job(struct amdgpu_job *job);
+
 /*
  * context related structures
  */
@@ -1211,6 +1253,7 @@ struct amdgpu_cs_parser {
         /* relocations */
         struct amdgpu_bo_list_entry     *vm_bos;
         struct list_head        validated;
+        struct fence            *fence;
 
         struct amdgpu_ib        *ibs;
         uint32_t                num_ibs;
@@ -1226,7 +1269,7 @@ struct amdgpu_job {
         struct amdgpu_device    *adev;
         struct amdgpu_ib        *ibs;
         uint32_t                num_ibs;
-        struct mutex            job_lock;
+        void                    *owner;
         struct amdgpu_user_fence uf;
         int (*free_job)(struct amdgpu_job *job);
 };
@@ -2257,11 +2300,6 @@ void amdgpu_pci_config_reset(struct amdgpu_device *adev);
 bool amdgpu_card_posted(struct amdgpu_device *adev);
 void amdgpu_update_display_priority(struct amdgpu_device *adev);
 bool amdgpu_boot_test_post_card(struct amdgpu_device *adev);
-struct amdgpu_cs_parser *amdgpu_cs_parser_create(struct amdgpu_device *adev,
-                                                 struct drm_file *filp,
-                                                 struct amdgpu_ctx *ctx,
-                                                 struct amdgpu_ib *ibs,
-                                                 uint32_t num_ibs);
 
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data);
 int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
@@ -2319,49 +2357,6 @@ long amdgpu_kms_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
 
 /*
- * vm
- */
-int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm);
-void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm);
-struct amdgpu_bo_list_entry *amdgpu_vm_get_bos(struct amdgpu_device *adev,
-                                          struct amdgpu_vm *vm,
-                                          struct list_head *head);
-int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
-                      struct amdgpu_sync *sync);
-void amdgpu_vm_flush(struct amdgpu_ring *ring,
-                     struct amdgpu_vm *vm,
-                     struct fence *updates);
-void amdgpu_vm_fence(struct amdgpu_device *adev,
-                     struct amdgpu_vm *vm,
-                     struct amdgpu_fence *fence);
-uint64_t amdgpu_vm_map_gart(struct amdgpu_device *adev, uint64_t addr);
-int amdgpu_vm_update_page_directory(struct amdgpu_device *adev,
-                                    struct amdgpu_vm *vm);
-int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
-                                struct amdgpu_vm *vm);
-int amdgpu_vm_clear_invalids(struct amdgpu_device *adev,
-                                struct amdgpu_vm *vm, struct amdgpu_sync *sync);
-int amdgpu_vm_bo_update(struct amdgpu_device *adev,
-                        struct amdgpu_bo_va *bo_va,
-                        struct ttm_mem_reg *mem);
-void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev,
-                             struct amdgpu_bo *bo);
-struct amdgpu_bo_va *amdgpu_vm_bo_find(struct amdgpu_vm *vm,
-                                       struct amdgpu_bo *bo);
-struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
-                                      struct amdgpu_vm *vm,
-                                      struct amdgpu_bo *bo);
-int amdgpu_vm_bo_map(struct amdgpu_device *adev,
-                     struct amdgpu_bo_va *bo_va,
-                     uint64_t addr, uint64_t offset,
-                     uint64_t size, uint32_t flags);
-int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
-                       struct amdgpu_bo_va *bo_va,
-                       uint64_t addr);
-void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
-                      struct amdgpu_bo_va *bo_va);
-int amdgpu_vm_free_job(struct amdgpu_job *job);
-/*
  * functions used by amdgpu_encoder.c
  */
 struct amdgpu_afmt_acr {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index dfc4d02c7a38..1d44d508d4d4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -127,30 +127,6 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
         return 0;
 }
 
-struct amdgpu_cs_parser *amdgpu_cs_parser_create(struct amdgpu_device *adev,
-                                               struct drm_file *filp,
-                                               struct amdgpu_ctx *ctx,
-                                               struct amdgpu_ib *ibs,
-                                               uint32_t num_ibs)
-{
-        struct amdgpu_cs_parser *parser;
-        int i;
-
-        parser = kzalloc(sizeof(struct amdgpu_cs_parser), GFP_KERNEL);
-        if (!parser)
-                return NULL;
-
-        parser->adev = adev;
-        parser->filp = filp;
-        parser->ctx = ctx;
-        parser->ibs = ibs;
-        parser->num_ibs = num_ibs;
-        for (i = 0; i < num_ibs; i++)
-                ibs[i].ctx = ctx;
-
-        return parser;
-}
-
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 {
         union drm_amdgpu_cs *cs = data;
@@ -463,8 +439,18 @@ static int cmp_size_smaller_first(void *priv, struct list_head *a,
         return (int)la->robj->tbo.num_pages - (int)lb->robj->tbo.num_pages;
 }
 
-static void amdgpu_cs_parser_fini_early(struct amdgpu_cs_parser *parser, int error, bool backoff)
+/**
+ * cs_parser_fini() - clean parser states
+ * @parser:     parser structure holding parsing context.
+ * @error:      error number
+ *
+ * If error is set than unvalidate buffer, otherwise just free memory
+ * used by parsing context.
+ **/
+static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bool backoff)
 {
+        unsigned i;
+
         if (!error) {
                 /* Sort the buffer list from the smallest to largest buffer,
                  * which affects the order of buffers in the LRU list.
@@ -479,17 +465,14 @@ static void amdgpu_cs_parser_fini_early(struct amdgpu_cs_parser *parser, int err
                 list_sort(NULL, &parser->validated, cmp_size_smaller_first);
 
                 ttm_eu_fence_buffer_objects(&parser->ticket,
-                                &parser->validated,
-                                &parser->ibs[parser->num_ibs-1].fence->base);
+                                            &parser->validated,
+                                            parser->fence);
         } else if (backoff) {
                 ttm_eu_backoff_reservation(&parser->ticket,
                                            &parser->validated);
         }
-}
+        fence_put(parser->fence);
 
-static void amdgpu_cs_parser_fini_late(struct amdgpu_cs_parser *parser)
-{
-        unsigned i;
         if (parser->ctx)
                 amdgpu_ctx_put(parser->ctx);
         if (parser->bo_list)
@@ -499,31 +482,12 @@ static void amdgpu_cs_parser_fini_late(struct amdgpu_cs_parser *parser)
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
-        if (!amdgpu_enable_scheduler)
-        {
-                if (parser->ibs)
-                        for (i = 0; i < parser->num_ibs; i++)
-                                amdgpu_ib_free(parser->adev, &parser->ibs[i]);
-                kfree(parser->ibs);
-                if (parser->uf.bo)
-                        drm_gem_object_unreference_unlocked(&parser->uf.bo->gem_base);
-        }
-
-        kfree(parser);
-}
-
-/**
- * cs_parser_fini() - clean parser states
- * @parser:     parser structure holding parsing context.
- * @error:      error number
- *
- * If error is set than unvalidate buffer, otherwise just free memory
- * used by parsing context.
- **/
-static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bool backoff)
-{
-       amdgpu_cs_parser_fini_early(parser, error, backoff);
-       amdgpu_cs_parser_fini_late(parser);
+        if (parser->ibs)
+                for (i = 0; i < parser->num_ibs; i++)
+                        amdgpu_ib_free(parser->adev, &parser->ibs[i]);
+        kfree(parser->ibs);
+        if (parser->uf.bo)
+                drm_gem_object_unreference_unlocked(&parser->uf.bo->gem_base);
 }
 
 static int amdgpu_bo_vm_update_pte(struct amdgpu_cs_parser *p,
@@ -610,15 +574,9 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
         }
 
         r = amdgpu_bo_vm_update_pte(parser, vm);
-        if (r) {
-                goto out;
-        }
-        amdgpu_cs_sync_rings(parser);
-        if (!amdgpu_enable_scheduler)
-                r = amdgpu_ib_schedule(adev, parser->num_ibs, parser->ibs,
-                                       parser->filp);
+        if (!r)
+                amdgpu_cs_sync_rings(parser);
 
-out:
         return r;
 }
 
@@ -826,38 +784,35 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
 {
         struct amdgpu_device *adev = dev->dev_private;
         union drm_amdgpu_cs *cs = data;
-        struct amdgpu_fpriv *fpriv = filp->driver_priv;
-        struct amdgpu_vm *vm = &fpriv->vm;
-        struct amdgpu_cs_parser *parser;
+        struct amdgpu_cs_parser parser = {};
         bool reserved_buffers = false;
         int i, r;
 
         if (!adev->accel_working)
                 return -EBUSY;
 
-        parser = amdgpu_cs_parser_create(adev, filp, NULL, NULL, 0);
-        if (!parser)
-                return -ENOMEM;
-        r = amdgpu_cs_parser_init(parser, data);
+        parser.adev = adev;
+        parser.filp = filp;
+
+        r = amdgpu_cs_parser_init(&parser, data);
         if (r) {
                 DRM_ERROR("Failed to initialize parser !\n");
-                amdgpu_cs_parser_fini(parser, r, false);
+                amdgpu_cs_parser_fini(&parser, r, false);
                 r = amdgpu_cs_handle_lockup(adev, r);
                 return r;
         }
-        mutex_lock(&vm->mutex);
-        r = amdgpu_cs_parser_relocs(parser);
+        r = amdgpu_cs_parser_relocs(&parser);
         if (r == -ENOMEM)
                 DRM_ERROR("Not enough memory for command submission!\n");
         else if (r && r != -ERESTARTSYS)
                 DRM_ERROR("Failed to process the buffer list %d!\n", r);
         else if (!r) {
                 reserved_buffers = true;
-                r = amdgpu_cs_ib_fill(adev, parser);
+                r = amdgpu_cs_ib_fill(adev, &parser);
         }
 
         if (!r) {
-                r = amdgpu_cs_dependencies(adev, parser);
+                r = amdgpu_cs_dependencies(adev, &parser);
                 if (r)
                         DRM_ERROR("Failed in the dependencies handling %d!\n", r);
         }
@@ -865,63 +820,71 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         if (r)
                 goto out;
 
-        for (i = 0; i < parser->num_ibs; i++)
-                trace_amdgpu_cs(parser, i);
+        for (i = 0; i < parser.num_ibs; i++)
+                trace_amdgpu_cs(&parser, i);
 
-        r = amdgpu_cs_ib_vm_chunk(adev, parser);
+        r = amdgpu_cs_ib_vm_chunk(adev, &parser);
         if (r)
                 goto out;
 
-        if (amdgpu_enable_scheduler && parser->num_ibs) {
+        if (amdgpu_enable_scheduler && parser.num_ibs) {
+                struct amdgpu_ring * ring = parser.ibs->ring;
+                struct amd_sched_fence *fence;
                 struct amdgpu_job *job;
-                struct amdgpu_ring * ring =  parser->ibs->ring;
+
                 job = kzalloc(sizeof(struct amdgpu_job), GFP_KERNEL);
                 if (!job) {
                         r = -ENOMEM;
                         goto out;
                 }
+
                 job->base.sched = &ring->sched;
-                job->base.s_entity = &parser->ctx->rings[ring->idx].entity;
-                job->adev = parser->adev;
-                job->ibs = parser->ibs;
-                job->num_ibs = parser->num_ibs;
-                job->base.owner = parser->filp;
-                mutex_init(&job->job_lock);
+                job->base.s_entity = &parser.ctx->rings[ring->idx].entity;
+                job->adev = parser.adev;
+                job->owner = parser.filp;
+                job->free_job = amdgpu_cs_free_job;
+
+                job->ibs = parser.ibs;
+                job->num_ibs = parser.num_ibs;
+                parser.ibs = NULL;
+                parser.num_ibs = 0;
+
                 if (job->ibs[job->num_ibs - 1].user) {
-                        memcpy(&job->uf,  &parser->uf,
-                               sizeof(struct amdgpu_user_fence));
+                        job->uf = parser.uf;
                         job->ibs[job->num_ibs - 1].user = &job->uf;
+                        parser.uf.bo = NULL;
                 }
 
-                job->free_job = amdgpu_cs_free_job;
-                mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job(&job->base);
-                if (r) {
-                        mutex_unlock(&job->job_lock);
+                fence = amd_sched_fence_create(job->base.s_entity,
+                                               parser.filp);
+                if (!fence) {
+                        r = -ENOMEM;
                         amdgpu_cs_free_job(job);
                         kfree(job);
                         goto out;
                 }
-                cs->out.handle =
-                        amdgpu_ctx_add_fence(parser->ctx, ring,
-                                             &job->base.s_fence->base);
-                parser->ibs[parser->num_ibs - 1].sequence = cs->out.handle;
+                job->base.s_fence = fence;
+                parser.fence = fence_get(&fence->base);
 
-                list_sort(NULL, &parser->validated, cmp_size_smaller_first);
-                ttm_eu_fence_buffer_objects(&parser->ticket,
-                                &parser->validated,
-                                &job->base.s_fence->base);
+                cs->out.handle = amdgpu_ctx_add_fence(parser.ctx, ring,
+                                                      &fence->base);
+                job->ibs[job->num_ibs - 1].sequence = cs->out.handle;
 
-                mutex_unlock(&job->job_lock);
-                amdgpu_cs_parser_fini_late(parser);
-                mutex_unlock(&vm->mutex);
-                return 0;
+                trace_amdgpu_cs_ioctl(job);
+                amd_sched_entity_push_job(&job->base);
+
+        } else {
+                struct amdgpu_fence *fence;
+
+                r = amdgpu_ib_schedule(adev, parser.num_ibs, parser.ibs,
+                                       parser.filp);
+                fence = parser.ibs[parser.num_ibs - 1].fence;
+                parser.fence = fence_get(&fence->base);
+                cs->out.handle = parser.ibs[parser.num_ibs - 1].sequence;
         }
 
-        cs->out.handle = parser->ibs[parser->num_ibs - 1].sequence;
 out:
-        amdgpu_cs_parser_fini(parser, r, reserved_buffers);
-        mutex_unlock(&vm->mutex);
+        amdgpu_cs_parser_fini(&parser, r, reserved_buffers);
         r = amdgpu_cs_handle_lockup(adev, r);
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 257d72205bb5..3671f9f220bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -47,6 +47,9 @@
  * that the the relevant GPU caches have been flushed.
  */
 
+static struct kmem_cache *amdgpu_fence_slab;
+static atomic_t amdgpu_fence_slab_ref = ATOMIC_INIT(0);
+
 /**
  * amdgpu_fence_write - write a fence value
  *
@@ -85,24 +88,6 @@ static u32 amdgpu_fence_read(struct amdgpu_ring *ring)
 }
 
 /**
- * amdgpu_fence_schedule_check - schedule lockup check
- *
- * @ring: pointer to struct amdgpu_ring
- *
- * Queues a delayed work item to check for lockups.
- */
-static void amdgpu_fence_schedule_check(struct amdgpu_ring *ring)
-{
-        /*
-         * Do not reset the timer here with mod_delayed_work,
-         * this can livelock in an interaction with TTM delayed destroy.
-         */
-        queue_delayed_work(system_power_efficient_wq,
-                &ring->fence_drv.lockup_work,
-                AMDGPU_FENCE_JIFFIES_TIMEOUT);
-}
-
-/**
  * amdgpu_fence_emit - emit a fence on the requested ring
  *
  * @ring: ring the fence is associated with
@@ -118,7 +103,7 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, void *owner,
         struct amdgpu_device *adev = ring->adev;
 
         /* we are protected by the ring emission mutex */
-        *fence = kmalloc(sizeof(struct amdgpu_fence), GFP_KERNEL);
+        *fence = kmem_cache_alloc(amdgpu_fence_slab, GFP_KERNEL);
         if ((*fence) == NULL) {
                 return -ENOMEM;
         }
@@ -132,11 +117,23 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, void *owner,
         amdgpu_ring_emit_fence(ring, ring->fence_drv.gpu_addr,
                                (*fence)->seq,
                                AMDGPU_FENCE_FLAG_INT);
-        trace_amdgpu_fence_emit(ring->adev->ddev, ring->idx, (*fence)->seq);
         return 0;
 }
 
 /**
+ * amdgpu_fence_schedule_fallback - schedule fallback check
+ *
+ * @ring: pointer to struct amdgpu_ring
+ *
+ * Start a timer as fallback to our interrupts.
+ */
+static void amdgpu_fence_schedule_fallback(struct amdgpu_ring *ring)
+{
+        mod_timer(&ring->fence_drv.fallback_timer,
+                  jiffies + AMDGPU_FENCE_JIFFIES_TIMEOUT);
+}
+
+/**
  * amdgpu_fence_activity - check for fence activity
  *
  * @ring: pointer to struct amdgpu_ring
@@ -202,45 +199,38 @@ static bool amdgpu_fence_activity(struct amdgpu_ring *ring)
         } while (atomic64_xchg(&ring->fence_drv.last_seq, seq) > seq);
 
         if (seq < last_emitted)
-                amdgpu_fence_schedule_check(ring);
+                amdgpu_fence_schedule_fallback(ring);
 
         return wake;
 }
 
 /**
- * amdgpu_fence_check_lockup - check for hardware lockup
+ * amdgpu_fence_process - process a fence
  *
- * @work: delayed work item
+ * @adev: amdgpu_device pointer
+ * @ring: ring index the fence is associated with
  *
- * Checks for fence activity and if there is none probe
- * the hardware if a lockup occured.
+ * Checks the current fence value and wakes the fence queue
+ * if the sequence number has increased (all asics).
  */
-static void amdgpu_fence_check_lockup(struct work_struct *work)
+void amdgpu_fence_process(struct amdgpu_ring *ring)
 {
-        struct amdgpu_fence_driver *fence_drv;
-        struct amdgpu_ring *ring;
-
-        fence_drv = container_of(work, struct amdgpu_fence_driver,
-                                lockup_work.work);
-        ring = fence_drv->ring;
-
         if (amdgpu_fence_activity(ring))
                 wake_up_all(&ring->fence_drv.fence_queue);
 }
 
 /**
- * amdgpu_fence_process - process a fence
+ * amdgpu_fence_fallback - fallback for hardware interrupts
  *
- * @adev: amdgpu_device pointer
- * @ring: ring index the fence is associated with
+ * @work: delayed work item
  *
- * Checks the current fence value and wakes the fence queue
- * if the sequence number has increased (all asics).
+ * Checks for fence activity.
  */
-void amdgpu_fence_process(struct amdgpu_ring *ring)
+static void amdgpu_fence_fallback(unsigned long arg)
 {
-        if (amdgpu_fence_activity(ring))
-                wake_up_all(&ring->fence_drv.fence_queue);
+        struct amdgpu_ring *ring = (void *)arg;
+
+        amdgpu_fence_process(ring);
 }
 
 /**
@@ -290,7 +280,7 @@ static int amdgpu_fence_ring_wait_seq(struct amdgpu_ring *ring, uint64_t seq)
         if (atomic64_read(&ring->fence_drv.last_seq) >= seq)
                 return 0;
 
-        amdgpu_fence_schedule_check(ring);
+        amdgpu_fence_schedule_fallback(ring);
         wait_event(ring->fence_drv.fence_queue, (
                    (signaled = amdgpu_fence_seq_signaled(ring, seq))));
 
@@ -491,9 +481,8 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
         atomic64_set(&ring->fence_drv.last_seq, 0);
         ring->fence_drv.initialized = false;
 
-        INIT_DELAYED_WORK(&ring->fence_drv.lockup_work,
-                        amdgpu_fence_check_lockup);
-        ring->fence_drv.ring = ring;
+        setup_timer(&ring->fence_drv.fallback_timer, amdgpu_fence_fallback,
+                    (unsigned long)ring);
 
         init_waitqueue_head(&ring->fence_drv.fence_queue);
 
@@ -536,6 +525,13 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
  */
 int amdgpu_fence_driver_init(struct amdgpu_device *adev)
 {
+        if (atomic_inc_return(&amdgpu_fence_slab_ref) == 1) {
+                amdgpu_fence_slab = kmem_cache_create(
+                        "amdgpu_fence", sizeof(struct amdgpu_fence), 0,
+                        SLAB_HWCACHE_ALIGN, NULL);
+                if (!amdgpu_fence_slab)
+                        return -ENOMEM;
+        }
         if (amdgpu_debugfs_fence_init(adev))
                 dev_err(adev->dev, "fence debugfs file creation failed\n");
 
@@ -554,9 +550,12 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
 {
         int i, r;
 
+        if (atomic_dec_and_test(&amdgpu_fence_slab_ref))
+                kmem_cache_destroy(amdgpu_fence_slab);
         mutex_lock(&adev->ring_lock);
         for (i = 0; i < AMDGPU_MAX_RINGS; i++) {
                 struct amdgpu_ring *ring = adev->rings[i];
+
                 if (!ring || !ring->fence_drv.initialized)
                         continue;
                 r = amdgpu_fence_wait_empty(ring);
@@ -568,6 +567,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
                 amdgpu_irq_put(adev, ring->fence_drv.irq_src,
                                ring->fence_drv.irq_type);
                 amd_sched_fini(&ring->sched);
+                del_timer_sync(&ring->fence_drv.fallback_timer);
                 ring->fence_drv.initialized = false;
         }
         mutex_unlock(&adev->ring_lock);
@@ -751,18 +751,25 @@ static bool amdgpu_fence_enable_signaling(struct fence *f)
         fence->fence_wake.func = amdgpu_fence_check_signaled;
         __add_wait_queue(&ring->fence_drv.fence_queue, &fence->fence_wake);
         fence_get(f);
-        amdgpu_fence_schedule_check(ring);
+        if (!timer_pending(&ring->fence_drv.fallback_timer))
+                amdgpu_fence_schedule_fallback(ring);
         FENCE_TRACE(&fence->base, "armed on ring %i!\n", ring->idx);
         return true;
 }
 
+static void amdgpu_fence_release(struct fence *f)
+{
+        struct amdgpu_fence *fence = to_amdgpu_fence(f);
+        kmem_cache_free(amdgpu_fence_slab, fence);
+}
+
 const struct fence_ops amdgpu_fence_ops = {
         .get_driver_name = amdgpu_fence_get_driver_name,
         .get_timeline_name = amdgpu_fence_get_timeline_name,
         .enable_signaling = amdgpu_fence_enable_signaling,
         .signaled = amdgpu_fence_is_signaled,
         .wait = fence_default_wait,
-        .release = NULL,
+        .release = amdgpu_fence_release,
 };
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 087332858853..fc32fc01a64b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -115,12 +115,9 @@ int amdgpu_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
         struct amdgpu_vm *vm = &fpriv->vm;
         struct amdgpu_bo_va *bo_va;
         int r;
-        mutex_lock(&vm->mutex);
         r = amdgpu_bo_reserve(rbo, false);
-        if (r) {
-                mutex_unlock(&vm->mutex);
+        if (r)
                 return r;
-        }
 
         bo_va = amdgpu_vm_bo_find(vm, rbo);
         if (!bo_va) {
@@ -129,7 +126,6 @@ int amdgpu_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_pri
                 ++bo_va->ref_count;
         }
         amdgpu_bo_unreserve(rbo);
-        mutex_unlock(&vm->mutex);
         return 0;
 }
 
@@ -142,10 +138,8 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj,
         struct amdgpu_vm *vm = &fpriv->vm;
         struct amdgpu_bo_va *bo_va;
         int r;
-        mutex_lock(&vm->mutex);
         r = amdgpu_bo_reserve(rbo, true);
         if (r) {
-                mutex_unlock(&vm->mutex);
                 dev_err(adev->dev, "leaking bo va because "
                         "we fail to reserve bo (%d)\n", r);
                 return;
@@ -157,7 +151,6 @@ void amdgpu_gem_object_close(struct drm_gem_object *obj,
                 }
         }
         amdgpu_bo_unreserve(rbo);
-        mutex_unlock(&vm->mutex);
 }
 
 static int amdgpu_gem_handle_lockup(struct amdgpu_device *adev, int r)
@@ -483,6 +476,9 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
                 if (domain == AMDGPU_GEM_DOMAIN_CPU)
                         goto error_unreserve;
         }
+        r = amdgpu_vm_update_page_directory(adev, bo_va->vm);
+        if (r)
+                goto error_unreserve;
 
         r = amdgpu_vm_clear_freed(adev, bo_va->vm);
         if (r)
@@ -512,6 +508,9 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         struct amdgpu_fpriv *fpriv = filp->driver_priv;
         struct amdgpu_bo *rbo;
         struct amdgpu_bo_va *bo_va;
+        struct ttm_validate_buffer tv, tv_pd;
+        struct ww_acquire_ctx ticket;
+        struct list_head list, duplicates;
         uint32_t invalid_flags, va_flags = 0;
         int r = 0;
 
@@ -547,19 +546,28 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         gobj = drm_gem_object_lookup(dev, filp, args->handle);
         if (gobj == NULL)
                 return -ENOENT;
-        mutex_lock(&fpriv->vm.mutex);
         rbo = gem_to_amdgpu_bo(gobj);
-        r = amdgpu_bo_reserve(rbo, false);
+        INIT_LIST_HEAD(&list);
+        INIT_LIST_HEAD(&duplicates);
+        tv.bo = &rbo->tbo;
+        tv.shared = true;
+        list_add(&tv.head, &list);
+
+        if (args->operation == AMDGPU_VA_OP_MAP) {
+                tv_pd.bo = &fpriv->vm.page_directory->tbo;
+                tv_pd.shared = true;
+                list_add(&tv_pd.head, &list);
+        }
+        r = ttm_eu_reserve_buffers(&ticket, &list, true, &duplicates);
         if (r) {
-                mutex_unlock(&fpriv->vm.mutex);
                 drm_gem_object_unreference_unlocked(gobj);
                 return r;
         }
 
         bo_va = amdgpu_vm_bo_find(&fpriv->vm, rbo);
         if (!bo_va) {
-                amdgpu_bo_unreserve(rbo);
-                mutex_unlock(&fpriv->vm.mutex);
+                ttm_eu_backoff_reservation(&ticket, &list);
+                drm_gem_object_unreference_unlocked(gobj);
                 return -ENOENT;
         }
 
@@ -581,10 +589,10 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         default:
                 break;
         }
-
+        ttm_eu_backoff_reservation(&ticket, &list);
         if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE))
                 amdgpu_gem_va_update_vm(adev, bo_va, args->operation);
-        mutex_unlock(&fpriv->vm.mutex);
+
         drm_gem_object_unreference_unlocked(gobj);
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index e65987743871..9e25edafa721 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -62,7 +62,7 @@ int amdgpu_ib_get(struct amdgpu_ring *ring, struct amdgpu_vm *vm,
         int r;
 
         if (size) {
-                r = amdgpu_sa_bo_new(adev, &adev->ring_tmp_bo,
+                r = amdgpu_sa_bo_new(&adev->ring_tmp_bo,
                                       &ib->sa_bo, size, 256);
                 if (r) {
                         dev_err(adev->dev, "failed to get a new IB (%d)\n", r);
@@ -216,7 +216,7 @@ int amdgpu_ib_schedule(struct amdgpu_device *adev, unsigned num_ibs,
         }
 
         if (ib->vm)
-                amdgpu_vm_fence(adev, ib->vm, ib->fence);
+                amdgpu_vm_fence(adev, ib->vm, &ib->fence->base);
 
         amdgpu_ring_unlock_commit(ring);
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
index 3c2ff4567798..ea756e77b023 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
@@ -189,10 +189,9 @@ int amdgpu_sa_bo_manager_start(struct amdgpu_device *adev,
                                       struct amdgpu_sa_manager *sa_manager);
 int amdgpu_sa_bo_manager_suspend(struct amdgpu_device *adev,
                                         struct amdgpu_sa_manager *sa_manager);
-int amdgpu_sa_bo_new(struct amdgpu_device *adev,
-                            struct amdgpu_sa_manager *sa_manager,
-                            struct amdgpu_sa_bo **sa_bo,
-                            unsigned size, unsigned align);
+int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
+                     struct amdgpu_sa_bo **sa_bo,
+                     unsigned size, unsigned align);
 void amdgpu_sa_bo_free(struct amdgpu_device *adev,
                               struct amdgpu_sa_bo **sa_bo,
                               struct fence *fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 0212b31dc194..8b88edb0434b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -311,8 +311,7 @@ static bool amdgpu_sa_bo_next_hole(struct amdgpu_sa_manager *sa_manager,
         return false;
 }
 
-int amdgpu_sa_bo_new(struct amdgpu_device *adev,
-                     struct amdgpu_sa_manager *sa_manager,
+int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
                      struct amdgpu_sa_bo **sa_bo,
                      unsigned size, unsigned align)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
index dcf4a8aca680..438c05254695 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <drm/drmP.h>
 #include "amdgpu.h"
+#include "amdgpu_trace.h"
 
 static struct fence *amdgpu_sched_dependency(struct amd_sched_job *sched_job)
 {
@@ -44,11 +45,8 @@ static struct fence *amdgpu_sched_run_job(struct amd_sched_job *sched_job)
                 return NULL;
         }
         job = to_amdgpu_job(sched_job);
-        mutex_lock(&job->job_lock);
-        r = amdgpu_ib_schedule(job->adev,
-                               job->num_ibs,
-                               job->ibs,
-                               job->base.owner);
+        trace_amdgpu_sched_run_job(job);
+        r = amdgpu_ib_schedule(job->adev, job->num_ibs, job->ibs, job->owner);
         if (r) {
                 DRM_ERROR("Error scheduling IBs (%d)\n", r);
                 goto err;
@@ -61,8 +59,6 @@ err:
         if (job->free_job)
                 job->free_job(job);
 
-        mutex_unlock(&job->job_lock);
-        fence_put(&job->base.s_fence->base);
         kfree(job);
         return fence ? &fence->base : NULL;
 }
@@ -88,21 +84,19 @@ int amdgpu_sched_ib_submit_kernel_helper(struct amdgpu_device *adev,
                         return -ENOMEM;
                 job->base.sched = &ring->sched;
                 job->base.s_entity = &adev->kernel_ctx.rings[ring->idx].entity;
+                job->base.s_fence = amd_sched_fence_create(job->base.s_entity, owner);
+                if (!job->base.s_fence) {
+                        kfree(job);
+                        return -ENOMEM;
+                }
+                *f = fence_get(&job->base.s_fence->base);
+
                 job->adev = adev;
                 job->ibs = ibs;
                 job->num_ibs = num_ibs;
-                job->base.owner = owner;
-                mutex_init(&job->job_lock);
+                job->owner = owner;
                 job->free_job = free_job;
-                mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job(&job->base);
-                if (r) {
-                        mutex_unlock(&job->job_lock);
-                        kfree(job);
-                        return r;
-                }
-                *f = fence_get(&job->base.s_fence->base);
-                mutex_unlock(&job->job_lock);
+                amd_sched_entity_push_job(&job->base);
         } else {
                 r = amdgpu_ib_schedule(adev, num_ibs, ibs, owner);
                 if (r)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
index ff3ca52ec6fe..1caaf201b708 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_semaphore.c
@@ -40,7 +40,7 @@ int amdgpu_semaphore_create(struct amdgpu_device *adev,
         if (*semaphore == NULL) {
                 return -ENOMEM;
         }
-        r = amdgpu_sa_bo_new(adev, &adev->ring_tmp_bo,
+        r = amdgpu_sa_bo_new(&adev->ring_tmp_bo,
                              &(*semaphore)->sa_bo, 8, 8);
         if (r) {
                 kfree(*semaphore);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6697fd05217..dd005c336c97 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -302,8 +302,14 @@ int amdgpu_sync_rings(struct amdgpu_sync *sync,
                         return -EINVAL;
                 }
 
-                if (amdgpu_enable_scheduler || !amdgpu_enable_semaphores ||
-                    (count >= AMDGPU_NUM_SYNCS)) {
+                if (amdgpu_enable_scheduler || !amdgpu_enable_semaphores) {
+                        r = fence_wait(&fence->base, true);
+                        if (r)
+                                return r;
+                        continue;
+                }
+
+                if (count >= AMDGPU_NUM_SYNCS) {
                         /* not enough room, wait manually */
                         r = fence_wait(&fence->base, false);
                         if (r)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
index 76ecbaf72a2e..8f9834ab1bd5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
@@ -48,6 +48,57 @@ TRACE_EVENT(amdgpu_cs,
                       __entry->fences)
 );
 
+TRACE_EVENT(amdgpu_cs_ioctl,
+            TP_PROTO(struct amdgpu_job *job),
+            TP_ARGS(job),
+            TP_STRUCT__entry(
+                             __field(struct amdgpu_device *, adev)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct amdgpu_ib *, ib)
+                             __field(struct fence *, fence)
+                             __field(char *, ring_name)
+                             __field(u32, num_ibs)
+                             ),
+
+            TP_fast_assign(
+                           __entry->adev = job->adev;
+                           __entry->sched_job = &job->base;
+                           __entry->ib = job->ibs;
+                           __entry->fence = &job->base.s_fence->base;
+                           __entry->ring_name = job->ibs[0].ring->name;
+                           __entry->num_ibs = job->num_ibs;
+                           ),
+            TP_printk("adev=%p, sched_job=%p, first ib=%p, sched fence=%p, ring name:%s, num_ibs:%u",
+                      __entry->adev, __entry->sched_job, __entry->ib,
+                      __entry->fence, __entry->ring_name, __entry->num_ibs)
+);
+
+TRACE_EVENT(amdgpu_sched_run_job,
+            TP_PROTO(struct amdgpu_job *job),
+            TP_ARGS(job),
+            TP_STRUCT__entry(
+                             __field(struct amdgpu_device *, adev)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct amdgpu_ib *, ib)
+                             __field(struct fence *, fence)
+                             __field(char *, ring_name)
+                             __field(u32, num_ibs)
+                             ),
+
+            TP_fast_assign(
+                           __entry->adev = job->adev;
+                           __entry->sched_job = &job->base;
+                           __entry->ib = job->ibs;
+                           __entry->fence = &job->base.s_fence->base;
+                           __entry->ring_name = job->ibs[0].ring->name;
+                           __entry->num_ibs = job->num_ibs;
+                           ),
+            TP_printk("adev=%p, sched_job=%p, first ib=%p, sched fence=%p, ring name:%s, num_ibs:%u",
+                      __entry->adev, __entry->sched_job, __entry->ib,
+                      __entry->fence, __entry->ring_name, __entry->num_ibs)
+);
+
+
 TRACE_EVENT(amdgpu_vm_grab_id,
             TP_PROTO(unsigned vmid, int ring),
             TP_ARGS(vmid, ring),
@@ -196,49 +247,6 @@ TRACE_EVENT(amdgpu_bo_list_set,
             TP_printk("list=%p, bo=%p", __entry->list, __entry->bo)
 );
 
-DECLARE_EVENT_CLASS(amdgpu_fence_request,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno),
-
-            TP_STRUCT__entry(
-                             __field(u32, dev)
-                             __field(int, ring)
-                             __field(u32, seqno)
-                             ),
-
-            TP_fast_assign(
-                           __entry->dev = dev->primary->index;
-                           __entry->ring = ring;
-                           __entry->seqno = seqno;
-                           ),
-
-            TP_printk("dev=%u, ring=%d, seqno=%u",
-                      __entry->dev, __entry->ring, __entry->seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_emit,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_wait_begin,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
-DEFINE_EVENT(amdgpu_fence_request, amdgpu_fence_wait_end,
-
-            TP_PROTO(struct drm_device *dev, int ring, u32 seqno),
-
-            TP_ARGS(dev, ring, seqno)
-);
-
 DECLARE_EVENT_CLASS(amdgpu_semaphore_request,
 
             TP_PROTO(int ring, struct amdgpu_semaphore *sem),
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 81bb8e9fc26d..d4bac5f49939 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -1073,10 +1073,10 @@ static int amdgpu_mm_dump_table(struct seq_file *m, void *data)
         ret = drm_mm_dump_table(m, mm);
         spin_unlock(&glob->lru_lock);
         if (ttm_pl == TTM_PL_VRAM)
-                seq_printf(m, "man size:%llu pages, ram usage:%luMB, vis usage:%luMB\n",
+                seq_printf(m, "man size:%llu pages, ram usage:%lluMB, vis usage:%lluMB\n",
                            adev->mman.bdev.man[ttm_pl].size,
-                           atomic64_read(&adev->vram_usage) >> 20,
-                           atomic64_read(&adev->vram_vis_usage) >> 20);
+                           (u64)atomic64_read(&adev->vram_usage) >> 20,
+                           (u64)atomic64_read(&adev->vram_vis_usage) >> 20);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
index 03f0c3bae516..a745eeeb5d82 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -392,7 +392,10 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         ib->ptr[ib->length_dw++] = 0x00000001; /* session cmd */
         ib->ptr[ib->length_dw++] = handle;
 
-        ib->ptr[ib->length_dw++] = 0x00000030; /* len */
+        if ((ring->adev->vce.fw_version >> 24) >= 52)
+                ib->ptr[ib->length_dw++] = 0x00000040; /* len */
+        else
+                ib->ptr[ib->length_dw++] = 0x00000030; /* len */
         ib->ptr[ib->length_dw++] = 0x01000001; /* create cmd */
         ib->ptr[ib->length_dw++] = 0x00000000;
         ib->ptr[ib->length_dw++] = 0x00000042;
@@ -404,6 +407,12 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         ib->ptr[ib->length_dw++] = 0x00000100;
         ib->ptr[ib->length_dw++] = 0x0000000c;
         ib->ptr[ib->length_dw++] = 0x00000000;
+        if ((ring->adev->vce.fw_version >> 24) >= 52) {
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+                ib->ptr[ib->length_dw++] = 0x00000000;
+        }
 
         ib->ptr[ib->length_dw++] = 0x00000014; /* len */
         ib->ptr[ib->length_dw++] = 0x05000005; /* feedback buffer */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 633a32a48560..ae037e5b6ad0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -143,10 +143,15 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
         unsigned i;
 
         /* check if the id is still valid */
-        if (vm_id->id && vm_id->last_id_use &&
-            vm_id->last_id_use == adev->vm_manager.active[vm_id->id]) {
-                trace_amdgpu_vm_grab_id(vm_id->id, ring->idx);
-                return 0;
+        if (vm_id->id) {
+                unsigned id = vm_id->id;
+                long owner;
+
+                owner = atomic_long_read(&adev->vm_manager.ids[id].owner);
+                if (owner == (long)vm) {
+                        trace_amdgpu_vm_grab_id(vm_id->id, ring->idx);
+                        return 0;
+                }
         }
 
         /* we definately need to flush */
@@ -154,7 +159,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 
         /* skip over VMID 0, since it is the system VM */
         for (i = 1; i < adev->vm_manager.nvm; ++i) {
-                struct fence *fence = adev->vm_manager.active[i];
+                struct fence *fence = adev->vm_manager.ids[i].active;
                 struct amdgpu_ring *fring;
 
                 if (fence == NULL) {
@@ -176,7 +181,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
                 if (choices[i]) {
                         struct fence *fence;
 
-                        fence  = adev->vm_manager.active[choices[i]];
+                        fence  = adev->vm_manager.ids[choices[i]].active;
                         vm_id->id = choices[i];
 
                         trace_amdgpu_vm_grab_id(choices[i], ring->idx);
@@ -207,24 +212,21 @@ void amdgpu_vm_flush(struct amdgpu_ring *ring,
         uint64_t pd_addr = amdgpu_bo_gpu_offset(vm->page_directory);
         struct amdgpu_vm_id *vm_id = &vm->ids[ring->idx];
         struct fence *flushed_updates = vm_id->flushed_updates;
-        bool is_earlier = false;
-
-        if (flushed_updates && updates) {
-                BUG_ON(flushed_updates->context != updates->context);
-                is_earlier = (updates->seqno - flushed_updates->seqno <=
-                              INT_MAX) ? true : false;
-        }
+        bool is_later;
 
-        if (pd_addr != vm_id->pd_gpu_addr || !flushed_updates ||
-            is_earlier) {
+        if (!flushed_updates)
+                is_later = true;
+        else if (!updates)
+                is_later = false;
+        else
+                is_later = fence_is_later(updates, flushed_updates);
 
+        if (pd_addr != vm_id->pd_gpu_addr || is_later) {
                 trace_amdgpu_vm_flush(pd_addr, ring->idx, vm_id->id);
-                if (is_earlier) {
+                if (is_later) {
                         vm_id->flushed_updates = fence_get(updates);
                         fence_put(flushed_updates);
                 }
-                if (!flushed_updates)
-                        vm_id->flushed_updates = fence_get(updates);
                 vm_id->pd_gpu_addr = pd_addr;
                 amdgpu_ring_emit_vm_flush(ring, vm_id->id, vm_id->pd_gpu_addr);
         }
@@ -244,16 +246,14 @@ void amdgpu_vm_flush(struct amdgpu_ring *ring,
  */
 void amdgpu_vm_fence(struct amdgpu_device *adev,
                      struct amdgpu_vm *vm,
-                     struct amdgpu_fence *fence)
+                     struct fence *fence)
 {
-        unsigned ridx = fence->ring->idx;
-        unsigned vm_id = vm->ids[ridx].id;
-
-        fence_put(adev->vm_manager.active[vm_id]);
-        adev->vm_manager.active[vm_id] = fence_get(&fence->base);
+        struct amdgpu_ring *ring = amdgpu_ring_from_fence(fence);
+        unsigned vm_id = vm->ids[ring->idx].id;
 
-        fence_put(vm->ids[ridx].last_id_use);
-        vm->ids[ridx].last_id_use = fence_get(&fence->base);
+        fence_put(adev->vm_manager.ids[vm_id].active);
+        adev->vm_manager.ids[vm_id].active = fence_get(fence);
+        atomic_long_set(&adev->vm_manager.ids[vm_id].owner, (long)vm);
 }
 
 /**
@@ -332,6 +332,8 @@ int amdgpu_vm_free_job(struct amdgpu_job *job)
  *
  * @adev: amdgpu_device pointer
  * @bo: bo to clear
+ *
+ * need to reserve bo first before calling it.
  */
 static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
                               struct amdgpu_bo *bo)
@@ -343,24 +345,20 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         uint64_t addr;
         int r;
 
-        r = amdgpu_bo_reserve(bo, false);
-        if (r)
-                return r;
-
         r = reservation_object_reserve_shared(bo->tbo.resv);
         if (r)
                 return r;
 
         r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
         if (r)
-                goto error_unreserve;
+                goto error;
 
         addr = amdgpu_bo_gpu_offset(bo);
         entries = amdgpu_bo_size(bo) / 8;
 
         ib = kzalloc(sizeof(struct amdgpu_ib), GFP_KERNEL);
         if (!ib)
-                goto error_unreserve;
+                goto error;
 
         r = amdgpu_ib_get(ring, NULL, entries * 2 + 64, ib);
         if (r)
@@ -378,16 +376,14 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
         if (!r)
                 amdgpu_bo_fence(bo, fence, true);
         fence_put(fence);
-        if (amdgpu_enable_scheduler) {
-                amdgpu_bo_unreserve(bo);
+        if (amdgpu_enable_scheduler)
                 return 0;
-        }
+
 error_free:
         amdgpu_ib_free(adev, ib);
         kfree(ib);
 
-error_unreserve:
-        amdgpu_bo_unreserve(bo);
+error:
         return r;
 }
 
@@ -926,8 +922,9 @@ int amdgpu_vm_clear_invalids(struct amdgpu_device *adev,
                 bo_va = list_first_entry(&vm->invalidated,
                         struct amdgpu_bo_va, vm_status);
                 spin_unlock(&vm->status_lock);
-
+                mutex_lock(&bo_va->mutex);
                 r = amdgpu_vm_bo_update(adev, bo_va, NULL);
+                mutex_unlock(&bo_va->mutex);
                 if (r)
                         return r;
 
@@ -971,7 +968,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
         INIT_LIST_HEAD(&bo_va->valids);
         INIT_LIST_HEAD(&bo_va->invalids);
         INIT_LIST_HEAD(&bo_va->vm_status);
-
+        mutex_init(&bo_va->mutex);
         list_add_tail(&bo_va->bo_list, &bo->va);
 
         return bo_va;
@@ -989,7 +986,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
  * Add a mapping of the BO at the specefied addr into the VM.
  * Returns 0 for success, error for failure.
  *
- * Object has to be reserved and gets unreserved by this function!
+ * Object has to be reserved and unreserved outside!
  */
 int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                      struct amdgpu_bo_va *bo_va,
@@ -1005,30 +1002,27 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
 
         /* validate the parameters */
         if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||
-            size == 0 || size & AMDGPU_GPU_PAGE_MASK) {
-                amdgpu_bo_unreserve(bo_va->bo);
+            size == 0 || size & AMDGPU_GPU_PAGE_MASK)
                 return -EINVAL;
-        }
 
         /* make sure object fit at this offset */
         eaddr = saddr + size;
-        if ((saddr >= eaddr) || (offset + size > amdgpu_bo_size(bo_va->bo))) {
-                amdgpu_bo_unreserve(bo_va->bo);
+        if ((saddr >= eaddr) || (offset + size > amdgpu_bo_size(bo_va->bo)))
                 return -EINVAL;
-        }
 
         last_pfn = eaddr / AMDGPU_GPU_PAGE_SIZE;
         if (last_pfn > adev->vm_manager.max_pfn) {
                 dev_err(adev->dev, "va above limit (0x%08X > 0x%08X)\n",
                         last_pfn, adev->vm_manager.max_pfn);
-                amdgpu_bo_unreserve(bo_va->bo);
                 return -EINVAL;
         }
 
         saddr /= AMDGPU_GPU_PAGE_SIZE;
         eaddr /= AMDGPU_GPU_PAGE_SIZE;
 
+        spin_lock(&vm->it_lock);
         it = interval_tree_iter_first(&vm->va, saddr, eaddr - 1);
+        spin_unlock(&vm->it_lock);
         if (it) {
                 struct amdgpu_bo_va_mapping *tmp;
                 tmp = container_of(it, struct amdgpu_bo_va_mapping, it);
@@ -1036,14 +1030,12 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 dev_err(adev->dev, "bo %p va 0x%010Lx-0x%010Lx conflict with "
                         "0x%010lx-0x%010lx\n", bo_va->bo, saddr, eaddr,
                         tmp->it.start, tmp->it.last + 1);
-                amdgpu_bo_unreserve(bo_va->bo);
                 r = -EINVAL;
                 goto error;
         }
 
         mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
         if (!mapping) {
-                amdgpu_bo_unreserve(bo_va->bo);
                 r = -ENOMEM;
                 goto error;
         }
@@ -1054,8 +1046,12 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
         mapping->offset = offset;
         mapping->flags = flags;
 
+        mutex_lock(&bo_va->mutex);
         list_add(&mapping->list, &bo_va->invalids);
+        mutex_unlock(&bo_va->mutex);
+        spin_lock(&vm->it_lock);
         interval_tree_insert(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_map(bo_va, mapping);
 
         /* Make sure the page tables are allocated */
@@ -1067,8 +1063,6 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
         if (eaddr > vm->max_pde_used)
                 vm->max_pde_used = eaddr;
 
-        amdgpu_bo_unreserve(bo_va->bo);
-
         /* walk over the address space and allocate the page tables */
         for (pt_idx = saddr; pt_idx <= eaddr; ++pt_idx) {
                 struct reservation_object *resv = vm->page_directory->tbo.resv;
@@ -1077,13 +1071,11 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 if (vm->page_tables[pt_idx].bo)
                         continue;
 
-                ww_mutex_lock(&resv->lock, NULL);
                 r = amdgpu_bo_create(adev, AMDGPU_VM_PTE_COUNT * 8,
                                      AMDGPU_GPU_PAGE_SIZE, true,
                                      AMDGPU_GEM_DOMAIN_VRAM,
                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS,
                                      NULL, resv, &pt);
-                ww_mutex_unlock(&resv->lock);
                 if (r)
                         goto error_free;
 
@@ -1101,7 +1093,9 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
 
 error_free:
         list_del(&mapping->list);
+        spin_lock(&vm->it_lock);
         interval_tree_remove(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_unmap(bo_va, mapping);
         kfree(mapping);
 
@@ -1119,7 +1113,7 @@ error:
  * Remove a mapping of the BO at the specefied addr from the VM.
  * Returns 0 for success, error for failure.
  *
- * Object has to be reserved and gets unreserved by this function!
+ * Object has to be reserved and unreserved outside!
  */
 int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                        struct amdgpu_bo_va *bo_va,
@@ -1130,7 +1124,7 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
         bool valid = true;
 
         saddr /= AMDGPU_GPU_PAGE_SIZE;
-
+        mutex_lock(&bo_va->mutex);
         list_for_each_entry(mapping, &bo_va->valids, list) {
                 if (mapping->it.start == saddr)
                         break;
@@ -1145,20 +1139,21 @@ int amdgpu_vm_bo_unmap(struct amdgpu_device *adev,
                 }
 
                 if (&mapping->list == &bo_va->invalids) {
-                        amdgpu_bo_unreserve(bo_va->bo);
+                        mutex_unlock(&bo_va->mutex);
                         return -ENOENT;
                 }
         }
-
+        mutex_unlock(&bo_va->mutex);
         list_del(&mapping->list);
+        spin_lock(&vm->it_lock);
         interval_tree_remove(&mapping->it, &vm->va);
+        spin_unlock(&vm->it_lock);
         trace_amdgpu_vm_bo_unmap(bo_va, mapping);
 
         if (valid)
                 list_add(&mapping->list, &vm->freed);
         else
                 kfree(mapping);
-        amdgpu_bo_unreserve(bo_va->bo);
 
         return 0;
 }
@@ -1187,17 +1182,21 @@ void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
 
         list_for_each_entry_safe(mapping, next, &bo_va->valids, list) {
                 list_del(&mapping->list);
+                spin_lock(&vm->it_lock);
                 interval_tree_remove(&mapping->it, &vm->va);
+                spin_unlock(&vm->it_lock);
                 trace_amdgpu_vm_bo_unmap(bo_va, mapping);
                 list_add(&mapping->list, &vm->freed);
         }
         list_for_each_entry_safe(mapping, next, &bo_va->invalids, list) {
                 list_del(&mapping->list);
+                spin_lock(&vm->it_lock);
                 interval_tree_remove(&mapping->it, &vm->va);
+                spin_unlock(&vm->it_lock);
                 kfree(mapping);
         }
-
         fence_put(bo_va->last_pt_update);
+        mutex_destroy(&bo_va->mutex);
         kfree(bo_va);
 }
 
@@ -1241,15 +1240,13 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                 vm->ids[i].id = 0;
                 vm->ids[i].flushed_updates = NULL;
-                vm->ids[i].last_id_use = NULL;
         }
-        mutex_init(&vm->mutex);
         vm->va = RB_ROOT;
         spin_lock_init(&vm->status_lock);
         INIT_LIST_HEAD(&vm->invalidated);
         INIT_LIST_HEAD(&vm->cleared);
         INIT_LIST_HEAD(&vm->freed);
-
+        spin_lock_init(&vm->it_lock);
         pd_size = amdgpu_vm_directory_size(adev);
         pd_entries = amdgpu_vm_num_pdes(adev);
 
@@ -1269,8 +1266,14 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
                              NULL, NULL, &vm->page_directory);
         if (r)
                 return r;
-
+        r = amdgpu_bo_reserve(vm->page_directory, false);
+        if (r) {
+                amdgpu_bo_unref(&vm->page_directory);
+                vm->page_directory = NULL;
+                return r;
+        }
         r = amdgpu_vm_clear_bo(adev, vm->page_directory);
+        amdgpu_bo_unreserve(vm->page_directory);
         if (r) {
                 amdgpu_bo_unref(&vm->page_directory);
                 vm->page_directory = NULL;
@@ -1313,11 +1316,27 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm)
 
         amdgpu_bo_unref(&vm->page_directory);
         fence_put(vm->page_directory_fence);
-
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
+                unsigned id = vm->ids[i].id;
+
+                atomic_long_cmpxchg(&adev->vm_manager.ids[id].owner,
+                                    (long)vm, 0);
                 fence_put(vm->ids[i].flushed_updates);
-                fence_put(vm->ids[i].last_id_use);
         }
 
-        mutex_destroy(&vm->mutex);
+}
+
+/**
+ * amdgpu_vm_manager_fini - cleanup VM manager
+ *
+ * @adev: amdgpu_device pointer
+ *
+ * Cleanup the VM manager and free resources.
+ */
+void amdgpu_vm_manager_fini(struct amdgpu_device *adev)
+{
+        unsigned i;
+
+        for (i = 0; i < AMDGPU_NUM_VM; ++i)
+                fence_put(adev->vm_manager.ids[i].active);
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index a1a35a5df8e7..57a2e347f04d 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -6569,12 +6569,12 @@ static int ci_dpm_set_interrupt_state(struct amdgpu_device *adev,
                 switch (state) {
                 case AMDGPU_IRQ_STATE_DISABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
+                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 case AMDGPU_IRQ_STATE_ENABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
+                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 default:
@@ -6586,12 +6586,12 @@ static int ci_dpm_set_interrupt_state(struct amdgpu_device *adev,
                 switch (state) {
                 case AMDGPU_IRQ_STATE_DISABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
+                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 case AMDGPU_IRQ_STATE_ENABLE:
                         cg_thermal_int = RREG32_SMC(ixCG_THERMAL_INT);
-                        cg_thermal_int |= CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
+                        cg_thermal_int &= ~CG_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK;
                         WREG32_SMC(ixCG_THERMAL_INT, cg_thermal_int);
                         break;
                 default:
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 6776cf756d40..e1dcab98e249 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -268,7 +268,6 @@ static const u32 fiji_mgcg_cgcg_init[] =
         mmCGTT_CP_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_CPC_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_CPF_CLK_CTRL, 0xffffffff, 0x40000100,
-        mmCGTT_DRM_CLK_CTRL0, 0xffffffff, 0x00600100,
         mmCGTT_GDS_CLK_CTRL, 0xffffffff, 0x00000100,
         mmCGTT_IA_CLK_CTRL, 0xffffffff, 0x06000100,
         mmCGTT_PA_CLK_CTRL, 0xffffffff, 0x00000100,
@@ -296,10 +295,6 @@ static const u32 fiji_mgcg_cgcg_init[] =
         mmCGTS_SM_CTRL_REG, 0xffffffff, 0x96e00200,
         mmCP_RB_WPTR_POLL_CNTL, 0xffffffff, 0x00900100,
         mmRLC_CGCG_CGLS_CTRL, 0xffffffff, 0x0020003c,
-        mmPCIE_INDEX, 0xffffffff, 0x0140001c,
-        mmPCIE_DATA, 0x000f0000, 0x00000000,
-        mmCGTT_DRM_CLK_CTRL0, 0xff000fff, 0x00000100,
-        mmHDP_XDP_CGTT_BLK_CTRL, 0xc0000fff, 0x00000104,
         mmCP_MEM_SLP_CNTL, 0x00000001, 0x00000001,
 };
 
@@ -1000,7 +995,7 @@ static void gfx_v8_0_gpu_early_init(struct amdgpu_device *adev)
                 adev->gfx.config.max_cu_per_sh = 16;
                 adev->gfx.config.max_sh_per_se = 1;
                 adev->gfx.config.max_backends_per_se = 4;
-                adev->gfx.config.max_texture_channel_caches = 8;
+                adev->gfx.config.max_texture_channel_caches = 16;
                 adev->gfx.config.max_gprs = 256;
                 adev->gfx.config.max_gs_threads = 32;
                 adev->gfx.config.max_hw_contexts = 8;
@@ -1613,6 +1608,296 @@ static void gfx_v8_0_tiling_mode_table_init(struct amdgpu_device *adev)
                         WREG32(mmGB_MACROTILE_MODE0 + reg_offset, gb_tile_moden);
                 }
         case CHIP_FIJI:
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++) {
+                        switch (reg_offset) {
+                        case 0:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 1:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 2:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 3:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 4:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 5:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 6:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 7:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_2KB) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DEPTH_MICRO_TILING));
+                                break;
+                        case 8:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16));
+                                break;
+                        case 9:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 10:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 11:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 12:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 13:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 14:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 15:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 16:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 17:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 18:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 19:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 20:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 21:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 22:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 23:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 24:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THIN_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 25:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_XTHICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 26:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_3D_TILED_XTHICK) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_THICK_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_1));
+                                break;
+                        case 27:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 28:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_2));
+                                break;
+                        case 29:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P16_32x32_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        case 30:
+                                gb_tile_moden = (ARRAY_MODE(ARRAY_PRT_TILED_THIN1) |
+                                                PIPE_CONFIG(ADDR_SURF_P4_16x16) |
+                                                MICRO_TILE_MODE_NEW(ADDR_SURF_ROTATED_MICRO_TILING) |
+                                                SAMPLE_SPLIT(ADDR_SURF_SAMPLE_SPLIT_8));
+                                break;
+                        default:
+                                gb_tile_moden = 0;
+                                break;
+                        }
+                        adev->gfx.config.tile_mode_array[reg_offset] = gb_tile_moden;
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, gb_tile_moden);
+                }
+                for (reg_offset = 0; reg_offset < num_secondary_tile_mode_states; reg_offset++) {
+                        switch (reg_offset) {
+                        case 0:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 1:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 2:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 3:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 4:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 5:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 6:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 8:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_8) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 9:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 10:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 11:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 12:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 13:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2) |
+                                                NUM_BANKS(ADDR_SURF_8_BANK));
+                                break;
+                        case 14:
+                                gb_tile_moden = (BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1) |
+                                                NUM_BANKS(ADDR_SURF_4_BANK));
+                                break;
+                        case 7:
+                                /* unused idx */
+                                continue;
+                        default:
+                                gb_tile_moden = 0;
+                                break;
+                        }
+                        adev->gfx.config.macrotile_mode_array[reg_offset] = gb_tile_moden;
+                        WREG32(mmGB_MACROTILE_MODE0 + reg_offset, gb_tile_moden);
+                }
+                break;
         case CHIP_TONGA:
                 for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++) {
                         switch (reg_offset) {
@@ -2971,10 +3256,13 @@ static int gfx_v8_0_cp_gfx_start(struct amdgpu_device *adev)
         amdgpu_ring_write(ring, mmPA_SC_RASTER_CONFIG - PACKET3_SET_CONTEXT_REG_START);
         switch (adev->asic_type) {
         case CHIP_TONGA:
-        case CHIP_FIJI:
                 amdgpu_ring_write(ring, 0x16000012);
                 amdgpu_ring_write(ring, 0x0000002A);
                 break;
+        case CHIP_FIJI:
+                amdgpu_ring_write(ring, 0x3a00161a);
+                amdgpu_ring_write(ring, 0x0000002e);
+                break;
         case CHIP_TOPAZ:
         case CHIP_CARRIZO:
                 amdgpu_ring_write(ring, 0x00000002);
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 85bbcdc73fff..7427d8cd4c43 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -40,7 +40,7 @@
 static void gmc_v7_0_set_gart_funcs(struct amdgpu_device *adev);
 static void gmc_v7_0_set_irq_funcs(struct amdgpu_device *adev);
 
-MODULE_FIRMWARE("radeon/boniare_mc.bin");
+MODULE_FIRMWARE("radeon/bonaire_mc.bin");
 MODULE_FIRMWARE("radeon/hawaii_mc.bin");
 
 /**
@@ -501,6 +501,7 @@ static int gmc_v7_0_gart_enable(struct amdgpu_device *adev)
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_L2_PDE0_CACHE_LRU_UPDATE_BY_WRITE, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, EFFECTIVE_L2_QUEUE_SIZE, 7);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, CONTEXT1_IDENTITY_ACCESS_MODE, 1);
+        tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_DEFAULT_PAGE_OUT_TO_SYSTEM_MEMORY, 1);
         WREG32(mmVM_L2_CNTL, tmp);
         tmp = REG_SET_FIELD(0, VM_L2_CNTL2, INVALIDATE_ALL_L1_TLBS, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1);
@@ -960,12 +961,10 @@ static int gmc_v7_0_sw_init(void *handle)
 
 static int gmc_v7_0_sw_fini(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v7_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
@@ -1010,12 +1009,10 @@ static int gmc_v7_0_hw_fini(void *handle)
 
 static int gmc_v7_0_suspend(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v7_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 1bcc4e74e3b4..cb0e50ebb528 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -629,6 +629,7 @@ static int gmc_v8_0_gart_enable(struct amdgpu_device *adev)
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_L2_PDE0_CACHE_LRU_UPDATE_BY_WRITE, 1);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, EFFECTIVE_L2_QUEUE_SIZE, 7);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, CONTEXT1_IDENTITY_ACCESS_MODE, 1);
+        tmp = REG_SET_FIELD(tmp, VM_L2_CNTL, ENABLE_DEFAULT_PAGE_OUT_TO_SYSTEM_MEMORY, 1);
         WREG32(mmVM_L2_CNTL, tmp);
         tmp = RREG32(mmVM_L2_CNTL2);
         tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_ALL_L1_TLBS, 1);
@@ -979,12 +980,10 @@ static int gmc_v8_0_sw_init(void *handle)
 
 static int gmc_v8_0_sw_fini(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v8_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
@@ -1031,12 +1030,10 @@ static int gmc_v8_0_hw_fini(void *handle)
 
 static int gmc_v8_0_suspend(void *handle)
 {
-        int i;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
         if (adev->vm_manager.enabled) {
-                for (i = 0; i < AMDGPU_NUM_VM; ++i)
-                        fence_put(adev->vm_manager.active[i]);
+                amdgpu_vm_manager_fini(adev);
                 gmc_v8_0_vm_fini(adev);
                 adev->vm_manager.enabled = false;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 6a52db6ad8d7..370c6c9d81c2 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -40,6 +40,9 @@
 
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR0         0x8616
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR1         0x8617
+#define mmVCE_LMI_VCPU_CACHE_40BIT_BAR2         0x8618
 
 #define VCE_V3_0_FW_SIZE        (384 * 1024)
 #define VCE_V3_0_STACK_SIZE     (64 * 1024)
@@ -130,9 +133,11 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
 
                 /* set BUSY flag */
                 WREG32_P(mmVCE_STATUS, 1, ~1);
-
-                WREG32_P(mmVCE_VCPU_CNTL, VCE_VCPU_CNTL__CLK_EN_MASK,
-                        ~VCE_VCPU_CNTL__CLK_EN_MASK);
+                if (adev->asic_type >= CHIP_STONEY)
+                        WREG32_P(mmVCE_VCPU_CNTL, 1, ~0x200001);
+                else
+                        WREG32_P(mmVCE_VCPU_CNTL, VCE_VCPU_CNTL__CLK_EN_MASK,
+                                ~VCE_VCPU_CNTL__CLK_EN_MASK);
 
                 WREG32_P(mmVCE_SOFT_RESET,
                          VCE_SOFT_RESET__ECPU_SOFT_RESET_MASK,
@@ -391,8 +396,12 @@ static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx)
         WREG32(mmVCE_LMI_SWAP_CNTL, 0);
         WREG32(mmVCE_LMI_SWAP_CNTL1, 0);
         WREG32(mmVCE_LMI_VM_CTRL, 0);
-
-        WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR, (adev->vce.gpu_addr >> 8));
+        if (adev->asic_type >= CHIP_STONEY) {
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR0, (adev->vce.gpu_addr >> 8));
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR1, (adev->vce.gpu_addr >> 8));
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR2, (adev->vce.gpu_addr >> 8));
+        } else
+                WREG32(mmVCE_LMI_VCPU_CACHE_40BIT_BAR, (adev->vce.gpu_addr >> 8));
         offset = AMDGPU_VCE_FIRMWARE_OFFSET;
         size = VCE_V3_0_FW_SIZE;
         WREG32(mmVCE_VCPU_CACHE_OFFSET0, offset & 0x7fffffff);
@@ -576,6 +585,11 @@ static int vce_v3_0_process_interrupt(struct amdgpu_device *adev,
                                       struct amdgpu_iv_entry *entry)
 {
         DRM_DEBUG("IH: VCE\n");
+
+        WREG32_P(mmVCE_SYS_INT_STATUS,
+                VCE_SYS_INT_STATUS__VCE_SYS_INT_TRAP_INTERRUPT_INT_MASK,
+                ~VCE_SYS_INT_STATUS__VCE_SYS_INT_TRAP_INTERRUPT_INT_MASK);
+
         switch (entry->src_data) {
         case 0:
                 amdgpu_fence_process(&adev->vce.ring[0]);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
index 144f50acc971..c89dc777768f 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
@@ -16,6 +16,8 @@ TRACE_EVENT(amd_sched_job,
             TP_ARGS(sched_job),
             TP_STRUCT__entry(
                              __field(struct amd_sched_entity *, entity)
+                             __field(struct amd_sched_job *, sched_job)
+                             __field(struct fence *, fence)
                              __field(const char *, name)
                              __field(u32, job_count)
                              __field(int, hw_job_count)
@@ -23,16 +25,32 @@ TRACE_EVENT(amd_sched_job,
 
             TP_fast_assign(
                            __entry->entity = sched_job->s_entity;
+                           __entry->sched_job = sched_job;
+                           __entry->fence = &sched_job->s_fence->base;
                            __entry->name = sched_job->sched->name;
                            __entry->job_count = kfifo_len(
                                    &sched_job->s_entity->job_queue) / sizeof(sched_job);
                            __entry->hw_job_count = atomic_read(
                                    &sched_job->sched->hw_rq_count);
                            ),
-            TP_printk("entity=%p, ring=%s, job count:%u, hw job count:%d",
-                      __entry->entity, __entry->name, __entry->job_count,
-                      __entry->hw_job_count)
+            TP_printk("entity=%p, sched job=%p, fence=%p, ring=%s, job count:%u, hw job count:%d",
+                      __entry->entity, __entry->sched_job, __entry->fence, __entry->name,
+                      __entry->job_count, __entry->hw_job_count)
 );
+
+TRACE_EVENT(amd_sched_process_job,
+            TP_PROTO(struct amd_sched_fence *fence),
+            TP_ARGS(fence),
+            TP_STRUCT__entry(
+                    __field(struct fence *, fence)
+                    ),
+
+            TP_fast_assign(
+                    __entry->fence = &fence->base;
+                    ),
+            TP_printk("fence=%p signaled", __entry->fence)
+);
+
 #endif
 
 /* This part must be outside protection */
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 89619a5a4289..651129f2ec1d 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -30,10 +30,12 @@
 #define CREATE_TRACE_POINTS
 #include "gpu_sched_trace.h"
 
-static struct amd_sched_job *
-amd_sched_entity_pop_job(struct amd_sched_entity *entity);
+static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
 
+struct kmem_cache *sched_fence_slab;
+atomic_t sched_fence_slab_ref = ATOMIC_INIT(0);
+
 /* Initialize a given run queue struct */
 static void amd_sched_rq_init(struct amd_sched_rq *rq)
 {
@@ -61,36 +63,36 @@ static void amd_sched_rq_remove_entity(struct amd_sched_rq *rq,
 }
 
 /**
- * Select next job from a specified run queue with round robin policy.
- * Return NULL if nothing available.
+ * Select an entity which could provide a job to run
+ *
+ * @rq          The run queue to check.
+ *
+ * Try to find a ready entity, returns NULL if none found.
  */
-static struct amd_sched_job *
-amd_sched_rq_select_job(struct amd_sched_rq *rq)
+static struct amd_sched_entity *
+amd_sched_rq_select_entity(struct amd_sched_rq *rq)
 {
         struct amd_sched_entity *entity;
-        struct amd_sched_job *sched_job;
 
         spin_lock(&rq->lock);
 
         entity = rq->current_entity;
         if (entity) {
                 list_for_each_entry_continue(entity, &rq->entities, list) {
-                        sched_job = amd_sched_entity_pop_job(entity);
-                        if (sched_job) {
+                        if (amd_sched_entity_is_ready(entity)) {
                                 rq->current_entity = entity;
                                 spin_unlock(&rq->lock);
-                                return sched_job;
+                                return entity;
                         }
                 }
         }
 
         list_for_each_entry(entity, &rq->entities, list) {
 
-                sched_job = amd_sched_entity_pop_job(entity);
-                if (sched_job) {
+                if (amd_sched_entity_is_ready(entity)) {
                         rq->current_entity = entity;
                         spin_unlock(&rq->lock);
-                        return sched_job;
+                        return entity;
                 }
 
                 if (entity == rq->current_entity)
@@ -174,6 +176,24 @@ static bool amd_sched_entity_is_idle(struct amd_sched_entity *entity)
 }
 
 /**
+ * Check if entity is ready
+ *
+ * @entity      The pointer to a valid scheduler entity
+ *
+ * Return true if entity could provide a job.
+ */
+static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity)
+{
+        if (kfifo_is_empty(&entity->job_queue))
+                return false;
+
+        if (ACCESS_ONCE(entity->dependency))
+                return false;
+
+        return true;
+}
+
+/**
  * Destroy a context entity
  *
  * @sched       Pointer to scheduler instance
@@ -208,32 +228,53 @@ static void amd_sched_entity_wakeup(struct fence *f, struct fence_cb *cb)
         amd_sched_wakeup(entity->sched);
 }
 
+static bool amd_sched_entity_add_dependency_cb(struct amd_sched_entity *entity)
+{
+        struct amd_gpu_scheduler *sched = entity->sched;
+        struct fence * fence = entity->dependency;
+        struct amd_sched_fence *s_fence;
+
+        if (fence->context == entity->fence_context) {
+                /* We can ignore fences from ourself */
+                fence_put(entity->dependency);
+                return false;
+        }
+
+        s_fence = to_amd_sched_fence(fence);
+        if (s_fence && s_fence->sched == sched) {
+                /* Fence is from the same scheduler */
+                if (test_bit(AMD_SCHED_FENCE_SCHEDULED_BIT, &fence->flags)) {
+                        /* Ignore it when it is already scheduled */
+                        fence_put(entity->dependency);
+                        return false;
+                }
+
+                /* Wait for fence to be scheduled */
+                entity->cb.func = amd_sched_entity_wakeup;
+                list_add_tail(&entity->cb.node, &s_fence->scheduled_cb);
+                return true;
+        }
+
+        if (!fence_add_callback(entity->dependency, &entity->cb,
+                                amd_sched_entity_wakeup))
+                return true;
+
+        fence_put(entity->dependency);
+        return false;
+}
+
 static struct amd_sched_job *
 amd_sched_entity_pop_job(struct amd_sched_entity *entity)
 {
         struct amd_gpu_scheduler *sched = entity->sched;
         struct amd_sched_job *sched_job;
 
-        if (ACCESS_ONCE(entity->dependency))
-                return NULL;
-
         if (!kfifo_out_peek(&entity->job_queue, &sched_job, sizeof(sched_job)))
                 return NULL;
 
-        while ((entity->dependency = sched->ops->dependency(sched_job))) {
-
-                if (entity->dependency->context == entity->fence_context) {
-                        /* We can ignore fences from ourself */
-                        fence_put(entity->dependency);
-                        continue;
-                }
-
-                if (fence_add_callback(entity->dependency, &entity->cb,
-                                       amd_sched_entity_wakeup))
-                        fence_put(entity->dependency);
-                else
+        while ((entity->dependency = sched->ops->dependency(sched_job)))
+                if (amd_sched_entity_add_dependency_cb(entity))
                         return NULL;
-        }
 
         return sched_job;
 }
@@ -273,22 +314,13 @@ static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
  *
  * Returns 0 for success, negative error code otherwise.
  */
-int amd_sched_entity_push_job(struct amd_sched_job *sched_job)
+void amd_sched_entity_push_job(struct amd_sched_job *sched_job)
 {
         struct amd_sched_entity *entity = sched_job->s_entity;
-        struct amd_sched_fence *fence = amd_sched_fence_create(
-                entity, sched_job->owner);
-
-        if (!fence)
-                return -ENOMEM;
-
-        fence_get(&fence->base);
-        sched_job->s_fence = fence;
 
         wait_event(entity->sched->job_scheduled,
                    amd_sched_entity_in(sched_job));
         trace_amd_sched_job(sched_job);
-        return 0;
 }
 
 /**
@@ -310,22 +342,22 @@ static void amd_sched_wakeup(struct amd_gpu_scheduler *sched)
 }
 
 /**
- * Select next to run
+ * Select next entity to process
 */
-static struct amd_sched_job *
-amd_sched_select_job(struct amd_gpu_scheduler *sched)
+static struct amd_sched_entity *
+amd_sched_select_entity(struct amd_gpu_scheduler *sched)
 {
-        struct amd_sched_job *sched_job;
+        struct amd_sched_entity *entity;
 
         if (!amd_sched_ready(sched))
                 return NULL;
 
         /* Kernel run queue has higher priority than normal run queue*/
-        sched_job = amd_sched_rq_select_job(&sched->kernel_rq);
-        if (sched_job == NULL)
-                sched_job = amd_sched_rq_select_job(&sched->sched_rq);
+        entity = amd_sched_rq_select_entity(&sched->kernel_rq);
+        if (entity == NULL)
+                entity = amd_sched_rq_select_entity(&sched->sched_rq);
 
-        return sched_job;
+        return entity;
 }
 
 static void amd_sched_process_job(struct fence *f, struct fence_cb *cb)
@@ -343,6 +375,7 @@ static void amd_sched_process_job(struct fence *f, struct fence_cb *cb)
                 list_del_init(&s_fence->list);
                 spin_unlock_irqrestore(&sched->fence_list_lock, flags);
         }
+        trace_amd_sched_process_job(s_fence);
         fence_put(&s_fence->base);
         wake_up_interruptible(&sched->wake_up_worker);
 }
@@ -386,13 +419,16 @@ static int amd_sched_main(void *param)
                 unsigned long flags;
 
                 wait_event_interruptible(sched->wake_up_worker,
-                        kthread_should_stop() ||
-                        (sched_job = amd_sched_select_job(sched)));
+                        (entity = amd_sched_select_entity(sched)) ||
+                        kthread_should_stop());
 
+                if (!entity)
+                        continue;
+
+                sched_job = amd_sched_entity_pop_job(entity);
                 if (!sched_job)
                         continue;
 
-                entity = sched_job->s_entity;
                 s_fence = sched_job->s_fence;
 
                 if (sched->timeout != MAX_SCHEDULE_TIMEOUT) {
@@ -405,6 +441,7 @@ static int amd_sched_main(void *param)
 
                 atomic_inc(&sched->hw_rq_count);
                 fence = sched->ops->run_job(sched_job);
+                amd_sched_fence_scheduled(s_fence);
                 if (fence) {
                         r = fence_add_callback(fence, &s_fence->cb,
                                                amd_sched_process_job);
@@ -450,6 +487,13 @@ int amd_sched_init(struct amd_gpu_scheduler *sched,
         init_waitqueue_head(&sched->wake_up_worker);
         init_waitqueue_head(&sched->job_scheduled);
         atomic_set(&sched->hw_rq_count, 0);
+        if (atomic_inc_return(&sched_fence_slab_ref) == 1) {
+                sched_fence_slab = kmem_cache_create(
+                        "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
+                        SLAB_HWCACHE_ALIGN, NULL);
+                if (!sched_fence_slab)
+                        return -ENOMEM;
+        }
 
         /* Each scheduler will run on a seperate kernel thread */
         sched->thread = kthread_run(amd_sched_main, sched, sched->name);
@@ -470,4 +514,6 @@ void amd_sched_fini(struct amd_gpu_scheduler *sched)
 {
         if (sched->thread)
                 kthread_stop(sched->thread);
+        if (atomic_dec_and_test(&sched_fence_slab_ref))
+                kmem_cache_destroy(sched_fence_slab);
 }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 929e9aced041..a0f0ae53aacd 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -27,9 +27,14 @@
 #include <linux/kfifo.h>
 #include <linux/fence.h>
 
+#define AMD_SCHED_FENCE_SCHEDULED_BIT   FENCE_FLAG_USER_BITS
+
 struct amd_gpu_scheduler;
 struct amd_sched_rq;
 
+extern struct kmem_cache *sched_fence_slab;
+extern atomic_t sched_fence_slab_ref;
+
 /**
  * A scheduler entity is a wrapper around a job queue or a group
  * of other entities. Entities take turns emitting jobs from their 
@@ -65,6 +70,7 @@ struct amd_sched_rq {
 struct amd_sched_fence {
         struct fence                    base;
         struct fence_cb                 cb;
+        struct list_head                scheduled_cb;
         struct amd_gpu_scheduler        *sched;
         spinlock_t                      lock;
         void                            *owner;
@@ -76,7 +82,6 @@ struct amd_sched_job {
         struct amd_gpu_scheduler        *sched;
         struct amd_sched_entity         *s_entity;
         struct amd_sched_fence          *s_fence;
-        void                            *owner;
 };
 
 extern const struct fence_ops amd_sched_fence_ops;
@@ -128,11 +133,11 @@ int amd_sched_entity_init(struct amd_gpu_scheduler *sched,
                           uint32_t jobs);
 void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                            struct amd_sched_entity *entity);
-int amd_sched_entity_push_job(struct amd_sched_job *sched_job);
+void amd_sched_entity_push_job(struct amd_sched_job *sched_job);
 
 struct amd_sched_fence *amd_sched_fence_create(
         struct amd_sched_entity *s_entity, void *owner);
+void amd_sched_fence_scheduled(struct amd_sched_fence *fence);
 void amd_sched_fence_signal(struct amd_sched_fence *fence);
 
-
 #endif
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index d802638094f4..87c78eecea64 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -32,9 +32,11 @@ struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *s_entity
         struct amd_sched_fence *fence = NULL;
         unsigned seq;
 
-        fence = kzalloc(sizeof(struct amd_sched_fence), GFP_KERNEL);
+        fence = kmem_cache_zalloc(sched_fence_slab, GFP_KERNEL);
         if (fence == NULL)
                 return NULL;
+
+        INIT_LIST_HEAD(&fence->scheduled_cb);
         fence->owner = owner;
         fence->sched = s_entity->sched;
         spin_lock_init(&fence->lock);
@@ -55,6 +57,17 @@ void amd_sched_fence_signal(struct amd_sched_fence *fence)
                 FENCE_TRACE(&fence->base, "was already signaled\n");
 }
 
+void amd_sched_fence_scheduled(struct amd_sched_fence *s_fence)
+{
+        struct fence_cb *cur, *tmp;
+
+        set_bit(AMD_SCHED_FENCE_SCHEDULED_BIT, &s_fence->base.flags);
+        list_for_each_entry_safe(cur, tmp, &s_fence->scheduled_cb, node) {
+                list_del_init(&cur->node);
+                cur->func(&s_fence->base, cur);
+        }
+}
+
 static const char *amd_sched_fence_get_driver_name(struct fence *fence)
 {
         return "amd_sched";
@@ -71,11 +84,17 @@ static bool amd_sched_fence_enable_signaling(struct fence *f)
         return true;
 }
 
+static void amd_sched_fence_release(struct fence *f)
+{
+        struct amd_sched_fence *fence = to_amd_sched_fence(f);
+        kmem_cache_free(sched_fence_slab, fence);
+}
+
 const struct fence_ops amd_sched_fence_ops = {
         .get_driver_name = amd_sched_fence_get_driver_name,
         .get_timeline_name = amd_sched_fence_get_timeline_name,
         .enable_signaling = amd_sched_fence_enable_signaling,
         .signaled = NULL,
         .wait = fence_default_wait,
-        .release = NULL,
+        .release = amd_sched_fence_release,
 };
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 7bb3845d9974..aeee083c7f95 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1432,6 +1432,45 @@ static int atomic_set_prop(struct drm_atomic_state *state,
         return ret;
 }
 
+/**
+ * drm_atomic_update_old_fb -- Unset old_fb pointers and set plane->fb pointers.
+ *
+ * @dev: drm device to check.
+ * @plane_mask: plane mask for planes that were updated.
+ * @ret: return value, can be -EDEADLK for a retry.
+ *
+ * Before doing an update plane->old_fb is set to plane->fb,
+ * but before dropping the locks old_fb needs to be set to NULL
+ * and plane->fb updated. This is a common operation for each
+ * atomic update, so this call is split off as a helper.
+ */
+void drm_atomic_clean_old_fb(struct drm_device *dev,
+                             unsigned plane_mask,
+                             int ret)
+{
+        struct drm_plane *plane;
+
+        /* if succeeded, fixup legacy plane crtc/fb ptrs before dropping
+         * locks (ie. while it is still safe to deref plane->state).  We
+         * need to do this here because the driver entry points cannot
+         * distinguish between legacy and atomic ioctls.
+         */
+        drm_for_each_plane_mask(plane, dev, plane_mask) {
+                if (ret == 0) {
+                        struct drm_framebuffer *new_fb = plane->state->fb;
+                        if (new_fb)
+                                drm_framebuffer_reference(new_fb);
+                        plane->fb = new_fb;
+                        plane->crtc = plane->state->crtc;
+
+                        if (plane->old_fb)
+                                drm_framebuffer_unreference(plane->old_fb);
+                }
+                plane->old_fb = NULL;
+        }
+}
+EXPORT_SYMBOL(drm_atomic_clean_old_fb);
+
 int drm_mode_atomic_ioctl(struct drm_device *dev,
                           void *data, struct drm_file *file_priv)
 {
@@ -1446,7 +1485,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         struct drm_plane *plane;
         struct drm_crtc *crtc;
         struct drm_crtc_state *crtc_state;
-        unsigned plane_mask = 0;
+        unsigned plane_mask;
         int ret = 0;
         unsigned int i, j;
 
@@ -1486,6 +1525,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         state->allow_modeset = !!(arg->flags & DRM_MODE_ATOMIC_ALLOW_MODESET);
 
 retry:
+        plane_mask = 0;
         copied_objs = 0;
         copied_props = 0;
 
@@ -1576,24 +1616,7 @@ retry:
         }
 
 out:
-        /* if succeeded, fixup legacy plane crtc/fb ptrs before dropping
-         * locks (ie. while it is still safe to deref plane->state).  We
-         * need to do this here because the driver entry points cannot
-         * distinguish between legacy and atomic ioctls.
-         */
-        drm_for_each_plane_mask(plane, dev, plane_mask) {
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
                 /*
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 0c6f62168776..e5aec45bf985 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -210,6 +210,14 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
                 return -EINVAL;
         }
 
+        if (!drm_encoder_crtc_ok(new_encoder, connector_state->crtc)) {
+                DRM_DEBUG_ATOMIC("[ENCODER:%d:%s] incompatible with [CRTC:%d]\n",
+                                 new_encoder->base.id,
+                                 new_encoder->name,
+                                 connector_state->crtc->base.id);
+                return -EINVAL;
+        }
+
         if (new_encoder == connector_state->best_encoder) {
                 DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] keeps [ENCODER:%d:%s], now on [CRTC:%d]\n",
                                  connector->base.id,
@@ -1553,6 +1561,9 @@ retry:
                 goto fail;
         }
 
+        if (plane_state->crtc && (plane == plane->crtc->cursor))
+                plane_state->state->legacy_cursor_update = true;
+
         ret = __drm_atomic_helper_disable_plane(plane, plane_state);
         if (ret != 0)
                 goto fail;
@@ -1605,9 +1616,6 @@ int __drm_atomic_helper_disable_plane(struct drm_plane *plane,
         plane_state->src_h = 0;
         plane_state->src_w = 0;
 
-        if (plane->crtc && (plane == plane->crtc->cursor))
-                plane_state->state->legacy_cursor_update = true;
-
         return 0;
 }
 
@@ -1741,6 +1749,7 @@ int __drm_atomic_helper_set_config(struct drm_mode_set *set,
         struct drm_crtc_state *crtc_state;
         struct drm_plane_state *primary_state;
         struct drm_crtc *crtc = set->crtc;
+        int hdisplay, vdisplay;
         int ret;
 
         crtc_state = drm_atomic_get_crtc_state(state, crtc);
@@ -1783,19 +1792,21 @@ int __drm_atomic_helper_set_config(struct drm_mode_set *set,
         if (ret != 0)
                 return ret;
 
+        drm_crtc_get_hv_timing(set->mode, &hdisplay, &vdisplay);
+
         drm_atomic_set_fb_for_plane(primary_state, set->fb);
         primary_state->crtc_x = 0;
         primary_state->crtc_y = 0;
-        primary_state->crtc_h = set->mode->vdisplay;
-        primary_state->crtc_w = set->mode->hdisplay;
+        primary_state->crtc_h = vdisplay;
+        primary_state->crtc_w = hdisplay;
         primary_state->src_x = set->x << 16;
         primary_state->src_y = set->y << 16;
         if (primary_state->rotation & (BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_270))) {
-                primary_state->src_h = set->mode->hdisplay << 16;
-                primary_state->src_w = set->mode->vdisplay << 16;
+                primary_state->src_h = hdisplay << 16;
+                primary_state->src_w = vdisplay << 16;
         } else {
-                primary_state->src_h = set->mode->vdisplay << 16;
-                primary_state->src_w = set->mode->hdisplay << 16;
+                primary_state->src_h = vdisplay << 16;
+                primary_state->src_w = hdisplay << 16;
         }
 
 commit:
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index e673c13c7391..69cbab5e5c81 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,6 +342,7 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
         struct drm_plane *plane;
         struct drm_atomic_state *state;
         int i, ret;
+        unsigned plane_mask;
 
         state = drm_atomic_state_alloc(dev);
         if (!state)
@@ -349,11 +350,10 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper)
 
         state->acquire_ctx = dev->mode_config.acquire_ctx;
 retry:
+        plane_mask = 0;
         drm_for_each_plane(plane, dev) {
                 struct drm_plane_state *plane_state;
 
-                plane->old_fb = plane->fb;
-
                 plane_state = drm_atomic_get_plane_state(state, plane);
                 if (IS_ERR(plane_state)) {
                         ret = PTR_ERR(plane_state);
@@ -362,6 +362,9 @@ retry:
 
                 plane_state->rotation = BIT(DRM_ROTATE_0);
 
+                plane->old_fb = plane->fb;
+                plane_mask |= 1 << drm_plane_index(plane);
+
                 /* disable non-primary: */
                 if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                         continue;
@@ -382,19 +385,7 @@ retry:
         ret = drm_atomic_commit(state);
 
 fail:
-        drm_for_each_plane(plane, dev) {
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret == -EDEADLK)
                 goto backoff;
@@ -1236,7 +1227,9 @@ static int pan_display_atomic(struct fb_var_screeninfo *var,
         struct drm_fb_helper *fb_helper = info->par;
         struct drm_device *dev = fb_helper->dev;
         struct drm_atomic_state *state;
+        struct drm_plane *plane;
         int i, ret;
+        unsigned plane_mask;
 
         state = drm_atomic_state_alloc(dev);
         if (!state)
@@ -1244,19 +1237,22 @@ static int pan_display_atomic(struct fb_var_screeninfo *var,
 
         state->acquire_ctx = dev->mode_config.acquire_ctx;
 retry:
+        plane_mask = 0;
         for(i = 0; i < fb_helper->crtc_count; i++) {
                 struct drm_mode_set *mode_set;
 
                 mode_set = &fb_helper->crtc_info[i].mode_set;
 
-                mode_set->crtc->primary->old_fb = mode_set->crtc->primary->fb;
-
                 mode_set->x = var->xoffset;
                 mode_set->y = var->yoffset;
 
                 ret = __drm_atomic_helper_set_config(mode_set, state);
                 if (ret != 0)
                         goto fail;
+
+                plane = mode_set->crtc->primary;
+                plane_mask |= drm_plane_index(plane);
+                plane->old_fb = plane->fb;
         }
 
         ret = drm_atomic_commit(state);
@@ -1268,26 +1264,7 @@ retry:
 
 
 fail:
-        for(i = 0; i < fb_helper->crtc_count; i++) {
-                struct drm_mode_set *mode_set;
-                struct drm_plane *plane;
-
-                mode_set = &fb_helper->crtc_info[i].mode_set;
-                plane = mode_set->crtc->primary;
-
-                if (ret == 0) {
-                        struct drm_framebuffer *new_fb = plane->state->fb;
-
-                        if (new_fb)
-                                drm_framebuffer_reference(new_fb);
-                        plane->fb = new_fb;
-                        plane->crtc = plane->state->crtc;
-
-                        if (plane->old_fb)
-                                drm_framebuffer_unreference(plane->old_fb);
-                }
-                plane->old_fb = NULL;
-        }
+        drm_atomic_clean_old_fb(dev, plane_mask, ret);
 
         if (ret == -EDEADLK)
                 goto backoff;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8afda459a26e..95bb27de774f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -351,6 +351,8 @@ enum intel_dpll_id {
         /* hsw/bdw */
         DPLL_ID_WRPLL1 = 0,
         DPLL_ID_WRPLL2 = 1,
+        DPLL_ID_SPLL = 2,
+
         /* skl */
         DPLL_ID_SKL_DPLL1 = 0,
         DPLL_ID_SKL_DPLL2 = 1,
@@ -367,6 +369,7 @@ struct intel_dpll_hw_state {
 
         /* hsw, bdw */
         uint32_t wrpll;
+        uint32_t spll;
 
         /* skl */
         /*
@@ -2648,6 +2651,7 @@ struct i915_params {
         int enable_cmd_parser;
         /* leave bools at the end to not create holes */
         bool enable_hangcheck;
+        bool fastboot;
         bool prefault_disable;
         bool load_detect_test;
         bool reset;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5cf4a1998273..91bb1fc27420 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3809,6 +3809,7 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data,
 int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_caching *args = data;
         struct drm_i915_gem_object *obj;
         enum i915_cache_level level;
@@ -3837,9 +3838,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
+        intel_runtime_pm_get(dev_priv);
+
         ret = i915_mutex_lock_interruptible(dev);
         if (ret)
-                return ret;
+                goto rpm_put;
 
         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
         if (&obj->base == NULL) {
@@ -3852,6 +3855,9 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
         drm_gem_object_unreference(&obj->base);
 unlock:
         mutex_unlock(&dev->struct_mutex);
+rpm_put:
+        intel_runtime_pm_put(dev_priv);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_params.c b/drivers/gpu/drm/i915/i915_params.c
index 96bb23865eac..4be13a5eb932 100644
--- a/drivers/gpu/drm/i915/i915_params.c
+++ b/drivers/gpu/drm/i915/i915_params.c
@@ -40,6 +40,7 @@ struct i915_params i915 __read_mostly = {
         .preliminary_hw_support = IS_ENABLED(CONFIG_DRM_I915_PRELIMINARY_HW_SUPPORT),
         .disable_power_well = -1,
         .enable_ips = 1,
+        .fastboot = 0,
         .prefault_disable = 0,
         .load_detect_test = 0,
         .reset = true,
@@ -133,6 +134,10 @@ MODULE_PARM_DESC(disable_power_well,
 module_param_named_unsafe(enable_ips, i915.enable_ips, int, 0600);
 MODULE_PARM_DESC(enable_ips, "Enable IPS (default: true)");
 
+module_param_named(fastboot, i915.fastboot, bool, 0600);
+MODULE_PARM_DESC(fastboot,
+        "Try to skip unnecessary mode sets at boot time (default: false)");
+
 module_param_named_unsafe(prefault_disable, i915.prefault_disable, bool, 0600);
 MODULE_PARM_DESC(prefault_disable,
         "Disable page prefaulting for pread/pwrite/reloc (default:false). "
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index b84aaa0bb48a..6a2c76e367a5 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -138,18 +138,6 @@ static void hsw_crt_get_config(struct intel_encoder *encoder,
         pipe_config->base.adjusted_mode.flags |= intel_crt_get_flags(encoder);
 }
 
-static void hsw_crt_pre_enable(struct intel_encoder *encoder)
-{
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-
-        WARN(I915_READ(SPLL_CTL) & SPLL_PLL_ENABLE, "SPLL already enabled\n");
-        I915_WRITE(SPLL_CTL,
-                   SPLL_PLL_ENABLE | SPLL_PLL_FREQ_1350MHz | SPLL_PLL_SSC);
-        POSTING_READ(SPLL_CTL);
-        udelay(20);
-}
-
 /* Note: The caller is required to filter out dpms modes not supported by the
  * platform. */
 static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
@@ -216,19 +204,6 @@ static void pch_post_disable_crt(struct intel_encoder *encoder)
         intel_disable_crt(encoder);
 }
 
-static void hsw_crt_post_disable(struct intel_encoder *encoder)
-{
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t val;
-
-        DRM_DEBUG_KMS("Disabling SPLL\n");
-        val = I915_READ(SPLL_CTL);
-        WARN_ON(!(val & SPLL_PLL_ENABLE));
-        I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
-        POSTING_READ(SPLL_CTL);
-}
-
 static void intel_enable_crt(struct intel_encoder *encoder)
 {
         struct intel_crt *crt = intel_encoder_to_crt(encoder);
@@ -280,6 +255,10 @@ static bool intel_crt_compute_config(struct intel_encoder *encoder,
         if (HAS_DDI(dev)) {
                 pipe_config->ddi_pll_sel = PORT_CLK_SEL_SPLL;
                 pipe_config->port_clock = 135000 * 2;
+
+                pipe_config->dpll_hw_state.wrpll = 0;
+                pipe_config->dpll_hw_state.spll =
+                        SPLL_PLL_ENABLE | SPLL_PLL_FREQ_1350MHz | SPLL_PLL_SSC;
         }
 
         return true;
@@ -860,8 +839,6 @@ void intel_crt_init(struct drm_device *dev)
         if (HAS_DDI(dev)) {
                 crt->base.get_config = hsw_crt_get_config;
                 crt->base.get_hw_state = intel_ddi_get_hw_state;
-                crt->base.pre_enable = hsw_crt_pre_enable;
-                crt->base.post_disable = hsw_crt_post_disable;
         } else {
                 crt->base.get_config = intel_crt_get_config;
                 crt->base.get_hw_state = intel_crt_get_hw_state;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index b25e99a432fb..a6752a61d99f 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1286,6 +1286,18 @@ hsw_ddi_pll_select(struct intel_crtc *intel_crtc,
                 }
 
                 crtc_state->ddi_pll_sel = PORT_CLK_SEL_WRPLL(pll->id);
+        } else if (crtc_state->ddi_pll_sel == PORT_CLK_SEL_SPLL) {
+                struct drm_atomic_state *state = crtc_state->base.state;
+                struct intel_shared_dpll_config *spll =
+                        &intel_atomic_get_shared_dpll_state(state)[DPLL_ID_SPLL];
+
+                if (spll->crtc_mask &&
+                    WARN_ON(spll->hw_state.spll != crtc_state->dpll_hw_state.spll))
+                        return false;
+
+                crtc_state->shared_dpll = DPLL_ID_SPLL;
+                spll->hw_state.spll = crtc_state->dpll_hw_state.spll;
+                spll->crtc_mask |= 1 << intel_crtc->pipe;
         }
 
         return true;
@@ -2437,7 +2449,7 @@ static void intel_disable_ddi(struct intel_encoder *intel_encoder)
         }
 }
 
-static void hsw_ddi_pll_enable(struct drm_i915_private *dev_priv,
+static void hsw_ddi_wrpll_enable(struct drm_i915_private *dev_priv,
                                struct intel_shared_dpll *pll)
 {
         I915_WRITE(WRPLL_CTL(pll->id), pll->config.hw_state.wrpll);
@@ -2445,9 +2457,17 @@ static void hsw_ddi_pll_enable(struct drm_i915_private *dev_priv,
         udelay(20);
 }
 
-static void hsw_ddi_pll_disable(struct drm_i915_private *dev_priv,
+static void hsw_ddi_spll_enable(struct drm_i915_private *dev_priv,
                                 struct intel_shared_dpll *pll)
 {
+        I915_WRITE(SPLL_CTL, pll->config.hw_state.spll);
+        POSTING_READ(SPLL_CTL);
+        udelay(20);
+}
+
+static void hsw_ddi_wrpll_disable(struct drm_i915_private *dev_priv,
+                                  struct intel_shared_dpll *pll)
+{
         uint32_t val;
 
         val = I915_READ(WRPLL_CTL(pll->id));
@@ -2455,9 +2475,19 @@ static void hsw_ddi_pll_disable(struct drm_i915_private *dev_priv,
         POSTING_READ(WRPLL_CTL(pll->id));
 }
 
-static bool hsw_ddi_pll_get_hw_state(struct drm_i915_private *dev_priv,
-                                     struct intel_shared_dpll *pll,
-                                     struct intel_dpll_hw_state *hw_state)
+static void hsw_ddi_spll_disable(struct drm_i915_private *dev_priv,
+                                 struct intel_shared_dpll *pll)
+{
+        uint32_t val;
+
+        val = I915_READ(SPLL_CTL);
+        I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
+        POSTING_READ(SPLL_CTL);
+}
+
+static bool hsw_ddi_wrpll_get_hw_state(struct drm_i915_private *dev_priv,
+                                       struct intel_shared_dpll *pll,
+                                       struct intel_dpll_hw_state *hw_state)
 {
         uint32_t val;
 
@@ -2470,25 +2500,50 @@ static bool hsw_ddi_pll_get_hw_state(struct drm_i915_private *dev_priv,
         return val & WRPLL_PLL_ENABLE;
 }
 
+static bool hsw_ddi_spll_get_hw_state(struct drm_i915_private *dev_priv,
+                                      struct intel_shared_dpll *pll,
+                                      struct intel_dpll_hw_state *hw_state)
+{
+        uint32_t val;
+
+        if (!intel_display_power_is_enabled(dev_priv, POWER_DOMAIN_PLLS))
+                return false;
+
+        val = I915_READ(SPLL_CTL);
+        hw_state->spll = val;
+
+        return val & SPLL_PLL_ENABLE;
+}
+
+
 static const char * const hsw_ddi_pll_names[] = {
         "WRPLL 1",
         "WRPLL 2",
+        "SPLL"
 };
 
 static void hsw_shared_dplls_init(struct drm_i915_private *dev_priv)
 {
         int i;
 
-        dev_priv->num_shared_dpll = 2;
+        dev_priv->num_shared_dpll = 3;
 
-        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+        for (i = 0; i < 2; i++) {
                 dev_priv->shared_dplls[i].id = i;
                 dev_priv->shared_dplls[i].name = hsw_ddi_pll_names[i];
-                dev_priv->shared_dplls[i].disable = hsw_ddi_pll_disable;
-                dev_priv->shared_dplls[i].enable = hsw_ddi_pll_enable;
+                dev_priv->shared_dplls[i].disable = hsw_ddi_wrpll_disable;
+                dev_priv->shared_dplls[i].enable = hsw_ddi_wrpll_enable;
                 dev_priv->shared_dplls[i].get_hw_state =
-                        hsw_ddi_pll_get_hw_state;
+                        hsw_ddi_wrpll_get_hw_state;
         }
+
+        /* SPLL is special, but needs to be initialized anyway.. */
+        dev_priv->shared_dplls[i].id = i;
+        dev_priv->shared_dplls[i].name = hsw_ddi_pll_names[i];
+        dev_priv->shared_dplls[i].disable = hsw_ddi_spll_disable;
+        dev_priv->shared_dplls[i].enable = hsw_ddi_spll_enable;
+        dev_priv->shared_dplls[i].get_hw_state = hsw_ddi_spll_get_hw_state;
+
 }
 
 static const char * const skl_ddi_pll_names[] = {
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f62ffc04c21d..71860f8680f9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2646,11 +2646,13 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
-        plane_state->src_x = plane_state->src_y = 0;
+        plane_state->src_x = 0;
+        plane_state->src_y = 0;
         plane_state->src_w = fb->width << 16;
         plane_state->src_h = fb->height << 16;
 
-        plane_state->crtc_x = plane_state->src_y = 0;
+        plane_state->crtc_x = 0;
+        plane_state->crtc_y = 0;
         plane_state->crtc_w = fb->width;
         plane_state->crtc_h = fb->height;
 
@@ -4237,6 +4239,7 @@ struct intel_shared_dpll *intel_get_shared_dpll(struct intel_crtc *crtc,
         struct intel_shared_dpll *pll;
         struct intel_shared_dpll_config *shared_dpll;
         enum intel_dpll_id i;
+        int max = dev_priv->num_shared_dpll;
 
         shared_dpll = intel_atomic_get_shared_dpll_state(crtc_state->base.state);
 
@@ -4271,9 +4274,11 @@ struct intel_shared_dpll *intel_get_shared_dpll(struct intel_crtc *crtc,
                 WARN_ON(shared_dpll[i].crtc_mask);
 
                 goto found;
-        }
+        } else if (INTEL_INFO(dev_priv)->gen < 9 && HAS_DDI(dev_priv))
+                /* Do not consider SPLL */
+                max = 2;
 
-        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+        for (i = 0; i < max; i++) {
                 pll = &dev_priv->shared_dplls[i];
 
                 /* Only want to check enabled timings first */
@@ -9723,6 +9728,8 @@ static void haswell_get_ddi_pll(struct drm_i915_private *dev_priv,
         case PORT_CLK_SEL_WRPLL2:
                 pipe_config->shared_dpll = DPLL_ID_WRPLL2;
                 break;
+        case PORT_CLK_SEL_SPLL:
+                pipe_config->shared_dpll = DPLL_ID_SPLL;
         }
 }
 
@@ -12003,9 +12010,10 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc,
                               pipe_config->dpll_hw_state.cfgcr1,
                               pipe_config->dpll_hw_state.cfgcr2);
         } else if (HAS_DDI(dev)) {
-                DRM_DEBUG_KMS("ddi_pll_sel: %u; dpll_hw_state: wrpll: 0x%x\n",
+                DRM_DEBUG_KMS("ddi_pll_sel: %u; dpll_hw_state: wrpll: 0x%x spll: 0x%x\n",
                               pipe_config->ddi_pll_sel,
-                              pipe_config->dpll_hw_state.wrpll);
+                              pipe_config->dpll_hw_state.wrpll,
+                              pipe_config->dpll_hw_state.spll);
         } else {
                 DRM_DEBUG_KMS("dpll_hw_state: dpll: 0x%x, dpll_md: 0x%x, "
                               "fp0: 0x%x, fp1: 0x%x\n",
@@ -12528,6 +12536,7 @@ intel_pipe_config_compare(struct drm_device *dev,
         PIPE_CONF_CHECK_X(dpll_hw_state.fp0);
         PIPE_CONF_CHECK_X(dpll_hw_state.fp1);
         PIPE_CONF_CHECK_X(dpll_hw_state.wrpll);
+        PIPE_CONF_CHECK_X(dpll_hw_state.spll);
         PIPE_CONF_CHECK_X(dpll_hw_state.ctrl1);
         PIPE_CONF_CHECK_X(dpll_hw_state.cfgcr1);
         PIPE_CONF_CHECK_X(dpll_hw_state.cfgcr2);
@@ -13032,6 +13041,9 @@ static int intel_atomic_check(struct drm_device *dev,
                 struct intel_crtc_state *pipe_config =
                         to_intel_crtc_state(crtc_state);
 
+                memset(&to_intel_crtc(crtc)->atomic, 0,
+                       sizeof(struct intel_crtc_atomic_commit));
+
                 /* Catch I915_MODE_FLAG_INHERITED */
                 if (crtc_state->mode.private_flags != crtc->state->mode.private_flags)
                         crtc_state->mode_changed = true;
@@ -13056,7 +13068,8 @@ static int intel_atomic_check(struct drm_device *dev,
                 if (ret)
                         return ret;
 
-                if (intel_pipe_config_compare(state->dev,
+                if (i915.fastboot &&
+                    intel_pipe_config_compare(state->dev,
                                         to_intel_crtc_state(crtc->state),
                                         pipe_config, true)) {
                         crtc_state->mode_changed = false;
@@ -14364,16 +14377,17 @@ static int intel_framebuffer_init(struct drm_device *dev,
 static struct drm_framebuffer *
 intel_user_framebuffer_create(struct drm_device *dev,
                               struct drm_file *filp,
-                              struct drm_mode_fb_cmd2 *mode_cmd)
+                              struct drm_mode_fb_cmd2 *user_mode_cmd)
 {
         struct drm_i915_gem_object *obj;
+        struct drm_mode_fb_cmd2 mode_cmd = *user_mode_cmd;
 
         obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
-                                                mode_cmd->handles[0]));
+                                                mode_cmd.handles[0]));
         if (&obj->base == NULL)
                 return ERR_PTR(-ENOENT);
 
-        return intel_framebuffer_create(dev, mode_cmd, obj);
+        return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
 
 #ifndef CONFIG_DRM_FBDEV_EMULATION
@@ -14705,6 +14719,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Apple Macbook 2,1 (Core 2 T7400) */
         { 0x27a2, 0x8086, 0x7270, quirk_backlight_present },
 
+        /* Apple Macbook 4,1 */
+        { 0x2a02, 0x106b, 0x00a1, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d52a15df6917..071a76b9ac52 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4449,7 +4449,7 @@ static void gen6_set_rps(struct drm_device *dev, u8 val)
         POSTING_READ(GEN6_RPNSWREQ);
 
         dev_priv->rps.cur_freq = val;
-        trace_intel_gpu_freq_change(val * 50);
+        trace_intel_gpu_freq_change(intel_gpu_freq(dev_priv, val));
 }
 
 static void valleyview_set_rps(struct drm_device *dev, u8 val)
@@ -7255,7 +7255,8 @@ static int chv_freq_opcode(struct drm_i915_private *dev_priv, int val)
 int intel_gpu_freq(struct drm_i915_private *dev_priv, int val)
 {
         if (IS_GEN9(dev_priv->dev))
-                return (val * GT_FREQUENCY_MULTIPLIER) / GEN9_FREQ_SCALER;
+                return DIV_ROUND_CLOSEST(val * GT_FREQUENCY_MULTIPLIER,
+                                         GEN9_FREQ_SCALER);
         else if (IS_CHERRYVIEW(dev_priv->dev))
                 return chv_gpu_freq(dev_priv, val);
         else if (IS_VALLEYVIEW(dev_priv->dev))
@@ -7267,13 +7268,14 @@ int intel_gpu_freq(struct drm_i915_private *dev_priv, int val)
 int intel_freq_opcode(struct drm_i915_private *dev_priv, int val)
 {
         if (IS_GEN9(dev_priv->dev))
-                return (val * GEN9_FREQ_SCALER) / GT_FREQUENCY_MULTIPLIER;
+                return DIV_ROUND_CLOSEST(val * GEN9_FREQ_SCALER,
+                                         GT_FREQUENCY_MULTIPLIER);
         else if (IS_CHERRYVIEW(dev_priv->dev))
                 return chv_freq_opcode(dev_priv, val);
         else if (IS_VALLEYVIEW(dev_priv->dev))
                 return byt_freq_opcode(dev_priv, val);
         else
-                return val / GT_FREQUENCY_MULTIPLIER;
+                return DIV_ROUND_CLOSEST(val, GT_FREQUENCY_MULTIPLIER);
 }
 
 struct request_boost {
diff --git a/drivers/gpu/drm/mgag200/mgag200_cursor.c b/drivers/gpu/drm/mgag200/mgag200_cursor.c
index 4f2068fe5d88..a7bf6a90eae5 100644
--- a/drivers/gpu/drm/mgag200/mgag200_cursor.c
+++ b/drivers/gpu/drm/mgag200/mgag200_cursor.c
@@ -70,6 +70,11 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
         BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev);
         BUG_ON(pixels_current == pixels_prev);
 
+        if (!handle || !file_priv) {
+                mga_hide_cursor(mdev);
+                return 0;
+        }
+
         obj = drm_gem_object_lookup(dev, file_priv, handle);
         if (!obj)
                 return -ENOENT;
@@ -88,12 +93,6 @@ int mga_crtc_cursor_set(struct drm_crtc *crtc,
                 goto out_unreserve1;
         }
 
-        if (!handle) {
-                mga_hide_cursor(mdev);
-                ret = 0;
-                goto out1;
-        }
-
         /* Move cursor buffers into VRAM if they aren't already */
         if (!pixels_1->pin_count) {
                 ret = mgag200_bo_pin(pixels_1, TTM_PL_FLAG_VRAM,
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
index 28bc202f9753..40f845e31272 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/instmem.h
@@ -7,6 +7,7 @@ struct nvkm_instmem {
         const struct nvkm_instmem_func *func;
         struct nvkm_subdev subdev;
 
+        spinlock_t lock;
         struct list_head list;
         u32 reserved;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 8b8332e46f24..d5e6938cc6bc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -367,6 +367,7 @@ static int nouveau_rom_call(acpi_handle rom_handle, uint8_t *bios,
                 return -ENODEV;
         }
         obj = (union acpi_object *)buffer.pointer;
+        len = min(len, (int)obj->buffer.length);
         memcpy(bios+offset, obj->buffer.pointer, len);
         kfree(buffer.pointer);
         return len;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
index 3050042e6c6d..a02813e994ec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -39,6 +39,7 @@
 
 #include <nvif/client.h>
 #include <nvif/device.h>
+#include <nvif/ioctl.h>
 
 #include <drmP.h>
 
@@ -65,9 +66,10 @@ struct nouveau_drm_tile {
 };
 
 enum nouveau_drm_object_route {
-        NVDRM_OBJECT_NVIF = 0,
+        NVDRM_OBJECT_NVIF = NVIF_IOCTL_V0_OWNER_NVIF,
         NVDRM_OBJECT_USIF,
         NVDRM_OBJECT_ABI16,
+        NVDRM_OBJECT_ANY = NVIF_IOCTL_V0_OWNER_ANY,
 };
 
 enum nouveau_drm_notify_route {
diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c
index 89dc4ce63490..6ae1b3494bcd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,10 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc)
         if (nvif_unpack(argv->v0, 0, 0, true)) {
                 /* block access to objects not created via this interface */
                 owner = argv->v0.owner;
-                argv->v0.owner = NVDRM_OBJECT_USIF;
+                if (argv->v0.object == 0ULL)
+                        argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
+                else
+                        argv->v0.owner = NVDRM_OBJECT_USIF;
         } else
                 goto done;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
index e3c783d0e2ab..caf22b589edc 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
@@ -279,6 +279,12 @@ nvkm_device_pci_10de_0fe3[] = {
 };
 
 static const struct nvkm_device_pci_vendor
+nvkm_device_pci_10de_0fe4[] = {
+        { 0x144d, 0xc740, NULL, { .War00C800_0 = true } },
+        {}
+};
+
+static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_104b[] = {
         { 0x1043, 0x844c, "GeForce GT 625" },
         { 0x1043, 0x846b, "GeForce GT 625" },
@@ -689,6 +695,12 @@ nvkm_device_pci_10de_1199[] = {
 };
 
 static const struct nvkm_device_pci_vendor
+nvkm_device_pci_10de_11e0[] = {
+        { 0x1558, 0x5106, NULL, { .War00C800_0 = true } },
+        {}
+};
+
+static const struct nvkm_device_pci_vendor
 nvkm_device_pci_10de_11e3[] = {
         { 0x17aa, 0x3683, "GeForce GTX 760A" },
         {}
@@ -1370,7 +1382,7 @@ nvkm_device_pci_10de[] = {
         { 0x0fe1, "GeForce GT 730M" },
         { 0x0fe2, "GeForce GT 745M" },
         { 0x0fe3, "GeForce GT 745M", nvkm_device_pci_10de_0fe3 },
-        { 0x0fe4, "GeForce GT 750M" },
+        { 0x0fe4, "GeForce GT 750M", nvkm_device_pci_10de_0fe4 },
         { 0x0fe9, "GeForce GT 750M" },
         { 0x0fea, "GeForce GT 755M" },
         { 0x0fec, "GeForce 710A" },
@@ -1485,7 +1497,7 @@ nvkm_device_pci_10de[] = {
         { 0x11c6, "GeForce GTX 650 Ti" },
         { 0x11c8, "GeForce GTX 650" },
         { 0x11cb, "GeForce GT 740" },
-        { 0x11e0, "GeForce GTX 770M" },
+        { 0x11e0, "GeForce GTX 770M", nvkm_device_pci_10de_11e0 },
         { 0x11e1, "GeForce GTX 765M" },
         { 0x11e2, "GeForce GTX 765M" },
         { 0x11e3, "GeForce GTX 760M", nvkm_device_pci_10de_11e3 },
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
index b5b875928aba..74de7a96c22a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf117.c
@@ -207,6 +207,8 @@ gf117_grctx_generate_attrib(struct gf100_grctx *info)
                         const u32 b =  beta * gr->ppc_tpc_nr[gpc][ppc];
                         const u32 t = timeslice_mode;
                         const u32 o = PPC_UNIT(gpc, ppc, 0);
+                        if (!(gr->ppc_mask[gpc] & (1 << ppc)))
+                                continue;
                         mmio_skip(info, o + 0xc0, (t << 28) | (b << 16) | ++bo);
                         mmio_wr32(info, o + 0xc0, (t << 28) | (b << 16) | --bo);
                         bo += grctx->attrib_nr_max * gr->ppc_tpc_nr[gpc][ppc];
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
index 194afe910d21..7dacb3cc0668 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpc.fuc
@@ -52,10 +52,12 @@ mmio_list_base:
 #endif
 
 #ifdef INCLUDE_CODE
+#define gpc_addr(reg,addr)                                                    /*
+*/      imm32(reg,addr)                                                       /*
+*/      or reg NV_PGRAPH_GPCX_GPCCS_MMIO_CTRL_BASE_ENABLE
 #define gpc_wr32(addr,reg)                                                    /*
+*/      gpc_addr($r14,addr)                                                   /*
 */      mov b32 $r15 reg                                                      /*
-*/      imm32($r14, addr)                                                     /*
-*/      or $r14 NV_PGRAPH_GPCX_GPCCS_MMIO_CTRL_BASE_ENABLE                    /*
 */      call(nv_wr32)
 
 // reports an exception to the host
@@ -161,7 +163,7 @@ init:
 
 #if NV_PGRAPH_GPCX_UNK__SIZE > 0
         // figure out which, and how many, UNKs are actually present
-        imm32($r14, 0x500c30)
+        gpc_addr($r14, 0x500c30)
         clear b32 $r2
         clear b32 $r3
         clear b32 $r4
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
index 64d07df4b8b1..bb820ff28621 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgf117.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gf117_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gf117_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40126,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf401,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f008,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x080007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
index 2f596433c222..911976d20940 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk104.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gk104_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gk104_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40126,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf401,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f008,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x080007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
index ee8e54db8fc9..1c6e11b05df2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk110.fuc3.h
@@ -314,7 +314,7 @@ uint32_t gk110_grgpc_code[] = {
         0x03f01200,
         0x0002d000,
         0x17f104bd,
-        0x10fe0542,
+        0x10fe0545,
         0x0007f100,
         0x0003f007,
         0xbd0000d0,
@@ -338,184 +338,184 @@ uint32_t gk110_grgpc_code[] = {
         0x02d00103,
         0xf104bd00,
         0xf00c30e7,
-        0x24bd50e3,
-        0x44bd34bd,
-/* 0x0430: init_unk_loop */
-        0xb06821f4,
-        0x0bf400f6,
-        0x01f7f00f,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x0445: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40226,
-/* 0x0451: init_unk_done */
-        0x070380e2,
-        0xf1080480,
-        0xf0010027,
-        0x22cf0223,
-        0x9534bd00,
-        0x07f10825,
-        0x03f0c000,
-        0x0005d001,
-        0x07f104bd,
-        0x03f0c100,
-        0x0005d001,
-        0x0e9804bd,
-        0x010f9800,
-        0x015021f5,
-        0xbb002fbb,
-        0x0e98003f,
-        0x020f9801,
-        0x015021f5,
-        0xfd050e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x98020e98,
-        0x21f5030f,
-        0x0e980150,
-        0x00effd07,
-        0xbb002ebb,
-        0x35b6003e,
-        0x0007f102,
-        0x0103f0d3,
-        0xbd0003d0,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb90834b6,
-        0x21f5022f,
-        0x2fbb02d3,
-        0x003fbb00,
-        0x010007f1,
-        0xd00203f0,
+        0xe5f050e3,
+        0xbd24bd01,
+/* 0x0433: init_unk_loop */
+        0xf444bd34,
+        0xf6b06821,
+        0x0f0bf400,
+        0xbb01f7f0,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x0448: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf402,
+/* 0x0454: init_unk_done */
+        0x80070380,
+        0x27f10804,
+        0x23f00100,
+        0x0022cf02,
+        0x259534bd,
+        0x0007f108,
+        0x0103f0c0,
+        0xbd0005d0,
+        0x0007f104,
+        0x0103f0c1,
+        0xbd0005d0,
+        0x000e9804,
+        0xf5010f98,
+        0xbb015021,
+        0x3fbb002f,
+        0x010e9800,
+        0xf5020f98,
+        0x98015021,
+        0xeffd050e,
+        0x002ebb00,
+        0x98003ebb,
+        0x0f98020e,
+        0x5021f503,
+        0x070e9801,
+        0xbb00effd,
+        0x3ebb002e,
+        0x0235b600,
+        0xd30007f1,
+        0xd00103f0,
         0x04bd0003,
-        0x29f024bd,
-        0x0007f11f,
-        0x0203f030,
-        0xbd0002d0,
-/* 0x0505: main */
-        0x0031f404,
-        0xf00028f4,
-        0x21f424d7,
-        0xf401f439,
-        0xf404e4b0,
-        0x81fe1e18,
-        0x0627f001,
-        0x12fd20bd,
-        0x01e4b604,
-        0xfe051efd,
-        0x21f50018,
-        0x0ef405fa,
-/* 0x0535: main_not_ctx_xfer */
-        0x10ef94d3,
-        0xf501f5f0,
-        0xf4037e21,
-/* 0x0542: ih */
-        0x80f9c60e,
-        0xf90188fe,
-        0xf990f980,
-        0xf9b0f9a0,
-        0xf9e0f9d0,
-        0xf104bdf0,
-        0xf00200a7,
-        0xaacf00a3,
-        0x04abc400,
-        0xf02c0bf4,
-        0xe7f124d7,
-        0xe3f01a00,
-        0x00eecf00,
-        0x1900f7f1,
-        0xcf00f3f0,
-        0x21f400ff,
-        0x01e7f004,
-        0x1d0007f1,
-        0xd00003f0,
-        0x04bd000e,
-/* 0x0590: ih_no_fifo */
-        0x010007f1,
-        0xd00003f0,
-        0x04bd000a,
-        0xe0fcf0fc,
-        0xb0fcd0fc,
-        0x90fca0fc,
-        0x88fe80fc,
-        0xf480fc00,
-        0x01f80032,
-/* 0x05b4: hub_barrier_done */
-        0x9801f7f0,
-        0xfebb040e,
-        0x02ffb904,
-        0x9418e7f1,
-        0xf440e3f0,
-        0x00f89d21,
-/* 0x05cc: ctx_redswitch */
-        0xf120f7f0,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb90834,
+        0xd321f502,
+        0x002fbb02,
+        0xf1003fbb,
+        0xf0010007,
+        0x03d00203,
+        0xbd04bd00,
+        0x1f29f024,
+        0x300007f1,
+        0xd00203f0,
+        0x04bd0002,
+/* 0x0508: main */
+        0xf40031f4,
+        0xd7f00028,
+        0x3921f424,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1e,
+        0xbd0627f0,
+        0x0412fd20,
+        0xfd01e4b6,
+        0x18fe051e,
+        0xfd21f500,
+        0xd30ef405,
+/* 0x0538: main_not_ctx_xfer */
+        0xf010ef94,
+        0x21f501f5,
+        0x0ef4037e,
+/* 0x0545: ih */
+        0xfe80f9c6,
+        0x80f90188,
+        0xa0f990f9,
+        0xd0f9b0f9,
+        0xf0f9e0f9,
+        0xa7f104bd,
+        0xa3f00200,
+        0x00aacf00,
+        0xf404abc4,
+        0xd7f02c0b,
+        0x00e7f124,
+        0x00e3f01a,
+        0xf100eecf,
+        0xf01900f7,
+        0xffcf00f3,
+        0x0421f400,
+        0xf101e7f0,
+        0xf01d0007,
+        0x0ed00003,
+/* 0x0593: ih_no_fifo */
+        0xf104bd00,
+        0xf0010007,
+        0x0ad00003,
+        0xfc04bd00,
+        0xfce0fcf0,
+        0xfcb0fcd0,
+        0xfc90fca0,
+        0x0088fe80,
+        0x32f480fc,
+/* 0x05b7: hub_barrier_done */
+        0xf001f800,
+        0x0e9801f7,
+        0x04febb04,
+        0xf102ffb9,
+        0xf09418e7,
+        0x21f440e3,
+/* 0x05cf: ctx_redswitch */
+        0xf000f89d,
+        0x07f120f7,
+        0x03f08500,
+        0x000fd001,
+        0xe7f004bd,
+/* 0x05e1: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0xf10200f5,
         0xf0850007,
         0x0fd00103,
-        0xf004bd00,
-/* 0x05de: ctx_redswitch_delay */
-        0xe2b608e7,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x850007f1,
-        0xd00103f0,
-        0x04bd000f,
-/* 0x05fa: ctx_xfer */
-        0x07f100f8,
-        0x03f08100,
-        0x000fd002,
-        0x11f404bd,
-        0xcc21f507,
-/* 0x060d: ctx_xfer_not_load */
-        0x6a21f505,
-        0xf124bd02,
-        0xf047fc07,
-        0x02d00203,
-        0xf004bd00,
-        0x20b6012c,
-        0xfc07f103,
-        0x0203f04a,
-        0xbd0002d0,
-        0x01acf004,
-        0xf102a5f0,
-        0xf00000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x00e7f001,
-        0x016f21f5,
-        0xf101acf0,
-        0xf04000b7,
-        0x0c9850b3,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x0800e7f1,
-        0x016f21f5,
+        0xf804bd00,
+/* 0x05fd: ctx_xfer */
+        0x0007f100,
+        0x0203f081,
+        0xbd000fd0,
+        0x0711f404,
+        0x05cf21f5,
+/* 0x0610: ctx_xfer_not_load */
+        0x026a21f5,
+        0x07f124bd,
+        0x03f047fc,
+        0x0002d002,
+        0x2cf004bd,
+        0x0320b601,
+        0x4afc07f1,
+        0xd00203f0,
+        0x04bd0002,
         0xf001acf0,
-        0xb7f104a5,
-        0xb3f03000,
+        0xb7f102a5,
+        0xb3f00000,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0xf1080f98,
-        0xf50200e7,
-        0xf5016f21,
-        0xf4025e21,
-        0x12f40601,
-/* 0x06a9: ctx_xfer_post */
-        0x7f21f507,
-/* 0x06ad: ctx_xfer_done */
-        0xb421f502,
-        0x0000f805,
-        0x00000000,
+        0x010d9800,
+        0xf500e7f0,
+        0xf0016f21,
+        0xb7f101ac,
+        0xb3f04000,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0xf1060f98,
+        0xf50800e7,
+        0xf0016f21,
+        0xa5f001ac,
+        0x00b7f104,
+        0x50b3f030,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0xe7f1080f,
+        0x21f50200,
+        0x21f5016f,
+        0x01f4025e,
+        0x0712f406,
+/* 0x06ac: ctx_xfer_post */
+        0x027f21f5,
+/* 0x06b0: ctx_xfer_done */
+        0x05b721f5,
+        0x000000f8,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
index fbcc342f896f..84af7ec6a78e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgk208.fuc5.h
@@ -276,7 +276,7 @@ uint32_t gk208_grgpc_code[] = {
         0x02020014,
         0xf6120040,
         0x04bd0002,
-        0xfe048141,
+        0xfe048441,
         0x00400010,
         0x0000f607,
         0x040204bd,
@@ -295,165 +295,165 @@ uint32_t gk208_grgpc_code[] = {
         0x01c90080,
         0xbd0002f6,
         0x0c308e04,
-        0xbd24bd50,
-/* 0x0383: init_unk_loop */
-        0x7e44bd34,
-        0xb0000065,
-        0x0bf400f6,
-        0xbb010f0e,
-        0x4ffd04f2,
-        0x0130b605,
-/* 0x0398: init_unk_next */
-        0xb60120b6,
-        0x26b004e0,
-        0xe21bf401,
-/* 0x03a4: init_unk_done */
-        0xb50703b5,
-        0x00820804,
-        0x22cf0201,
-        0x9534bd00,
-        0x00800825,
-        0x05f601c0,
-        0x8004bd00,
-        0xf601c100,
-        0x04bd0005,
-        0x98000e98,
-        0x207e010f,
-        0x2fbb0001,
-        0x003fbb00,
-        0x98010e98,
-        0x207e020f,
-        0x0e980001,
-        0x00effd05,
-        0xbb002ebb,
-        0x0e98003e,
-        0x030f9802,
-        0x0001207e,
-        0xfd070e98,
-        0x2ebb00ef,
-        0x003ebb00,
-        0x800235b6,
-        0xf601d300,
-        0x04bd0003,
-        0xb60825b6,
-        0x20b60635,
-        0x0130b601,
-        0xb60824b6,
-        0x2fb20834,
-        0x0002687e,
-        0xbb002fbb,
-        0x0080003f,
-        0x03f60201,
-        0xbd04bd00,
-        0x1f29f024,
-        0x02300080,
-        0xbd0002f6,
-/* 0x0445: main */
-        0x0031f404,
-        0x0d0028f4,
-        0x00377e24,
-        0xf401f400,
-        0xf404e4b0,
-        0x81fe1d18,
-        0xbd060201,
-        0x0412fd20,
-        0xfd01e4b6,
-        0x18fe051e,
-        0x05187e00,
-        0xd40ef400,
-/* 0x0474: main_not_ctx_xfer */
-        0xf010ef94,
-        0xf87e01f5,
-        0x0ef40002,
-/* 0x0481: ih */
-        0xfe80f9c7,
-        0x80f90188,
-        0xa0f990f9,
-        0xd0f9b0f9,
-        0xf0f9e0f9,
-        0x004a04bd,
-        0x00aacf02,
-        0xf404abc4,
-        0x240d1f0b,
-        0xcf1a004e,
-        0x004f00ee,
-        0x00ffcf19,
-        0x0000047e,
-        0x0040010e,
-        0x000ef61d,
-/* 0x04be: ih_no_fifo */
-        0x004004bd,
-        0x000af601,
-        0xf0fc04bd,
-        0xd0fce0fc,
-        0xa0fcb0fc,
-        0x80fc90fc,
-        0xfc0088fe,
-        0x0032f480,
-/* 0x04de: hub_barrier_done */
-        0x010f01f8,
-        0xbb040e98,
-        0xffb204fe,
-        0x4094188e,
-        0x00008f7e,
-/* 0x04f2: ctx_redswitch */
-        0x200f00f8,
+        0x01e5f050,
+        0x34bd24bd,
+/* 0x0386: init_unk_loop */
+        0x657e44bd,
+        0xf6b00000,
+        0x0e0bf400,
+        0xf2bb010f,
+        0x054ffd04,
+/* 0x039b: init_unk_next */
+        0xb60130b6,
+        0xe0b60120,
+        0x0126b004,
+/* 0x03a7: init_unk_done */
+        0xb5e21bf4,
+        0x04b50703,
+        0x01008208,
+        0x0022cf02,
+        0x259534bd,
+        0xc0008008,
+        0x0005f601,
+        0x008004bd,
+        0x05f601c1,
+        0x9804bd00,
+        0x0f98000e,
+        0x01207e01,
+        0x002fbb00,
+        0x98003fbb,
+        0x0f98010e,
+        0x01207e02,
+        0x050e9800,
+        0xbb00effd,
+        0x3ebb002e,
+        0x020e9800,
+        0x7e030f98,
+        0x98000120,
+        0xeffd070e,
+        0x002ebb00,
+        0xb6003ebb,
+        0x00800235,
+        0x03f601d3,
+        0xb604bd00,
+        0x35b60825,
+        0x0120b606,
+        0xb60130b6,
+        0x34b60824,
+        0x7e2fb208,
+        0xbb000268,
+        0x3fbb002f,
+        0x01008000,
+        0x0003f602,
+        0x24bd04bd,
+        0x801f29f0,
+        0xf6023000,
+        0x04bd0002,
+/* 0x0448: main */
+        0xf40031f4,
+        0x240d0028,
+        0x0000377e,
+        0xb0f401f4,
+        0x18f404e4,
+        0x0181fe1d,
+        0x20bd0602,
+        0xb60412fd,
+        0x1efd01e4,
+        0x0018fe05,
+        0x00051b7e,
+/* 0x0477: main_not_ctx_xfer */
+        0x94d40ef4,
+        0xf5f010ef,
+        0x02f87e01,
+        0xc70ef400,
+/* 0x0484: ih */
+        0x88fe80f9,
+        0xf980f901,
+        0xf9a0f990,
+        0xf9d0f9b0,
+        0xbdf0f9e0,
+        0x02004a04,
+        0xc400aacf,
+        0x0bf404ab,
+        0x4e240d1f,
+        0xeecf1a00,
+        0x19004f00,
+        0x7e00ffcf,
+        0x0e000004,
+        0x1d004001,
+        0xbd000ef6,
+/* 0x04c1: ih_no_fifo */
+        0x01004004,
+        0xbd000af6,
+        0xfcf0fc04,
+        0xfcd0fce0,
+        0xfca0fcb0,
+        0xfe80fc90,
+        0x80fc0088,
+        0xf80032f4,
+/* 0x04e1: hub_barrier_done */
+        0x98010f01,
+        0xfebb040e,
+        0x8effb204,
+        0x7e409418,
+        0xf800008f,
+/* 0x04f5: ctx_redswitch */
+        0x80200f00,
+        0xf6018500,
+        0x04bd000f,
+/* 0x0502: ctx_redswitch_delay */
+        0xe2b6080e,
+        0xfd1bf401,
+        0x0800f5f1,
+        0x0200f5f1,
         0x01850080,
         0xbd000ff6,
-/* 0x04ff: ctx_redswitch_delay */
-        0xb6080e04,
-        0x1bf401e2,
-        0x00f5f1fd,
-        0x00f5f108,
-        0x85008002,
-        0x000ff601,
-        0x00f804bd,
-/* 0x0518: ctx_xfer */
-        0x02810080,
-        0xbd000ff6,
-        0x0711f404,
-        0x0004f27e,
-/* 0x0528: ctx_xfer_not_load */
-        0x0002167e,
-        0xfc8024bd,
-        0x02f60247,
-        0xf004bd00,
-        0x20b6012c,
-        0x4afc8003,
+/* 0x051b: ctx_xfer */
+        0x8000f804,
+        0xf6028100,
+        0x04bd000f,
+        0x7e0711f4,
+/* 0x052b: ctx_xfer_not_load */
+        0x7e0004f5,
+        0xbd000216,
+        0x47fc8024,
         0x0002f602,
-        0xacf004bd,
-        0x02a5f001,
-        0x5000008b,
-        0xb6040c98,
-        0xbcbb0fc4,
-        0x000c9800,
-        0x0e010d98,
-        0x013d7e00,
-        0x01acf000,
-        0x5040008b,
-        0xb6040c98,
-        0xbcbb0fc4,
-        0x010c9800,
-        0x98020d98,
-        0x004e060f,
-        0x013d7e08,
-        0x01acf000,
-        0x8b04a5f0,
-        0x98503000,
+        0x2cf004bd,
+        0x0320b601,
+        0x024afc80,
+        0xbd0002f6,
+        0x01acf004,
+        0x8b02a5f0,
+        0x98500000,
         0xc4b6040c,
         0x00bcbb0f,
-        0x98020c98,
-        0x0f98030d,
-        0x02004e08,
+        0x98000c98,
+        0x000e010d,
         0x00013d7e,
-        0x00020a7e,
-        0xf40601f4,
-/* 0x05b2: ctx_xfer_post */
-        0x277e0712,
-/* 0x05b6: ctx_xfer_done */
-        0xde7e0002,
-        0x00f80004,
-        0x00000000,
+        0x8b01acf0,
+        0x98504000,
+        0xc4b6040c,
+        0x00bcbb0f,
+        0x98010c98,
+        0x0f98020d,
+        0x08004e06,
+        0x00013d7e,
+        0xf001acf0,
+        0x008b04a5,
+        0x0c985030,
+        0x0fc4b604,
+        0x9800bcbb,
+        0x0d98020c,
+        0x080f9803,
+        0x7e02004e,
+        0x7e00013d,
+        0xf400020a,
+        0x12f40601,
+/* 0x05b5: ctx_xfer_post */
+        0x02277e07,
+/* 0x05b9: ctx_xfer_done */
+        0x04e17e00,
+        0x0000f800,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
index 51f5c3c6e966..11bf363a6ae9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/fuc/gpcgm107.fuc5.h
@@ -289,7 +289,7 @@ uint32_t gm107_grgpc_code[] = {
         0x020014fe,
         0x12004002,
         0xbd0002f6,
-        0x05b04104,
+        0x05b34104,
         0x400010fe,
         0x00f60700,
         0x0204bd00,
@@ -308,259 +308,259 @@ uint32_t gm107_grgpc_code[] = {
         0xc900800f,
         0x0002f601,
         0x308e04bd,
-        0x24bd500c,
-        0x44bd34bd,
-/* 0x03b0: init_unk_loop */
-        0x0000657e,
-        0xf400f6b0,
-        0x010f0e0b,
-        0xfd04f2bb,
-        0x30b6054f,
-/* 0x03c5: init_unk_next */
-        0x0120b601,
-        0xb004e0b6,
-        0x1bf40226,
-/* 0x03d1: init_unk_done */
-        0x0703b5e2,
-        0x820804b5,
-        0xcf020100,
-        0x34bd0022,
-        0x80082595,
-        0xf601c000,
+        0xe5f0500c,
+        0xbd24bd01,
+/* 0x03b3: init_unk_loop */
+        0x7e44bd34,
+        0xb0000065,
+        0x0bf400f6,
+        0xbb010f0e,
+        0x4ffd04f2,
+        0x0130b605,
+/* 0x03c8: init_unk_next */
+        0xb60120b6,
+        0x26b004e0,
+        0xe21bf402,
+/* 0x03d4: init_unk_done */
+        0xb50703b5,
+        0x00820804,
+        0x22cf0201,
+        0x9534bd00,
+        0x00800825,
+        0x05f601c0,
+        0x8004bd00,
+        0xf601c100,
         0x04bd0005,
-        0x01c10080,
-        0xbd0005f6,
-        0x000e9804,
-        0x7e010f98,
-        0xbb000120,
-        0x3fbb002f,
-        0x010e9800,
-        0x7e020f98,
-        0x98000120,
-        0xeffd050e,
-        0x002ebb00,
-        0x98003ebb,
-        0x0f98020e,
-        0x01207e03,
-        0x070e9800,
-        0xbb00effd,
-        0x3ebb002e,
-        0x0235b600,
-        0x01d30080,
-        0xbd0003f6,
-        0x0825b604,
-        0xb60635b6,
-        0x30b60120,
-        0x0824b601,
-        0xb20834b6,
-        0x02687e2f,
-        0x002fbb00,
-        0x0f003fbb,
-        0x8effb23f,
-        0xf0501d60,
-        0x8f7e01e5,
-        0x0c0f0000,
-        0xa88effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0xb23f0f00,
-        0x1d608eff,
-        0x01e5f050,
-        0x00008f7e,
-        0xffb2000f,
-        0x501d9c8e,
-        0x7e01e5f0,
-        0x0f00008f,
-        0x03147e01,
-        0x8effb200,
+        0x98000e98,
+        0x207e010f,
+        0x2fbb0001,
+        0x003fbb00,
+        0x98010e98,
+        0x207e020f,
+        0x0e980001,
+        0x00effd05,
+        0xbb002ebb,
+        0x0e98003e,
+        0x030f9802,
+        0x0001207e,
+        0xfd070e98,
+        0x2ebb00ef,
+        0x003ebb00,
+        0x800235b6,
+        0xf601d300,
+        0x04bd0003,
+        0xb60825b6,
+        0x20b60635,
+        0x0130b601,
+        0xb60824b6,
+        0x2fb20834,
+        0x0002687e,
+        0xbb002fbb,
+        0x3f0f003f,
+        0x501d608e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8e0c0f00,
         0xf0501da8,
-        0x8f7e01e5,
-        0xff0f0000,
-        0x988effb2,
+        0xffb201e5,
+        0x00008f7e,
+        0x0003147e,
+        0x608e3f0f,
         0xe5f0501d,
-        0x008f7e01,
-        0xb2020f00,
-        0x1da88eff,
+        0x7effb201,
+        0x0f00008f,
+        0x1d9c8e00,
         0x01e5f050,
-        0x00008f7e,
+        0x8f7effb2,
+        0x010f0000,
         0x0003147e,
-        0x85050498,
-        0x98504000,
-        0x64b60406,
-        0x0056bb0f,
-/* 0x04e0: tpc_strand_init_tpc_loop */
-        0x05705eb8,
-        0x00657e00,
-        0xbdf6b200,
-/* 0x04ed: tpc_strand_init_idx_loop */
-        0x605eb874,
-        0x7fb20005,
-        0x00008f7e,
-        0x05885eb8,
-        0x082f9500,
-        0x00008f7e,
-        0x058c5eb8,
-        0x082f9500,
+        0x501da88e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8eff0f00,
+        0xf0501d98,
+        0xffb201e5,
         0x00008f7e,
-        0x05905eb8,
-        0x00657e00,
-        0x06f5b600,
-        0xb601f0b6,
-        0x2fbb08f4,
-        0x003fbb00,
-        0xb60170b6,
-        0x1bf40162,
-        0x0050b7bf,
-        0x0142b608,
-        0x0fa81bf4,
-        0x8effb23f,
-        0xf0501d60,
-        0x8f7e01e5,
-        0x0d0f0000,
-        0xa88effb2,
+        0xa88e020f,
         0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0x01008000,
-        0x0003f602,
-        0x24bd04bd,
-        0x801f29f0,
-        0xf6023000,
-        0x04bd0002,
-/* 0x0574: main */
-        0xf40031f4,
-        0x240d0028,
-        0x0000377e,
-        0xb0f401f4,
-        0x18f404e4,
-        0x0181fe1d,
-        0x20bd0602,
-        0xb60412fd,
-        0x1efd01e4,
-        0x0018fe05,
-        0x0006477e,
-/* 0x05a3: main_not_ctx_xfer */
-        0x94d40ef4,
-        0xf5f010ef,
-        0x02f87e01,
-        0xc70ef400,
-/* 0x05b0: ih */
-        0x88fe80f9,
-        0xf980f901,
-        0xf9a0f990,
-        0xf9d0f9b0,
-        0xbdf0f9e0,
-        0x02004a04,
-        0xc400aacf,
-        0x0bf404ab,
-        0x4e240d1f,
-        0xeecf1a00,
-        0x19004f00,
-        0x7e00ffcf,
-        0x0e000004,
-        0x1d004001,
-        0xbd000ef6,
-/* 0x05ed: ih_no_fifo */
-        0x01004004,
-        0xbd000af6,
-        0xfcf0fc04,
-        0xfcd0fce0,
-        0xfca0fcb0,
-        0xfe80fc90,
-        0x80fc0088,
-        0xf80032f4,
-/* 0x060d: hub_barrier_done */
-        0x98010f01,
-        0xfebb040e,
-        0x8effb204,
-        0x7e409418,
-        0xf800008f,
-/* 0x0621: ctx_redswitch */
-        0x80200f00,
+        0x7effb201,
+        0x7e00008f,
+        0x98000314,
+        0x00850504,
+        0x06985040,
+        0x0f64b604,
+/* 0x04e3: tpc_strand_init_tpc_loop */
+        0xb80056bb,
+        0x0005705e,
+        0x0000657e,
+        0x74bdf6b2,
+/* 0x04f0: tpc_strand_init_idx_loop */
+        0x05605eb8,
+        0x7e7fb200,
+        0xb800008f,
+        0x0005885e,
+        0x7e082f95,
+        0xb800008f,
+        0x00058c5e,
+        0x7e082f95,
+        0xb800008f,
+        0x0005905e,
+        0x0000657e,
+        0xb606f5b6,
+        0xf4b601f0,
+        0x002fbb08,
+        0xb6003fbb,
+        0x62b60170,
+        0xbf1bf401,
+        0x080050b7,
+        0xf40142b6,
+        0x3f0fa81b,
+        0x501d608e,
+        0xb201e5f0,
+        0x008f7eff,
+        0x8e0d0f00,
+        0xf0501da8,
+        0xffb201e5,
+        0x00008f7e,
+        0x0003147e,
+        0x02010080,
+        0xbd0003f6,
+        0xf024bd04,
+        0x00801f29,
+        0x02f60230,
+/* 0x0577: main */
+        0xf404bd00,
+        0x28f40031,
+        0x7e240d00,
+        0xf4000037,
+        0xe4b0f401,
+        0x1d18f404,
+        0x020181fe,
+        0xfd20bd06,
+        0xe4b60412,
+        0x051efd01,
+        0x7e0018fe,
+        0xf400064a,
+/* 0x05a6: main_not_ctx_xfer */
+        0xef94d40e,
+        0x01f5f010,
+        0x0002f87e,
+/* 0x05b3: ih */
+        0xf9c70ef4,
+        0x0188fe80,
+        0x90f980f9,
+        0xb0f9a0f9,
+        0xe0f9d0f9,
+        0x04bdf0f9,
+        0xcf02004a,
+        0xabc400aa,
+        0x1f0bf404,
+        0x004e240d,
+        0x00eecf1a,
+        0xcf19004f,
+        0x047e00ff,
+        0x010e0000,
+        0xf61d0040,
+        0x04bd000e,
+/* 0x05f0: ih_no_fifo */
+        0xf6010040,
+        0x04bd000a,
+        0xe0fcf0fc,
+        0xb0fcd0fc,
+        0x90fca0fc,
+        0x88fe80fc,
+        0xf480fc00,
+        0x01f80032,
+/* 0x0610: hub_barrier_done */
+        0x0e98010f,
+        0x04febb04,
+        0x188effb2,
+        0x8f7e4094,
+        0x00f80000,
+/* 0x0624: ctx_redswitch */
+        0x0080200f,
+        0x0ff60185,
+        0x0e04bd00,
+/* 0x0631: ctx_redswitch_delay */
+        0x01e2b608,
+        0xf1fd1bf4,
+        0xf10800f5,
+        0x800200f5,
         0xf6018500,
         0x04bd000f,
-/* 0x062e: ctx_redswitch_delay */
-        0xe2b6080e,
-        0xfd1bf401,
-        0x0800f5f1,
-        0x0200f5f1,
-        0x01850080,
-        0xbd000ff6,
-/* 0x0647: ctx_xfer */
-        0x8000f804,
-        0xf6028100,
-        0x04bd000f,
-        0xc48effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x0711f400,
-        0x0006217e,
-/* 0x0664: ctx_xfer_not_load */
-        0x0002167e,
-        0xfc8024bd,
-        0x02f60247,
-        0xf004bd00,
-        0x20b6012c,
-        0x4afc8003,
+/* 0x064a: ctx_xfer */
+        0x008000f8,
+        0x0ff60281,
+        0x8e04bd00,
+        0xf0501dc4,
+        0xffb201e5,
+        0x00008f7e,
+        0x7e0711f4,
+/* 0x0667: ctx_xfer_not_load */
+        0x7e000624,
+        0xbd000216,
+        0x47fc8024,
         0x0002f602,
-        0x0c0f04bd,
-        0xa88effb2,
-        0xe5f0501d,
-        0x008f7e01,
-        0x03147e00,
-        0xb23f0f00,
-        0x1d608eff,
-        0x01e5f050,
+        0x2cf004bd,
+        0x0320b601,
+        0x024afc80,
+        0xbd0002f6,
+        0x8e0c0f04,
+        0xf0501da8,
+        0xffb201e5,
         0x00008f7e,
-        0xffb2000f,
-        0x501d9c8e,
-        0x7e01e5f0,
+        0x0003147e,
+        0x608e3f0f,
+        0xe5f0501d,
+        0x7effb201,
         0x0f00008f,
-        0x03147e01,
-        0x01fcf000,
-        0xb203f0b6,
-        0x1da88eff,
+        0x1d9c8e00,
         0x01e5f050,
-        0x00008f7e,
-        0xf001acf0,
-        0x008b02a5,
-        0x0c985000,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98000c,
-        0x7e000e01,
-        0xf000013d,
-        0x008b01ac,
-        0x0c985040,
-        0x0fc4b604,
-        0x9800bcbb,
-        0x0d98010c,
-        0x060f9802,
-        0x7e08004e,
-        0xf000013d,
+        0x8f7effb2,
+        0x010f0000,
+        0x0003147e,
+        0xb601fcf0,
+        0xa88e03f0,
+        0xe5f0501d,
+        0x7effb201,
+        0xf000008f,
         0xa5f001ac,
-        0x30008b04,
+        0x00008b02,
         0x040c9850,
         0xbb0fc4b6,
         0x0c9800bc,
-        0x030d9802,
-        0x4e080f98,
-        0x3d7e0200,
-        0x0a7e0001,
-        0x147e0002,
-        0x01f40003,
-        0x1a12f406,
-/* 0x073c: ctx_xfer_post */
-        0x0002277e,
-        0xffb20d0f,
-        0x501da88e,
-        0x7e01e5f0,
-        0x7e00008f,
-/* 0x0753: ctx_xfer_done */
-        0x7e000314,
-        0xf800060d,
-        0x00000000,
+        0x010d9800,
+        0x3d7e000e,
+        0xacf00001,
+        0x40008b01,
+        0x040c9850,
+        0xbb0fc4b6,
+        0x0c9800bc,
+        0x020d9801,
+        0x4e060f98,
+        0x3d7e0800,
+        0xacf00001,
+        0x04a5f001,
+        0x5030008b,
+        0xb6040c98,
+        0xbcbb0fc4,
+        0x020c9800,
+        0x98030d98,
+        0x004e080f,
+        0x013d7e02,
+        0x020a7e00,
+        0x03147e00,
+        0x0601f400,
+/* 0x073f: ctx_xfer_post */
+        0x7e1a12f4,
+        0x0f000227,
+        0x1da88e0d,
+        0x01e5f050,
+        0x8f7effb2,
+        0x147e0000,
+/* 0x0756: ctx_xfer_done */
+        0x107e0003,
+        0x00f80006,
         0x00000000,
         0x00000000,
         0x00000000,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
index dda7a7d224c9..9f5dfc85147a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -143,7 +143,7 @@ gf100_gr_zbc_depth_get(struct gf100_gr *gr, int format,
 static int
 gf100_fermi_mthd_zbc_color(struct nvkm_object *object, void *data, u32 size)
 {
-        struct gf100_gr *gr = (void *)object->engine;
+        struct gf100_gr *gr = gf100_gr(nvkm_gr(object->engine));
         union {
                 struct fermi_a_zbc_color_v0 v0;
         } *args = data;
@@ -189,7 +189,7 @@ gf100_fermi_mthd_zbc_color(struct nvkm_object *object, void *data, u32 size)
 static int
 gf100_fermi_mthd_zbc_depth(struct nvkm_object *object, void *data, u32 size)
 {
-        struct gf100_gr *gr = (void *)object->engine;
+        struct gf100_gr *gr = gf100_gr(nvkm_gr(object->engine));
         union {
                 struct fermi_a_zbc_depth_v0 v0;
         } *args = data;
@@ -1530,6 +1530,8 @@ gf100_gr_oneinit(struct nvkm_gr *base)
                 gr->ppc_nr[i]  = gr->func->ppc_nr;
                 for (j = 0; j < gr->ppc_nr[i]; j++) {
                         u8 mask = nvkm_rd32(device, GPC_UNIT(i, 0x0c30 + (j * 4)));
+                        if (mask)
+                                gr->ppc_mask[i] |= (1 << j);
                         gr->ppc_tpc_nr[i][j] = hweight8(mask);
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
index 4611961b1187..02e78b8d93f6 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
@@ -97,6 +97,7 @@ struct gf100_gr {
         u8 tpc_nr[GPC_MAX];
         u8 tpc_total;
         u8 ppc_nr[GPC_MAX];
+        u8 ppc_mask[GPC_MAX];
         u8 ppc_tpc_nr[GPC_MAX][4];
 
         struct nvkm_memory *unk4188b4;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
index 895ba74057d4..1d7dd38292b3 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c
@@ -97,7 +97,9 @@ static void *
 nvkm_instobj_dtor(struct nvkm_memory *memory)
 {
         struct nvkm_instobj *iobj = nvkm_instobj(memory);
+        spin_lock(&iobj->imem->lock);
         list_del(&iobj->head);
+        spin_unlock(&iobj->imem->lock);
         nvkm_memory_del(&iobj->parent);
         return iobj;
 }
@@ -190,7 +192,9 @@ nvkm_instobj_new(struct nvkm_instmem *imem, u32 size, u32 align, bool zero,
                 nvkm_memory_ctor(&nvkm_instobj_func_slow, &iobj->memory);
                 iobj->parent = memory;
                 iobj->imem = imem;
+                spin_lock(&iobj->imem->lock);
                 list_add_tail(&iobj->head, &imem->list);
+                spin_unlock(&iobj->imem->lock);
                 memory = &iobj->memory;
         }
 
@@ -309,5 +313,6 @@ nvkm_instmem_ctor(const struct nvkm_instmem_func *func,
 {
         nvkm_subdev_ctor(&nvkm_instmem, device, index, 0, &imem->subdev);
         imem->func = func;
+        spin_lock_init(&imem->lock);
         INIT_LIST_HEAD(&imem->list);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
index b61509e26ec9..b735173a18ff 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk104.c
@@ -59,7 +59,7 @@ gk104_volt_set(struct nvkm_volt *base, u32 uv)
         duty = (uv - bios->base) * div / bios->pwm_range;
 
         nvkm_wr32(device, 0x20340, div);
-        nvkm_wr32(device, 0x20344, 0x8000000 | duty);
+        nvkm_wr32(device, 0x20344, 0x80000000 | duty);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index d3024883b844..84d45633d28c 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -221,11 +221,17 @@ int radeon_bo_create(struct radeon_device *rdev,
         if (!(rdev->flags & RADEON_IS_PCIE))
                 bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 
+        /* Write-combined CPU mappings of GTT cause GPU hangs with RV6xx
+         * See https://bugs.freedesktop.org/show_bug.cgi?id=91268
+         */
+        if (rdev->family >= CHIP_RV610 && rdev->family <= CHIP_RV635)
+                bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
+
 #ifdef CONFIG_X86_32
         /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
          * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
          */
-        bo->flags &= ~RADEON_GEM_GTT_WC;
+        bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 #elif defined(CONFIG_X86) && !defined(CONFIG_X86_PAT)
         /* Don't try to enable write-combining when it can't work, or things
          * may be slow
@@ -235,9 +241,10 @@ int radeon_bo_create(struct radeon_device *rdev,
 #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \
          thanks to write-combining
 
-        DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
-                      "better performance thanks to write-combining\n");
-        bo->flags &= ~RADEON_GEM_GTT_WC;
+        if (bo->flags & RADEON_GEM_GTT_WC)
+                DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
+                              "better performance thanks to write-combining\n");
+        bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 #endif
 
         radeon_ttm_placement_from_domain(bo, domain);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 6d80dde23400..f4f03dcc1530 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1542,8 +1542,7 @@ int radeon_pm_late_init(struct radeon_device *rdev)
                                 ret = device_create_file(rdev->dev, &dev_attr_power_method);
                                 if (ret)
                                         DRM_ERROR("failed to create device file for power method\n");
-                                if (!ret)
-                                        rdev->pm.sysfs_initialized = true;
+                                rdev->pm.sysfs_initialized = true;
                         }
 
                         mutex_lock(&rdev->pm.mutex);
diff --git a/drivers/gpu/drm/radeon/rv730_dpm.c b/drivers/gpu/drm/radeon/rv730_dpm.c
index 3f5e1cf138ba..d37ba2cb886e 100644
--- a/drivers/gpu/drm/radeon/rv730_dpm.c
+++ b/drivers/gpu/drm/radeon/rv730_dpm.c
@@ -464,7 +464,7 @@ void rv730_stop_dpm(struct radeon_device *rdev)
         result = rv770_send_msg_to_smc(rdev, PPSMC_MSG_TwoLevelsDisabled);
 
         if (result != PPSMC_Result_OK)
-                DRM_ERROR("Could not force DPM to low\n");
+                DRM_DEBUG("Could not force DPM to low\n");
 
         WREG32_P(GENERAL_PWRMGT, 0, ~GLOBAL_PWRMGT_EN);
 
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index b9c770745a7a..e830c8935db0 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -193,7 +193,7 @@ void rv770_stop_dpm(struct radeon_device *rdev)
         result = rv770_send_msg_to_smc(rdev, PPSMC_MSG_TwoLevelsDisabled);
 
         if (result != PPSMC_Result_OK)
-                DRM_ERROR("Could not force DPM to low.\n");
+                DRM_DEBUG("Could not force DPM to low.\n");
 
         WREG32_P(GENERAL_PWRMGT, 0, ~GLOBAL_PWRMGT_EN);
 
@@ -1418,7 +1418,7 @@ int rv770_resume_smc(struct radeon_device *rdev)
 int rv770_set_sw_state(struct radeon_device *rdev)
 {
         if (rv770_send_msg_to_smc(rdev, PPSMC_MSG_SwitchToSwState) != PPSMC_Result_OK)
-                return -EINVAL;
+                DRM_DEBUG("rv770_set_sw_state failed\n");
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index e72bf46042e0..a82b891ae1fe 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2927,7 +2927,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
         { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
-        { PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
+        { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
         { 0, 0, 0, 0 },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 7a9f4768591e..265064c62d49 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -168,7 +168,7 @@ static int vc4_get_clock_select(struct drm_crtc *crtc)
         struct drm_connector *connector;
 
         drm_for_each_connector(connector, crtc->dev) {
-                if (connector && connector->state->crtc == crtc) {
+                if (connector->state->crtc == crtc) {
                         struct drm_encoder *encoder = connector->encoder;
                         struct vc4_encoder *vc4_encoder =
                                 to_vc4_encoder(encoder);
@@ -401,7 +401,8 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
                 dlist_next++;
 
                 HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
-                          (u32 *)vc4_crtc->dlist - (u32 *)vc4->hvs->dlist);
+                          (u32 __iomem *)vc4_crtc->dlist -
+                          (u32 __iomem *)vc4->hvs->dlist);
 
                 /* Make the next display list start after ours. */
                 vc4_crtc->dlist_size -= (dlist_next - vc4_crtc->dlist);
@@ -591,14 +592,14 @@ static int vc4_crtc_bind(struct device *dev, struct device *master, void *data)
          * that will take too much.
          */
         primary_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_PRIMARY);
-        if (!primary_plane) {
+        if (IS_ERR(primary_plane)) {
                 dev_err(dev, "failed to construct primary plane\n");
                 ret = PTR_ERR(primary_plane);
                 goto err;
         }
 
         cursor_plane = vc4_plane_init(drm, DRM_PLANE_TYPE_CURSOR);
-        if (!cursor_plane) {
+        if (IS_ERR(cursor_plane)) {
                 dev_err(dev, "failed to construct cursor plane\n");
                 ret = PTR_ERR(cursor_plane);
                 goto err_primary;
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 6e730605edcc..d5db9e0f3b73 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -259,7 +259,6 @@ static struct platform_driver vc4_platform_driver = {
         .remove         = vc4_platform_drm_remove,
         .driver         = {
                 .name   = "vc4-drm",
-                .owner  = THIS_MODULE,
                 .of_match_table = vc4_of_match,
         },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
index ab1673f672a4..8098c5b21ba4 100644
--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -75,10 +75,10 @@ void vc4_hvs_dump_state(struct drm_device *dev)
         for (i = 0; i < 64; i += 4) {
                 DRM_INFO("0x%08x (%s): 0x%08x 0x%08x 0x%08x 0x%08x\n",
                          i * 4, i < HVS_BOOTLOADER_DLIST_END ? "B" : "D",
-                         ((uint32_t *)vc4->hvs->dlist)[i + 0],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 1],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 2],
-                         ((uint32_t *)vc4->hvs->dlist)[i + 3]);
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 0),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 1),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 2),
+                         readl((u32 __iomem *)vc4->hvs->dlist + i + 3));
         }
 }
 
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index cdd8b10c0147..887f3caad0be 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -70,7 +70,7 @@ static bool plane_enabled(struct drm_plane_state *state)
         return state->fb && state->crtc;
 }
 
-struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
+static struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
 {
         struct vc4_plane_state *vc4_state;
 
@@ -97,8 +97,8 @@ struct drm_plane_state *vc4_plane_duplicate_state(struct drm_plane *plane)
         return &vc4_state->base;
 }
 
-void vc4_plane_destroy_state(struct drm_plane *plane,
-                             struct drm_plane_state *state)
+static void vc4_plane_destroy_state(struct drm_plane *plane,
+                                    struct drm_plane_state *state)
 {
         struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
 
@@ -108,7 +108,7 @@ void vc4_plane_destroy_state(struct drm_plane *plane,
 }
 
 /* Called during init to allocate the plane's atomic state. */
-void vc4_plane_reset(struct drm_plane *plane)
+static void vc4_plane_reset(struct drm_plane *plane)
 {
         struct vc4_plane_state *vc4_state;
 
@@ -157,6 +157,16 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
         int crtc_w = state->crtc_w;
         int crtc_h = state->crtc_h;
 
+        if (state->crtc_w << 16 != state->src_w ||
+            state->crtc_h << 16 != state->src_h) {
+                /* We don't support scaling yet, which involves
+                 * allocating the LBM memory for scaling temporary
+                 * storage, and putting filter kernels in the HVS
+                 * context.
+                 */
+                return -EINVAL;
+        }
+
         if (crtc_x < 0) {
                 offset += drm_format_plane_cpp(fb->pixel_format, 0) * -crtc_x;
                 crtc_w += crtc_x;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8b29949507d1..01a4f05c1642 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2481,7 +2481,7 @@ void wacom_setup_device_quirks(struct wacom *wacom)
                 if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
                         if (features->touch_max)
                                 features->device_type |= WACOM_DEVICETYPE_TOUCH;
-                        if (features->type >= INTUOSHT || features->type <= BAMBOO_PT)
+                        if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
                                 features->device_type |= WACOM_DEVICETYPE_PAD;
 
                         features->x_max = 4096;
@@ -3213,7 +3213,8 @@ static const struct wacom_features wacom_features_0x32F =
           WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x336 =
         { "Wacom DTU1141", 23472, 13203, 1023, 0,
-          DTUS, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
+          DTUS, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4,
+          WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x57 =
         { "Wacom DTK2241", 95640, 54060, 2047, 63,
           DTK, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 6,
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 842b0043ad94..8f59f057cdf4 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -324,6 +324,7 @@ config SENSORS_APPLESMC
 config SENSORS_ARM_SCPI
         tristate "ARM SCPI Sensors"
         depends on ARM_SCPI_PROTOCOL
+        depends on THERMAL || !THERMAL_OF
         help
           This driver provides support for temperature, voltage, current
           and power sensors available on ARM Ltd's SCP based platforms. The
@@ -1471,6 +1472,7 @@ config SENSORS_INA209
 config SENSORS_INA2XX
         tristate "Texas Instruments INA219 and compatibles"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for INA219, INA220, INA226,
           INA230, and INA231 power monitor chips.
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 1f5e956941b1..0af7fd311979 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -537,7 +537,7 @@ static int applesmc_init_index(struct applesmc_registers *s)
 static int applesmc_init_smcreg_try(void)
 {
         struct applesmc_registers *s = &smcreg;
-        bool left_light_sensor, right_light_sensor;
+        bool left_light_sensor = 0, right_light_sensor = 0;
         unsigned int count;
         u8 tmp[1];
         int ret;
diff --git a/drivers/hwmon/scpi-hwmon.c b/drivers/hwmon/scpi-hwmon.c
index 2c1241bbf9af..7e20567bc369 100644
--- a/drivers/hwmon/scpi-hwmon.c
+++ b/drivers/hwmon/scpi-hwmon.c
@@ -117,7 +117,7 @@ static int scpi_hwmon_probe(struct platform_device *pdev)
         struct scpi_ops *scpi_ops;
         struct device *hwdev, *dev = &pdev->dev;
         struct scpi_sensors *scpi_sensors;
-        int ret;
+        int ret, idx;
 
         scpi_ops = get_scpi_ops();
         if (!scpi_ops)
@@ -146,8 +146,8 @@ static int scpi_hwmon_probe(struct platform_device *pdev)
 
         scpi_sensors->scpi_ops = scpi_ops;
 
-        for (i = 0; i < nr_sensors; i++) {
-                struct sensor_data *sensor = &scpi_sensors->data[i];
+        for (i = 0, idx = 0; i < nr_sensors; i++) {
+                struct sensor_data *sensor = &scpi_sensors->data[idx];
 
                 ret = scpi_ops->sensor_get_info(i, &sensor->info);
                 if (ret)
@@ -183,7 +183,7 @@ static int scpi_hwmon_probe(struct platform_device *pdev)
                         num_power++;
                         break;
                 default:
-                        break;
+                        continue;
                 }
 
                 sensor->dev_attr_input.attr.mode = S_IRUGO;
@@ -194,11 +194,12 @@ static int scpi_hwmon_probe(struct platform_device *pdev)
                 sensor->dev_attr_label.show = scpi_show_label;
                 sensor->dev_attr_label.attr.name = sensor->label;
 
-                scpi_sensors->attrs[i << 1] = &sensor->dev_attr_input.attr;
-                scpi_sensors->attrs[(i << 1) + 1] = &sensor->dev_attr_label.attr;
+                scpi_sensors->attrs[idx << 1] = &sensor->dev_attr_input.attr;
+                scpi_sensors->attrs[(idx << 1) + 1] = &sensor->dev_attr_label.attr;
 
-                sysfs_attr_init(scpi_sensors->attrs[i << 1]);
-                sysfs_attr_init(scpi_sensors->attrs[(i << 1) + 1]);
+                sysfs_attr_init(scpi_sensors->attrs[idx << 1]);
+                sysfs_attr_init(scpi_sensors->attrs[(idx << 1) + 1]);
+                idx++;
         }
 
         scpi_sensors->group.attrs = scpi_sensors->attrs;
@@ -236,8 +237,8 @@ static int scpi_hwmon_probe(struct platform_device *pdev)
 
                 zone->sensor_id = i;
                 zone->scpi_sensors = scpi_sensors;
-                zone->tzd = thermal_zone_of_sensor_register(dev, i, zone,
-                                                            &scpi_sensor_ops);
+                zone->tzd = thermal_zone_of_sensor_register(dev,
+                                sensor->info.sensor_id, zone, &scpi_sensor_ops);
                 /*
                  * The call to thermal_zone_of_sensor_register returns
                  * an error for sensors that are not associated with
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index e24c2b680b47..7b0aa82ea38b 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -126,6 +126,7 @@ config I2C_I801
             Sunrise Point-LP (PCH)
             DNV (SOC)
             Broxton (SOC)
+            Lewisburg (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index c306751ceadb..f62d69799a9c 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -62,6 +62,8 @@
  * Sunrise Point-LP (PCH)       0x9d23  32      hard    yes     yes     yes
  * DNV (SOC)                    0x19df  32      hard    yes     yes     yes
  * Broxton (SOC)                0x5ad4  32      hard    yes     yes     yes
+ * Lewisburg (PCH)              0xa1a3  32      hard    yes     yes     yes
+ * Lewisburg Supersku (PCH)     0xa223  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -206,6 +208,8 @@
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS       0x9d23
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS               0x5ad4
+#define PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS             0xa1a3
+#define PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS        0xa223
 
 struct i801_mux_config {
         char *gpio_chip;
@@ -869,6 +873,8 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS) },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 1e4d99da4164..9bb0b056b25f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -50,6 +50,7 @@
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
 #include <linux/of_gpio.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_data/i2c-imx.h>
 #include <linux/platform_device.h>
 #include <linux/sched.h>
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index e23a7b068c60..0b20449e48cf 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -662,8 +662,10 @@ static void __xiic_start_xfer(struct xiic_i2c *i2c)
 
 static void xiic_start_xfer(struct xiic_i2c *i2c)
 {
-
+        spin_lock(&i2c->lock);
+        xiic_reinit(i2c);
         __xiic_start_xfer(i2c);
+        spin_unlock(&i2c->lock);
 }
 
 static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 040af5cc8143..ba8eb087f224 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -715,7 +715,7 @@ static int i2c_device_probe(struct device *dev)
                 if (wakeirq > 0 && wakeirq != client->irq)
                         status = dev_pm_set_dedicated_wake_irq(dev, wakeirq);
                 else if (client->irq > 0)
-                        status = dev_pm_set_wake_irq(dev, wakeirq);
+                        status = dev_pm_set_wake_irq(dev, client->irq);
                 else
                         status = 0;
 
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index eea0c79111e7..4d960d3b93c0 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -101,7 +101,7 @@
 #define AD7795_CH_AIN1M_AIN1M   8 /* AIN1(-) - AIN1(-) */
 
 /* ID Register Bit Designations (AD7793_REG_ID) */
-#define AD7785_ID               0xB
+#define AD7785_ID               0x3
 #define AD7792_ID               0xA
 #define AD7793_ID               0xB
 #define AD7794_ID               0xF
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 599cde3d03a1..b10f629cc44b 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -106,6 +106,13 @@
 
 #define DEFAULT_SAMPLE_TIME             1000
 
+/* V at 25°C of 696 mV */
+#define VF610_VTEMP25_3V0               950
+/* V at 25°C of 699 mV */
+#define VF610_VTEMP25_3V3               867
+/* Typical sensor slope coefficient at all temperatures */
+#define VF610_TEMP_SLOPE_COEFF          1840
+
 enum clk_sel {
         VF610_ADCIOC_BUSCLK_SET,
         VF610_ADCIOC_ALTCLK_SET,
@@ -197,6 +204,8 @@ static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
                 adc_feature->clk_div = 8;
         }
 
+        adck_rate = ipg_rate / adc_feature->clk_div;
+
         /*
          * Determine the long sample time adder value to be used based
          * on the default minimum sample time provided.
@@ -221,7 +230,6 @@ static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
          * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
          * LSTAdder(Long Sample Time): 3, 5, 7, 9, 13, 17, 21, 25 ADCK cycles
          */
-        adck_rate = ipg_rate / info->adc_feature.clk_div;
         for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
                 info->sample_freq_avail[i] =
                         adck_rate / (6 + vf610_hw_avgs[i] *
@@ -663,11 +671,13 @@ static int vf610_read_raw(struct iio_dev *indio_dev,
                         break;
                 case IIO_TEMP:
                         /*
-                        * Calculate in degree Celsius times 1000
-                        * Using sensor slope of 1.84 mV/°C and
-                        * V at 25°C of 696 mV
-                        */
-                        *val = 25000 - ((int)info->value - 864) * 1000000 / 1840;
+                         * Calculate in degree Celsius times 1000
+                         * Using the typical sensor slope of 1.84 mV/°C
+                         * and VREFH_ADC at 3.3V, V at 25°C of 699 mV
+                         */
+                        *val = 25000 - ((int)info->value - VF610_VTEMP25_3V3) *
+                                        1000000 / VF610_TEMP_SLOPE_COEFF;
+
                         break;
                 default:
                         mutex_unlock(&indio_dev->mlock);
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 0370624a35db..02e636a1c49a 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -841,6 +841,7 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
                         case XADC_REG_VCCINT:
                         case XADC_REG_VCCAUX:
                         case XADC_REG_VREFP:
+                        case XADC_REG_VREFN:
                         case XADC_REG_VCCBRAM:
                         case XADC_REG_VCCPINT:
                         case XADC_REG_VCCPAUX:
diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
index 9e4d2c18b554..81ca0081a019 100644
--- a/drivers/iio/dac/ad5064.c
+++ b/drivers/iio/dac/ad5064.c
@@ -113,12 +113,16 @@ enum ad5064_type {
         ID_AD5065,
         ID_AD5628_1,
         ID_AD5628_2,
+        ID_AD5629_1,
+        ID_AD5629_2,
         ID_AD5648_1,
         ID_AD5648_2,
         ID_AD5666_1,
         ID_AD5666_2,
         ID_AD5668_1,
         ID_AD5668_2,
+        ID_AD5669_1,
+        ID_AD5669_2,
 };
 
 static int ad5064_write(struct ad5064_state *st, unsigned int cmd,
@@ -291,7 +295,7 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = {
         { },
 };
 
-#define AD5064_CHANNEL(chan, addr, bits) {                      \
+#define AD5064_CHANNEL(chan, addr, bits, _shift) {              \
         .type = IIO_VOLTAGE,                                    \
         .indexed = 1,                                           \
         .output = 1,                                            \
@@ -303,36 +307,39 @@ static const struct iio_chan_spec_ext_info ad5064_ext_info[] = {
                 .sign = 'u',                                    \
                 .realbits = (bits),                             \
                 .storagebits = 16,                              \
-                .shift = 20 - bits,                             \
+                .shift = (_shift),                              \
         },                                                      \
         .ext_info = ad5064_ext_info,                            \
 }
 
-#define DECLARE_AD5064_CHANNELS(name, bits) \
+#define DECLARE_AD5064_CHANNELS(name, bits, shift) \
 const struct iio_chan_spec name[] = { \
-        AD5064_CHANNEL(0, 0, bits), \
-        AD5064_CHANNEL(1, 1, bits), \
-        AD5064_CHANNEL(2, 2, bits), \
-        AD5064_CHANNEL(3, 3, bits), \
-        AD5064_CHANNEL(4, 4, bits), \
-        AD5064_CHANNEL(5, 5, bits), \
-        AD5064_CHANNEL(6, 6, bits), \
-        AD5064_CHANNEL(7, 7, bits), \
+        AD5064_CHANNEL(0, 0, bits, shift), \
+        AD5064_CHANNEL(1, 1, bits, shift), \
+        AD5064_CHANNEL(2, 2, bits, shift), \
+        AD5064_CHANNEL(3, 3, bits, shift), \
+        AD5064_CHANNEL(4, 4, bits, shift), \
+        AD5064_CHANNEL(5, 5, bits, shift), \
+        AD5064_CHANNEL(6, 6, bits, shift), \
+        AD5064_CHANNEL(7, 7, bits, shift), \
 }
 
-#define DECLARE_AD5065_CHANNELS(name, bits) \
+#define DECLARE_AD5065_CHANNELS(name, bits, shift) \
 const struct iio_chan_spec name[] = { \
-        AD5064_CHANNEL(0, 0, bits), \
-        AD5064_CHANNEL(1, 3, bits), \
+        AD5064_CHANNEL(0, 0, bits, shift), \
+        AD5064_CHANNEL(1, 3, bits, shift), \
 }
 
-static DECLARE_AD5064_CHANNELS(ad5024_channels, 12);
-static DECLARE_AD5064_CHANNELS(ad5044_channels, 14);
-static DECLARE_AD5064_CHANNELS(ad5064_channels, 16);
+static DECLARE_AD5064_CHANNELS(ad5024_channels, 12, 8);
+static DECLARE_AD5064_CHANNELS(ad5044_channels, 14, 6);
+static DECLARE_AD5064_CHANNELS(ad5064_channels, 16, 4);
 
-static DECLARE_AD5065_CHANNELS(ad5025_channels, 12);
-static DECLARE_AD5065_CHANNELS(ad5045_channels, 14);
-static DECLARE_AD5065_CHANNELS(ad5065_channels, 16);
+static DECLARE_AD5065_CHANNELS(ad5025_channels, 12, 8);
+static DECLARE_AD5065_CHANNELS(ad5045_channels, 14, 6);
+static DECLARE_AD5065_CHANNELS(ad5065_channels, 16, 4);
+
+static DECLARE_AD5064_CHANNELS(ad5629_channels, 12, 4);
+static DECLARE_AD5064_CHANNELS(ad5669_channels, 16, 0);
 
 static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
         [ID_AD5024] = {
@@ -382,6 +389,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
                 .channels = ad5024_channels,
                 .num_channels = 8,
         },
+        [ID_AD5629_1] = {
+                .shared_vref = true,
+                .internal_vref = 2500000,
+                .channels = ad5629_channels,
+                .num_channels = 8,
+        },
+        [ID_AD5629_2] = {
+                .shared_vref = true,
+                .internal_vref = 5000000,
+                .channels = ad5629_channels,
+                .num_channels = 8,
+        },
         [ID_AD5648_1] = {
                 .shared_vref = true,
                 .internal_vref = 2500000,
@@ -418,6 +437,18 @@ static const struct ad5064_chip_info ad5064_chip_info_tbl[] = {
                 .channels = ad5064_channels,
                 .num_channels = 8,
         },
+        [ID_AD5669_1] = {
+                .shared_vref = true,
+                .internal_vref = 2500000,
+                .channels = ad5669_channels,
+                .num_channels = 8,
+        },
+        [ID_AD5669_2] = {
+                .shared_vref = true,
+                .internal_vref = 5000000,
+                .channels = ad5669_channels,
+                .num_channels = 8,
+        },
 };
 
 static inline unsigned int ad5064_num_vref(struct ad5064_state *st)
@@ -597,10 +628,16 @@ static int ad5064_i2c_write(struct ad5064_state *st, unsigned int cmd,
         unsigned int addr, unsigned int val)
 {
         struct i2c_client *i2c = to_i2c_client(st->dev);
+        int ret;
 
         st->data.i2c[0] = (cmd << 4) | addr;
         put_unaligned_be16(val, &st->data.i2c[1]);
-        return i2c_master_send(i2c, st->data.i2c, 3);
+
+        ret = i2c_master_send(i2c, st->data.i2c, 3);
+        if (ret < 0)
+                return ret;
+
+        return 0;
 }
 
 static int ad5064_i2c_probe(struct i2c_client *i2c,
@@ -616,12 +653,12 @@ static int ad5064_i2c_remove(struct i2c_client *i2c)
 }
 
 static const struct i2c_device_id ad5064_i2c_ids[] = {
-        {"ad5629-1", ID_AD5628_1},
-        {"ad5629-2", ID_AD5628_2},
-        {"ad5629-3", ID_AD5628_2}, /* similar enough to ad5629-2 */
-        {"ad5669-1", ID_AD5668_1},
-        {"ad5669-2", ID_AD5668_2},
-        {"ad5669-3", ID_AD5668_2}, /* similar enough to ad5669-2 */
+        {"ad5629-1", ID_AD5629_1},
+        {"ad5629-2", ID_AD5629_2},
+        {"ad5629-3", ID_AD5629_2}, /* similar enough to ad5629-2 */
+        {"ad5669-1", ID_AD5669_1},
+        {"ad5669-2", ID_AD5669_2},
+        {"ad5669-3", ID_AD5669_2}, /* similar enough to ad5669-2 */
         {}
 };
 MODULE_DEVICE_TABLE(i2c, ad5064_i2c_ids);
diff --git a/drivers/iio/humidity/si7020.c b/drivers/iio/humidity/si7020.c
index 12128d1ca570..71991b5c0658 100644
--- a/drivers/iio/humidity/si7020.c
+++ b/drivers/iio/humidity/si7020.c
@@ -50,10 +50,10 @@ static int si7020_read_raw(struct iio_dev *indio_dev,
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                ret = i2c_smbus_read_word_data(*client,
-                                               chan->type == IIO_TEMP ?
-                                               SI7020CMD_TEMP_HOLD :
-                                               SI7020CMD_RH_HOLD);
+                ret = i2c_smbus_read_word_swapped(*client,
+                                                  chan->type == IIO_TEMP ?
+                                                  SI7020CMD_TEMP_HOLD :
+                                                  SI7020CMD_RH_HOLD);
                 if (ret < 0)
                         return ret;
                 *val = ret >> 2;
diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c
index cbe198cb3699..471ee36b9c6e 100644
--- a/drivers/iommu/s390-iommu.c
+++ b/drivers/iommu/s390-iommu.c
@@ -216,6 +216,7 @@ static int s390_iommu_update_trans(struct s390_domain *s390_domain,
         u8 *page_addr = (u8 *) (pa & PAGE_MASK);
         dma_addr_t start_dma_addr = dma_addr;
         unsigned long irq_flags, nr_pages, i;
+        unsigned long *entry;
         int rc = 0;
 
         if (dma_addr < s390_domain->domain.geometry.aperture_start ||
@@ -228,8 +229,12 @@ static int s390_iommu_update_trans(struct s390_domain *s390_domain,
 
         spin_lock_irqsave(&s390_domain->dma_table_lock, irq_flags);
         for (i = 0; i < nr_pages; i++) {
-                dma_update_cpu_trans(s390_domain->dma_table, page_addr,
-                                     dma_addr, flags);
+                entry = dma_walk_cpu_trans(s390_domain->dma_table, dma_addr);
+                if (!entry) {
+                        rc = -ENOMEM;
+                        goto undo_cpu_trans;
+                }
+                dma_update_cpu_trans(entry, page_addr, flags);
                 page_addr += PAGE_SIZE;
                 dma_addr += PAGE_SIZE;
         }
@@ -242,6 +247,20 @@ static int s390_iommu_update_trans(struct s390_domain *s390_domain,
                         break;
         }
         spin_unlock(&s390_domain->list_lock);
+
+undo_cpu_trans:
+        if (rc && ((flags & ZPCI_PTE_VALID_MASK) == ZPCI_PTE_VALID)) {
+                flags = ZPCI_PTE_INVALID;
+                while (i-- > 0) {
+                        page_addr -= PAGE_SIZE;
+                        dma_addr -= PAGE_SIZE;
+                        entry = dma_walk_cpu_trans(s390_domain->dma_table,
+                                                   dma_addr);
+                        if (!entry)
+                                break;
+                        dma_update_cpu_trans(entry, page_addr, flags);
+                }
+        }
         spin_unlock_irqrestore(&s390_domain->dma_table_lock, irq_flags);
 
         return rc;
diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c
index 44a077f3a4a2..f174ce0ca361 100644
--- a/drivers/irqchip/irq-gic-common.c
+++ b/drivers/irqchip/irq-gic-common.c
@@ -84,12 +84,15 @@ void __init gic_dist_config(void __iomem *base, int gic_irqs,
                 writel_relaxed(GICD_INT_DEF_PRI_X4, base + GIC_DIST_PRI + i);
 
         /*
-         * Disable all interrupts.  Leave the PPI and SGIs alone
-         * as they are enabled by redistributor registers.
+         * Deactivate and disable all SPIs. Leave the PPI and SGIs
+         * alone as they are in the redistributor registers on GICv3.
          */
-        for (i = 32; i < gic_irqs; i += 32)
+        for (i = 32; i < gic_irqs; i += 32) {
                 writel_relaxed(GICD_INT_EN_CLR_X32,
-                                        base + GIC_DIST_ENABLE_CLEAR + i / 8);
+                               base + GIC_DIST_ACTIVE_CLEAR + i / 8);
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               base + GIC_DIST_ENABLE_CLEAR + i / 8);
+        }
 
         if (sync_access)
                 sync_access();
@@ -102,7 +105,9 @@ void gic_cpu_config(void __iomem *base, void (*sync_access)(void))
         /*
          * Deal with the banked PPI and SGI interrupts - disable all
          * PPI interrupts, ensure all SGI interrupts are enabled.
+         * Make sure everything is deactivated.
          */
+        writel_relaxed(GICD_INT_EN_CLR_X32, base + GIC_DIST_ACTIVE_CLEAR);
         writel_relaxed(GICD_INT_EN_CLR_PPI, base + GIC_DIST_ENABLE_CLEAR);
         writel_relaxed(GICD_INT_EN_SET_SGI, base + GIC_DIST_ENABLE_SET);
 
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 515c823c1c95..abf2ffaed392 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -73,9 +73,11 @@ struct gic_chip_data {
         union gic_base cpu_base;
 #ifdef CONFIG_CPU_PM
         u32 saved_spi_enable[DIV_ROUND_UP(1020, 32)];
+        u32 saved_spi_active[DIV_ROUND_UP(1020, 32)];
         u32 saved_spi_conf[DIV_ROUND_UP(1020, 16)];
         u32 saved_spi_target[DIV_ROUND_UP(1020, 4)];
         u32 __percpu *saved_ppi_enable;
+        u32 __percpu *saved_ppi_active;
         u32 __percpu *saved_ppi_conf;
 #endif
         struct irq_domain *domain;
@@ -566,6 +568,10 @@ static void gic_dist_save(unsigned int gic_nr)
         for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
                 gic_data[gic_nr].saved_spi_enable[i] =
                         readl_relaxed(dist_base + GIC_DIST_ENABLE_SET + i * 4);
+
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
+                gic_data[gic_nr].saved_spi_active[i] =
+                        readl_relaxed(dist_base + GIC_DIST_ACTIVE_SET + i * 4);
 }
 
 /*
@@ -604,9 +610,19 @@ static void gic_dist_restore(unsigned int gic_nr)
                 writel_relaxed(gic_data[gic_nr].saved_spi_target[i],
                         dist_base + GIC_DIST_TARGET + i * 4);
 
-        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++)
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                        dist_base + GIC_DIST_ENABLE_CLEAR + i * 4);
                 writel_relaxed(gic_data[gic_nr].saved_spi_enable[i],
                         dist_base + GIC_DIST_ENABLE_SET + i * 4);
+        }
+
+        for (i = 0; i < DIV_ROUND_UP(gic_irqs, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                        dist_base + GIC_DIST_ACTIVE_CLEAR + i * 4);
+                writel_relaxed(gic_data[gic_nr].saved_spi_active[i],
+                        dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+        }
 
         writel_relaxed(GICD_ENABLE, dist_base + GIC_DIST_CTRL);
 }
@@ -631,6 +647,10 @@ static void gic_cpu_save(unsigned int gic_nr)
         for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
                 ptr[i] = readl_relaxed(dist_base + GIC_DIST_ENABLE_SET + i * 4);
 
+        ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_active);
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
+                ptr[i] = readl_relaxed(dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_conf);
         for (i = 0; i < DIV_ROUND_UP(32, 16); i++)
                 ptr[i] = readl_relaxed(dist_base + GIC_DIST_CONFIG + i * 4);
@@ -654,8 +674,18 @@ static void gic_cpu_restore(unsigned int gic_nr)
                 return;
 
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_enable);
-        for (i = 0; i < DIV_ROUND_UP(32, 32); i++)
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               dist_base + GIC_DIST_ENABLE_CLEAR + i * 4);
                 writel_relaxed(ptr[i], dist_base + GIC_DIST_ENABLE_SET + i * 4);
+        }
+
+        ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_active);
+        for (i = 0; i < DIV_ROUND_UP(32, 32); i++) {
+                writel_relaxed(GICD_INT_EN_CLR_X32,
+                               dist_base + GIC_DIST_ACTIVE_CLEAR + i * 4);
+                writel_relaxed(ptr[i], dist_base + GIC_DIST_ACTIVE_SET + i * 4);
+        }
 
         ptr = raw_cpu_ptr(gic_data[gic_nr].saved_ppi_conf);
         for (i = 0; i < DIV_ROUND_UP(32, 16); i++)
@@ -710,6 +740,10 @@ static void __init gic_pm_init(struct gic_chip_data *gic)
                 sizeof(u32));
         BUG_ON(!gic->saved_ppi_enable);
 
+        gic->saved_ppi_active = __alloc_percpu(DIV_ROUND_UP(32, 32) * 4,
+                sizeof(u32));
+        BUG_ON(!gic->saved_ppi_active);
+
         gic->saved_ppi_conf = __alloc_percpu(DIV_ROUND_UP(32, 16) * 4,
                 sizeof(u32));
         BUG_ON(!gic->saved_ppi_conf);
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index f659e605a406..5178645ac42b 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -160,11 +160,6 @@ int nvm_erase_blk(struct nvm_dev *dev, struct nvm_block *blk)
 }
 EXPORT_SYMBOL(nvm_erase_blk);
 
-static void nvm_core_free(struct nvm_dev *dev)
-{
-        kfree(dev);
-}
-
 static int nvm_core_init(struct nvm_dev *dev)
 {
         struct nvm_id *id = &dev->identity;
@@ -179,12 +174,21 @@ static int nvm_core_init(struct nvm_dev *dev)
         dev->sec_size = grp->csecs;
         dev->oob_size = grp->sos;
         dev->sec_per_pg = grp->fpg_sz / grp->csecs;
-        dev->addr_mode = id->ppat;
-        dev->addr_format = id->ppaf;
+        memcpy(&dev->ppaf, &id->ppaf, sizeof(struct nvm_addr_format));
 
         dev->plane_mode = NVM_PLANE_SINGLE;
         dev->max_rq_size = dev->ops->max_phys_sect * dev->sec_size;
 
+        if (grp->mtype != 0) {
+                pr_err("nvm: memory type not supported\n");
+                return -EINVAL;
+        }
+
+        if (grp->fmtype != 0 && grp->fmtype != 1) {
+                pr_err("nvm: flash type not supported\n");
+                return -EINVAL;
+        }
+
         if (grp->mpos & 0x020202)
                 dev->plane_mode = NVM_PLANE_DOUBLE;
         if (grp->mpos & 0x040404)
@@ -213,21 +217,18 @@ static void nvm_free(struct nvm_dev *dev)
 
         if (dev->mt)
                 dev->mt->unregister_mgr(dev);
-
-        nvm_core_free(dev);
 }
 
 static int nvm_init(struct nvm_dev *dev)
 {
         struct nvmm_type *mt;
-        int ret = 0;
+        int ret = -EINVAL;
 
         if (!dev->q || !dev->ops)
-                return -EINVAL;
+                return ret;
 
         if (dev->ops->identity(dev->q, &dev->identity)) {
                 pr_err("nvm: device could not be identified\n");
-                ret = -EINVAL;
                 goto err;
         }
 
@@ -273,7 +274,6 @@ static int nvm_init(struct nvm_dev *dev)
                         dev->nr_chnls);
         return 0;
 err:
-        nvm_free(dev);
         pr_err("nvm: failed to initialize nvm\n");
         return ret;
 }
@@ -308,22 +308,24 @@ int nvm_register(struct request_queue *q, char *disk_name,
         if (ret)
                 goto err_init;
 
-        down_write(&nvm_lock);
-        list_add(&dev->devices, &nvm_devices);
-        up_write(&nvm_lock);
-
         if (dev->ops->max_phys_sect > 1) {
                 dev->ppalist_pool = dev->ops->create_dma_pool(dev->q,
                                                                 "ppalist");
                 if (!dev->ppalist_pool) {
                         pr_err("nvm: could not create ppa pool\n");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err_init;
                 }
         } else if (dev->ops->max_phys_sect > 256) {
                 pr_info("nvm: max sectors supported is 256.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_init;
         }
 
+        down_write(&nvm_lock);
+        list_add(&dev->devices, &nvm_devices);
+        up_write(&nvm_lock);
+
         return 0;
 err_init:
         kfree(dev);
@@ -341,11 +343,12 @@ void nvm_unregister(char *disk_name)
                 return;
         }
 
-        nvm_exit(dev);
-
         down_write(&nvm_lock);
         list_del(&dev->devices);
         up_write(&nvm_lock);
+
+        nvm_exit(dev);
+        kfree(dev);
 }
 EXPORT_SYMBOL(nvm_unregister);
 
@@ -457,11 +460,11 @@ static void nvm_remove_target(struct nvm_target *t)
         lockdep_assert_held(&nvm_lock);
 
         del_gendisk(tdisk);
+        blk_cleanup_queue(q);
+
         if (tt->exit)
                 tt->exit(tdisk->private_data);
 
-        blk_cleanup_queue(q);
-
         put_disk(tdisk);
 
         list_del(&t->list);
@@ -541,7 +544,7 @@ static int nvm_configure_show(const char *val)
         if (!dev->mt)
                 return 0;
 
-        dev->mt->free_blocks_print(dev);
+        dev->mt->lun_info_print(dev);
 
         return 0;
 }
diff --git a/drivers/lightnvm/gennvm.c b/drivers/lightnvm/gennvm.c
index ae1fb2bdc5f4..e20e74ec6b91 100644
--- a/drivers/lightnvm/gennvm.c
+++ b/drivers/lightnvm/gennvm.c
@@ -60,23 +60,28 @@ static int gennvm_luns_init(struct nvm_dev *dev, struct gen_nvm *gn)
                 lun->vlun.lun_id = i % dev->luns_per_chnl;
                 lun->vlun.chnl_id = i / dev->luns_per_chnl;
                 lun->vlun.nr_free_blocks = dev->blks_per_lun;
+                lun->vlun.nr_inuse_blocks = 0;
+                lun->vlun.nr_bad_blocks = 0;
         }
         return 0;
 }
 
-static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
+static int gennvm_block_bb(struct ppa_addr ppa, int nr_blocks, u8 *blks,
                                                                 void *private)
 {
         struct gen_nvm *gn = private;
-        struct gen_lun *lun = &gn->luns[lun_id];
+        struct nvm_dev *dev = gn->dev;
+        struct gen_lun *lun;
         struct nvm_block *blk;
         int i;
 
-        if (unlikely(bitmap_empty(bb_bitmap, nr_blocks)))
-                return 0;
+        ppa = dev_to_generic_addr(gn->dev, ppa);
+        lun = &gn->luns[(dev->nr_luns * ppa.g.ch) + ppa.g.lun];
+
+        for (i = 0; i < nr_blocks; i++) {
+                if (blks[i] == 0)
+                        continue;
 
-        i = -1;
-        while ((i = find_next_bit(bb_bitmap, nr_blocks, i + 1)) < nr_blocks) {
                 blk = &lun->vlun.blocks[i];
                 if (!blk) {
                         pr_err("gennvm: BB data is out of bounds.\n");
@@ -84,6 +89,7 @@ static int gennvm_block_bb(u32 lun_id, void *bb_bitmap, unsigned int nr_blocks,
                 }
 
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
         }
 
         return 0;
@@ -136,6 +142,7 @@ static int gennvm_block_map(u64 slba, u32 nlb, __le64 *entries, void *private)
                         list_move_tail(&blk->list, &lun->used_list);
                         blk->type = 1;
                         lun->vlun.nr_free_blocks--;
+                        lun->vlun.nr_inuse_blocks++;
                 }
         }
 
@@ -164,15 +171,25 @@ static int gennvm_blocks_init(struct nvm_dev *dev, struct gen_nvm *gn)
                         block->id = cur_block_id++;
 
                         /* First block is reserved for device */
-                        if (unlikely(lun_iter == 0 && blk_iter == 0))
+                        if (unlikely(lun_iter == 0 && blk_iter == 0)) {
+                                lun->vlun.nr_free_blocks--;
                                 continue;
+                        }
 
                         list_add_tail(&block->list, &lun->free_list);
                 }
 
                 if (dev->ops->get_bb_tbl) {
-                        ret = dev->ops->get_bb_tbl(dev->q, lun->vlun.id,
-                                        dev->blks_per_lun, gennvm_block_bb, gn);
+                        struct ppa_addr ppa;
+
+                        ppa.ppa = 0;
+                        ppa.g.ch = lun->vlun.chnl_id;
+                        ppa.g.lun = lun->vlun.id;
+                        ppa = generic_to_dev_addr(dev, ppa);
+
+                        ret = dev->ops->get_bb_tbl(dev->q, ppa,
+                                                dev->blks_per_lun,
+                                                gennvm_block_bb, gn);
                         if (ret)
                                 pr_err("gennvm: could not read BB table\n");
                 }
@@ -199,6 +216,7 @@ static int gennvm_register(struct nvm_dev *dev)
         if (!gn)
                 return -ENOMEM;
 
+        gn->dev = dev;
         gn->nr_luns = dev->nr_luns;
         dev->mp = gn;
 
@@ -254,6 +272,7 @@ static struct nvm_block *gennvm_get_blk(struct nvm_dev *dev,
         blk->type = 1;
 
         lun->vlun.nr_free_blocks--;
+        lun->vlun.nr_inuse_blocks++;
 
         spin_unlock(&vlun->lock);
 out:
@@ -271,16 +290,21 @@ static void gennvm_put_blk(struct nvm_dev *dev, struct nvm_block *blk)
         case 1:
                 list_move_tail(&blk->list, &lun->free_list);
                 lun->vlun.nr_free_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 blk->type = 0;
                 break;
         case 2:
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
                 break;
         default:
                 WARN_ON_ONCE(1);
                 pr_err("gennvm: erroneous block type (%lu -> %u)\n",
                                                         blk->id, blk->type);
                 list_move_tail(&blk->list, &lun->bb_list);
+                lun->vlun.nr_bad_blocks++;
+                lun->vlun.nr_inuse_blocks--;
         }
 
         spin_unlock(&vlun->lock);
@@ -292,10 +316,10 @@ static void gennvm_addr_to_generic_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = addr_to_generic_mode(dev,
+                        rqd->ppa_list[i] = dev_to_generic_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = addr_to_generic_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = dev_to_generic_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -305,10 +329,10 @@ static void gennvm_generic_to_addr_mode(struct nvm_dev *dev, struct nvm_rq *rqd)
 
         if (rqd->nr_pages > 1) {
                 for (i = 0; i < rqd->nr_pages; i++)
-                        rqd->ppa_list[i] = generic_to_addr_mode(dev,
+                        rqd->ppa_list[i] = generic_to_dev_addr(dev,
                                                         rqd->ppa_list[i]);
         } else {
-                rqd->ppa_addr = generic_to_addr_mode(dev, rqd->ppa_addr);
+                rqd->ppa_addr = generic_to_dev_addr(dev, rqd->ppa_addr);
         }
 }
 
@@ -354,10 +378,10 @@ static void gennvm_mark_blk_bad(struct nvm_dev *dev, struct nvm_rq *rqd)
 {
         int i;
 
-        if (!dev->ops->set_bb)
+        if (!dev->ops->set_bb_tbl)
                 return;
 
-        if (dev->ops->set_bb(dev->q, rqd, 1))
+        if (dev->ops->set_bb_tbl(dev->q, rqd, 1))
                 return;
 
         gennvm_addr_to_generic_mode(dev, rqd);
@@ -440,15 +464,24 @@ static struct nvm_lun *gennvm_get_lun(struct nvm_dev *dev, int lunid)
         return &gn->luns[lunid].vlun;
 }
 
-static void gennvm_free_blocks_print(struct nvm_dev *dev)
+static void gennvm_lun_info_print(struct nvm_dev *dev)
 {
         struct gen_nvm *gn = dev->mp;
         struct gen_lun *lun;
         unsigned int i;
 
-        gennvm_for_each_lun(gn, lun, i)
-                pr_info("%s: lun%8u\t%u\n",
-                                        dev->name, i, lun->vlun.nr_free_blocks);
+
+        gennvm_for_each_lun(gn, lun, i) {
+                spin_lock(&lun->vlun.lock);
+
+                pr_info("%s: lun%8u\t%u\t%u\t%u\n",
+                                dev->name, i,
+                                lun->vlun.nr_free_blocks,
+                                lun->vlun.nr_inuse_blocks,
+                                lun->vlun.nr_bad_blocks);
+
+                spin_unlock(&lun->vlun.lock);
+        }
 }
 
 static struct nvmm_type gennvm = {
@@ -466,7 +499,7 @@ static struct nvmm_type gennvm = {
         .erase_blk      = gennvm_erase_blk,
 
         .get_lun        = gennvm_get_lun,
-        .free_blocks_print = gennvm_free_blocks_print,
+        .lun_info_print = gennvm_lun_info_print,
 };
 
 static int __init gennvm_module_init(void)
diff --git a/drivers/lightnvm/gennvm.h b/drivers/lightnvm/gennvm.h
index d23bd3501ddc..9c24b5b32dac 100644
--- a/drivers/lightnvm/gennvm.h
+++ b/drivers/lightnvm/gennvm.h
@@ -35,6 +35,8 @@ struct gen_lun {
 };
 
 struct gen_nvm {
+        struct nvm_dev *dev;
+
         int nr_luns;
         struct gen_lun *luns;
 };
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index 7ba64c87ba1c..75e59c3a3f96 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -123,12 +123,42 @@ static u64 block_to_addr(struct rrpc *rrpc, struct rrpc_block *rblk)
         return blk->id * rrpc->dev->pgs_per_blk;
 }
 
+static struct ppa_addr linear_to_generic_addr(struct nvm_dev *dev,
+                                                        struct ppa_addr r)
+{
+        struct ppa_addr l;
+        int secs, pgs, blks, luns;
+        sector_t ppa = r.ppa;
+
+        l.ppa = 0;
+
+        div_u64_rem(ppa, dev->sec_per_pg, &secs);
+        l.g.sec = secs;
+
+        sector_div(ppa, dev->sec_per_pg);
+        div_u64_rem(ppa, dev->sec_per_blk, &pgs);
+        l.g.pg = pgs;
+
+        sector_div(ppa, dev->pgs_per_blk);
+        div_u64_rem(ppa, dev->blks_per_lun, &blks);
+        l.g.blk = blks;
+
+        sector_div(ppa, dev->blks_per_lun);
+        div_u64_rem(ppa, dev->luns_per_chnl, &luns);
+        l.g.lun = luns;
+
+        sector_div(ppa, dev->luns_per_chnl);
+        l.g.ch = ppa;
+
+        return l;
+}
+
 static struct ppa_addr rrpc_ppa_to_gaddr(struct nvm_dev *dev, u64 addr)
 {
         struct ppa_addr paddr;
 
         paddr.ppa = addr;
-        return __linear_to_generic_addr(dev, paddr);
+        return linear_to_generic_addr(dev, paddr);
 }
 
 /* requires lun->lock taken */
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 917d47e290ae..3147c8d09ea8 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -112,7 +112,8 @@ struct iv_tcw_private {
  * and encrypts / decrypts at the same time.
  */
 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
-             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD };
+             DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
+             DM_CRYPT_EXIT_THREAD};
 
 /*
  * The fields in here must be read only after initialization.
@@ -1203,20 +1204,18 @@ continue_locked:
                 if (!RB_EMPTY_ROOT(&cc->write_tree))
                         goto pop_from_list;
 
+                if (unlikely(test_bit(DM_CRYPT_EXIT_THREAD, &cc->flags))) {
+                        spin_unlock_irq(&cc->write_thread_wait.lock);
+                        break;
+                }
+
                 __set_current_state(TASK_INTERRUPTIBLE);
                 __add_wait_queue(&cc->write_thread_wait, &wait);
 
                 spin_unlock_irq(&cc->write_thread_wait.lock);
 
-                if (unlikely(kthread_should_stop())) {
-                        set_task_state(current, TASK_RUNNING);
-                        remove_wait_queue(&cc->write_thread_wait, &wait);
-                        break;
-                }
-
                 schedule();
 
-                set_task_state(current, TASK_RUNNING);
                 spin_lock_irq(&cc->write_thread_wait.lock);
                 __remove_wait_queue(&cc->write_thread_wait, &wait);
                 goto continue_locked;
@@ -1531,8 +1530,13 @@ static void crypt_dtr(struct dm_target *ti)
         if (!cc)
                 return;
 
-        if (cc->write_thread)
+        if (cc->write_thread) {
+                spin_lock_irq(&cc->write_thread_wait.lock);
+                set_bit(DM_CRYPT_EXIT_THREAD, &cc->flags);
+                wake_up_locked(&cc->write_thread_wait);
+                spin_unlock_irq(&cc->write_thread_wait.lock);
                 kthread_stop(cc->write_thread);
+        }
 
         if (cc->io_queue)
                 destroy_workqueue(cc->io_queue);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index aaa6caa46a9f..cfa29f574c2a 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1537,32 +1537,34 @@ static int multipath_prepare_ioctl(struct dm_target *ti,
                 struct block_device **bdev, fmode_t *mode)
 {
         struct multipath *m = ti->private;
-        struct pgpath *pgpath;
         unsigned long flags;
         int r;
 
-        r = 0;
-
         spin_lock_irqsave(&m->lock, flags);
 
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        pgpath = m->current_pgpath;
-
-        if (pgpath) {
-                *bdev = pgpath->path.dev->bdev;
-                *mode = pgpath->path.dev->mode;
+        if (m->current_pgpath) {
+                if (!m->queue_io) {
+                        *bdev = m->current_pgpath->path.dev->bdev;
+                        *mode = m->current_pgpath->path.dev->mode;
+                        r = 0;
+                } else {
+                        /* pg_init has not started or completed */
+                        r = -ENOTCONN;
+                }
+        } else {
+                /* No path is available */
+                if (m->queue_if_no_path)
+                        r = -ENOTCONN;
+                else
+                        r = -EIO;
         }
 
-        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
-                r = -ENOTCONN;
-        else if (!*bdev)
-                r = -EIO;
-
         spin_unlock_irqrestore(&m->lock, flags);
 
-        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
+        if (r == -ENOTCONN) {
                 spin_lock_irqsave(&m->lock, flags);
                 if (!m->current_pg) {
                         /* Path status changed, redo selection */
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 3897b90bd462..63903a5a5d9e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2432,6 +2432,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         case PM_WRITE:
                 if (old_mode != new_mode)
                         notify_of_pool_mode_change(pool, "write");
+                pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard_bio;
@@ -4249,10 +4250,9 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
         struct pool *pool = tc->pool;
-        struct queue_limits *pool_limits = dm_get_queue_limits(pool->pool_md);
 
-        if (!pool_limits->discard_granularity)
-                return; /* pool's discard support is disabled */
+        if (!pool->pf.discard_enabled)
+                return;
 
         limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
         limits->max_discard_sectors = 2048 * 1024 * 16; /* 16G */
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e15f3565892..5df40480228b 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -591,7 +591,7 @@ retry:
 
 out:
         dm_put_live_table(md, *srcu_idx);
-        if (r == -ENOTCONN) {
+        if (r == -ENOTCONN && !fatal_signal_pending(current)) {
                 msleep(10);
                 goto retry;
         }
@@ -603,9 +603,10 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 {
         struct mapped_device *md = bdev->bd_disk->private_data;
         struct dm_target *tgt;
+        struct block_device *tgt_bdev = NULL;
         int srcu_idx, r;
 
-        r = dm_get_live_table_for_ioctl(md, &tgt, &bdev, &mode, &srcu_idx);
+        r = dm_get_live_table_for_ioctl(md, &tgt, &tgt_bdev, &mode, &srcu_idx);
         if (r < 0)
                 return r;
 
@@ -620,7 +621,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
                         goto out;
         }
 
-        r =  __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+        r =  __blkdev_driver_ioctl(tgt_bdev, mode, cmd, arg);
 out:
         dm_put_live_table(md, srcu_idx);
         return r;
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 35759a91d47d..e8f847226a19 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -1992,9 +1992,9 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
                 (unsigned long long)pci_resource_start(pci_dev, 0));
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail_context;
         }
 
diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
index dbc695f32760..0042803a9de7 100644
--- a/drivers/media/pci/cx25821/cx25821-core.c
+++ b/drivers/media/pci/cx25821/cx25821-core.c
@@ -1319,7 +1319,8 @@ static int cx25821_initdev(struct pci_dev *pci_dev,
                 dev->pci_lat, (unsigned long long)dev->base_io_addr);
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 pr_err("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
                 err = -EIO;
                 goto fail_irq;
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 0ed1b6530374..1b5268f9bb24 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -890,9 +890,9 @@ static int snd_cx88_create(struct snd_card *card, struct pci_dev *pci,
                 return err;
         }
 
-        if (!pci_set_dma_mask(pci,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci,DMA_BIT_MASK(32));
+        if (err) {
                 dprintk(0, "%s/1: Oops: no 32bit PCI DMA ???\n",core->name);
-                err = -EIO;
                 cx88_core_put(core, pci);
                 return err;
         }
diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
index 9db7767d1fe0..f34c229f9b37 100644
--- a/drivers/media/pci/cx88/cx88-mpeg.c
+++ b/drivers/media/pci/cx88/cx88-mpeg.c
@@ -393,7 +393,8 @@ static int cx8802_init_common(struct cx8802_dev *dev)
         if (pci_enable_device(dev->pci))
                 return -EIO;
         pci_set_master(dev->pci);
-        if (!pci_set_dma_mask(dev->pci,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(dev->pci,DMA_BIT_MASK(32));
+        if (err) {
                 printk("%s/2: Oops: no 32bit PCI DMA ???\n",dev->core->name);
                 return -EIO;
         }
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 0de1ad5a977d..aef9acf351f6 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -1314,9 +1314,9 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
                dev->pci_lat,(unsigned long long)pci_resource_start(pci_dev,0));
 
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev,DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev,DMA_BIT_MASK(32));
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n",core->name);
-                err = -EIO;
                 goto fail_core;
         }
         dev->alloc_ctx = vb2_dma_sg_init_ctx(&pci_dev->dev);
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index 60b2d462f98d..3fdbd81b5580 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -810,7 +810,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
                 "%s(): board vendor 0x%x, revision 0x%x\n",
                 __func__, board_vendor, board_revision);
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        if (pci_set_dma_mask(pci_dev, 0xffffffff) < 0) {
                 dev_err(&pci_dev->dev,
                         "%s(): 32bit PCI DMA is not supported\n", __func__);
                 goto pci_detect_err;
diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c
index e79d63eb774e..f720cea80e28 100644
--- a/drivers/media/pci/saa7134/saa7134-core.c
+++ b/drivers/media/pci/saa7134/saa7134-core.c
@@ -951,9 +951,9 @@ static int saa7134_initdev(struct pci_dev *pci_dev,
                pci_name(pci_dev), dev->pci_rev, pci_dev->irq,
                dev->pci_lat,(unsigned long long)pci_resource_start(pci_dev,0));
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
+        if (err) {
                 pr_warn("%s: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail1;
         }
 
diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 8f36b48ef733..8bbd092fbe1d 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1264,9 +1264,9 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
 
         pci_set_master(pci_dev);
         /* TODO */
-        if (!pci_set_dma_mask(pci_dev, 0xffffffff)) {
+        err = pci_set_dma_mask(pci_dev, 0xffffffff);
+        if (err) {
                 printk("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail_irq;
         }
 
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index 8c5655d351d3..4e77618fbb2b 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -257,9 +257,9 @@ static int tw68_initdev(struct pci_dev *pci_dev,
                 dev->name, pci_name(pci_dev), dev->pci_rev, pci_dev->irq,
                 dev->pci_lat, (u64)pci_resource_start(pci_dev, 0));
         pci_set_master(pci_dev);
-        if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
+        if (err) {
                 pr_info("%s: Oops: no 32bit PCI DMA ???\n", dev->name);
-                err = -EIO;
                 goto fail1;
         }
 
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 23b6c8e8701c..d8486168415a 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -65,8 +65,7 @@ MODULE_ALIAS("mmc:block");
 #define MMC_SANITIZE_REQ_TIMEOUT 240000
 #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
 
-#define mmc_req_rel_wr(req)     (((req->cmd_flags & REQ_FUA) || \
-                                  (req->cmd_flags & REQ_META)) && \
+#define mmc_req_rel_wr(req)     ((req->cmd_flags & REQ_FUA) && \
                                   (rq_data_dir(req) == WRITE))
 #define PACKED_CMD_VER  0x01
 #define PACKED_CMD_WR   0x02
@@ -1467,13 +1466,9 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
 
         /*
          * Reliable writes are used to implement Forced Unit Access and
-         * REQ_META accesses, and are supported only on MMCs.
-         *
-         * XXX: this really needs a good explanation of why REQ_META
-         * is treated special.
+         * are supported only on MMCs.
          */
-        bool do_rel_wr = ((req->cmd_flags & REQ_FUA) ||
-                          (req->cmd_flags & REQ_META)) &&
+        bool do_rel_wr = (req->cmd_flags & REQ_FUA) &&
                 (rq_data_dir(req) == WRITE) &&
                 (md->flags & MMC_BLK_REL_WR);
 
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index c793fda27321..3a9a79ec4343 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1040,9 +1040,24 @@ static int mmc_select_hs_ddr(struct mmc_card *card)
         return err;
 }
 
+/* Caller must hold re-tuning */
+static int mmc_switch_status(struct mmc_card *card)
+{
+        u32 status;
+        int err;
+
+        err = mmc_send_status(card, &status);
+        if (err)
+                return err;
+
+        return mmc_switch_status_error(card->host, status);
+}
+
 static int mmc_select_hs400(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
+        bool send_status = true;
+        unsigned int max_dtr;
         int err = 0;
         u8 val;
 
@@ -1053,25 +1068,36 @@ static int mmc_select_hs400(struct mmc_card *card)
               host->ios.bus_width == MMC_BUS_WIDTH_8))
                 return 0;
 
-        /*
-         * Before switching to dual data rate operation for HS400,
-         * it is required to convert from HS200 mode to HS mode.
-         */
-        mmc_set_timing(card->host, MMC_TIMING_MMC_HS);
-        mmc_set_bus_speed(card);
+        if (host->caps & MMC_CAP_WAIT_WHILE_BUSY)
+                send_status = false;
 
+        /* Reduce frequency to HS frequency */
+        max_dtr = card->ext_csd.hs_max_dtr;
+        mmc_set_clock(host, max_dtr);
+
+        /* Switch card to HS mode */
         val = EXT_CSD_TIMING_HS |
               card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
         err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                            EXT_CSD_HS_TIMING, val,
                            card->ext_csd.generic_cmd6_time,
-                           true, true, true);
+                           true, send_status, true);
         if (err) {
                 pr_err("%s: switch to high-speed from hs200 failed, err:%d\n",
                         mmc_hostname(host), err);
                 return err;
         }
 
+        /* Set host controller to HS timing */
+        mmc_set_timing(card->host, MMC_TIMING_MMC_HS);
+
+        if (!send_status) {
+                err = mmc_switch_status(card);
+                if (err)
+                        goto out_err;
+        }
+
+        /* Switch card to DDR */
         err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                          EXT_CSD_BUS_WIDTH,
                          EXT_CSD_DDR_BUS_WIDTH_8,
@@ -1082,22 +1108,35 @@ static int mmc_select_hs400(struct mmc_card *card)
                 return err;
         }
 
+        /* Switch card to HS400 */
         val = EXT_CSD_TIMING_HS400 |
               card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
         err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                            EXT_CSD_HS_TIMING, val,
                            card->ext_csd.generic_cmd6_time,
-                           true, true, true);
+                           true, send_status, true);
         if (err) {
                 pr_err("%s: switch to hs400 failed, err:%d\n",
                          mmc_hostname(host), err);
                 return err;
         }
 
+        /* Set host controller to HS400 timing and frequency */
         mmc_set_timing(host, MMC_TIMING_MMC_HS400);
         mmc_set_bus_speed(card);
 
+        if (!send_status) {
+                err = mmc_switch_status(card);
+                if (err)
+                        goto out_err;
+        }
+
         return 0;
+
+out_err:
+        pr_err("%s: %s failed, error %d\n", mmc_hostname(card->host),
+               __func__, err);
+        return err;
 }
 
 int mmc_hs200_to_hs400(struct mmc_card *card)
@@ -1105,19 +1144,6 @@ int mmc_hs200_to_hs400(struct mmc_card *card)
         return mmc_select_hs400(card);
 }
 
-/* Caller must hold re-tuning */
-static int mmc_switch_status(struct mmc_card *card)
-{
-        u32 status;
-        int err;
-
-        err = mmc_send_status(card, &status);
-        if (err)
-                return err;
-
-        return mmc_switch_status_error(card->host, status);
-}
-
 int mmc_hs400_to_hs200(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
@@ -1219,6 +1245,8 @@ static void mmc_select_driver_type(struct mmc_card *card)
 static int mmc_select_hs200(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
+        bool send_status = true;
+        unsigned int old_timing;
         int err = -EINVAL;
         u8 val;
 
@@ -1234,6 +1262,9 @@ static int mmc_select_hs200(struct mmc_card *card)
 
         mmc_select_driver_type(card);
 
+        if (host->caps & MMC_CAP_WAIT_WHILE_BUSY)
+                send_status = false;
+
         /*
          * Set the bus width(4 or 8) with host's support and
          * switch to HS200 mode if bus width is set successfully.
@@ -1245,11 +1276,25 @@ static int mmc_select_hs200(struct mmc_card *card)
                 err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                    EXT_CSD_HS_TIMING, val,
                                    card->ext_csd.generic_cmd6_time,
-                                   true, true, true);
-                if (!err)
-                        mmc_set_timing(host, MMC_TIMING_MMC_HS200);
+                                   true, send_status, true);
+                if (err)
+                        goto err;
+                old_timing = host->ios.timing;
+                mmc_set_timing(host, MMC_TIMING_MMC_HS200);
+                if (!send_status) {
+                        err = mmc_switch_status(card);
+                        /*
+                         * mmc_select_timing() assumes timing has not changed if
+                         * it is a switch error.
+                         */
+                        if (err == -EBADMSG)
+                                mmc_set_timing(host, old_timing);
+                }
         }
 err:
+        if (err)
+                pr_err("%s: %s failed, error %d\n", mmc_hostname(card->host),
+                       __func__, err);
         return err;
 }
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index af71de5fda3b..1dee533634c9 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -473,6 +473,7 @@ config MMC_DAVINCI
 
 config MMC_GOLDFISH
         tristate "goldfish qemu Multimedia Card Interface support"
+        depends on HAS_DMA
         depends on GOLDFISH || COMPILE_TEST
         help
           This selects the Goldfish Multimedia card Interface emulation
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 39568cc29a2a..33dfd7e72516 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -1276,7 +1276,7 @@ static struct msdc_delay_phase get_best_delay(struct msdc_host *host, u32 delay)
         int start = 0, len = 0;
         int start_final = 0, len_final = 0;
         u8 final_phase = 0xff;
-        struct msdc_delay_phase delay_phase;
+        struct msdc_delay_phase delay_phase = { 0, };
 
         if (delay == 0) {
                 dev_err(host->dev, "phase error: [map:%x]\n", delay);
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 8cadd74e8407..ce08896b9d69 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -805,7 +805,7 @@ static int pxamci_probe(struct platform_device *pdev)
                 goto out;
         } else {
                 mmc->caps |= host->pdata->gpio_card_ro_invert ?
-                        MMC_CAP2_RO_ACTIVE_HIGH : 0;
+                        0 : MMC_CAP2_RO_ACTIVE_HIGH;
         }
 
         if (gpio_is_valid(gpio_cd))
diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
index dc4e8446f1ff..5a99a93ed025 100644
--- a/drivers/mtd/nand/jz4740_nand.c
+++ b/drivers/mtd/nand/jz4740_nand.c
@@ -25,6 +25,7 @@
 
 #include <linux/gpio.h>
 
+#include <asm/mach-jz4740/gpio.h>
 #include <asm/mach-jz4740/jz4740_nand.h>
 
 #define JZ_REG_NAND_CTRL        0x50
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index cc74142938b0..ece544efccc3 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -3110,7 +3110,7 @@ static void nand_resume(struct mtd_info *mtd)
  */
 static void nand_shutdown(struct mtd_info *mtd)
 {
-        nand_get_device(mtd, FL_SHUTDOWN);
+        nand_get_device(mtd, FL_PM_SUSPENDED);
 }
 
 /* Set default functions */
diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
index 9093577755f6..0527f485c3dc 100644
--- a/drivers/net/dsa/mv88e6060.c
+++ b/drivers/net/dsa/mv88e6060.c
@@ -15,9 +15,7 @@
 #include <linux/netdevice.h>
 #include <linux/phy.h>
 #include <net/dsa.h>
-
-#define REG_PORT(p)             (8 + (p))
-#define REG_GLOBAL              0x0f
+#include "mv88e6060.h"
 
 static int reg_read(struct dsa_switch *ds, int addr, int reg)
 {
@@ -67,13 +65,14 @@ static char *mv88e6060_probe(struct device *host_dev, int sw_addr)
         if (bus == NULL)
                 return NULL;
 
-        ret = mdiobus_read(bus, sw_addr + REG_PORT(0), 0x03);
+        ret = mdiobus_read(bus, sw_addr + REG_PORT(0), PORT_SWITCH_ID);
         if (ret >= 0) {
-                if (ret == 0x0600)
+                if (ret == PORT_SWITCH_ID_6060)
                         return "Marvell 88E6060 (A0)";
-                if (ret == 0x0601 || ret == 0x0602)
+                if (ret == PORT_SWITCH_ID_6060_R1 ||
+                    ret == PORT_SWITCH_ID_6060_R2)
                         return "Marvell 88E6060 (B0)";
-                if ((ret & 0xfff0) == 0x0600)
+                if ((ret & PORT_SWITCH_ID_6060_MASK) == PORT_SWITCH_ID_6060)
                         return "Marvell 88E6060";
         }
 
@@ -87,22 +86,26 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
         unsigned long timeout;
 
         /* Set all ports to the disabled state. */
-        for (i = 0; i < 6; i++) {
-                ret = REG_READ(REG_PORT(i), 0x04);
-                REG_WRITE(REG_PORT(i), 0x04, ret & 0xfffc);
+        for (i = 0; i < MV88E6060_PORTS; i++) {
+                ret = REG_READ(REG_PORT(i), PORT_CONTROL);
+                REG_WRITE(REG_PORT(i), PORT_CONTROL,
+                          ret & ~PORT_CONTROL_STATE_MASK);
         }
 
         /* Wait for transmit queues to drain. */
         usleep_range(2000, 4000);
 
         /* Reset the switch. */
-        REG_WRITE(REG_GLOBAL, 0x0a, 0xa130);
+        REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+                  GLOBAL_ATU_CONTROL_SWRESET |
+                  GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+                  GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
 
         /* Wait up to one second for reset to complete. */
         timeout = jiffies + 1 * HZ;
         while (time_before(jiffies, timeout)) {
-                ret = REG_READ(REG_GLOBAL, 0x00);
-                if ((ret & 0x8000) == 0x0000)
+                ret = REG_READ(REG_GLOBAL, GLOBAL_STATUS);
+                if (ret & GLOBAL_STATUS_INIT_READY)
                         break;
 
                 usleep_range(1000, 2000);
@@ -119,13 +122,15 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
          * set the maximum frame size to 1536 bytes, and mask all
          * interrupt sources.
          */
-        REG_WRITE(REG_GLOBAL, 0x04, 0x0800);
+        REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
 
         /* Enable automatic address learning, set the address
          * database size to 1024 entries, and set the default aging
          * time to 5 minutes.
          */
-        REG_WRITE(REG_GLOBAL, 0x0a, 0x2130);
+        REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+                  GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+                  GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
 
         return 0;
 }
@@ -139,25 +144,30 @@ static int mv88e6060_setup_port(struct dsa_switch *ds, int p)
          * state to Forwarding.  Additionally, if this is the CPU
          * port, enable Ingress and Egress Trailer tagging mode.
          */
-        REG_WRITE(addr, 0x04, dsa_is_cpu_port(ds, p) ?  0x4103 : 0x0003);
+        REG_WRITE(addr, PORT_CONTROL,
+                  dsa_is_cpu_port(ds, p) ?
+                        PORT_CONTROL_TRAILER |
+                        PORT_CONTROL_INGRESS_MODE |
+                        PORT_CONTROL_STATE_FORWARDING :
+                        PORT_CONTROL_STATE_FORWARDING);
 
         /* Port based VLAN map: give each port its own address
          * database, allow the CPU port to talk to each of the 'real'
          * ports, and allow each of the 'real' ports to only talk to
          * the CPU port.
          */
-        REG_WRITE(addr, 0x06,
-                        ((p & 0xf) << 12) |
-                         (dsa_is_cpu_port(ds, p) ?
-                                ds->phys_port_mask :
-                                (1 << ds->dst->cpu_port)));
+        REG_WRITE(addr, PORT_VLAN_MAP,
+                  ((p & 0xf) << PORT_VLAN_MAP_DBNUM_SHIFT) |
+                   (dsa_is_cpu_port(ds, p) ?
+                        ds->phys_port_mask :
+                        BIT(ds->dst->cpu_port)));
 
         /* Port Association Vector: when learning source addresses
          * of packets, add the address to the address database using
          * a port bitmap that has only the bit for this port set and
          * the other bits clear.
          */
-        REG_WRITE(addr, 0x0b, 1 << p);
+        REG_WRITE(addr, PORT_ASSOC_VECTOR, BIT(p));
 
         return 0;
 }
@@ -177,7 +187,7 @@ static int mv88e6060_setup(struct dsa_switch *ds)
         if (ret < 0)
                 return ret;
 
-        for (i = 0; i < 6; i++) {
+        for (i = 0; i < MV88E6060_PORTS; i++) {
                 ret = mv88e6060_setup_port(ds, i);
                 if (ret < 0)
                         return ret;
@@ -188,16 +198,17 @@ static int mv88e6060_setup(struct dsa_switch *ds)
 
 static int mv88e6060_set_addr(struct dsa_switch *ds, u8 *addr)
 {
-        REG_WRITE(REG_GLOBAL, 0x01, (addr[0] << 8) | addr[1]);
-        REG_WRITE(REG_GLOBAL, 0x02, (addr[2] << 8) | addr[3]);
-        REG_WRITE(REG_GLOBAL, 0x03, (addr[4] << 8) | addr[5]);
+        /* Use the same MAC Address as FD Pause frames for all ports */
+        REG_WRITE(REG_GLOBAL, GLOBAL_MAC_01, (addr[0] << 9) | addr[1]);
+        REG_WRITE(REG_GLOBAL, GLOBAL_MAC_23, (addr[2] << 8) | addr[3]);
+        REG_WRITE(REG_GLOBAL, GLOBAL_MAC_45, (addr[4] << 8) | addr[5]);
 
         return 0;
 }
 
 static int mv88e6060_port_to_phy_addr(int port)
 {
-        if (port >= 0 && port <= 5)
+        if (port >= 0 && port < MV88E6060_PORTS)
                 return port;
         return -1;
 }
@@ -225,54 +236,6 @@ mv88e6060_phy_write(struct dsa_switch *ds, int port, int regnum, u16 val)
         return reg_write(ds, addr, regnum, val);
 }
 
-static void mv88e6060_poll_link(struct dsa_switch *ds)
-{
-        int i;
-
-        for (i = 0; i < DSA_MAX_PORTS; i++) {
-                struct net_device *dev;
-                int uninitialized_var(port_status);
-                int link;
-                int speed;
-                int duplex;
-                int fc;
-
-                dev = ds->ports[i];
-                if (dev == NULL)
-                        continue;
-
-                link = 0;
-                if (dev->flags & IFF_UP) {
-                        port_status = reg_read(ds, REG_PORT(i), 0x00);
-                        if (port_status < 0)
-                                continue;
-
-                        link = !!(port_status & 0x1000);
-                }
-
-                if (!link) {
-                        if (netif_carrier_ok(dev)) {
-                                netdev_info(dev, "link down\n");
-                                netif_carrier_off(dev);
-                        }
-                        continue;
-                }
-
-                speed = (port_status & 0x0100) ? 100 : 10;
-                duplex = (port_status & 0x0200) ? 1 : 0;
-                fc = ((port_status & 0xc000) == 0xc000) ? 1 : 0;
-
-                if (!netif_carrier_ok(dev)) {
-                        netdev_info(dev,
-                                    "link up, %d Mb/s, %s duplex, flow control %sabled\n",
-                                    speed,
-                                    duplex ? "full" : "half",
-                                    fc ? "en" : "dis");
-                        netif_carrier_on(dev);
-                }
-        }
-}
-
 static struct dsa_switch_driver mv88e6060_switch_driver = {
         .tag_protocol   = DSA_TAG_PROTO_TRAILER,
         .probe          = mv88e6060_probe,
@@ -280,7 +243,6 @@ static struct dsa_switch_driver mv88e6060_switch_driver = {
         .set_addr       = mv88e6060_set_addr,
         .phy_read       = mv88e6060_phy_read,
         .phy_write      = mv88e6060_phy_write,
-        .poll_link      = mv88e6060_poll_link,
 };
 
 static int __init mv88e6060_init(void)
diff --git a/drivers/net/dsa/mv88e6060.h b/drivers/net/dsa/mv88e6060.h
new file mode 100644
index 000000000000..cc9b2ed4aff4
--- /dev/null
+++ b/drivers/net/dsa/mv88e6060.h
@@ -0,0 +1,111 @@
+/*
+ * drivers/net/dsa/mv88e6060.h - Marvell 88e6060 switch chip support
+ * Copyright (c) 2015 Neil Armstrong
+ *
+ * Based on mv88e6xxx.h
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __MV88E6060_H
+#define __MV88E6060_H
+
+#define MV88E6060_PORTS 6
+
+#define REG_PORT(p)             (0x8 + (p))
+#define PORT_STATUS             0x00
+#define PORT_STATUS_PAUSE_EN    BIT(15)
+#define PORT_STATUS_MY_PAUSE    BIT(14)
+#define PORT_STATUS_FC          (PORT_STATUS_MY_PAUSE | PORT_STATUS_PAUSE_EN)
+#define PORT_STATUS_RESOLVED    BIT(13)
+#define PORT_STATUS_LINK        BIT(12)
+#define PORT_STATUS_PORTMODE    BIT(11)
+#define PORT_STATUS_PHYMODE     BIT(10)
+#define PORT_STATUS_DUPLEX      BIT(9)
+#define PORT_STATUS_SPEED       BIT(8)
+#define PORT_SWITCH_ID          0x03
+#define PORT_SWITCH_ID_6060     0x0600
+#define PORT_SWITCH_ID_6060_MASK        0xfff0
+#define PORT_SWITCH_ID_6060_R1  0x0601
+#define PORT_SWITCH_ID_6060_R2  0x0602
+#define PORT_CONTROL            0x04
+#define PORT_CONTROL_FORCE_FLOW_CTRL    BIT(15)
+#define PORT_CONTROL_TRAILER    BIT(14)
+#define PORT_CONTROL_HEADER     BIT(11)
+#define PORT_CONTROL_INGRESS_MODE       BIT(8)
+#define PORT_CONTROL_VLAN_TUNNEL        BIT(7)
+#define PORT_CONTROL_STATE_MASK 0x03
+#define PORT_CONTROL_STATE_DISABLED     0x00
+#define PORT_CONTROL_STATE_BLOCKING     0x01
+#define PORT_CONTROL_STATE_LEARNING     0x02
+#define PORT_CONTROL_STATE_FORWARDING   0x03
+#define PORT_VLAN_MAP           0x06
+#define PORT_VLAN_MAP_DBNUM_SHIFT       12
+#define PORT_VLAN_MAP_TABLE_MASK        0x1f
+#define PORT_ASSOC_VECTOR       0x0b
+#define PORT_ASSOC_VECTOR_MONITOR       BIT(15)
+#define PORT_ASSOC_VECTOR_PAV_MASK      0x1f
+#define PORT_RX_CNTR            0x10
+#define PORT_TX_CNTR            0x11
+
+#define REG_GLOBAL              0x0f
+#define GLOBAL_STATUS           0x00
+#define GLOBAL_STATUS_SW_MODE_MASK      (0x3 << 12)
+#define GLOBAL_STATUS_SW_MODE_0 (0x0 << 12)
+#define GLOBAL_STATUS_SW_MODE_1 (0x1 << 12)
+#define GLOBAL_STATUS_SW_MODE_2 (0x2 << 12)
+#define GLOBAL_STATUS_SW_MODE_3 (0x3 << 12)
+#define GLOBAL_STATUS_INIT_READY        BIT(11)
+#define GLOBAL_STATUS_ATU_FULL          BIT(3)
+#define GLOBAL_STATUS_ATU_DONE          BIT(2)
+#define GLOBAL_STATUS_PHY_INT   BIT(1)
+#define GLOBAL_STATUS_EEINT     BIT(0)
+#define GLOBAL_MAC_01           0x01
+#define GLOBAL_MAC_01_DIFF_ADDR BIT(8)
+#define GLOBAL_MAC_23           0x02
+#define GLOBAL_MAC_45           0x03
+#define GLOBAL_CONTROL          0x04
+#define GLOBAL_CONTROL_DISCARD_EXCESS   BIT(13)
+#define GLOBAL_CONTROL_MAX_FRAME_1536   BIT(10)
+#define GLOBAL_CONTROL_RELOAD_EEPROM    BIT(9)
+#define GLOBAL_CONTROL_CTRMODE          BIT(8)
+#define GLOBAL_CONTROL_ATU_FULL_EN      BIT(3)
+#define GLOBAL_CONTROL_ATU_DONE_EN      BIT(2)
+#define GLOBAL_CONTROL_PHYINT_EN        BIT(1)
+#define GLOBAL_CONTROL_EEPROM_DONE_EN   BIT(0)
+#define GLOBAL_ATU_CONTROL      0x0a
+#define GLOBAL_ATU_CONTROL_SWRESET      BIT(15)
+#define GLOBAL_ATU_CONTROL_LEARNDIS     BIT(14)
+#define GLOBAL_ATU_CONTROL_ATUSIZE_256  (0x0 << 12)
+#define GLOBAL_ATU_CONTROL_ATUSIZE_512  (0x1 << 12)
+#define GLOBAL_ATU_CONTROL_ATUSIZE_1024 (0x2 << 12)
+#define GLOBAL_ATU_CONTROL_ATE_AGE_SHIFT        4
+#define GLOBAL_ATU_CONTROL_ATE_AGE_MASK (0xff << 4)
+#define GLOBAL_ATU_CONTROL_ATE_AGE_5MIN (0x13 << 4)
+#define GLOBAL_ATU_OP           0x0b
+#define GLOBAL_ATU_OP_BUSY      BIT(15)
+#define GLOBAL_ATU_OP_NOP               (0 << 12)
+#define GLOBAL_ATU_OP_FLUSH_ALL ((1 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_OP_FLUSH_UNLOCKED    ((2 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_OP_LOAD_DB           ((3 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_OP_GET_NEXT_DB       ((4 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_OP_FLUSH_DB          ((5 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_OP_FLUSH_UNLOCKED_DB ((6 << 12) | GLOBAL_ATU_OP_BUSY)
+#define GLOBAL_ATU_DATA         0x0c
+#define GLOBAL_ATU_DATA_PORT_VECTOR_MASK        0x3f0
+#define GLOBAL_ATU_DATA_PORT_VECTOR_SHIFT       4
+#define GLOBAL_ATU_DATA_STATE_MASK              0x0f
+#define GLOBAL_ATU_DATA_STATE_UNUSED            0x00
+#define GLOBAL_ATU_DATA_STATE_UC_STATIC         0x0e
+#define GLOBAL_ATU_DATA_STATE_UC_LOCKED         0x0f
+#define GLOBAL_ATU_DATA_STATE_MC_STATIC         0x07
+#define GLOBAL_ATU_DATA_STATE_MC_LOCKED         0x0e
+#define GLOBAL_ATU_MAC_01       0x0d
+#define GLOBAL_ATU_MAC_23       0x0e
+#define GLOBAL_ATU_MAC_45       0x0f
+
+#endif
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index 05aa7597dab9..955d06b9cdba 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -78,7 +78,6 @@ source "drivers/net/ethernet/ibm/Kconfig"
 source "drivers/net/ethernet/intel/Kconfig"
 source "drivers/net/ethernet/i825xx/Kconfig"
 source "drivers/net/ethernet/xscale/Kconfig"
-source "drivers/net/ethernet/icplus/Kconfig"
 
 config JME
         tristate "JMicron(R) PCI-Express Gigabit Ethernet support"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index ddfc808110a1..4a2ee98738f0 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -41,7 +41,6 @@ obj-$(CONFIG_NET_VENDOR_IBM) += ibm/
 obj-$(CONFIG_NET_VENDOR_INTEL) += intel/
 obj-$(CONFIG_NET_VENDOR_I825XX) += i825xx/
 obj-$(CONFIG_NET_VENDOR_XSCALE) += xscale/
-obj-$(CONFIG_IP1000) += icplus/
 obj-$(CONFIG_JME) += jme.o
 obj-$(CONFIG_KORINA) += korina.o
 obj-$(CONFIG_LANTIQ_ETOP) += lantiq_etop.o
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index e2afabf3a465..7ccebae9cb48 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1500,10 +1500,11 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        if (!pci_set_dma_mask(pdev, PCNET32_DMA_MASK)) {
+        err = pci_set_dma_mask(pdev, PCNET32_DMA_MASK);
+        if (err) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
                         pr_err("architecture does not support 32bit PCI busmaster DMA\n");
-                return -ENODEV;
+                return err;
         }
         if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index f1d62d5dbaff..c9b036789184 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13207,7 +13207,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
 
         /* VF with OLD Hypervisor or old PF do not support filtering */
         if (IS_PF(bp)) {
-                if (CHIP_IS_E1x(bp))
+                if (chip_is_e1x)
                         bp->accept_any_vlan = true;
                 else
                         dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index f683d97d7614..b89504405b72 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -560,7 +560,7 @@ static int liquidio_resume(struct pci_dev *pdev)
 #endif
 
 /* For PCI-E Advanced Error Recovery (AER) Interface */
-static struct pci_error_handlers liquidio_err_handler = {
+static const struct pci_error_handlers liquidio_err_handler = {
         .error_detected = liquidio_pcie_error_detected,
         .mmio_enabled   = liquidio_pcie_mmio_enabled,
         .slot_reset     = liquidio_pcie_slot_reset,
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index a9377727c11c..7f709cbdcd87 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1583,8 +1583,14 @@ err_disable_device:
 static void nicvf_remove(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
-        struct nicvf *nic = netdev_priv(netdev);
-        struct net_device *pnetdev = nic->pnicvf->netdev;
+        struct nicvf *nic;
+        struct net_device *pnetdev;
+
+        if (!netdev)
+                return;
+
+        nic = netdev_priv(netdev);
+        pnetdev = nic->pnicvf->netdev;
 
         /* Check if this Qset is assigned to different VF.
          * If yes, clean primary and all secondary Qsets.
diff --git a/drivers/net/ethernet/dlink/Kconfig b/drivers/net/ethernet/dlink/Kconfig
index f6e858d0b9d4..ebdc83247bb6 100644
--- a/drivers/net/ethernet/dlink/Kconfig
+++ b/drivers/net/ethernet/dlink/Kconfig
@@ -17,15 +17,16 @@ config NET_VENDOR_DLINK
 if NET_VENDOR_DLINK
 
 config DL2K
-        tristate "DL2000/TC902x-based Gigabit Ethernet support"
+        tristate "DL2000/TC902x/IP1000A-based Gigabit Ethernet support"
         depends on PCI
         select CRC32
         ---help---
-          This driver supports DL2000/TC902x-based Gigabit ethernet cards,
+          This driver supports DL2000/TC902x/IP1000A-based Gigabit ethernet cards,
           which includes
           D-Link DGE-550T Gigabit Ethernet Adapter.
           D-Link DL2000-based Gigabit Ethernet Adapter.
           Sundance/Tamarack TC902x Gigabit Ethernet Adapter.
+          ICPlus IP1000A-based cards
 
           To compile this driver as a module, choose M here: the
           module will be called dl2k.
diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index cf0a5fcdaaaf..ccca4799c27b 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -253,6 +253,19 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_out_unmap_rx;
 
+        if (np->chip_id == CHIP_IP1000A &&
+            (np->pdev->revision == 0x40 || np->pdev->revision == 0x41)) {
+                /* PHY magic taken from ipg driver, undocumented registers */
+                mii_write(dev, np->phy_addr, 31, 0x0001);
+                mii_write(dev, np->phy_addr, 27, 0x01e0);
+                mii_write(dev, np->phy_addr, 31, 0x0002);
+                mii_write(dev, np->phy_addr, 27, 0xeb8e);
+                mii_write(dev, np->phy_addr, 31, 0x0000);
+                mii_write(dev, np->phy_addr, 30, 0x005e);
+                /* advertise 1000BASE-T half & full duplex, prefer MASTER */
+                mii_write(dev, np->phy_addr, MII_CTRL1000, 0x0700);
+        }
+
         /* Fiber device? */
         np->phy_media = (dr16(ASICCtrl) & PhyMedia) ? 1 : 0;
         np->link_status = 0;
@@ -361,6 +374,11 @@ parse_eeprom (struct net_device *dev)
         for (i = 0; i < 6; i++)
                 dev->dev_addr[i] = psrom->mac_addr[i];
 
+        if (np->chip_id == CHIP_IP1000A) {
+                np->led_mode = psrom->led_mode;
+                return 0;
+        }
+
         if (np->pdev->vendor != PCI_VENDOR_ID_DLINK) {
                 return 0;
         }
@@ -406,6 +424,28 @@ parse_eeprom (struct net_device *dev)
         return 0;
 }
 
+static void rio_set_led_mode(struct net_device *dev)
+{
+        struct netdev_private *np = netdev_priv(dev);
+        void __iomem *ioaddr = np->ioaddr;
+        u32 mode;
+
+        if (np->chip_id != CHIP_IP1000A)
+                return;
+
+        mode = dr32(ASICCtrl);
+        mode &= ~(IPG_AC_LED_MODE_BIT_1 | IPG_AC_LED_MODE | IPG_AC_LED_SPEED);
+
+        if (np->led_mode & 0x01)
+                mode |= IPG_AC_LED_MODE;
+        if (np->led_mode & 0x02)
+                mode |= IPG_AC_LED_MODE_BIT_1;
+        if (np->led_mode & 0x08)
+                mode |= IPG_AC_LED_SPEED;
+
+        dw32(ASICCtrl, mode);
+}
+
 static int
 rio_open (struct net_device *dev)
 {
@@ -424,6 +464,8 @@ rio_open (struct net_device *dev)
              GlobalReset | DMAReset | FIFOReset | NetworkReset | HostReset);
         mdelay(10);
 
+        rio_set_led_mode(dev);
+
         /* DebugCtrl bit 4, 5, 9 must set */
         dw32(DebugCtrl, dr32(DebugCtrl) | 0x0230);
 
@@ -433,9 +475,13 @@ rio_open (struct net_device *dev)
 
         alloc_list (dev);
 
-        /* Get station address */
-        for (i = 0; i < 6; i++)
-                dw8(StationAddr0 + i, dev->dev_addr[i]);
+        /* Set station address */
+        /* 16 or 32-bit access is required by TC9020 datasheet but 8-bit works
+         * too. However, it doesn't work on IP1000A so we use 16-bit access.
+         */
+        for (i = 0; i < 3; i++)
+                dw16(StationAddr0 + 2 * i,
+                     cpu_to_le16(((u16 *)dev->dev_addr)[i]));
 
         set_multicast (dev);
         if (np->coalesce) {
@@ -780,6 +826,7 @@ tx_error (struct net_device *dev, int tx_status)
                                 break;
                         mdelay (1);
                 }
+                rio_set_led_mode(dev);
                 rio_free_tx (dev, 1);
                 /* Reset TFDListPtr */
                 dw32(TFDListPtr0, np->tx_ring_dma +
@@ -799,6 +846,7 @@ tx_error (struct net_device *dev, int tx_status)
                                 break;
                         mdelay (1);
                 }
+                rio_set_led_mode(dev);
                 /* Let TxStartThresh stay default value */
         }
         /* Maximum Collisions */
@@ -965,6 +1013,7 @@ rio_error (struct net_device *dev, int int_status)
                         dev->name, int_status);
                 dw16(ASICCtrl + 2, GlobalReset | HostReset);
                 mdelay (500);
+                rio_set_led_mode(dev);
         }
 }
 
diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
index 23c07b007069..8f4f61262d5c 100644
--- a/drivers/net/ethernet/dlink/dl2k.h
+++ b/drivers/net/ethernet/dlink/dl2k.h
@@ -211,6 +211,10 @@ enum ASICCtrl_HiWord_bits {
         ResetBusy = 0x0400,
 };
 
+#define IPG_AC_LED_MODE         BIT(14)
+#define IPG_AC_LED_SPEED        BIT(27)
+#define IPG_AC_LED_MODE_BIT_1   BIT(29)
+
 /* Transmit Frame Control bits */
 enum TFC_bits {
         DwordAlign = 0x00000000,
@@ -332,7 +336,10 @@ typedef struct t_SROM {
         u16 asic_ctrl;          /* 0x02 */
         u16 sub_vendor_id;      /* 0x04 */
         u16 sub_system_id;      /* 0x06 */
-        u16 reserved1[12];      /* 0x08-0x1f */
+        u16 pci_base_1;         /* 0x08 (IP1000A only) */
+        u16 pci_base_2;         /* 0x0a (IP1000A only) */
+        u16 led_mode;           /* 0x0c (IP1000A only) */
+        u16 reserved1[9];       /* 0x0e-0x1f */
         u8 mac_addr[6];         /* 0x20-0x25 */
         u8 reserved2[10];       /* 0x26-0x2f */
         u8 sib[204];            /* 0x30-0xfb */
@@ -397,6 +404,7 @@ struct netdev_private {
         u16 advertising;        /* NWay media advertisement */
         u16 negotiate;          /* Negotiated media */
         int phy_addr;           /* PHY addresses. */
+        u16 led_mode;           /* LED mode read from EEPROM (IP1000A only) */
 };
 
 /* The station address location in the EEPROM. */
@@ -407,10 +415,15 @@ struct netdev_private {
         class_mask              of the class are honored during the comparison.
         driver_data             Data private to the driver.
 */
+#define CHIP_IP1000A    1
 
 static const struct pci_device_id rio_pci_tbl[] = {
         {0x1186, 0x4000, PCI_ANY_ID, PCI_ANY_ID, },
         {0x13f0, 0x1021, PCI_ANY_ID, PCI_ANY_ID, },
+        { PCI_VDEVICE(SUNDANCE, 0x1023), CHIP_IP1000A },
+        { PCI_VDEVICE(SUNDANCE, 0x2021), CHIP_IP1000A },
+        { PCI_VDEVICE(DLINK,    0x9021), CHIP_IP1000A },
+        { PCI_VDEVICE(DLINK,    0x4020), CHIP_IP1000A },
         { }
 };
 MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
index f4cb8e425853..734f655c99c1 100644
--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
@@ -1062,9 +1062,7 @@ static int be_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
 static int be_set_rss_hash_opts(struct be_adapter *adapter,
                                 struct ethtool_rxnfc *cmd)
 {
-        struct be_rx_obj *rxo;
-        int status = 0, i, j;
-        u8 rsstable[128];
+        int status;
         u32 rss_flags = adapter->rss_info.rss_flags;
 
         if (cmd->data != L3_RSS_FLAGS &&
@@ -1113,20 +1111,11 @@ static int be_set_rss_hash_opts(struct be_adapter *adapter,
         }
 
         if (rss_flags == adapter->rss_info.rss_flags)
-                return status;
-
-        if (be_multi_rxq(adapter)) {
-                for (j = 0; j < 128; j += adapter->num_rss_qs) {
-                        for_all_rss_queues(adapter, rxo, i) {
-                                if ((j + i) >= 128)
-                                        break;
-                                rsstable[j + i] = rxo->rss_id;
-                        }
-                }
-        }
+                return 0;
 
         status = be_cmd_rss_config(adapter, adapter->rss_info.rsstable,
-                                   rss_flags, 128, adapter->rss_info.rss_hkey);
+                                   rss_flags, RSS_INDIR_TABLE_LEN,
+                                   adapter->rss_info.rss_hkey);
         if (!status)
                 adapter->rss_info.rss_flags = rss_flags;
 
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index eb48a977f8da..b6ad02909d6b 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3518,7 +3518,7 @@ static int be_rx_qs_create(struct be_adapter *adapter)
 
         netdev_rss_key_fill(rss_key, RSS_HASH_KEY_LEN);
         rc = be_cmd_rss_config(adapter, rss->rsstable, rss->rss_flags,
-                               128, rss_key);
+                               RSS_INDIR_TABLE_LEN, rss_key);
         if (rc) {
                 rss->rss_flags = RSS_ENABLE_NONE;
                 return rc;
diff --git a/drivers/net/ethernet/icplus/Kconfig b/drivers/net/ethernet/icplus/Kconfig
deleted file mode 100644
index 14a66e9d2e26..000000000000
--- a/drivers/net/ethernet/icplus/Kconfig
+++ /dev/null
@@ -1,13 +0,0 @@
-#
-# IC Plus device configuration
-#
-
-config IP1000
-        tristate "IP1000 Gigabit Ethernet support"
-        depends on PCI
-        select MII
-        ---help---
-          This driver supports IP1000 gigabit Ethernet cards.
-
-          To compile this driver as a module, choose M here: the module
-          will be called ipg.  This is recommended.
diff --git a/drivers/net/ethernet/icplus/Makefile b/drivers/net/ethernet/icplus/Makefile
deleted file mode 100644
index 5bc87c1f36aa..000000000000
--- a/drivers/net/ethernet/icplus/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# Makefile for the IC Plus device drivers
-#
-
-obj-$(CONFIG_IP1000) += ipg.o
diff --git a/drivers/net/ethernet/icplus/ipg.c b/drivers/net/ethernet/icplus/ipg.c
deleted file mode 100644
index c3b6af83f070..000000000000
--- a/drivers/net/ethernet/icplus/ipg.c
+++ /dev/null
@@ -1,2300 +0,0 @@
-/*
- * ipg.c: Device Driver for the IP1000 Gigabit Ethernet Adapter
- *
- * Copyright (C) 2003, 2007  IC Plus Corp
- *
- * Original Author:
- *
- *   Craig Rich
- *   Sundance Technology, Inc.
- *   www.sundanceti.com
- *   craig_rich@sundanceti.com
- *
- * Current Maintainer:
- *
- *   Sorbica Shieh.
- *   http://www.icplus.com.tw
- *   sorbica@icplus.com.tw
- *
- *   Jesse Huang
- *   http://www.icplus.com.tw
- *   jesse@icplus.com.tw
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/crc32.h>
-#include <linux/ethtool.h>
-#include <linux/interrupt.h>
-#include <linux/gfp.h>
-#include <linux/mii.h>
-#include <linux/mutex.h>
-
-#include <asm/div64.h>
-
-#define IPG_RX_RING_BYTES       (sizeof(struct ipg_rx) * IPG_RFDLIST_LENGTH)
-#define IPG_TX_RING_BYTES       (sizeof(struct ipg_tx) * IPG_TFDLIST_LENGTH)
-#define IPG_RESET_MASK \
-        (IPG_AC_GLOBAL_RESET | IPG_AC_RX_RESET | IPG_AC_TX_RESET | \
-         IPG_AC_DMA | IPG_AC_FIFO | IPG_AC_NETWORK | IPG_AC_HOST | \
-         IPG_AC_AUTO_INIT)
-
-#define ipg_w32(val32, reg)     iowrite32((val32), ioaddr + (reg))
-#define ipg_w16(val16, reg)     iowrite16((val16), ioaddr + (reg))
-#define ipg_w8(val8, reg)       iowrite8((val8), ioaddr + (reg))
-
-#define ipg_r32(reg)            ioread32(ioaddr + (reg))
-#define ipg_r16(reg)            ioread16(ioaddr + (reg))
-#define ipg_r8(reg)             ioread8(ioaddr + (reg))
-
-enum {
-        netdev_io_size = 128
-};
-
-#include "ipg.h"
-#define DRV_NAME        "ipg"
-
-MODULE_AUTHOR("IC Plus Corp. 2003");
-MODULE_DESCRIPTION("IC Plus IP1000 Gigabit Ethernet Adapter Linux Driver");
-MODULE_LICENSE("GPL");
-
-/*
- * Defaults
- */
-#define IPG_MAX_RXFRAME_SIZE    0x0600
-#define IPG_RXFRAG_SIZE         0x0600
-#define IPG_RXSUPPORT_SIZE      0x0600
-#define IPG_IS_JUMBO            false
-
-/*
- * Variable record -- index by leading revision/length
- * Revision/Length(=N*4), Address1, Data1, Address2, Data2,...,AddressN,DataN
- */
-static const unsigned short DefaultPhyParam[] = {
-        /* 11/12/03 IP1000A v1-3 rev=0x40 */
-        /*--------------------------------------------------------------------------
-        (0x4000|(15*4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 22, 0x85bd, 24, 0xfff2,
-                                 27, 0x0c10, 28, 0x0c10, 29, 0x2c10, 31, 0x0003, 23, 0x92f6,
-                                 31, 0x0000, 23, 0x003d, 30, 0x00de, 20, 0x20e7,  9, 0x0700,
-          --------------------------------------------------------------------------*/
-        /* 12/17/03 IP1000A v1-4 rev=0x40 */
-        (0x4000 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
-            0x0000,
-        30, 0x005e, 9, 0x0700,
-        /* 01/09/04 IP1000A v1-5 rev=0x41 */
-        (0x4100 | (07 * 4)), 31, 0x0001, 27, 0x01e0, 31, 0x0002, 27, 0xeb8e, 31,
-            0x0000,
-        30, 0x005e, 9, 0x0700,
-        0x0000
-};
-
-static const char * const ipg_brand_name[] = {
-        "IC PLUS IP1000 1000/100/10 based NIC",
-        "Sundance Technology ST2021 based NIC",
-        "Tamarack Microelectronics TC9020/9021 based NIC",
-        "D-Link NIC IP1000A"
-};
-
-static const struct pci_device_id ipg_pci_tbl[] = {
-        { PCI_VDEVICE(SUNDANCE, 0x1023), 0 },
-        { PCI_VDEVICE(SUNDANCE, 0x2021), 1 },
-        { PCI_VDEVICE(DLINK,    0x9021), 2 },
-        { PCI_VDEVICE(DLINK,    0x4020), 3 },
-        { 0, }
-};
-
-MODULE_DEVICE_TABLE(pci, ipg_pci_tbl);
-
-static inline void __iomem *ipg_ioaddr(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        return sp->ioaddr;
-}
-
-#ifdef IPG_DEBUG
-static void ipg_dump_rfdlist(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-        u32 offset;
-
-        IPG_DEBUG_MSG("_dump_rfdlist\n");
-
-        netdev_info(dev, "rx_current = %02x\n", sp->rx_current);
-        netdev_info(dev, "rx_dirty   = %02x\n", sp->rx_dirty);
-        netdev_info(dev, "RFDList start address = %016lx\n",
-                    (unsigned long)sp->rxd_map);
-        netdev_info(dev, "RFDListPtr register   = %08x%08x\n",
-                    ipg_r32(IPG_RFDLISTPTR1), ipg_r32(IPG_RFDLISTPTR0));
-
-        for (i = 0; i < IPG_RFDLIST_LENGTH; i++) {
-                offset = (u32) &sp->rxd[i].next_desc - (u32) sp->rxd;
-                netdev_info(dev, "%02x %04x RFDNextPtr = %016lx\n",
-                            i, offset, (unsigned long)sp->rxd[i].next_desc);
-                offset = (u32) &sp->rxd[i].rfs - (u32) sp->rxd;
-                netdev_info(dev, "%02x %04x RFS        = %016lx\n",
-                            i, offset, (unsigned long)sp->rxd[i].rfs);
-                offset = (u32) &sp->rxd[i].frag_info - (u32) sp->rxd;
-                netdev_info(dev, "%02x %04x frag_info   = %016lx\n",
-                            i, offset, (unsigned long)sp->rxd[i].frag_info);
-        }
-}
-
-static void ipg_dump_tfdlist(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-        u32 offset;
-
-        IPG_DEBUG_MSG("_dump_tfdlist\n");
-
-        netdev_info(dev, "tx_current         = %02x\n", sp->tx_current);
-        netdev_info(dev, "tx_dirty = %02x\n", sp->tx_dirty);
-        netdev_info(dev, "TFDList start address = %016lx\n",
-                    (unsigned long) sp->txd_map);
-        netdev_info(dev, "TFDListPtr register   = %08x%08x\n",
-                    ipg_r32(IPG_TFDLISTPTR1), ipg_r32(IPG_TFDLISTPTR0));
-
-        for (i = 0; i < IPG_TFDLIST_LENGTH; i++) {
-                offset = (u32) &sp->txd[i].next_desc - (u32) sp->txd;
-                netdev_info(dev, "%02x %04x TFDNextPtr = %016lx\n",
-                            i, offset, (unsigned long)sp->txd[i].next_desc);
-
-                offset = (u32) &sp->txd[i].tfc - (u32) sp->txd;
-                netdev_info(dev, "%02x %04x TFC        = %016lx\n",
-                            i, offset, (unsigned long) sp->txd[i].tfc);
-                offset = (u32) &sp->txd[i].frag_info - (u32) sp->txd;
-                netdev_info(dev, "%02x %04x frag_info   = %016lx\n",
-                            i, offset, (unsigned long) sp->txd[i].frag_info);
-        }
-}
-#endif
-
-static void ipg_write_phy_ctl(void __iomem *ioaddr, u8 data)
-{
-        ipg_w8(IPG_PC_RSVD_MASK & data, PHY_CTRL);
-        ndelay(IPG_PC_PHYCTRLWAIT_NS);
-}
-
-static void ipg_drive_phy_ctl_low_high(void __iomem *ioaddr, u8 data)
-{
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_LO | data);
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_HI | data);
-}
-
-static void send_three_state(void __iomem *ioaddr, u8 phyctrlpolarity)
-{
-        phyctrlpolarity |= (IPG_PC_MGMTDATA & 0) | IPG_PC_MGMTDIR;
-
-        ipg_drive_phy_ctl_low_high(ioaddr, phyctrlpolarity);
-}
-
-static void send_end(void __iomem *ioaddr, u8 phyctrlpolarity)
-{
-        ipg_w8((IPG_PC_MGMTCLK_LO | (IPG_PC_MGMTDATA & 0) | IPG_PC_MGMTDIR |
-                phyctrlpolarity) & IPG_PC_RSVD_MASK, PHY_CTRL);
-}
-
-static u16 read_phy_bit(void __iomem *ioaddr, u8 phyctrlpolarity)
-{
-        u16 bit_data;
-
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_LO | phyctrlpolarity);
-
-        bit_data = ((ipg_r8(PHY_CTRL) & IPG_PC_MGMTDATA) >> 1) & 1;
-
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_HI | phyctrlpolarity);
-
-        return bit_data;
-}
-
-/*
- * Read a register from the Physical Layer device located
- * on the IPG NIC, using the IPG PHYCTRL register.
- */
-static int mdio_read(struct net_device *dev, int phy_id, int phy_reg)
-{
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        /*
-         * The GMII mangement frame structure for a read is as follows:
-         *
-         * |Preamble|st|op|phyad|regad|ta|      data      |idle|
-         * |< 32 1s>|01|10|AAAAA|RRRRR|z0|DDDDDDDDDDDDDDDD|z   |
-         *
-         * <32 1s> = 32 consecutive logic 1 values
-         * A = bit of Physical Layer device address (MSB first)
-         * R = bit of register address (MSB first)
-         * z = High impedance state
-         * D = bit of read data (MSB first)
-         *
-         * Transmission order is 'Preamble' field first, bits transmitted
-         * left to right (first to last).
-         */
-        struct {
-                u32 field;
-                unsigned int len;
-        } p[] = {
-                { GMII_PREAMBLE,        32 },   /* Preamble */
-                { GMII_ST,              2  },   /* ST */
-                { GMII_READ,            2  },   /* OP */
-                { phy_id,               5  },   /* PHYAD */
-                { phy_reg,              5  },   /* REGAD */
-                { 0x0000,               2  },   /* TA */
-                { 0x0000,               16 },   /* DATA */
-                { 0x0000,               1  }    /* IDLE */
-        };
-        unsigned int i, j;
-        u8 polarity, data;
-
-        polarity  = ipg_r8(PHY_CTRL);
-        polarity &= (IPG_PC_DUPLEX_POLARITY | IPG_PC_LINK_POLARITY);
-
-        /* Create the Preamble, ST, OP, PHYAD, and REGAD field. */
-        for (j = 0; j < 5; j++) {
-                for (i = 0; i < p[j].len; i++) {
-                        /* For each variable length field, the MSB must be
-                         * transmitted first. Rotate through the field bits,
-                         * starting with the MSB, and move each bit into the
-                         * the 1st (2^1) bit position (this is the bit position
-                         * corresponding to the MgmtData bit of the PhyCtrl
-                         * register for the IPG).
-                         *
-                         * Example: ST = 01;
-                         *
-                         *          First write a '0' to bit 1 of the PhyCtrl
-                         *          register, then write a '1' to bit 1 of the
-                         *          PhyCtrl register.
-                         *
-                         * To do this, right shift the MSB of ST by the value:
-                         * [field length - 1 - #ST bits already written]
-                         * then left shift this result by 1.
-                         */
-                        data  = (p[j].field >> (p[j].len - 1 - i)) << 1;
-                        data &= IPG_PC_MGMTDATA;
-                        data |= polarity | IPG_PC_MGMTDIR;
-
-                        ipg_drive_phy_ctl_low_high(ioaddr, data);
-                }
-        }
-
-        send_three_state(ioaddr, polarity);
-
-        read_phy_bit(ioaddr, polarity);
-
-        /*
-         * For a read cycle, the bits for the next two fields (TA and
-         * DATA) are driven by the PHY (the IPG reads these bits).
-         */
-        for (i = 0; i < p[6].len; i++) {
-                p[6].field |=
-                    (read_phy_bit(ioaddr, polarity) << (p[6].len - 1 - i));
-        }
-
-        send_three_state(ioaddr, polarity);
-        send_three_state(ioaddr, polarity);
-        send_three_state(ioaddr, polarity);
-        send_end(ioaddr, polarity);
-
-        /* Return the value of the DATA field. */
-        return p[6].field;
-}
-
-/*
- * Write to a register from the Physical Layer device located
- * on the IPG NIC, using the IPG PHYCTRL register.
- */
-static void mdio_write(struct net_device *dev, int phy_id, int phy_reg, int val)
-{
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        /*
-         * The GMII mangement frame structure for a read is as follows:
-         *
-         * |Preamble|st|op|phyad|regad|ta|      data      |idle|
-         * |< 32 1s>|01|10|AAAAA|RRRRR|z0|DDDDDDDDDDDDDDDD|z   |
-         *
-         * <32 1s> = 32 consecutive logic 1 values
-         * A = bit of Physical Layer device address (MSB first)
-         * R = bit of register address (MSB first)
-         * z = High impedance state
-         * D = bit of write data (MSB first)
-         *
-         * Transmission order is 'Preamble' field first, bits transmitted
-         * left to right (first to last).
-         */
-        struct {
-                u32 field;
-                unsigned int len;
-        } p[] = {
-                { GMII_PREAMBLE,        32 },   /* Preamble */
-                { GMII_ST,              2  },   /* ST */
-                { GMII_WRITE,           2  },   /* OP */
-                { phy_id,               5  },   /* PHYAD */
-                { phy_reg,              5  },   /* REGAD */
-                { 0x0002,               2  },   /* TA */
-                { val & 0xffff,         16 },   /* DATA */
-                { 0x0000,               1  }    /* IDLE */
-        };
-        unsigned int i, j;
-        u8 polarity, data;
-
-        polarity  = ipg_r8(PHY_CTRL);
-        polarity &= (IPG_PC_DUPLEX_POLARITY | IPG_PC_LINK_POLARITY);
-
-        /* Create the Preamble, ST, OP, PHYAD, and REGAD field. */
-        for (j = 0; j < 7; j++) {
-                for (i = 0; i < p[j].len; i++) {
-                        /* For each variable length field, the MSB must be
-                         * transmitted first. Rotate through the field bits,
-                         * starting with the MSB, and move each bit into the
-                         * the 1st (2^1) bit position (this is the bit position
-                         * corresponding to the MgmtData bit of the PhyCtrl
-                         * register for the IPG).
-                         *
-                         * Example: ST = 01;
-                         *
-                         *          First write a '0' to bit 1 of the PhyCtrl
-                         *          register, then write a '1' to bit 1 of the
-                         *          PhyCtrl register.
-                         *
-                         * To do this, right shift the MSB of ST by the value:
-                         * [field length - 1 - #ST bits already written]
-                         * then left shift this result by 1.
-                         */
-                        data  = (p[j].field >> (p[j].len - 1 - i)) << 1;
-                        data &= IPG_PC_MGMTDATA;
-                        data |= polarity | IPG_PC_MGMTDIR;
-
-                        ipg_drive_phy_ctl_low_high(ioaddr, data);
-                }
-        }
-
-        /* The last cycle is a tri-state, so read from the PHY. */
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_LO | polarity);
-        ipg_r8(PHY_CTRL);
-        ipg_write_phy_ctl(ioaddr, IPG_PC_MGMTCLK_HI | polarity);
-}
-
-static void ipg_set_led_mode(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        u32 mode;
-
-        mode = ipg_r32(ASIC_CTRL);
-        mode &= ~(IPG_AC_LED_MODE_BIT_1 | IPG_AC_LED_MODE | IPG_AC_LED_SPEED);
-
-        if ((sp->led_mode & 0x03) > 1)
-                mode |= IPG_AC_LED_MODE_BIT_1;  /* Write Asic Control Bit 29 */
-
-        if ((sp->led_mode & 0x01) == 1)
-                mode |= IPG_AC_LED_MODE;        /* Write Asic Control Bit 14 */
-
-        if ((sp->led_mode & 0x08) == 8)
-                mode |= IPG_AC_LED_SPEED;       /* Write Asic Control Bit 27 */
-
-        ipg_w32(mode, ASIC_CTRL);
-}
-
-static void ipg_set_phy_set(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        int physet;
-
-        physet = ipg_r8(PHY_SET);
-        physet &= ~(IPG_PS_MEM_LENB9B | IPG_PS_MEM_LEN9 | IPG_PS_NON_COMPDET);
-        physet |= ((sp->led_mode & 0x70) >> 4);
-        ipg_w8(physet, PHY_SET);
-}
-
-static int ipg_reset(struct net_device *dev, u32 resetflags)
-{
-        /* Assert functional resets via the IPG AsicCtrl
-         * register as specified by the 'resetflags' input
-         * parameter.
-         */
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        unsigned int timeout_count = 0;
-
-        IPG_DEBUG_MSG("_reset\n");
-
-        ipg_w32(ipg_r32(ASIC_CTRL) | resetflags, ASIC_CTRL);
-
-        /* Delay added to account for problem with 10Mbps reset. */
-        mdelay(IPG_AC_RESETWAIT);
-
-        while (IPG_AC_RESET_BUSY & ipg_r32(ASIC_CTRL)) {
-                mdelay(IPG_AC_RESETWAIT);
-                if (++timeout_count > IPG_AC_RESET_TIMEOUT)
-                        return -ETIME;
-        }
-        /* Set LED Mode in Asic Control */
-        ipg_set_led_mode(dev);
-
-        /* Set PHYSet Register Value */
-        ipg_set_phy_set(dev);
-        return 0;
-}
-
-/* Find the GMII PHY address. */
-static int ipg_find_phyaddr(struct net_device *dev)
-{
-        unsigned int phyaddr, i;
-
-        for (i = 0; i < 32; i++) {
-                u32 status;
-
-                /* Search for the correct PHY address among 32 possible. */
-                phyaddr = (IPG_NIC_PHY_ADDRESS + i) % 32;
-
-                /* 10/22/03 Grace change verify from GMII_PHY_STATUS to
-                   GMII_PHY_ID1
-                 */
-
-                status = mdio_read(dev, phyaddr, MII_BMSR);
-
-                if ((status != 0xFFFF) && (status != 0))
-                        return phyaddr;
-        }
-
-        return 0x1f;
-}
-
-/*
- * Configure IPG based on result of IEEE 802.3 PHY
- * auto-negotiation.
- */
-static int ipg_config_autoneg(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int txflowcontrol;
-        unsigned int rxflowcontrol;
-        unsigned int fullduplex;
-        u32 mac_ctrl_val;
-        u32 asicctrl;
-        u8 phyctrl;
-        const char *speed;
-        const char *duplex;
-        const char *tx_desc;
-        const char *rx_desc;
-
-        IPG_DEBUG_MSG("_config_autoneg\n");
-
-        asicctrl = ipg_r32(ASIC_CTRL);
-        phyctrl = ipg_r8(PHY_CTRL);
-        mac_ctrl_val = ipg_r32(MAC_CTRL);
-
-        /* Set flags for use in resolving auto-negotiation, assuming
-         * non-1000Mbps, half duplex, no flow control.
-         */
-        fullduplex = 0;
-        txflowcontrol = 0;
-        rxflowcontrol = 0;
-
-        /* To accommodate a problem in 10Mbps operation,
-         * set a global flag if PHY running in 10Mbps mode.
-         */
-        sp->tenmbpsmode = 0;
-
-        /* Determine actual speed of operation. */
-        switch (phyctrl & IPG_PC_LINK_SPEED) {
-        case IPG_PC_LINK_SPEED_10MBPS:
-                speed = "10Mbps";
-                sp->tenmbpsmode = 1;
-                break;
-        case IPG_PC_LINK_SPEED_100MBPS:
-                speed = "100Mbps";
-                break;
-        case IPG_PC_LINK_SPEED_1000MBPS:
-                speed = "1000Mbps";
-                break;
-        default:
-                speed = "undefined!";
-                return 0;
-        }
-
-        netdev_info(dev, "Link speed = %s\n", speed);
-        if (sp->tenmbpsmode == 1)
-                netdev_info(dev, "10Mbps operational mode enabled\n");
-
-        if (phyctrl & IPG_PC_DUPLEX_STATUS) {
-                fullduplex = 1;
-                txflowcontrol = 1;
-                rxflowcontrol = 1;
-        }
-
-        /* Configure full duplex, and flow control. */
-        if (fullduplex == 1) {
-
-                /* Configure IPG for full duplex operation. */
-
-                duplex = "full";
-
-                mac_ctrl_val |= IPG_MC_DUPLEX_SELECT_FD;
-
-                if (txflowcontrol == 1) {
-                        tx_desc  = "";
-                        mac_ctrl_val |= IPG_MC_TX_FLOW_CONTROL_ENABLE;
-                } else {
-                        tx_desc = "no ";
-                        mac_ctrl_val &= ~IPG_MC_TX_FLOW_CONTROL_ENABLE;
-                }
-
-                if (rxflowcontrol == 1) {
-                        rx_desc = "";
-                        mac_ctrl_val |= IPG_MC_RX_FLOW_CONTROL_ENABLE;
-                } else {
-                        rx_desc = "no ";
-                        mac_ctrl_val &= ~IPG_MC_RX_FLOW_CONTROL_ENABLE;
-                }
-        } else {
-                duplex = "half";
-                tx_desc = "no ";
-                rx_desc = "no ";
-                mac_ctrl_val &= (~IPG_MC_DUPLEX_SELECT_FD &
-                                 ~IPG_MC_TX_FLOW_CONTROL_ENABLE &
-                                 ~IPG_MC_RX_FLOW_CONTROL_ENABLE);
-        }
-
-        netdev_info(dev, "setting %s duplex, %sTX, %sRX flow control\n",
-                    duplex, tx_desc, rx_desc);
-        ipg_w32(mac_ctrl_val, MAC_CTRL);
-
-        return 0;
-}
-
-/* Determine and configure multicast operation and set
- * receive mode for IPG.
- */
-static void ipg_nic_set_multicast_list(struct net_device *dev)
-{
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        struct netdev_hw_addr *ha;
-        unsigned int hashindex;
-        u32 hashtable[2];
-        u8 receivemode;
-
-        IPG_DEBUG_MSG("_nic_set_multicast_list\n");
-
-        receivemode = IPG_RM_RECEIVEUNICAST | IPG_RM_RECEIVEBROADCAST;
-
-        if (dev->flags & IFF_PROMISC) {
-                /* NIC to be configured in promiscuous mode. */
-                receivemode = IPG_RM_RECEIVEALLFRAMES;
-        } else if ((dev->flags & IFF_ALLMULTI) ||
-                   ((dev->flags & IFF_MULTICAST) &&
-                    (netdev_mc_count(dev) > IPG_MULTICAST_HASHTABLE_SIZE))) {
-                /* NIC to be configured to receive all multicast
-                 * frames. */
-                receivemode |= IPG_RM_RECEIVEMULTICAST;
-        } else if ((dev->flags & IFF_MULTICAST) && !netdev_mc_empty(dev)) {
-                /* NIC to be configured to receive selected
-                 * multicast addresses. */
-                receivemode |= IPG_RM_RECEIVEMULTICASTHASH;
-        }
-
-        /* Calculate the bits to set for the 64 bit, IPG HASHTABLE.
-         * The IPG applies a cyclic-redundancy-check (the same CRC
-         * used to calculate the frame data FCS) to the destination
-         * address all incoming multicast frames whose destination
-         * address has the multicast bit set. The least significant
-         * 6 bits of the CRC result are used as an addressing index
-         * into the hash table. If the value of the bit addressed by
-         * this index is a 1, the frame is passed to the host system.
-         */
-
-        /* Clear hashtable. */
-        hashtable[0] = 0x00000000;
-        hashtable[1] = 0x00000000;
-
-        /* Cycle through all multicast addresses to filter. */
-        netdev_for_each_mc_addr(ha, dev) {
-                /* Calculate CRC result for each multicast address. */
-                hashindex = crc32_le(0xffffffff, ha->addr,
-                                     ETH_ALEN);
-
-                /* Use only the least significant 6 bits. */
-                hashindex = hashindex & 0x3F;
-
-                /* Within "hashtable", set bit number "hashindex"
-                 * to a logic 1.
-                 */
-                set_bit(hashindex, (void *)hashtable);
-        }
-
-        /* Write the value of the hashtable, to the 4, 16 bit
-         * HASHTABLE IPG registers.
-         */
-        ipg_w32(hashtable[0], HASHTABLE_0);
-        ipg_w32(hashtable[1], HASHTABLE_1);
-
-        ipg_w8(IPG_RM_RSVD_MASK & receivemode, RECEIVE_MODE);
-
-        IPG_DEBUG_MSG("ReceiveMode = %x\n", ipg_r8(RECEIVE_MODE));
-}
-
-static int ipg_io_config(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        u32 origmacctrl;
-        u32 restoremacctrl;
-
-        IPG_DEBUG_MSG("_io_config\n");
-
-        origmacctrl = ipg_r32(MAC_CTRL);
-
-        restoremacctrl = origmacctrl | IPG_MC_STATISTICS_ENABLE;
-
-        /* Based on compilation option, determine if FCS is to be
-         * stripped on receive frames by IPG.
-         */
-        if (!IPG_STRIP_FCS_ON_RX)
-                restoremacctrl |= IPG_MC_RCV_FCS;
-
-        /* Determine if transmitter and/or receiver are
-         * enabled so we may restore MACCTRL correctly.
-         */
-        if (origmacctrl & IPG_MC_TX_ENABLED)
-                restoremacctrl |= IPG_MC_TX_ENABLE;
-
-        if (origmacctrl & IPG_MC_RX_ENABLED)
-                restoremacctrl |= IPG_MC_RX_ENABLE;
-
-        /* Transmitter and receiver must be disabled before setting
-         * IFSSelect.
-         */
-        ipg_w32((origmacctrl & (IPG_MC_RX_DISABLE | IPG_MC_TX_DISABLE)) &
-                IPG_MC_RSVD_MASK, MAC_CTRL);
-
-        /* Now that transmitter and receiver are disabled, write
-         * to IFSSelect.
-         */
-        ipg_w32((origmacctrl & IPG_MC_IFS_96BIT) & IPG_MC_RSVD_MASK, MAC_CTRL);
-
-        /* Set RECEIVEMODE register. */
-        ipg_nic_set_multicast_list(dev);
-
-        ipg_w16(sp->max_rxframe_size, MAX_FRAME_SIZE);
-
-        ipg_w8(IPG_RXDMAPOLLPERIOD_VALUE,   RX_DMA_POLL_PERIOD);
-        ipg_w8(IPG_RXDMAURGENTTHRESH_VALUE, RX_DMA_URGENT_THRESH);
-        ipg_w8(IPG_RXDMABURSTTHRESH_VALUE,  RX_DMA_BURST_THRESH);
-        ipg_w8(IPG_TXDMAPOLLPERIOD_VALUE,   TX_DMA_POLL_PERIOD);
-        ipg_w8(IPG_TXDMAURGENTTHRESH_VALUE, TX_DMA_URGENT_THRESH);
-        ipg_w8(IPG_TXDMABURSTTHRESH_VALUE,  TX_DMA_BURST_THRESH);
-        ipg_w16((IPG_IE_HOST_ERROR | IPG_IE_TX_DMA_COMPLETE |
-                 IPG_IE_TX_COMPLETE | IPG_IE_INT_REQUESTED |
-                 IPG_IE_UPDATE_STATS | IPG_IE_LINK_EVENT |
-                 IPG_IE_RX_DMA_COMPLETE | IPG_IE_RX_DMA_PRIORITY), INT_ENABLE);
-        ipg_w16(IPG_FLOWONTHRESH_VALUE,  FLOW_ON_THRESH);
-        ipg_w16(IPG_FLOWOFFTHRESH_VALUE, FLOW_OFF_THRESH);
-
-        /* IPG multi-frag frame bug workaround.
-         * Per silicon revision B3 eratta.
-         */
-        ipg_w16(ipg_r16(DEBUG_CTRL) | 0x0200, DEBUG_CTRL);
-
-        /* IPG TX poll now bug workaround.
-         * Per silicon revision B3 eratta.
-         */
-        ipg_w16(ipg_r16(DEBUG_CTRL) | 0x0010, DEBUG_CTRL);
-
-        /* IPG RX poll now bug workaround.
-         * Per silicon revision B3 eratta.
-         */
-        ipg_w16(ipg_r16(DEBUG_CTRL) | 0x0020, DEBUG_CTRL);
-
-        /* Now restore MACCTRL to original setting. */
-        ipg_w32(IPG_MC_RSVD_MASK & restoremacctrl, MAC_CTRL);
-
-        /* Disable unused RMON statistics. */
-        ipg_w32(IPG_RZ_ALL, RMON_STATISTICS_MASK);
-
-        /* Disable unused MIB statistics. */
-        ipg_w32(IPG_SM_MACCONTROLFRAMESXMTD | IPG_SM_MACCONTROLFRAMESRCVD |
-                IPG_SM_BCSTOCTETXMTOK_BCSTFRAMESXMTDOK | IPG_SM_TXJUMBOFRAMES |
-                IPG_SM_MCSTOCTETXMTOK_MCSTFRAMESXMTDOK | IPG_SM_RXJUMBOFRAMES |
-                IPG_SM_BCSTOCTETRCVDOK_BCSTFRAMESRCVDOK |
-                IPG_SM_UDPCHECKSUMERRORS | IPG_SM_TCPCHECKSUMERRORS |
-                IPG_SM_IPCHECKSUMERRORS, STATISTICS_MASK);
-
-        return 0;
-}
-
-/*
- * Create a receive buffer within system memory and update
- * NIC private structure appropriately.
- */
-static int ipg_get_rxbuff(struct net_device *dev, int entry)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        struct ipg_rx *rxfd = sp->rxd + entry;
-        struct sk_buff *skb;
-        u64 rxfragsize;
-
-        IPG_DEBUG_MSG("_get_rxbuff\n");
-
-        skb = netdev_alloc_skb_ip_align(dev, sp->rxsupport_size);
-        if (!skb) {
-                sp->rx_buff[entry] = NULL;
-                return -ENOMEM;
-        }
-
-        /* Save the address of the sk_buff structure. */
-        sp->rx_buff[entry] = skb;
-
-        rxfd->frag_info = cpu_to_le64(pci_map_single(sp->pdev, skb->data,
-                sp->rx_buf_sz, PCI_DMA_FROMDEVICE));
-
-        /* Set the RFD fragment length. */
-        rxfragsize = sp->rxfrag_size;
-        rxfd->frag_info |= cpu_to_le64((rxfragsize << 48) & IPG_RFI_FRAGLEN);
-
-        return 0;
-}
-
-static int init_rfdlist(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-
-        IPG_DEBUG_MSG("_init_rfdlist\n");
-
-        for (i = 0; i < IPG_RFDLIST_LENGTH; i++) {
-                struct ipg_rx *rxfd = sp->rxd + i;
-
-                if (sp->rx_buff[i]) {
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                                sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb_irq(sp->rx_buff[i]);
-                        sp->rx_buff[i] = NULL;
-                }
-
-                /* Clear out the RFS field. */
-                rxfd->rfs = 0x0000000000000000;
-
-                if (ipg_get_rxbuff(dev, i) < 0) {
-                        /*
-                         * A receive buffer was not ready, break the
-                         * RFD list here.
-                         */
-                        IPG_DEBUG_MSG("Cannot allocate Rx buffer\n");
-
-                        /* Just in case we cannot allocate a single RFD.
-                         * Should not occur.
-                         */
-                        if (i == 0) {
-                                netdev_err(dev, "No memory available for RFD list\n");
-                                return -ENOMEM;
-                        }
-                }
-
-                rxfd->next_desc = cpu_to_le64(sp->rxd_map +
-                        sizeof(struct ipg_rx)*(i + 1));
-        }
-        sp->rxd[i - 1].next_desc = cpu_to_le64(sp->rxd_map);
-
-        sp->rx_current = 0;
-        sp->rx_dirty = 0;
-
-        /* Write the location of the RFDList to the IPG. */
-        ipg_w32((u32) sp->rxd_map, RFD_LIST_PTR_0);
-        ipg_w32(0x00000000, RFD_LIST_PTR_1);
-
-        return 0;
-}
-
-static void init_tfdlist(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-
-        IPG_DEBUG_MSG("_init_tfdlist\n");
-
-        for (i = 0; i < IPG_TFDLIST_LENGTH; i++) {
-                struct ipg_tx *txfd = sp->txd + i;
-
-                txfd->tfc = cpu_to_le64(IPG_TFC_TFDDONE);
-
-                if (sp->tx_buff[i]) {
-                        dev_kfree_skb_irq(sp->tx_buff[i]);
-                        sp->tx_buff[i] = NULL;
-                }
-
-                txfd->next_desc = cpu_to_le64(sp->txd_map +
-                        sizeof(struct ipg_tx)*(i + 1));
-        }
-        sp->txd[i - 1].next_desc = cpu_to_le64(sp->txd_map);
-
-        sp->tx_current = 0;
-        sp->tx_dirty = 0;
-
-        /* Write the location of the TFDList to the IPG. */
-        IPG_DDEBUG_MSG("Starting TFDListPtr = %08x\n",
-                       (u32) sp->txd_map);
-        ipg_w32((u32) sp->txd_map, TFD_LIST_PTR_0);
-        ipg_w32(0x00000000, TFD_LIST_PTR_1);
-
-        sp->reset_current_tfd = 1;
-}
-
-/*
- * Free all transmit buffers which have already been transferred
- * via DMA to the IPG.
- */
-static void ipg_nic_txfree(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        unsigned int released, pending, dirty;
-
-        IPG_DEBUG_MSG("_nic_txfree\n");
-
-        pending = sp->tx_current - sp->tx_dirty;
-        dirty = sp->tx_dirty % IPG_TFDLIST_LENGTH;
-
-        for (released = 0; released < pending; released++) {
-                struct sk_buff *skb = sp->tx_buff[dirty];
-                struct ipg_tx *txfd = sp->txd + dirty;
-
-                IPG_DEBUG_MSG("TFC = %016lx\n", (unsigned long) txfd->tfc);
-
-                /* Look at each TFD's TFC field beginning
-                 * at the last freed TFD up to the current TFD.
-                 * If the TFDDone bit is set, free the associated
-                 * buffer.
-                 */
-                if (!(txfd->tfc & cpu_to_le64(IPG_TFC_TFDDONE)))
-                        break;
-
-                /* Free the transmit buffer. */
-                if (skb) {
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(txfd->frag_info) & ~IPG_TFI_FRAGLEN,
-                                skb->len, PCI_DMA_TODEVICE);
-
-                        dev_kfree_skb_irq(skb);
-
-                        sp->tx_buff[dirty] = NULL;
-                }
-                dirty = (dirty + 1) % IPG_TFDLIST_LENGTH;
-        }
-
-        sp->tx_dirty += released;
-
-        if (netif_queue_stopped(dev) &&
-            (sp->tx_current != (sp->tx_dirty + IPG_TFDLIST_LENGTH))) {
-                netif_wake_queue(dev);
-        }
-}
-
-static void ipg_tx_timeout(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-
-        ipg_reset(dev, IPG_AC_TX_RESET | IPG_AC_DMA | IPG_AC_NETWORK |
-                  IPG_AC_FIFO);
-
-        spin_lock_irq(&sp->lock);
-
-        /* Re-configure after DMA reset. */
-        if (ipg_io_config(dev) < 0)
-                netdev_info(dev, "Error during re-configuration\n");
-
-        init_tfdlist(dev);
-
-        spin_unlock_irq(&sp->lock);
-
-        ipg_w32((ipg_r32(MAC_CTRL) | IPG_MC_TX_ENABLE) & IPG_MC_RSVD_MASK,
-                MAC_CTRL);
-}
-
-/*
- * For TxComplete interrupts, free all transmit
- * buffers which have already been transferred via DMA
- * to the IPG.
- */
-static void ipg_nic_txcleanup(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-
-        IPG_DEBUG_MSG("_nic_txcleanup\n");
-
-        for (i = 0; i < IPG_TFDLIST_LENGTH; i++) {
-                /* Reading the TXSTATUS register clears the
-                 * TX_COMPLETE interrupt.
-                 */
-                u32 txstatusdword = ipg_r32(TX_STATUS);
-
-                IPG_DEBUG_MSG("TxStatus = %08x\n", txstatusdword);
-
-                /* Check for Transmit errors. Error bits only valid if
-                 * TX_COMPLETE bit in the TXSTATUS register is a 1.
-                 */
-                if (!(txstatusdword & IPG_TS_TX_COMPLETE))
-                        break;
-
-                /* If in 10Mbps mode, indicate transmit is ready. */
-                if (sp->tenmbpsmode) {
-                        netif_wake_queue(dev);
-                }
-
-                /* Transmit error, increment stat counters. */
-                if (txstatusdword & IPG_TS_TX_ERROR) {
-                        IPG_DEBUG_MSG("Transmit error\n");
-                        sp->stats.tx_errors++;
-                }
-
-                /* Late collision, re-enable transmitter. */
-                if (txstatusdword & IPG_TS_LATE_COLLISION) {
-                        IPG_DEBUG_MSG("Late collision on transmit\n");
-                        ipg_w32((ipg_r32(MAC_CTRL) | IPG_MC_TX_ENABLE) &
-                                IPG_MC_RSVD_MASK, MAC_CTRL);
-                }
-
-                /* Maximum collisions, re-enable transmitter. */
-                if (txstatusdword & IPG_TS_TX_MAX_COLL) {
-                        IPG_DEBUG_MSG("Maximum collisions on transmit\n");
-                        ipg_w32((ipg_r32(MAC_CTRL) | IPG_MC_TX_ENABLE) &
-                                IPG_MC_RSVD_MASK, MAC_CTRL);
-                }
-
-                /* Transmit underrun, reset and re-enable
-                 * transmitter.
-                 */
-                if (txstatusdword & IPG_TS_TX_UNDERRUN) {
-                        IPG_DEBUG_MSG("Transmitter underrun\n");
-                        sp->stats.tx_fifo_errors++;
-                        ipg_reset(dev, IPG_AC_TX_RESET | IPG_AC_DMA |
-                                  IPG_AC_NETWORK | IPG_AC_FIFO);
-
-                        /* Re-configure after DMA reset. */
-                        if (ipg_io_config(dev) < 0) {
-                                netdev_info(dev, "Error during re-configuration\n");
-                        }
-                        init_tfdlist(dev);
-
-                        ipg_w32((ipg_r32(MAC_CTRL) | IPG_MC_TX_ENABLE) &
-                                IPG_MC_RSVD_MASK, MAC_CTRL);
-                }
-        }
-
-        ipg_nic_txfree(dev);
-}
-
-/* Provides statistical information about the IPG NIC. */
-static struct net_device_stats *ipg_nic_get_stats(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        u16 temp1;
-        u16 temp2;
-
-        IPG_DEBUG_MSG("_nic_get_stats\n");
-
-        /* Check to see if the NIC has been initialized via nic_open,
-         * before trying to read statistic registers.
-         */
-        if (!netif_running(dev))
-                return &sp->stats;
-
-        sp->stats.rx_packets += ipg_r32(IPG_FRAMESRCVDOK);
-        sp->stats.tx_packets += ipg_r32(IPG_FRAMESXMTDOK);
-        sp->stats.rx_bytes += ipg_r32(IPG_OCTETRCVOK);
-        sp->stats.tx_bytes += ipg_r32(IPG_OCTETXMTOK);
-        temp1 = ipg_r16(IPG_FRAMESLOSTRXERRORS);
-        sp->stats.rx_errors += temp1;
-        sp->stats.rx_missed_errors += temp1;
-        temp1 = ipg_r32(IPG_SINGLECOLFRAMES) + ipg_r32(IPG_MULTICOLFRAMES) +
-                ipg_r32(IPG_LATECOLLISIONS);
-        temp2 = ipg_r16(IPG_CARRIERSENSEERRORS);
-        sp->stats.collisions += temp1;
-        sp->stats.tx_dropped += ipg_r16(IPG_FRAMESABORTXSCOLLS);
-        sp->stats.tx_errors += ipg_r16(IPG_FRAMESWEXDEFERRAL) +
-                ipg_r32(IPG_FRAMESWDEFERREDXMT) + temp1 + temp2;
-        sp->stats.multicast += ipg_r32(IPG_MCSTOCTETRCVDOK);
-
-        /* detailed tx_errors */
-        sp->stats.tx_carrier_errors += temp2;
-
-        /* detailed rx_errors */
-        sp->stats.rx_length_errors += ipg_r16(IPG_INRANGELENGTHERRORS) +
-                ipg_r16(IPG_FRAMETOOLONGERRORS);
-        sp->stats.rx_crc_errors += ipg_r16(IPG_FRAMECHECKSEQERRORS);
-
-        /* Unutilized IPG statistic registers. */
-        ipg_r32(IPG_MCSTFRAMESRCVDOK);
-
-        return &sp->stats;
-}
-
-/* Restore used receive buffers. */
-static int ipg_nic_rxrestore(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        const unsigned int curr = sp->rx_current;
-        unsigned int dirty = sp->rx_dirty;
-
-        IPG_DEBUG_MSG("_nic_rxrestore\n");
-
-        for (dirty = sp->rx_dirty; curr - dirty > 0; dirty++) {
-                unsigned int entry = dirty % IPG_RFDLIST_LENGTH;
-
-                /* rx_copybreak may poke hole here and there. */
-                if (sp->rx_buff[entry])
-                        continue;
-
-                /* Generate a new receive buffer to replace the
-                 * current buffer (which will be released by the
-                 * Linux system).
-                 */
-                if (ipg_get_rxbuff(dev, entry) < 0) {
-                        IPG_DEBUG_MSG("Cannot allocate new Rx buffer\n");
-
-                        break;
-                }
-
-                /* Reset the RFS field. */
-                sp->rxd[entry].rfs = 0x0000000000000000;
-        }
-        sp->rx_dirty = dirty;
-
-        return 0;
-}
-
-/* use jumboindex and jumbosize to control jumbo frame status
- * initial status is jumboindex=-1 and jumbosize=0
- * 1. jumboindex = -1 and jumbosize=0 : previous jumbo frame has been done.
- * 2. jumboindex != -1 and jumbosize != 0 : jumbo frame is not over size and receiving
- * 3. jumboindex = -1 and jumbosize != 0 : jumbo frame is over size, already dump
- *               previous receiving and need to continue dumping the current one
- */
-enum {
-        NORMAL_PACKET,
-        ERROR_PACKET
-};
-
-enum {
-        FRAME_NO_START_NO_END   = 0,
-        FRAME_WITH_START                = 1,
-        FRAME_WITH_END          = 10,
-        FRAME_WITH_START_WITH_END = 11
-};
-
-static void ipg_nic_rx_free_skb(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        unsigned int entry = sp->rx_current % IPG_RFDLIST_LENGTH;
-
-        if (sp->rx_buff[entry]) {
-                struct ipg_rx *rxfd = sp->rxd + entry;
-
-                pci_unmap_single(sp->pdev,
-                        le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                        sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-                dev_kfree_skb_irq(sp->rx_buff[entry]);
-                sp->rx_buff[entry] = NULL;
-        }
-}
-
-static int ipg_nic_rx_check_frame_type(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        struct ipg_rx *rxfd = sp->rxd + (sp->rx_current % IPG_RFDLIST_LENGTH);
-        int type = FRAME_NO_START_NO_END;
-
-        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_FRAMESTART)
-                type += FRAME_WITH_START;
-        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_FRAMEEND)
-                type += FRAME_WITH_END;
-        return type;
-}
-
-static int ipg_nic_rx_check_error(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        unsigned int entry = sp->rx_current % IPG_RFDLIST_LENGTH;
-        struct ipg_rx *rxfd = sp->rxd + entry;
-
-        if (IPG_DROP_ON_RX_ETH_ERRORS && (le64_to_cpu(rxfd->rfs) &
-             (IPG_RFS_RXFIFOOVERRUN | IPG_RFS_RXRUNTFRAME |
-              IPG_RFS_RXALIGNMENTERROR | IPG_RFS_RXFCSERROR |
-              IPG_RFS_RXOVERSIZEDFRAME | IPG_RFS_RXLENGTHERROR))) {
-                IPG_DEBUG_MSG("Rx error, RFS = %016lx\n",
-                              (unsigned long) rxfd->rfs);
-
-                /* Increment general receive error statistic. */
-                sp->stats.rx_errors++;
-
-                /* Increment detailed receive error statistics. */
-                if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFIFOOVERRUN) {
-                        IPG_DEBUG_MSG("RX FIFO overrun occurred\n");
-
-                        sp->stats.rx_fifo_errors++;
-                }
-
-                if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXRUNTFRAME) {
-                        IPG_DEBUG_MSG("RX runt occurred\n");
-                        sp->stats.rx_length_errors++;
-                }
-
-                /* Do nothing for IPG_RFS_RXOVERSIZEDFRAME,
-                 * error count handled by a IPG statistic register.
-                 */
-
-                if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXALIGNMENTERROR) {
-                        IPG_DEBUG_MSG("RX alignment error occurred\n");
-                        sp->stats.rx_frame_errors++;
-                }
-
-                /* Do nothing for IPG_RFS_RXFCSERROR, error count
-                 * handled by a IPG statistic register.
-                 */
-
-                /* Free the memory associated with the RX
-                 * buffer since it is erroneous and we will
-                 * not pass it to higher layer processes.
-                 */
-                if (sp->rx_buff[entry]) {
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                                sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-
-                        dev_kfree_skb_irq(sp->rx_buff[entry]);
-                        sp->rx_buff[entry] = NULL;
-                }
-                return ERROR_PACKET;
-        }
-        return NORMAL_PACKET;
-}
-
-static void ipg_nic_rx_with_start_and_end(struct net_device *dev,
-                                          struct ipg_nic_private *sp,
-                                          struct ipg_rx *rxfd, unsigned entry)
-{
-        struct ipg_jumbo *jumbo = &sp->jumbo;
-        struct sk_buff *skb;
-        int framelen;
-
-        if (jumbo->found_start) {
-                dev_kfree_skb_irq(jumbo->skb);
-                jumbo->found_start = 0;
-                jumbo->current_size = 0;
-                jumbo->skb = NULL;
-        }
-
-        /* 1: found error, 0 no error */
-        if (ipg_nic_rx_check_error(dev) != NORMAL_PACKET)
-                return;
-
-        skb = sp->rx_buff[entry];
-        if (!skb)
-                return;
-
-        /* accept this frame and send to upper layer */
-        framelen = le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFRAMELEN;
-        if (framelen > sp->rxfrag_size)
-                framelen = sp->rxfrag_size;
-
-        skb_put(skb, framelen);
-        skb->protocol = eth_type_trans(skb, dev);
-        skb_checksum_none_assert(skb);
-        netif_rx(skb);
-        sp->rx_buff[entry] = NULL;
-}
-
-static void ipg_nic_rx_with_start(struct net_device *dev,
-                                  struct ipg_nic_private *sp,
-                                  struct ipg_rx *rxfd, unsigned entry)
-{
-        struct ipg_jumbo *jumbo = &sp->jumbo;
-        struct pci_dev *pdev = sp->pdev;
-        struct sk_buff *skb;
-
-        /* 1: found error, 0 no error */
-        if (ipg_nic_rx_check_error(dev) != NORMAL_PACKET)
-                return;
-
-        /* accept this frame and send to upper layer */
-        skb = sp->rx_buff[entry];
-        if (!skb)
-                return;
-
-        if (jumbo->found_start)
-                dev_kfree_skb_irq(jumbo->skb);
-
-        pci_unmap_single(pdev, le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                         sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-
-        skb_put(skb, sp->rxfrag_size);
-
-        jumbo->found_start = 1;
-        jumbo->current_size = sp->rxfrag_size;
-        jumbo->skb = skb;
-
-        sp->rx_buff[entry] = NULL;
-}
-
-static void ipg_nic_rx_with_end(struct net_device *dev,
-                                struct ipg_nic_private *sp,
-                                struct ipg_rx *rxfd, unsigned entry)
-{
-        struct ipg_jumbo *jumbo = &sp->jumbo;
-
-        /* 1: found error, 0 no error */
-        if (ipg_nic_rx_check_error(dev) == NORMAL_PACKET) {
-                struct sk_buff *skb = sp->rx_buff[entry];
-
-                if (!skb)
-                        return;
-
-                if (jumbo->found_start) {
-                        int framelen, endframelen;
-
-                        framelen = le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFRAMELEN;
-
-                        endframelen = framelen - jumbo->current_size;
-                        if (framelen > sp->rxsupport_size)
-                                dev_kfree_skb_irq(jumbo->skb);
-                        else {
-                                memcpy(skb_put(jumbo->skb, endframelen),
-                                       skb->data, endframelen);
-
-                                jumbo->skb->protocol =
-                                    eth_type_trans(jumbo->skb, dev);
-
-                                skb_checksum_none_assert(jumbo->skb);
-                                netif_rx(jumbo->skb);
-                        }
-                }
-
-                jumbo->found_start = 0;
-                jumbo->current_size = 0;
-                jumbo->skb = NULL;
-
-                ipg_nic_rx_free_skb(dev);
-        } else {
-                dev_kfree_skb_irq(jumbo->skb);
-                jumbo->found_start = 0;
-                jumbo->current_size = 0;
-                jumbo->skb = NULL;
-        }
-}
-
-static void ipg_nic_rx_no_start_no_end(struct net_device *dev,
-                                       struct ipg_nic_private *sp,
-                                       struct ipg_rx *rxfd, unsigned entry)
-{
-        struct ipg_jumbo *jumbo = &sp->jumbo;
-
-        /* 1: found error, 0 no error */
-        if (ipg_nic_rx_check_error(dev) == NORMAL_PACKET) {
-                struct sk_buff *skb = sp->rx_buff[entry];
-
-                if (skb) {
-                        if (jumbo->found_start) {
-                                jumbo->current_size += sp->rxfrag_size;
-                                if (jumbo->current_size <= sp->rxsupport_size) {
-                                        memcpy(skb_put(jumbo->skb,
-                                                       sp->rxfrag_size),
-                                               skb->data, sp->rxfrag_size);
-                                }
-                        }
-                        ipg_nic_rx_free_skb(dev);
-                }
-        } else {
-                dev_kfree_skb_irq(jumbo->skb);
-                jumbo->found_start = 0;
-                jumbo->current_size = 0;
-                jumbo->skb = NULL;
-        }
-}
-
-static int ipg_nic_rx_jumbo(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        unsigned int curr = sp->rx_current;
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-
-        IPG_DEBUG_MSG("_nic_rx\n");
-
-        for (i = 0; i < IPG_MAXRFDPROCESS_COUNT; i++, curr++) {
-                unsigned int entry = curr % IPG_RFDLIST_LENGTH;
-                struct ipg_rx *rxfd = sp->rxd + entry;
-
-                if (!(rxfd->rfs & cpu_to_le64(IPG_RFS_RFDDONE)))
-                        break;
-
-                switch (ipg_nic_rx_check_frame_type(dev)) {
-                case FRAME_WITH_START_WITH_END:
-                        ipg_nic_rx_with_start_and_end(dev, sp, rxfd, entry);
-                        break;
-                case FRAME_WITH_START:
-                        ipg_nic_rx_with_start(dev, sp, rxfd, entry);
-                        break;
-                case FRAME_WITH_END:
-                        ipg_nic_rx_with_end(dev, sp, rxfd, entry);
-                        break;
-                case FRAME_NO_START_NO_END:
-                        ipg_nic_rx_no_start_no_end(dev, sp, rxfd, entry);
-                        break;
-                }
-        }
-
-        sp->rx_current = curr;
-
-        if (i == IPG_MAXRFDPROCESS_COUNT) {
-                /* There are more RFDs to process, however the
-                 * allocated amount of RFD processing time has
-                 * expired. Assert Interrupt Requested to make
-                 * sure we come back to process the remaining RFDs.
-                 */
-                ipg_w32(ipg_r32(ASIC_CTRL) | IPG_AC_INT_REQUEST, ASIC_CTRL);
-        }
-
-        ipg_nic_rxrestore(dev);
-
-        return 0;
-}
-
-static int ipg_nic_rx(struct net_device *dev)
-{
-        /* Transfer received Ethernet frames to higher network layers. */
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        unsigned int curr = sp->rx_current;
-        void __iomem *ioaddr = sp->ioaddr;
-        struct ipg_rx *rxfd;
-        unsigned int i;
-
-        IPG_DEBUG_MSG("_nic_rx\n");
-
-#define __RFS_MASK \
-        cpu_to_le64(IPG_RFS_RFDDONE | IPG_RFS_FRAMESTART | IPG_RFS_FRAMEEND)
-
-        for (i = 0; i < IPG_MAXRFDPROCESS_COUNT; i++, curr++) {
-                unsigned int entry = curr % IPG_RFDLIST_LENGTH;
-                struct sk_buff *skb = sp->rx_buff[entry];
-                unsigned int framelen;
-
-                rxfd = sp->rxd + entry;
-
-                if (((rxfd->rfs & __RFS_MASK) != __RFS_MASK) || !skb)
-                        break;
-
-                /* Get received frame length. */
-                framelen = le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFRAMELEN;
-
-                /* Check for jumbo frame arrival with too small
-                 * RXFRAG_SIZE.
-                 */
-                if (framelen > sp->rxfrag_size) {
-                        IPG_DEBUG_MSG
-                            ("RFS FrameLen > allocated fragment size\n");
-
-                        framelen = sp->rxfrag_size;
-                }
-
-                if ((IPG_DROP_ON_RX_ETH_ERRORS && (le64_to_cpu(rxfd->rfs) &
-                       (IPG_RFS_RXFIFOOVERRUN | IPG_RFS_RXRUNTFRAME |
-                        IPG_RFS_RXALIGNMENTERROR | IPG_RFS_RXFCSERROR |
-                        IPG_RFS_RXOVERSIZEDFRAME | IPG_RFS_RXLENGTHERROR)))) {
-
-                        IPG_DEBUG_MSG("Rx error, RFS = %016lx\n",
-                                      (unsigned long int) rxfd->rfs);
-
-                        /* Increment general receive error statistic. */
-                        sp->stats.rx_errors++;
-
-                        /* Increment detailed receive error statistics. */
-                        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFIFOOVERRUN) {
-                                IPG_DEBUG_MSG("RX FIFO overrun occurred\n");
-                                sp->stats.rx_fifo_errors++;
-                        }
-
-                        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXRUNTFRAME) {
-                                IPG_DEBUG_MSG("RX runt occurred\n");
-                                sp->stats.rx_length_errors++;
-                        }
-
-                        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXOVERSIZEDFRAME) ;
-                        /* Do nothing, error count handled by a IPG
-                         * statistic register.
-                         */
-
-                        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXALIGNMENTERROR) {
-                                IPG_DEBUG_MSG("RX alignment error occurred\n");
-                                sp->stats.rx_frame_errors++;
-                        }
-
-                        if (le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFCSERROR) ;
-                        /* Do nothing, error count handled by a IPG
-                         * statistic register.
-                         */
-
-                        /* Free the memory associated with the RX
-                         * buffer since it is erroneous and we will
-                         * not pass it to higher layer processes.
-                         */
-                        if (skb) {
-                                __le64 info = rxfd->frag_info;
-
-                                pci_unmap_single(sp->pdev,
-                                        le64_to_cpu(info) & ~IPG_RFI_FRAGLEN,
-                                        sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-
-                                dev_kfree_skb_irq(skb);
-                        }
-                } else {
-
-                        /* Adjust the new buffer length to accommodate the size
-                         * of the received frame.
-                         */
-                        skb_put(skb, framelen);
-
-                        /* Set the buffer's protocol field to Ethernet. */
-                        skb->protocol = eth_type_trans(skb, dev);
-
-                        /* The IPG encountered an error with (or
-                         * there were no) IP/TCP/UDP checksums.
-                         * This may or may not indicate an invalid
-                         * IP/TCP/UDP frame was received. Let the
-                         * upper layer decide.
-                         */
-                        skb_checksum_none_assert(skb);
-
-                        /* Hand off frame for higher layer processing.
-                         * The function netif_rx() releases the sk_buff
-                         * when processing completes.
-                         */
-                        netif_rx(skb);
-                }
-
-                /* Assure RX buffer is not reused by IPG. */
-                sp->rx_buff[entry] = NULL;
-        }
-
-        /*
-         * If there are more RFDs to process and the allocated amount of RFD
-         * processing time has expired, assert Interrupt Requested to make
-         * sure we come back to process the remaining RFDs.
-         */
-        if (i == IPG_MAXRFDPROCESS_COUNT)
-                ipg_w32(ipg_r32(ASIC_CTRL) | IPG_AC_INT_REQUEST, ASIC_CTRL);
-
-#ifdef IPG_DEBUG
-        /* Check if the RFD list contained no receive frame data. */
-        if (!i)
-                sp->EmptyRFDListCount++;
-#endif
-        while ((le64_to_cpu(rxfd->rfs) & IPG_RFS_RFDDONE) &&
-               !((le64_to_cpu(rxfd->rfs) & IPG_RFS_FRAMESTART) &&
-                 (le64_to_cpu(rxfd->rfs) & IPG_RFS_FRAMEEND))) {
-                unsigned int entry = curr++ % IPG_RFDLIST_LENGTH;
-
-                rxfd = sp->rxd + entry;
-
-                IPG_DEBUG_MSG("Frame requires multiple RFDs\n");
-
-                /* An unexpected event, additional code needed to handle
-                 * properly. So for the time being, just disregard the
-                 * frame.
-                 */
-
-                /* Free the memory associated with the RX
-                 * buffer since it is erroneous and we will
-                 * not pass it to higher layer processes.
-                 */
-                if (sp->rx_buff[entry]) {
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                                sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb_irq(sp->rx_buff[entry]);
-                }
-
-                /* Assure RX buffer is not reused by IPG. */
-                sp->rx_buff[entry] = NULL;
-        }
-
-        sp->rx_current = curr;
-
-        /* Check to see if there are a minimum number of used
-         * RFDs before restoring any (should improve performance.)
-         */
-        if ((curr - sp->rx_dirty) >= IPG_MINUSEDRFDSTOFREE)
-                ipg_nic_rxrestore(dev);
-
-        return 0;
-}
-
-static void ipg_reset_after_host_error(struct work_struct *work)
-{
-        struct ipg_nic_private *sp =
-                container_of(work, struct ipg_nic_private, task.work);
-        struct net_device *dev = sp->dev;
-
-        /*
-         * Acknowledge HostError interrupt by resetting
-         * IPG DMA and HOST.
-         */
-        ipg_reset(dev, IPG_AC_GLOBAL_RESET | IPG_AC_HOST | IPG_AC_DMA);
-
-        init_rfdlist(dev);
-        init_tfdlist(dev);
-
-        if (ipg_io_config(dev) < 0) {
-                netdev_info(dev, "Cannot recover from PCI error\n");
-                schedule_delayed_work(&sp->task, HZ);
-        }
-}
-
-static irqreturn_t ipg_interrupt_handler(int irq, void *dev_inst)
-{
-        struct net_device *dev = dev_inst;
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int handled = 0;
-        u16 status;
-
-        IPG_DEBUG_MSG("_interrupt_handler\n");
-
-        if (sp->is_jumbo)
-                ipg_nic_rxrestore(dev);
-
-        spin_lock(&sp->lock);
-
-        /* Get interrupt source information, and acknowledge
-         * some (i.e. TxDMAComplete, RxDMAComplete, RxEarly,
-         * IntRequested, MacControlFrame, LinkEvent) interrupts
-         * if issued. Also, all IPG interrupts are disabled by
-         * reading IntStatusAck.
-         */
-        status = ipg_r16(INT_STATUS_ACK);
-
-        IPG_DEBUG_MSG("IntStatusAck = %04x\n", status);
-
-        /* Shared IRQ of remove event. */
-        if (!(status & IPG_IS_RSVD_MASK))
-                goto out_enable;
-
-        handled = 1;
-
-        if (unlikely(!netif_running(dev)))
-                goto out_unlock;
-
-        /* If RFDListEnd interrupt, restore all used RFDs. */
-        if (status & IPG_IS_RFD_LIST_END) {
-                IPG_DEBUG_MSG("RFDListEnd Interrupt\n");
-
-                /* The RFD list end indicates an RFD was encountered
-                 * with a 0 NextPtr, or with an RFDDone bit set to 1
-                 * (indicating the RFD is not read for use by the
-                 * IPG.) Try to restore all RFDs.
-                 */
-                ipg_nic_rxrestore(dev);
-
-#ifdef IPG_DEBUG
-                /* Increment the RFDlistendCount counter. */
-                sp->RFDlistendCount++;
-#endif
-        }
-
-        /* If RFDListEnd, RxDMAPriority, RxDMAComplete, or
-         * IntRequested interrupt, process received frames. */
-        if ((status & IPG_IS_RX_DMA_PRIORITY) ||
-            (status & IPG_IS_RFD_LIST_END) ||
-            (status & IPG_IS_RX_DMA_COMPLETE) ||
-            (status & IPG_IS_INT_REQUESTED)) {
-#ifdef IPG_DEBUG
-                /* Increment the RFD list checked counter if interrupted
-                 * only to check the RFD list. */
-                if (status & (~(IPG_IS_RX_DMA_PRIORITY | IPG_IS_RFD_LIST_END |
-                                IPG_IS_RX_DMA_COMPLETE | IPG_IS_INT_REQUESTED) &
-                               (IPG_IS_HOST_ERROR | IPG_IS_TX_DMA_COMPLETE |
-                                IPG_IS_LINK_EVENT | IPG_IS_TX_COMPLETE |
-                                IPG_IS_UPDATE_STATS)))
-                        sp->RFDListCheckedCount++;
-#endif
-
-                if (sp->is_jumbo)
-                        ipg_nic_rx_jumbo(dev);
-                else
-                        ipg_nic_rx(dev);
-        }
-
-        /* If TxDMAComplete interrupt, free used TFDs. */
-        if (status & IPG_IS_TX_DMA_COMPLETE)
-                ipg_nic_txfree(dev);
-
-        /* TxComplete interrupts indicate one of numerous actions.
-         * Determine what action to take based on TXSTATUS register.
-         */
-        if (status & IPG_IS_TX_COMPLETE)
-                ipg_nic_txcleanup(dev);
-
-        /* If UpdateStats interrupt, update Linux Ethernet statistics */
-        if (status & IPG_IS_UPDATE_STATS)
-                ipg_nic_get_stats(dev);
-
-        /* If HostError interrupt, reset IPG. */
-        if (status & IPG_IS_HOST_ERROR) {
-                IPG_DDEBUG_MSG("HostError Interrupt\n");
-
-                schedule_delayed_work(&sp->task, 0);
-        }
-
-        /* If LinkEvent interrupt, resolve autonegotiation. */
-        if (status & IPG_IS_LINK_EVENT) {
-                if (ipg_config_autoneg(dev) < 0)
-                        netdev_info(dev, "Auto-negotiation error\n");
-        }
-
-        /* If MACCtrlFrame interrupt, do nothing. */
-        if (status & IPG_IS_MAC_CTRL_FRAME)
-                IPG_DEBUG_MSG("MACCtrlFrame interrupt\n");
-
-        /* If RxComplete interrupt, do nothing. */
-        if (status & IPG_IS_RX_COMPLETE)
-                IPG_DEBUG_MSG("RxComplete interrupt\n");
-
-        /* If RxEarly interrupt, do nothing. */
-        if (status & IPG_IS_RX_EARLY)
-                IPG_DEBUG_MSG("RxEarly interrupt\n");
-
-out_enable:
-        /* Re-enable IPG interrupts. */
-        ipg_w16(IPG_IE_TX_DMA_COMPLETE | IPG_IE_RX_DMA_COMPLETE |
-                IPG_IE_HOST_ERROR | IPG_IE_INT_REQUESTED | IPG_IE_TX_COMPLETE |
-                IPG_IE_LINK_EVENT | IPG_IE_UPDATE_STATS, INT_ENABLE);
-out_unlock:
-        spin_unlock(&sp->lock);
-
-        return IRQ_RETVAL(handled);
-}
-
-static void ipg_rx_clear(struct ipg_nic_private *sp)
-{
-        unsigned int i;
-
-        for (i = 0; i < IPG_RFDLIST_LENGTH; i++) {
-                if (sp->rx_buff[i]) {
-                        struct ipg_rx *rxfd = sp->rxd + i;
-
-                        dev_kfree_skb_irq(sp->rx_buff[i]);
-                        sp->rx_buff[i] = NULL;
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
-                                sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-                }
-        }
-}
-
-static void ipg_tx_clear(struct ipg_nic_private *sp)
-{
-        unsigned int i;
-
-        for (i = 0; i < IPG_TFDLIST_LENGTH; i++) {
-                if (sp->tx_buff[i]) {
-                        struct ipg_tx *txfd = sp->txd + i;
-
-                        pci_unmap_single(sp->pdev,
-                                le64_to_cpu(txfd->frag_info) & ~IPG_TFI_FRAGLEN,
-                                sp->tx_buff[i]->len, PCI_DMA_TODEVICE);
-
-                        dev_kfree_skb_irq(sp->tx_buff[i]);
-
-                        sp->tx_buff[i] = NULL;
-                }
-        }
-}
-
-static int ipg_nic_open(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        struct pci_dev *pdev = sp->pdev;
-        int rc;
-
-        IPG_DEBUG_MSG("_nic_open\n");
-
-        sp->rx_buf_sz = sp->rxsupport_size;
-
-        /* Check for interrupt line conflicts, and request interrupt
-         * line for IPG.
-         *
-         * IMPORTANT: Disable IPG interrupts prior to registering
-         *            IRQ.
-         */
-        ipg_w16(0x0000, INT_ENABLE);
-
-        /* Register the interrupt line to be used by the IPG within
-         * the Linux system.
-         */
-        rc = request_irq(pdev->irq, ipg_interrupt_handler, IRQF_SHARED,
-                         dev->name, dev);
-        if (rc < 0) {
-                netdev_info(dev, "Error when requesting interrupt\n");
-                goto out;
-        }
-
-        dev->irq = pdev->irq;
-
-        rc = -ENOMEM;
-
-        sp->rxd = dma_alloc_coherent(&pdev->dev, IPG_RX_RING_BYTES,
-                                     &sp->rxd_map, GFP_KERNEL);
-        if (!sp->rxd)
-                goto err_free_irq_0;
-
-        sp->txd = dma_alloc_coherent(&pdev->dev, IPG_TX_RING_BYTES,
-                                     &sp->txd_map, GFP_KERNEL);
-        if (!sp->txd)
-                goto err_free_rx_1;
-
-        rc = init_rfdlist(dev);
-        if (rc < 0) {
-                netdev_info(dev, "Error during configuration\n");
-                goto err_free_tx_2;
-        }
-
-        init_tfdlist(dev);
-
-        rc = ipg_io_config(dev);
-        if (rc < 0) {
-                netdev_info(dev, "Error during configuration\n");
-                goto err_release_tfdlist_3;
-        }
-
-        /* Resolve autonegotiation. */
-        if (ipg_config_autoneg(dev) < 0)
-                netdev_info(dev, "Auto-negotiation error\n");
-
-        /* initialize JUMBO Frame control variable */
-        sp->jumbo.found_start = 0;
-        sp->jumbo.current_size = 0;
-        sp->jumbo.skb = NULL;
-
-        /* Enable transmit and receive operation of the IPG. */
-        ipg_w32((ipg_r32(MAC_CTRL) | IPG_MC_RX_ENABLE | IPG_MC_TX_ENABLE) &
-                 IPG_MC_RSVD_MASK, MAC_CTRL);
-
-        netif_start_queue(dev);
-out:
-        return rc;
-
-err_release_tfdlist_3:
-        ipg_tx_clear(sp);
-        ipg_rx_clear(sp);
-err_free_tx_2:
-        dma_free_coherent(&pdev->dev, IPG_TX_RING_BYTES, sp->txd, sp->txd_map);
-err_free_rx_1:
-        dma_free_coherent(&pdev->dev, IPG_RX_RING_BYTES, sp->rxd, sp->rxd_map);
-err_free_irq_0:
-        free_irq(pdev->irq, dev);
-        goto out;
-}
-
-static int ipg_nic_stop(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        struct pci_dev *pdev = sp->pdev;
-
-        IPG_DEBUG_MSG("_nic_stop\n");
-
-        netif_stop_queue(dev);
-
-        IPG_DUMPTFDLIST(dev);
-
-        do {
-                (void) ipg_r16(INT_STATUS_ACK);
-
-                ipg_reset(dev, IPG_AC_GLOBAL_RESET | IPG_AC_HOST | IPG_AC_DMA);
-
-                synchronize_irq(pdev->irq);
-        } while (ipg_r16(INT_ENABLE) & IPG_IE_RSVD_MASK);
-
-        ipg_rx_clear(sp);
-
-        ipg_tx_clear(sp);
-
-        pci_free_consistent(pdev, IPG_RX_RING_BYTES, sp->rxd, sp->rxd_map);
-        pci_free_consistent(pdev, IPG_TX_RING_BYTES, sp->txd, sp->txd_map);
-
-        free_irq(pdev->irq, dev);
-
-        return 0;
-}
-
-static netdev_tx_t ipg_nic_hard_start_xmit(struct sk_buff *skb,
-                                           struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int entry = sp->tx_current % IPG_TFDLIST_LENGTH;
-        unsigned long flags;
-        struct ipg_tx *txfd;
-
-        IPG_DDEBUG_MSG("_nic_hard_start_xmit\n");
-
-        /* If in 10Mbps mode, stop the transmit queue so
-         * no more transmit frames are accepted.
-         */
-        if (sp->tenmbpsmode)
-                netif_stop_queue(dev);
-
-        if (sp->reset_current_tfd) {
-                sp->reset_current_tfd = 0;
-                entry = 0;
-        }
-
-        txfd = sp->txd + entry;
-
-        sp->tx_buff[entry] = skb;
-
-        /* Clear all TFC fields, except TFDDONE. */
-        txfd->tfc = cpu_to_le64(IPG_TFC_TFDDONE);
-
-        /* Specify the TFC field within the TFD. */
-        txfd->tfc |= cpu_to_le64(IPG_TFC_WORDALIGNDISABLED |
-                (IPG_TFC_FRAMEID & sp->tx_current) |
-                (IPG_TFC_FRAGCOUNT & (1 << 24)));
-        /*
-         * 16--17 (WordAlign) <- 3 (disable),
-         * 0--15 (FrameId) <- sp->tx_current,
-         * 24--27 (FragCount) <- 1
-         */
-
-        /* Request TxComplete interrupts at an interval defined
-         * by the constant IPG_FRAMESBETWEENTXCOMPLETES.
-         * Request TxComplete interrupt for every frame
-         * if in 10Mbps mode to accommodate problem with 10Mbps
-         * processing.
-         */
-        if (sp->tenmbpsmode)
-                txfd->tfc |= cpu_to_le64(IPG_TFC_TXINDICATE);
-        txfd->tfc |= cpu_to_le64(IPG_TFC_TXDMAINDICATE);
-        /* Based on compilation option, determine if FCS is to be
-         * appended to transmit frame by IPG.
-         */
-        if (!(IPG_APPEND_FCS_ON_TX))
-                txfd->tfc |= cpu_to_le64(IPG_TFC_FCSAPPENDDISABLE);
-
-        /* Based on compilation option, determine if IP, TCP and/or
-         * UDP checksums are to be added to transmit frame by IPG.
-         */
-        if (IPG_ADD_IPCHECKSUM_ON_TX)
-                txfd->tfc |= cpu_to_le64(IPG_TFC_IPCHECKSUMENABLE);
-
-        if (IPG_ADD_TCPCHECKSUM_ON_TX)
-                txfd->tfc |= cpu_to_le64(IPG_TFC_TCPCHECKSUMENABLE);
-
-        if (IPG_ADD_UDPCHECKSUM_ON_TX)
-                txfd->tfc |= cpu_to_le64(IPG_TFC_UDPCHECKSUMENABLE);
-
-        /* Based on compilation option, determine if VLAN tag info is to be
-         * inserted into transmit frame by IPG.
-         */
-        if (IPG_INSERT_MANUAL_VLAN_TAG) {
-                txfd->tfc |= cpu_to_le64(IPG_TFC_VLANTAGINSERT |
-                        ((u64) IPG_MANUAL_VLAN_VID << 32) |
-                        ((u64) IPG_MANUAL_VLAN_CFI << 44) |
-                        ((u64) IPG_MANUAL_VLAN_USERPRIORITY << 45));
-        }
-
-        /* The fragment start location within system memory is defined
-         * by the sk_buff structure's data field. The physical address
-         * of this location within the system's virtual memory space
-         * is determined using the IPG_HOST2BUS_MAP function.
-         */
-        txfd->frag_info = cpu_to_le64(pci_map_single(sp->pdev, skb->data,
-                skb->len, PCI_DMA_TODEVICE));
-
-        /* The length of the fragment within system memory is defined by
-         * the sk_buff structure's len field.
-         */
-        txfd->frag_info |= cpu_to_le64(IPG_TFI_FRAGLEN &
-                ((u64) (skb->len & 0xffff) << 48));
-
-        /* Clear the TFDDone bit last to indicate the TFD is ready
-         * for transfer to the IPG.
-         */
-        txfd->tfc &= cpu_to_le64(~IPG_TFC_TFDDONE);
-
-        spin_lock_irqsave(&sp->lock, flags);
-
-        sp->tx_current++;
-
-        mmiowb();
-
-        ipg_w32(IPG_DC_TX_DMA_POLL_NOW, DMA_CTRL);
-
-        if (sp->tx_current == (sp->tx_dirty + IPG_TFDLIST_LENGTH))
-                netif_stop_queue(dev);
-
-        spin_unlock_irqrestore(&sp->lock, flags);
-
-        return NETDEV_TX_OK;
-}
-
-static void ipg_set_phy_default_param(unsigned char rev,
-                                      struct net_device *dev, int phy_address)
-{
-        unsigned short length;
-        unsigned char revision;
-        const unsigned short *phy_param;
-        unsigned short address, value;
-
-        phy_param = &DefaultPhyParam[0];
-        length = *phy_param & 0x00FF;
-        revision = (unsigned char)((*phy_param) >> 8);
-        phy_param++;
-        while (length != 0) {
-                if (rev == revision) {
-                        while (length > 1) {
-                                address = *phy_param;
-                                value = *(phy_param + 1);
-                                phy_param += 2;
-                                mdio_write(dev, phy_address, address, value);
-                                length -= 4;
-                        }
-                        break;
-                } else {
-                        phy_param += length / 2;
-                        length = *phy_param & 0x00FF;
-                        revision = (unsigned char)((*phy_param) >> 8);
-                        phy_param++;
-                }
-        }
-}
-
-static int read_eeprom(struct net_device *dev, int eep_addr)
-{
-        void __iomem *ioaddr = ipg_ioaddr(dev);
-        unsigned int i;
-        int ret = 0;
-        u16 value;
-
-        value = IPG_EC_EEPROM_READOPCODE | (eep_addr & 0xff);
-        ipg_w16(value, EEPROM_CTRL);
-
-        for (i = 0; i < 1000; i++) {
-                u16 data;
-
-                mdelay(10);
-                data = ipg_r16(EEPROM_CTRL);
-                if (!(data & IPG_EC_EEPROM_BUSY)) {
-                        ret = ipg_r16(EEPROM_DATA);
-                        break;
-                }
-        }
-        return ret;
-}
-
-static void ipg_init_mii(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        struct mii_if_info *mii_if = &sp->mii_if;
-        int phyaddr;
-
-        mii_if->dev          = dev;
-        mii_if->mdio_read    = mdio_read;
-        mii_if->mdio_write   = mdio_write;
-        mii_if->phy_id_mask  = 0x1f;
-        mii_if->reg_num_mask = 0x1f;
-
-        mii_if->phy_id = phyaddr = ipg_find_phyaddr(dev);
-
-        if (phyaddr != 0x1f) {
-                u16 mii_phyctrl, mii_1000cr;
-
-                mii_1000cr  = mdio_read(dev, phyaddr, MII_CTRL1000);
-                mii_1000cr |= ADVERTISE_1000FULL | ADVERTISE_1000HALF |
-                        GMII_PHY_1000BASETCONTROL_PreferMaster;
-                mdio_write(dev, phyaddr, MII_CTRL1000, mii_1000cr);
-
-                mii_phyctrl = mdio_read(dev, phyaddr, MII_BMCR);
-
-                /* Set default phyparam */
-                ipg_set_phy_default_param(sp->pdev->revision, dev, phyaddr);
-
-                /* Reset PHY */
-                mii_phyctrl |= BMCR_RESET | BMCR_ANRESTART;
-                mdio_write(dev, phyaddr, MII_BMCR, mii_phyctrl);
-
-        }
-}
-
-static int ipg_hw_init(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        void __iomem *ioaddr = sp->ioaddr;
-        unsigned int i;
-        int rc;
-
-        /* Read/Write and Reset EEPROM Value */
-        /* Read LED Mode Configuration from EEPROM */
-        sp->led_mode = read_eeprom(dev, 6);
-
-        /* Reset all functions within the IPG. Do not assert
-         * RST_OUT as not compatible with some PHYs.
-         */
-        rc = ipg_reset(dev, IPG_RESET_MASK);
-        if (rc < 0)
-                goto out;
-
-        ipg_init_mii(dev);
-
-        /* Read MAC Address from EEPROM */
-        for (i = 0; i < 3; i++)
-                sp->station_addr[i] = read_eeprom(dev, 16 + i);
-
-        for (i = 0; i < 3; i++)
-                ipg_w16(sp->station_addr[i], STATION_ADDRESS_0 + 2*i);
-
-        /* Set station address in ethernet_device structure. */
-        dev->dev_addr[0] =  ipg_r16(STATION_ADDRESS_0) & 0x00ff;
-        dev->dev_addr[1] = (ipg_r16(STATION_ADDRESS_0) & 0xff00) >> 8;
-        dev->dev_addr[2] =  ipg_r16(STATION_ADDRESS_1) & 0x00ff;
-        dev->dev_addr[3] = (ipg_r16(STATION_ADDRESS_1) & 0xff00) >> 8;
-        dev->dev_addr[4] =  ipg_r16(STATION_ADDRESS_2) & 0x00ff;
-        dev->dev_addr[5] = (ipg_r16(STATION_ADDRESS_2) & 0xff00) >> 8;
-out:
-        return rc;
-}
-
-static int ipg_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        int rc;
-
-        mutex_lock(&sp->mii_mutex);
-        rc = generic_mii_ioctl(&sp->mii_if, if_mii(ifr), cmd, NULL);
-        mutex_unlock(&sp->mii_mutex);
-
-        return rc;
-}
-
-static int ipg_nic_change_mtu(struct net_device *dev, int new_mtu)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        int err;
-
-        /* Function to accommodate changes to Maximum Transfer Unit
-         * (or MTU) of IPG NIC. Cannot use default function since
-         * the default will not allow for MTU > 1500 bytes.
-         */
-
-        IPG_DEBUG_MSG("_nic_change_mtu\n");
-
-        /*
-         * Check that the new MTU value is between 68 (14 byte header, 46 byte
-         * payload, 4 byte FCS) and 10 KB, which is the largest supported MTU.
-         */
-        if (new_mtu < 68 || new_mtu > 10240)
-                return -EINVAL;
-
-        err = ipg_nic_stop(dev);
-        if (err)
-                return err;
-
-        dev->mtu = new_mtu;
-
-        sp->max_rxframe_size = new_mtu;
-
-        sp->rxfrag_size = new_mtu;
-        if (sp->rxfrag_size > 4088)
-                sp->rxfrag_size = 4088;
-
-        sp->rxsupport_size = sp->max_rxframe_size;
-
-        if (new_mtu > 0x0600)
-                sp->is_jumbo = true;
-        else
-                sp->is_jumbo = false;
-
-        return ipg_nic_open(dev);
-}
-
-static int ipg_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        int rc;
-
-        mutex_lock(&sp->mii_mutex);
-        rc = mii_ethtool_gset(&sp->mii_if, cmd);
-        mutex_unlock(&sp->mii_mutex);
-
-        return rc;
-}
-
-static int ipg_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        int rc;
-
-        mutex_lock(&sp->mii_mutex);
-        rc = mii_ethtool_sset(&sp->mii_if, cmd);
-        mutex_unlock(&sp->mii_mutex);
-
-        return rc;
-}
-
-static int ipg_nway_reset(struct net_device *dev)
-{
-        struct ipg_nic_private *sp = netdev_priv(dev);
-        int rc;
-
-        mutex_lock(&sp->mii_mutex);
-        rc = mii_nway_restart(&sp->mii_if);
-        mutex_unlock(&sp->mii_mutex);
-
-        return rc;
-}
-
-static const struct ethtool_ops ipg_ethtool_ops = {
-        .get_settings = ipg_get_settings,
-        .set_settings = ipg_set_settings,
-        .nway_reset   = ipg_nway_reset,
-};
-
-static void ipg_remove(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        struct ipg_nic_private *sp = netdev_priv(dev);
-
-        IPG_DEBUG_MSG("_remove\n");
-
-        /* Un-register Ethernet device. */
-        unregister_netdev(dev);
-
-        pci_iounmap(pdev, sp->ioaddr);
-
-        pci_release_regions(pdev);
-
-        free_netdev(dev);
-        pci_disable_device(pdev);
-}
-
-static const struct net_device_ops ipg_netdev_ops = {
-        .ndo_open               = ipg_nic_open,
-        .ndo_stop               = ipg_nic_stop,
-        .ndo_start_xmit         = ipg_nic_hard_start_xmit,
-        .ndo_get_stats          = ipg_nic_get_stats,
-        .ndo_set_rx_mode        = ipg_nic_set_multicast_list,
-        .ndo_do_ioctl           = ipg_ioctl,
-        .ndo_tx_timeout         = ipg_tx_timeout,
-        .ndo_change_mtu         = ipg_nic_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-static int ipg_probe(struct pci_dev *pdev, const struct pci_device_id *id)
-{
-        unsigned int i = id->driver_data;
-        struct ipg_nic_private *sp;
-        struct net_device *dev;
-        void __iomem *ioaddr;
-        int rc;
-
-        rc = pci_enable_device(pdev);
-        if (rc < 0)
-                goto out;
-
-        pr_info("%s: %s\n", pci_name(pdev), ipg_brand_name[i]);
-
-        pci_set_master(pdev);
-
-        rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(40));
-        if (rc < 0) {
-                rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-                if (rc < 0) {
-                        pr_err("%s: DMA config failed\n", pci_name(pdev));
-                        goto err_disable_0;
-                }
-        }
-
-        /*
-         * Initialize net device.
-         */
-        dev = alloc_etherdev(sizeof(struct ipg_nic_private));
-        if (!dev) {
-                rc = -ENOMEM;
-                goto err_disable_0;
-        }
-
-        sp = netdev_priv(dev);
-        spin_lock_init(&sp->lock);
-        mutex_init(&sp->mii_mutex);
-
-        sp->is_jumbo = IPG_IS_JUMBO;
-        sp->rxfrag_size = IPG_RXFRAG_SIZE;
-        sp->rxsupport_size = IPG_RXSUPPORT_SIZE;
-        sp->max_rxframe_size = IPG_MAX_RXFRAME_SIZE;
-
-        /* Declare IPG NIC functions for Ethernet device methods.
-         */
-        dev->netdev_ops = &ipg_netdev_ops;
-        SET_NETDEV_DEV(dev, &pdev->dev);
-        dev->ethtool_ops = &ipg_ethtool_ops;
-
-        rc = pci_request_regions(pdev, DRV_NAME);
-        if (rc)
-                goto err_free_dev_1;
-
-        ioaddr = pci_iomap(pdev, 1, pci_resource_len(pdev, 1));
-        if (!ioaddr) {
-                pr_err("%s: cannot map MMIO\n", pci_name(pdev));
-                rc = -EIO;
-                goto err_release_regions_2;
-        }
-
-        /* Save the pointer to the PCI device information. */
-        sp->ioaddr = ioaddr;
-        sp->pdev = pdev;
-        sp->dev = dev;
-
-        INIT_DELAYED_WORK(&sp->task, ipg_reset_after_host_error);
-
-        pci_set_drvdata(pdev, dev);
-
-        rc = ipg_hw_init(dev);
-        if (rc < 0)
-                goto err_unmap_3;
-
-        rc = register_netdev(dev);
-        if (rc < 0)
-                goto err_unmap_3;
-
-        netdev_info(dev, "Ethernet device registered\n");
-out:
-        return rc;
-
-err_unmap_3:
-        pci_iounmap(pdev, ioaddr);
-err_release_regions_2:
-        pci_release_regions(pdev);
-err_free_dev_1:
-        free_netdev(dev);
-err_disable_0:
-        pci_disable_device(pdev);
-        goto out;
-}
-
-static struct pci_driver ipg_pci_driver = {
-        .name           = IPG_DRIVER_NAME,
-        .id_table       = ipg_pci_tbl,
-        .probe          = ipg_probe,
-        .remove         = ipg_remove,
-};
-
-module_pci_driver(ipg_pci_driver);
diff --git a/drivers/net/ethernet/icplus/ipg.h b/drivers/net/ethernet/icplus/ipg.h
deleted file mode 100644
index de606281f97b..000000000000
--- a/drivers/net/ethernet/icplus/ipg.h
+++ /dev/null
@@ -1,748 +0,0 @@
-/*
- * Include file for Gigabit Ethernet device driver for Network
- * Interface Cards (NICs) utilizing the Tamarack Microelectronics
- * Inc. IPG Gigabit or Triple Speed Ethernet Media Access
- * Controller.
- */
-#ifndef __LINUX_IPG_H
-#define __LINUX_IPG_H
-
-#include <linux/module.h>
-
-#include <linux/kernel.h>
-#include <linux/pci.h>
-#include <linux/ioport.h>
-#include <linux/errno.h>
-#include <asm/io.h>
-#include <linux/delay.h>
-#include <linux/types.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <asm/bitops.h>
-
-/*
- *      Constants
- */
-
-/* GMII based PHY IDs */
-#define         NS                              0x2000
-#define         MARVELL                         0x0141
-#define         ICPLUS_PHY                      0x243
-
-/* NIC Physical Layer Device MII register fields. */
-#define         MII_PHY_SELECTOR_IEEE8023       0x0001
-#define         MII_PHY_TECHABILITYFIELD        0x1FE0
-
-/* GMII_PHY_1000 need to set to prefer master */
-#define         GMII_PHY_1000BASETCONTROL_PreferMaster 0x0400
-
-/* NIC Physical Layer Device GMII constants. */
-#define         GMII_PREAMBLE                    0xFFFFFFFF
-#define         GMII_ST                          0x1
-#define         GMII_READ                        0x2
-#define         GMII_WRITE                       0x1
-#define         GMII_TA_READ_MASK                0x1
-#define         GMII_TA_WRITE                    0x2
-
-/* I/O register offsets. */
-enum ipg_regs {
-        DMA_CTRL                = 0x00,
-        RX_DMA_STATUS           = 0x08, /* Unused + reserved */
-        TFD_LIST_PTR_0          = 0x10,
-        TFD_LIST_PTR_1          = 0x14,
-        TX_DMA_BURST_THRESH     = 0x18,
-        TX_DMA_URGENT_THRESH    = 0x19,
-        TX_DMA_POLL_PERIOD      = 0x1a,
-        RFD_LIST_PTR_0          = 0x1c,
-        RFD_LIST_PTR_1          = 0x20,
-        RX_DMA_BURST_THRESH     = 0x24,
-        RX_DMA_URGENT_THRESH    = 0x25,
-        RX_DMA_POLL_PERIOD      = 0x26,
-        DEBUG_CTRL              = 0x2c,
-        ASIC_CTRL               = 0x30,
-        FIFO_CTRL               = 0x38, /* Unused */
-        FLOW_OFF_THRESH         = 0x3c,
-        FLOW_ON_THRESH          = 0x3e,
-        EEPROM_DATA             = 0x48,
-        EEPROM_CTRL             = 0x4a,
-        EXPROM_ADDR             = 0x4c, /* Unused */
-        EXPROM_DATA             = 0x50, /* Unused */
-        WAKE_EVENT              = 0x51, /* Unused */
-        COUNTDOWN               = 0x54, /* Unused */
-        INT_STATUS_ACK          = 0x5a,
-        INT_ENABLE              = 0x5c,
-        INT_STATUS              = 0x5e, /* Unused */
-        TX_STATUS               = 0x60,
-        MAC_CTRL                = 0x6c,
-        VLAN_TAG                = 0x70, /* Unused */
-        PHY_SET                 = 0x75,
-        PHY_CTRL                = 0x76,
-        STATION_ADDRESS_0       = 0x78,
-        STATION_ADDRESS_1       = 0x7a,
-        STATION_ADDRESS_2       = 0x7c,
-        MAX_FRAME_SIZE          = 0x86,
-        RECEIVE_MODE            = 0x88,
-        HASHTABLE_0             = 0x8c,
-        HASHTABLE_1             = 0x90,
-        RMON_STATISTICS_MASK    = 0x98,
-        STATISTICS_MASK         = 0x9c,
-        RX_JUMBO_FRAMES         = 0xbc, /* Unused */
-        TCP_CHECKSUM_ERRORS     = 0xc0, /* Unused */
-        IP_CHECKSUM_ERRORS      = 0xc2, /* Unused */
-        UDP_CHECKSUM_ERRORS     = 0xc4, /* Unused */
-        TX_JUMBO_FRAMES         = 0xf4  /* Unused */
-};
-
-/* Ethernet MIB statistic register offsets. */
-#define IPG_OCTETRCVOK                  0xA8
-#define IPG_MCSTOCTETRCVDOK             0xAC
-#define IPG_BCSTOCTETRCVOK              0xB0
-#define IPG_FRAMESRCVDOK                0xB4
-#define IPG_MCSTFRAMESRCVDOK            0xB8
-#define IPG_BCSTFRAMESRCVDOK            0xBE
-#define IPG_MACCONTROLFRAMESRCVD        0xC6
-#define IPG_FRAMETOOLONGERRORS          0xC8
-#define IPG_INRANGELENGTHERRORS         0xCA
-#define IPG_FRAMECHECKSEQERRORS         0xCC
-#define IPG_FRAMESLOSTRXERRORS          0xCE
-#define IPG_OCTETXMTOK                  0xD0
-#define IPG_MCSTOCTETXMTOK              0xD4
-#define IPG_BCSTOCTETXMTOK              0xD8
-#define IPG_FRAMESXMTDOK                0xDC
-#define IPG_MCSTFRAMESXMTDOK            0xE0
-#define IPG_FRAMESWDEFERREDXMT          0xE4
-#define IPG_LATECOLLISIONS              0xE8
-#define IPG_MULTICOLFRAMES              0xEC
-#define IPG_SINGLECOLFRAMES             0xF0
-#define IPG_BCSTFRAMESXMTDOK            0xF6
-#define IPG_CARRIERSENSEERRORS          0xF8
-#define IPG_MACCONTROLFRAMESXMTDOK      0xFA
-#define IPG_FRAMESABORTXSCOLLS          0xFC
-#define IPG_FRAMESWEXDEFERRAL           0xFE
-
-/* RMON statistic register offsets. */
-#define IPG_ETHERSTATSCOLLISIONS                        0x100
-#define IPG_ETHERSTATSOCTETSTRANSMIT                    0x104
-#define IPG_ETHERSTATSPKTSTRANSMIT                      0x108
-#define IPG_ETHERSTATSPKTS64OCTESTSTRANSMIT             0x10C
-#define IPG_ETHERSTATSPKTS65TO127OCTESTSTRANSMIT        0x110
-#define IPG_ETHERSTATSPKTS128TO255OCTESTSTRANSMIT       0x114
-#define IPG_ETHERSTATSPKTS256TO511OCTESTSTRANSMIT       0x118
-#define IPG_ETHERSTATSPKTS512TO1023OCTESTSTRANSMIT      0x11C
-#define IPG_ETHERSTATSPKTS1024TO1518OCTESTSTRANSMIT     0x120
-#define IPG_ETHERSTATSCRCALIGNERRORS                    0x124
-#define IPG_ETHERSTATSUNDERSIZEPKTS                     0x128
-#define IPG_ETHERSTATSFRAGMENTS                         0x12C
-#define IPG_ETHERSTATSJABBERS                           0x130
-#define IPG_ETHERSTATSOCTETS                            0x134
-#define IPG_ETHERSTATSPKTS                              0x138
-#define IPG_ETHERSTATSPKTS64OCTESTS                     0x13C
-#define IPG_ETHERSTATSPKTS65TO127OCTESTS                0x140
-#define IPG_ETHERSTATSPKTS128TO255OCTESTS               0x144
-#define IPG_ETHERSTATSPKTS256TO511OCTESTS               0x148
-#define IPG_ETHERSTATSPKTS512TO1023OCTESTS              0x14C
-#define IPG_ETHERSTATSPKTS1024TO1518OCTESTS             0x150
-
-/* RMON statistic register equivalents. */
-#define IPG_ETHERSTATSMULTICASTPKTSTRANSMIT             0xE0
-#define IPG_ETHERSTATSBROADCASTPKTSTRANSMIT             0xF6
-#define IPG_ETHERSTATSMULTICASTPKTS                     0xB8
-#define IPG_ETHERSTATSBROADCASTPKTS                     0xBE
-#define IPG_ETHERSTATSOVERSIZEPKTS                      0xC8
-#define IPG_ETHERSTATSDROPEVENTS                        0xCE
-
-/* Serial EEPROM offsets */
-#define IPG_EEPROM_CONFIGPARAM          0x00
-#define IPG_EEPROM_ASICCTRL             0x01
-#define IPG_EEPROM_SUBSYSTEMVENDORID    0x02
-#define IPG_EEPROM_SUBSYSTEMID          0x03
-#define IPG_EEPROM_STATIONADDRESS0      0x10
-#define IPG_EEPROM_STATIONADDRESS1      0x11
-#define IPG_EEPROM_STATIONADDRESS2      0x12
-
-/* Register & data structure bit masks */
-
-/* PCI register masks. */
-
-/* IOBaseAddress */
-#define         IPG_PIB_RSVD_MASK               0xFFFFFE01
-#define         IPG_PIB_IOBASEADDRESS           0xFFFFFF00
-#define         IPG_PIB_IOBASEADDRIND           0x00000001
-
-/* MemBaseAddress */
-#define         IPG_PMB_RSVD_MASK               0xFFFFFE07
-#define         IPG_PMB_MEMBASEADDRIND          0x00000001
-#define         IPG_PMB_MEMMAPTYPE              0x00000006
-#define         IPG_PMB_MEMMAPTYPE0             0x00000002
-#define         IPG_PMB_MEMMAPTYPE1             0x00000004
-#define         IPG_PMB_MEMBASEADDRESS          0xFFFFFE00
-
-/* ConfigStatus */
-#define IPG_CS_RSVD_MASK                0xFFB0
-#define IPG_CS_CAPABILITIES             0x0010
-#define IPG_CS_66MHZCAPABLE             0x0020
-#define IPG_CS_FASTBACK2BACK            0x0080
-#define IPG_CS_DATAPARITYREPORTED       0x0100
-#define IPG_CS_DEVSELTIMING             0x0600
-#define IPG_CS_SIGNALEDTARGETABORT      0x0800
-#define IPG_CS_RECEIVEDTARGETABORT      0x1000
-#define IPG_CS_RECEIVEDMASTERABORT      0x2000
-#define IPG_CS_SIGNALEDSYSTEMERROR      0x4000
-#define IPG_CS_DETECTEDPARITYERROR      0x8000
-
-/* TFD data structure masks. */
-
-/* TFDList, TFC */
-#define IPG_TFC_RSVD_MASK                       0x0000FFFF9FFFFFFFULL
-#define IPG_TFC_FRAMEID                         0x000000000000FFFFULL
-#define IPG_TFC_WORDALIGN                       0x0000000000030000ULL
-#define IPG_TFC_WORDALIGNTODWORD                0x0000000000000000ULL
-#define IPG_TFC_WORDALIGNTOWORD                 0x0000000000020000ULL
-#define IPG_TFC_WORDALIGNDISABLED               0x0000000000030000ULL
-#define IPG_TFC_TCPCHECKSUMENABLE               0x0000000000040000ULL
-#define IPG_TFC_UDPCHECKSUMENABLE               0x0000000000080000ULL
-#define IPG_TFC_IPCHECKSUMENABLE                0x0000000000100000ULL
-#define IPG_TFC_FCSAPPENDDISABLE                0x0000000000200000ULL
-#define IPG_TFC_TXINDICATE                      0x0000000000400000ULL
-#define IPG_TFC_TXDMAINDICATE                   0x0000000000800000ULL
-#define IPG_TFC_FRAGCOUNT                       0x000000000F000000ULL
-#define IPG_TFC_VLANTAGINSERT                   0x0000000010000000ULL
-#define IPG_TFC_TFDDONE                         0x0000000080000000ULL
-#define IPG_TFC_VID                             0x00000FFF00000000ULL
-#define IPG_TFC_CFI                             0x0000100000000000ULL
-#define IPG_TFC_USERPRIORITY                    0x0000E00000000000ULL
-
-/* TFDList, FragInfo */
-#define IPG_TFI_RSVD_MASK                       0xFFFF00FFFFFFFFFFULL
-#define IPG_TFI_FRAGADDR                        0x000000FFFFFFFFFFULL
-#define IPG_TFI_FRAGLEN                         0xFFFF000000000000ULL
-
-/* RFD data structure masks. */
-
-/* RFDList, RFS */
-#define IPG_RFS_RSVD_MASK                       0x0000FFFFFFFFFFFFULL
-#define IPG_RFS_RXFRAMELEN                      0x000000000000FFFFULL
-#define IPG_RFS_RXFIFOOVERRUN                   0x0000000000010000ULL
-#define IPG_RFS_RXRUNTFRAME                     0x0000000000020000ULL
-#define IPG_RFS_RXALIGNMENTERROR                0x0000000000040000ULL
-#define IPG_RFS_RXFCSERROR                      0x0000000000080000ULL
-#define IPG_RFS_RXOVERSIZEDFRAME                0x0000000000100000ULL
-#define IPG_RFS_RXLENGTHERROR                   0x0000000000200000ULL
-#define IPG_RFS_VLANDETECTED                    0x0000000000400000ULL
-#define IPG_RFS_TCPDETECTED                     0x0000000000800000ULL
-#define IPG_RFS_TCPERROR                        0x0000000001000000ULL
-#define IPG_RFS_UDPDETECTED                     0x0000000002000000ULL
-#define IPG_RFS_UDPERROR                        0x0000000004000000ULL
-#define IPG_RFS_IPDETECTED                      0x0000000008000000ULL
-#define IPG_RFS_IPERROR                         0x0000000010000000ULL
-#define IPG_RFS_FRAMESTART                      0x0000000020000000ULL
-#define IPG_RFS_FRAMEEND                        0x0000000040000000ULL
-#define IPG_RFS_RFDDONE                         0x0000000080000000ULL
-#define IPG_RFS_TCI                             0x0000FFFF00000000ULL
-
-/* RFDList, FragInfo */
-#define IPG_RFI_RSVD_MASK                       0xFFFF00FFFFFFFFFFULL
-#define IPG_RFI_FRAGADDR                        0x000000FFFFFFFFFFULL
-#define IPG_RFI_FRAGLEN                         0xFFFF000000000000ULL
-
-/* I/O Register masks. */
-
-/* RMON Statistics Mask */
-#define IPG_RZ_ALL                                      0x0FFFFFFF
-
-/* Statistics Mask */
-#define IPG_SM_ALL                                      0x0FFFFFFF
-#define IPG_SM_OCTETRCVOK_FRAMESRCVDOK                  0x00000001
-#define IPG_SM_MCSTOCTETRCVDOK_MCSTFRAMESRCVDOK         0x00000002
-#define IPG_SM_BCSTOCTETRCVDOK_BCSTFRAMESRCVDOK         0x00000004
-#define IPG_SM_RXJUMBOFRAMES                            0x00000008
-#define IPG_SM_TCPCHECKSUMERRORS                        0x00000010
-#define IPG_SM_IPCHECKSUMERRORS                         0x00000020
-#define IPG_SM_UDPCHECKSUMERRORS                        0x00000040
-#define IPG_SM_MACCONTROLFRAMESRCVD                     0x00000080
-#define IPG_SM_FRAMESTOOLONGERRORS                      0x00000100
-#define IPG_SM_INRANGELENGTHERRORS                      0x00000200
-#define IPG_SM_FRAMECHECKSEQERRORS                      0x00000400
-#define IPG_SM_FRAMESLOSTRXERRORS                       0x00000800
-#define IPG_SM_OCTETXMTOK_FRAMESXMTOK                   0x00001000
-#define IPG_SM_MCSTOCTETXMTOK_MCSTFRAMESXMTDOK          0x00002000
-#define IPG_SM_BCSTOCTETXMTOK_BCSTFRAMESXMTDOK          0x00004000
-#define IPG_SM_FRAMESWDEFERREDXMT                       0x00008000
-#define IPG_SM_LATECOLLISIONS                           0x00010000
-#define IPG_SM_MULTICOLFRAMES                           0x00020000
-#define IPG_SM_SINGLECOLFRAMES                          0x00040000
-#define IPG_SM_TXJUMBOFRAMES                            0x00080000
-#define IPG_SM_CARRIERSENSEERRORS                       0x00100000
-#define IPG_SM_MACCONTROLFRAMESXMTD                     0x00200000
-#define IPG_SM_FRAMESABORTXSCOLLS                       0x00400000
-#define IPG_SM_FRAMESWEXDEFERAL                         0x00800000
-
-/* Countdown */
-#define IPG_CD_RSVD_MASK                0x0700FFFF
-#define IPG_CD_COUNT                    0x0000FFFF
-#define IPG_CD_COUNTDOWNSPEED           0x01000000
-#define IPG_CD_COUNTDOWNMODE            0x02000000
-#define IPG_CD_COUNTINTENABLED          0x04000000
-
-/* TxDMABurstThresh */
-#define IPG_TB_RSVD_MASK                0xFF
-
-/* TxDMAUrgentThresh */
-#define IPG_TU_RSVD_MASK                0xFF
-
-/* TxDMAPollPeriod */
-#define IPG_TP_RSVD_MASK                0xFF
-
-/* RxDMAUrgentThresh */
-#define IPG_RU_RSVD_MASK                0xFF
-
-/* RxDMAPollPeriod */
-#define IPG_RP_RSVD_MASK                0xFF
-
-/* ReceiveMode */
-#define IPG_RM_RSVD_MASK                0x3F
-#define IPG_RM_RECEIVEUNICAST           0x01
-#define IPG_RM_RECEIVEMULTICAST         0x02
-#define IPG_RM_RECEIVEBROADCAST         0x04
-#define IPG_RM_RECEIVEALLFRAMES         0x08
-#define IPG_RM_RECEIVEMULTICASTHASH     0x10
-#define IPG_RM_RECEIVEIPMULTICAST       0x20
-
-/* PhySet */
-#define IPG_PS_MEM_LENB9B               0x01
-#define IPG_PS_MEM_LEN9                 0x02
-#define IPG_PS_NON_COMPDET              0x04
-
-/* PhyCtrl */
-#define IPG_PC_RSVD_MASK                0xFF
-#define IPG_PC_MGMTCLK_LO               0x00
-#define IPG_PC_MGMTCLK_HI               0x01
-#define IPG_PC_MGMTCLK                  0x01
-#define IPG_PC_MGMTDATA                 0x02
-#define IPG_PC_MGMTDIR                  0x04
-#define IPG_PC_DUPLEX_POLARITY          0x08
-#define IPG_PC_DUPLEX_STATUS            0x10
-#define IPG_PC_LINK_POLARITY            0x20
-#define IPG_PC_LINK_SPEED               0xC0
-#define IPG_PC_LINK_SPEED_10MBPS        0x40
-#define IPG_PC_LINK_SPEED_100MBPS       0x80
-#define IPG_PC_LINK_SPEED_1000MBPS      0xC0
-
-/* DMACtrl */
-#define IPG_DC_RSVD_MASK                0xC07D9818
-#define IPG_DC_RX_DMA_COMPLETE          0x00000008
-#define IPG_DC_RX_DMA_POLL_NOW          0x00000010
-#define IPG_DC_TX_DMA_COMPLETE          0x00000800
-#define IPG_DC_TX_DMA_POLL_NOW          0x00001000
-#define IPG_DC_TX_DMA_IN_PROG           0x00008000
-#define IPG_DC_RX_EARLY_DISABLE         0x00010000
-#define IPG_DC_MWI_DISABLE              0x00040000
-#define IPG_DC_TX_WRITE_BACK_DISABLE    0x00080000
-#define IPG_DC_TX_BURST_LIMIT           0x00700000
-#define IPG_DC_TARGET_ABORT             0x40000000
-#define IPG_DC_MASTER_ABORT             0x80000000
-
-/* ASICCtrl */
-#define IPG_AC_RSVD_MASK                0x07FFEFF2
-#define IPG_AC_EXP_ROM_SIZE             0x00000002
-#define IPG_AC_PHY_SPEED10              0x00000010
-#define IPG_AC_PHY_SPEED100             0x00000020
-#define IPG_AC_PHY_SPEED1000            0x00000040
-#define IPG_AC_PHY_MEDIA                0x00000080
-#define IPG_AC_FORCED_CFG               0x00000700
-#define IPG_AC_D3RESETDISABLE           0x00000800
-#define IPG_AC_SPEED_UP_MODE            0x00002000
-#define IPG_AC_LED_MODE                 0x00004000
-#define IPG_AC_RST_OUT_POLARITY         0x00008000
-#define IPG_AC_GLOBAL_RESET             0x00010000
-#define IPG_AC_RX_RESET                 0x00020000
-#define IPG_AC_TX_RESET                 0x00040000
-#define IPG_AC_DMA                      0x00080000
-#define IPG_AC_FIFO                     0x00100000
-#define IPG_AC_NETWORK                  0x00200000
-#define IPG_AC_HOST                     0x00400000
-#define IPG_AC_AUTO_INIT                0x00800000
-#define IPG_AC_RST_OUT                  0x01000000
-#define IPG_AC_INT_REQUEST              0x02000000
-#define IPG_AC_RESET_BUSY               0x04000000
-#define IPG_AC_LED_SPEED                0x08000000
-#define IPG_AC_LED_MODE_BIT_1           0x20000000
-
-/* EepromCtrl */
-#define IPG_EC_RSVD_MASK                0x83FF
-#define IPG_EC_EEPROM_ADDR              0x00FF
-#define IPG_EC_EEPROM_OPCODE            0x0300
-#define IPG_EC_EEPROM_SUBCOMMAD         0x0000
-#define IPG_EC_EEPROM_WRITEOPCODE       0x0100
-#define IPG_EC_EEPROM_READOPCODE        0x0200
-#define IPG_EC_EEPROM_ERASEOPCODE       0x0300
-#define IPG_EC_EEPROM_BUSY              0x8000
-
-/* FIFOCtrl */
-#define IPG_FC_RSVD_MASK                0xC001
-#define IPG_FC_RAM_TEST_MODE            0x0001
-#define IPG_FC_TRANSMITTING             0x4000
-#define IPG_FC_RECEIVING                0x8000
-
-/* TxStatus */
-#define IPG_TS_RSVD_MASK                0xFFFF00DD
-#define IPG_TS_TX_ERROR                 0x00000001
-#define IPG_TS_LATE_COLLISION           0x00000004
-#define IPG_TS_TX_MAX_COLL              0x00000008
-#define IPG_TS_TX_UNDERRUN              0x00000010
-#define IPG_TS_TX_IND_REQD              0x00000040
-#define IPG_TS_TX_COMPLETE              0x00000080
-#define IPG_TS_TX_FRAMEID               0xFFFF0000
-
-/* WakeEvent */
-#define IPG_WE_WAKE_PKT_ENABLE          0x01
-#define IPG_WE_MAGIC_PKT_ENABLE         0x02
-#define IPG_WE_LINK_EVT_ENABLE          0x04
-#define IPG_WE_WAKE_POLARITY            0x08
-#define IPG_WE_WAKE_PKT_EVT             0x10
-#define IPG_WE_MAGIC_PKT_EVT            0x20
-#define IPG_WE_LINK_EVT                 0x40
-#define IPG_WE_WOL_ENABLE               0x80
-
-/* IntEnable */
-#define IPG_IE_RSVD_MASK                0x1FFE
-#define IPG_IE_HOST_ERROR               0x0002
-#define IPG_IE_TX_COMPLETE              0x0004
-#define IPG_IE_MAC_CTRL_FRAME           0x0008
-#define IPG_IE_RX_COMPLETE              0x0010
-#define IPG_IE_RX_EARLY                 0x0020
-#define IPG_IE_INT_REQUESTED            0x0040
-#define IPG_IE_UPDATE_STATS             0x0080
-#define IPG_IE_LINK_EVENT               0x0100
-#define IPG_IE_TX_DMA_COMPLETE          0x0200
-#define IPG_IE_RX_DMA_COMPLETE          0x0400
-#define IPG_IE_RFD_LIST_END             0x0800
-#define IPG_IE_RX_DMA_PRIORITY          0x1000
-
-/* IntStatus */
-#define IPG_IS_RSVD_MASK                0x1FFF
-#define IPG_IS_INTERRUPT_STATUS         0x0001
-#define IPG_IS_HOST_ERROR               0x0002
-#define IPG_IS_TX_COMPLETE              0x0004
-#define IPG_IS_MAC_CTRL_FRAME           0x0008
-#define IPG_IS_RX_COMPLETE              0x0010
-#define IPG_IS_RX_EARLY                 0x0020
-#define IPG_IS_INT_REQUESTED            0x0040
-#define IPG_IS_UPDATE_STATS             0x0080
-#define IPG_IS_LINK_EVENT               0x0100
-#define IPG_IS_TX_DMA_COMPLETE          0x0200
-#define IPG_IS_RX_DMA_COMPLETE          0x0400
-#define IPG_IS_RFD_LIST_END             0x0800
-#define IPG_IS_RX_DMA_PRIORITY          0x1000
-
-/* MACCtrl */
-#define IPG_MC_RSVD_MASK                0x7FE33FA3
-#define IPG_MC_IFS_SELECT               0x00000003
-#define IPG_MC_IFS_4352BIT              0x00000003
-#define IPG_MC_IFS_1792BIT              0x00000002
-#define IPG_MC_IFS_1024BIT              0x00000001
-#define IPG_MC_IFS_96BIT                0x00000000
-#define IPG_MC_DUPLEX_SELECT            0x00000020
-#define IPG_MC_DUPLEX_SELECT_FD         0x00000020
-#define IPG_MC_DUPLEX_SELECT_HD         0x00000000
-#define IPG_MC_TX_FLOW_CONTROL_ENABLE   0x00000080
-#define IPG_MC_RX_FLOW_CONTROL_ENABLE   0x00000100
-#define IPG_MC_RCV_FCS                  0x00000200
-#define IPG_MC_FIFO_LOOPBACK            0x00000400
-#define IPG_MC_MAC_LOOPBACK             0x00000800
-#define IPG_MC_AUTO_VLAN_TAGGING        0x00001000
-#define IPG_MC_AUTO_VLAN_UNTAGGING      0x00002000
-#define IPG_MC_COLLISION_DETECT         0x00010000
-#define IPG_MC_CARRIER_SENSE            0x00020000
-#define IPG_MC_STATISTICS_ENABLE        0x00200000
-#define IPG_MC_STATISTICS_DISABLE       0x00400000
-#define IPG_MC_STATISTICS_ENABLED       0x00800000
-#define IPG_MC_TX_ENABLE                0x01000000
-#define IPG_MC_TX_DISABLE               0x02000000
-#define IPG_MC_TX_ENABLED               0x04000000
-#define IPG_MC_RX_ENABLE                0x08000000
-#define IPG_MC_RX_DISABLE               0x10000000
-#define IPG_MC_RX_ENABLED               0x20000000
-#define IPG_MC_PAUSED                   0x40000000
-
-/*
- *      Tune
- */
-
-/* Assign IPG_APPEND_FCS_ON_TX > 0 for auto FCS append on TX. */
-#define         IPG_APPEND_FCS_ON_TX         1
-
-/* Assign IPG_APPEND_FCS_ON_TX > 0 for auto FCS strip on RX. */
-#define         IPG_STRIP_FCS_ON_RX          1
-
-/* Assign IPG_DROP_ON_RX_ETH_ERRORS > 0 to drop RX frames with
- * Ethernet errors.
- */
-#define         IPG_DROP_ON_RX_ETH_ERRORS    1
-
-/* Assign IPG_INSERT_MANUAL_VLAN_TAG > 0 to insert VLAN tags manually
- * (via TFC).
- */
-#define         IPG_INSERT_MANUAL_VLAN_TAG   0
-
-/* Assign IPG_ADD_IPCHECKSUM_ON_TX > 0 for auto IP checksum on TX. */
-#define         IPG_ADD_IPCHECKSUM_ON_TX     0
-
-/* Assign IPG_ADD_TCPCHECKSUM_ON_TX > 0 for auto TCP checksum on TX.
- * DO NOT USE FOR SILICON REVISIONS B3 AND EARLIER.
- */
-#define         IPG_ADD_TCPCHECKSUM_ON_TX    0
-
-/* Assign IPG_ADD_UDPCHECKSUM_ON_TX > 0 for auto UDP checksum on TX.
- * DO NOT USE FOR SILICON REVISIONS B3 AND EARLIER.
- */
-#define         IPG_ADD_UDPCHECKSUM_ON_TX    0
-
-/* If inserting VLAN tags manually, assign the IPG_MANUAL_VLAN_xx
- * constants as desired.
- */
-#define         IPG_MANUAL_VLAN_VID             0xABC
-#define         IPG_MANUAL_VLAN_CFI             0x1
-#define         IPG_MANUAL_VLAN_USERPRIORITY 0x5
-
-#define         IPG_IO_REG_RANGE                0xFF
-#define         IPG_MEM_REG_RANGE               0x154
-#define         IPG_DRIVER_NAME         "Sundance Technology IPG Triple-Speed Ethernet"
-#define         IPG_NIC_PHY_ADDRESS          0x01
-#define         IPG_DMALIST_ALIGN_PAD   0x07
-#define         IPG_MULTICAST_HASHTABLE_SIZE    0x40
-
-/* Number of milliseconds to wait after issuing a software reset.
- * 0x05 <= IPG_AC_RESETWAIT to account for proper 10Mbps operation.
- */
-#define         IPG_AC_RESETWAIT             0x05
-
-/* Number of IPG_AC_RESETWAIT timeperiods before declaring timeout. */
-#define         IPG_AC_RESET_TIMEOUT         0x0A
-
-/* Minimum number of nanoseconds used to toggle MDC clock during
- * MII/GMII register access.
- */
-#define         IPG_PC_PHYCTRLWAIT_NS           200
-
-#define         IPG_TFDLIST_LENGTH              0x100
-
-/* Number of frames between TxDMAComplete interrupt.
- * 0 < IPG_FRAMESBETWEENTXDMACOMPLETES <= IPG_TFDLIST_LENGTH
- */
-#define         IPG_FRAMESBETWEENTXDMACOMPLETES 0x1
-
-#define         IPG_RFDLIST_LENGTH              0x100
-
-/* Maximum number of RFDs to process per interrupt.
- * 1 < IPG_MAXRFDPROCESS_COUNT < IPG_RFDLIST_LENGTH
- */
-#define         IPG_MAXRFDPROCESS_COUNT 0x80
-
-/* Minimum margin between last freed RFD, and current RFD.
- * 1 < IPG_MINUSEDRFDSTOFREE < IPG_RFDLIST_LENGTH
- */
-#define         IPG_MINUSEDRFDSTOFREE   0x80
-
-/* specify the jumbo frame maximum size
- * per unit is 0x600 (the rx_buffer size that one RFD can carry)
- */
-#define     MAX_JUMBOSIZE               0x8     /* max is 12K */
-
-/* Key register values loaded at driver start up. */
-
-/* TXDMAPollPeriod is specified in 320ns increments.
- *
- * Value        Time
- * ---------------------
- * 0x00-0x01    320ns
- * 0x03         ~1us
- * 0x1F         ~10us
- * 0xFF         ~82us
- */
-#define         IPG_TXDMAPOLLPERIOD_VALUE       0x26
-
-/* TxDMAUrgentThresh specifies the minimum amount of
- * data in the transmit FIFO before asserting an
- * urgent transmit DMA request.
- *
- * Value        Min TxFIFO occupied space before urgent TX request
- * ---------------------------------------------------------------
- * 0x00-0x04    128 bytes (1024 bits)
- * 0x27         1248 bytes (~10000 bits)
- * 0x30         1536 bytes (12288 bits)
- * 0xFF         8192 bytes (65535 bits)
- */
-#define         IPG_TXDMAURGENTTHRESH_VALUE     0x04
-
-/* TxDMABurstThresh specifies the minimum amount of
- * free space in the transmit FIFO before asserting an
- * transmit DMA request.
- *
- * Value        Min TxFIFO free space before TX request
- * ----------------------------------------------------
- * 0x00-0x08    256 bytes
- * 0x30         1536 bytes
- * 0xFF         8192 bytes
- */
-#define         IPG_TXDMABURSTTHRESH_VALUE      0x30
-
-/* RXDMAPollPeriod is specified in 320ns increments.
- *
- * Value        Time
- * ---------------------
- * 0x00-0x01    320ns
- * 0x03         ~1us
- * 0x1F         ~10us
- * 0xFF         ~82us
- */
-#define         IPG_RXDMAPOLLPERIOD_VALUE       0x01
-
-/* RxDMAUrgentThresh specifies the minimum amount of
- * free space within the receive FIFO before asserting
- * a urgent receive DMA request.
- *
- * Value        Min RxFIFO free space before urgent RX request
- * ---------------------------------------------------------------
- * 0x00-0x04    128 bytes (1024 bits)
- * 0x27         1248 bytes (~10000 bits)
- * 0x30         1536 bytes (12288 bits)
- * 0xFF         8192 bytes (65535 bits)
- */
-#define         IPG_RXDMAURGENTTHRESH_VALUE     0x30
-
-/* RxDMABurstThresh specifies the minimum amount of
- * occupied space within the receive FIFO before asserting
- * a receive DMA request.
- *
- * Value        Min TxFIFO free space before TX request
- * ----------------------------------------------------
- * 0x00-0x08    256 bytes
- * 0x30         1536 bytes
- * 0xFF         8192 bytes
- */
-#define         IPG_RXDMABURSTTHRESH_VALUE      0x30
-
-/* FlowOnThresh specifies the maximum amount of occupied
- * space in the receive FIFO before a PAUSE frame with
- * maximum pause time transmitted.
- *
- * Value        Max RxFIFO occupied space before PAUSE
- * ---------------------------------------------------
- * 0x0000       0 bytes
- * 0x0740       29,696 bytes
- * 0x07FF       32,752 bytes
- */
-#define         IPG_FLOWONTHRESH_VALUE  0x0740
-
-/* FlowOffThresh specifies the minimum amount of occupied
- * space in the receive FIFO before a PAUSE frame with
- * zero pause time is transmitted.
- *
- * Value        Max RxFIFO occupied space before PAUSE
- * ---------------------------------------------------
- * 0x0000       0 bytes
- * 0x00BF       3056 bytes
- * 0x07FF       32,752 bytes
- */
-#define         IPG_FLOWOFFTHRESH_VALUE 0x00BF
-
-/*
- * Miscellaneous macros.
- */
-
-/* Macros for printing debug statements. */
-#ifdef IPG_DEBUG
-#  define IPG_DEBUG_MSG(fmt, args...)                   \
-do {                                                    \
-        if (0)                                          \
-                printk(KERN_DEBUG "IPG: " fmt, ##args); \
-} while (0)
-#  define IPG_DDEBUG_MSG(fmt, args...)                  \
-        printk(KERN_DEBUG "IPG: " fmt, ##args)
-#  define IPG_DUMPRFDLIST(args) ipg_dump_rfdlist(args)
-#  define IPG_DUMPTFDLIST(args) ipg_dump_tfdlist(args)
-#else
-#  define IPG_DEBUG_MSG(fmt, args...)                   \
-do {                                                    \
-        if (0)                                          \
-                printk(KERN_DEBUG "IPG: " fmt, ##args); \
-} while (0)
-#  define IPG_DDEBUG_MSG(fmt, args...)                  \
-do {                                                    \
-        if (0)                                          \
-                printk(KERN_DEBUG "IPG: " fmt, ##args); \
-} while (0)
-#  define IPG_DUMPRFDLIST(args)
-#  define IPG_DUMPTFDLIST(args)
-#endif
-
-/*
- * End miscellaneous macros.
- */
-
-/* Transmit Frame Descriptor. The IPG supports 15 fragments,
- * however Linux requires only a single fragment. Note, each
- * TFD field is 64 bits wide.
- */
-struct ipg_tx {
-        __le64 next_desc;
-        __le64 tfc;
-        __le64 frag_info;
-};
-
-/* Receive Frame Descriptor. Note, each RFD field is 64 bits wide.
- */
-struct ipg_rx {
-        __le64 next_desc;
-        __le64 rfs;
-        __le64 frag_info;
-};
-
-struct ipg_jumbo {
-        int found_start;
-        int current_size;
-        struct sk_buff *skb;
-};
-
-/* Structure of IPG NIC specific data. */
-struct ipg_nic_private {
-        void __iomem *ioaddr;
-        struct ipg_tx *txd;
-        struct ipg_rx *rxd;
-        dma_addr_t txd_map;
-        dma_addr_t rxd_map;
-        struct sk_buff *tx_buff[IPG_TFDLIST_LENGTH];
-        struct sk_buff *rx_buff[IPG_RFDLIST_LENGTH];
-        unsigned int tx_current;
-        unsigned int tx_dirty;
-        unsigned int rx_current;
-        unsigned int rx_dirty;
-        bool is_jumbo;
-        struct ipg_jumbo jumbo;
-        unsigned long rxfrag_size;
-        unsigned long rxsupport_size;
-        unsigned long max_rxframe_size;
-        unsigned int rx_buf_sz;
-        struct pci_dev *pdev;
-        struct net_device *dev;
-        struct net_device_stats stats;
-        spinlock_t lock;
-        int tenmbpsmode;
-
-        u16 led_mode;
-        u16 station_addr[3];    /* Station Address in EEPROM Reg 0x10..0x12 */
-
-        struct mutex            mii_mutex;
-        struct mii_if_info      mii_if;
-        int reset_current_tfd;
-#ifdef IPG_DEBUG
-        int RFDlistendCount;
-        int RFDListCheckedCount;
-        int EmptyRFDListCount;
-#endif
-        struct delayed_work task;
-};
-
-#endif                          /* __LINUX_IPG_H */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 85f1b1e7e505..31c491e02e69 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -892,9 +892,10 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
                 dev->caps.qp1_proxy[i - 1] = func_cap.qp1_proxy_qpn;
                 dev->caps.port_mask[i] = dev->caps.port_type[i];
                 dev->caps.phys_port_id[i] = func_cap.phys_port_id;
-                if (mlx4_get_slave_pkey_gid_tbl_len(dev, i,
-                                                    &dev->caps.gid_table_len[i],
-                                                    &dev->caps.pkey_table_len[i]))
+                err = mlx4_get_slave_pkey_gid_tbl_len(dev, i,
+                                                      &dev->caps.gid_table_len[i],
+                                                      &dev->caps.pkey_table_len[i]);
+                if (err)
                         goto err_mem;
         }
 
@@ -906,6 +907,7 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
                          dev->caps.uar_page_size * dev->caps.num_uars,
                          (unsigned long long)
                          pci_resource_len(dev->persist->pdev, 2));
+                err = -ENOMEM;
                 goto err_mem;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 9813d34f3e5b..6fec3e993d02 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -4952,26 +4952,41 @@ static void rem_slave_counters(struct mlx4_dev *dev, int slave)
         struct res_counter *counter;
         struct res_counter *tmp;
         int err;
-        int index;
+        int *counters_arr = NULL;
+        int i, j;
 
         err = move_all_busy(dev, slave, RES_COUNTER);
         if (err)
                 mlx4_warn(dev, "rem_slave_counters: Could not move all counters - too busy for slave %d\n",
                           slave);
 
-        spin_lock_irq(mlx4_tlock(dev));
-        list_for_each_entry_safe(counter, tmp, counter_list, com.list) {
-                if (counter->com.owner == slave) {
-                        index = counter->com.res_id;
-                        rb_erase(&counter->com.node,
-                                 &tracker->res_tree[RES_COUNTER]);
-                        list_del(&counter->com.list);
-                        kfree(counter);
-                        __mlx4_counter_free(dev, index);
+        counters_arr = kmalloc_array(dev->caps.max_counters,
+                                     sizeof(*counters_arr), GFP_KERNEL);
+        if (!counters_arr)
+                return;
+
+        do {
+                i = 0;
+                j = 0;
+                spin_lock_irq(mlx4_tlock(dev));
+                list_for_each_entry_safe(counter, tmp, counter_list, com.list) {
+                        if (counter->com.owner == slave) {
+                                counters_arr[i++] = counter->com.res_id;
+                                rb_erase(&counter->com.node,
+                                         &tracker->res_tree[RES_COUNTER]);
+                                list_del(&counter->com.list);
+                                kfree(counter);
+                        }
+                }
+                spin_unlock_irq(mlx4_tlock(dev));
+
+                while (j < i) {
+                        __mlx4_counter_free(dev, counters_arr[j++]);
                         mlx4_release_resource(dev, slave, RES_COUNTER, 1, 0);
                 }
-        }
-        spin_unlock_irq(mlx4_tlock(dev));
+        } while (i);
+
+        kfree(counters_arr);
 }
 
 static void rem_slave_xrcdns(struct mlx4_dev *dev, int slave)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index f2ae62dd8c09..22e72bf1ae48 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -334,9 +334,15 @@ struct mlx5e_tx_skb_cb {
 
 #define MLX5E_TX_SKB_CB(__skb) ((struct mlx5e_tx_skb_cb *)__skb->cb)
 
+enum mlx5e_dma_map_type {
+        MLX5E_DMA_MAP_SINGLE,
+        MLX5E_DMA_MAP_PAGE
+};
+
 struct mlx5e_sq_dma {
-        dma_addr_t addr;
-        u32        size;
+        dma_addr_t              addr;
+        u32                     size;
+        enum mlx5e_dma_map_type type;
 };
 
 enum {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 5fc4d2d78cdf..1e52db32c73d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1332,6 +1332,42 @@ static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt)
         return err;
 }
 
+static int mlx5e_refresh_tir_self_loopback_enable(struct mlx5_core_dev *mdev,
+                                                  u32 tirn)
+{
+        void *in;
+        int inlen;
+        int err;
+
+        inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
+        in = mlx5_vzalloc(inlen);
+        if (!in)
+                return -ENOMEM;
+
+        MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1);
+
+        err = mlx5_core_modify_tir(mdev, tirn, in, inlen);
+
+        kvfree(in);
+
+        return err;
+}
+
+static int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5e_priv *priv)
+{
+        int err;
+        int i;
+
+        for (i = 0; i < MLX5E_NUM_TT; i++) {
+                err = mlx5e_refresh_tir_self_loopback_enable(priv->mdev,
+                                                             priv->tirn[i]);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
 static int mlx5e_set_dev_port_mtu(struct net_device *netdev)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -1376,6 +1412,13 @@ int mlx5e_open_locked(struct net_device *netdev)
                 goto err_clear_state_opened_flag;
         }
 
+        err = mlx5e_refresh_tirs_self_loopback_enable(priv);
+        if (err) {
+                netdev_err(netdev, "%s: mlx5e_refresh_tirs_self_loopback_enable failed, %d\n",
+                           __func__, err);
+                goto err_close_channels;
+        }
+
         mlx5e_update_carrier(priv);
         mlx5e_redirect_rqts(priv);
 
@@ -1383,6 +1426,8 @@ int mlx5e_open_locked(struct net_device *netdev)
 
         return 0;
 
+err_close_channels:
+        mlx5e_close_channels(priv);
 err_clear_state_opened_flag:
         clear_bit(MLX5E_STATE_OPENED, &priv->state);
         return err;
@@ -1856,6 +1901,8 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
 
         mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
 
+        max_mtu = MLX5E_HW2SW_MTU(max_mtu);
+
         if (new_mtu > max_mtu) {
                 netdev_err(netdev,
                            "%s: Bad MTU (%d) > (%d) Max\n",
@@ -1909,6 +1956,9 @@ static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
                                "Not creating net device, some required device capabilities are missing\n");
                 return -ENOTSUPP;
         }
+        if (!MLX5_CAP_ETH(mdev, self_lb_en_modifiable))
+                mlx5_core_warn(mdev, "Self loop back prevention is not supported\n");
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index cd8f85a251d7..1341b1d3c421 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -61,39 +61,47 @@ void mlx5e_send_nop(struct mlx5e_sq *sq, bool notify_hw)
         }
 }
 
-static void mlx5e_dma_pop_last_pushed(struct mlx5e_sq *sq, dma_addr_t *addr,
-                                      u32 *size)
+static inline void mlx5e_tx_dma_unmap(struct device *pdev,
+                                      struct mlx5e_sq_dma *dma)
 {
-        sq->dma_fifo_pc--;
-        *addr = sq->dma_fifo[sq->dma_fifo_pc & sq->dma_fifo_mask].addr;
-        *size = sq->dma_fifo[sq->dma_fifo_pc & sq->dma_fifo_mask].size;
-}
-
-static void mlx5e_dma_unmap_wqe_err(struct mlx5e_sq *sq, struct sk_buff *skb)
-{
-        dma_addr_t addr;
-        u32 size;
-        int i;
-
-        for (i = 0; i < MLX5E_TX_SKB_CB(skb)->num_dma; i++) {
-                mlx5e_dma_pop_last_pushed(sq, &addr, &size);
-                dma_unmap_single(sq->pdev, addr, size, DMA_TO_DEVICE);
+        switch (dma->type) {
+        case MLX5E_DMA_MAP_SINGLE:
+                dma_unmap_single(pdev, dma->addr, dma->size, DMA_TO_DEVICE);
+                break;
+        case MLX5E_DMA_MAP_PAGE:
+                dma_unmap_page(pdev, dma->addr, dma->size, DMA_TO_DEVICE);
+                break;
+        default:
+                WARN_ONCE(true, "mlx5e_tx_dma_unmap unknown DMA type!\n");
         }
 }
 
-static inline void mlx5e_dma_push(struct mlx5e_sq *sq, dma_addr_t addr,
-                                  u32 size)
+static inline void mlx5e_dma_push(struct mlx5e_sq *sq,
+                                  dma_addr_t addr,
+                                  u32 size,
+                                  enum mlx5e_dma_map_type map_type)
 {
         sq->dma_fifo[sq->dma_fifo_pc & sq->dma_fifo_mask].addr = addr;
         sq->dma_fifo[sq->dma_fifo_pc & sq->dma_fifo_mask].size = size;
+        sq->dma_fifo[sq->dma_fifo_pc & sq->dma_fifo_mask].type = map_type;
         sq->dma_fifo_pc++;
 }
 
-static inline void mlx5e_dma_get(struct mlx5e_sq *sq, u32 i, dma_addr_t *addr,
-                                 u32 *size)
+static inline struct mlx5e_sq_dma *mlx5e_dma_get(struct mlx5e_sq *sq, u32 i)
 {
-        *addr = sq->dma_fifo[i & sq->dma_fifo_mask].addr;
-        *size = sq->dma_fifo[i & sq->dma_fifo_mask].size;
+        return &sq->dma_fifo[i & sq->dma_fifo_mask];
+}
+
+static void mlx5e_dma_unmap_wqe_err(struct mlx5e_sq *sq, struct sk_buff *skb)
+{
+        int i;
+
+        for (i = 0; i < MLX5E_TX_SKB_CB(skb)->num_dma; i++) {
+                struct mlx5e_sq_dma *last_pushed_dma =
+                        mlx5e_dma_get(sq, --sq->dma_fifo_pc);
+
+                mlx5e_tx_dma_unmap(sq->pdev, last_pushed_dma);
+        }
 }
 
 u16 mlx5e_select_queue(struct net_device *dev, struct sk_buff *skb,
@@ -118,8 +126,15 @@ static inline u16 mlx5e_get_inline_hdr_size(struct mlx5e_sq *sq,
          */
 #define MLX5E_MIN_INLINE ETH_HLEN
 
-        if (bf && (skb_headlen(skb) <= sq->max_inline))
-                return skb_headlen(skb);
+        if (bf) {
+                u16 ihs = skb_headlen(skb);
+
+                if (skb_vlan_tag_present(skb))
+                        ihs += VLAN_HLEN;
+
+                if (ihs <= sq->max_inline)
+                        return skb_headlen(skb);
+        }
 
         return MLX5E_MIN_INLINE;
 }
@@ -218,7 +233,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 dseg->lkey       = sq->mkey_be;
                 dseg->byte_count = cpu_to_be32(headlen);
 
-                mlx5e_dma_push(sq, dma_addr, headlen);
+                mlx5e_dma_push(sq, dma_addr, headlen, MLX5E_DMA_MAP_SINGLE);
                 MLX5E_TX_SKB_CB(skb)->num_dma++;
 
                 dseg++;
@@ -237,7 +252,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 dseg->lkey       = sq->mkey_be;
                 dseg->byte_count = cpu_to_be32(fsz);
 
-                mlx5e_dma_push(sq, dma_addr, fsz);
+                mlx5e_dma_push(sq, dma_addr, fsz, MLX5E_DMA_MAP_PAGE);
                 MLX5E_TX_SKB_CB(skb)->num_dma++;
 
                 dseg++;
@@ -353,13 +368,10 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq)
                         }
 
                         for (j = 0; j < MLX5E_TX_SKB_CB(skb)->num_dma; j++) {
-                                dma_addr_t addr;
-                                u32 size;
+                                struct mlx5e_sq_dma *dma =
+                                        mlx5e_dma_get(sq, dma_fifo_cc++);
 
-                                mlx5e_dma_get(sq, dma_fifo_cc, &addr, &size);
-                                dma_fifo_cc++;
-                                dma_unmap_single(sq->pdev, addr, size,
-                                                 DMA_TO_DEVICE);
+                                mlx5e_tx_dma_unmap(sq->pdev, dma);
                         }
 
                         npkts++;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b4f21232019a..79ef799f88ab 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7429,15 +7429,15 @@ process_pkt:
 
                         rtl8169_rx_vlan_tag(desc, skb);
 
+                        if (skb->pkt_type == PACKET_MULTICAST)
+                                dev->stats.multicast++;
+
                         napi_gro_receive(&tp->napi, skb);
 
                         u64_stats_update_begin(&tp->rx_stats.syncp);
                         tp->rx_stats.packets++;
                         tp->rx_stats.bytes += pkt_size;
                         u64_stats_update_end(&tp->rx_stats.syncp);
-
-                        if (skb->pkt_type == PACKET_MULTICAST)
-                                dev->stats.multicast++;
                 }
 release_descriptor:
                 desc->opts2 = 0;
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index aa7b2083cb53..ee8d1ec61fab 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -408,8 +408,6 @@ static int ravb_dmac_init(struct net_device *ndev)
         /* Interrupt enable: */
         /* Frame receive */
         ravb_write(ndev, RIC0_FRE0 | RIC0_FRE1, RIC0);
-        /* Receive FIFO full warning */
-        ravb_write(ndev, RIC1_RFWE, RIC1);
         /* Receive FIFO full error, descriptor empty */
         ravb_write(ndev, RIC2_QFE0 | RIC2_QFE1 | RIC2_RFFE, RIC2);
         /* Frame transmitted, timestamp FIFO updated */
@@ -733,8 +731,10 @@ static irqreturn_t ravb_interrupt(int irq, void *dev_id)
                             ((tis  & tic)  & BIT(q))) {
                                 if (napi_schedule_prep(&priv->napi[q])) {
                                         /* Mask RX and TX interrupts */
-                                        ravb_write(ndev, ric0 & ~BIT(q), RIC0);
-                                        ravb_write(ndev, tic  & ~BIT(q), TIC);
+                                        ric0 &= ~BIT(q);
+                                        tic &= ~BIT(q);
+                                        ravb_write(ndev, ric0, RIC0);
+                                        ravb_write(ndev, tic, TIC);
                                         __napi_schedule(&priv->napi[q]);
                                 } else {
                                         netdev_warn(ndev,
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index d288f1c928de..a3c42a376741 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -3422,7 +3422,7 @@ out:
  * with our request for slot reset the mmio_enabled callback will never be
  * called, and the link_reset callback is not used by AER or EEH mechanisms.
  */
-static struct pci_error_handlers efx_err_handlers = {
+static const struct pci_error_handlers efx_err_handlers = {
         .error_detected = efx_io_error_detected,
         .slot_reset     = efx_io_slot_reset,
         .resume         = efx_io_resume,
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index c860c9007e49..219a99b7a631 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -809,22 +809,17 @@ static int smsc911x_phy_check_loopbackpkt(struct smsc911x_data *pdata)
 
 static int smsc911x_phy_reset(struct smsc911x_data *pdata)
 {
-        struct phy_device *phy_dev = pdata->phy_dev;
         unsigned int temp;
         unsigned int i = 100000;
 
-        BUG_ON(!phy_dev);
-        BUG_ON(!phy_dev->bus);
-
-        SMSC_TRACE(pdata, hw, "Performing PHY BCR Reset");
-        smsc911x_mii_write(phy_dev->bus, phy_dev->addr, MII_BMCR, BMCR_RESET);
+        temp = smsc911x_reg_read(pdata, PMT_CTRL);
+        smsc911x_reg_write(pdata, PMT_CTRL, temp | PMT_CTRL_PHY_RST_);
         do {
                 msleep(1);
-                temp = smsc911x_mii_read(phy_dev->bus, phy_dev->addr,
-                        MII_BMCR);
-        } while ((i--) && (temp & BMCR_RESET));
+                temp = smsc911x_reg_read(pdata, PMT_CTRL);
+        } while ((i--) && (temp & PMT_CTRL_PHY_RST_));
 
-        if (temp & BMCR_RESET) {
+        if (unlikely(temp & PMT_CTRL_PHY_RST_)) {
                 SMSC_WARN(pdata, hw, "PHY reset failed to complete");
                 return -EIO;
         }
@@ -2296,7 +2291,7 @@ static int smsc911x_init(struct net_device *dev)
         }
 
         /* Reset the LAN911x */
-        if (smsc911x_soft_reset(pdata))
+        if (smsc911x_phy_reset(pdata) || smsc911x_soft_reset(pdata))
                 return -ENODEV;
 
         dev->flags |= IFF_MULTICAST;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 9d89bdbf029f..82de68b1a452 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -337,11 +337,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
                              QSGMII_PHY_RX_SIGNAL_DETECT_EN |
                              QSGMII_PHY_TX_DRIVER_EN |
                              QSGMII_PHY_QSGMII_EN |
-                             0x4 << QSGMII_PHY_PHASE_LOOP_GAIN_OFFSET |
-                             0x3 << QSGMII_PHY_RX_DC_BIAS_OFFSET |
-                             0x1 << QSGMII_PHY_RX_INPUT_EQU_OFFSET |
-                             0x2 << QSGMII_PHY_CDR_PI_SLEW_OFFSET |
-                             0xC << QSGMII_PHY_TX_DRV_AMP_OFFSET);
+                             0x4ul << QSGMII_PHY_PHASE_LOOP_GAIN_OFFSET |
+                             0x3ul << QSGMII_PHY_RX_DC_BIAS_OFFSET |
+                             0x1ul << QSGMII_PHY_RX_INPUT_EQU_OFFSET |
+                             0x2ul << QSGMII_PHY_CDR_PI_SLEW_OFFSET |
+                             0xCul << QSGMII_PHY_TX_DRV_AMP_OFFSET);
         }
 
         plat_dat->has_gmac = true;
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index ae68afd50a15..f38696ceee74 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -345,13 +345,6 @@ VELOCITY_PARAM(flow_control, "Enable flow control ability");
 */
 VELOCITY_PARAM(speed_duplex, "Setting the speed and duplex mode");
 
-#define VAL_PKT_LEN_DEF     0
-/* ValPktLen[] is used for setting the checksum offload ability of NIC.
-   0: Receive frame with invalid layer 2 length (Default)
-   1: Drop frame with invalid layer 2 length
-*/
-VELOCITY_PARAM(ValPktLen, "Receiving or Drop invalid 802.3 frame");
-
 #define WOL_OPT_DEF     0
 #define WOL_OPT_MIN     0
 #define WOL_OPT_MAX     7
@@ -494,7 +487,6 @@ static void velocity_get_options(struct velocity_opt *opts, int index,
 
         velocity_set_int_opt(&opts->flow_cntl, flow_control[index], FLOW_CNTL_MIN, FLOW_CNTL_MAX, FLOW_CNTL_DEF, "flow_control", devname);
         velocity_set_bool_opt(&opts->flags, IP_byte_align[index], IP_ALIG_DEF, VELOCITY_FLAGS_IP_ALIGN, "IP_byte_align", devname);
-        velocity_set_bool_opt(&opts->flags, ValPktLen[index], VAL_PKT_LEN_DEF, VELOCITY_FLAGS_VAL_PKT_LEN, "ValPktLen", devname);
         velocity_set_int_opt((int *) &opts->spd_dpx, speed_duplex[index], MED_LNK_MIN, MED_LNK_MAX, MED_LNK_DEF, "Media link mode", devname);
         velocity_set_int_opt(&opts->wol_opts, wol_opts[index], WOL_OPT_MIN, WOL_OPT_MAX, WOL_OPT_DEF, "Wake On Lan options", devname);
         opts->numrx = (opts->numrx & ~3);
@@ -2055,8 +2047,9 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
         int pkt_len = le16_to_cpu(rd->rdesc0.len) & 0x3fff;
         struct sk_buff *skb;
 
-        if (rd->rdesc0.RSR & (RSR_STP | RSR_EDP)) {
-                VELOCITY_PRT(MSG_LEVEL_VERBOSE, KERN_ERR " %s : the received frame spans multiple RDs.\n", vptr->netdev->name);
+        if (unlikely(rd->rdesc0.RSR & (RSR_STP | RSR_EDP | RSR_RL))) {
+                if (rd->rdesc0.RSR & (RSR_STP | RSR_EDP))
+                        VELOCITY_PRT(MSG_LEVEL_VERBOSE, KERN_ERR " %s : the received frame spans multiple RDs.\n", vptr->netdev->name);
                 stats->rx_length_errors++;
                 return -EINVAL;
         }
@@ -2069,17 +2062,6 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
         dma_sync_single_for_cpu(vptr->dev, rd_info->skb_dma,
                                     vptr->rx.buf_sz, DMA_FROM_DEVICE);
 
-        /*
-         *      Drop frame not meeting IEEE 802.3
-         */
-
-        if (vptr->flags & VELOCITY_FLAGS_VAL_PKT_LEN) {
-                if (rd->rdesc0.RSR & RSR_RL) {
-                        stats->rx_length_errors++;
-                        return -EINVAL;
-                }
-        }
-
         velocity_rx_csum(rd, skb);
 
         if (velocity_rx_copy(&skb, pkt_len, vptr) < 0) {
diff --git a/drivers/net/fjes/fjes_hw.c b/drivers/net/fjes/fjes_hw.c
index bb8b5304d851..b103adb8d62e 100644
--- a/drivers/net/fjes/fjes_hw.c
+++ b/drivers/net/fjes/fjes_hw.c
@@ -599,7 +599,7 @@ int fjes_hw_unregister_buff_addr(struct fjes_hw *hw, int dest_epid)
                 FJES_CMD_REQ_RES_CODE_BUSY) &&
                (timeout > 0)) {
                 msleep(200 + hw->my_epid * 20);
-                        timeout -= (200 + hw->my_epid * 20);
+                timeout -= (200 + hw->my_epid * 20);
 
                 res_buf->unshare_buffer.length = 0;
                 res_buf->unshare_buffer.code = 0;
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index d50887e3df6d..8c48bb2a94ea 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -254,7 +254,7 @@ acct:
         }
 }
 
-static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
+static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb,
                             bool local)
 {
         struct ipvl_dev *ipvlan = addr->master;
@@ -262,6 +262,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
         unsigned int len;
         rx_handler_result_t ret = RX_HANDLER_CONSUMED;
         bool success = false;
+        struct sk_buff *skb = *pskb;
 
         len = skb->len + ETH_HLEN;
         if (unlikely(!(dev->flags & IFF_UP))) {
@@ -273,6 +274,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff *skb,
         if (!skb)
                 goto out;
 
+        *pskb = skb;
         skb->dev = dev;
         skb->pkt_type = PACKET_HOST;
 
@@ -486,7 +488,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
 
         addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
         if (addr)
-                return ipvlan_rcv_frame(addr, skb, true);
+                return ipvlan_rcv_frame(addr, &skb, true);
 
 out:
         skb->dev = ipvlan->phy_dev;
@@ -506,7 +508,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
                 if (lyr3h) {
                         addr = ipvlan_addr_lookup(ipvlan->port, lyr3h, addr_type, true);
                         if (addr)
-                                return ipvlan_rcv_frame(addr, skb, true);
+                                return ipvlan_rcv_frame(addr, &skb, true);
                 }
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (!skb)
@@ -589,7 +591,7 @@ static rx_handler_result_t ipvlan_handle_mode_l3(struct sk_buff **pskb,
 
         addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
         if (addr)
-                ret = ipvlan_rcv_frame(addr, skb, false);
+                ret = ipvlan_rcv_frame(addr, pskb, false);
 
 out:
         return ret;
@@ -626,7 +628,7 @@ static rx_handler_result_t ipvlan_handle_mode_l2(struct sk_buff **pskb,
 
                 addr = ipvlan_addr_lookup(port, lyr3h, addr_type, true);
                 if (addr)
-                        ret = ipvlan_rcv_frame(addr, skb, false);
+                        ret = ipvlan_rcv_frame(addr, pskb, false);
         }
 
         return ret;
@@ -651,5 +653,5 @@ rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb)
         WARN_ONCE(true, "ipvlan_handle_frame() called for mode = [%hx]\n",
                           port->mode);
         kfree_skb(skb);
-        return NET_RX_DROP;
+        return RX_HANDLER_CONSUMED;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 86f6c6292c27..06c8bfeaccd6 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -415,6 +415,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
                 skb = ip_check_defrag(dev_net(skb->dev), skb, IP_DEFRAG_MACVLAN);
                 if (!skb)
                         return RX_HANDLER_CONSUMED;
+                *pskb = skb;
                 eth = eth_hdr(skb);
                 macvlan_forward_source(skb, port, eth->h_source);
                 src = macvlan_hash_lookup(port, eth->h_source);
@@ -456,6 +457,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
                 goto out;
         }
 
+        *pskb = skb;
         skb->dev = dev;
         skb->pkt_type = PACKET_HOST;
 
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index fabf11d32d27..2d020a3ec0b5 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -308,6 +308,8 @@ static struct phy_driver at803x_driver[] = {
         .flags                  = PHY_HAS_INTERRUPT,
         .config_aneg            = genphy_config_aneg,
         .read_status            = genphy_read_status,
+        .ack_interrupt          = at803x_ack_interrupt,
+        .config_intr            = at803x_config_intr,
         .driver                 = {
                 .owner = THIS_MODULE,
         },
@@ -327,6 +329,8 @@ static struct phy_driver at803x_driver[] = {
         .flags                  = PHY_HAS_INTERRUPT,
         .config_aneg            = genphy_config_aneg,
         .read_status            = genphy_read_status,
+        .ack_interrupt          = at803x_ack_interrupt,
+        .config_intr            = at803x_config_intr,
         .driver                 = {
                 .owner = THIS_MODULE,
         },
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 5de8d5827536..0240552b50f3 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1154,6 +1154,21 @@ static struct phy_driver marvell_drivers[] = {
                 .driver = { .owner = THIS_MODULE },
         },
         {
+                .phy_id = MARVELL_PHY_ID_88E1540,
+                .phy_id_mask = MARVELL_PHY_ID_MASK,
+                .name = "Marvell 88E1540",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_aneg = &m88e1510_config_aneg,
+                .read_status = &marvell_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .did_interrupt = &m88e1121_did_interrupt,
+                .resume = &genphy_resume,
+                .suspend = &genphy_suspend,
+                .driver = { .owner = THIS_MODULE },
+        },
+        {
                 .phy_id = MARVELL_PHY_ID_88E3016,
                 .phy_id_mask = MARVELL_PHY_ID_MASK,
                 .name = "Marvell 88E3016",
@@ -1186,6 +1201,7 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
         { MARVELL_PHY_ID_88E1318S, MARVELL_PHY_ID_MASK },
         { MARVELL_PHY_ID_88E1116R, MARVELL_PHY_ID_MASK },
         { MARVELL_PHY_ID_88E1510, MARVELL_PHY_ID_MASK },
+        { MARVELL_PHY_ID_88E1540, MARVELL_PHY_ID_MASK },
         { MARVELL_PHY_ID_88E3016, MARVELL_PHY_ID_MASK },
         { }
 };
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index adb48abafc87..48ce6ef400fe 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -863,6 +863,9 @@ void phy_state_machine(struct work_struct *work)
                         needs_aneg = true;
                 break;
         case PHY_NOLINK:
+                if (phy_interrupt_is_valid(phydev))
+                        break;
+
                 err = phy_read_status(phydev);
                 if (err)
                         break;
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 76cad712ddb2..dd295dbaa074 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -66,6 +66,7 @@
 #define PHY_ID_VSC8244                  0x000fc6c0
 #define PHY_ID_VSC8514                  0x00070670
 #define PHY_ID_VSC8574                  0x000704a0
+#define PHY_ID_VSC8601                  0x00070420
 #define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
 #define PHY_ID_VSC8211                  0x000fc4b0
@@ -133,7 +134,8 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
                         (phydev->drv->phy_id == PHY_ID_VSC8234 ||
                          phydev->drv->phy_id == PHY_ID_VSC8244 ||
                          phydev->drv->phy_id == PHY_ID_VSC8514 ||
-                         phydev->drv->phy_id == PHY_ID_VSC8574) ?
+                         phydev->drv->phy_id == PHY_ID_VSC8574 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8601) ?
                                 MII_VSC8244_IMASK_MASK :
                                 MII_VSC8221_IMASK_MASK);
         else {
@@ -272,6 +274,18 @@ static struct phy_driver vsc82xx_driver[] = {
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8601,
+        .name           = "Vitesse VSC8601",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &genphy_config_init,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_VSC8662,
         .name           = "Vitesse VSC8662",
         .phy_id_mask    = 0x000ffff0,
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c78d3cb1b464..3da70bf9936a 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -696,6 +696,11 @@ static const struct usb_device_id	products[] = {
                         USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
         .driver_info = (kernel_ulong_t) &wwan_info,
 }, {
+        /* Dell DW5580 modules */
+        USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, 0x81ba, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = (kernel_ulong_t)&wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 46f4caddccbe..899ea4288197 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2157,12 +2157,13 @@ vmxnet3_set_mc(struct net_device *netdev)
                 if (!netdev_mc_empty(netdev)) {
                         new_table = vmxnet3_copy_mc(netdev);
                         if (new_table) {
-                                rxConf->mfTableLen = cpu_to_le16(
-                                        netdev_mc_count(netdev) * ETH_ALEN);
+                                size_t sz = netdev_mc_count(netdev) * ETH_ALEN;
+
+                                rxConf->mfTableLen = cpu_to_le16(sz);
                                 new_table_pa = dma_map_single(
                                                         &adapter->pdev->dev,
                                                         new_table,
-                                                        rxConf->mfTableLen,
+                                                        sz,
                                                         PCI_DMA_TODEVICE);
                         }
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 3f859a55c035..4c58c83dc225 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.3.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.4.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040300
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040400
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index e0b7b95813bc..9202d1a468d0 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -93,7 +93,7 @@ struct nvme_nvm_l2ptbl {
         __le16                  cdw14[6];
 };
 
-struct nvme_nvm_bbtbl {
+struct nvme_nvm_getbbtbl {
         __u8                    opcode;
         __u8                    flags;
         __u16                   command_id;
@@ -101,10 +101,23 @@ struct nvme_nvm_bbtbl {
         __u64                   rsvd[2];
         __le64                  prp1;
         __le64                  prp2;
-        __le32                  prp1_len;
-        __le32                  prp2_len;
-        __le32                  lbb;
-        __u32                   rsvd11[3];
+        __le64                  spba;
+        __u32                   rsvd4[4];
+};
+
+struct nvme_nvm_setbbtbl {
+        __u8                    opcode;
+        __u8                    flags;
+        __u16                   command_id;
+        __le32                  nsid;
+        __le64                  rsvd[2];
+        __le64                  prp1;
+        __le64                  prp2;
+        __le64                  spba;
+        __le16                  nlb;
+        __u8                    value;
+        __u8                    rsvd3;
+        __u32                   rsvd4[3];
 };
 
 struct nvme_nvm_erase_blk {
@@ -129,8 +142,8 @@ struct nvme_nvm_command {
                 struct nvme_nvm_hb_rw hb_rw;
                 struct nvme_nvm_ph_rw ph_rw;
                 struct nvme_nvm_l2ptbl l2p;
-                struct nvme_nvm_bbtbl get_bb;
-                struct nvme_nvm_bbtbl set_bb;
+                struct nvme_nvm_getbbtbl get_bb;
+                struct nvme_nvm_setbbtbl set_bb;
                 struct nvme_nvm_erase_blk erase;
         };
 };
@@ -142,11 +155,13 @@ struct nvme_nvm_id_group {
         __u8                    num_ch;
         __u8                    num_lun;
         __u8                    num_pln;
+        __u8                    rsvd1;
         __le16                  num_blk;
         __le16                  num_pg;
         __le16                  fpg_sz;
         __le16                  csecs;
         __le16                  sos;
+        __le16                  rsvd2;
         __le32                  trdt;
         __le32                  trdm;
         __le32                  tprt;
@@ -154,8 +169,9 @@ struct nvme_nvm_id_group {
         __le32                  tbet;
         __le32                  tbem;
         __le32                  mpos;
+        __le32                  mccap;
         __le16                  cpar;
-        __u8                    reserved[913];
+        __u8                    reserved[906];
 } __packed;
 
 struct nvme_nvm_addr_format {
@@ -178,15 +194,28 @@ struct nvme_nvm_id {
         __u8                    ver_id;
         __u8                    vmnt;
         __u8                    cgrps;
-        __u8                    res[5];
+        __u8                    res;
         __le32                  cap;
         __le32                  dom;
         struct nvme_nvm_addr_format ppaf;
-        __u8                    ppat;
-        __u8                    resv[223];
+        __u8                    resv[228];
         struct nvme_nvm_id_group groups[4];
 } __packed;
 
+struct nvme_nvm_bb_tbl {
+        __u8    tblid[4];
+        __le16  verid;
+        __le16  revid;
+        __le32  rvsd1;
+        __le32  tblks;
+        __le32  tfact;
+        __le32  tgrown;
+        __le32  tdresv;
+        __le32  thresv;
+        __le32  rsvd2[8];
+        __u8    blk[0];
+};
+
 /*
  * Check we didn't inadvertently grow the command struct
  */
@@ -195,12 +224,14 @@ static inline void _nvme_nvm_check_size(void)
         BUILD_BUG_ON(sizeof(struct nvme_nvm_identity) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_hb_rw) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_ph_rw) != 64);
-        BUILD_BUG_ON(sizeof(struct nvme_nvm_bbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_getbbtbl) != 64);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_setbbtbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_l2ptbl) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_erase_blk) != 64);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id_group) != 960);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_addr_format) != 128);
         BUILD_BUG_ON(sizeof(struct nvme_nvm_id) != 4096);
+        BUILD_BUG_ON(sizeof(struct nvme_nvm_bb_tbl) != 512);
 }
 
 static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
@@ -234,6 +265,7 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
                 dst->tbet = le32_to_cpu(src->tbet);
                 dst->tbem = le32_to_cpu(src->tbem);
                 dst->mpos = le32_to_cpu(src->mpos);
+                dst->mccap = le32_to_cpu(src->mccap);
 
                 dst->cpar = le16_to_cpu(src->cpar);
         }
@@ -244,6 +276,7 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
 static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
 {
         struct nvme_ns *ns = q->queuedata;
+        struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_id *nvme_nvm_id;
         struct nvme_nvm_command c = {};
         int ret;
@@ -256,8 +289,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         if (!nvme_nvm_id)
                 return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, nvme_nvm_id,
-                                                sizeof(struct nvme_nvm_id));
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                nvme_nvm_id, sizeof(struct nvme_nvm_id));
         if (ret) {
                 ret = -EIO;
                 goto out;
@@ -268,6 +301,8 @@ static int nvme_nvm_identity(struct request_queue *q, struct nvm_id *nvm_id)
         nvm_id->cgrps = nvme_nvm_id->cgrps;
         nvm_id->cap = le32_to_cpu(nvme_nvm_id->cap);
         nvm_id->dom = le32_to_cpu(nvme_nvm_id->dom);
+        memcpy(&nvm_id->ppaf, &nvme_nvm_id->ppaf,
+                                        sizeof(struct nvme_nvm_addr_format));
 
         ret = init_grps(nvm_id, nvme_nvm_id);
 out:
@@ -281,7 +316,7 @@ static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
         struct nvme_ns *ns = q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        u32 len = queue_max_hw_sectors(q) << 9;
+        u32 len = queue_max_hw_sectors(dev->admin_q) << 9;
         u32 nlb_pr_rq = len / sizeof(u64);
         u64 cmd_slba = slba;
         void *entries;
@@ -299,8 +334,8 @@ static int nvme_nvm_get_l2p_tbl(struct request_queue *q, u64 slba, u32 nlb,
                 c.l2p.slba = cpu_to_le64(cmd_slba);
                 c.l2p.nlb = cpu_to_le32(cmd_nlb);
 
-                ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c,
-                                                                entries, len);
+                ret = nvme_submit_sync_cmd(dev->admin_q,
+                                (struct nvme_command *)&c, entries, len);
                 if (ret) {
                         dev_err(dev->dev, "L2P table transfer failed (%d)\n",
                                                                         ret);
@@ -322,43 +357,82 @@ out:
         return ret;
 }
 
-static int nvme_nvm_get_bb_tbl(struct request_queue *q, int lunid,
-                                unsigned int nr_blocks,
-                                nvm_bb_update_fn *update_bbtbl, void *priv)
+static int nvme_nvm_get_bb_tbl(struct request_queue *q, struct ppa_addr ppa,
+                                int nr_blocks, nvm_bb_update_fn *update_bbtbl,
+                                void *priv)
 {
         struct nvme_ns *ns = q->queuedata;
         struct nvme_dev *dev = ns->dev;
         struct nvme_nvm_command c = {};
-        void *bb_bitmap;
-        u16 bb_bitmap_size;
+        struct nvme_nvm_bb_tbl *bb_tbl;
+        int tblsz = sizeof(struct nvme_nvm_bb_tbl) + nr_blocks;
         int ret = 0;
 
         c.get_bb.opcode = nvme_nvm_admin_get_bb_tbl;
         c.get_bb.nsid = cpu_to_le32(ns->ns_id);
-        c.get_bb.lbb = cpu_to_le32(lunid);
-        bb_bitmap_size = ((nr_blocks >> 15) + 1) * PAGE_SIZE;
-        bb_bitmap = kmalloc(bb_bitmap_size, GFP_KERNEL);
-        if (!bb_bitmap)
-                return -ENOMEM;
+        c.get_bb.spba = cpu_to_le64(ppa.ppa);
 
-        bitmap_zero(bb_bitmap, nr_blocks);
+        bb_tbl = kzalloc(tblsz, GFP_KERNEL);
+        if (!bb_tbl)
+                return -ENOMEM;
 
-        ret = nvme_submit_sync_cmd(q, (struct nvme_command *)&c, bb_bitmap,
-                                                                bb_bitmap_size);
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                bb_tbl, tblsz);
         if (ret) {
                 dev_err(dev->dev, "get bad block table failed (%d)\n", ret);
                 ret = -EIO;
                 goto out;
         }
 
-        ret = update_bbtbl(lunid, bb_bitmap, nr_blocks, priv);
+        if (bb_tbl->tblid[0] != 'B' || bb_tbl->tblid[1] != 'B' ||
+                bb_tbl->tblid[2] != 'L' || bb_tbl->tblid[3] != 'T') {
+                dev_err(dev->dev, "bbt format mismatch\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (le16_to_cpu(bb_tbl->verid) != 1) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt version not supported\n");
+                goto out;
+        }
+
+        if (le32_to_cpu(bb_tbl->tblks) != nr_blocks) {
+                ret = -EINVAL;
+                dev_err(dev->dev, "bbt unsuspected blocks returned (%u!=%u)",
+                                        le32_to_cpu(bb_tbl->tblks), nr_blocks);
+                goto out;
+        }
+
+        ret = update_bbtbl(ppa, nr_blocks, bb_tbl->blk, priv);
         if (ret) {
                 ret = -EINTR;
                 goto out;
         }
 
 out:
-        kfree(bb_bitmap);
+        kfree(bb_tbl);
+        return ret;
+}
+
+static int nvme_nvm_set_bb_tbl(struct request_queue *q, struct nvm_rq *rqd,
+                                                                int type)
+{
+        struct nvme_ns *ns = q->queuedata;
+        struct nvme_dev *dev = ns->dev;
+        struct nvme_nvm_command c = {};
+        int ret = 0;
+
+        c.set_bb.opcode = nvme_nvm_admin_set_bb_tbl;
+        c.set_bb.nsid = cpu_to_le32(ns->ns_id);
+        c.set_bb.spba = cpu_to_le64(rqd->ppa_addr.ppa);
+        c.set_bb.nlb = cpu_to_le16(rqd->nr_pages - 1);
+        c.set_bb.value = type;
+
+        ret = nvme_submit_sync_cmd(dev->admin_q, (struct nvme_command *)&c,
+                                                                NULL, 0);
+        if (ret)
+                dev_err(dev->dev, "set bad block table failed (%d)\n", ret);
         return ret;
 }
 
@@ -474,6 +548,7 @@ static struct nvm_dev_ops nvme_nvm_dev_ops = {
         .get_l2p_tbl            = nvme_nvm_get_l2p_tbl,
 
         .get_bb_tbl             = nvme_nvm_get_bb_tbl,
+        .set_bb_tbl             = nvme_nvm_set_bb_tbl,
 
         .submit_io              = nvme_nvm_submit_io,
         .erase_block            = nvme_nvm_erase_block,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 8187df204695..f3b53af789ef 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -896,19 +896,28 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
                         goto retry_cmd;
                 }
                 if (blk_integrity_rq(req)) {
-                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1)
+                        if (blk_rq_count_integrity_sg(req->q, req->bio) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         sg_init_table(iod->meta_sg, 1);
                         if (blk_rq_map_integrity_sg(
-                                        req->q, req->bio, iod->meta_sg) != 1)
+                                        req->q, req->bio, iod->meta_sg) != 1) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
 
                         if (rq_data_dir(req))
                                 nvme_dif_remap(req, nvme_dif_prep);
 
-                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir))
+                        if (!dma_map_sg(nvmeq->q_dmadev, iod->meta_sg, 1, dma_dir)) {
+                                dma_unmap_sg(dev->dev, iod->sg, iod->nents,
+                                                dma_dir);
                                 goto error_cmd;
+                        }
                 }
         }
 
@@ -968,7 +977,8 @@ static void __nvme_process_cq(struct nvme_queue *nvmeq, unsigned int *tag)
         if (head == nvmeq->cq_head && phase == nvmeq->cq_phase)
                 return;
 
-        writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
+        if (likely(nvmeq->cq_vector >= 0))
+                writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
         nvmeq->cq_head = head;
         nvmeq->cq_phase = phase;
 
@@ -1727,9 +1737,13 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
         u32 aqa;
         u64 cap = lo_hi_readq(&dev->bar->cap);
         struct nvme_queue *nvmeq;
-        unsigned page_shift = PAGE_SHIFT;
+        /*
+         * default to a 4K page size, with the intention to update this
+         * path in the future to accomodate architectures with differing
+         * kernel and IO page sizes.
+         */
+        unsigned page_shift = 12;
         unsigned dev_page_min = NVME_CAP_MPSMIN(cap) + 12;
-        unsigned dev_page_max = NVME_CAP_MPSMAX(cap) + 12;
 
         if (page_shift < dev_page_min) {
                 dev_err(dev->dev,
@@ -1738,13 +1752,6 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
                                 1 << page_shift);
                 return -ENODEV;
         }
-        if (page_shift > dev_page_max) {
-                dev_info(dev->dev,
-                                "Device maximum page size (%u) smaller than "
-                                "host (%u); enabling work-around\n",
-                                1 << dev_page_max, 1 << page_shift);
-                page_shift = dev_page_max;
-        }
 
         dev->subsystem = readl(&dev->bar->vs) >= NVME_VS(1, 1) ?
                                                 NVME_CAP_NSSRC(cap) : 0;
@@ -2268,7 +2275,7 @@ static void nvme_alloc_ns(struct nvme_dev *dev, unsigned nsid)
         if (dev->max_hw_sectors) {
                 blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
                 blk_queue_max_segments(ns->queue,
-                        ((dev->max_hw_sectors << 9) / dev->page_size) + 1);
+                        (dev->max_hw_sectors / (dev->page_size >> 9)) + 1);
         }
         if (dev->stripe_size)
                 blk_queue_chunk_sectors(ns->queue, dev->stripe_size >> 9);
@@ -2787,6 +2794,10 @@ static void nvme_del_queue_end(struct nvme_queue *nvmeq)
 {
         struct nvme_delq_ctx *dq = nvmeq->cmdinfo.ctx;
         nvme_put_dq(dq);
+
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_process_cq(nvmeq);
+        spin_unlock_irq(&nvmeq->q_lock);
 }
 
 static int adapter_async_del_queue(struct nvme_queue *nvmeq, u8 opcode,
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 540f077c37ea..02a7452bdf23 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -440,7 +440,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
                                          ret, pp->io);
                                 continue;
                         }
-                        pp->io_base = pp->io->start;
                         break;
                 case IORESOURCE_MEM:
                         pp->mem = win->res;
diff --git a/drivers/pci/host/pcie-hisi.c b/drivers/pci/host/pcie-hisi.c
index 35457ecd8e70..163671a4f798 100644
--- a/drivers/pci/host/pcie-hisi.c
+++ b/drivers/pci/host/pcie-hisi.c
@@ -111,7 +111,7 @@ static struct pcie_host_ops hisi_pcie_host_ops = {
         .link_up = hisi_pcie_link_up,
 };
 
-static int __init hisi_add_pcie_port(struct pcie_port *pp,
+static int hisi_add_pcie_port(struct pcie_port *pp,
                                      struct platform_device *pdev)
 {
         int ret;
@@ -139,7 +139,7 @@ static int __init hisi_add_pcie_port(struct pcie_port *pp,
         return 0;
 }
 
-static int __init hisi_pcie_probe(struct platform_device *pdev)
+static int hisi_pcie_probe(struct platform_device *pdev)
 {
         struct hisi_pcie *hisi_pcie;
         struct pcie_port *pp;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92618686604c..eead54cd01b2 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -216,7 +216,10 @@ static ssize_t numa_node_store(struct device *dev,
         if (ret)
                 return ret;
 
-        if (node >= MAX_NUMNODES || !node_online(node))
+        if ((node < 0 && node != NUMA_NO_NODE) || node >= MAX_NUMNODES)
+                return -EINVAL;
+
+        if (node != NUMA_NO_NODE && !node_online(node))
                 return -EINVAL;
 
         add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index fd2f03fa53f3..d390fc1475ec 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -337,6 +337,4 @@ static inline int pci_dev_specific_reset(struct pci_dev *dev, int probe)
 }
 #endif
 
-struct pci_host_bridge *pci_find_host_bridge(struct pci_bus *bus);
-
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index e735c728e3b3..edb1984201e9 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1685,8 +1685,8 @@ static void pci_dma_configure(struct pci_dev *dev)
 {
         struct device *bridge = pci_get_host_bridge_device(dev);
 
-        if (IS_ENABLED(CONFIG_OF) && dev->dev.of_node) {
-                if (bridge->parent)
+        if (IS_ENABLED(CONFIG_OF) &&
+                bridge->parent && bridge->parent->of_node) {
                         of_dma_configure(&dev->dev, bridge->parent->of_node);
         } else if (has_acpi_companion(bridge)) {
                 struct acpi_device *adev = to_acpi_device_node(bridge->fwnode);
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 8b3130f22b42..9e03d158f411 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1478,6 +1478,8 @@ module_init(remoteproc_init);
 
 static void __exit remoteproc_exit(void)
 {
+        ida_destroy(&rproc_dev_index);
+
         rproc_exit_debugfs();
 }
 module_exit(remoteproc_exit);
diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
index 9d30809bb407..916af5096f57 100644
--- a/drivers/remoteproc/remoteproc_debugfs.c
+++ b/drivers/remoteproc/remoteproc_debugfs.c
@@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp, const char __user *user_buf,
         char buf[10];
         int ret;
 
-        if (count > sizeof(buf))
+        if (count < 1 || count > sizeof(buf))
                 return count;
 
         ret = copy_from_user(buf, user_buf, count);
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 188006c55ce0..aa705bb4748c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -15,9 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/of_device.h>
-#include <linux/of_irq.h>
-#include <linux/pm_wakeirq.h>
 #include <linux/rtc/ds1307.h>
 #include <linux/rtc.h>
 #include <linux/slab.h>
@@ -117,7 +114,6 @@ struct ds1307 {
 #define HAS_ALARM       1               /* bit 1 == irq claimed */
         struct i2c_client       *client;
         struct rtc_device       *rtc;
-        int                     wakeirq;
         s32 (*read_block_data)(const struct i2c_client *client, u8 command,
                                u8 length, u8 *values);
         s32 (*write_block_data)(const struct i2c_client *client, u8 command,
@@ -1138,7 +1134,10 @@ read_rtc:
                                 bin2bcd(tmp));
         }
 
-        device_set_wakeup_capable(&client->dev, want_irq);
+        if (want_irq) {
+                device_set_wakeup_capable(&client->dev, true);
+                set_bit(HAS_ALARM, &ds1307->flags);
+        }
         ds1307->rtc = devm_rtc_device_register(&client->dev, client->name,
                                 rtc_ops, THIS_MODULE);
         if (IS_ERR(ds1307->rtc)) {
@@ -1146,43 +1145,19 @@ read_rtc:
         }
 
         if (want_irq) {
-                struct device_node *node = client->dev.of_node;
-
                 err = devm_request_threaded_irq(&client->dev,
                                                 client->irq, NULL, irq_handler,
                                                 IRQF_SHARED | IRQF_ONESHOT,
                                                 ds1307->rtc->name, client);
                 if (err) {
                         client->irq = 0;
+                        device_set_wakeup_capable(&client->dev, false);
+                        clear_bit(HAS_ALARM, &ds1307->flags);
                         dev_err(&client->dev, "unable to request IRQ!\n");
-                        goto no_irq;
-                }
-
-                set_bit(HAS_ALARM, &ds1307->flags);
-                dev_dbg(&client->dev, "got IRQ %d\n", client->irq);
-
-                /* Currently supported by OF code only! */
-                if (!node)
-                        goto no_irq;
-
-                err = of_irq_get(node, 1);
-                if (err <= 0) {
-                        if (err == -EPROBE_DEFER)
-                                goto exit;
-                        goto no_irq;
-                }
-                ds1307->wakeirq = err;
-
-                err = dev_pm_set_dedicated_wake_irq(&client->dev,
-                                                    ds1307->wakeirq);
-                if (err) {
-                        dev_err(&client->dev, "unable to setup wakeIRQ %d!\n",
-                                err);
-                        goto exit;
-                }
+                } else
+                        dev_dbg(&client->dev, "got IRQ %d\n", client->irq);
         }
 
-no_irq:
         if (chip->nvram_size) {
 
                 ds1307->nvram = devm_kzalloc(&client->dev,
@@ -1226,9 +1201,6 @@ static int ds1307_remove(struct i2c_client *client)
 {
         struct ds1307 *ds1307 = i2c_get_clientdata(client);
 
-        if (ds1307->wakeirq)
-                dev_pm_clear_wake_irq(&client->dev);
-
         if (test_and_clear_bit(HAS_NVRAM, &ds1307->flags))
                 sysfs_remove_bin_file(&client->dev.kobj, ds1307->nvram);
 
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 548a18916a31..a831d18596a5 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -1080,28 +1080,10 @@ void __init chsc_init_cleanup(void)
         free_page((unsigned long)sei_page);
 }
 
-int chsc_enable_facility(int operation_code)
+int __chsc_enable_facility(struct chsc_sda_area *sda_area, int operation_code)
 {
-        unsigned long flags;
         int ret;
-        struct {
-                struct chsc_header request;
-                u8 reserved1:4;
-                u8 format:4;
-                u8 reserved2;
-                u16 operation_code;
-                u32 reserved3;
-                u32 reserved4;
-                u32 operation_data_area[252];
-                struct chsc_header response;
-                u32 reserved5:4;
-                u32 format2:4;
-                u32 reserved6:24;
-        } __attribute__ ((packed)) *sda_area;
 
-        spin_lock_irqsave(&chsc_page_lock, flags);
-        memset(chsc_page, 0, PAGE_SIZE);
-        sda_area = chsc_page;
         sda_area->request.length = 0x0400;
         sda_area->request.code = 0x0031;
         sda_area->operation_code = operation_code;
@@ -1119,10 +1101,25 @@ int chsc_enable_facility(int operation_code)
         default:
                 ret = chsc_error_from_response(sda_area->response.code);
         }
+out:
+        return ret;
+}
+
+int chsc_enable_facility(int operation_code)
+{
+        struct chsc_sda_area *sda_area;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&chsc_page_lock, flags);
+        memset(chsc_page, 0, PAGE_SIZE);
+        sda_area = chsc_page;
+
+        ret = __chsc_enable_facility(sda_area, operation_code);
         if (ret != 0)
                 CIO_CRW_EVENT(2, "chsc: sda (oc=%x) failed (rc=%04x)\n",
                               operation_code, sda_area->response.code);
-out:
+
         spin_unlock_irqrestore(&chsc_page_lock, flags);
         return ret;
 }
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 76c9b50700b2..0de134c3a204 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -115,6 +115,20 @@ struct chsc_scpd {
         u8 data[PAGE_SIZE - 20];
 } __attribute__ ((packed));
 
+struct chsc_sda_area {
+        struct chsc_header request;
+        u8 :4;
+        u8 format:4;
+        u8 :8;
+        u16 operation_code;
+        u32 :32;
+        u32 :32;
+        u32 operation_data_area[252];
+        struct chsc_header response;
+        u32 :4;
+        u32 format2:4;
+        u32 :24;
+} __packed __aligned(PAGE_SIZE);
 
 extern int chsc_get_ssd_info(struct subchannel_id schid,
                              struct chsc_ssd_info *ssd);
@@ -122,6 +136,7 @@ extern int chsc_determine_css_characteristics(void);
 extern int chsc_init(void);
 extern void chsc_init_cleanup(void);
 
+int __chsc_enable_facility(struct chsc_sda_area *sda_area, int operation_code);
 extern int chsc_enable_facility(int);
 struct channel_subsystem;
 extern int chsc_secm(struct channel_subsystem *, int);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index b5620e818d6b..690b8547e828 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -925,18 +925,32 @@ void reipl_ccw_dev(struct ccw_dev_id *devid)
 
 int __init cio_get_iplinfo(struct cio_iplinfo *iplinfo)
 {
+        static struct chsc_sda_area sda_area __initdata;
         struct subchannel_id schid;
         struct schib schib;
 
         schid = *(struct subchannel_id *)&S390_lowcore.subchannel_id;
         if (!schid.one)
                 return -ENODEV;
+
+        if (schid.ssid) {
+                /*
+                 * Firmware should have already enabled MSS but whoever started
+                 * the kernel might have initiated a channel subsystem reset.
+                 * Ensure that MSS is enabled.
+                 */
+                memset(&sda_area, 0, sizeof(sda_area));
+                if (__chsc_enable_facility(&sda_area, CHSC_SDA_OC_MSS))
+                        return -ENODEV;
+        }
         if (stsch_err(schid, &schib))
                 return -ENODEV;
         if (schib.pmcw.st != SUBCHANNEL_TYPE_IO)
                 return -ENODEV;
         if (!schib.pmcw.dnv)
                 return -ENODEV;
+
+        iplinfo->ssid = schid.ssid;
         iplinfo->devno = schib.pmcw.dev;
         iplinfo->is_qdio = schib.pmcw.qf;
         return 0;
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 2ee3053bdc12..489e703dc82d 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -702,17 +702,12 @@ css_generate_pgid(struct channel_subsystem *css, u32 tod_high)
                 css->global_pgid.pgid_high.ext_cssid.version = 0x80;
                 css->global_pgid.pgid_high.ext_cssid.cssid = css->cssid;
         } else {
-#ifdef CONFIG_SMP
                 css->global_pgid.pgid_high.cpu_addr = stap();
-#else
-                css->global_pgid.pgid_high.cpu_addr = 0;
-#endif
         }
         get_cpu_id(&cpu_id);
         css->global_pgid.cpu_id = cpu_id.ident;
         css->global_pgid.cpu_model = cpu_id.machine;
         css->global_pgid.tod_high = tod_high;
-
 }
 
 static void
diff --git a/drivers/s390/crypto/Makefile b/drivers/s390/crypto/Makefile
index 57f710b3c8a4..b8ab18676e69 100644
--- a/drivers/s390/crypto/Makefile
+++ b/drivers/s390/crypto/Makefile
@@ -3,6 +3,9 @@
 #
 
 ap-objs := ap_bus.o
-obj-$(CONFIG_ZCRYPT) += ap.o zcrypt_api.o zcrypt_pcixcc.o
-obj-$(CONFIG_ZCRYPT) += zcrypt_cex2a.o zcrypt_cex4.o
+# zcrypt_api depends on ap
+obj-$(CONFIG_ZCRYPT) += ap.o zcrypt_api.o
+# msgtype* depend on zcrypt_api
 obj-$(CONFIG_ZCRYPT) += zcrypt_msgtype6.o zcrypt_msgtype50.o
+# adapter drivers depend on ap, zcrypt_api and msgtype*
+obj-$(CONFIG_ZCRYPT) += zcrypt_pcixcc.o zcrypt_cex2a.o zcrypt_cex4.o
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9cb3dfbcaddb..61f768518a34 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -74,6 +74,7 @@ static struct device *ap_root_device = NULL;
 static struct ap_config_info *ap_configuration;
 static DEFINE_SPINLOCK(ap_device_list_lock);
 static LIST_HEAD(ap_device_list);
+static bool initialised;
 
 /*
  * Workqueue timer for bus rescan.
@@ -1384,6 +1385,9 @@ int ap_driver_register(struct ap_driver *ap_drv, struct module *owner,
 {
         struct device_driver *drv = &ap_drv->driver;
 
+        if (!initialised)
+                return -ENODEV;
+
         drv->bus = &ap_bus_type;
         drv->probe = ap_device_probe;
         drv->remove = ap_device_remove;
@@ -1808,6 +1812,7 @@ int __init ap_module_init(void)
                 goto out_pm;
 
         queue_work(system_long_wq, &ap_scan_work);
+        initialised = true;
 
         return 0;
 
@@ -1837,6 +1842,7 @@ void ap_module_exit(void)
 {
         int i;
 
+        initialised = false;
         ap_reset_domain();
         ap_poll_thread_stop();
         del_timer_sync(&ap_config_timer);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index a9603ebbc1f8..9f8fa42c062c 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -317,11 +317,9 @@ EXPORT_SYMBOL(zcrypt_device_unregister);
 
 void zcrypt_msgtype_register(struct zcrypt_ops *zops)
 {
-        if (zops->owner) {
-                spin_lock_bh(&zcrypt_ops_list_lock);
-                list_add_tail(&zops->list, &zcrypt_ops_list);
-                spin_unlock_bh(&zcrypt_ops_list_lock);
-        }
+        spin_lock_bh(&zcrypt_ops_list_lock);
+        list_add_tail(&zops->list, &zcrypt_ops_list);
+        spin_unlock_bh(&zcrypt_ops_list_lock);
 }
 EXPORT_SYMBOL(zcrypt_msgtype_register);
 
@@ -342,7 +340,7 @@ struct zcrypt_ops *__ops_lookup(unsigned char *name, int variant)
         spin_lock_bh(&zcrypt_ops_list_lock);
         list_for_each_entry(zops, &zcrypt_ops_list, list) {
                 if ((zops->variant == variant) &&
-                    (!strncmp(zops->owner->name, name, MODULE_NAME_LEN))) {
+                    (!strncmp(zops->name, name, sizeof(zops->name)))) {
                         found = 1;
                         break;
                 }
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 750876891931..38618f05ad92 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -96,6 +96,7 @@ struct zcrypt_ops {
         struct list_head list;          /* zcrypt ops list. */
         struct module *owner;
         int variant;
+        char name[128];
 };
 
 struct zcrypt_device {
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
index 71ceee9137a8..74edf2934e7c 100644
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -513,6 +513,7 @@ static struct zcrypt_ops zcrypt_msgtype50_ops = {
         .rsa_modexpo = zcrypt_cex2a_modexpo,
         .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
         .owner = THIS_MODULE,
+        .name = MSGTYPE50_NAME,
         .variant = MSGTYPE50_VARIANT_DEFAULT,
 };
 
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 74762214193b..9a2dd472c1cc 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -1119,6 +1119,7 @@ static long zcrypt_msgtype6_rng(struct zcrypt_device *zdev,
  */
 static struct zcrypt_ops zcrypt_msgtype6_norng_ops = {
         .owner = THIS_MODULE,
+        .name = MSGTYPE06_NAME,
         .variant = MSGTYPE06_VARIANT_NORNG,
         .rsa_modexpo = zcrypt_msgtype6_modexpo,
         .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
@@ -1127,6 +1128,7 @@ static struct zcrypt_ops zcrypt_msgtype6_norng_ops = {
 
 static struct zcrypt_ops zcrypt_msgtype6_ops = {
         .owner = THIS_MODULE,
+        .name = MSGTYPE06_NAME,
         .variant = MSGTYPE06_VARIANT_DEFAULT,
         .rsa_modexpo = zcrypt_msgtype6_modexpo,
         .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
@@ -1136,6 +1138,7 @@ static struct zcrypt_ops zcrypt_msgtype6_ops = {
 
 static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
         .owner = THIS_MODULE,
+        .name = MSGTYPE06_NAME,
         .variant = MSGTYPE06_VARIANT_EP11,
         .rsa_modexpo = NULL,
         .rsa_modexpo_crt = NULL,
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 3ba2e9564b9a..81af294f15a7 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -902,7 +902,7 @@ static ssize_t tcm_qla2xxx_tpg_fabric_prot_type_show(struct config_item *item,
         return sprintf(page, "%d\n", tpg->tpg_attrib.fabric_prot_type);
 }
 
-CONFIGFS_ATTR_WO(tcm_qla2xxx_tpg_, enable);
+CONFIGFS_ATTR(tcm_qla2xxx_tpg_, enable);
 CONFIGFS_ATTR_RO(tcm_qla2xxx_tpg_, dynamic_sessions);
 CONFIGFS_ATTR(tcm_qla2xxx_tpg_, fabric_prot_type);
 
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index 25abd4eb7d10..91a003011acf 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
 
 static int __init sh_pm_runtime_init(void)
 {
-        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE_MULTI)) {
+        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
                 if (!of_find_compatible_node(NULL, NULL,
                                              "renesas,cpg-mstp-clocks"))
                         return 0;
diff --git a/drivers/soc/mediatek/Kconfig b/drivers/soc/mediatek/Kconfig
index 9d5068248aa0..0a4ea809a61b 100644
--- a/drivers/soc/mediatek/Kconfig
+++ b/drivers/soc/mediatek/Kconfig
@@ -23,6 +23,7 @@ config MTK_PMIC_WRAP
 config MTK_SCPSYS
         bool "MediaTek SCPSYS Support"
         depends on ARCH_MEDIATEK || COMPILE_TEST
+        default ARM64 && ARCH_MEDIATEK
         select REGMAP
         select MTK_INFRACFG
         select PM_GENERIC_DOMAINS if PM
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index f3a0b6a4b54e..8c03a80b482d 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1179,7 +1179,7 @@ static int knav_queue_setup_link_ram(struct knav_device *kdev)
 
                 block++;
                 if (!block->size)
-                        return 0;
+                        continue;
 
                 dev_dbg(kdev->dev, "linkram1: phys:%x, virt:%p, size:%x\n",
                         block->phys, block->virt, block->size);
@@ -1519,9 +1519,9 @@ static int knav_queue_load_pdsp(struct knav_device *kdev,
 
         for (i = 0; i < ARRAY_SIZE(knav_acc_firmwares); i++) {
                 if (knav_acc_firmwares[i]) {
-                        ret = request_firmware(&fw,
-                                               knav_acc_firmwares[i],
-                                               kdev->dev);
+                        ret = request_firmware_direct(&fw,
+                                                      knav_acc_firmwares[i],
+                                                      kdev->dev);
                         if (!ret) {
                                 found = true;
                                 break;
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 6d5b38d69578..9d7f0004d2d7 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -18,7 +18,8 @@ source "drivers/staging/iio/resolver/Kconfig"
 source "drivers/staging/iio/trigger/Kconfig"
 
 config IIO_DUMMY_EVGEN
-       tristate
+        tristate
+        select IRQ_WORK
 
 config IIO_SIMPLE_DUMMY
        tristate "An example driver with no hardware requirements"
diff --git a/drivers/staging/iio/adc/lpc32xx_adc.c b/drivers/staging/iio/adc/lpc32xx_adc.c
index d11c54b72186..b51f237cd817 100644
--- a/drivers/staging/iio/adc/lpc32xx_adc.c
+++ b/drivers/staging/iio/adc/lpc32xx_adc.c
@@ -76,7 +76,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
 
         if (mask == IIO_CHAN_INFO_RAW) {
                 mutex_lock(&indio_dev->mlock);
-                clk_enable(info->clk);
+                clk_prepare_enable(info->clk);
                 /* Measurement setup */
                 __raw_writel(AD_INTERNAL | (chan->address) | AD_REFp | AD_REFm,
                              LPC32XX_ADC_SELECT(info->adc_base));
@@ -84,7 +84,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
                 __raw_writel(AD_PDN_CTRL | AD_STROBE,
                              LPC32XX_ADC_CTRL(info->adc_base));
                 wait_for_completion(&info->completion); /* set by ISR */
-                clk_disable(info->clk);
+                clk_disable_unprepare(info->clk);
                 *val = info->value;
                 mutex_unlock(&indio_dev->mlock);
 
diff --git a/drivers/staging/wilc1000/coreconfigurator.c b/drivers/staging/wilc1000/coreconfigurator.c
index e10c6ffa698a..9568bdb6319b 100644
--- a/drivers/staging/wilc1000/coreconfigurator.c
+++ b/drivers/staging/wilc1000/coreconfigurator.c
@@ -13,12 +13,8 @@
 #include "wilc_wlan.h"
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/etherdevice.h>
 #define TAG_PARAM_OFFSET        (MAC_HDR_LEN + TIME_STAMP_LEN + \
                                                         BEACON_INTERVAL_LEN + CAP_INFO_LEN)
-#define ADDR1 4
-#define ADDR2 10
-#define ADDR3 16
 
 /* Basic Frame Type Codes (2-bit) */
 enum basic_frame_type {
@@ -175,32 +171,38 @@ static inline u8 get_from_ds(u8 *header)
         return ((header[1] & 0x02) >> 1);
 }
 
+/* This function extracts the MAC Address in 'address1' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address1(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 4, 6);
+}
+
+/* This function extracts the MAC Address in 'address2' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address2(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 10, 6);
+}
+
+/* This function extracts the MAC Address in 'address3' field of the MAC     */
+/* header and updates the MAC Address in the allocated 'addr' variable.      */
+static inline void get_address3(u8 *pu8msa, u8 *addr)
+{
+        memcpy(addr, pu8msa + 16, 6);
+}
+
 /* This function extracts the BSSID from the incoming WLAN packet based on   */
-/* the 'from ds' bit, and updates the MAC Address in the allocated 'data'    */
+/* the 'from ds' bit, and updates the MAC Address in the allocated 'addr'    */
 /* variable.                                                                 */
 static inline void get_BSSID(u8 *data, u8 *bssid)
 {
         if (get_from_ds(data) == 1)
-                /*
-                 * Extract the MAC Address in 'address2' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 *  variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR2);
+                get_address2(data, bssid);
         else if (get_to_ds(data) == 1)
-                /*
-                 * Extract the MAC Address in 'address1' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 * variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR1);
+                get_address1(data, bssid);
         else
-                /*
-                 * Extract the MAC Address in 'address3' field of the MAC
-                 * header and update the MAC Address in the allocated 'data'
-                 * variable.
-                 */
-                ether_addr_copy(data, bssid + ADDR3);
+                get_address3(data, bssid);
 }
 
 /* This function extracts the SSID from a beacon/probe response frame        */
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 342a07c58d89..72204fbf2bb1 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4074,6 +4074,17 @@ reject:
         return iscsit_add_reject(conn, ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
 }
 
+static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
+{
+        bool ret;
+
+        spin_lock_bh(&conn->state_lock);
+        ret = (conn->conn_state != TARG_CONN_STATE_LOGGED_IN);
+        spin_unlock_bh(&conn->state_lock);
+
+        return ret;
+}
+
 int iscsi_target_rx_thread(void *arg)
 {
         int ret, rc;
@@ -4091,7 +4102,7 @@ int iscsi_target_rx_thread(void *arg)
          * incoming iscsi/tcp socket I/O, and/or failing the connection.
          */
         rc = wait_for_completion_interruptible(&conn->rx_login_comp);
-        if (rc < 0)
+        if (rc < 0 || iscsi_target_check_conn_state(conn))
                 return 0;
 
         if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 5c964c09c89f..9fc9117d0f22 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -388,6 +388,7 @@ err:
         if (login->login_complete) {
                 if (conn->rx_thread && conn->rx_thread_active) {
                         send_sig(SIGINT, conn->rx_thread, 1);
+                        complete(&conn->rx_login_comp);
                         kthread_stop(conn->rx_thread);
                 }
                 if (conn->tx_thread && conn->tx_thread_active) {
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 51d1734d5390..2cbea2af7cd0 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -208,7 +208,7 @@ int iscsi_create_default_params(struct iscsi_param_list **param_list_ptr)
         if (!pl) {
                 pr_err("Unable to allocate memory for"
                                 " struct iscsi_param_list.\n");
-                return -1 ;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&pl->param_list);
         INIT_LIST_HEAD(&pl->extra_response_list);
@@ -578,7 +578,7 @@ int iscsi_copy_param_list(
         param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
         if (!param_list) {
                 pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
-                return -1;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&param_list->param_list);
         INIT_LIST_HEAD(&param_list->extra_response_list);
@@ -629,7 +629,7 @@ int iscsi_copy_param_list(
 
 err_out:
         iscsi_release_param_list(param_list);
-        return -1;
+        return -ENOMEM;
 }
 
 static void iscsi_release_extra_responses(struct iscsi_param_list *param_list)
@@ -729,7 +729,7 @@ static int iscsi_add_notunderstood_response(
         if (!extra_response) {
                 pr_err("Unable to allocate memory for"
                         " struct iscsi_extra_response.\n");
-                return -1;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&extra_response->er_list);
 
@@ -1370,7 +1370,7 @@ int iscsi_decode_text_input(
         tmpbuf = kzalloc(length + 1, GFP_KERNEL);
         if (!tmpbuf) {
                 pr_err("Unable to allocate %u + 1 bytes for tmpbuf.\n", length);
-                return -1;
+                return -ENOMEM;
         }
 
         memcpy(tmpbuf, textbuf, length);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 0b4b2a67d9f9..98698d875742 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -371,7 +371,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
         return 0;
 }
 
-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
+                                           int *post_ret)
 {
         unsigned char *buf, *addr;
         struct scatterlist *sg;
@@ -437,7 +438,8 @@ sbc_execute_rw(struct se_cmd *cmd)
                                cmd->data_direction);
 }
 
-static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+                                             int *post_ret)
 {
         struct se_device *dev = cmd->se_dev;
 
@@ -447,8 +449,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
          * sent to the backend driver.
          */
         spin_lock_irq(&cmd->t_state_lock);
-        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
                 cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+                *post_ret = 1;
+        }
         spin_unlock_irq(&cmd->t_state_lock);
 
         /*
@@ -460,7 +464,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
         return TCM_NO_SENSE;
 }
 
-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+                                                 int *post_ret)
 {
         struct se_device *dev = cmd->se_dev;
         struct scatterlist *write_sg = NULL, *sg;
@@ -556,11 +561,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
 
                 if (block_size < PAGE_SIZE) {
                         sg_set_page(&write_sg[i], m.page, block_size,
-                                    block_size);
+                                    m.piter.sg->offset + block_size);
                 } else {
                         sg_miter_next(&m);
                         sg_set_page(&write_sg[i], m.page, block_size,
-                                    0);
+                                    m.piter.sg->offset);
                 }
                 len -= block_size;
                 i++;
diff --git a/drivers/target/target_core_stat.c b/drivers/target/target_core_stat.c
index 273c72b2b83d..81a6b3e07687 100644
--- a/drivers/target/target_core_stat.c
+++ b/drivers/target/target_core_stat.c
@@ -246,7 +246,7 @@ static ssize_t target_stat_lu_prod_show(struct config_item *item, char *page)
         char str[sizeof(dev->t10_wwn.model)+1];
 
         /* scsiLuProductId */
-        for (i = 0; i < sizeof(dev->t10_wwn.vendor); i++)
+        for (i = 0; i < sizeof(dev->t10_wwn.model); i++)
                 str[i] = ISPRINT(dev->t10_wwn.model[i]) ?
                         dev->t10_wwn.model[i] : ' ';
         str[i] = '\0';
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 5b2820312310..28fb3016370f 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -130,6 +130,9 @@ void core_tmr_abort_task(
                 if (tmr->ref_task_tag != ref_tag)
                         continue;
 
+                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
+                        continue;
+
                 printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
                         se_cmd->se_tfo->get_fabric_name(), ref_tag);
 
@@ -139,13 +142,15 @@ void core_tmr_abort_task(
                                " skipping\n", ref_tag);
                         spin_unlock(&se_cmd->t_state_lock);
                         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+                        target_put_sess_cmd(se_cmd);
+
                         goto out;
                 }
                 se_cmd->transport_state |= CMD_T_ABORTED;
                 spin_unlock(&se_cmd->t_state_lock);
 
                 list_del_init(&se_cmd->se_cmd_list);
-                kref_get(&se_cmd->cmd_kref);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
                 cancel_work_sync(&se_cmd->work);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 5bacc7b5ed6d..4fdcee2006d1 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1658,7 +1658,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
 void transport_generic_request_failure(struct se_cmd *cmd,
                 sense_reason_t sense_reason)
 {
-        int ret = 0;
+        int ret = 0, post_ret = 0;
 
         pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08llx"
                 " CDB: 0x%02x\n", cmd, cmd->tag, cmd->t_task_cdb[0]);
@@ -1680,7 +1680,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
          */
         if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
              cmd->transport_complete_callback)
-                cmd->transport_complete_callback(cmd, false);
+                cmd->transport_complete_callback(cmd, false, &post_ret);
 
         switch (sense_reason) {
         case TCM_NON_EXISTENT_LUN:
@@ -2068,11 +2068,13 @@ static void target_complete_ok_work(struct work_struct *work)
          */
         if (cmd->transport_complete_callback) {
                 sense_reason_t rc;
+                bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE);
+                bool zero_dl = !(cmd->data_length);
+                int post_ret = 0;
 
-                rc = cmd->transport_complete_callback(cmd, true);
-                if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
-                        if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
-                            !cmd->data_length)
+                rc = cmd->transport_complete_callback(cmd, true, &post_ret);
+                if (!rc && !post_ret) {
+                        if (caw && zero_dl)
                                 goto queue_rsp;
 
                         return;
@@ -2507,23 +2509,24 @@ out:
 EXPORT_SYMBOL(target_get_sess_cmd);
 
 static void target_release_cmd_kref(struct kref *kref)
-                __releases(&se_cmd->se_sess->sess_cmd_lock)
 {
         struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
         struct se_session *se_sess = se_cmd->se_sess;
+        unsigned long flags;
 
+        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (list_empty(&se_cmd->se_cmd_list)) {
-                spin_unlock(&se_sess->sess_cmd_lock);
+                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return;
         }
         if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
-                spin_unlock(&se_sess->sess_cmd_lock);
+                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                 complete(&se_cmd->cmd_wait_comp);
                 return;
         }
         list_del(&se_cmd->se_cmd_list);
-        spin_unlock(&se_sess->sess_cmd_lock);
+        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
         se_cmd->se_tfo->release_cmd(se_cmd);
 }
@@ -2539,8 +2542,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return 1;
         }
-        return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
-                        &se_sess->sess_cmd_lock);
+        return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
 }
 EXPORT_SYMBOL(target_put_sess_cmd);
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 937cebf76633..5e6d6cb348fc 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -638,7 +638,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
         if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
                 return 0;
 
-        if (!time_after(cmd->deadline, jiffies))
+        if (!time_after(jiffies, cmd->deadline))
                 return 0;
 
         set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
@@ -1101,8 +1101,6 @@ tcmu_parse_cdb(struct se_cmd *cmd)
 
 static const struct target_backend_ops tcmu_ops = {
         .name                   = "user",
-        .inquiry_prod           = "USER",
-        .inquiry_rev            = TCMU_VERSION,
         .owner                  = THIS_MODULE,
         .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
         .attach_hba             = tcmu_attach_hba,
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index c463c89b90ef..8cc4ac64a91c 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -382,7 +382,7 @@ endmenu
 
 config QCOM_SPMI_TEMP_ALARM
         tristate "Qualcomm SPMI PMIC Temperature Alarm"
-        depends on OF && (SPMI || COMPILE_TEST) && IIO
+        depends on OF && SPMI && IIO
         select REGMAP_SPMI
         help
           This enables a thermal sysfs driver for Qualcomm plug-and-play (QPNP)
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index c8fe3cac2e0e..c5547bd711db 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -55,6 +55,7 @@
 #define TEMPSENSE2_PANIC_VALUE_SHIFT    16
 #define TEMPSENSE2_PANIC_VALUE_MASK     0xfff0000
 
+#define OCOTP_MEM0                      0x0480
 #define OCOTP_ANA1                      0x04e0
 
 /* The driver supports 1 passive trip point and 1 critical trip point */
@@ -64,12 +65,6 @@ enum imx_thermal_trip {
         IMX_TRIP_NUM,
 };
 
-/*
- * It defines the temperature in millicelsius for passive trip point
- * that will trigger cooling action when crossed.
- */
-#define IMX_TEMP_PASSIVE                85000
-
 #define IMX_POLLING_DELAY               2000 /* millisecond */
 #define IMX_PASSIVE_DELAY               1000
 
@@ -100,12 +95,14 @@ struct imx_thermal_data {
         u32 c1, c2; /* See formula in imx_get_sensor_data() */
         int temp_passive;
         int temp_critical;
+        int temp_max;
         int alarm_temp;
         int last_temp;
         bool irq_enabled;
         int irq;
         struct clk *thermal_clk;
         const struct thermal_soc_data *socdata;
+        const char *temp_grade;
 };
 
 static void imx_set_panic_temp(struct imx_thermal_data *data,
@@ -285,10 +282,12 @@ static int imx_set_trip_temp(struct thermal_zone_device *tz, int trip,
 {
         struct imx_thermal_data *data = tz->devdata;
 
+        /* do not allow changing critical threshold */
         if (trip == IMX_TRIP_CRITICAL)
                 return -EPERM;
 
-        if (temp < 0 || temp > IMX_TEMP_PASSIVE)
+        /* do not allow passive to be set higher than critical */
+        if (temp < 0 || temp > data->temp_critical)
                 return -EINVAL;
 
         data->temp_passive = temp;
@@ -404,17 +403,39 @@ static int imx_get_sensor_data(struct platform_device *pdev)
         data->c1 = temp64;
         data->c2 = n1 * data->c1 + 1000 * t1;
 
-        /*
-         * Set the default passive cooling trip point,
-         * can be changed from userspace.
-         */
-        data->temp_passive = IMX_TEMP_PASSIVE;
+        /* use OTP for thermal grade */
+        ret = regmap_read(map, OCOTP_MEM0, &val);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to read temp grade: %d\n", ret);
+                return ret;
+        }
+
+        /* The maximum die temp is specified by the Temperature Grade */
+        switch ((val >> 6) & 0x3) {
+        case 0: /* Commercial (0 to 95C) */
+                data->temp_grade = "Commercial";
+                data->temp_max = 95000;
+                break;
+        case 1: /* Extended Commercial (-20 to 105C) */
+                data->temp_grade = "Extended Commercial";
+                data->temp_max = 105000;
+                break;
+        case 2: /* Industrial (-40 to 105C) */
+                data->temp_grade = "Industrial";
+                data->temp_max = 105000;
+                break;
+        case 3: /* Automotive (-40 to 125C) */
+                data->temp_grade = "Automotive";
+                data->temp_max = 125000;
+                break;
+        }
 
         /*
-         * The maximum die temperature set to 20 C higher than
-         * IMX_TEMP_PASSIVE.
+         * Set the critical trip point at 5C under max
+         * Set the passive trip point at 10C under max (can change via sysfs)
          */
-        data->temp_critical = 1000 * 20 + data->temp_passive;
+        data->temp_critical = data->temp_max - (1000 * 5);
+        data->temp_passive = data->temp_max - (1000 * 10);
 
         return 0;
 }
@@ -551,6 +572,11 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        dev_info(&pdev->dev, "%s CPU temperature grade - max:%dC"
+                 " critical:%dC passive:%dC\n", data->temp_grade,
+                 data->temp_max / 1000, data->temp_critical / 1000,
+                 data->temp_passive / 1000);
+
         /* Enable measurements at ~ 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_CLR, TEMPSENSE1_MEASURE_FREQ);
         measure_freq = DIV_ROUND_UP(32768, 10); /* 10 Hz */
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 42b7d4253b94..be4eedcb839a 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -964,7 +964,7 @@ void of_thermal_destroy_zones(void)
 
         np = of_find_node_by_name(NULL, "thermal-zones");
         if (!np) {
-                pr_err("unable to find thermal zones\n");
+                pr_debug("unable to find thermal zones\n");
                 return;
         }
 
diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
index f0fbea386869..1246aa6fcab0 100644
--- a/drivers/thermal/power_allocator.c
+++ b/drivers/thermal/power_allocator.c
@@ -174,7 +174,6 @@ static void estimate_pid_constants(struct thermal_zone_device *tz,
 /**
  * pid_controller() - PID controller
  * @tz: thermal zone we are operating in
- * @current_temp:       the current temperature in millicelsius
  * @control_temp:       the target temperature in millicelsius
  * @max_allocatable_power:      maximum allocatable power for this thermal zone
  *
@@ -191,7 +190,6 @@ static void estimate_pid_constants(struct thermal_zone_device *tz,
  * Return: The power budget for the next period.
  */
 static u32 pid_controller(struct thermal_zone_device *tz,
-                          int current_temp,
                           int control_temp,
                           u32 max_allocatable_power)
 {
@@ -211,7 +209,7 @@ static u32 pid_controller(struct thermal_zone_device *tz,
                                        true);
         }
 
-        err = control_temp - current_temp;
+        err = control_temp - tz->temperature;
         err = int_to_frac(err);
 
         /* Calculate the proportional term */
@@ -332,7 +330,6 @@ static void divvy_up_power(u32 *req_power, u32 *max_power, int num_actors,
 }
 
 static int allocate_power(struct thermal_zone_device *tz,
-                          int current_temp,
                           int control_temp)
 {
         struct thermal_instance *instance;
@@ -418,8 +415,7 @@ static int allocate_power(struct thermal_zone_device *tz,
                 i++;
         }
 
-        power_range = pid_controller(tz, current_temp, control_temp,
-                                     max_allocatable_power);
+        power_range = pid_controller(tz, control_temp, max_allocatable_power);
 
         divvy_up_power(weighted_req_power, max_power, num_actors,
                        total_weighted_req_power, power_range, granted_power,
@@ -444,8 +440,8 @@ static int allocate_power(struct thermal_zone_device *tz,
         trace_thermal_power_allocator(tz, req_power, total_req_power,
                                       granted_power, total_granted_power,
                                       num_actors, power_range,
-                                      max_allocatable_power, current_temp,
-                                      control_temp - current_temp);
+                                      max_allocatable_power, tz->temperature,
+                                      control_temp - tz->temperature);
 
         kfree(req_power);
 unlock:
@@ -612,7 +608,7 @@ static void power_allocator_unbind(struct thermal_zone_device *tz)
 static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
 {
         int ret;
-        int switch_on_temp, control_temp, current_temp;
+        int switch_on_temp, control_temp;
         struct power_allocator_params *params = tz->governor_data;
 
         /*
@@ -622,15 +618,9 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
         if (trip != params->trip_max_desired_temperature)
                 return 0;
 
-        ret = thermal_zone_get_temp(tz, &current_temp);
-        if (ret) {
-                dev_warn(&tz->device, "Failed to get temperature: %d\n", ret);
-                return ret;
-        }
-
         ret = tz->ops->get_trip_temp(tz, params->trip_switch_on,
                                      &switch_on_temp);
-        if (!ret && (current_temp < switch_on_temp)) {
+        if (!ret && (tz->temperature < switch_on_temp)) {
                 tz->passive = 0;
                 reset_pid_controller(params);
                 allow_maximum_power(tz);
@@ -648,7 +638,7 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
                 return ret;
         }
 
-        return allocate_power(tz, current_temp, control_temp);
+        return allocate_power(tz, control_temp);
 }
 
 static struct thermal_governor thermal_gov_power_allocator = {
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 5d4ae7d705e0..13d01edc7a04 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -361,6 +361,24 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data)
 /*
  *              platform functions
  */
+static int rcar_thermal_remove(struct platform_device *pdev)
+{
+        struct rcar_thermal_common *common = platform_get_drvdata(pdev);
+        struct device *dev = &pdev->dev;
+        struct rcar_thermal_priv *priv;
+
+        rcar_thermal_for_each_priv(priv, common) {
+                if (rcar_has_irq_support(priv))
+                        rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
+        }
+
+        pm_runtime_put(dev);
+        pm_runtime_disable(dev);
+
+        return 0;
+}
+
 static int rcar_thermal_probe(struct platform_device *pdev)
 {
         struct rcar_thermal_common *common;
@@ -377,6 +395,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         if (!common)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, common);
+
         INIT_LIST_HEAD(&common->head);
         spin_lock_init(&common->lock);
         common->dev = dev;
@@ -454,43 +474,16 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 rcar_thermal_common_write(common, ENR, enr_bits);
         }
 
-        platform_set_drvdata(pdev, common);
-
         dev_info(dev, "%d sensor probed\n", i);
 
         return 0;
 
 error_unregister:
-        rcar_thermal_for_each_priv(priv, common) {
-                if (rcar_has_irq_support(priv))
-                        rcar_thermal_irq_disable(priv);
-                thermal_zone_device_unregister(priv->zone);
-        }
-
-        pm_runtime_put(dev);
-        pm_runtime_disable(dev);
+        rcar_thermal_remove(pdev);
 
         return ret;
 }
 
-static int rcar_thermal_remove(struct platform_device *pdev)
-{
-        struct rcar_thermal_common *common = platform_get_drvdata(pdev);
-        struct device *dev = &pdev->dev;
-        struct rcar_thermal_priv *priv;
-
-        rcar_thermal_for_each_priv(priv, common) {
-                if (rcar_has_irq_support(priv))
-                        rcar_thermal_irq_disable(priv);
-                thermal_zone_device_unregister(priv->zone);
-        }
-
-        pm_runtime_put(dev);
-        pm_runtime_disable(dev);
-
-        return 0;
-}
-
 static const struct of_device_id rcar_thermal_dt_ids[] = {
         { .compatible = "renesas,rcar-thermal", },
         {},
diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
index 9787e8aa509f..e845841ab036 100644
--- a/drivers/thermal/rockchip_thermal.c
+++ b/drivers/thermal/rockchip_thermal.c
@@ -1,6 +1,9 @@
 /*
  * Copyright (c) 2014, Fuzhou Rockchip Electronics Co., Ltd
  *
+ * Copyright (c) 2015, Fuzhou Rockchip Electronics Co., Ltd
+ * Caesar Wang <wxt@rock-chips.com>
+ *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
  * version 2, as published by the Free Software Foundation.
@@ -45,17 +48,50 @@ enum tshut_polarity {
 };
 
 /**
- * The system has three Temperature Sensors.  channel 0 is reserved,
- * channel 1 is for CPU, and channel 2 is for GPU.
+ * The system has two Temperature Sensors.
+ * sensor0 is for CPU, and sensor1 is for GPU.
  */
 enum sensor_id {
-        SENSOR_CPU = 1,
+        SENSOR_CPU = 0,
         SENSOR_GPU,
 };
 
+/**
+* The conversion table has the adc value and temperature.
+* ADC_DECREMENT is the adc value decremnet.(e.g. v2_code_table)
+* ADC_INCREMNET is the adc value incremnet.(e.g. v3_code_table)
+*/
+enum adc_sort_mode {
+        ADC_DECREMENT = 0,
+        ADC_INCREMENT,
+};
+
+/**
+ * The max sensors is two in rockchip SoCs.
+ * Two sensors: CPU and GPU sensor.
+ */
+#define SOC_MAX_SENSORS 2
+
+struct chip_tsadc_table {
+        const struct tsadc_table *id;
+
+        /* the array table size*/
+        unsigned int length;
+
+        /* that analogic mask data */
+        u32 data_mask;
+
+        /* the sort mode is adc value that increment or decrement in table */
+        enum adc_sort_mode mode;
+};
+
 struct rockchip_tsadc_chip {
+        /* The sensor id of chip correspond to the ADC channel */
+        int chn_id[SOC_MAX_SENSORS];
+        int chn_num;
+
         /* The hardware-controlled tshut property */
-        long tshut_temp;
+        int tshut_temp;
         enum tshut_mode tshut_mode;
         enum tshut_polarity tshut_polarity;
 
@@ -65,37 +101,40 @@ struct rockchip_tsadc_chip {
         void (*control)(void __iomem *reg, bool on);
 
         /* Per-sensor methods */
-        int (*get_temp)(int chn, void __iomem *reg, int *temp);
-        void (*set_tshut_temp)(int chn, void __iomem *reg, long temp);
+        int (*get_temp)(struct chip_tsadc_table table,
+                        int chn, void __iomem *reg, int *temp);
+        void (*set_tshut_temp)(struct chip_tsadc_table table,
+                               int chn, void __iomem *reg, int temp);
         void (*set_tshut_mode)(int chn, void __iomem *reg, enum tshut_mode m);
+
+        /* Per-table methods */
+        struct chip_tsadc_table table;
 };
 
 struct rockchip_thermal_sensor {
         struct rockchip_thermal_data *thermal;
         struct thermal_zone_device *tzd;
-        enum sensor_id id;
+        int id;
 };
 
-#define NUM_SENSORS     2 /* Ignore unused sensor 0 */
-
 struct rockchip_thermal_data {
         const struct rockchip_tsadc_chip *chip;
         struct platform_device *pdev;
         struct reset_control *reset;
 
-        struct rockchip_thermal_sensor sensors[NUM_SENSORS];
+        struct rockchip_thermal_sensor sensors[SOC_MAX_SENSORS];
 
         struct clk *clk;
         struct clk *pclk;
 
         void __iomem *regs;
 
-        long tshut_temp;
+        int tshut_temp;
         enum tshut_mode tshut_mode;
         enum tshut_polarity tshut_polarity;
 };
 
-/* TSADC V2 Sensor info define: */
+/* TSADC Sensor info define: */
 #define TSADCV2_AUTO_CON                        0x04
 #define TSADCV2_INT_EN                          0x08
 #define TSADCV2_INT_PD                          0x0c
@@ -117,6 +156,8 @@ struct rockchip_thermal_data {
 #define TSADCV2_INT_PD_CLEAR_MASK               ~BIT(8)
 
 #define TSADCV2_DATA_MASK                       0xfff
+#define TSADCV3_DATA_MASK                       0x3ff
+
 #define TSADCV2_HIGHT_INT_DEBOUNCE_COUNT        4
 #define TSADCV2_HIGHT_TSHUT_DEBOUNCE_COUNT      4
 #define TSADCV2_AUTO_PERIOD_TIME                250 /* msec */
@@ -124,7 +165,7 @@ struct rockchip_thermal_data {
 
 struct tsadc_table {
         u32 code;
-        long temp;
+        int temp;
 };
 
 static const struct tsadc_table v2_code_table[] = {
@@ -165,21 +206,61 @@ static const struct tsadc_table v2_code_table[] = {
         {3421, 125000},
 };
 
-static u32 rk_tsadcv2_temp_to_code(long temp)
+static const struct tsadc_table v3_code_table[] = {
+        {0, -40000},
+        {106, -40000},
+        {108, -35000},
+        {110, -30000},
+        {112, -25000},
+        {114, -20000},
+        {116, -15000},
+        {118, -10000},
+        {120, -5000},
+        {122, 0},
+        {124, 5000},
+        {126, 10000},
+        {128, 15000},
+        {130, 20000},
+        {132, 25000},
+        {134, 30000},
+        {136, 35000},
+        {138, 40000},
+        {140, 45000},
+        {142, 50000},
+        {144, 55000},
+        {146, 60000},
+        {148, 65000},
+        {150, 70000},
+        {152, 75000},
+        {154, 80000},
+        {156, 85000},
+        {158, 90000},
+        {160, 95000},
+        {162, 100000},
+        {163, 105000},
+        {165, 110000},
+        {167, 115000},
+        {169, 120000},
+        {171, 125000},
+        {TSADCV3_DATA_MASK, 125000},
+};
+
+static u32 rk_tsadcv2_temp_to_code(struct chip_tsadc_table table,
+                                   int temp)
 {
         int high, low, mid;
 
         low = 0;
-        high = ARRAY_SIZE(v2_code_table) - 1;
+        high = table.length - 1;
         mid = (high + low) / 2;
 
-        if (temp < v2_code_table[low].temp || temp > v2_code_table[high].temp)
+        if (temp < table.id[low].temp || temp > table.id[high].temp)
                 return 0;
 
         while (low <= high) {
-                if (temp == v2_code_table[mid].temp)
-                        return v2_code_table[mid].code;
-                else if (temp < v2_code_table[mid].temp)
+                if (temp == table.id[mid].temp)
+                        return table.id[mid].code;
+                else if (temp < table.id[mid].temp)
                         high = mid - 1;
                 else
                         low = mid + 1;
@@ -189,29 +270,54 @@ static u32 rk_tsadcv2_temp_to_code(long temp)
         return 0;
 }
 
-static int rk_tsadcv2_code_to_temp(u32 code, int *temp)
+static int rk_tsadcv2_code_to_temp(struct chip_tsadc_table table, u32 code,
+                                   int *temp)
 {
         unsigned int low = 1;
-        unsigned int high = ARRAY_SIZE(v2_code_table) - 1;
+        unsigned int high = table.length - 1;
         unsigned int mid = (low + high) / 2;
         unsigned int num;
         unsigned long denom;
 
-        BUILD_BUG_ON(ARRAY_SIZE(v2_code_table) < 2);
-
-        code &= TSADCV2_DATA_MASK;
-        if (code < v2_code_table[high].code)
-                return -EAGAIN;         /* Incorrect reading */
-
-        while (low <= high) {
-                if (code >= v2_code_table[mid].code &&
-                    code < v2_code_table[mid - 1].code)
-                        break;
-                else if (code < v2_code_table[mid].code)
-                        low = mid + 1;
-                else
-                        high = mid - 1;
-                mid = (low + high) / 2;
+        WARN_ON(table.length < 2);
+
+        switch (table.mode) {
+        case ADC_DECREMENT:
+                code &= table.data_mask;
+                if (code < table.id[high].code)
+                        return -EAGAIN;         /* Incorrect reading */
+
+                while (low <= high) {
+                        if (code >= table.id[mid].code &&
+                            code < table.id[mid - 1].code)
+                                break;
+                        else if (code < table.id[mid].code)
+                                low = mid + 1;
+                        else
+                                high = mid - 1;
+
+                        mid = (low + high) / 2;
+                }
+                break;
+        case ADC_INCREMENT:
+                code &= table.data_mask;
+                if (code < table.id[low].code)
+                        return -EAGAIN;         /* Incorrect reading */
+
+                while (low <= high) {
+                        if (code >= table.id[mid - 1].code &&
+                            code < table.id[mid].code)
+                                break;
+                        else if (code > table.id[mid].code)
+                                low = mid + 1;
+                        else
+                                high = mid - 1;
+
+                        mid = (low + high) / 2;
+                }
+                break;
+        default:
+                pr_err("Invalid the conversion table\n");
         }
 
         /*
@@ -220,24 +326,28 @@ static int rk_tsadcv2_code_to_temp(u32 code, int *temp)
          * temperature between 2 table entries is linear and interpolate
          * to produce less granular result.
          */
-        num = v2_code_table[mid].temp - v2_code_table[mid - 1].temp;
-        num *= v2_code_table[mid - 1].code - code;
-        denom = v2_code_table[mid - 1].code - v2_code_table[mid].code;
-        *temp = v2_code_table[mid - 1].temp + (num / denom);
+        num = table.id[mid].temp - v2_code_table[mid - 1].temp;
+        num *= abs(table.id[mid - 1].code - code);
+        denom = abs(table.id[mid - 1].code - table.id[mid].code);
+        *temp = table.id[mid - 1].temp + (num / denom);
 
         return 0;
 }
 
 /**
- * rk_tsadcv2_initialize - initialize TASDC Controller
- * (1) Set TSADCV2_AUTO_PERIOD, configure the interleave between
- * every two accessing of TSADC in normal operation.
- * (2) Set TSADCV2_AUTO_PERIOD_HT, configure the interleave between
- * every two accessing of TSADC after the temperature is higher
- * than COM_SHUT or COM_INT.
- * (3) Set TSADCV2_HIGH_INT_DEBOUNCE and TSADC_HIGHT_TSHUT_DEBOUNCE,
- * if the temperature is higher than COMP_INT or COMP_SHUT for
- * "debounce" times, TSADC controller will generate interrupt or TSHUT.
+ * rk_tsadcv2_initialize - initialize TASDC Controller.
+ *
+ * (1) Set TSADC_V2_AUTO_PERIOD:
+ *     Configure the interleave between every two accessing of
+ *     TSADC in normal operation.
+ *
+ * (2) Set TSADCV2_AUTO_PERIOD_HT:
+ *     Configure the interleave between every two accessing of
+ *     TSADC after the temperature is higher than COM_SHUT or COM_INT.
+ *
+ * (3) Set TSADCV2_HIGH_INT_DEBOUNCE and TSADC_HIGHT_TSHUT_DEBOUNCE:
+ *     If the temperature is higher than COMP_INT or COMP_SHUT for
+ *     "debounce" times, TSADC controller will generate interrupt or TSHUT.
  */
 static void rk_tsadcv2_initialize(void __iomem *regs,
                                   enum tshut_polarity tshut_polarity)
@@ -279,20 +389,22 @@ static void rk_tsadcv2_control(void __iomem *regs, bool enable)
         writel_relaxed(val, regs + TSADCV2_AUTO_CON);
 }
 
-static int rk_tsadcv2_get_temp(int chn, void __iomem *regs, int *temp)
+static int rk_tsadcv2_get_temp(struct chip_tsadc_table table,
+                               int chn, void __iomem *regs, int *temp)
 {
         u32 val;
 
         val = readl_relaxed(regs + TSADCV2_DATA(chn));
 
-        return rk_tsadcv2_code_to_temp(val, temp);
+        return rk_tsadcv2_code_to_temp(table, val, temp);
 }
 
-static void rk_tsadcv2_tshut_temp(int chn, void __iomem *regs, long temp)
+static void rk_tsadcv2_tshut_temp(struct chip_tsadc_table table,
+                                  int chn, void __iomem *regs, int temp)
 {
         u32 tshut_value, val;
 
-        tshut_value = rk_tsadcv2_temp_to_code(temp);
+        tshut_value = rk_tsadcv2_temp_to_code(table, temp);
         writel_relaxed(tshut_value, regs + TSADCV2_COMP_SHUT(chn));
 
         /* TSHUT will be valid */
@@ -318,6 +430,10 @@ static void rk_tsadcv2_tshut_mode(int chn, void __iomem *regs,
 }
 
 static const struct rockchip_tsadc_chip rk3288_tsadc_data = {
+        .chn_id[SENSOR_CPU] = 1, /* cpu sensor is channel 1 */
+        .chn_id[SENSOR_GPU] = 2, /* gpu sensor is channel 2 */
+        .chn_num = 2, /* two channels for tsadc */
+
         .tshut_mode = TSHUT_MODE_GPIO, /* default TSHUT via GPIO give PMIC */
         .tshut_polarity = TSHUT_LOW_ACTIVE, /* default TSHUT LOW ACTIVE */
         .tshut_temp = 95000,
@@ -328,6 +444,37 @@ static const struct rockchip_tsadc_chip rk3288_tsadc_data = {
         .get_temp = rk_tsadcv2_get_temp,
         .set_tshut_temp = rk_tsadcv2_tshut_temp,
         .set_tshut_mode = rk_tsadcv2_tshut_mode,
+
+        .table = {
+                .id = v2_code_table,
+                .length = ARRAY_SIZE(v2_code_table),
+                .data_mask = TSADCV2_DATA_MASK,
+                .mode = ADC_DECREMENT,
+        },
+};
+
+static const struct rockchip_tsadc_chip rk3368_tsadc_data = {
+        .chn_id[SENSOR_CPU] = 0, /* cpu sensor is channel 0 */
+        .chn_id[SENSOR_GPU] = 1, /* gpu sensor is channel 1 */
+        .chn_num = 2, /* two channels for tsadc */
+
+        .tshut_mode = TSHUT_MODE_GPIO, /* default TSHUT via GPIO give PMIC */
+        .tshut_polarity = TSHUT_LOW_ACTIVE, /* default TSHUT LOW ACTIVE */
+        .tshut_temp = 95000,
+
+        .initialize = rk_tsadcv2_initialize,
+        .irq_ack = rk_tsadcv2_irq_ack,
+        .control = rk_tsadcv2_control,
+        .get_temp = rk_tsadcv2_get_temp,
+        .set_tshut_temp = rk_tsadcv2_tshut_temp,
+        .set_tshut_mode = rk_tsadcv2_tshut_mode,
+
+        .table = {
+                .id = v3_code_table,
+                .length = ARRAY_SIZE(v3_code_table),
+                .data_mask = TSADCV3_DATA_MASK,
+                .mode = ADC_INCREMENT,
+        },
 };
 
 static const struct of_device_id of_rockchip_thermal_match[] = {
@@ -335,6 +482,10 @@ static const struct of_device_id of_rockchip_thermal_match[] = {
                 .compatible = "rockchip,rk3288-tsadc",
                 .data = (void *)&rk3288_tsadc_data,
         },
+        {
+                .compatible = "rockchip,rk3368-tsadc",
+                .data = (void *)&rk3368_tsadc_data,
+        },
         { /* end */ },
 };
 MODULE_DEVICE_TABLE(of, of_rockchip_thermal_match);
@@ -357,7 +508,7 @@ static irqreturn_t rockchip_thermal_alarm_irq_thread(int irq, void *dev)
 
         thermal->chip->irq_ack(thermal->regs);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 thermal_zone_device_update(thermal->sensors[i].tzd);
 
         return IRQ_HANDLED;
@@ -370,7 +521,8 @@ static int rockchip_thermal_get_temp(void *_sensor, int *out_temp)
         const struct rockchip_tsadc_chip *tsadc = sensor->thermal->chip;
         int retval;
 
-        retval = tsadc->get_temp(sensor->id, thermal->regs, out_temp);
+        retval = tsadc->get_temp(tsadc->table,
+                                 sensor->id, thermal->regs, out_temp);
         dev_dbg(&thermal->pdev->dev, "sensor %d - temp: %d, retval: %d\n",
                 sensor->id, *out_temp, retval);
 
@@ -389,7 +541,7 @@ static int rockchip_configure_from_dt(struct device *dev,
 
         if (of_property_read_u32(np, "rockchip,hw-tshut-temp", &shut_temp)) {
                 dev_warn(dev,
-                         "Missing tshut temp property, using default %ld\n",
+                         "Missing tshut temp property, using default %d\n",
                          thermal->chip->tshut_temp);
                 thermal->tshut_temp = thermal->chip->tshut_temp;
         } else {
@@ -397,7 +549,7 @@ static int rockchip_configure_from_dt(struct device *dev,
         }
 
         if (thermal->tshut_temp > INT_MAX) {
-                dev_err(dev, "Invalid tshut temperature specified: %ld\n",
+                dev_err(dev, "Invalid tshut temperature specified: %d\n",
                         thermal->tshut_temp);
                 return -ERANGE;
         }
@@ -442,13 +594,14 @@ static int
 rockchip_thermal_register_sensor(struct platform_device *pdev,
                                  struct rockchip_thermal_data *thermal,
                                  struct rockchip_thermal_sensor *sensor,
-                                 enum sensor_id id)
+                                 int id)
 {
         const struct rockchip_tsadc_chip *tsadc = thermal->chip;
         int error;
 
         tsadc->set_tshut_mode(id, thermal->regs, thermal->tshut_mode);
-        tsadc->set_tshut_temp(id, thermal->regs, thermal->tshut_temp);
+        tsadc->set_tshut_temp(tsadc->table, id, thermal->regs,
+                              thermal->tshut_temp);
 
         sensor->thermal = thermal;
         sensor->id = id;
@@ -481,7 +634,7 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
         const struct of_device_id *match;
         struct resource *res;
         int irq;
-        int i;
+        int i, j;
         int error;
 
         match = of_match_node(of_rockchip_thermal_match, np);
@@ -556,22 +709,19 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
 
         thermal->chip->initialize(thermal->regs, thermal->tshut_polarity);
 
-        error = rockchip_thermal_register_sensor(pdev, thermal,
-                                                 &thermal->sensors[0],
-                                                 SENSOR_CPU);
-        if (error) {
-                dev_err(&pdev->dev,
-                        "failed to register CPU thermal sensor: %d\n", error);
-                goto err_disable_pclk;
-        }
-
-        error = rockchip_thermal_register_sensor(pdev, thermal,
-                                                 &thermal->sensors[1],
-                                                 SENSOR_GPU);
-        if (error) {
-                dev_err(&pdev->dev,
-                        "failed to register GPU thermal sensor: %d\n", error);
-                goto err_unregister_cpu_sensor;
+        for (i = 0; i < thermal->chip->chn_num; i++) {
+                error = rockchip_thermal_register_sensor(pdev, thermal,
+                                                &thermal->sensors[i],
+                                                thermal->chip->chn_id[i]);
+                if (error) {
+                        dev_err(&pdev->dev,
+                                "failed to register sensor[%d] : error = %d\n",
+                                i, error);
+                        for (j = 0; j < i; j++)
+                                thermal_zone_of_sensor_unregister(&pdev->dev,
+                                                thermal->sensors[j].tzd);
+                        goto err_disable_pclk;
+                }
         }
 
         error = devm_request_threaded_irq(&pdev->dev, irq, NULL,
@@ -581,22 +731,23 @@ static int rockchip_thermal_probe(struct platform_device *pdev)
         if (error) {
                 dev_err(&pdev->dev,
                         "failed to request tsadc irq: %d\n", error);
-                goto err_unregister_gpu_sensor;
+                goto err_unregister_sensor;
         }
 
         thermal->chip->control(thermal->regs, true);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], true);
 
         platform_set_drvdata(pdev, thermal);
 
         return 0;
 
-err_unregister_gpu_sensor:
-        thermal_zone_of_sensor_unregister(&pdev->dev, thermal->sensors[1].tzd);
-err_unregister_cpu_sensor:
-        thermal_zone_of_sensor_unregister(&pdev->dev, thermal->sensors[0].tzd);
+err_unregister_sensor:
+        while (i--)
+                thermal_zone_of_sensor_unregister(&pdev->dev,
+                                                  thermal->sensors[i].tzd);
+
 err_disable_pclk:
         clk_disable_unprepare(thermal->pclk);
 err_disable_clk:
@@ -610,7 +761,7 @@ static int rockchip_thermal_remove(struct platform_device *pdev)
         struct rockchip_thermal_data *thermal = platform_get_drvdata(pdev);
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++) {
+        for (i = 0; i < thermal->chip->chn_num; i++) {
                 struct rockchip_thermal_sensor *sensor = &thermal->sensors[i];
 
                 rockchip_thermal_toggle_sensor(sensor, false);
@@ -631,7 +782,7 @@ static int __maybe_unused rockchip_thermal_suspend(struct device *dev)
         struct rockchip_thermal_data *thermal = platform_get_drvdata(pdev);
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], false);
 
         thermal->chip->control(thermal->regs, false);
@@ -663,18 +814,19 @@ static int __maybe_unused rockchip_thermal_resume(struct device *dev)
 
         thermal->chip->initialize(thermal->regs, thermal->tshut_polarity);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++) {
-                enum sensor_id id = thermal->sensors[i].id;
+        for (i = 0; i < thermal->chip->chn_num; i++) {
+                int id = thermal->sensors[i].id;
 
                 thermal->chip->set_tshut_mode(id, thermal->regs,
                                               thermal->tshut_mode);
-                thermal->chip->set_tshut_temp(id, thermal->regs,
+                thermal->chip->set_tshut_temp(thermal->chip->table,
+                                              id, thermal->regs,
                                               thermal->tshut_temp);
         }
 
         thermal->chip->control(thermal->regs, true);
 
-        for (i = 0; i < ARRAY_SIZE(thermal->sensors); i++)
+        for (i = 0; i < thermal->chip->chn_num; i++)
                 rockchip_thermal_toggle_sensor(&thermal->sensors[i], true);
 
         pinctrl_pm_select_default_state(dev);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 13844261cd5f..ed776149261e 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -169,7 +169,7 @@ static inline int tty_copy_to_user(struct tty_struct *tty,
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        tty_audit_add_data(tty, to, n, ldata->icanon);
+        tty_audit_add_data(tty, from, n, ldata->icanon);
         return copy_to_user(to, from, n);
 }
 
diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
index c0533a57ec53..910bfee5a88b 100644
--- a/drivers/tty/serial/8250/8250_fsl.c
+++ b/drivers/tty/serial/8250/8250_fsl.c
@@ -60,3 +60,4 @@ int fsl8250_handle_irq(struct uart_port *port)
         spin_unlock_irqrestore(&up->port.lock, flags);
         return 1;
 }
+EXPORT_SYMBOL_GPL(fsl8250_handle_irq);
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index e6f5e12a2d83..6412f1455beb 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -373,6 +373,7 @@ config SERIAL_8250_MID
         depends on SERIAL_8250 && PCI
         select HSU_DMA if SERIAL_8250_DMA
         select HSU_DMA_PCI if X86_INTEL_MID
+        select RATIONAL
         help
           Selecting this option will enable handling of the extra features
           present on the UART found on Intel Medfield SOC and various other
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 1aec4404062d..f38beb28e7ae 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1539,7 +1539,6 @@ config SERIAL_FSL_LPUART
         tristate "Freescale lpuart serial port support"
         depends on HAS_DMA
         select SERIAL_CORE
-        select SERIAL_EARLYCON
         help
           Support for the on-chip lpuart on some Freescale SOCs.
 
@@ -1547,6 +1546,7 @@ config SERIAL_FSL_LPUART_CONSOLE
         bool "Console on Freescale lpuart serial port"
         depends on SERIAL_FSL_LPUART=y
         select SERIAL_CORE_CONSOLE
+        select SERIAL_EARLYCON
         help
           If you have enabled the lpuart serial port on the Freescale SoCs,
           you can make it the console by answering Y to this option.
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 681e0f3d5e0e..a1c0a89d9c7f 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -474,7 +474,7 @@ static int bcm_uart_startup(struct uart_port *port)
 
         /* register irq and enable rx interrupts */
         ret = request_irq(port->irq, bcm_uart_interrupt, 0,
-                          bcm_uart_type(port), port);
+                          dev_name(port->dev), port);
         if (ret)
                 return ret;
         bcm_uart_writel(port, UART_RX_INT_MASK, UART_IR_REG);
diff --git a/drivers/tty/serial/etraxfs-uart.c b/drivers/tty/serial/etraxfs-uart.c
index 6813e316e9ff..2f80bc7e44fb 100644
--- a/drivers/tty/serial/etraxfs-uart.c
+++ b/drivers/tty/serial/etraxfs-uart.c
@@ -894,7 +894,7 @@ static int etraxfs_uart_probe(struct platform_device *pdev)
         up->regi_ser = of_iomap(np, 0);
         up->port.dev = &pdev->dev;
 
-        up->gpios = mctrl_gpio_init(&pdev->dev, 0);
+        up->gpios = mctrl_gpio_init_noauto(&pdev->dev, 0);
         if (IS_ERR(up->gpios))
                 return PTR_ERR(up->gpios);
 
diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c
index 90ca082935f6..3d245cd3d8e6 100644
--- a/drivers/tty/tty_audit.c
+++ b/drivers/tty/tty_audit.c
@@ -265,7 +265,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty,
  *
  *      Audit @data of @size from @tty, if necessary.
  */
-void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
+void tty_audit_add_data(struct tty_struct *tty, const void *data,
                         size_t size, unsigned icanon)
 {
         struct tty_audit_buf *buf;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 0c41dbcb90b8..bcc8e1e8bb72 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1282,18 +1282,22 @@ int tty_send_xchar(struct tty_struct *tty, char ch)
         int     was_stopped = tty->stopped;
 
         if (tty->ops->send_xchar) {
+                down_read(&tty->termios_rwsem);
                 tty->ops->send_xchar(tty, ch);
+                up_read(&tty->termios_rwsem);
                 return 0;
         }
 
         if (tty_write_lock(tty, 0) < 0)
                 return -ERESTARTSYS;
 
+        down_read(&tty->termios_rwsem);
         if (was_stopped)
                 start_tty(tty);
         tty->ops->write(tty, &ch, 1);
         if (was_stopped)
                 stop_tty(tty);
+        up_read(&tty->termios_rwsem);
         tty_write_unlock(tty);
         return 0;
 }
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 9c5aebfe7053..1445dd39aa62 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1147,16 +1147,12 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                         spin_unlock_irq(&tty->flow_lock);
                         break;
                 case TCIOFF:
-                        down_read(&tty->termios_rwsem);
                         if (STOP_CHAR(tty) != __DISABLED_CHAR)
                                 retval = tty_send_xchar(tty, STOP_CHAR(tty));
-                        up_read(&tty->termios_rwsem);
                         break;
                 case TCION:
-                        down_read(&tty->termios_rwsem);
                         if (START_CHAR(tty) != __DISABLED_CHAR)
                                 retval = tty_send_xchar(tty, START_CHAR(tty));
-                        up_read(&tty->termios_rwsem);
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 5af8f1874c1a..629e3c865072 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -592,7 +592,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         /* Restart the work queue in case no characters kick it off. Safe if
            already running */
-        schedule_work(&tty->port->buf.work);
+        tty_buffer_restart_work(tty->port);
 
         tty_unlock(tty);
         return retval;
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 6ccbf60cdd5c..5a048b7b92e8 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -84,6 +84,12 @@ struct ci_hdrc_imx_data {
         struct imx_usbmisc_data *usbmisc_data;
         bool supports_runtime_pm;
         bool in_lpm;
+        /* SoC before i.mx6 (except imx23/imx28) needs three clks */
+        bool need_three_clks;
+        struct clk *clk_ipg;
+        struct clk *clk_ahb;
+        struct clk *clk_per;
+        /* --------------------------------- */
 };
 
 /* Common functions shared by usbmisc drivers */
@@ -135,6 +141,102 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev)
 }
 
 /* End of common functions shared by usbmisc drivers*/
+static int imx_get_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+        int ret = 0;
+
+        data->clk_ipg = devm_clk_get(dev, "ipg");
+        if (IS_ERR(data->clk_ipg)) {
+                /* If the platform only needs one clocks */
+                data->clk = devm_clk_get(dev, NULL);
+                if (IS_ERR(data->clk)) {
+                        ret = PTR_ERR(data->clk);
+                        dev_err(dev,
+                                "Failed to get clks, err=%ld,%ld\n",
+                                PTR_ERR(data->clk), PTR_ERR(data->clk_ipg));
+                        return ret;
+                }
+                return ret;
+        }
+
+        data->clk_ahb = devm_clk_get(dev, "ahb");
+        if (IS_ERR(data->clk_ahb)) {
+                ret = PTR_ERR(data->clk_ahb);
+                dev_err(dev,
+                        "Failed to get ahb clock, err=%d\n", ret);
+                return ret;
+        }
+
+        data->clk_per = devm_clk_get(dev, "per");
+        if (IS_ERR(data->clk_per)) {
+                ret = PTR_ERR(data->clk_per);
+                dev_err(dev,
+                        "Failed to get per clock, err=%d\n", ret);
+                return ret;
+        }
+
+        data->need_three_clks = true;
+        return ret;
+}
+
+static int imx_prepare_enable_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (data->need_three_clks) {
+                ret = clk_prepare_enable(data->clk_ipg);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable ipg clk, err=%d\n",
+                                ret);
+                        return ret;
+                }
+
+                ret = clk_prepare_enable(data->clk_ahb);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable ahb clk, err=%d\n",
+                                ret);
+                        clk_disable_unprepare(data->clk_ipg);
+                        return ret;
+                }
+
+                ret = clk_prepare_enable(data->clk_per);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable per clk, err=%d\n",
+                                ret);
+                        clk_disable_unprepare(data->clk_ahb);
+                        clk_disable_unprepare(data->clk_ipg);
+                        return ret;
+                }
+        } else {
+                ret = clk_prepare_enable(data->clk);
+                if (ret) {
+                        dev_err(dev,
+                                "Failed to prepare/enable clk, err=%d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+static void imx_disable_unprepare_clks(struct device *dev)
+{
+        struct ci_hdrc_imx_data *data = dev_get_drvdata(dev);
+
+        if (data->need_three_clks) {
+                clk_disable_unprepare(data->clk_per);
+                clk_disable_unprepare(data->clk_ahb);
+                clk_disable_unprepare(data->clk_ipg);
+        } else {
+                clk_disable_unprepare(data->clk);
+        }
+}
 
 static int ci_hdrc_imx_probe(struct platform_device *pdev)
 {
@@ -145,31 +247,31 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 .flags          = CI_HDRC_SET_NON_ZERO_TTHA,
         };
         int ret;
-        const struct of_device_id *of_id =
-                        of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
-        const struct ci_hdrc_imx_platform_flag *imx_platform_flag = of_id->data;
+        const struct of_device_id *of_id;
+        const struct ci_hdrc_imx_platform_flag *imx_platform_flag;
+
+        of_id = of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
+        imx_platform_flag = of_id->data;
 
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, data);
         data->usbmisc_data = usbmisc_get_init_data(&pdev->dev);
         if (IS_ERR(data->usbmisc_data))
                 return PTR_ERR(data->usbmisc_data);
 
-        data->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(data->clk)) {
-                dev_err(&pdev->dev,
-                        "Failed to get clock, err=%ld\n", PTR_ERR(data->clk));
-                return PTR_ERR(data->clk);
-        }
+        ret = imx_get_clks(&pdev->dev);
+        if (ret)
+                return ret;
 
-        ret = clk_prepare_enable(data->clk);
-        if (ret) {
-                dev_err(&pdev->dev,
-                        "Failed to prepare or enable clock, err=%d\n", ret);
+        ret = imx_prepare_enable_clks(&pdev->dev);
+        if (ret)
                 return ret;
-        }
 
         data->phy = devm_usb_get_phy_by_phandle(&pdev->dev, "fsl,usbphy", 0);
         if (IS_ERR(data->phy)) {
@@ -212,8 +314,6 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 goto disable_device;
         }
 
-        platform_set_drvdata(pdev, data);
-
         if (data->supports_runtime_pm) {
                 pm_runtime_set_active(&pdev->dev);
                 pm_runtime_enable(&pdev->dev);
@@ -226,7 +326,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 disable_device:
         ci_hdrc_remove_device(data->ci_pdev);
 err_clk:
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(&pdev->dev);
         return ret;
 }
 
@@ -240,7 +340,7 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
                 pm_runtime_put_noidle(&pdev->dev);
         }
         ci_hdrc_remove_device(data->ci_pdev);
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(&pdev->dev);
 
         return 0;
 }
@@ -252,7 +352,7 @@ static int imx_controller_suspend(struct device *dev)
 
         dev_dbg(dev, "at %s\n", __func__);
 
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(dev);
         data->in_lpm = true;
 
         return 0;
@@ -270,7 +370,7 @@ static int imx_controller_resume(struct device *dev)
                 return 0;
         }
 
-        ret = clk_prepare_enable(data->clk);
+        ret = imx_prepare_enable_clks(dev);
         if (ret)
                 return ret;
 
@@ -285,7 +385,7 @@ static int imx_controller_resume(struct device *dev)
         return 0;
 
 clk_disable:
-        clk_disable_unprepare(data->clk);
+        imx_disable_unprepare_clks(dev);
         return ret;
 }
 
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 080b7be3daf0..58c8485a0715 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -322,8 +322,10 @@ static ssize_t ci_role_write(struct file *file, const char __user *ubuf,
                 return -EINVAL;
 
         pm_runtime_get_sync(ci->dev);
+        disable_irq(ci->irq);
         ci_role_stop(ci);
         ret = ci_role_start(ci, role);
+        enable_irq(ci->irq);
         pm_runtime_put_sync(ci->dev);
 
         return ret ? ret : count;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 8223fe73ea85..391a1225b0ba 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1751,6 +1751,22 @@ static int ci_udc_start(struct usb_gadget *gadget,
         return retval;
 }
 
+static void ci_udc_stop_for_otg_fsm(struct ci_hdrc *ci)
+{
+        if (!ci_otg_is_fsm_mode(ci))
+                return;
+
+        mutex_lock(&ci->fsm.lock);
+        if (ci->fsm.otg->state == OTG_STATE_A_PERIPHERAL) {
+                ci->fsm.a_bidl_adis_tmout = 1;
+                ci_hdrc_otg_fsm_start(ci);
+        } else if (ci->fsm.otg->state == OTG_STATE_B_PERIPHERAL) {
+                ci->fsm.protocol = PROTO_UNDEF;
+                ci->fsm.otg->state = OTG_STATE_UNDEFINED;
+        }
+        mutex_unlock(&ci->fsm.lock);
+}
+
 /**
  * ci_udc_stop: unregister a gadget driver
  */
@@ -1775,6 +1791,7 @@ static int ci_udc_stop(struct usb_gadget *gadget)
         ci->driver = NULL;
         spin_unlock_irqrestore(&ci->lock, flags);
 
+        ci_udc_stop_for_otg_fsm(ci);
         return 0;
 }
 
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index fcea4eb36eee..ab8b027e8cc8 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -500,7 +500,11 @@ static int usbmisc_imx_probe(struct platform_device *pdev)
 {
         struct resource *res;
         struct imx_usbmisc *data;
-        struct of_device_id *tmp_dev;
+        const struct of_device_id *of_id;
+
+        of_id = of_match_device(usbmisc_imx_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
 
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -513,9 +517,7 @@ static int usbmisc_imx_probe(struct platform_device *pdev)
         if (IS_ERR(data->base))
                 return PTR_ERR(data->base);
 
-        tmp_dev = (struct of_device_id *)
-                of_match_device(usbmisc_imx_dt_ids, &pdev->dev);
-        data->ops = (const struct usbmisc_ops *)tmp_dev->data;
+        data->ops = (const struct usbmisc_ops *)of_id->data;
         platform_set_drvdata(pdev, data);
 
         return 0;
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 433bbc34a8a4..071964c7847f 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -884,11 +884,11 @@ static int usblp_wwait(struct usblp *usblp, int nonblock)
 
         add_wait_queue(&usblp->wwait, &waita);
         for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
                 if (mutex_lock_interruptible(&usblp->mut)) {
                         rc = -EINTR;
                         break;
                 }
+                set_current_state(TASK_INTERRUPTIBLE);
                 rc = usblp_wtest(usblp, nonblock);
                 mutex_unlock(&usblp->mut);
                 if (rc <= 0)
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index a99c89e78126..dd280108758f 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -77,8 +77,7 @@ config USB_OTG_BLACKLIST_HUB
 
 config USB_OTG_FSM
         tristate "USB 2.0 OTG FSM implementation"
-        depends on USB
-        select USB_OTG
+        depends on USB && USB_OTG
         select USB_PHY
         help
           Implements OTG Finite State Machine as specified in On-The-Go
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index e79baf73c234..571c21727ff9 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -324,12 +324,13 @@ void dwc2_hcd_disconnect(struct dwc2_hsotg *hsotg)
  */
 static void dwc2_hcd_rem_wakeup(struct dwc2_hsotg *hsotg)
 {
-        if (hsotg->lx_state == DWC2_L2) {
+        if (hsotg->bus_suspended) {
                 hsotg->flags.b.port_suspend_change = 1;
                 usb_hcd_resume_root_hub(hsotg->priv);
-        } else {
-                hsotg->flags.b.port_l1_change = 1;
         }
+
+        if (hsotg->lx_state == DWC2_L1)
+                hsotg->flags.b.port_l1_change = 1;
 }
 
 /**
@@ -1428,8 +1429,8 @@ static void dwc2_wakeup_detected(unsigned long data)
         dev_dbg(hsotg->dev, "Clear Resume: HPRT0=%0x\n",
                 dwc2_readl(hsotg->regs + HPRT0));
 
-        hsotg->bus_suspended = 0;
         dwc2_hcd_rem_wakeup(hsotg);
+        hsotg->bus_suspended = 0;
 
         /* Change to L0 state */
         hsotg->lx_state = DWC2_L0;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 5859b0fa19ee..e61d773cf65e 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -108,7 +108,8 @@ static const struct dwc2_core_params params_rk3066 = {
         .host_ls_low_power_phy_clk      = -1,
         .ts_dline                       = -1,
         .reload_ctl                     = -1,
-        .ahbcfg                         = 0x7, /* INCR16 */
+        .ahbcfg                         = GAHBCFG_HBSTLEN_INCR16 <<
+                                          GAHBCFG_HBSTLEN_SHIFT,
         .uframe_sched                   = -1,
         .external_id_pin_ctl            = -1,
         .hibernation                    = -1,
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 77a622cb48ab..009d83048c8c 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -34,6 +34,8 @@
 #define PCI_DEVICE_ID_INTEL_BSW                 0x22b7
 #define PCI_DEVICE_ID_INTEL_SPTLP               0x9d30
 #define PCI_DEVICE_ID_INTEL_SPTH                0xa130
+#define PCI_DEVICE_ID_INTEL_BXT                 0x0aaa
+#define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 
 static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
 static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -210,6 +212,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTLP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SPTH), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 55ba447fdf8b..e24a01cc98df 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2744,12 +2744,34 @@ int dwc3_gadget_init(struct dwc3 *dwc)
         }
 
         dwc->gadget.ops                 = &dwc3_gadget_ops;
-        dwc->gadget.max_speed           = USB_SPEED_SUPER;
         dwc->gadget.speed               = USB_SPEED_UNKNOWN;
         dwc->gadget.sg_supported        = true;
         dwc->gadget.name                = "dwc3-gadget";
 
         /*
+         * FIXME We might be setting max_speed to <SUPER, however versions
+         * <2.20a of dwc3 have an issue with metastability (documented
+         * elsewhere in this driver) which tells us we can't set max speed to
+         * anything lower than SUPER.
+         *
+         * Because gadget.max_speed is only used by composite.c and function
+         * drivers (i.e. it won't go into dwc3's registers) we are allowing this
+         * to happen so we avoid sending SuperSpeed Capability descriptor
+         * together with our BOS descriptor as that could confuse host into
+         * thinking we can handle super speed.
+         *
+         * Note that, in fact, we won't even support GetBOS requests when speed
+         * is less than super speed because we don't have means, yet, to tell
+         * composite.c that we are USB 2.0 + LPM ECN.
+         */
+        if (dwc->revision < DWC3_REVISION_220A)
+                dwc3_trace(trace_dwc3_gadget,
+                                "Changing max_speed on rev %08x\n",
+                                dwc->revision);
+
+        dwc->gadget.max_speed           = dwc->maximum_speed;
+
+        /*
          * Per databook, DWC3 needs buffer size to be aligned to MaxPacketSize
          * on ep out.
          */
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 23933bdf2d9d..ddc3aad886b7 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -329,7 +329,7 @@ static int alloc_requests(struct usb_composite_dev *cdev,
         for (i = 0; i < loop->qlen && result == 0; i++) {
                 result = -ENOMEM;
 
-                in_req = usb_ep_alloc_request(loop->in_ep, GFP_KERNEL);
+                in_req = usb_ep_alloc_request(loop->in_ep, GFP_ATOMIC);
                 if (!in_req)
                         goto fail;
 
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index f0f2b066ac08..f92f5aff0dd5 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1633,7 +1633,7 @@ static irqreturn_t usba_udc_irq(int irq, void *devid)
         spin_lock(&udc->lock);
 
         int_enb = usba_int_enb_get(udc);
-        status = usba_readl(udc, INT_STA) & int_enb;
+        status = usba_readl(udc, INT_STA) & (int_enb | USBA_HIGH_SPEED);
         DBG(DBG_INT, "irq, status=%#08x\n", status);
 
         if (status & USBA_DET_SUSPEND) {
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5d2d7e954bd4..0230965fb78c 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -782,12 +782,15 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
                 }
         }
-        if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0
-                        && (raw_port_status & PORT_POWER)
-                        && (bus_state->suspended_ports & (1 << wIndex))) {
-                bus_state->suspended_ports &= ~(1 << wIndex);
-                if (hcd->speed < HCD_USB3)
-                        bus_state->port_c_suspend |= 1 << wIndex;
+        if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 &&
+            (raw_port_status & PORT_POWER)) {
+                if (bus_state->suspended_ports & (1 << wIndex)) {
+                        bus_state->suspended_ports &= ~(1 << wIndex);
+                        if (hcd->speed < HCD_USB3)
+                                bus_state->port_c_suspend |= 1 << wIndex;
+                }
+                bus_state->resume_done[wIndex] = 0;
+                clear_bit(wIndex, &bus_state->resuming_ports);
         }
         if (raw_port_status & PORT_CONNECT) {
                 status |= USB_PORT_STAT_CONNECTION;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fa836251ca21..6c5e8133cf87 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3896,28 +3896,6 @@ cleanup:
         return ret;
 }
 
-static int ep_ring_is_processing(struct xhci_hcd *xhci,
-                int slot_id, unsigned int ep_index)
-{
-        struct xhci_virt_device *xdev;
-        struct xhci_ring *ep_ring;
-        struct xhci_ep_ctx *ep_ctx;
-        struct xhci_virt_ep *xep;
-        dma_addr_t hw_deq;
-
-        xdev = xhci->devs[slot_id];
-        xep = &xhci->devs[slot_id]->eps[ep_index];
-        ep_ring = xep->ring;
-        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
-
-        if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) != EP_STATE_RUNNING)
-                return 0;
-
-        hw_deq = le64_to_cpu(ep_ctx->deq) & ~EP_CTX_CYCLE_MASK;
-        return (hw_deq !=
-                xhci_trb_virt_to_dma(ep_ring->enq_seg, ep_ring->enqueue));
-}
-
 /*
  * Check transfer ring to guarantee there is enough room for the urb.
  * Update ISO URB start_frame and interval.
@@ -3983,10 +3961,12 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
         }
 
         /* Calculate the start frame and put it in urb->start_frame. */
-        if (HCC_CFC(xhci->hcc_params) &&
-                        ep_ring_is_processing(xhci, slot_id, ep_index)) {
-                urb->start_frame = xep->next_frame_id;
-                goto skip_start_over;
+        if (HCC_CFC(xhci->hcc_params) && !list_empty(&ep_ring->td_list)) {
+                if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) ==
+                                EP_STATE_RUNNING) {
+                        urb->start_frame = xep->next_frame_id;
+                        goto skip_start_over;
+                }
         }
 
         start_frame = readl(&xhci->run_regs->microframe_index);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6e7dc6f93978..dfa44d3e8eee 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -175,6 +175,16 @@ int xhci_reset(struct xhci_hcd *xhci)
         command |= CMD_RESET;
         writel(command, &xhci->op_regs->command);
 
+        /* Existing Intel xHCI controllers require a delay of 1 mS,
+         * after setting the CMD_RESET bit, and before accessing any
+         * HC registers. This allows the HC to complete the
+         * reset operation and be ready for HC register access.
+         * Without this delay, the subsequent HC register access,
+         * may result in a system hang very rarely.
+         */
+        if (xhci->quirks & XHCI_INTEL_HOST)
+                udelay(1000);
+
         ret = xhci_handshake(&xhci->op_regs->command,
                         CMD_RESET, 0, 10 * 1000 * 1000);
         if (ret)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index ba13529cbd52..18cfc0a361cb 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -132,7 +132,7 @@ static inline struct musb *dev_to_musb(struct device *dev)
 /*-------------------------------------------------------------------------*/
 
 #ifndef CONFIG_BLACKFIN
-static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
+static int musb_ulpi_read(struct usb_phy *phy, u32 reg)
 {
         void __iomem *addr = phy->io_priv;
         int     i = 0;
@@ -151,7 +151,7 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
          * ULPICarKitControlDisableUTMI after clearing POWER_SUSPENDM.
          */
 
-        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
+        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL,
                         MUSB_ULPI_REG_REQ | MUSB_ULPI_RDN_WR);
 
@@ -176,7 +176,7 @@ out:
         return ret;
 }
 
-static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
+static int musb_ulpi_write(struct usb_phy *phy, u32 val, u32 reg)
 {
         void __iomem *addr = phy->io_priv;
         int     i = 0;
@@ -191,8 +191,8 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
         power &= ~MUSB_POWER_SUSPENDM;
         musb_writeb(addr, MUSB_POWER, power);
 
-        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
-        musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)data);
+        musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
+        musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)val);
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL, MUSB_ULPI_REG_REQ);
 
         while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL)
@@ -1668,7 +1668,7 @@ EXPORT_SYMBOL_GPL(musb_interrupt);
 static bool use_dma = 1;
 
 /* "modprobe ... use_dma=0" etc */
-module_param(use_dma, bool, 0);
+module_param(use_dma, bool, 0644);
 MODULE_PARM_DESC(use_dma, "enable/disable use of DMA");
 
 void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit)
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 26c65e66cc0f..795a45b1b25b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -112,22 +112,32 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
         struct musb     *musb = ep->musb;
         void __iomem    *epio = ep->regs;
         u16             csr;
-        u16             lastcsr = 0;
         int             retries = 1000;
 
         csr = musb_readw(epio, MUSB_TXCSR);
         while (csr & MUSB_TXCSR_FIFONOTEMPTY) {
-                if (csr != lastcsr)
-                        dev_dbg(musb->controller, "Host TX FIFONOTEMPTY csr: %02x\n", csr);
-                lastcsr = csr;
                 csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_TXPKTRDY;
                 musb_writew(epio, MUSB_TXCSR, csr);
                 csr = musb_readw(epio, MUSB_TXCSR);
-                if (WARN(retries-- < 1,
+
+                /*
+                 * FIXME: sometimes the tx fifo flush failed, it has been
+                 * observed during device disconnect on AM335x.
+                 *
+                 * To reproduce the issue, ensure tx urb(s) are queued when
+                 * unplug the usb device which is connected to AM335x usb
+                 * host port.
+                 *
+                 * I found using a usb-ethernet device and running iperf
+                 * (client on AM335x) has very high chance to trigger it.
+                 *
+                 * Better to turn on dev_dbg() in musb_cleanup_urb() with
+                 * CPPI enabled to see the issue when aborting the tx channel.
+                 */
+                if (dev_WARN_ONCE(musb->controller, retries-- < 1,
                                 "Could not flush host TX%d fifo: csr: %04x\n",
                                 ep->epnum, csr))
                         return;
-                mdelay(1);
         }
 }
 
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 173132416170..22e8ecb6bfbd 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -21,7 +21,6 @@ config AB8500_USB
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
         depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
-        select USB_OTG
         select USB_PHY
         help
           Enable this to support Freescale USB OTG transceiver.
@@ -168,8 +167,7 @@ config USB_QCOM_8X16_PHY
 
 config USB_MV_OTG
         tristate "Marvell USB OTG support"
-        depends on USB_EHCI_MV && USB_MV_UDC && PM
-        select USB_OTG
+        depends on USB_EHCI_MV && USB_MV_UDC && PM && USB_OTG
         select USB_PHY
         help
           Say Y here if you want to build Marvell USB OTG transciever
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 4d863ebc117c..b7536af777ab 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -452,10 +452,13 @@ static int mxs_phy_probe(struct platform_device *pdev)
         struct clk *clk;
         struct mxs_phy *mxs_phy;
         int ret;
-        const struct of_device_id *of_id =
-                        of_match_device(mxs_phy_dt_ids, &pdev->dev);
+        const struct of_device_id *of_id;
         struct device_node *np = pdev->dev.of_node;
 
+        of_id = of_match_device(mxs_phy_dt_ids, &pdev->dev);
+        if (!of_id)
+                return -ENODEV;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index 1270906ccb95..c4bf2de6d14e 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -105,7 +105,6 @@ static int omap_otg_probe(struct platform_device *pdev)
         extcon = extcon_get_extcon_dev(config->extcon);
         if (!extcon)
                 return -EPROBE_DEFER;
-        otg_dev->extcon = extcon;
 
         otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
         if (!otg_dev)
@@ -115,6 +114,7 @@ static int omap_otg_probe(struct platform_device *pdev)
         if (IS_ERR(otg_dev->base))
                 return PTR_ERR(otg_dev->base);
 
+        otg_dev->extcon = extcon;
         otg_dev->id_nb.notifier_call = omap_otg_id_notifier;
         otg_dev->vbus_nb.notifier_call = omap_otg_vbus_notifier;
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 685fef71d3d1..f2280606b73c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
 #define NOVATELWIRELESS_PRODUCT_E362            0x9010
 #define NOVATELWIRELESS_PRODUCT_E371            0x9011
+#define NOVATELWIRELESS_PRODUCT_U620L           0x9022
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
 #define NOVATELWIRELESS_PRODUCT_MC551           0xB001
 
@@ -354,6 +355,7 @@ static void option_instat_callback(struct urb *urb);
 /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
 #define FOUR_G_SYSTEMS_PRODUCT_W14              0x9603
+#define FOUR_G_SYSTEMS_PRODUCT_W100             0x9b01
 
 /* iBall 3.5G connect wireless modem */
 #define IBALL_3_5G_CONNECT                      0x9605
@@ -519,6 +521,11 @@ static const struct option_blacklist_info four_g_w14_blacklist = {
         .sendsetup = BIT(0) | BIT(1),
 };
 
+static const struct option_blacklist_info four_g_w100_blacklist = {
+        .sendsetup = BIT(1) | BIT(2),
+        .reserved = BIT(3),
+};
+
 static const struct option_blacklist_info alcatel_x200_blacklist = {
         .sendsetup = BIT(0) | BIT(1),
         .reserved = BIT(4),
@@ -1052,6 +1059,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U620L, 0xff, 0x00, 0x00) },
 
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
@@ -1641,6 +1649,9 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
           .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
         },
+        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
+          .driver_info = (kernel_ulong_t)&four_g_w100_blacklist
+        },
         { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 5022fcfa0260..9919d2a9faf2 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -22,6 +22,8 @@
 #define DRIVER_AUTHOR "Qualcomm Inc"
 #define DRIVER_DESC "Qualcomm USB Serial driver"
 
+#define QUECTEL_EC20_PID        0x9215
+
 /* standard device layouts supported by this driver */
 enum qcserial_layouts {
         QCSERIAL_G2K = 0,       /* Gobi 2000 */
@@ -171,6 +173,38 @@ static const struct usb_device_id id_table[] = {
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
+static int handle_quectel_ec20(struct device *dev, int ifnum)
+{
+        int altsetting = 0;
+
+        /*
+         * Quectel EC20 Mini PCIe LTE module layout:
+         * 0: DM/DIAG (use libqcdm from ModemManager for communication)
+         * 1: NMEA
+         * 2: AT-capable modem port
+         * 3: Modem interface
+         * 4: NDIS
+         */
+        switch (ifnum) {
+        case 0:
+                dev_dbg(dev, "Quectel EC20 DM/DIAG interface found\n");
+                break;
+        case 1:
+                dev_dbg(dev, "Quectel EC20 NMEA GPS interface found\n");
+                break;
+        case 2:
+        case 3:
+                dev_dbg(dev, "Quectel EC20 Modem port found\n");
+                break;
+        case 4:
+                /* Don't claim the QMI/net interface */
+                altsetting = -1;
+                break;
+        }
+
+        return altsetting;
+}
+
 static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 {
         struct usb_host_interface *intf = serial->interface->cur_altsetting;
@@ -181,6 +215,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         int altsetting = -1;
         bool sendsetup = false;
 
+        /* we only support vendor specific functions */
+        if (intf->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                goto done;
+
         nintf = serial->dev->actconfig->desc.bNumInterfaces;
         dev_dbg(dev, "Num Interfaces = %d\n", nintf);
         ifnum = intf->desc.bInterfaceNumber;
@@ -240,6 +278,12 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                         altsetting = -1;
                 break;
         case QCSERIAL_G2K:
+                /* handle non-standard layouts */
+                if (nintf == 5 && id->idProduct == QUECTEL_EC20_PID) {
+                        altsetting = handle_quectel_ec20(dev, ifnum);
+                        goto done;
+                }
+
                 /*
                  * Gobi 2K+ USB layout:
                  * 0: QMI/net
@@ -301,29 +345,39 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                 break;
         case QCSERIAL_HWI:
                 /*
-                 * Huawei layout:
-                 * 0: AT-capable modem port
-                 * 1: DM/DIAG
-                 * 2: AT-capable modem port
-                 * 3: CCID-compatible PCSC interface
-                 * 4: QMI/net
-                 * 5: NMEA
+                 * Huawei devices map functions by subclass + protocol
+                 * instead of interface numbers. The protocol identify
+                 * a specific function, while the subclass indicate a
+                 * specific firmware source
+                 *
+                 * This is a blacklist of functions known to be
+                 * non-serial.  The rest are assumed to be serial and
+                 * will be handled by this driver
                  */
-                switch (ifnum) {
-                case 0:
-                case 2:
-                        dev_dbg(dev, "Modem port found\n");
-                        break;
-                case 1:
-                        dev_dbg(dev, "DM/DIAG interface found\n");
-                        break;
-                case 5:
-                        dev_dbg(dev, "NMEA GPS interface found\n");
-                        break;
-                default:
-                        /* don't claim any unsupported interface */
+                switch (intf->desc.bInterfaceProtocol) {
+                        /* QMI combined (qmi_wwan) */
+                case 0x07:
+                case 0x37:
+                case 0x67:
+                        /* QMI data (qmi_wwan) */
+                case 0x08:
+                case 0x38:
+                case 0x68:
+                        /* QMI control (qmi_wwan) */
+                case 0x09:
+                case 0x39:
+                case 0x69:
+                        /* NCM like (huawei_cdc_ncm) */
+                case 0x16:
+                case 0x46:
+                case 0x76:
                         altsetting = -1;
                         break;
+                default:
+                        dev_dbg(dev, "Huawei type serial port found (%02x/%02x/%02x)\n",
+                                intf->desc.bInterfaceClass,
+                                intf->desc.bInterfaceSubClass,
+                                intf->desc.bInterfaceProtocol);
                 }
                 break;
         default:
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index e9da41d9fe7f..2694df2f4559 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -159,6 +159,7 @@ static const struct usb_device_id ti_id_table_3410[] = {
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) },
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+        { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) },
         { }     /* terminator */
 };
 
@@ -191,6 +192,7 @@ static const struct usb_device_id ti_id_table_combined[] = {
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+        { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) },
         { }     /* terminator */
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index 4a2423e84d55..98f35c656c02 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -56,6 +56,10 @@
 #define ABBOTT_PRODUCT_ID               ABBOTT_STEREO_PLUG_ID
 #define ABBOTT_STRIP_PORT_ID            0x3420
 
+/* Honeywell vendor and product IDs */
+#define HONEYWELL_VENDOR_ID             0x10ac
+#define HONEYWELL_HGI80_PRODUCT_ID      0x0102  /* Honeywell HGI80 */
+
 /* Commands */
 #define TI_GET_VERSION                  0x01
 #define TI_GET_PORT_STATUS              0x02
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 7a8a6c6952e9..1c427beffadd 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -446,7 +446,7 @@ config MAX63XX_WATCHDOG
 
 config IMX2_WDT
         tristate "IMX2+ Watchdog"
-        depends on ARCH_MXC
+        depends on ARCH_MXC || ARCH_LAYERSCAPE
         select REGMAP_MMIO
         select WATCHDOG_CORE
         help
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index 6ad9df948711..b751f43d76ed 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -123,6 +123,7 @@ static int mtk_wdt_stop(struct watchdog_device *wdt_dev)
 
         reg = readl(wdt_base + WDT_MODE);
         reg &= ~WDT_MODE_EN;
+        reg |= WDT_MODE_KEY;
         iowrite32(reg, wdt_base + WDT_MODE);
 
         return 0;
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index d96bee017fd3..6f17c935a6cf 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -205,7 +205,7 @@ static int omap_wdt_set_timeout(struct watchdog_device *wdog,
 
 static unsigned int omap_wdt_get_timeleft(struct watchdog_device *wdog)
 {
-        struct omap_wdt_dev *wdev = watchdog_get_drvdata(wdog);
+        struct omap_wdt_dev *wdev = to_omap_wdt_dev(wdog);
         void __iomem *base = wdev->base;
         u32 value;
 
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 4224b3ec83a5..313cd1c6fda0 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -80,7 +80,7 @@ static unsigned int heartbeat = DEFAULT_HEARTBEAT;
 
 static DEFINE_SPINLOCK(io_lock);
 static void __iomem     *wdt_base;
-struct clk              *wdt_clk;
+static struct clk       *wdt_clk;
 
 static int pnx4008_wdt_start(struct watchdog_device *wdd)
 {
@@ -161,7 +161,7 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
         if (IS_ERR(wdt_clk))
                 return PTR_ERR(wdt_clk);
 
-        ret = clk_enable(wdt_clk);
+        ret = clk_prepare_enable(wdt_clk);
         if (ret)
                 return ret;
 
@@ -184,7 +184,7 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
         return 0;
 
 disable_clk:
-        clk_disable(wdt_clk);
+        clk_disable_unprepare(wdt_clk);
         return ret;
 }
 
@@ -192,7 +192,7 @@ static int pnx4008_wdt_remove(struct platform_device *pdev)
 {
         watchdog_unregister_device(&pnx4008_wdd);
 
-        clk_disable(wdt_clk);
+        clk_disable_unprepare(wdt_clk);
 
         return 0;
 }
diff --git a/drivers/watchdog/tegra_wdt.c b/drivers/watchdog/tegra_wdt.c
index 7f97cdd53f29..9ec57608da82 100644
--- a/drivers/watchdog/tegra_wdt.c
+++ b/drivers/watchdog/tegra_wdt.c
@@ -140,8 +140,10 @@ static int tegra_wdt_set_timeout(struct watchdog_device *wdd,
 {
         wdd->timeout = timeout;
 
-        if (watchdog_active(wdd))
+        if (watchdog_active(wdd)) {
+                tegra_wdt_stop(wdd);
                 return tegra_wdt_start(wdd);
+        }
 
         return 0;
 }
diff --git a/drivers/watchdog/w83977f_wdt.c b/drivers/watchdog/w83977f_wdt.c
index 91bf55a20024..20e2bba10400 100644
--- a/drivers/watchdog/w83977f_wdt.c
+++ b/drivers/watchdog/w83977f_wdt.c
@@ -224,7 +224,7 @@ static int wdt_keepalive(void)
 
 static int wdt_set_timeout(int t)
 {
-        int tmrval;
+        unsigned int tmrval;
 
         /*
          * Convert seconds to watchdog counter time units, rounding up.
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 849500e4e14d..524c22146429 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -39,6 +39,7 @@
 #include <asm/irq.h>
 #include <asm/idle.h>
 #include <asm/io_apic.h>
+#include <asm/i8259.h>
 #include <asm/xen/pci.h>
 #endif
 #include <asm/sync_bitops.h>
@@ -420,7 +421,7 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
                 return xen_allocate_irq_dynamic();
 
         /* Legacy IRQ descriptors are already allocated by the arch. */
-        if (gsi < NR_IRQS_LEGACY)
+        if (gsi < nr_legacy_irqs())
                 irq = gsi;
         else
                 irq = irq_alloc_desc_at(gsi, -1);
@@ -446,7 +447,7 @@ static void xen_free_irq(unsigned irq)
         kfree(info);
 
         /* Legacy IRQ descriptors are managed by the arch. */
-        if (irq < NR_IRQS_LEGACY)
+        if (irq < nr_legacy_irqs())
                 return;
 
         irq_free_desc(irq);
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 00f40f051d95..38272ad24551 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -49,6 +49,8 @@
 #include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/cpu.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -58,10 +60,10 @@
 struct per_user_data {
         struct mutex bind_mutex; /* serialize bind/unbind operations */
         struct rb_root evtchns;
+        unsigned int nr_evtchns;
 
         /* Notification ring, accessed via /dev/xen/evtchn. */
-#define EVTCHN_RING_SIZE     (PAGE_SIZE / sizeof(evtchn_port_t))
-#define EVTCHN_RING_MASK(_i) ((_i)&(EVTCHN_RING_SIZE-1))
+        unsigned int ring_size;
         evtchn_port_t *ring;
         unsigned int ring_cons, ring_prod, ring_overflow;
         struct mutex ring_cons_mutex; /* protect against concurrent readers */
@@ -80,10 +82,41 @@ struct user_evtchn {
         bool enabled;
 };
 
+static evtchn_port_t *evtchn_alloc_ring(unsigned int size)
+{
+        evtchn_port_t *ring;
+        size_t s = size * sizeof(*ring);
+
+        ring = kmalloc(s, GFP_KERNEL);
+        if (!ring)
+                ring = vmalloc(s);
+
+        return ring;
+}
+
+static void evtchn_free_ring(evtchn_port_t *ring)
+{
+        kvfree(ring);
+}
+
+static unsigned int evtchn_ring_offset(struct per_user_data *u,
+                                       unsigned int idx)
+{
+        return idx & (u->ring_size - 1);
+}
+
+static evtchn_port_t *evtchn_ring_entry(struct per_user_data *u,
+                                        unsigned int idx)
+{
+        return u->ring + evtchn_ring_offset(u, idx);
+}
+
 static int add_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 {
         struct rb_node **new = &(u->evtchns.rb_node), *parent = NULL;
 
+        u->nr_evtchns++;
+
         while (*new) {
                 struct user_evtchn *this;
 
@@ -107,6 +140,7 @@ static int add_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 
 static void del_evtchn(struct per_user_data *u, struct user_evtchn *evtchn)
 {
+        u->nr_evtchns--;
         rb_erase(&evtchn->node, &u->evtchns);
         kfree(evtchn);
 }
@@ -144,8 +178,8 @@ static irqreturn_t evtchn_interrupt(int irq, void *data)
 
         spin_lock(&u->ring_prod_lock);
 
-        if ((u->ring_prod - u->ring_cons) < EVTCHN_RING_SIZE) {
-                u->ring[EVTCHN_RING_MASK(u->ring_prod)] = evtchn->port;
+        if ((u->ring_prod - u->ring_cons) < u->ring_size) {
+                *evtchn_ring_entry(u, u->ring_prod) = evtchn->port;
                 wmb(); /* Ensure ring contents visible */
                 if (u->ring_cons == u->ring_prod++) {
                         wake_up_interruptible(&u->evtchn_wait);
@@ -200,10 +234,10 @@ static ssize_t evtchn_read(struct file *file, char __user *buf,
         }
 
         /* Byte lengths of two chunks. Chunk split (if any) is at ring wrap. */
-        if (((c ^ p) & EVTCHN_RING_SIZE) != 0) {
-                bytes1 = (EVTCHN_RING_SIZE - EVTCHN_RING_MASK(c)) *
+        if (((c ^ p) & u->ring_size) != 0) {
+                bytes1 = (u->ring_size - evtchn_ring_offset(u, c)) *
                         sizeof(evtchn_port_t);
-                bytes2 = EVTCHN_RING_MASK(p) * sizeof(evtchn_port_t);
+                bytes2 = evtchn_ring_offset(u, p) * sizeof(evtchn_port_t);
         } else {
                 bytes1 = (p - c) * sizeof(evtchn_port_t);
                 bytes2 = 0;
@@ -219,7 +253,7 @@ static ssize_t evtchn_read(struct file *file, char __user *buf,
 
         rc = -EFAULT;
         rmb(); /* Ensure that we see the port before we copy it. */
-        if (copy_to_user(buf, &u->ring[EVTCHN_RING_MASK(c)], bytes1) ||
+        if (copy_to_user(buf, evtchn_ring_entry(u, c), bytes1) ||
             ((bytes2 != 0) &&
              copy_to_user(&buf[bytes1], &u->ring[0], bytes2)))
                 goto unlock_out;
@@ -278,6 +312,66 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf,
         return rc;
 }
 
+static int evtchn_resize_ring(struct per_user_data *u)
+{
+        unsigned int new_size;
+        evtchn_port_t *new_ring, *old_ring;
+        unsigned int p, c;
+
+        /*
+         * Ensure the ring is large enough to capture all possible
+         * events. i.e., one free slot for each bound event.
+         */
+        if (u->nr_evtchns <= u->ring_size)
+                return 0;
+
+        if (u->ring_size == 0)
+                new_size = 64;
+        else
+                new_size = 2 * u->ring_size;
+
+        new_ring = evtchn_alloc_ring(new_size);
+        if (!new_ring)
+                return -ENOMEM;
+
+        old_ring = u->ring;
+
+        /*
+         * Access to the ring contents is serialized by either the
+         * prod /or/ cons lock so take both when resizing.
+         */
+        mutex_lock(&u->ring_cons_mutex);
+        spin_lock_irq(&u->ring_prod_lock);
+
+        /*
+         * Copy the old ring contents to the new ring.
+         *
+         * If the ring contents crosses the end of the current ring,
+         * it needs to be copied in two chunks.
+         *
+         * +---------+    +------------------+
+         * |34567  12| -> |       1234567    |
+         * +-----p-c-+    +------------------+
+         */
+        p = evtchn_ring_offset(u, u->ring_prod);
+        c = evtchn_ring_offset(u, u->ring_cons);
+        if (p < c) {
+                memcpy(new_ring + c, u->ring + c, (u->ring_size - c) * sizeof(*u->ring));
+                memcpy(new_ring + u->ring_size, u->ring, p * sizeof(*u->ring));
+        } else
+                memcpy(new_ring + c, u->ring + c, (p - c) * sizeof(*u->ring));
+
+        u->ring = new_ring;
+        u->ring_size = new_size;
+
+        spin_unlock_irq(&u->ring_prod_lock);
+        mutex_unlock(&u->ring_cons_mutex);
+
+        evtchn_free_ring(old_ring);
+
+        return 0;
+}
+
 static int evtchn_bind_to_user(struct per_user_data *u, int port)
 {
         struct user_evtchn *evtchn;
@@ -305,6 +399,10 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port)
         if (rc < 0)
                 goto err;
 
+        rc = evtchn_resize_ring(u);
+        if (rc < 0)
+                goto err;
+
         rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, 0,
                                        u->name, evtchn);
         if (rc < 0)
@@ -503,13 +601,6 @@ static int evtchn_open(struct inode *inode, struct file *filp)
 
         init_waitqueue_head(&u->evtchn_wait);
 
-        u->ring = (evtchn_port_t *)__get_free_page(GFP_KERNEL);
-        if (u->ring == NULL) {
-                kfree(u->name);
-                kfree(u);
-                return -ENOMEM;
-        }
-
         mutex_init(&u->bind_mutex);
         mutex_init(&u->ring_cons_mutex);
         spin_lock_init(&u->ring_prod_lock);
@@ -532,7 +623,7 @@ static int evtchn_release(struct inode *inode, struct file *filp)
                 evtchn_unbind_from_user(u, evtchn);
         }
 
-        free_page((unsigned long)u->ring);
+        evtchn_free_ring(u->ring);
         kfree(u->name);
         kfree(u);
 
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 2ea0b3b2a91d..1be5dd048622 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -804,7 +804,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 
         vma->vm_ops = &gntdev_vmops;
 
-        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
 
         if (use_ptemod)
                 vma->vm_flags |= VM_DONTCOPY;
diff --git a/fs/Kconfig b/fs/Kconfig
index da3f32f1a4e4..6ce72d8d1ee1 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -46,6 +46,12 @@ config FS_DAX
           or if unsure, say N.  Saying Y will increase the size of the kernel
           by about 5kB.
 
+config FS_DAX_PMD
+        bool
+        default FS_DAX
+        depends on FS_DAX
+        depends on BROKEN
+
 endif # BLOCK
 
 # Posix ACL utility routines
diff --git a/fs/block_dev.c b/fs/block_dev.c
index bb0dfb1c7af1..c25639e907bd 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -390,9 +390,17 @@ int bdev_read_page(struct block_device *bdev, sector_t sector,
                         struct page *page)
 {
         const struct block_device_operations *ops = bdev->bd_disk->fops;
+        int result = -EOPNOTSUPP;
+
         if (!ops->rw_page || bdev_get_integrity(bdev))
-                return -EOPNOTSUPP;
-        return ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);
+                return result;
+
+        result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);
+        if (result)
+                return result;
+        result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);
+        blk_queue_exit(bdev->bd_queue);
+        return result;
 }
 EXPORT_SYMBOL_GPL(bdev_read_page);
 
@@ -421,14 +429,20 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
         int result;
         int rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE;
         const struct block_device_operations *ops = bdev->bd_disk->fops;
+
         if (!ops->rw_page || bdev_get_integrity(bdev))
                 return -EOPNOTSUPP;
+        result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);
+        if (result)
+                return result;
+
         set_page_writeback(page);
         result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw);
         if (result)
                 end_page_writeback(page);
         else
                 unlock_page(page);
+        blk_queue_exit(bdev->bd_queue);
         return result;
 }
 EXPORT_SYMBOL_GPL(bdev_write_page);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 6dcdb2ec9211..d453d62ab0c6 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -355,7 +355,7 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
 
         index = srcu_read_lock(&fs_info->subvol_srcu);
 
-        root = btrfs_read_fs_root_no_name(fs_info, &root_key);
+        root = btrfs_get_fs_root(fs_info, &root_key, false);
         if (IS_ERR(root)) {
                 srcu_read_unlock(&fs_info->subvol_srcu, index);
                 ret = PTR_ERR(root);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 8c58191249cc..35489e7129a7 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3416,6 +3416,7 @@ int btrfs_cross_ref_exist(struct btrfs_trans_handle *trans,
 struct btrfs_block_group_cache *btrfs_lookup_block_group(
                                                  struct btrfs_fs_info *info,
                                                  u64 bytenr);
+void btrfs_get_block_group(struct btrfs_block_group_cache *cache);
 void btrfs_put_block_group(struct btrfs_block_group_cache *cache);
 int get_block_group_index(struct btrfs_block_group_cache *cache);
 struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
@@ -3479,6 +3480,9 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root, u64 bytes_used,
                            u64 type, u64 chunk_objectid, u64 chunk_offset,
                            u64 size);
+struct btrfs_trans_handle *btrfs_start_trans_remove_block_group(
+                                struct btrfs_fs_info *fs_info,
+                                const u64 chunk_offset);
 int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root, u64 group_start,
                              struct extent_map *em);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index acf3ed11cfb6..4b89680a1923 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -124,7 +124,7 @@ static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
         return (cache->flags & bits) == bits;
 }
 
-static void btrfs_get_block_group(struct btrfs_block_group_cache *cache)
+void btrfs_get_block_group(struct btrfs_block_group_cache *cache)
 {
         atomic_inc(&cache->count);
 }
@@ -5915,19 +5915,6 @@ static int update_block_group(struct btrfs_trans_handle *trans,
                         set_extent_dirty(info->pinned_extents,
                                          bytenr, bytenr + num_bytes - 1,
                                          GFP_NOFS | __GFP_NOFAIL);
-                        /*
-                         * No longer have used bytes in this block group, queue
-                         * it for deletion.
-                         */
-                        if (old_val == 0) {
-                                spin_lock(&info->unused_bgs_lock);
-                                if (list_empty(&cache->bg_list)) {
-                                        btrfs_get_block_group(cache);
-                                        list_add_tail(&cache->bg_list,
-                                                      &info->unused_bgs);
-                                }
-                                spin_unlock(&info->unused_bgs_lock);
-                        }
                 }
 
                 spin_lock(&trans->transaction->dirty_bgs_lock);
@@ -5939,6 +5926,22 @@ static int update_block_group(struct btrfs_trans_handle *trans,
                 }
                 spin_unlock(&trans->transaction->dirty_bgs_lock);
 
+                /*
+                 * No longer have used bytes in this block group, queue it for
+                 * deletion. We do this after adding the block group to the
+                 * dirty list to avoid races between cleaner kthread and space
+                 * cache writeout.
+                 */
+                if (!alloc && old_val == 0) {
+                        spin_lock(&info->unused_bgs_lock);
+                        if (list_empty(&cache->bg_list)) {
+                                btrfs_get_block_group(cache);
+                                list_add_tail(&cache->bg_list,
+                                              &info->unused_bgs);
+                        }
+                        spin_unlock(&info->unused_bgs_lock);
+                }
+
                 btrfs_put_block_group(cache);
                 total -= num_bytes;
                 bytenr += num_bytes;
@@ -8105,21 +8108,47 @@ reada:
 }
 
 /*
- * TODO: Modify related function to add related node/leaf to dirty_extent_root,
- * for later qgroup accounting.
- *
- * Current, this function does nothing.
+ * These may not be seen by the usual inc/dec ref code so we have to
+ * add them here.
  */
+static int record_one_subtree_extent(struct btrfs_trans_handle *trans,
+                                     struct btrfs_root *root, u64 bytenr,
+                                     u64 num_bytes)
+{
+        struct btrfs_qgroup_extent_record *qrecord;
+        struct btrfs_delayed_ref_root *delayed_refs;
+
+        qrecord = kmalloc(sizeof(*qrecord), GFP_NOFS);
+        if (!qrecord)
+                return -ENOMEM;
+
+        qrecord->bytenr = bytenr;
+        qrecord->num_bytes = num_bytes;
+        qrecord->old_roots = NULL;
+
+        delayed_refs = &trans->transaction->delayed_refs;
+        spin_lock(&delayed_refs->lock);
+        if (btrfs_qgroup_insert_dirty_extent(delayed_refs, qrecord))
+                kfree(qrecord);
+        spin_unlock(&delayed_refs->lock);
+
+        return 0;
+}
+
 static int account_leaf_items(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct extent_buffer *eb)
 {
         int nr = btrfs_header_nritems(eb);
-        int i, extent_type;
+        int i, extent_type, ret;
         struct btrfs_key key;
         struct btrfs_file_extent_item *fi;
         u64 bytenr, num_bytes;
 
+        /* We can be called directly from walk_up_proc() */
+        if (!root->fs_info->quota_enabled)
+                return 0;
+
         for (i = 0; i < nr; i++) {
                 btrfs_item_key_to_cpu(eb, &key, i);
 
@@ -8138,6 +8167,10 @@ static int account_leaf_items(struct btrfs_trans_handle *trans,
                         continue;
 
                 num_bytes = btrfs_file_extent_disk_num_bytes(eb, fi);
+
+                ret = record_one_subtree_extent(trans, root, bytenr, num_bytes);
+                if (ret)
+                        return ret;
         }
         return 0;
 }
@@ -8206,8 +8239,6 @@ static int adjust_slots_upwards(struct btrfs_root *root,
 
 /*
  * root_eb is the subtree root and is locked before this function is called.
- * TODO: Modify this function to mark all (including complete shared node)
- * to dirty_extent_root to allow it get accounted in qgroup.
  */
 static int account_shared_subtree(struct btrfs_trans_handle *trans,
                                   struct btrfs_root *root,
@@ -8285,6 +8316,11 @@ walk_down:
                         btrfs_tree_read_lock(eb);
                         btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
                         path->locks[level] = BTRFS_READ_LOCK_BLOCKING;
+
+                        ret = record_one_subtree_extent(trans, root, child_bytenr,
+                                                        root->nodesize);
+                        if (ret)
+                                goto out;
                 }
 
                 if (level == 0) {
@@ -10256,6 +10292,47 @@ out:
         return ret;
 }
 
+struct btrfs_trans_handle *
+btrfs_start_trans_remove_block_group(struct btrfs_fs_info *fs_info,
+                                     const u64 chunk_offset)
+{
+        struct extent_map_tree *em_tree = &fs_info->mapping_tree.map_tree;
+        struct extent_map *em;
+        struct map_lookup *map;
+        unsigned int num_items;
+
+        read_lock(&em_tree->lock);
+        em = lookup_extent_mapping(em_tree, chunk_offset, 1);
+        read_unlock(&em_tree->lock);
+        ASSERT(em && em->start == chunk_offset);
+
+        /*
+         * We need to reserve 3 + N units from the metadata space info in order
+         * to remove a block group (done at btrfs_remove_chunk() and at
+         * btrfs_remove_block_group()), which are used for:
+         *
+         * 1 unit for adding the free space inode's orphan (located in the tree
+         * of tree roots).
+         * 1 unit for deleting the block group item (located in the extent
+         * tree).
+         * 1 unit for deleting the free space item (located in tree of tree
+         * roots).
+         * N units for deleting N device extent items corresponding to each
+         * stripe (located in the device tree).
+         *
+         * In order to remove a block group we also need to reserve units in the
+         * system space info in order to update the chunk tree (update one or
+         * more device items and remove one chunk item), but this is done at
+         * btrfs_remove_chunk() through a call to check_system_chunk().
+         */
+        map = (struct map_lookup *)em->bdev;
+        num_items = 3 + map->num_stripes;
+        free_extent_map(em);
+
+        return btrfs_start_transaction_fallback_global_rsv(fs_info->extent_root,
+                                                           num_items, 1);
+}
+
 /*
  * Process the unused_bgs list and remove any that don't have any allocated
  * space inside of them.
@@ -10322,8 +10399,8 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
                  * Want to do this before we do anything else so we can recover
                  * properly if we fail to join the transaction.
                  */
-                /* 1 for btrfs_orphan_reserve_metadata() */
-                trans = btrfs_start_transaction(root, 1);
+                trans = btrfs_start_trans_remove_block_group(fs_info,
+                                                     block_group->key.objectid);
                 if (IS_ERR(trans)) {
                         btrfs_dec_block_group_ro(root, block_group);
                         ret = PTR_ERR(trans);
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 977e715f0bf2..72e73461c064 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1882,8 +1882,13 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         struct btrfs_log_ctx ctx;
         int ret = 0;
         bool full_sync = 0;
-        const u64 len = end - start + 1;
+        u64 len;
 
+        /*
+         * The range length can be represented by u64, we have to do the typecasts
+         * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+         */
+        len = (u64)end - (u64)start + 1;
         trace_btrfs_sync_file(file, datasync);
 
         /*
@@ -2071,8 +2076,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                         }
                 }
                 if (!full_sync) {
-                        ret = btrfs_wait_ordered_range(inode, start,
-                                                       end - start + 1);
+                        ret = btrfs_wait_ordered_range(inode, start, len);
                         if (ret) {
                                 btrfs_end_transaction(trans, root);
                                 goto out;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 994490d5fa64..a70c5790f8f5 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4046,9 +4046,7 @@ int btrfs_unlink_inode(struct btrfs_trans_handle *trans,
  */
 static struct btrfs_trans_handle *__unlink_start_trans(struct inode *dir)
 {
-        struct btrfs_trans_handle *trans;
         struct btrfs_root *root = BTRFS_I(dir)->root;
-        int ret;
 
         /*
          * 1 for the possible orphan item
@@ -4057,27 +4055,7 @@ static struct btrfs_trans_handle *__unlink_start_trans(struct inode *dir)
          * 1 for the inode ref
          * 1 for the inode
          */
-        trans = btrfs_start_transaction(root, 5);
-        if (!IS_ERR(trans) || PTR_ERR(trans) != -ENOSPC)
-                return trans;
-
-        if (PTR_ERR(trans) == -ENOSPC) {
-                u64 num_bytes = btrfs_calc_trans_metadata_size(root, 5);
-
-                trans = btrfs_start_transaction(root, 0);
-                if (IS_ERR(trans))
-                        return trans;
-                ret = btrfs_cond_migrate_bytes(root->fs_info,
-                                               &root->fs_info->trans_block_rsv,
-                                               num_bytes, 5);
-                if (ret) {
-                        btrfs_end_transaction(trans, root);
-                        return ERR_PTR(ret);
-                }
-                trans->block_rsv = &root->fs_info->trans_block_rsv;
-                trans->bytes_reserved = num_bytes;
-        }
-        return trans;
+        return btrfs_start_transaction_fallback_global_rsv(root, 5, 5);
 }
 
 static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 93e12c18ffd7..5279fdae7142 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -993,9 +993,10 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
         mutex_lock(&fs_info->qgroup_ioctl_lock);
         if (!fs_info->quota_root)
                 goto out;
-        spin_lock(&fs_info->qgroup_lock);
         fs_info->quota_enabled = 0;
         fs_info->pending_quota_state = 0;
+        btrfs_qgroup_wait_for_completion(fs_info);
+        spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
         fs_info->quota_root = NULL;
         fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_ON;
@@ -1461,6 +1462,8 @@ struct btrfs_qgroup_extent_record
         struct btrfs_qgroup_extent_record *entry;
         u64 bytenr = record->bytenr;
 
+        assert_spin_locked(&delayed_refs->lock);
+
         while (*p) {
                 parent_node = *p;
                 entry = rb_entry(parent_node, struct btrfs_qgroup_extent_record,
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 2907a77fb1f6..b091d94ceef6 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3432,7 +3432,9 @@ out:
 static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
                                           struct btrfs_device *scrub_dev,
                                           u64 chunk_offset, u64 length,
-                                          u64 dev_offset, int is_dev_replace)
+                                          u64 dev_offset,
+                                          struct btrfs_block_group_cache *cache,
+                                          int is_dev_replace)
 {
         struct btrfs_mapping_tree *map_tree =
                 &sctx->dev_root->fs_info->mapping_tree;
@@ -3445,8 +3447,18 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
         em = lookup_extent_mapping(&map_tree->map_tree, chunk_offset, 1);
         read_unlock(&map_tree->map_tree.lock);
 
-        if (!em)
-                return -EINVAL;
+        if (!em) {
+                /*
+                 * Might have been an unused block group deleted by the cleaner
+                 * kthread or relocation.
+                 */
+                spin_lock(&cache->lock);
+                if (!cache->removed)
+                        ret = -EINVAL;
+                spin_unlock(&cache->lock);
+
+                return ret;
+        }
 
         map = (struct map_lookup *)em->bdev;
         if (em->start != chunk_offset)
@@ -3483,6 +3495,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
         u64 length;
         u64 chunk_offset;
         int ret = 0;
+        int ro_set;
         int slot;
         struct extent_buffer *l;
         struct btrfs_key key;
@@ -3568,7 +3581,21 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
                 scrub_pause_on(fs_info);
                 ret = btrfs_inc_block_group_ro(root, cache);
                 scrub_pause_off(fs_info);
-                if (ret) {
+
+                if (ret == 0) {
+                        ro_set = 1;
+                } else if (ret == -ENOSPC) {
+                        /*
+                         * btrfs_inc_block_group_ro return -ENOSPC when it
+                         * failed in creating new chunk for metadata.
+                         * It is not a problem for scrub/replace, because
+                         * metadata are always cowed, and our scrub paused
+                         * commit_transactions.
+                         */
+                        ro_set = 0;
+                } else {
+                        btrfs_warn(fs_info, "failed setting block group ro, ret=%d\n",
+                                   ret);
                         btrfs_put_block_group(cache);
                         break;
                 }
@@ -3577,7 +3604,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
                 dev_replace->cursor_left = found_key.offset;
                 dev_replace->item_needs_writeback = 1;
                 ret = scrub_chunk(sctx, scrub_dev, chunk_offset, length,
-                                  found_key.offset, is_dev_replace);
+                                  found_key.offset, cache, is_dev_replace);
 
                 /*
                  * flush, submit all pending read and write bios, afterwards
@@ -3611,7 +3638,30 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
 
                 scrub_pause_off(fs_info);
 
-                btrfs_dec_block_group_ro(root, cache);
+                if (ro_set)
+                        btrfs_dec_block_group_ro(root, cache);
+
+                /*
+                 * We might have prevented the cleaner kthread from deleting
+                 * this block group if it was already unused because we raced
+                 * and set it to RO mode first. So add it back to the unused
+                 * list, otherwise it might not ever be deleted unless a manual
+                 * balance is triggered or it becomes used and unused again.
+                 */
+                spin_lock(&cache->lock);
+                if (!cache->removed && !cache->ro && cache->reserved == 0 &&
+                    btrfs_block_group_used(&cache->item) == 0) {
+                        spin_unlock(&cache->lock);
+                        spin_lock(&fs_info->unused_bgs_lock);
+                        if (list_empty(&cache->bg_list)) {
+                                btrfs_get_block_group(cache);
+                                list_add_tail(&cache->bg_list,
+                                              &fs_info->unused_bgs);
+                        }
+                        spin_unlock(&fs_info->unused_bgs_lock);
+                } else {
+                        spin_unlock(&cache->lock);
+                }
 
                 btrfs_put_block_group(cache);
                 if (ret)
diff --git a/fs/btrfs/tests/free-space-tests.c b/fs/btrfs/tests/free-space-tests.c
index c8c3d70c31ff..8b72b005bfb9 100644
--- a/fs/btrfs/tests/free-space-tests.c
+++ b/fs/btrfs/tests/free-space-tests.c
@@ -898,8 +898,10 @@ int btrfs_test_free_space_cache(void)
         }
 
         root = btrfs_alloc_dummy_root();
-        if (!root)
+        if (IS_ERR(root)) {
+                ret = PTR_ERR(root);
                 goto out;
+        }
 
         root->fs_info = btrfs_alloc_dummy_fs_info();
         if (!root->fs_info)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 418c6a2ad7d8..3367a3c6f214 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -592,6 +592,38 @@ struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
         return start_transaction(root, num_items, TRANS_START,
                                  BTRFS_RESERVE_FLUSH_ALL);
 }
+struct btrfs_trans_handle *btrfs_start_transaction_fallback_global_rsv(
+                                        struct btrfs_root *root,
+                                        unsigned int num_items,
+                                        int min_factor)
+{
+        struct btrfs_trans_handle *trans;
+        u64 num_bytes;
+        int ret;
+
+        trans = btrfs_start_transaction(root, num_items);
+        if (!IS_ERR(trans) || PTR_ERR(trans) != -ENOSPC)
+                return trans;
+
+        trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans))
+                return trans;
+
+        num_bytes = btrfs_calc_trans_metadata_size(root, num_items);
+        ret = btrfs_cond_migrate_bytes(root->fs_info,
+                                       &root->fs_info->trans_block_rsv,
+                                       num_bytes,
+                                       min_factor);
+        if (ret) {
+                btrfs_end_transaction(trans, root);
+                return ERR_PTR(ret);
+        }
+
+        trans->block_rsv = &root->fs_info->trans_block_rsv;
+        trans->bytes_reserved = num_bytes;
+
+        return trans;
+}
 
 struct btrfs_trans_handle *btrfs_start_transaction_lflush(
                                         struct btrfs_root *root,
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index b05b2f64d913..0da21ca9b3fb 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -185,6 +185,10 @@ int btrfs_end_transaction(struct btrfs_trans_handle *trans,
                           struct btrfs_root *root);
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
                                                    unsigned int num_items);
+struct btrfs_trans_handle *btrfs_start_transaction_fallback_global_rsv(
+                                        struct btrfs_root *root,
+                                        unsigned int num_items,
+                                        int min_factor);
 struct btrfs_trans_handle *btrfs_start_transaction_lflush(
                                         struct btrfs_root *root,
                                         unsigned int num_items);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a6df8fdc1312..456452206609 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1973,8 +1973,7 @@ void btrfs_rm_dev_replace_remove_srcdev(struct btrfs_fs_info *fs_info,
         if (srcdev->writeable) {
                 fs_devices->rw_devices--;
                 /* zero out the old super if it is writable */
-                btrfs_scratch_superblocks(srcdev->bdev,
-                                        rcu_str_deref(srcdev->name));
+                btrfs_scratch_superblocks(srcdev->bdev, srcdev->name->str);
         }
 
         if (srcdev->bdev)
@@ -2024,8 +2023,7 @@ void btrfs_destroy_dev_replace_tgtdev(struct btrfs_fs_info *fs_info,
         btrfs_sysfs_rm_device_link(fs_info->fs_devices, tgtdev);
 
         if (tgtdev->bdev) {
-                btrfs_scratch_superblocks(tgtdev->bdev,
-                                        rcu_str_deref(tgtdev->name));
+                btrfs_scratch_superblocks(tgtdev->bdev, tgtdev->name->str);
                 fs_info->fs_devices->open_devices--;
         }
         fs_info->fs_devices->num_devices--;
@@ -2853,7 +2851,8 @@ static int btrfs_relocate_chunk(struct btrfs_root *root, u64 chunk_offset)
         if (ret)
                 return ret;
 
-        trans = btrfs_start_transaction(root, 0);
+        trans = btrfs_start_trans_remove_block_group(root->fs_info,
+                                                     chunk_offset);
         if (IS_ERR(trans)) {
                 ret = PTR_ERR(trans);
                 btrfs_std_error(root->fs_info, ret, NULL);
@@ -3123,7 +3122,7 @@ static int chunk_profiles_filter(u64 chunk_type,
         return 1;
 }
 
-static int chunk_usage_filter(struct btrfs_fs_info *fs_info, u64 chunk_offset,
+static int chunk_usage_range_filter(struct btrfs_fs_info *fs_info, u64 chunk_offset,
                               struct btrfs_balance_args *bargs)
 {
         struct btrfs_block_group_cache *cache;
@@ -3156,7 +3155,7 @@ static int chunk_usage_filter(struct btrfs_fs_info *fs_info, u64 chunk_offset,
         return ret;
 }
 
-static int chunk_usage_range_filter(struct btrfs_fs_info *fs_info,
+static int chunk_usage_filter(struct btrfs_fs_info *fs_info,
                 u64 chunk_offset, struct btrfs_balance_args *bargs)
 {
         struct btrfs_block_group_cache *cache;
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index ec5712372732..d5c84f6b1353 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -382,7 +382,7 @@ struct map_lookup {
 #define BTRFS_BALANCE_ARGS_LIMIT        (1ULL << 5)
 #define BTRFS_BALANCE_ARGS_LIMIT_RANGE  (1ULL << 6)
 #define BTRFS_BALANCE_ARGS_STRIPES_RANGE (1ULL << 7)
-#define BTRFS_BALANCE_ARGS_USAGE_RANGE  (1ULL << 8)
+#define BTRFS_BALANCE_ARGS_USAGE_RANGE  (1ULL << 10)
 
 #define BTRFS_BALANCE_ARGS_MASK                 \
         (BTRFS_BALANCE_ARGS_PROFILES |          \
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 7a6b02f72787..c0f3da3926a0 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -879,7 +879,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         loff_t pos, eof;
         size_t len;
         void *data;
-        int ret;
+        int ret = -ENOBUFS;
 
         ASSERT(op != NULL);
         ASSERT(page != NULL);
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index c81ce7f200a6..a7a1b218f308 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1636,6 +1636,116 @@ const struct file_operations configfs_dir_operations = {
         .iterate        = configfs_readdir,
 };
 
+/**
+ * configfs_register_group - creates a parent-child relation between two groups
+ * @parent_group:       parent group
+ * @group:              child group
+ *
+ * link groups, creates dentry for the child and attaches it to the
+ * parent dentry.
+ *
+ * Return: 0 on success, negative errno code on error
+ */
+int configfs_register_group(struct config_group *parent_group,
+                            struct config_group *group)
+{
+        struct configfs_subsystem *subsys = parent_group->cg_subsys;
+        struct dentry *parent;
+        int ret;
+
+        mutex_lock(&subsys->su_mutex);
+        link_group(parent_group, group);
+        mutex_unlock(&subsys->su_mutex);
+
+        parent = parent_group->cg_item.ci_dentry;
+
+        mutex_lock_nested(&d_inode(parent)->i_mutex, I_MUTEX_PARENT);
+        ret = create_default_group(parent_group, group);
+        if (!ret) {
+                spin_lock(&configfs_dirent_lock);
+                configfs_dir_set_ready(group->cg_item.ci_dentry->d_fsdata);
+                spin_unlock(&configfs_dirent_lock);
+        }
+        mutex_unlock(&d_inode(parent)->i_mutex);
+        return ret;
+}
+EXPORT_SYMBOL(configfs_register_group);
+
+/**
+ * configfs_unregister_group() - unregisters a child group from its parent
+ * @group: parent group to be unregistered
+ *
+ * Undoes configfs_register_group()
+ */
+void configfs_unregister_group(struct config_group *group)
+{
+        struct configfs_subsystem *subsys = group->cg_subsys;
+        struct dentry *dentry = group->cg_item.ci_dentry;
+        struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
+
+        mutex_lock_nested(&d_inode(parent)->i_mutex, I_MUTEX_PARENT);
+        spin_lock(&configfs_dirent_lock);
+        configfs_detach_prep(dentry, NULL);
+        spin_unlock(&configfs_dirent_lock);
+
+        configfs_detach_group(&group->cg_item);
+        d_inode(dentry)->i_flags |= S_DEAD;
+        dont_mount(dentry);
+        d_delete(dentry);
+        mutex_unlock(&d_inode(parent)->i_mutex);
+
+        dput(dentry);
+
+        mutex_lock(&subsys->su_mutex);
+        unlink_group(group);
+        mutex_unlock(&subsys->su_mutex);
+}
+EXPORT_SYMBOL(configfs_unregister_group);
+
+/**
+ * configfs_register_default_group() - allocates and registers a child group
+ * @parent_group:       parent group
+ * @name:               child group name
+ * @item_type:          child item type description
+ *
+ * boilerplate to allocate and register a child group with its parent. We need
+ * kzalloc'ed memory because child's default_group is initially empty.
+ *
+ * Return: allocated config group or ERR_PTR() on error
+ */
+struct config_group *
+configfs_register_default_group(struct config_group *parent_group,
+                                const char *name,
+                                struct config_item_type *item_type)
+{
+        int ret;
+        struct config_group *group;
+
+        group = kzalloc(sizeof(*group), GFP_KERNEL);
+        if (!group)
+                return ERR_PTR(-ENOMEM);
+        config_group_init_type_name(group, name, item_type);
+
+        ret = configfs_register_group(parent_group, group);
+        if (ret) {
+                kfree(group);
+                return ERR_PTR(ret);
+        }
+        return group;
+}
+EXPORT_SYMBOL(configfs_register_default_group);
+
+/**
+ * configfs_unregister_default_group() - unregisters and frees a child group
+ * @group:      the group to act on
+ */
+void configfs_unregister_default_group(struct config_group *group)
+{
+        configfs_unregister_group(group);
+        kfree(group);
+}
+EXPORT_SYMBOL(configfs_unregister_default_group);
+
 int configfs_register_subsystem(struct configfs_subsystem *subsys)
 {
         int err;
diff --git a/fs/dax.c b/fs/dax.c
index d1e5cb7311a1..43671b68220e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -541,6 +541,10 @@ int __dax_pmd_fault(struct vm_area_struct *vma, unsigned long address,
         unsigned long pfn;
         int result = 0;
 
+        /* dax pmd mappings are broken wrt gup and fork */
+        if (!IS_ENABLED(CONFIG_FS_DAX_PMD))
+                return VM_FAULT_FALLBACK;
+
         /* Fall back to PTEs if we're going to COW */
         if (write && !(vma->vm_flags & VM_SHARED))
                 return VM_FAULT_FALLBACK;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 3a71cea68420..748d35afc902 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -569,6 +569,8 @@ static int parse_options(char *options, struct super_block *sb)
                         /* Fall through */
                 case Opt_dax:
 #ifdef CONFIG_FS_DAX
+                        ext2_msg(sb, KERN_WARNING,
+                "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
                         set_opt(sbi->s_mount_opt, DAX);
 #else
                         ext2_msg(sb, KERN_INFO, "dax option not supported");
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 753f4e68b820..c9ab67da6e5a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1664,8 +1664,12 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
                 }
                 sbi->s_jquota_fmt = m->mount_opt;
 #endif
-#ifndef CONFIG_FS_DAX
         } else if (token == Opt_dax) {
+#ifdef CONFIG_FS_DAX
+                ext4_msg(sb, KERN_WARNING,
+                "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
+                        sbi->s_mount_opt |= m->mount_opt;
+#else
                 ext4_msg(sb, KERN_INFO, "dax option not supported");
                 return -1;
 #endif
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 4afc4d9d2e41..8b2127ffb226 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -610,9 +610,9 @@ parse_record:
                 int status = fat_parse_long(inode, &cpos, &bh, &de,
                                             &unicode, &nr_slots);
                 if (status < 0) {
-                        ctx->pos = cpos;
+                        bh = NULL;
                         ret = status;
-                        goto out;
+                        goto end_of_dir;
                 } else if (status == PARSE_INVALID)
                         goto record_end;
                 else if (status == PARSE_NOT_LONGNAME)
@@ -654,8 +654,9 @@ parse_record:
         fill_len = short_len;
 
 start_filldir:
-        if (!fake_offset)
-                ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+        ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+        if (fake_offset && ctx->pos < 2)
+                ctx->pos = 2;
 
         if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) {
                 if (!dir_emit_dot(file, ctx))
@@ -681,14 +682,19 @@ record_end:
         fake_offset = 0;
         ctx->pos = cpos;
         goto get_new;
+
 end_of_dir:
-        ctx->pos = cpos;
+        if (fake_offset && cpos < 2)
+                ctx->pos = 2;
+        else
+                ctx->pos = cpos;
 fill_failed:
         brelse(bh);
         if (unicode)
                 __putname(unicode);
 out:
         mutex_unlock(&sbi->s_lock);
+
         return ret;
 }
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 316adb968b65..de4bdfac0cec 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -332,12 +332,17 @@ static void remove_huge_page(struct page *page)
  * truncation is indicated by end of range being LLONG_MAX
  *      In this case, we first scan the range and release found pages.
  *      After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
- *      maps and global counts.
+ *      maps and global counts.  Page faults can not race with truncation
+ *      in this routine.  hugetlb_no_page() prevents page faults in the
+ *      truncated range.  It checks i_size before allocation, and again after
+ *      with the page table lock for the page held.  The same lock must be
+ *      acquired to unmap a page.
  * hole punch is indicated if end is not LLONG_MAX
  *      In the hole punch case we scan the range and release found pages.
  *      Only when releasing a page is the associated region/reserv map
  *      deleted.  The region/reserv map for ranges without associated
- *      pages are not modified.
+ *      pages are not modified.  Page faults can race with hole punch.
+ *      This is indicated if we find a mapped page.
  * Note: If the passed end of range value is beyond the end of file, but
  * not LLONG_MAX this routine still performs a hole punch operation.
  */
@@ -361,46 +366,37 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
         next = start;
         while (next < end) {
                 /*
-                 * Make sure to never grab more pages that we
-                 * might possibly need.
+                 * Don't grab more pages than the number left in the range.
                  */
                 if (end - next < lookup_nr)
                         lookup_nr = end - next;
 
                 /*
-                 * This pagevec_lookup() may return pages past 'end',
-                 * so we must check for page->index > end.
+                 * When no more pages are found, we are done.
                  */
-                if (!pagevec_lookup(&pvec, mapping, next, lookup_nr)) {
-                        if (next == start)
-                                break;
-                        next = start;
-                        continue;
-                }
+                if (!pagevec_lookup(&pvec, mapping, next, lookup_nr))
+                        break;
 
                 for (i = 0; i < pagevec_count(&pvec); ++i) {
                         struct page *page = pvec.pages[i];
                         u32 hash;
 
+                        /*
+                         * The page (index) could be beyond end.  This is
+                         * only possible in the punch hole case as end is
+                         * max page offset in the truncate case.
+                         */
+                        next = page->index;
+                        if (next >= end)
+                                break;
+
                         hash = hugetlb_fault_mutex_hash(h, current->mm,
                                                         &pseudo_vma,
                                                         mapping, next, 0);
                         mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
                         lock_page(page);
-                        if (page->index >= end) {
-                                unlock_page(page);
-                                mutex_unlock(&hugetlb_fault_mutex_table[hash]);
-                                next = end;     /* we are done */
-                                break;
-                        }
-
-                        /*
-                         * If page is mapped, it was faulted in after being
-                         * unmapped.  Do nothing in this race case.  In the
-                         * normal case page is not mapped.
-                         */
-                        if (!page_mapped(page)) {
+                        if (likely(!page_mapped(page))) {
                                 bool rsv_on_error = !PagePrivate(page);
                                 /*
                                  * We must free the huge page and remove
@@ -421,17 +417,23 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
                                                 hugetlb_fix_reserve_counts(
                                                         inode, rsv_on_error);
                                 }
+                        } else {
+                                /*
+                                 * If page is mapped, it was faulted in after
+                                 * being unmapped.  It indicates a race between
+                                 * hole punch and page fault.  Do nothing in
+                                 * this case.  Getting here in a truncate
+                                 * operation is a bug.
+                                 */
+                                BUG_ON(truncate_op);
                         }
 
-                        if (page->index > next)
-                                next = page->index;
-
-                        ++next;
                         unlock_page(page);
-
                         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
                 }
+                ++next;
                 huge_pagevec_release(&pvec);
+                cond_resched();
         }
 
         if (truncate_op)
@@ -647,9 +649,6 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
         if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
                 i_size_write(inode, offset + len);
         inode->i_ctime = CURRENT_TIME;
-        spin_lock(&inode->i_lock);
-        inode->i_private = NULL;
-        spin_unlock(&inode->i_lock);
 out:
         mutex_unlock(&inode->i_mutex);
         return error;
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index 79b113048eac..0a3f9b594602 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -525,6 +525,8 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg
                         switch (rqdata.cmd) {
                                 case NCP_LOCK_EX:
                                 case NCP_LOCK_SH:
+                                                if (rqdata.timeout < 0)
+                                                        return -EINVAL;
                                                 if (rqdata.timeout == 0)
                                                         rqdata.timeout = NCP_LOCK_DEFAULT_TIMEOUT;
                                                 else if (rqdata.timeout > NCP_LOCK_MAX_TIMEOUT)
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 646cdac73488..beac58b0e09c 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -78,7 +78,8 @@ static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
 
         p = xdr_inline_decode(xdr, nbytes);
         if (unlikely(p == NULL))
-                printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed!\n");
+                printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed "
+                                                        "or truncated request.\n");
         return p;
 }
 
@@ -889,6 +890,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
         struct cb_compound_hdr_arg hdr_arg = { 0 };
         struct cb_compound_hdr_res hdr_res = { NULL };
         struct xdr_stream xdr_in, xdr_out;
+        struct xdr_buf *rq_arg = &rqstp->rq_arg;
         __be32 *p, status;
         struct cb_process_state cps = {
                 .drc_status = 0,
@@ -900,7 +902,8 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 
         dprintk("%s: start\n", __func__);
 
-        xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
+        rq_arg->len = rq_arg->head[0].iov_len + rq_arg->page_len;
+        xdr_init_decode(&xdr_in, rq_arg, rq_arg->head[0].iov_base);
 
         p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
         xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 326d9e10d833..31b0a52223a7 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -618,7 +618,10 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr,
                 nfs_inc_stats(inode, NFSIOS_SETATTRTRUNC);
                 nfs_vmtruncate(inode, attr->ia_size);
         }
-        nfs_update_inode(inode, fattr);
+        if (fattr->valid)
+                nfs_update_inode(inode, fattr);
+        else
+                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATTR;
         spin_unlock(&inode->i_lock);
 }
 EXPORT_SYMBOL_GPL(nfs_setattr_update_inode);
@@ -1824,7 +1827,11 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0)
                         nfsi->attr_gencount = fattr->gencount;
         }
-        invalid &= ~NFS_INO_INVALID_ATTR;
+
+        /* Don't declare attrcache up to date if there were no attrs! */
+        if (fattr->valid != 0)
+                invalid &= ~NFS_INO_INVALID_ATTR;
+
         /* Don't invalidate the data if we were to blame */
         if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
                                 || S_ISLNK(inode->i_mode)))
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 3e92a3cde15d..6b1ce9825430 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -14,7 +14,7 @@
 #include "pnfs.h"
 #include "internal.h"
 
-#define NFSDBG_FACILITY NFSDBG_PNFS
+#define NFSDBG_FACILITY NFSDBG_PROC
 
 static int nfs42_set_rw_stateid(nfs4_stateid *dst, struct file *file,
                                 fmode_t fmode)
@@ -284,6 +284,7 @@ static int _nfs42_proc_clone(struct rpc_message *msg, struct file *src_f,
                 .dst_fh = NFS_FH(dst_inode),
                 .src_offset = src_offset,
                 .dst_offset = dst_offset,
+                .count = count,
                 .dst_bitmask = server->cache_consistency_bitmask,
         };
         struct nfs42_clone_res res = {
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 223bedda64ae..10410e8b5853 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -33,7 +33,7 @@ static int nfs_get_cb_ident_idr(struct nfs_client *clp, int minorversion)
                 return ret;
         idr_preload(GFP_KERNEL);
         spin_lock(&nn->nfs_client_lock);
-        ret = idr_alloc(&nn->cb_ident_idr, clp, 0, 0, GFP_NOWAIT);
+        ret = idr_alloc(&nn->cb_ident_idr, clp, 1, 0, GFP_NOWAIT);
         if (ret >= 0)
                 clp->cl_cb_ident = ret;
         spin_unlock(&nn->nfs_client_lock);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 4aa571956cd6..db9b5fea5b3e 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -7,6 +7,7 @@
 #include <linux/file.h>
 #include <linux/falloc.h>
 #include <linux/nfs_fs.h>
+#include <uapi/linux/btrfs.h>   /* BTRFS_IOC_CLONE/BTRFS_IOC_CLONE_RANGE */
 #include "delegation.h"
 #include "internal.h"
 #include "iostat.h"
@@ -203,6 +204,7 @@ nfs42_ioctl_clone(struct file *dst_file, unsigned long srcfd,
         struct fd src_file;
         struct inode *src_inode;
         unsigned int bs = server->clone_blksize;
+        bool same_inode = false;
         int ret;
 
         /* dst file must be opened for writing */
@@ -221,10 +223,8 @@ nfs42_ioctl_clone(struct file *dst_file, unsigned long srcfd,
 
         src_inode = file_inode(src_file.file);
 
-        /* src and dst must be different files */
-        ret = -EINVAL;
         if (src_inode == dst_inode)
-                goto out_fput;
+                same_inode = true;
 
         /* src file must be opened for reading */
         if (!(src_file.file->f_mode & FMODE_READ))
@@ -249,8 +249,16 @@ nfs42_ioctl_clone(struct file *dst_file, unsigned long srcfd,
                         goto out_fput;
         }
 
+        /* verify if ranges are overlapped within the same file */
+        if (same_inode) {
+                if (dst_off + count > src_off && dst_off < src_off + count)
+                        goto out_fput;
+        }
+
         /* XXX: do we lock at all? what if server needs CB_RECALL_LAYOUT? */
-        if (dst_inode < src_inode) {
+        if (same_inode) {
+                mutex_lock(&src_inode->i_mutex);
+        } else if (dst_inode < src_inode) {
                 mutex_lock_nested(&dst_inode->i_mutex, I_MUTEX_PARENT);
                 mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD);
         } else {
@@ -275,7 +283,9 @@ nfs42_ioctl_clone(struct file *dst_file, unsigned long srcfd,
                 truncate_inode_pages_range(&dst_inode->i_data, dst_off, dst_off + count - 1);
 
 out_unlock:
-        if (dst_inode < src_inode) {
+        if (same_inode) {
+                mutex_unlock(&src_inode->i_mutex);
+        } else if (dst_inode < src_inode) {
                 mutex_unlock(&src_inode->i_mutex);
                 mutex_unlock(&dst_inode->i_mutex);
         } else {
@@ -291,46 +301,31 @@ out_drop_write:
 
 static long nfs42_ioctl_clone_range(struct file *dst_file, void __user *argp)
 {
-        struct nfs_ioctl_clone_range_args args;
+        struct btrfs_ioctl_clone_range_args args;
 
         if (copy_from_user(&args, argp, sizeof(args)))
                 return -EFAULT;
 
-        return nfs42_ioctl_clone(dst_file, args.src_fd, args.src_off, args.dst_off, args.count);
-}
-#else
-static long nfs42_ioctl_clone(struct file *dst_file, unsigned long srcfd,
-                u64 src_off, u64 dst_off, u64 count)
-{
-        return -ENOTTY;
-}
-
-static long nfs42_ioctl_clone_range(struct file *dst_file, void __user *argp)
-{
-        return -ENOTTY;
+        return nfs42_ioctl_clone(dst_file, args.src_fd, args.src_offset,
+                                 args.dest_offset, args.src_length);
 }
-#endif /* CONFIG_NFS_V4_2 */
 
 long nfs4_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         void __user *argp = (void __user *)arg;
 
         switch (cmd) {
-        case NFS_IOC_CLONE:
+        case BTRFS_IOC_CLONE:
                 return nfs42_ioctl_clone(file, arg, 0, 0, 0);
-        case NFS_IOC_CLONE_RANGE:
+        case BTRFS_IOC_CLONE_RANGE:
                 return nfs42_ioctl_clone_range(file, argp);
         }
 
         return -ENOTTY;
 }
+#endif /* CONFIG_NFS_V4_2 */
 
 const struct file_operations nfs4_file_operations = {
-#ifdef CONFIG_NFS_V4_2
-        .llseek         = nfs4_file_llseek,
-#else
-        .llseek         = nfs_file_llseek,
-#endif
         .read_iter      = nfs_file_read,
         .write_iter     = nfs_file_write,
         .mmap           = nfs_file_mmap,
@@ -342,14 +337,14 @@ const struct file_operations nfs4_file_operations = {
         .flock          = nfs_flock,
         .splice_read    = nfs_file_splice_read,
         .splice_write   = iter_file_splice_write,
-#ifdef CONFIG_NFS_V4_2
-        .fallocate      = nfs42_fallocate,
-#endif /* CONFIG_NFS_V4_2 */
         .check_flags    = nfs_check_flags,
         .setlease       = simple_nosetlease,
-#ifdef CONFIG_COMPAT
+#ifdef CONFIG_NFS_V4_2
+        .llseek         = nfs4_file_llseek,
+        .fallocate      = nfs42_fallocate,
         .unlocked_ioctl = nfs4_ioctl,
-#else
         .compat_ioctl   = nfs4_ioctl,
-#endif /* CONFIG_COMPAT */
+#else
+        .llseek         = nfs_file_llseek,
+#endif
 };
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 765a03559363..89818036f035 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7866,7 +7866,7 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
                         spin_unlock(&inode->i_lock);
                 goto out_restart;
         }
-        if (nfs4_async_handle_error(task, server, state, NULL) == -EAGAIN)
+        if (nfs4_async_handle_error(task, server, state, &lgp->timeout) == -EAGAIN)
                 goto out_restart;
 out:
         dprintk("<-- %s\n", __func__);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index dfed4f5c8fcc..4e4441216804 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3615,6 +3615,7 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
         status = 0;
         if (unlikely(!(bitmap[0] & FATTR4_WORD0_FS_LOCATIONS)))
                 goto out;
+        bitmap[0] &= ~FATTR4_WORD0_FS_LOCATIONS;
         status = -EIO;
         /* Ignore borken servers that return unrequested attrs */
         if (unlikely(res == NULL))
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 93496c059837..5a8ae2125b50 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -872,33 +872,38 @@ send_layoutget(struct pnfs_layout_hdr *lo,
 
         dprintk("--> %s\n", __func__);
 
-        lgp = kzalloc(sizeof(*lgp), gfp_flags);
-        if (lgp == NULL)
-                return NULL;
+        /*
+         * Synchronously retrieve layout information from server and
+         * store in lseg. If we race with a concurrent seqid morphing
+         * op, then re-send the LAYOUTGET.
+         */
+        do {
+                lgp = kzalloc(sizeof(*lgp), gfp_flags);
+                if (lgp == NULL)
+                        return NULL;
+
+                i_size = i_size_read(ino);
+
+                lgp->args.minlength = PAGE_CACHE_SIZE;
+                if (lgp->args.minlength > range->length)
+                        lgp->args.minlength = range->length;
+                if (range->iomode == IOMODE_READ) {
+                        if (range->offset >= i_size)
+                                lgp->args.minlength = 0;
+                        else if (i_size - range->offset < lgp->args.minlength)
+                                lgp->args.minlength = i_size - range->offset;
+                }
+                lgp->args.maxcount = PNFS_LAYOUT_MAXSIZE;
+                lgp->args.range = *range;
+                lgp->args.type = server->pnfs_curr_ld->id;
+                lgp->args.inode = ino;
+                lgp->args.ctx = get_nfs_open_context(ctx);
+                lgp->gfp_flags = gfp_flags;
+                lgp->cred = lo->plh_lc_cred;
 
-        i_size = i_size_read(ino);
+                lseg = nfs4_proc_layoutget(lgp, gfp_flags);
+        } while (lseg == ERR_PTR(-EAGAIN));
 
-        lgp->args.minlength = PAGE_CACHE_SIZE;
-        if (lgp->args.minlength > range->length)
-                lgp->args.minlength = range->length;
-        if (range->iomode == IOMODE_READ) {
-                if (range->offset >= i_size)
-                        lgp->args.minlength = 0;
-                else if (i_size - range->offset < lgp->args.minlength)
-                        lgp->args.minlength = i_size - range->offset;
-        }
-        lgp->args.maxcount = PNFS_LAYOUT_MAXSIZE;
-        lgp->args.range = *range;
-        lgp->args.type = server->pnfs_curr_ld->id;
-        lgp->args.inode = ino;
-        lgp->args.ctx = get_nfs_open_context(ctx);
-        lgp->gfp_flags = gfp_flags;
-        lgp->cred = lo->plh_lc_cred;
-
-        /* Synchronously retrieve layout information from server and
-         * store in lseg.
-         */
-        lseg = nfs4_proc_layoutget(lgp, gfp_flags);
         if (IS_ERR(lseg)) {
                 switch (PTR_ERR(lseg)) {
                 case -ENOMEM:
@@ -1687,6 +1692,7 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
                 /* existing state ID, make sure the sequence number matches. */
                 if (pnfs_layout_stateid_blocked(lo, &res->stateid)) {
                         dprintk("%s forget reply due to sequence\n", __func__);
+                        status = -EAGAIN;
                         goto out_forget_reply;
                 }
                 pnfs_set_layout_stateid(lo, &res->stateid, false);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 3b48ac25d8a7..a03f6f433075 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -372,6 +372,8 @@ static int ocfs2_mknod(struct inode *dir,
                 mlog_errno(status);
                 goto leave;
         }
+        /* update inode->i_mode after mask with "umask". */
+        inode->i_mode = mode;
 
         handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
                                                             S_ISDIR(mode),
diff --git a/fs/splice.c b/fs/splice.c
index 801c21cd77fe..4cf700d50b40 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -809,6 +809,13 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
  */
 static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
 {
+        /*
+         * Check for signal early to make process killable when there are
+         * always buffers available
+         */
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
         while (!pipe->nrbufs) {
                 if (!pipe->writers)
                         return 0;
@@ -884,6 +891,7 @@ ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
 
         splice_from_pipe_begin(sd);
         do {
+                cond_resched();
                 ret = splice_from_pipe_next(pipe, sd);
                 if (ret > 0)
                         ret = splice_from_pipe_feed(pipe, sd, actor);
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 590ad9206e3f..02fa1dcc5969 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -162,15 +162,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev)
                 inode->i_fop = &sysv_dir_operations;
                 inode->i_mapping->a_ops = &sysv_aops;
         } else if (S_ISLNK(inode->i_mode)) {
-                if (inode->i_blocks) {
-                        inode->i_op = &sysv_symlink_inode_operations;
-                        inode->i_mapping->a_ops = &sysv_aops;
-                } else {
-                        inode->i_op = &simple_symlink_inode_operations;
-                        inode->i_link = (char *)SYSV_I(inode)->i_data;
-                        nd_terminate_link(inode->i_link, inode->i_size,
-                                sizeof(SYSV_I(inode)->i_data) - 1);
-                }
+                inode->i_op = &sysv_symlink_inode_operations;
+                inode->i_mapping->a_ops = &sysv_aops;
         } else
                 init_special_inode(inode, inode->i_mode, rdev);
 }
diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
index e67aeac2aee0..4b74c97d297a 100644
--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -136,6 +136,9 @@ drm_atomic_connectors_for_crtc(struct drm_atomic_state *state,
 
 void drm_atomic_legacy_backoff(struct drm_atomic_state *state);
 
+void
+drm_atomic_clean_old_fb(struct drm_device *dev, unsigned plane_mask, int ret);
+
 int __must_check drm_atomic_check_only(struct drm_atomic_state *state);
 int __must_check drm_atomic_commit(struct drm_atomic_state *state);
 int __must_check drm_atomic_async_commit(struct drm_atomic_state *state);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 9c747cb14ad8..d2f41477f8ae 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -342,10 +342,10 @@ int kvm_vgic_inject_mapped_irq(struct kvm *kvm, int cpuid,
                                struct irq_phys_map *map, bool level);
 void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg);
 int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu);
-int kvm_vgic_vcpu_active_irq(struct kvm_vcpu *vcpu);
 struct irq_phys_map *kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu,
                                            int virt_irq, int irq);
 int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, struct irq_phys_map *map);
+bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, struct irq_phys_map *map);
 
 #define irqchip_in_kernel(k)    (!!((k)->arch.vgic.in_kernel))
 #define vgic_initialized(k)     (!!((k)->arch.vgic.nr_cpus))
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 3fe27f8d91f0..c0d2b7927c1f 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -794,6 +794,8 @@ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
 extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
                          struct scsi_ioctl_command __user *);
 
+extern int blk_queue_enter(struct request_queue *q, gfp_t gfp);
+extern void blk_queue_exit(struct request_queue *q);
 extern void blk_start_queue(struct request_queue *q);
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index a8a335b7fce0..758a029011b1 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -197,6 +197,16 @@ static inline struct configfs_subsystem *to_configfs_subsystem(struct config_gro
 int configfs_register_subsystem(struct configfs_subsystem *subsys);
 void configfs_unregister_subsystem(struct configfs_subsystem *subsys);
 
+int configfs_register_group(struct config_group *parent_group,
+                            struct config_group *group);
+void configfs_unregister_group(struct config_group *group);
+
+struct config_group *
+configfs_register_default_group(struct config_group *parent_group,
+                                const char *name,
+                                struct config_item_type *item_type);
+void configfs_unregister_default_group(struct config_group *group);
+
 /* These functions can sleep and can alloc with GFP_KERNEL */
 /* WARNING: These cannot be called underneath configfs callbacks!! */
 int configfs_depend_item(struct configfs_subsystem *subsys, struct config_item *target);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 6523109e136d..8942af0813e3 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -271,7 +271,7 @@ static inline int gfpflags_to_migratetype(const gfp_t gfp_flags)
 
 static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
 {
-        return gfp_flags & __GFP_DIRECT_RECLAIM;
+        return (bool __force)(gfp_flags & __GFP_DIRECT_RECLAIM);
 }
 
 #ifdef CONFIG_HIGHMEM
diff --git a/include/linux/kref.h b/include/linux/kref.h
index 484604d184be..e15828fd71f1 100644
--- a/include/linux/kref.h
+++ b/include/linux/kref.h
@@ -19,7 +19,6 @@
 #include <linux/atomic.h>
 #include <linux/kernel.h>
 #include <linux/mutex.h>
-#include <linux/spinlock.h>
 
 struct kref {
         atomic_t refcount;
@@ -99,38 +98,6 @@ static inline int kref_put(struct kref *kref, void (*release)(struct kref *kref)
         return kref_sub(kref, 1, release);
 }
 
-/**
- * kref_put_spinlock_irqsave - decrement refcount for object.
- * @kref: object.
- * @release: pointer to the function that will clean up the object when the
- *           last reference to the object is released.
- *           This pointer is required, and it is not acceptable to pass kfree
- *           in as this function.
- * @lock: lock to take in release case
- *
- * Behaves identical to kref_put with one exception.  If the reference count
- * drops to zero, the lock will be taken atomically wrt dropping the reference
- * count.  The release function has to call spin_unlock() without _irqrestore.
- */
-static inline int kref_put_spinlock_irqsave(struct kref *kref,
-                void (*release)(struct kref *kref),
-                spinlock_t *lock)
-{
-        unsigned long flags;
-
-        WARN_ON(release == NULL);
-        if (atomic_add_unless(&kref->refcount, -1, 1))
-                return 0;
-        spin_lock_irqsave(lock, flags);
-        if (atomic_dec_and_test(&kref->refcount)) {
-                release(kref);
-                local_irq_restore(flags);
-                return 1;
-        }
-        spin_unlock_irqrestore(lock, flags);
-        return 0;
-}
-
 static inline int kref_put_mutex(struct kref *kref,
                                  void (*release)(struct kref *kref),
                                  struct mutex *lock)
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 5706a2108f0a..c923350ca20a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -460,6 +460,17 @@ static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
              (vcpup = kvm_get_vcpu(kvm, idx)) != NULL; \
              idx++)
 
+static inline struct kvm_vcpu *kvm_get_vcpu_by_id(struct kvm *kvm, int id)
+{
+        struct kvm_vcpu *vcpu;
+        int i;
+
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                if (vcpu->vcpu_id == id)
+                        return vcpu;
+        return NULL;
+}
+
 #define kvm_for_each_memslot(memslot, slots)    \
         for (memslot = &slots->memslots[0];     \
               memslot < slots->memslots + KVM_MEM_SLOTS_NUM && memslot->npages;\
diff --git a/include/linux/lightnvm.h b/include/linux/lightnvm.h
index 69c9057e1ab8..3db5552b17d5 100644
--- a/include/linux/lightnvm.h
+++ b/include/linux/lightnvm.h
@@ -58,7 +58,6 @@ enum {
 struct nvm_id_group {
         u8      mtype;
         u8      fmtype;
-        u16     res16;
         u8      num_ch;
         u8      num_lun;
         u8      num_pln;
@@ -74,9 +73,9 @@ struct nvm_id_group {
         u32     tbet;
         u32     tbem;
         u32     mpos;
+        u32     mccap;
         u16     cpar;
-        u8      res[913];
-} __packed;
+};
 
 struct nvm_addr_format {
         u8      ch_offset;
@@ -91,19 +90,15 @@ struct nvm_addr_format {
         u8      pg_len;
         u8      sect_offset;
         u8      sect_len;
-        u8      res[4];
 };
 
 struct nvm_id {
         u8      ver_id;
         u8      vmnt;
         u8      cgrps;
-        u8      res[5];
         u32     cap;
         u32     dom;
         struct nvm_addr_format ppaf;
-        u8      ppat;
-        u8      resv[224];
         struct nvm_id_group groups[4];
 } __packed;
 
@@ -123,39 +118,28 @@ struct nvm_tgt_instance {
 #define NVM_VERSION_MINOR 0
 #define NVM_VERSION_PATCH 0
 
-#define NVM_SEC_BITS (8)
-#define NVM_PL_BITS  (6)
-#define NVM_PG_BITS  (16)
 #define NVM_BLK_BITS (16)
-#define NVM_LUN_BITS (10)
+#define NVM_PG_BITS  (16)
+#define NVM_SEC_BITS (8)
+#define NVM_PL_BITS  (8)
+#define NVM_LUN_BITS (8)
 #define NVM_CH_BITS  (8)
 
 struct ppa_addr {
+        /* Generic structure for all addresses */
         union {
-                /* Channel-based PPA format in nand 4x2x2x2x8x10 */
-                struct {
-                        u64 ch          : 4;
-                        u64 sec         : 2; /* 4 sectors per page */
-                        u64 pl          : 2; /* 4 planes per LUN */
-                        u64 lun         : 2; /* 4 LUNs per channel */
-                        u64 pg          : 8; /* 256 pages per block */
-                        u64 blk         : 10;/* 1024 blocks per plane */
-                        u64 resved              : 36;
-                } chnl;
-
-                /* Generic structure for all addresses */
                 struct {
+                        u64 blk         : NVM_BLK_BITS;
+                        u64 pg          : NVM_PG_BITS;
                         u64 sec         : NVM_SEC_BITS;
                         u64 pl          : NVM_PL_BITS;
-                        u64 pg          : NVM_PG_BITS;
-                        u64 blk         : NVM_BLK_BITS;
                         u64 lun         : NVM_LUN_BITS;
                         u64 ch          : NVM_CH_BITS;
                 } g;
 
                 u64 ppa;
         };
-} __packed;
+};
 
 struct nvm_rq {
         struct nvm_tgt_instance *ins;
@@ -191,11 +175,11 @@ static inline void *nvm_rq_to_pdu(struct nvm_rq *rqdata)
 struct nvm_block;
 
 typedef int (nvm_l2p_update_fn)(u64, u32, __le64 *, void *);
-typedef int (nvm_bb_update_fn)(u32, void *, unsigned int, void *);
+typedef int (nvm_bb_update_fn)(struct ppa_addr, int, u8 *, void *);
 typedef int (nvm_id_fn)(struct request_queue *, struct nvm_id *);
 typedef int (nvm_get_l2p_tbl_fn)(struct request_queue *, u64, u32,
                                 nvm_l2p_update_fn *, void *);
-typedef int (nvm_op_bb_tbl_fn)(struct request_queue *, int, unsigned int,
+typedef int (nvm_op_bb_tbl_fn)(struct request_queue *, struct ppa_addr, int,
                                 nvm_bb_update_fn *, void *);
 typedef int (nvm_op_set_bb_fn)(struct request_queue *, struct nvm_rq *, int);
 typedef int (nvm_submit_io_fn)(struct request_queue *, struct nvm_rq *);
@@ -210,7 +194,7 @@ struct nvm_dev_ops {
         nvm_id_fn               *identity;
         nvm_get_l2p_tbl_fn      *get_l2p_tbl;
         nvm_op_bb_tbl_fn        *get_bb_tbl;
-        nvm_op_set_bb_fn        *set_bb;
+        nvm_op_set_bb_fn        *set_bb_tbl;
 
         nvm_submit_io_fn        *submit_io;
         nvm_erase_blk_fn        *erase_block;
@@ -220,7 +204,7 @@ struct nvm_dev_ops {
         nvm_dev_dma_alloc_fn    *dev_dma_alloc;
         nvm_dev_dma_free_fn     *dev_dma_free;
 
-        uint8_t                 max_phys_sect;
+        unsigned int            max_phys_sect;
 };
 
 struct nvm_lun {
@@ -229,7 +213,9 @@ struct nvm_lun {
         int lun_id;
         int chnl_id;
 
+        unsigned int nr_inuse_blocks;   /* Number of used blocks */
         unsigned int nr_free_blocks;    /* Number of unused blocks */
+        unsigned int nr_bad_blocks;     /* Number of bad blocks */
         struct nvm_block *blocks;
 
         spinlock_t lock;
@@ -263,8 +249,7 @@ struct nvm_dev {
         int blks_per_lun;
         int sec_size;
         int oob_size;
-        int addr_mode;
-        struct nvm_addr_format addr_format;
+        struct nvm_addr_format ppaf;
 
         /* Calculated/Cached values. These do not reflect the actual usable
          * blocks at run-time.
@@ -290,118 +275,45 @@ struct nvm_dev {
         char name[DISK_NAME_LEN];
 };
 
-/* fallback conversion */
-static struct ppa_addr __generic_to_linear_addr(struct nvm_dev *dev,
-                                                        struct ppa_addr r)
-{
-        struct ppa_addr l;
-
-        l.ppa = r.g.sec +
-                r.g.pg  * dev->sec_per_pg +
-                r.g.blk * (dev->pgs_per_blk *
-                                dev->sec_per_pg) +
-                r.g.lun * (dev->blks_per_lun *
-                                dev->pgs_per_blk *
-                                dev->sec_per_pg) +
-                r.g.ch * (dev->blks_per_lun *
-                                dev->pgs_per_blk *
-                                dev->luns_per_chnl *
-                                dev->sec_per_pg);
-
-        return l;
-}
-
-/* fallback conversion */
-static struct ppa_addr __linear_to_generic_addr(struct nvm_dev *dev,
-                                                        struct ppa_addr r)
+static inline struct ppa_addr generic_to_dev_addr(struct nvm_dev *dev,
+                                                struct ppa_addr r)
 {
         struct ppa_addr l;
-        int secs, pgs, blks, luns;
-        sector_t ppa = r.ppa;
 
-        l.ppa = 0;
-
-        div_u64_rem(ppa, dev->sec_per_pg, &secs);
-        l.g.sec = secs;
-
-        sector_div(ppa, dev->sec_per_pg);
-        div_u64_rem(ppa, dev->sec_per_blk, &pgs);
-        l.g.pg = pgs;
-
-        sector_div(ppa, dev->pgs_per_blk);
-        div_u64_rem(ppa, dev->blks_per_lun, &blks);
-        l.g.blk = blks;
-
-        sector_div(ppa, dev->blks_per_lun);
-        div_u64_rem(ppa, dev->luns_per_chnl, &luns);
-        l.g.lun = luns;
-
-        sector_div(ppa, dev->luns_per_chnl);
-        l.g.ch = ppa;
+        l.ppa = ((u64)r.g.blk) << dev->ppaf.blk_offset;
+        l.ppa |= ((u64)r.g.pg) << dev->ppaf.pg_offset;
+        l.ppa |= ((u64)r.g.sec) << dev->ppaf.sect_offset;
+        l.ppa |= ((u64)r.g.pl) << dev->ppaf.pln_offset;
+        l.ppa |= ((u64)r.g.lun) << dev->ppaf.lun_offset;
+        l.ppa |= ((u64)r.g.ch) << dev->ppaf.ch_offset;
 
         return l;
 }
 
-static struct ppa_addr __generic_to_chnl_addr(struct ppa_addr r)
+static inline struct ppa_addr dev_to_generic_addr(struct nvm_dev *dev,
+                                                struct ppa_addr r)
 {
         struct ppa_addr l;
 
-        l.ppa = 0;
-
-        l.chnl.sec = r.g.sec;
-        l.chnl.pl = r.g.pl;
-        l.chnl.pg = r.g.pg;
-        l.chnl.blk = r.g.blk;
-        l.chnl.lun = r.g.lun;
-        l.chnl.ch = r.g.ch;
-
-        return l;
-}
-
-static struct ppa_addr __chnl_to_generic_addr(struct ppa_addr r)
-{
-        struct ppa_addr l;
-
-        l.ppa = 0;
-
-        l.g.sec = r.chnl.sec;
-        l.g.pl = r.chnl.pl;
-        l.g.pg = r.chnl.pg;
-        l.g.blk = r.chnl.blk;
-        l.g.lun = r.chnl.lun;
-        l.g.ch = r.chnl.ch;
+        /*
+         * (r.ppa << X offset) & X len bitmask. X eq. blk, pg, etc.
+         */
+        l.g.blk = (r.ppa >> dev->ppaf.blk_offset) &
+                                        (((1 << dev->ppaf.blk_len) - 1));
+        l.g.pg |= (r.ppa >> dev->ppaf.pg_offset) &
+                                        (((1 << dev->ppaf.pg_len) - 1));
+        l.g.sec |= (r.ppa >> dev->ppaf.sect_offset) &
+                                        (((1 << dev->ppaf.sect_len) - 1));
+        l.g.pl |= (r.ppa >> dev->ppaf.pln_offset) &
+                                        (((1 << dev->ppaf.pln_len) - 1));
+        l.g.lun |= (r.ppa >> dev->ppaf.lun_offset) &
+                                        (((1 << dev->ppaf.lun_len) - 1));
+        l.g.ch |= (r.ppa >> dev->ppaf.ch_offset) &
+                                        (((1 << dev->ppaf.ch_len) - 1));
 
         return l;
 }
 
-static inline struct ppa_addr addr_to_generic_mode(struct nvm_dev *dev,
-                                                struct ppa_addr gppa)
-{
-        switch (dev->addr_mode) {
-        case NVM_ADDRMODE_LINEAR:
-                return __linear_to_generic_addr(dev, gppa);
-        case NVM_ADDRMODE_CHANNEL:
-                return __chnl_to_generic_addr(gppa);
-        default:
-                BUG();
-        }
-        return gppa;
-}
-
-static inline struct ppa_addr generic_to_addr_mode(struct nvm_dev *dev,
-                                                struct ppa_addr gppa)
-{
-        switch (dev->addr_mode) {
-        case NVM_ADDRMODE_LINEAR:
-                return __generic_to_linear_addr(dev, gppa);
-        case NVM_ADDRMODE_CHANNEL:
-                return __generic_to_chnl_addr(gppa);
-        default:
-                BUG();
-        }
-        return gppa;
-}
-
 static inline int ppa_empty(struct ppa_addr ppa_addr)
 {
         return (ppa_addr.ppa == ADDR_EMPTY);
@@ -468,7 +380,7 @@ typedef int (nvmm_end_io_fn)(struct nvm_rq *, int);
 typedef int (nvmm_erase_blk_fn)(struct nvm_dev *, struct nvm_block *,
                                                                 unsigned long);
 typedef struct nvm_lun *(nvmm_get_lun_fn)(struct nvm_dev *, int);
-typedef void (nvmm_free_blocks_print_fn)(struct nvm_dev *);
+typedef void (nvmm_lun_info_print_fn)(struct nvm_dev *);
 
 struct nvmm_type {
         const char *name;
@@ -492,7 +404,7 @@ struct nvmm_type {
         nvmm_get_lun_fn *get_lun;
 
         /* Statistics */
-        nvmm_free_blocks_print_fn *free_blocks_print;
+        nvmm_lun_info_print_fn *lun_info_print;
         struct list_head list;
 };
 
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index e6982ac3200d..a57f0dfb6db7 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -16,6 +16,7 @@
 #define MARVELL_PHY_ID_88E1318S         0x01410e90
 #define MARVELL_PHY_ID_88E1116R         0x01410e40
 #define MARVELL_PHY_ID_88E1510          0x01410dd0
+#define MARVELL_PHY_ID_88E1540          0x01410eb0
 #define MARVELL_PHY_ID_88E3016          0x01410e60
 
 /* struct phy_device dev_flags definitions */
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index dd2097455a2e..1565324eb620 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -453,26 +453,28 @@ struct mlx5_ifc_per_protocol_networking_offload_caps_bits {
         u8         lro_cap[0x1];
         u8         lro_psh_flag[0x1];
         u8         lro_time_stamp[0x1];
-        u8         reserved_0[0x6];
+        u8         reserved_0[0x3];
+        u8         self_lb_en_modifiable[0x1];
+        u8         reserved_1[0x2];
         u8         max_lso_cap[0x5];
-        u8         reserved_1[0x4];
+        u8         reserved_2[0x4];
         u8         rss_ind_tbl_cap[0x4];
-        u8         reserved_2[0x3];
+        u8         reserved_3[0x3];
         u8         tunnel_lso_const_out_ip_id[0x1];
-        u8         reserved_3[0x2];
+        u8         reserved_4[0x2];
         u8         tunnel_statless_gre[0x1];
         u8         tunnel_stateless_vxlan[0x1];
 
-        u8         reserved_4[0x20];
+        u8         reserved_5[0x20];
 
-        u8         reserved_5[0x10];
+        u8         reserved_6[0x10];
         u8         lro_min_mss_size[0x10];
 
-        u8         reserved_6[0x120];
+        u8         reserved_7[0x120];
 
         u8         lro_timer_supported_periods[4][0x20];
 
-        u8         reserved_7[0x600];
+        u8         reserved_8[0x600];
 };
 
 struct mlx5_ifc_roce_cap_bits {
@@ -4051,9 +4053,11 @@ struct mlx5_ifc_modify_tis_in_bits {
 };
 
 struct mlx5_ifc_modify_tir_bitmask_bits {
-        u8         reserved[0x20];
+        u8         reserved_0[0x20];
 
-        u8         reserved1[0x1f];
+        u8         reserved_1[0x1b];
+        u8         self_lb_en[0x1];
+        u8         reserved_2[0x3];
         u8         lro[0x1];
 };
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d20891465247..67bfac1abfc1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2068,20 +2068,23 @@ struct pcpu_sw_netstats {
         struct u64_stats_sync   syncp;
 };
 
-#define netdev_alloc_pcpu_stats(type)                           \
-({                                                              \
-        typeof(type) __percpu *pcpu_stats = alloc_percpu(type); \
-        if (pcpu_stats) {                                       \
-                int __cpu;                                      \
-                for_each_possible_cpu(__cpu) {                  \
-                        typeof(type) *stat;                     \
-                        stat = per_cpu_ptr(pcpu_stats, __cpu);  \
-                        u64_stats_init(&stat->syncp);           \
-                }                                               \
-        }                                                       \
-        pcpu_stats;                                             \
+#define __netdev_alloc_pcpu_stats(type, gfp)                            \
+({                                                                      \
+        typeof(type) __percpu *pcpu_stats = alloc_percpu_gfp(type, gfp);\
+        if (pcpu_stats) {                                               \
+                int __cpu;                                              \
+                for_each_possible_cpu(__cpu) {                          \
+                        typeof(type) *stat;                             \
+                        stat = per_cpu_ptr(pcpu_stats, __cpu);          \
+                        u64_stats_init(&stat->syncp);                   \
+                }                                                       \
+        }                                                               \
+        pcpu_stats;                                                     \
 })
 
+#define netdev_alloc_pcpu_stats(type)                                   \
+        __netdev_alloc_pcpu_stats(type, GFP_KERNEL);
+
 #include <linux/notifier.h>
 
 /* netdevice notifier chain. Please remember to update the rtnetlink
@@ -3854,6 +3857,11 @@ static inline bool netif_is_bridge_master(const struct net_device *dev)
         return dev->priv_flags & IFF_EBRIDGE;
 }
 
+static inline bool netif_is_bridge_port(const struct net_device *dev)
+{
+        return dev->priv_flags & IFF_BRIDGE_PORT;
+}
+
 static inline bool netif_is_ovs_master(const struct net_device *dev)
 {
         return dev->priv_flags & IFF_OPENVSWITCH;
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 48bb01edcf30..0e1f433cc4b7 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -421,7 +421,7 @@ extern void ip_set_free(void *members);
 extern int ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr);
 extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
 extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[],
-                              size_t len);
+                              size_t len, size_t align);
 extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
                                  struct ip_set_ext *ext);
 
diff --git a/include/linux/netfilter_ingress.h b/include/linux/netfilter_ingress.h
index 187feabe557c..5fcd375ef175 100644
--- a/include/linux/netfilter_ingress.h
+++ b/include/linux/netfilter_ingress.h
@@ -5,10 +5,13 @@
 #include <linux/netdevice.h>
 
 #ifdef CONFIG_NETFILTER_INGRESS
-static inline int nf_hook_ingress_active(struct sk_buff *skb)
+static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
 {
-        return nf_hook_list_active(&skb->dev->nf_hooks_ingress,
-                                   NFPROTO_NETDEV, NF_NETDEV_INGRESS);
+#ifdef HAVE_JUMP_LABEL
+        if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))
+                return false;
+#endif
+        return !list_empty(&skb->dev->nf_hooks_ingress);
 }
 
 static inline int nf_hook_ingress(struct sk_buff *skb)
@@ -16,8 +19,8 @@ static inline int nf_hook_ingress(struct sk_buff *skb)
         struct nf_hook_state state;
 
         nf_hook_state_init(&state, &skb->dev->nf_hooks_ingress,
-                           NF_NETDEV_INGRESS, INT_MIN, NFPROTO_NETDEV, NULL,
-                           skb->dev, NULL, dev_net(skb->dev), NULL);
+                           NF_NETDEV_INGRESS, INT_MIN, NFPROTO_NETDEV,
+                           skb->dev, NULL, NULL, dev_net(skb->dev), NULL);
         return nf_hook_slow(skb, &state);
 }
 
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 570d630f98ae..11bbae44f4cb 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -251,6 +251,7 @@ struct nfs4_layoutget {
         struct nfs4_layoutget_res res;
         struct rpc_cred *cred;
         gfp_t gfp_flags;
+        long timeout;
 };
 
 struct nfs4_getdeviceinfo_args {
diff --git a/include/linux/of_dma.h b/include/linux/of_dma.h
index 36112cdd665a..b90d8ec57c1f 100644
--- a/include/linux/of_dma.h
+++ b/include/linux/of_dma.h
@@ -80,7 +80,7 @@ static inline int of_dma_router_register(struct device_node *np,
 static inline struct dma_chan *of_dma_request_slave_channel(struct device_node *np,
                                                      const char *name)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline struct dma_chan *of_dma_simple_xlate(struct of_phandle_args *dma_spec,
diff --git a/include/linux/pci.h b/include/linux/pci.h
index e828e7b4afec..6ae25aae88fd 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -412,9 +412,18 @@ struct pci_host_bridge {
         void (*release_fn)(struct pci_host_bridge *);
         void *release_data;
         unsigned int ignore_reset_delay:1;      /* for entire hierarchy */
+        /* Resource alignment requirements */
+        resource_size_t (*align_resource)(struct pci_dev *dev,
+                        const struct resource *res,
+                        resource_size_t start,
+                        resource_size_t size,
+                        resource_size_t align);
 };
 
 #define to_pci_host_bridge(n) container_of(n, struct pci_host_bridge, dev)
+
+struct pci_host_bridge *pci_find_host_bridge(struct pci_bus *bus);
+
 void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
                      void (*release_fn)(struct pci_host_bridge *),
                      void *release_data);
diff --git a/include/linux/scpi_protocol.h b/include/linux/scpi_protocol.h
index 80af3cd35ae4..72ce932c69b2 100644
--- a/include/linux/scpi_protocol.h
+++ b/include/linux/scpi_protocol.h
@@ -71,7 +71,7 @@ struct scpi_ops {
         int (*sensor_get_value)(u16, u32 *);
 };
 
-#if IS_ENABLED(CONFIG_ARM_SCPI_PROTOCOL)
+#if IS_REACHABLE(CONFIG_ARM_SCPI_PROTOCOL)
 struct scpi_ops *get_scpi_ops(void);
 #else
 static inline struct scpi_ops *get_scpi_ops(void) { return NULL; }
diff --git a/include/linux/signal.h b/include/linux/signal.h
index ab1e0392b5ac..92557bbce7e7 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -239,7 +239,6 @@ extern int sigprocmask(int, sigset_t *, sigset_t *);
 extern void set_current_blocked(sigset_t *);
 extern void __set_current_blocked(const sigset_t *);
 extern int show_unhandled_signals;
-extern int sigsuspend(sigset_t *);
 
 struct sigaction {
 #ifndef __ARCH_HAS_IRIX_SIGACTION
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 7c82e3b307a3..2037a861e367 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -158,6 +158,24 @@ size_t ksize(const void *);
 #endif
 
 /*
+ * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
+ * Intended for arches that get misalignment faults even for 64 bit integer
+ * aligned buffers.
+ */
+#ifndef ARCH_SLAB_MINALIGN
+#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
+#endif
+
+/*
+ * kmalloc and friends return ARCH_KMALLOC_MINALIGN aligned
+ * pointers. kmem_cache_alloc and friends return ARCH_SLAB_MINALIGN
+ * aligned pointers.
+ */
+#define __assume_kmalloc_alignment __assume_aligned(ARCH_KMALLOC_MINALIGN)
+#define __assume_slab_alignment __assume_aligned(ARCH_SLAB_MINALIGN)
+#define __assume_page_alignment __assume_aligned(PAGE_SIZE)
+
+/*
  * Kmalloc array related definitions
  */
 
@@ -286,8 +304,8 @@ static __always_inline int kmalloc_index(size_t size)
 }
 #endif /* !CONFIG_SLOB */
 
-void *__kmalloc(size_t size, gfp_t flags);
-void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags);
+void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment;
+void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment;
 void kmem_cache_free(struct kmem_cache *, void *);
 
 /*
@@ -298,11 +316,11 @@ void kmem_cache_free(struct kmem_cache *, void *);
  * Note that interrupts must be enabled when calling these functions.
  */
 void kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
-bool kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
+int kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
 
 #ifdef CONFIG_NUMA
-void *__kmalloc_node(size_t size, gfp_t flags, int node);
-void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
+void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment;
+void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment;
 #else
 static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
 {
@@ -316,12 +334,12 @@ static __always_inline void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t f
 #endif
 
 #ifdef CONFIG_TRACING
-extern void *kmem_cache_alloc_trace(struct kmem_cache *, gfp_t, size_t);
+extern void *kmem_cache_alloc_trace(struct kmem_cache *, gfp_t, size_t) __assume_slab_alignment;
 
 #ifdef CONFIG_NUMA
 extern void *kmem_cache_alloc_node_trace(struct kmem_cache *s,
                                            gfp_t gfpflags,
-                                           int node, size_t size);
+                                           int node, size_t size) __assume_slab_alignment;
 #else
 static __always_inline void *
 kmem_cache_alloc_node_trace(struct kmem_cache *s,
@@ -354,10 +372,10 @@ kmem_cache_alloc_node_trace(struct kmem_cache *s,
 }
 #endif /* CONFIG_TRACING */
 
-extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order);
+extern void *kmalloc_order(size_t size, gfp_t flags, unsigned int order) __assume_page_alignment;
 
 #ifdef CONFIG_TRACING
-extern void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order);
+extern void *kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order) __assume_page_alignment;
 #else
 static __always_inline void *
 kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
@@ -482,15 +500,6 @@ static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
         return __kmalloc_node(size, flags, node);
 }
 
-/*
- * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
- * Intended for arches that get misalignment faults even for 64 bit integer
- * aligned buffers.
- */
-#ifndef ARCH_SLAB_MINALIGN
-#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
-#endif
-
 struct memcg_cache_array {
         struct rcu_head rcu;
         struct kmem_cache *entries[0];
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index a156b82dd14c..c2b66a277e98 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -524,7 +524,7 @@ asmlinkage long sys_chown(const char __user *filename,
 asmlinkage long sys_lchown(const char __user *filename,
                                 uid_t user, gid_t group);
 asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group);
-#ifdef CONFIG_UID16
+#ifdef CONFIG_HAVE_UID16
 asmlinkage long sys_chown16(const char __user *filename,
                                 old_uid_t user, old_gid_t group);
 asmlinkage long sys_lchown16(const char __user *filename,
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index 4014a59828fc..613c29bd6baf 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -438,7 +438,8 @@ static inline void thermal_zone_device_unregister(
 static inline int thermal_zone_bind_cooling_device(
         struct thermal_zone_device *tz, int trip,
         struct thermal_cooling_device *cdev,
-        unsigned long upper, unsigned long lower)
+        unsigned long upper, unsigned long lower,
+        unsigned int weight)
 { return -ENODEV; }
 static inline int thermal_zone_unbind_cooling_device(
         struct thermal_zone_device *tz, int trip,
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 5b04b0a5375b..5e31f1b99037 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -607,7 +607,7 @@ extern void n_tty_inherit_ops(struct tty_ldisc_ops *ops);
 
 /* tty_audit.c */
 #ifdef CONFIG_AUDIT
-extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
+extern void tty_audit_add_data(struct tty_struct *tty, const void *data,
                                size_t size, unsigned icanon);
 extern void tty_audit_exit(void);
 extern void tty_audit_fork(struct signal_struct *sig);
@@ -615,8 +615,8 @@ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch);
 extern void tty_audit_push(struct tty_struct *tty);
 extern int tty_audit_push_current(void);
 #else
-static inline void tty_audit_add_data(struct tty_struct *tty,
-                unsigned char *data, size_t size, unsigned icanon)
+static inline void tty_audit_add_data(struct tty_struct *tty, const void *data,
+                                      size_t size, unsigned icanon)
 {
 }
 static inline void tty_audit_tiocsti(struct tty_struct *tty, char ch)
diff --git a/include/linux/types.h b/include/linux/types.h
index 70d8500bddf1..70dd3dfde631 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -35,7 +35,7 @@ typedef __kernel_gid16_t        gid16_t;
 
 typedef unsigned long           uintptr_t;
 
-#ifdef CONFIG_UID16
+#ifdef CONFIG_HAVE_UID16
 /* This is defined by include/asm-{arch}/posix_types.h */
 typedef __kernel_old_uid_t      old_uid_t;
 typedef __kernel_old_gid_t      old_gid_t;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index aaf9700fc9e5..fb961a576abe 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -167,7 +167,8 @@ static inline void rt6_update_expires(struct rt6_info *rt0, int timeout)
 
 static inline u32 rt6_get_cookie(const struct rt6_info *rt)
 {
-        if (rt->rt6i_flags & RTF_PCPU || unlikely(rt->dst.flags & DST_NOCACHE))
+        if (rt->rt6i_flags & RTF_PCPU ||
+            (unlikely(rt->dst.flags & DST_NOCACHE) && rt->dst.from))
                 rt = (struct rt6_info *)(rt->dst.from);
 
         return rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index aaee6fa02cf1..ff788b665277 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -90,11 +90,12 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
         err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb);
 
         if (net_xmit_eval(err) == 0) {
-                struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
+                struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
                 u64_stats_update_begin(&tstats->syncp);
                 tstats->tx_bytes += pkt_len;
                 tstats->tx_packets++;
                 u64_stats_update_end(&tstats->syncp);
+                put_cpu_ptr(tstats);
         } else {
                 stats->tx_errors++;
                 stats->tx_aborted_errors++;
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index f6dafec9102c..62a750a6a8f8 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -287,12 +287,13 @@ static inline void iptunnel_xmit_stats(int err,
                                        struct pcpu_sw_netstats __percpu *stats)
 {
         if (err > 0) {
-                struct pcpu_sw_netstats *tstats = this_cpu_ptr(stats);
+                struct pcpu_sw_netstats *tstats = get_cpu_ptr(stats);
 
                 u64_stats_update_begin(&tstats->syncp);
                 tstats->tx_bytes += err;
                 tstats->tx_packets++;
                 u64_stats_update_end(&tstats->syncp);
+                put_cpu_ptr(tstats);
         } else if (err < 0) {
                 err_stats->tx_errors++;
                 err_stats->tx_aborted_errors++;
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index c9149cc0a02d..4bd7508bedc9 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -618,6 +618,8 @@ struct nft_expr_ops {
         void                            (*eval)(const struct nft_expr *expr,
                                                 struct nft_regs *regs,
                                                 const struct nft_pktinfo *pkt);
+        int                             (*clone)(struct nft_expr *dst,
+                                                 const struct nft_expr *src);
         unsigned int                    size;
 
         int                             (*init)(const struct nft_ctx *ctx,
@@ -660,10 +662,20 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);
 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
                   const struct nft_expr *expr);
 
-static inline void nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
+static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
 {
+        int err;
+
         __module_get(src->ops->type->owner);
-        memcpy(dst, src, src->ops->size);
+        if (src->ops->clone) {
+                dst->ops = src->ops;
+                err = src->ops->clone(dst, src);
+                if (err < 0)
+                        return err;
+        } else {
+                memcpy(dst, src, src->ops->size);
+        }
+        return 0;
 }
 
 /**
diff --git a/include/net/sock.h b/include/net/sock.h
index bbf7c2cf15b4..7f89e4ba18d1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2226,6 +2226,31 @@ static inline bool sk_listener(const struct sock *sk)
         return (1 << sk->sk_state) & (TCPF_LISTEN | TCPF_NEW_SYN_RECV);
 }
 
+/**
+ * sk_state_load - read sk->sk_state for lockless contexts
+ * @sk: socket pointer
+ *
+ * Paired with sk_state_store(). Used in places we do not hold socket lock :
+ * tcp_diag_get_info(), tcp_get_info(), tcp_poll(), get_tcp4_sock() ...
+ */
+static inline int sk_state_load(const struct sock *sk)
+{
+        return smp_load_acquire(&sk->sk_state);
+}
+
+/**
+ * sk_state_store - update sk->sk_state
+ * @sk: socket pointer
+ * @newstate: new state
+ *
+ * Paired with sk_state_load(). Should be used in contexts where
+ * state change might impact lockless readers.
+ */
+static inline void sk_state_store(struct sock *sk, int newstate)
+{
+        smp_store_release(&sk->sk_state, newstate);
+}
+
 void sock_enable_timestamp(struct sock *sk, int flag);
 int sock_get_timestamp(struct sock *, struct timeval __user *);
 int sock_get_timestampns(struct sock *, struct timespec __user *);
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index bc865e244efe..1d22ce9f352e 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -323,7 +323,7 @@ static inline int switchdev_port_fdb_dump(struct sk_buff *skb,
                                           struct net_device *filter_dev,
                                           int idx)
 {
-        return -EOPNOTSUPP;
+       return idx;
 }
 
 static inline void switchdev_port_fwd_mark_set(struct net_device *dev,
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 0a2c74008e53..aabf0aca0171 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -474,7 +474,7 @@ struct se_cmd {
         struct completion       cmd_wait_comp;
         const struct target_core_fabric_ops *se_tfo;
         sense_reason_t          (*execute_cmd)(struct se_cmd *);
-        sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
+        sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool, int *);
         void                    *protocol_data;
 
         unsigned char           *t_task_cdb;
diff --git a/include/uapi/linux/nfs.h b/include/uapi/linux/nfs.h
index 654bae3f1a38..5e6296160361 100644
--- a/include/uapi/linux/nfs.h
+++ b/include/uapi/linux/nfs.h
@@ -33,17 +33,6 @@
 
 #define NFS_PIPE_DIRNAME "nfs"
 
-/* NFS ioctls */
-/* Let's follow btrfs lead on CLONE to avoid messing userspace */
-#define NFS_IOC_CLONE           _IOW(0x94, 9, int)
-#define NFS_IOC_CLONE_RANGE     _IOW(0x94, 13, int)
-
-struct nfs_ioctl_clone_range_args {
-        __s64 src_fd;
-        __u64 src_off, count;
-        __u64 dst_off;
-};
-
 /*
  * NFS stats. The good thing with these values is that NFSv3 errors are
  * a superset of NFSv2 errors (with the exception of NFSERR_WFLUSH which
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 6e5344112419..db545cbcdb89 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -294,6 +294,12 @@ static int klp_write_object_relocations(struct module *pmod,
 
         for (reloc = obj->relocs; reloc->name; reloc++) {
                 if (!klp_is_module(obj)) {
+
+#if defined(CONFIG_RANDOMIZE_BASE)
+                        /* If KASLR has been enabled, adjust old value accordingly */
+                        if (kaslr_enabled())
+                                reloc->val += kaslr_offset();
+#endif
                         ret = klp_verify_vmlinux_symbol(reloc->name,
                                                         reloc->val);
                         if (ret)
diff --git a/kernel/panic.c b/kernel/panic.c
index 4579dbb7ed87..4b150bc0c6c1 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -152,8 +152,11 @@ void panic(const char *fmt, ...)
          * We may have ended up stopping the CPU holding the lock (in
          * smp_send_stop()) while still having some valuable data in the console
          * buffer.  Try to acquire the lock then release it regardless of the
-         * result.  The release will also print the buffers out.
+         * result.  The release will also print the buffers out.  Locks debug
+         * should be disabled to avoid reporting bad unlock balance when
+         * panic() is not being callled from OOPS.
          */
+        debug_locks_off();
         console_trylock();
         console_unlock();
 
diff --git a/kernel/pid.c b/kernel/pid.c
index ca368793808e..78b3d9f80d44 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -467,7 +467,7 @@ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
         rcu_read_lock();
         if (type != PIDTYPE_PID)
                 task = task->group_leader;
-        pid = get_pid(task->pids[type].pid);
+        pid = get_pid(rcu_dereference(task->pids[type].pid));
         rcu_read_unlock();
         return pid;
 }
@@ -528,7 +528,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
         if (likely(pid_alive(task))) {
                 if (type != PIDTYPE_PID)
                         task = task->group_leader;
-                nr = pid_nr_ns(task->pids[type].pid, ns);
+                nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
         }
         rcu_read_unlock();
 
diff --git a/kernel/signal.c b/kernel/signal.c
index c0b01fe24bbd..f3f1f7a972fd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3503,7 +3503,7 @@ SYSCALL_DEFINE0(pause)
 
 #endif
 
-int sigsuspend(sigset_t *set)
+static int sigsuspend(sigset_t *set)
 {
         current->saved_sigmask = current->blocked;
         set_current_blocked(set);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 75f1d05ea82d..9c6045a27ba3 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1887,12 +1887,6 @@ rb_event_index(struct ring_buffer_event *event)
         return (addr & ~PAGE_MASK) - BUF_PAGE_HDR_SIZE;
 }
 
-static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
-{
-        cpu_buffer->read_stamp = cpu_buffer->reader_page->page->time_stamp;
-        cpu_buffer->reader_page->read = 0;
-}
-
 static void rb_inc_iter(struct ring_buffer_iter *iter)
 {
         struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
@@ -2803,8 +2797,11 @@ rb_reserve_next_event(struct ring_buffer *buffer,
 
         event = __rb_reserve_next(cpu_buffer, &info);
 
-        if (unlikely(PTR_ERR(event) == -EAGAIN))
+        if (unlikely(PTR_ERR(event) == -EAGAIN)) {
+                if (info.add_timestamp)
+                        info.length -= RB_LEN_TIME_EXTEND;
                 goto again;
+        }
 
         if (!event)
                 goto out_fail;
@@ -3626,7 +3623,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
 
         /* Finally update the reader page to the new head */
         cpu_buffer->reader_page = reader;
-        rb_reset_reader_page(cpu_buffer);
+        cpu_buffer->reader_page->read = 0;
 
         if (overwrite != cpu_buffer->last_overrun) {
                 cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
@@ -3636,6 +3633,10 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
         goto again;
 
  out:
+        /* Update the read_stamp on the first event */
+        if (reader && reader->read == 0)
+                cpu_buffer->read_stamp = reader->page->time_stamp;
+
         arch_spin_unlock(&cpu_buffer->lock);
         local_irq_restore(flags);
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c29ddebc8705..62fe06bb7d04 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2009,7 +2009,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
+                if (*vm_flags & VM_NO_THP)
                         return -EINVAL;
                 *vm_flags &= ~VM_NOHUGEPAGE;
                 *vm_flags |= VM_HUGEPAGE;
@@ -2025,7 +2025,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
+                if (*vm_flags & VM_NO_THP)
                         return -EINVAL;
                 *vm_flags &= ~VM_HUGEPAGE;
                 *vm_flags |= VM_NOHUGEPAGE;
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index d41b21bce6a0..bc0a8d8b8f42 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -19,6 +19,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/kmemleak.h>
 #include <linux/memblock.h>
 #include <linux/memory.h>
 #include <linux/mm.h>
@@ -444,6 +445,7 @@ int kasan_module_alloc(void *addr, size_t size)
 
         if (ret) {
                 find_vm_area(addr)->flags |= VM_KASAN;
+                kmemleak_ignore(ret);
                 return 0;
         }
 
diff --git a/mm/memory.c b/mm/memory.c
index deb679c31f2a..c387430f06c3 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3015,9 +3015,9 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 } else {
                         /*
                          * The fault handler has no page to lock, so it holds
-                         * i_mmap_lock for write to protect against truncate.
+                         * i_mmap_lock for read to protect against truncate.
                          */
-                        i_mmap_unlock_write(vma->vm_file->f_mapping);
+                        i_mmap_unlock_read(vma->vm_file->f_mapping);
                 }
                 goto uncharge_out;
         }
@@ -3031,9 +3031,9 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         } else {
                 /*
                  * The fault handler has no page to lock, so it holds
-                 * i_mmap_lock for write to protect against truncate.
+                 * i_mmap_lock for read to protect against truncate.
                  */
-                i_mmap_unlock_write(vma->vm_file->f_mapping);
+                i_mmap_unlock_read(vma->vm_file->f_mapping);
         }
         return ret;
 uncharge_out:
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 2c90357c34ea..3e4d65445fa7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1542,7 +1542,9 @@ static void balance_dirty_pages(struct address_space *mapping,
         for (;;) {
                 unsigned long now = jiffies;
                 unsigned long dirty, thresh, bg_thresh;
-                unsigned long m_dirty, m_thresh, m_bg_thresh;
+                unsigned long m_dirty = 0;      /* stop bogus uninit warnings */
+                unsigned long m_thresh = 0;
+                unsigned long m_bg_thresh = 0;
 
                 /*
                  * Unstable writes are a feature of certain networked
diff --git a/mm/slab.c b/mm/slab.c
index e0819fa96559..4765c97ce690 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3419,7 +3419,7 @@ void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                                                                 void **p)
 {
         return __kmem_cache_alloc_bulk(s, flags, size, p);
diff --git a/mm/slab.h b/mm/slab.h
index 27492eb678f7..7b6087197997 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -170,7 +170,7 @@ ssize_t slabinfo_write(struct file *file, const char __user *buffer,
  * may be allocated or freed using these operations.
  */
 void __kmem_cache_free_bulk(struct kmem_cache *, size_t, void **);
-bool __kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
+int __kmem_cache_alloc_bulk(struct kmem_cache *, gfp_t, size_t, void **);
 
 #ifdef CONFIG_MEMCG_KMEM
 /*
diff --git a/mm/slab_common.c b/mm/slab_common.c
index d88e97c10a2e..3c6a86b4ec25 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -112,7 +112,7 @@ void __kmem_cache_free_bulk(struct kmem_cache *s, size_t nr, void **p)
                 kmem_cache_free(s, p[i]);
 }
 
-bool __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
+int __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
                                                                 void **p)
 {
         size_t i;
@@ -121,10 +121,10 @@ bool __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
                 void *x = p[i] = kmem_cache_alloc(s, flags);
                 if (!x) {
                         __kmem_cache_free_bulk(s, i, p);
-                        return false;
+                        return 0;
                 }
         }
-        return true;
+        return i;
 }
 
 #ifdef CONFIG_MEMCG_KMEM
diff --git a/mm/slob.c b/mm/slob.c
index 0d7e5df74d1f..17e8f8cc7c53 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -617,7 +617,7 @@ void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                                                                 void **p)
 {
         return __kmem_cache_alloc_bulk(s, flags, size, p);
diff --git a/mm/slub.c b/mm/slub.c
index 7cb4bf9ae320..46997517406e 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1065,11 +1065,15 @@ bad:
         return 0;
 }
 
+/* Supports checking bulk free of a constructed freelist */
 static noinline struct kmem_cache_node *free_debug_processing(
-        struct kmem_cache *s, struct page *page, void *object,
+        struct kmem_cache *s, struct page *page,
+        void *head, void *tail, int bulk_cnt,
         unsigned long addr, unsigned long *flags)
 {
         struct kmem_cache_node *n = get_node(s, page_to_nid(page));
+        void *object = head;
+        int cnt = 0;
 
         spin_lock_irqsave(&n->list_lock, *flags);
         slab_lock(page);
@@ -1077,6 +1081,9 @@ static noinline struct kmem_cache_node *free_debug_processing(
         if (!check_slab(s, page))
                 goto fail;
 
+next_object:
+        cnt++;
+
         if (!check_valid_pointer(s, page, object)) {
                 slab_err(s, page, "Invalid object pointer 0x%p", object);
                 goto fail;
@@ -1107,8 +1114,19 @@ static noinline struct kmem_cache_node *free_debug_processing(
         if (s->flags & SLAB_STORE_USER)
                 set_track(s, object, TRACK_FREE, addr);
         trace(s, page, object, 0);
+        /* Freepointer not overwritten by init_object(), SLAB_POISON moved it */
         init_object(s, object, SLUB_RED_INACTIVE);
+
+        /* Reached end of constructed freelist yet? */
+        if (object != tail) {
+                object = get_freepointer(s, object);
+                goto next_object;
+        }
 out:
+        if (cnt != bulk_cnt)
+                slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
+                         bulk_cnt, cnt);
+
         slab_unlock(page);
         /*
          * Keep node_lock to preserve integrity
@@ -1204,7 +1222,7 @@ unsigned long kmem_cache_flags(unsigned long object_size,
 
         return flags;
 }
-#else
+#else /* !CONFIG_SLUB_DEBUG */
 static inline void setup_object_debug(struct kmem_cache *s,
                         struct page *page, void *object) {}
 
@@ -1212,7 +1230,8 @@ static inline int alloc_debug_processing(struct kmem_cache *s,
         struct page *page, void *object, unsigned long addr) { return 0; }
 
 static inline struct kmem_cache_node *free_debug_processing(
-        struct kmem_cache *s, struct page *page, void *object,
+        struct kmem_cache *s, struct page *page,
+        void *head, void *tail, int bulk_cnt,
         unsigned long addr, unsigned long *flags) { return NULL; }
 
 static inline int slab_pad_check(struct kmem_cache *s, struct page *page)
@@ -1273,14 +1292,21 @@ static inline struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s,
         return memcg_kmem_get_cache(s, flags);
 }
 
-static inline void slab_post_alloc_hook(struct kmem_cache *s,
-                                        gfp_t flags, void *object)
+static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
+                                        size_t size, void **p)
 {
+        size_t i;
+
         flags &= gfp_allowed_mask;
-        kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
-        kmemleak_alloc_recursive(object, s->object_size, 1, s->flags, flags);
+        for (i = 0; i < size; i++) {
+                void *object = p[i];
+
+                kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
+                kmemleak_alloc_recursive(object, s->object_size, 1,
+                                         s->flags, flags);
+                kasan_slab_alloc(s, object);
+        }
         memcg_kmem_put_cache(s);
-        kasan_slab_alloc(s, object);
 }
 
 static inline void slab_free_hook(struct kmem_cache *s, void *x)
@@ -1308,6 +1334,29 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
         kasan_slab_free(s, x);
 }
 
+static inline void slab_free_freelist_hook(struct kmem_cache *s,
+                                           void *head, void *tail)
+{
+/*
+ * Compiler cannot detect this function can be removed if slab_free_hook()
+ * evaluates to nothing.  Thus, catch all relevant config debug options here.
+ */
+#if defined(CONFIG_KMEMCHECK) ||                \
+        defined(CONFIG_LOCKDEP) ||              \
+        defined(CONFIG_DEBUG_KMEMLEAK) ||       \
+        defined(CONFIG_DEBUG_OBJECTS_FREE) ||   \
+        defined(CONFIG_KASAN)
+
+        void *object = head;
+        void *tail_obj = tail ? : head;
+
+        do {
+                slab_free_hook(s, object);
+        } while ((object != tail_obj) &&
+                 (object = get_freepointer(s, object)));
+#endif
+}
+
 static void setup_object(struct kmem_cache *s, struct page *page,
                                 void *object)
 {
@@ -2295,23 +2344,15 @@ static inline void *get_freelist(struct kmem_cache *s, struct page *page)
  * And if we were unable to get a new slab from the partial slab lists then
  * we need to allocate a new slab. This is the slowest path since it involves
  * a call to the page allocator and the setup of a new slab.
+ *
+ * Version of __slab_alloc to use when we know that interrupts are
+ * already disabled (which is the case for bulk allocation).
  */
-static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
                           unsigned long addr, struct kmem_cache_cpu *c)
 {
         void *freelist;
         struct page *page;
-        unsigned long flags;
-
-        local_irq_save(flags);
-#ifdef CONFIG_PREEMPT
-        /*
-         * We may have been preempted and rescheduled on a different
-         * cpu before disabling interrupts. Need to reload cpu area
-         * pointer.
-         */
-        c = this_cpu_ptr(s->cpu_slab);
-#endif
 
         page = c->page;
         if (!page)
@@ -2369,7 +2410,6 @@ load_freelist:
         VM_BUG_ON(!c->page->frozen);
         c->freelist = get_freepointer(s, freelist);
         c->tid = next_tid(c->tid);
-        local_irq_restore(flags);
         return freelist;
 
 new_slab:
@@ -2386,7 +2426,6 @@ new_slab:
 
         if (unlikely(!freelist)) {
                 slab_out_of_memory(s, gfpflags, node);
-                local_irq_restore(flags);
                 return NULL;
         }
 
@@ -2402,11 +2441,35 @@ new_slab:
         deactivate_slab(s, page, get_freepointer(s, freelist));
         c->page = NULL;
         c->freelist = NULL;
-        local_irq_restore(flags);
         return freelist;
 }
 
 /*
+ * Another one that disabled interrupt and compensates for possible
+ * cpu changes by refetching the per cpu area pointer.
+ */
+static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+                          unsigned long addr, struct kmem_cache_cpu *c)
+{
+        void *p;
+        unsigned long flags;
+
+        local_irq_save(flags);
+#ifdef CONFIG_PREEMPT
+        /*
+         * We may have been preempted and rescheduled on a different
+         * cpu before disabling interrupts. Need to reload cpu area
+         * pointer.
+         */
+        c = this_cpu_ptr(s->cpu_slab);
+#endif
+
+        p = ___slab_alloc(s, gfpflags, node, addr, c);
+        local_irq_restore(flags);
+        return p;
+}
+
+/*
  * Inlined fastpath so that allocation functions (kmalloc, kmem_cache_alloc)
  * have the fastpath folded into their functions. So no function call
  * overhead for requests that can be satisfied on the fastpath.
@@ -2419,7 +2482,7 @@ new_slab:
 static __always_inline void *slab_alloc_node(struct kmem_cache *s,
                 gfp_t gfpflags, int node, unsigned long addr)
 {
-        void **object;
+        void *object;
         struct kmem_cache_cpu *c;
         struct page *page;
         unsigned long tid;
@@ -2498,7 +2561,7 @@ redo:
         if (unlikely(gfpflags & __GFP_ZERO) && object)
                 memset(object, 0, s->object_size);
 
-        slab_post_alloc_hook(s, gfpflags, object);
+        slab_post_alloc_hook(s, gfpflags, 1, &object);
 
         return object;
 }
@@ -2569,10 +2632,11 @@ EXPORT_SYMBOL(kmem_cache_alloc_node_trace);
  * handling required then we can return immediately.
  */
 static void __slab_free(struct kmem_cache *s, struct page *page,
-                        void *x, unsigned long addr)
+                        void *head, void *tail, int cnt,
+                        unsigned long addr)
+
 {
         void *prior;
-        void **object = (void *)x;
         int was_frozen;
         struct page new;
         unsigned long counters;
@@ -2582,7 +2646,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
         stat(s, FREE_SLOWPATH);
 
         if (kmem_cache_debug(s) &&
-                !(n = free_debug_processing(s, page, x, addr, &flags)))
+            !(n = free_debug_processing(s, page, head, tail, cnt,
+                                        addr, &flags)))
                 return;
 
         do {
@@ -2592,10 +2657,10 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
                 }
                 prior = page->freelist;
                 counters = page->counters;
-                set_freepointer(s, object, prior);
+                set_freepointer(s, tail, prior);
                 new.counters = counters;
                 was_frozen = new.frozen;
-                new.inuse--;
+                new.inuse -= cnt;
                 if ((!new.inuse || !prior) && !was_frozen) {
 
                         if (kmem_cache_has_cpu_partial(s) && !prior) {
@@ -2626,7 +2691,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
 
         } while (!cmpxchg_double_slab(s, page,
                 prior, counters,
-                object, new.counters,
+                head, new.counters,
                 "__slab_free"));
 
         if (likely(!n)) {
@@ -2691,15 +2756,20 @@ slab_empty:
  *
  * If fastpath is not possible then fall back to __slab_free where we deal
  * with all sorts of special processing.
+ *
+ * Bulk free of a freelist with several objects (all pointing to the
+ * same page) possible by specifying head and tail ptr, plus objects
+ * count (cnt). Bulk free indicated by tail pointer being set.
  */
-static __always_inline void slab_free(struct kmem_cache *s,
-                        struct page *page, void *x, unsigned long addr)
+static __always_inline void slab_free(struct kmem_cache *s, struct page *page,
+                                      void *head, void *tail, int cnt,
+                                      unsigned long addr)
 {
-        void **object = (void *)x;
+        void *tail_obj = tail ? : head;
         struct kmem_cache_cpu *c;
         unsigned long tid;
 
-        slab_free_hook(s, x);
+        slab_free_freelist_hook(s, head, tail);
 
 redo:
         /*
@@ -2718,19 +2788,19 @@ redo:
         barrier();
 
         if (likely(page == c->page)) {
-                set_freepointer(s, object, c->freelist);
+                set_freepointer(s, tail_obj, c->freelist);
 
                 if (unlikely(!this_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 c->freelist, tid,
-                                object, next_tid(tid)))) {
+                                head, next_tid(tid)))) {
 
                         note_cmpxchg_failure("slab_free", s, tid);
                         goto redo;
                 }
                 stat(s, FREE_FASTPATH);
         } else
-                __slab_free(s, page, x, addr);
+                __slab_free(s, page, head, tail_obj, cnt, addr);
 
 }
 
@@ -2739,59 +2809,116 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
         s = cache_from_obj(s, x);
         if (!s)
                 return;
-        slab_free(s, virt_to_head_page(x), x, _RET_IP_);
+        slab_free(s, virt_to_head_page(x), x, NULL, 1, _RET_IP_);
         trace_kmem_cache_free(_RET_IP_, x);
 }
 EXPORT_SYMBOL(kmem_cache_free);
 
-/* Note that interrupts must be enabled when calling this function. */
-void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p)
-{
-        struct kmem_cache_cpu *c;
+struct detached_freelist {
         struct page *page;
-        int i;
+        void *tail;
+        void *freelist;
+        int cnt;
+};
 
-        local_irq_disable();
-        c = this_cpu_ptr(s->cpu_slab);
+/*
+ * This function progressively scans the array with free objects (with
+ * a limited look ahead) and extract objects belonging to the same
+ * page.  It builds a detached freelist directly within the given
+ * page/objects.  This can happen without any need for
+ * synchronization, because the objects are owned by running process.
+ * The freelist is build up as a single linked list in the objects.
+ * The idea is, that this detached freelist can then be bulk
+ * transferred to the real freelist(s), but only requiring a single
+ * synchronization primitive.  Look ahead in the array is limited due
+ * to performance reasons.
+ */
+static int build_detached_freelist(struct kmem_cache *s, size_t size,
+                                   void **p, struct detached_freelist *df)
+{
+        size_t first_skipped_index = 0;
+        int lookahead = 3;
+        void *object;
 
-        for (i = 0; i < size; i++) {
-                void *object = p[i];
+        /* Always re-init detached_freelist */
+        df->page = NULL;
 
-                BUG_ON(!object);
-                /* kmem cache debug support */
-                s = cache_from_obj(s, object);
-                if (unlikely(!s))
-                        goto exit;
-                slab_free_hook(s, object);
+        do {
+                object = p[--size];
+        } while (!object && size);
 
-                page = virt_to_head_page(object);
+        if (!object)
+                return 0;
 
-                if (c->page == page) {
-                        /* Fastpath: local CPU free */
-                        set_freepointer(s, object, c->freelist);
-                        c->freelist = object;
-                } else {
-                        c->tid = next_tid(c->tid);
-                        local_irq_enable();
-                        /* Slowpath: overhead locked cmpxchg_double_slab */
-                        __slab_free(s, page, object, _RET_IP_);
-                        local_irq_disable();
-                        c = this_cpu_ptr(s->cpu_slab);
+        /* Start new detached freelist */
+        set_freepointer(s, object, NULL);
+        df->page = virt_to_head_page(object);
+        df->tail = object;
+        df->freelist = object;
+        p[size] = NULL; /* mark object processed */
+        df->cnt = 1;
+
+        while (size) {
+                object = p[--size];
+                if (!object)
+                        continue; /* Skip processed objects */
+
+                /* df->page is always set at this point */
+                if (df->page == virt_to_head_page(object)) {
+                        /* Opportunity build freelist */
+                        set_freepointer(s, object, df->freelist);
+                        df->freelist = object;
+                        df->cnt++;
+                        p[size] = NULL; /* mark object processed */
+
+                        continue;
                 }
+
+                /* Limit look ahead search */
+                if (!--lookahead)
+                        break;
+
+                if (!first_skipped_index)
+                        first_skipped_index = size + 1;
         }
-exit:
-        c->tid = next_tid(c->tid);
-        local_irq_enable();
+
+        return first_skipped_index;
+}
+
+
+/* Note that interrupts must be enabled when calling this function. */
+void kmem_cache_free_bulk(struct kmem_cache *orig_s, size_t size, void **p)
+{
+        if (WARN_ON(!size))
+                return;
+
+        do {
+                struct detached_freelist df;
+                struct kmem_cache *s;
+
+                /* Support for memcg */
+                s = cache_from_obj(orig_s, p[size - 1]);
+
+                size = build_detached_freelist(s, size, p, &df);
+                if (unlikely(!df.page))
+                        continue;
+
+                slab_free(s, df.page, df.freelist, df.tail, df.cnt, _RET_IP_);
+        } while (likely(size));
 }
 EXPORT_SYMBOL(kmem_cache_free_bulk);
 
 /* Note that interrupts must be enabled when calling this function. */
-bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
-                           void **p)
+int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+                          void **p)
 {
         struct kmem_cache_cpu *c;
         int i;
 
+        /* memcg and kmem_cache debug support */
+        s = slab_pre_alloc_hook(s, flags);
+        if (unlikely(!s))
+                return false;
         /*
          * Drain objects in the per cpu slab, while disabling local
          * IRQs, which protects against PREEMPT and interrupts
@@ -2804,36 +2931,20 @@ bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                 void *object = c->freelist;
 
                 if (unlikely(!object)) {
-                        local_irq_enable();
                         /*
                          * Invoking slow path likely have side-effect
                          * of re-populating per CPU c->freelist
                          */
-                        p[i] = __slab_alloc(s, flags, NUMA_NO_NODE,
+                        p[i] = ___slab_alloc(s, flags, NUMA_NO_NODE,
                                             _RET_IP_, c);
-                        if (unlikely(!p[i])) {
-                                __kmem_cache_free_bulk(s, i, p);
-                                return false;
-                        }
-                        local_irq_disable();
+                        if (unlikely(!p[i]))
+                                goto error;
+
                         c = this_cpu_ptr(s->cpu_slab);
                         continue; /* goto for-loop */
                 }
-
-                /* kmem_cache debug support */
-                s = slab_pre_alloc_hook(s, flags);
-                if (unlikely(!s)) {
-                        __kmem_cache_free_bulk(s, i, p);
-                        c->tid = next_tid(c->tid);
-                        local_irq_enable();
-                        return false;
-                }
-
                 c->freelist = get_freepointer(s, object);
                 p[i] = object;
-
-                /* kmem_cache debug support */
-                slab_post_alloc_hook(s, flags, object);
         }
         c->tid = next_tid(c->tid);
         local_irq_enable();
@@ -2846,7 +2957,14 @@ bool kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
                         memset(p[j], 0, s->object_size);
         }
 
-        return true;
+        /* memcg and kmem_cache debug support */
+        slab_post_alloc_hook(s, flags, size, p);
+        return i;
+error:
+        local_irq_enable();
+        slab_post_alloc_hook(s, flags, i, p);
+        __kmem_cache_free_bulk(s, i, p);
+        return 0;
 }
 EXPORT_SYMBOL(kmem_cache_alloc_bulk);
 
@@ -3511,7 +3629,7 @@ void kfree(const void *x)
                 __free_kmem_pages(page, compound_order(page));
                 return;
         }
-        slab_free(page->slab_cache, page, object, _RET_IP_);
+        slab_free(page->slab_cache, page, object, NULL, 1, _RET_IP_);
 }
 EXPORT_SYMBOL(kfree);
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index d04563480c94..8e3c9c5a3042 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1443,7 +1443,6 @@ struct vm_struct *remove_vm_area(const void *addr)
                 vmap_debug_free_range(va->va_start, va->va_end);
                 kasan_free_shadow(vm);
                 free_unmap_vmap_area(va);
-                vm->size -= PAGE_SIZE;
 
                 return vm;
         }
@@ -1468,8 +1467,8 @@ static void __vunmap(const void *addr, int deallocate_pages)
                 return;
         }
 
-        debug_check_no_locks_freed(addr, area->size);
-        debug_check_no_obj_freed(addr, area->size);
+        debug_check_no_locks_freed(addr, get_vm_area_size(area));
+        debug_check_no_obj_freed(addr, get_vm_area_size(area));
 
         if (deallocate_pages) {
                 int i;
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 496b27588493..e2ed69850489 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -30,7 +30,9 @@ bool vlan_do_receive(struct sk_buff **skbp)
                         skb->pkt_type = PACKET_HOST;
         }
 
-        if (!(vlan_dev_priv(vlan_dev)->flags & VLAN_FLAG_REORDER_HDR)) {
+        if (!(vlan_dev_priv(vlan_dev)->flags & VLAN_FLAG_REORDER_HDR) &&
+            !netif_is_macvlan_port(vlan_dev) &&
+            !netif_is_bridge_port(vlan_dev)) {
                 unsigned int offset = skb->data - skb_mac_header(skb);
 
                 /*
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index f7e8dee64fc8..5f3f64553179 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -48,7 +48,7 @@ void br_set_state(struct net_bridge_port *p, unsigned int state)
 
         p->state = state;
         err = switchdev_port_attr_set(p->dev, &attr);
-        if (err)
+        if (err && err != -EOPNOTSUPP)
                 br_warn(p->br, "error setting offload STP state on port %u(%s)\n",
                                 (unsigned int) p->port_no, p->dev->name);
 }
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index fa53d7a89f48..5396ff08af32 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -50,7 +50,7 @@ void br_init_port(struct net_bridge_port *p)
         p->config_pending = 0;
 
         err = switchdev_port_attr_set(p->dev, &attr);
-        if (err)
+        if (err && err != -EOPNOTSUPP)
                 netdev_err(p->dev, "failed to set HW ageing time\n");
 }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index ab9b8d0d115e..ae00b894e675 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2403,17 +2403,20 @@ static void skb_warn_bad_offload(const struct sk_buff *skb)
 {
         static const netdev_features_t null_features = 0;
         struct net_device *dev = skb->dev;
-        const char *driver = "";
+        const char *name = "";
 
         if (!net_ratelimit())
                 return;
 
-        if (dev && dev->dev.parent)
-                driver = dev_driver_string(dev->dev.parent);
-
+        if (dev) {
+                if (dev->dev.parent)
+                        name = dev_driver_string(dev->dev.parent);
+                else
+                        name = netdev_name(dev);
+        }
         WARN(1, "%s: caps=(%pNF, %pNF) len=%d data_len=%d gso_size=%d "
              "gso_type=%d ip_summed=%d\n",
-             driver, dev ? &dev->features : &null_features,
+             name, dev ? &dev->features : &null_features,
              skb->sk ? &skb->sk->sk_route_caps : &null_features,
              skb->len, skb->data_len, skb_shinfo(skb)->gso_size,
              skb_shinfo(skb)->gso_type, skb->ip_summed);
@@ -6426,11 +6429,16 @@ int __netdev_update_features(struct net_device *dev)
 
         if (dev->netdev_ops->ndo_set_features)
                 err = dev->netdev_ops->ndo_set_features(dev, features);
+        else
+                err = 0;
 
         if (unlikely(err < 0)) {
                 netdev_err(dev,
                         "set_features() failed (%d); wanted %pNF, left %pNF\n",
                         err, &features, &dev->features);
+                /* return non-0 since some features might have changed and
+                 * it's better to fire a spurious notification than miss it
+                 */
                 return -1;
         }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 1aa8437ed6c4..e6af42da28d9 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -857,7 +857,7 @@ static void neigh_probe(struct neighbour *neigh)
         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
         /* keep skb alive even if arp_queue overflows */
         if (skb)
-                skb = skb_copy(skb, GFP_ATOMIC);
+                skb = skb_clone(skb, GFP_ATOMIC);
         write_unlock(&neigh->lock);
         neigh->ops->solicit(neigh, skb);
         atomic_inc(&neigh->probes);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 504bd17b7456..34ba7a08876d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1045,15 +1045,156 @@ static int rtnl_phys_switch_id_fill(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static noinline_for_stack int rtnl_fill_stats(struct sk_buff *skb,
+                                              struct net_device *dev)
+{
+        const struct rtnl_link_stats64 *stats;
+        struct rtnl_link_stats64 temp;
+        struct nlattr *attr;
+
+        stats = dev_get_stats(dev, &temp);
+
+        attr = nla_reserve(skb, IFLA_STATS,
+                           sizeof(struct rtnl_link_stats));
+        if (!attr)
+                return -EMSGSIZE;
+
+        copy_rtnl_link_stats(nla_data(attr), stats);
+
+        attr = nla_reserve(skb, IFLA_STATS64,
+                           sizeof(struct rtnl_link_stats64));
+        if (!attr)
+                return -EMSGSIZE;
+
+        copy_rtnl_link_stats64(nla_data(attr), stats);
+
+        return 0;
+}
+
+static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
+                                               struct net_device *dev,
+                                               int vfs_num,
+                                               struct nlattr *vfinfo)
+{
+        struct ifla_vf_rss_query_en vf_rss_query_en;
+        struct ifla_vf_link_state vf_linkstate;
+        struct ifla_vf_spoofchk vf_spoofchk;
+        struct ifla_vf_tx_rate vf_tx_rate;
+        struct ifla_vf_stats vf_stats;
+        struct ifla_vf_trust vf_trust;
+        struct ifla_vf_vlan vf_vlan;
+        struct ifla_vf_rate vf_rate;
+        struct nlattr *vf, *vfstats;
+        struct ifla_vf_mac vf_mac;
+        struct ifla_vf_info ivi;
+
+        /* Not all SR-IOV capable drivers support the
+         * spoofcheck and "RSS query enable" query.  Preset to
+         * -1 so the user space tool can detect that the driver
+         * didn't report anything.
+         */
+        ivi.spoofchk = -1;
+        ivi.rss_query_en = -1;
+        ivi.trusted = -1;
+        memset(ivi.mac, 0, sizeof(ivi.mac));
+        /* The default value for VF link state is "auto"
+         * IFLA_VF_LINK_STATE_AUTO which equals zero
+         */
+        ivi.linkstate = 0;
+        if (dev->netdev_ops->ndo_get_vf_config(dev, vfs_num, &ivi))
+                return 0;
+
+        vf_mac.vf =
+                vf_vlan.vf =
+                vf_rate.vf =
+                vf_tx_rate.vf =
+                vf_spoofchk.vf =
+                vf_linkstate.vf =
+                vf_rss_query_en.vf =
+                vf_trust.vf = ivi.vf;
+
+        memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
+        vf_vlan.vlan = ivi.vlan;
+        vf_vlan.qos = ivi.qos;
+        vf_tx_rate.rate = ivi.max_tx_rate;
+        vf_rate.min_tx_rate = ivi.min_tx_rate;
+        vf_rate.max_tx_rate = ivi.max_tx_rate;
+        vf_spoofchk.setting = ivi.spoofchk;
+        vf_linkstate.link_state = ivi.linkstate;
+        vf_rss_query_en.setting = ivi.rss_query_en;
+        vf_trust.setting = ivi.trusted;
+        vf = nla_nest_start(skb, IFLA_VF_INFO);
+        if (!vf) {
+                nla_nest_cancel(skb, vfinfo);
+                return -EMSGSIZE;
+        }
+        if (nla_put(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac) ||
+            nla_put(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan) ||
+            nla_put(skb, IFLA_VF_RATE, sizeof(vf_rate),
+                    &vf_rate) ||
+            nla_put(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate),
+                    &vf_tx_rate) ||
+            nla_put(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
+                    &vf_spoofchk) ||
+            nla_put(skb, IFLA_VF_LINK_STATE, sizeof(vf_linkstate),
+                    &vf_linkstate) ||
+            nla_put(skb, IFLA_VF_RSS_QUERY_EN,
+                    sizeof(vf_rss_query_en),
+                    &vf_rss_query_en) ||
+            nla_put(skb, IFLA_VF_TRUST,
+                    sizeof(vf_trust), &vf_trust))
+                return -EMSGSIZE;
+        memset(&vf_stats, 0, sizeof(vf_stats));
+        if (dev->netdev_ops->ndo_get_vf_stats)
+                dev->netdev_ops->ndo_get_vf_stats(dev, vfs_num,
+                                                &vf_stats);
+        vfstats = nla_nest_start(skb, IFLA_VF_STATS);
+        if (!vfstats) {
+                nla_nest_cancel(skb, vf);
+                nla_nest_cancel(skb, vfinfo);
+                return -EMSGSIZE;
+        }
+        if (nla_put_u64(skb, IFLA_VF_STATS_RX_PACKETS,
+                        vf_stats.rx_packets) ||
+            nla_put_u64(skb, IFLA_VF_STATS_TX_PACKETS,
+                        vf_stats.tx_packets) ||
+            nla_put_u64(skb, IFLA_VF_STATS_RX_BYTES,
+                        vf_stats.rx_bytes) ||
+            nla_put_u64(skb, IFLA_VF_STATS_TX_BYTES,
+                        vf_stats.tx_bytes) ||
+            nla_put_u64(skb, IFLA_VF_STATS_BROADCAST,
+                        vf_stats.broadcast) ||
+            nla_put_u64(skb, IFLA_VF_STATS_MULTICAST,
+                        vf_stats.multicast))
+                return -EMSGSIZE;
+        nla_nest_end(skb, vfstats);
+        nla_nest_end(skb, vf);
+        return 0;
+}
+
+static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
+{
+        struct rtnl_link_ifmap map = {
+                .mem_start   = dev->mem_start,
+                .mem_end     = dev->mem_end,
+                .base_addr   = dev->base_addr,
+                .irq         = dev->irq,
+                .dma         = dev->dma,
+                .port        = dev->if_port,
+        };
+        if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
+                return -EMSGSIZE;
+
+        return 0;
+}
+
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags, u32 ext_filter_mask)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
-        struct rtnl_link_stats64 temp;
-        const struct rtnl_link_stats64 *stats;
-        struct nlattr *attr, *af_spec;
+        struct nlattr *af_spec;
         struct rtnl_af_ops *af_ops;
         struct net_device *upper_dev = netdev_master_upper_dev_get(dev);
 
@@ -1096,18 +1237,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
             nla_put_u8(skb, IFLA_PROTO_DOWN, dev->proto_down))
                 goto nla_put_failure;
 
-        if (1) {
-                struct rtnl_link_ifmap map = {
-                        .mem_start   = dev->mem_start,
-                        .mem_end     = dev->mem_end,
-                        .base_addr   = dev->base_addr,
-                        .irq         = dev->irq,
-                        .dma         = dev->dma,
-                        .port        = dev->if_port,
-                };
-                if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
-                        goto nla_put_failure;
-        }
+        if (rtnl_fill_link_ifmap(skb, dev))
+                goto nla_put_failure;
 
         if (dev->addr_len) {
                 if (nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr) ||
@@ -1124,128 +1255,27 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         if (rtnl_phys_switch_id_fill(skb, dev))
                 goto nla_put_failure;
 
-        attr = nla_reserve(skb, IFLA_STATS,
-                        sizeof(struct rtnl_link_stats));
-        if (attr == NULL)
-                goto nla_put_failure;
-
-        stats = dev_get_stats(dev, &temp);
-        copy_rtnl_link_stats(nla_data(attr), stats);
-
-        attr = nla_reserve(skb, IFLA_STATS64,
-                        sizeof(struct rtnl_link_stats64));
-        if (attr == NULL)
+        if (rtnl_fill_stats(skb, dev))
                 goto nla_put_failure;
-        copy_rtnl_link_stats64(nla_data(attr), stats);
 
         if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF) &&
             nla_put_u32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent)))
                 goto nla_put_failure;
 
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
-            && (ext_filter_mask & RTEXT_FILTER_VF)) {
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent &&
+            ext_filter_mask & RTEXT_FILTER_VF) {
                 int i;
-
-                struct nlattr *vfinfo, *vf, *vfstats;
+                struct nlattr *vfinfo;
                 int num_vfs = dev_num_vf(dev->dev.parent);
 
                 vfinfo = nla_nest_start(skb, IFLA_VFINFO_LIST);
                 if (!vfinfo)
                         goto nla_put_failure;
                 for (i = 0; i < num_vfs; i++) {
-                        struct ifla_vf_info ivi;
-                        struct ifla_vf_mac vf_mac;
-                        struct ifla_vf_vlan vf_vlan;
-                        struct ifla_vf_rate vf_rate;
-                        struct ifla_vf_tx_rate vf_tx_rate;
-                        struct ifla_vf_spoofchk vf_spoofchk;
-                        struct ifla_vf_link_state vf_linkstate;
-                        struct ifla_vf_rss_query_en vf_rss_query_en;
-                        struct ifla_vf_stats vf_stats;
-                        struct ifla_vf_trust vf_trust;
-
-                        /*
-                         * Not all SR-IOV capable drivers support the
-                         * spoofcheck and "RSS query enable" query.  Preset to
-                         * -1 so the user space tool can detect that the driver
-                         * didn't report anything.
-                         */
-                        ivi.spoofchk = -1;
-                        ivi.rss_query_en = -1;
-                        ivi.trusted = -1;
-                        memset(ivi.mac, 0, sizeof(ivi.mac));
-                        /* The default value for VF link state is "auto"
-                         * IFLA_VF_LINK_STATE_AUTO which equals zero
-                         */
-                        ivi.linkstate = 0;
-                        if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
-                                break;
-                        vf_mac.vf =
-                                vf_vlan.vf =
-                                vf_rate.vf =
-                                vf_tx_rate.vf =
-                                vf_spoofchk.vf =
-                                vf_linkstate.vf =
-                                vf_rss_query_en.vf =
-                                vf_trust.vf = ivi.vf;
-
-                        memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
-                        vf_vlan.vlan = ivi.vlan;
-                        vf_vlan.qos = ivi.qos;
-                        vf_tx_rate.rate = ivi.max_tx_rate;
-                        vf_rate.min_tx_rate = ivi.min_tx_rate;
-                        vf_rate.max_tx_rate = ivi.max_tx_rate;
-                        vf_spoofchk.setting = ivi.spoofchk;
-                        vf_linkstate.link_state = ivi.linkstate;
-                        vf_rss_query_en.setting = ivi.rss_query_en;
-                        vf_trust.setting = ivi.trusted;
-                        vf = nla_nest_start(skb, IFLA_VF_INFO);
-                        if (!vf) {
-                                nla_nest_cancel(skb, vfinfo);
-                                goto nla_put_failure;
-                        }
-                        if (nla_put(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac) ||
-                            nla_put(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan) ||
-                            nla_put(skb, IFLA_VF_RATE, sizeof(vf_rate),
-                                    &vf_rate) ||
-                            nla_put(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate),
-                                    &vf_tx_rate) ||
-                            nla_put(skb, IFLA_VF_SPOOFCHK, sizeof(vf_spoofchk),
-                                    &vf_spoofchk) ||
-                            nla_put(skb, IFLA_VF_LINK_STATE, sizeof(vf_linkstate),
-                                    &vf_linkstate) ||
-                            nla_put(skb, IFLA_VF_RSS_QUERY_EN,
-                                    sizeof(vf_rss_query_en),
-                                    &vf_rss_query_en) ||
-                            nla_put(skb, IFLA_VF_TRUST,
-                                    sizeof(vf_trust), &vf_trust))
+                        if (rtnl_fill_vfinfo(skb, dev, i, vfinfo))
                                 goto nla_put_failure;
-                        memset(&vf_stats, 0, sizeof(vf_stats));
-                        if (dev->netdev_ops->ndo_get_vf_stats)
-                                dev->netdev_ops->ndo_get_vf_stats(dev, i,
-                                                                  &vf_stats);
-                        vfstats = nla_nest_start(skb, IFLA_VF_STATS);
-                        if (!vfstats) {
-                                nla_nest_cancel(skb, vf);
-                                nla_nest_cancel(skb, vfinfo);
-                                goto nla_put_failure;
-                        }
-                        if (nla_put_u64(skb, IFLA_VF_STATS_RX_PACKETS,
-                                        vf_stats.rx_packets) ||
-                            nla_put_u64(skb, IFLA_VF_STATS_TX_PACKETS,
-                                        vf_stats.tx_packets) ||
-                            nla_put_u64(skb, IFLA_VF_STATS_RX_BYTES,
-                                        vf_stats.rx_bytes) ||
-                            nla_put_u64(skb, IFLA_VF_STATS_TX_BYTES,
-                                        vf_stats.tx_bytes) ||
-                            nla_put_u64(skb, IFLA_VF_STATS_BROADCAST,
-                                        vf_stats.broadcast) ||
-                            nla_put_u64(skb, IFLA_VF_STATS_MULTICAST,
-                                        vf_stats.multicast))
-                                goto nla_put_failure;
-                        nla_nest_end(skb, vfstats);
-                        nla_nest_end(skb, vf);
                 }
+
                 nla_nest_end(skb, vfinfo);
         }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index aa41e6dd6429..152b9c70e252 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4268,7 +4268,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
                 return NULL;
         }
 
-        memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
+        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len,
+                2 * ETH_ALEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 1feb15f23de8..46b9c887bede 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -563,7 +563,7 @@ static void reqsk_timer_handler(unsigned long data)
         int max_retries, thresh;
         u8 defer_accept;
 
-        if (sk_listener->sk_state != TCP_LISTEN)
+        if (sk_state_load(sk_listener) != TCP_LISTEN)
                 goto drop;
 
         max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
@@ -749,7 +749,7 @@ int inet_csk_listen_start(struct sock *sk, int backlog)
          * It is OK, because this socket enters to hash table only
          * after validation is complete.
          */
-        sk->sk_state = TCP_LISTEN;
+        sk_state_store(sk, TCP_LISTEN);
         if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
                 inet->inet_sport = htons(inet->inet_num);
 
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 657d2307f031..b3ca21b2ba9b 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -45,7 +45,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
         struct net *net = nf_ct_net(ct);
         const struct nf_conn *master = ct->master;
         struct nf_conntrack_expect *other_exp;
-        struct nf_conntrack_tuple t;
+        struct nf_conntrack_tuple t = {};
         const struct nf_ct_pptp_master *ct_pptp_info;
         const struct nf_nat_pptp *nat_pptp_info;
         struct nf_nat_range range;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 8c0d0bdc2a7c..63e5be0abd86 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -406,10 +406,12 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
                         ip_select_ident(net, skb, NULL);
 
                 iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
+                skb->transport_header += iphlen;
+                if (iph->protocol == IPPROTO_ICMP &&
+                    length >= iphlen + sizeof(struct icmphdr))
+                        icmp_out_count(net, ((struct icmphdr *)
+                                skb_transport_header(skb))->type);
         }
-        if (iph->protocol == IPPROTO_ICMP)
-                icmp_out_count(net, ((struct icmphdr *)
-                        skb_transport_header(skb))->type);
 
         err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                       net, sk, skb, NULL, rt->dst.dev,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0cfa7c0c1e80..c1728771cf89 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -451,11 +451,14 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         unsigned int mask;
         struct sock *sk = sock->sk;
         const struct tcp_sock *tp = tcp_sk(sk);
+        int state;
 
         sock_rps_record_flow(sk);
 
         sock_poll_wait(file, sk_sleep(sk), wait);
-        if (sk->sk_state == TCP_LISTEN)
+
+        state = sk_state_load(sk);
+        if (state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
         /* Socket is not locked. We are protected from async events
@@ -492,14 +495,14 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
          * NOTE. Check for TCP_CLOSE is added. The goal is to prevent
          * blocking on fresh not-connected or disconnected socket. --ANK
          */
-        if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == TCP_CLOSE)
+        if (sk->sk_shutdown == SHUTDOWN_MASK || state == TCP_CLOSE)
                 mask |= POLLHUP;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
                 mask |= POLLIN | POLLRDNORM | POLLRDHUP;
 
         /* Connected or passive Fast Open socket? */
-        if (sk->sk_state != TCP_SYN_SENT &&
-            (sk->sk_state != TCP_SYN_RECV || tp->fastopen_rsk)) {
+        if (state != TCP_SYN_SENT &&
+            (state != TCP_SYN_RECV || tp->fastopen_rsk)) {
                 int target = sock_rcvlowat(sk, 0, INT_MAX);
 
                 if (tp->urg_seq == tp->copied_seq &&
@@ -507,9 +510,6 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                     tp->urg_data)
                         target++;
 
-                /* Potential race condition. If read of tp below will
-                 * escape above sk->sk_state, we can be illegally awaken
-                 * in SYN_* states. */
                 if (tp->rcv_nxt - tp->copied_seq >= target)
                         mask |= POLLIN | POLLRDNORM;
 
@@ -1934,7 +1934,7 @@ void tcp_set_state(struct sock *sk, int state)
         /* Change state AFTER socket is unhashed to avoid closed
          * socket sitting in hash tables.
          */
-        sk->sk_state = state;
+        sk_state_store(sk, state);
 
 #ifdef STATE_TRACE
         SOCK_DEBUG(sk, "TCP sk=%p, State %s -> %s\n", sk, statename[oldstate], statename[state]);
@@ -2644,7 +2644,8 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         if (sk->sk_type != SOCK_STREAM)
                 return;
 
-        info->tcpi_state = sk->sk_state;
+        info->tcpi_state = sk_state_load(sk);
+
         info->tcpi_ca_state = icsk->icsk_ca_state;
         info->tcpi_retransmits = icsk->icsk_retransmits;
         info->tcpi_probes = icsk->icsk_probes_out;
@@ -2672,7 +2673,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_snd_mss = tp->mss_cache;
         info->tcpi_rcv_mss = icsk->icsk_ack.rcv_mss;
 
-        if (sk->sk_state == TCP_LISTEN) {
+        if (info->tcpi_state == TCP_LISTEN) {
                 info->tcpi_unacked = sk->sk_ack_backlog;
                 info->tcpi_sacked = sk->sk_max_ack_backlog;
         } else {
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 479f34946177..b31604086edd 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -21,7 +21,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
 {
         struct tcp_info *info = _info;
 
-        if (sk->sk_state == TCP_LISTEN) {
+        if (sk_state_load(sk) == TCP_LISTEN) {
                 r->idiag_rqueue = sk->sk_ack_backlog;
                 r->idiag_wqueue = sk->sk_max_ack_backlog;
         } else if (sk->sk_type == SOCK_STREAM) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 950e28c0cdf2..ba09016d1bfd 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2158,6 +2158,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
         __u16 destp = ntohs(inet->inet_dport);
         __u16 srcp = ntohs(inet->inet_sport);
         int rx_queue;
+        int state;
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
@@ -2175,17 +2176,18 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
                 timer_expires = jiffies;
         }
 
-        if (sk->sk_state == TCP_LISTEN)
+        state = sk_state_load(sk);
+        if (state == TCP_LISTEN)
                 rx_queue = sk->sk_ack_backlog;
         else
-                /*
-                 * because we dont lock socket, we might find a transient negative value
+                /* Because we don't lock the socket,
+                 * we might find a transient negative value.
                  */
                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
 
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
                         "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
-                i, src, srcp, dest, destp, sk->sk_state,
+                i, src, srcp, dest, destp, state,
                 tp->write_seq - tp->snd_una,
                 rx_queue,
                 timer_active,
@@ -2199,8 +2201,8 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
                 jiffies_to_clock_t(icsk->icsk_ack.ato),
                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                 tp->snd_cwnd,
-                sk->sk_state == TCP_LISTEN ?
-                    (fastopenq ? fastopenq->max_qlen : 0) :
+                state == TCP_LISTEN ?
+                    fastopenq->max_qlen :
                     (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh));
 }
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 124338a39e29..5ee56d0a8699 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1651,7 +1651,6 @@ out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
         } else {
                 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
         }
@@ -2015,7 +2014,6 @@ out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS(net, idev, type);
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
         } else
                 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c8bc9b4ac328..6f01fe122abd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -404,6 +404,14 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         }
 }
 
+static bool __rt6_check_expired(const struct rt6_info *rt)
+{
+        if (rt->rt6i_flags & RTF_EXPIRES)
+                return time_after(jiffies, rt->dst.expires);
+        else
+                return false;
+}
+
 static bool rt6_check_expired(const struct rt6_info *rt)
 {
         if (rt->rt6i_flags & RTF_EXPIRES) {
@@ -1252,7 +1260,8 @@ static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie)
 
 static struct dst_entry *rt6_dst_from_check(struct rt6_info *rt, u32 cookie)
 {
-        if (rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
+        if (!__rt6_check_expired(rt) &&
+            rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
             rt6_check((struct rt6_info *)(rt->dst.from), cookie))
                 return &rt->dst;
         else
@@ -1272,7 +1281,8 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt6_dst_from_metrics_check(rt);
 
-        if ((rt->rt6i_flags & RTF_PCPU) || unlikely(dst->flags & DST_NOCACHE))
+        if (rt->rt6i_flags & RTF_PCPU ||
+            (unlikely(dst->flags & DST_NOCACHE) && rt->dst.from))
                 return rt6_dst_from_check(rt, cookie);
         else
                 return rt6_check(rt, cookie);
@@ -1322,6 +1332,12 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
         rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
 }
 
+static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
+{
+        return !(rt->rt6i_flags & RTF_CACHE) &&
+                (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node);
+}
+
 static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
                                  const struct ipv6hdr *iph, u32 mtu)
 {
@@ -1335,7 +1351,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
         if (mtu >= dst_mtu(dst))
                 return;
 
-        if (rt6->rt6i_flags & RTF_CACHE) {
+        if (!rt6_cache_allowed_for_pmtu(rt6)) {
                 rt6_do_update_pmtu(rt6, mtu);
         } else {
                 const struct in6_addr *daddr, *saddr;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5baa8e754e41..c5429a636f1a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1690,6 +1690,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
         const struct tcp_sock *tp = tcp_sk(sp);
         const struct inet_connection_sock *icsk = inet_csk(sp);
         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
+        int rx_queue;
+        int state;
 
         dest  = &sp->sk_v6_daddr;
         src   = &sp->sk_v6_rcv_saddr;
@@ -1710,6 +1712,15 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                 timer_expires = jiffies;
         }
 
+        state = sk_state_load(sp);
+        if (state == TCP_LISTEN)
+                rx_queue = sp->sk_ack_backlog;
+        else
+                /* Because we don't lock the socket,
+                 * we might find a transient negative value.
+                 */
+                rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
+
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
@@ -1718,9 +1729,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state,
-                   tp->write_seq-tp->snd_una,
-                   (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
+                   state,
+                   tp->write_seq - tp->snd_una,
+                   rx_queue,
                    timer_active,
                    jiffies_delta_to_clock_t(timer_expires - jiffies),
                    icsk->icsk_retransmits,
@@ -1732,7 +1743,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    jiffies_to_clock_t(icsk->icsk_ack.ato),
                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                    tp->snd_cwnd,
-                   sp->sk_state == TCP_LISTEN ?
+                   state == TCP_LISTEN ?
                         fastopenq->max_qlen :
                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
                    );
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index e22349ea7256..4692782b5280 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -869,7 +869,7 @@ config NETFILTER_XT_TARGET_TEE
         depends on IPV6 || IPV6=n
         depends on !NF_CONNTRACK || NF_CONNTRACK
         select NF_DUP_IPV4
-        select NF_DUP_IPV6 if IP6_NF_IPTABLES
+        select NF_DUP_IPV6 if IP6_NF_IPTABLES != n
         ---help---
         This option adds a "TEE" target with which a packet can be cloned and
         this clone be rerouted to another nexthop.
@@ -882,7 +882,7 @@ config NETFILTER_XT_TARGET_TPROXY
         depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
         depends on IP_NF_MANGLE
         select NF_DEFRAG_IPV4
-        select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
+        select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
         help
           This option adds a `TPROXY' target, which is somewhat similar to
           REDIRECT.  It can only be used in the mangle table and is useful
@@ -1375,7 +1375,7 @@ config NETFILTER_XT_MATCH_SOCKET
         depends on IPV6 || IPV6=n
         depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
         select NF_DEFRAG_IPV4
-        select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
+        select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
         help
           This option adds a `socket' match, which can be used to match
           packets for which a TCP or UDP socket lookup finds a valid socket.
diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
index d05e759ed0fa..b0bc475f641e 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -33,7 +33,7 @@
 #define mtype_gc                IPSET_TOKEN(MTYPE, _gc)
 #define mtype                   MTYPE
 
-#define get_ext(set, map, id)   ((map)->extensions + (set)->dsize * (id))
+#define get_ext(set, map, id)   ((map)->extensions + ((set)->dsize * (id)))
 
 static void
 mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set))
@@ -67,12 +67,9 @@ mtype_destroy(struct ip_set *set)
                 del_timer_sync(&map->gc);
 
         ip_set_free(map->members);
-        if (set->dsize) {
-                if (set->extensions & IPSET_EXT_DESTROY)
-                        mtype_ext_cleanup(set);
-                ip_set_free(map->extensions);
-        }
-        kfree(map);
+        if (set->dsize && set->extensions & IPSET_EXT_DESTROY)
+                mtype_ext_cleanup(set);
+        ip_set_free(map);
 
         set->data = NULL;
 }
@@ -92,16 +89,14 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)
 {
         const struct mtype *map = set->data;
         struct nlattr *nested;
+        size_t memsize = sizeof(*map) + map->memsize;
 
         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
         if (!nested)
                 goto nla_put_failure;
         if (mtype_do_head(skb, map) ||
             nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
-            nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
-                          htonl(sizeof(*map) +
-                                map->memsize +
-                                set->dsize * map->elements)))
+            nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)))
                 goto nla_put_failure;
         if (unlikely(ip_set_put_flags(skb, set)))
                 goto nla_put_failure;
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index 64a564334418..4783efff0bde 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -41,7 +41,6 @@ MODULE_ALIAS("ip_set_bitmap:ip");
 /* Type structure */
 struct bitmap_ip {
         void *members;          /* the set members */
-        void *extensions;       /* data extensions */
         u32 first_ip;           /* host byte order, included in range */
         u32 last_ip;            /* host byte order, included in range */
         u32 elements;           /* number of max elements in the set */
@@ -49,6 +48,8 @@ struct bitmap_ip {
         size_t memsize;         /* members size */
         u8 netmask;             /* subnet netmask */
         struct timer_list gc;   /* garbage collection */
+        unsigned char extensions[0]     /* data extensions */
+                __aligned(__alignof__(u64));
 };
 
 /* ADT structure for generic function args */
@@ -224,13 +225,6 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
         map->members = ip_set_alloc(map->memsize);
         if (!map->members)
                 return false;
-        if (set->dsize) {
-                map->extensions = ip_set_alloc(set->dsize * elements);
-                if (!map->extensions) {
-                        kfree(map->members);
-                        return false;
-                }
-        }
         map->first_ip = first_ip;
         map->last_ip = last_ip;
         map->elements = elements;
@@ -316,13 +310,13 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
         pr_debug("hosts %u, elements %llu\n",
                  hosts, (unsigned long long)elements);
 
-        map = kzalloc(sizeof(*map), GFP_KERNEL);
+        set->dsize = ip_set_elem_len(set, tb, 0, 0);
+        map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
         if (!map)
                 return -ENOMEM;
 
         map->memsize = bitmap_bytes(0, elements - 1);
         set->variant = &bitmap_ip;
-        set->dsize = ip_set_elem_len(set, tb, 0);
         if (!init_map_ip(set, map, first_ip, last_ip,
                          elements, hosts, netmask)) {
                 kfree(map);
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 1430535118fb..29dde208381d 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -47,24 +47,26 @@ enum {
 /* Type structure */
 struct bitmap_ipmac {
         void *members;          /* the set members */
-        void *extensions;       /* MAC + data extensions */
         u32 first_ip;           /* host byte order, included in range */
         u32 last_ip;            /* host byte order, included in range */
         u32 elements;           /* number of max elements in the set */
         size_t memsize;         /* members size */
         struct timer_list gc;   /* garbage collector */
+        unsigned char extensions[0]     /* MAC + data extensions */
+                __aligned(__alignof__(u64));
 };
 
 /* ADT structure for generic function args */
 struct bitmap_ipmac_adt_elem {
+        unsigned char ether[ETH_ALEN] __aligned(2);
         u16 id;
-        unsigned char *ether;
+        u16 add_mac;
 };
 
 struct bitmap_ipmac_elem {
         unsigned char ether[ETH_ALEN];
         unsigned char filled;
-} __attribute__ ((aligned));
+} __aligned(__alignof__(u64));
 
 static inline u32
 ip_to_id(const struct bitmap_ipmac *m, u32 ip)
@@ -72,11 +74,11 @@ ip_to_id(const struct bitmap_ipmac *m, u32 ip)
         return ip - m->first_ip;
 }
 
-static inline struct bitmap_ipmac_elem *
-get_elem(void *extensions, u16 id, size_t dsize)
-{
-        return (struct bitmap_ipmac_elem *)(extensions + id * dsize);
-}
+#define get_elem(extensions, id, dsize)         \
+        (struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))
+
+#define get_const_elem(extensions, id, dsize)   \
+        (const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))
 
 /* Common functions */
 
@@ -88,10 +90,9 @@ bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e,
 
         if (!test_bit(e->id, map->members))
                 return 0;
-        elem = get_elem(map->extensions, e->id, dsize);
-        if (elem->filled == MAC_FILLED)
-                return !e->ether ||
-                       ether_addr_equal(e->ether, elem->ether);
+        elem = get_const_elem(map->extensions, e->id, dsize);
+        if (e->add_mac && elem->filled == MAC_FILLED)
+                return ether_addr_equal(e->ether, elem->ether);
         /* Trigger kernel to fill out the ethernet address */
         return -EAGAIN;
 }
@@ -103,7 +104,7 @@ bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize)
 
         if (!test_bit(id, map->members))
                 return 0;
-        elem = get_elem(map->extensions, id, dsize);
+        elem = get_const_elem(map->extensions, id, dsize);
         /* Timer not started for the incomplete elements */
         return elem->filled == MAC_FILLED;
 }
@@ -133,7 +134,7 @@ bitmap_ipmac_add_timeout(unsigned long *timeout,
                  * and we can reuse it later when MAC is filled out,
                  * possibly by the kernel
                  */
-                if (e->ether)
+                if (e->add_mac)
                         ip_set_timeout_set(timeout, t);
                 else
                         *timeout = t;
@@ -150,7 +151,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
         elem = get_elem(map->extensions, e->id, dsize);
         if (test_bit(e->id, map->members)) {
                 if (elem->filled == MAC_FILLED) {
-                        if (e->ether &&
+                        if (e->add_mac &&
                             (flags & IPSET_FLAG_EXIST) &&
                             !ether_addr_equal(e->ether, elem->ether)) {
                                 /* memcpy isn't atomic */
@@ -159,7 +160,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
                                 ether_addr_copy(elem->ether, e->ether);
                         }
                         return IPSET_ADD_FAILED;
-                } else if (!e->ether)
+                } else if (!e->add_mac)
                         /* Already added without ethernet address */
                         return IPSET_ADD_FAILED;
                 /* Fill the MAC address and trigger the timer activation */
@@ -168,7 +169,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
                 ether_addr_copy(elem->ether, e->ether);
                 elem->filled = MAC_FILLED;
                 return IPSET_ADD_START_STORED_TIMEOUT;
-        } else if (e->ether) {
+        } else if (e->add_mac) {
                 /* We can store MAC too */
                 ether_addr_copy(elem->ether, e->ether);
                 elem->filled = MAC_FILLED;
@@ -191,7 +192,7 @@ bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map,
                      u32 id, size_t dsize)
 {
         const struct bitmap_ipmac_elem *elem =
-                get_elem(map->extensions, id, dsize);
+                get_const_elem(map->extensions, id, dsize);
 
         return nla_put_ipaddr4(skb, IPSET_ATTR_IP,
                                htonl(map->first_ip + id)) ||
@@ -213,7 +214,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 {
         struct bitmap_ipmac *map = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
-        struct bitmap_ipmac_adt_elem e = { .id = 0 };
+        struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
         u32 ip;
 
@@ -231,7 +232,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
                 return -EINVAL;
 
         e.id = ip_to_id(map, ip);
-        e.ether = eth_hdr(skb)->h_source;
+        memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
 
         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 }
@@ -265,11 +266,10 @@ bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
                 return -IPSET_ERR_BITMAP_RANGE;
 
         e.id = ip_to_id(map, ip);
-        if (tb[IPSET_ATTR_ETHER])
-                e.ether = nla_data(tb[IPSET_ATTR_ETHER]);
-        else
-                e.ether = NULL;
-
+        if (tb[IPSET_ATTR_ETHER]) {
+                memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
+                e.add_mac = 1;
+        }
         ret = adtfn(set, &e, &ext, &ext, flags);
 
         return ip_set_eexist(ret, flags) ? 0 : ret;
@@ -300,13 +300,6 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
         map->members = ip_set_alloc(map->memsize);
         if (!map->members)
                 return false;
-        if (set->dsize) {
-                map->extensions = ip_set_alloc(set->dsize * elements);
-                if (!map->extensions) {
-                        kfree(map->members);
-                        return false;
-                }
-        }
         map->first_ip = first_ip;
         map->last_ip = last_ip;
         map->elements = elements;
@@ -361,14 +354,15 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
         if (elements > IPSET_BITMAP_MAX_RANGE + 1)
                 return -IPSET_ERR_BITMAP_RANGE_SIZE;
 
-        map = kzalloc(sizeof(*map), GFP_KERNEL);
+        set->dsize = ip_set_elem_len(set, tb,
+                                     sizeof(struct bitmap_ipmac_elem),
+                                     __alignof__(struct bitmap_ipmac_elem));
+        map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
         if (!map)
                 return -ENOMEM;
 
         map->memsize = bitmap_bytes(0, elements - 1);
         set->variant = &bitmap_ipmac;
-        set->dsize = ip_set_elem_len(set, tb,
-                                     sizeof(struct bitmap_ipmac_elem));
         if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
                 kfree(map);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 5338ccd5da46..7f0c733358a4 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -35,12 +35,13 @@ MODULE_ALIAS("ip_set_bitmap:port");
 /* Type structure */
 struct bitmap_port {
         void *members;          /* the set members */
-        void *extensions;       /* data extensions */
         u16 first_port;         /* host byte order, included in range */
         u16 last_port;          /* host byte order, included in range */
         u32 elements;           /* number of max elements in the set */
         size_t memsize;         /* members size */
         struct timer_list gc;   /* garbage collection */
+        unsigned char extensions[0]     /* data extensions */
+                __aligned(__alignof__(u64));
 };
 
 /* ADT structure for generic function args */
@@ -209,13 +210,6 @@ init_map_port(struct ip_set *set, struct bitmap_port *map,
         map->members = ip_set_alloc(map->memsize);
         if (!map->members)
                 return false;
-        if (set->dsize) {
-                map->extensions = ip_set_alloc(set->dsize * map->elements);
-                if (!map->extensions) {
-                        kfree(map->members);
-                        return false;
-                }
-        }
         map->first_port = first_port;
         map->last_port = last_port;
         set->timeout = IPSET_NO_TIMEOUT;
@@ -232,6 +226,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
 {
         struct bitmap_port *map;
         u16 first_port, last_port;
+        u32 elements;
 
         if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT_TO) ||
@@ -248,14 +243,15 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
                 last_port = tmp;
         }
 
-        map = kzalloc(sizeof(*map), GFP_KERNEL);
+        elements = last_port - first_port + 1;
+        set->dsize = ip_set_elem_len(set, tb, 0, 0);
+        map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
         if (!map)
                 return -ENOMEM;
 
-        map->elements = last_port - first_port + 1;
+        map->elements = elements;
         map->memsize = bitmap_bytes(0, map->elements);
         set->variant = &bitmap_port;
-        set->dsize = ip_set_elem_len(set, tb, 0);
         if (!init_map_port(set, map, first_port, last_port)) {
                 kfree(map);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 69ab9c2634e1..54f3d7cb23e6 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -364,25 +364,27 @@ add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[])
 }
 
 size_t
-ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len)
+ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len,
+                size_t align)
 {
         enum ip_set_ext_id id;
-        size_t offset = len;
         u32 cadt_flags = 0;
 
         if (tb[IPSET_ATTR_CADT_FLAGS])
                 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
         if (cadt_flags & IPSET_FLAG_WITH_FORCEADD)
                 set->flags |= IPSET_CREATE_FLAG_FORCEADD;
+        if (!align)
+                align = 1;
         for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
                 if (!add_extension(id, cadt_flags, tb))
                         continue;
-                offset = ALIGN(offset, ip_set_extensions[id].align);
-                set->offset[id] = offset;
+                len = ALIGN(len, ip_set_extensions[id].align);
+                set->offset[id] = len;
                 set->extensions |= ip_set_extensions[id].type;
-                offset += ip_set_extensions[id].len;
+                len += ip_set_extensions[id].len;
         }
-        return offset;
+        return ALIGN(len, align);
 }
 EXPORT_SYMBOL_GPL(ip_set_elem_len);
 
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 691b54fcaf2a..e5336ab36d67 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -72,8 +72,9 @@ struct hbucket {
         DECLARE_BITMAP(used, AHASH_MAX_TUNED);
         u8 size;                /* size of the array */
         u8 pos;                 /* position of the first free entry */
-        unsigned char value[0]; /* the array of the values */
-} __attribute__ ((aligned));
+        unsigned char value[0]  /* the array of the values */
+                __aligned(__alignof__(u64));
+};
 
 /* The hash table: the table size stored here in order to make resizing easy */
 struct htable {
@@ -475,7 +476,7 @@ static void
 mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize)
 {
         struct htable *t;
-        struct hbucket *n;
+        struct hbucket *n, *tmp;
         struct mtype_elem *data;
         u32 i, j, d;
 #ifdef IP_SET_HASH_WITH_NETS
@@ -510,9 +511,14 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize)
                         }
                 }
                 if (d >= AHASH_INIT_SIZE) {
-                        struct hbucket *tmp = kzalloc(sizeof(*tmp) +
-                                        (n->size - AHASH_INIT_SIZE) * dsize,
-                                        GFP_ATOMIC);
+                        if (d >= n->size) {
+                                rcu_assign_pointer(hbucket(t, i), NULL);
+                                kfree_rcu(n, rcu);
+                                continue;
+                        }
+                        tmp = kzalloc(sizeof(*tmp) +
+                                      (n->size - AHASH_INIT_SIZE) * dsize,
+                                      GFP_ATOMIC);
                         if (!tmp)
                                 /* Still try to delete expired elements */
                                 continue;
@@ -522,7 +528,7 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize)
                                         continue;
                                 data = ahash_data(n, j, dsize);
                                 memcpy(tmp->value + d * dsize, data, dsize);
-                                set_bit(j, tmp->used);
+                                set_bit(d, tmp->used);
                                 d++;
                         }
                         tmp->pos = d;
@@ -1323,12 +1329,14 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 #endif
                 set->variant = &IPSET_TOKEN(HTYPE, 4_variant);
                 set->dsize = ip_set_elem_len(set, tb,
-                                sizeof(struct IPSET_TOKEN(HTYPE, 4_elem)));
+                        sizeof(struct IPSET_TOKEN(HTYPE, 4_elem)),
+                        __alignof__(struct IPSET_TOKEN(HTYPE, 4_elem)));
 #ifndef IP_SET_PROTO_UNDEF
         } else {
                 set->variant = &IPSET_TOKEN(HTYPE, 6_variant);
                 set->dsize = ip_set_elem_len(set, tb,
-                                sizeof(struct IPSET_TOKEN(HTYPE, 6_elem)));
+                        sizeof(struct IPSET_TOKEN(HTYPE, 6_elem)),
+                        __alignof__(struct IPSET_TOKEN(HTYPE, 6_elem)));
         }
 #endif
         if (tb[IPSET_ATTR_TIMEOUT]) {
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 5a30ce6e8c90..bbede95c9f68 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -31,7 +31,7 @@ struct set_elem {
         struct rcu_head rcu;
         struct list_head list;
         ip_set_id_t id;
-};
+} __aligned(__alignof__(u64));
 
 struct set_adt_elem {
         ip_set_id_t id;
@@ -618,7 +618,8 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
                 size = IP_SET_LIST_MIN_SIZE;
 
         set->variant = &set_variant;
-        set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem));
+        set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem),
+                                     __alignof__(struct set_elem));
         if (!init_list_set(net, set, size))
                 return -ENOMEM;
         if (tb[IPSET_ATTR_TIMEOUT]) {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 1e24fff53e4b..f57b4dcdb233 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1176,6 +1176,7 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
         struct ip_vs_protocol *pp;
         struct ip_vs_proto_data *pd;
         struct ip_vs_conn *cp;
+        struct sock *sk;
 
         EnterFunction(11);
 
@@ -1183,13 +1184,12 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
         if (skb->ipvs_property)
                 return NF_ACCEPT;
 
+        sk = skb_to_full_sk(skb);
         /* Bad... Do not break raw sockets */
-        if (unlikely(skb->sk != NULL && hooknum == NF_INET_LOCAL_OUT &&
+        if (unlikely(sk && hooknum == NF_INET_LOCAL_OUT &&
                      af == AF_INET)) {
-                struct sock *sk = skb->sk;
-                struct inet_sock *inet = inet_sk(skb->sk);
 
-                if (inet && sk->sk_family == PF_INET && inet->nodefrag)
+                if (sk->sk_family == PF_INET && inet_sk(sk)->nodefrag)
                         return NF_ACCEPT;
         }
 
@@ -1681,6 +1681,7 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
         struct ip_vs_conn *cp;
         int ret, pkts;
         int conn_reuse_mode;
+        struct sock *sk;
 
         /* Already marked as IPVS request or reply? */
         if (skb->ipvs_property)
@@ -1708,12 +1709,11 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
         ip_vs_fill_iph_skb(af, skb, false, &iph);
 
         /* Bad... Do not break raw sockets */
-        if (unlikely(skb->sk != NULL && hooknum == NF_INET_LOCAL_OUT &&
+        sk = skb_to_full_sk(skb);
+        if (unlikely(sk && hooknum == NF_INET_LOCAL_OUT &&
                      af == AF_INET)) {
-                struct sock *sk = skb->sk;
-                struct inet_sock *inet = inet_sk(skb->sk);
 
-                if (inet && sk->sk_family == PF_INET && inet->nodefrag)
+                if (sk->sk_family == PF_INET && inet_sk(sk)->nodefrag)
                         return NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 06eb48fceb42..740cce4685ac 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -825,7 +825,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
         struct net *net = sock_net(ctnl);
         struct nfnl_log_net *log = nfnl_log_pernet(net);
         int ret = 0;
-        u16 flags;
+        u16 flags = 0;
 
         if (nfula[NFULA_CFG_CMD]) {
                 u_int8_t pf = nfmsg->nfgen_family;
diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c
index 1067fb4c1ffa..c7808fc19719 100644
--- a/net/netfilter/nft_counter.c
+++ b/net/netfilter/nft_counter.c
@@ -47,27 +47,34 @@ static void nft_counter_eval(const struct nft_expr *expr,
         local_bh_enable();
 }
 
-static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr)
+static void nft_counter_fetch(const struct nft_counter_percpu __percpu *counter,
+                              struct nft_counter *total)
 {
-        struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
-        struct nft_counter_percpu *cpu_stats;
-        struct nft_counter total;
+        const struct nft_counter_percpu *cpu_stats;
         u64 bytes, packets;
         unsigned int seq;
         int cpu;
 
-        memset(&total, 0, sizeof(total));
+        memset(total, 0, sizeof(*total));
         for_each_possible_cpu(cpu) {
-                cpu_stats = per_cpu_ptr(priv->counter, cpu);
+                cpu_stats = per_cpu_ptr(counter, cpu);
                 do {
                         seq     = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
                         bytes   = cpu_stats->counter.bytes;
                         packets = cpu_stats->counter.packets;
                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
 
-                total.packets += packets;
-                total.bytes += bytes;
+                total->packets += packets;
+                total->bytes += bytes;
         }
+}
+
+static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr)
+{
+        struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
+        struct nft_counter total;
+
+        nft_counter_fetch(priv->counter, &total);
 
         if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes)) ||
             nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets)))
@@ -118,6 +125,31 @@ static void nft_counter_destroy(const struct nft_ctx *ctx,
         free_percpu(priv->counter);
 }
 
+static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src)
+{
+        struct nft_counter_percpu_priv *priv = nft_expr_priv(src);
+        struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst);
+        struct nft_counter_percpu __percpu *cpu_stats;
+        struct nft_counter_percpu *this_cpu;
+        struct nft_counter total;
+
+        nft_counter_fetch(priv->counter, &total);
+
+        cpu_stats = __netdev_alloc_pcpu_stats(struct nft_counter_percpu,
+                                              GFP_ATOMIC);
+        if (cpu_stats == NULL)
+                return ENOMEM;
+
+        preempt_disable();
+        this_cpu = this_cpu_ptr(cpu_stats);
+        this_cpu->counter.packets = total.packets;
+        this_cpu->counter.bytes = total.bytes;
+        preempt_enable();
+
+        priv_clone->counter = cpu_stats;
+        return 0;
+}
+
 static struct nft_expr_type nft_counter_type;
 static const struct nft_expr_ops nft_counter_ops = {
         .type           = &nft_counter_type,
@@ -126,6 +158,7 @@ static const struct nft_expr_ops nft_counter_ops = {
         .init           = nft_counter_init,
         .destroy        = nft_counter_destroy,
         .dump           = nft_counter_dump,
+        .clone          = nft_counter_clone,
 };
 
 static struct nft_expr_type nft_counter_type __read_mostly = {
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 513a8ef60a59..9dec3bd1b63c 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -50,8 +50,9 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
         }
 
         ext = nft_set_elem_ext(set, elem);
-        if (priv->expr != NULL)
-                nft_expr_clone(nft_set_ext_expr(ext), priv->expr);
+        if (priv->expr != NULL &&
+            nft_expr_clone(nft_set_ext_expr(ext), priv->expr) < 0)
+                return NULL;
 
         return elem;
 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index af399cac5205..1cf928fb573e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1741,6 +1741,20 @@ static void fanout_release(struct sock *sk)
                 kfree_rcu(po->rollover, rcu);
 }
 
+static bool packet_extra_vlan_len_allowed(const struct net_device *dev,
+                                          struct sk_buff *skb)
+{
+        /* Earlier code assumed this would be a VLAN pkt, double-check
+         * this now that we have the actual packet in hand. We can only
+         * do this check on Ethernet devices.
+         */
+        if (unlikely(dev->type != ARPHRD_ETHER))
+                return false;
+
+        skb_reset_mac_header(skb);
+        return likely(eth_hdr(skb)->h_proto == htons(ETH_P_8021Q));
+}
+
 static const struct proto_ops packet_ops;
 
 static const struct proto_ops packet_ops_spkt;
@@ -1902,18 +1916,10 @@ retry:
                 goto retry;
         }
 
-        if (len > (dev->mtu + dev->hard_header_len + extra_len)) {
-                /* Earlier code assumed this would be a VLAN pkt,
-                 * double-check this now that we have the actual
-                 * packet in hand.
-                 */
-                struct ethhdr *ehdr;
-                skb_reset_mac_header(skb);
-                ehdr = eth_hdr(skb);
-                if (ehdr->h_proto != htons(ETH_P_8021Q)) {
-                        err = -EMSGSIZE;
-                        goto out_unlock;
-                }
+        if (len > (dev->mtu + dev->hard_header_len + extra_len) &&
+            !packet_extra_vlan_len_allowed(dev, skb)) {
+                err = -EMSGSIZE;
+                goto out_unlock;
         }
 
         skb->protocol = proto;
@@ -2332,6 +2338,15 @@ static bool ll_header_truncated(const struct net_device *dev, int len)
         return false;
 }
 
+static void tpacket_set_protocol(const struct net_device *dev,
+                                 struct sk_buff *skb)
+{
+        if (dev->type == ARPHRD_ETHER) {
+                skb_reset_mac_header(skb);
+                skb->protocol = eth_hdr(skb)->h_proto;
+        }
+}
+
 static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
                 void *frame, struct net_device *dev, int size_max,
                 __be16 proto, unsigned char *addr, int hlen)
@@ -2368,8 +2383,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
 
-        if (!packet_use_direct_xmit(po))
-                skb_probe_transport_header(skb, 0);
         if (unlikely(po->tp_tx_has_off)) {
                 int off_min, off_max, off;
                 off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll);
@@ -2415,6 +2428,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
                                 dev->hard_header_len);
                 if (unlikely(err))
                         return err;
+                if (!skb->protocol)
+                        tpacket_set_protocol(dev, skb);
 
                 data += dev->hard_header_len;
                 to_write -= dev->hard_header_len;
@@ -2449,6 +2464,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
                 len = ((to_write > len_max) ? len_max : to_write);
         }
 
+        skb_probe_transport_header(skb, 0);
+
         return tp_len;
 }
 
@@ -2493,12 +2510,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
-        reserve = dev->hard_header_len + VLAN_HLEN;
+        if (po->sk.sk_socket->type == SOCK_RAW)
+                reserve = dev->hard_header_len;
         size_max = po->tx_ring.frame_size
                 - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
 
-        if (size_max > dev->mtu + reserve)
-                size_max = dev->mtu + reserve;
+        if (size_max > dev->mtu + reserve + VLAN_HLEN)
+                size_max = dev->mtu + reserve + VLAN_HLEN;
 
         do {
                 ph = packet_current_frame(po, &po->tx_ring,
@@ -2525,18 +2543,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
                                           addr, hlen);
                 if (likely(tp_len >= 0) &&
-                    tp_len > dev->mtu + dev->hard_header_len) {
-                        struct ethhdr *ehdr;
-                        /* Earlier code assumed this would be a VLAN pkt,
-                         * double-check this now that we have the actual
-                         * packet in hand.
-                         */
+                    tp_len > dev->mtu + reserve &&
+                    !packet_extra_vlan_len_allowed(dev, skb))
+                        tp_len = -EMSGSIZE;
 
-                        skb_reset_mac_header(skb);
-                        ehdr = eth_hdr(skb);
-                        if (ehdr->h_proto != htons(ETH_P_8021Q))
-                                tp_len = -EMSGSIZE;
-                }
                 if (unlikely(tp_len < 0)) {
                         if (po->tp_loss) {
                                 __packet_set_status(po, ph,
@@ -2765,18 +2775,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
         sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
 
-        if (!gso_type && (len > dev->mtu + reserve + extra_len)) {
-                /* Earlier code assumed this would be a VLAN pkt,
-                 * double-check this now that we have the actual
-                 * packet in hand.
-                 */
-                struct ethhdr *ehdr;
-                skb_reset_mac_header(skb);
-                ehdr = eth_hdr(skb);
-                if (ehdr->h_proto != htons(ETH_P_8021Q)) {
-                        err = -EMSGSIZE;
-                        goto out_free;
-                }
+        if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
+            !packet_extra_vlan_len_allowed(dev, skb)) {
+                err = -EMSGSIZE;
+                goto out_free;
         }
 
         skb->protocol = proto;
@@ -2807,8 +2809,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 len += vnet_hdr_len;
         }
 
-        if (!packet_use_direct_xmit(po))
-                skb_probe_transport_header(skb, reserve);
+        skb_probe_transport_header(skb, reserve);
+
         if (unlikely(extra_len == 4))
                 skb->no_fcs = 1;
 
@@ -4107,7 +4109,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 err = -EINVAL;
                 if (unlikely((int)req->tp_block_size <= 0))
                         goto out;
-                if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
+                if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
                         goto out;
                 if (po->tp_version >= TPACKET_V3 &&
                     (int)(req->tp_block_size -
@@ -4119,8 +4121,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
                         goto out;
 
-                rb->frames_per_block = req->tp_block_size/req->tp_frame_size;
-                if (unlikely(rb->frames_per_block <= 0))
+                rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
+                if (unlikely(rb->frames_per_block == 0))
                         goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 4f15b7d730e1..1543e39f47c3 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -809,8 +809,8 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
         if (!has_sha1)
                 return -EINVAL;
 
-        memcpy(ep->auth_hmacs_list->hmac_ids, &hmacs->shmac_idents[0],
-                hmacs->shmac_num_idents * sizeof(__u16));
+        for (i = 0; i < hmacs->shmac_num_idents; i++)
+                ep->auth_hmacs_list->hmac_ids[i] = htons(hmacs->shmac_idents[i]);
         ep->auth_hmacs_list->param_hdr.length = htons(sizeof(sctp_paramhdr_t) +
                                 hmacs->shmac_num_idents * sizeof(__u16));
         return 0;
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 229956bf8457..95f82d8d4888 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -353,12 +353,20 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
 {
         struct rpc_xprt *xprt = req->rq_xprt;
         struct svc_serv *bc_serv = xprt->bc_serv;
+        struct xdr_buf *rq_rcv_buf = &req->rq_rcv_buf;
 
         spin_lock(&xprt->bc_pa_lock);
         list_del(&req->rq_bc_pa_list);
         xprt_dec_alloc_count(xprt, 1);
         spin_unlock(&xprt->bc_pa_lock);
 
+        if (copied <= rq_rcv_buf->head[0].iov_len) {
+                rq_rcv_buf->head[0].iov_len = copied;
+                rq_rcv_buf->page_len = 0;
+        } else {
+                rq_rcv_buf->page_len = copied - rq_rcv_buf->head[0].iov_len;
+        }
+
         req->rq_private_buf.len = copied;
         set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index bc5b7b5032ca..7fccf9675df8 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1363,6 +1363,7 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
         memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
         memcpy(&rqstp->rq_arg, &req->rq_rcv_buf, sizeof(rqstp->rq_arg));
         memcpy(&rqstp->rq_res, &req->rq_snd_buf, sizeof(rqstp->rq_res));
+        rqstp->rq_arg.len = req->rq_private_buf.len;
 
         /* reset result send buffer "put" position */
         resv->iov_len = 0;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index aaa0b58d6aba..955ec152cb71 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -441,6 +441,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
                 if (state == TCP_LISTEN)
                         unix_release_sock(skb->sk, 1);
                 /* passed fds are erased in the kfree_skb hook        */
+                UNIXCB(skb).consumed = skb->len;
                 kfree_skb(skb);
         }
 
@@ -1799,6 +1800,7 @@ alloc_skb:
                  * this - does no harm
                  */
                 consume_skb(newskb);
+                newskb = NULL;
         }
 
         if (skb_append_pagefrags(skb, page, offset, size)) {
@@ -1811,8 +1813,11 @@ alloc_skb:
         skb->truesize += size;
         atomic_add(size, &sk->sk_wmem_alloc);
 
-        if (newskb)
+        if (newskb) {
+                spin_lock(&other->sk_receive_queue.lock);
                 __skb_queue_tail(&other->sk_receive_queue, newskb);
+                spin_unlock(&other->sk_receive_queue.lock);
+        }
 
         unix_state_unlock(other);
         mutex_unlock(&unix_sk(other)->readlock);
@@ -2072,6 +2077,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
 
         do {
                 int chunk;
+                bool drop_skb;
                 struct sk_buff *skb, *last;
 
                 unix_state_lock(sk);
@@ -2152,7 +2158,11 @@ unlock:
                 }
 
                 chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
+                skb_get(skb);
                 chunk = state->recv_actor(skb, skip, chunk, state);
+                drop_skb = !unix_skb_len(skb);
+                /* skb is only safe to use if !drop_skb */
+                consume_skb(skb);
                 if (chunk < 0) {
                         if (copied == 0)
                                 copied = -EFAULT;
@@ -2161,6 +2171,18 @@ unlock:
                 copied += chunk;
                 size -= chunk;
 
+                if (drop_skb) {
+                        /* the skb was touched by a concurrent reader;
+                         * we should not expect anything from this skb
+                         * anymore and assume it invalid - we can be
+                         * sure it was dropped from the socket queue
+                         *
+                         * let's report a short read
+                         */
+                        err = 0;
+                        break;
+                }
+
                 /* Mark read part of skb as used */
                 if (!(flags & MSG_PEEK)) {
                         UNIXCB(skb).consumed += chunk;
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 79b4596b5f9a..edd638b5825f 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -67,10 +67,13 @@ HOSTLOADLIBES_lathist += -lelf
 # point this to your LLVM backend with bpf support
 LLC=$(srctree)/tools/bpf/llvm/bld/Debug+Asserts/bin/llc
 
+# asm/sysreg.h inline assmbly used by it is incompatible with llvm.
+# But, ehere is not easy way to fix it, so just exclude it since it is
+# useless for BPF samples.
 $(obj)/%.o: $(src)/%.c
         clang $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS) \
-                -D__KERNEL__ -Wno-unused-value -Wno-pointer-sign \
+                -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \
                 -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
         clang $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS) \
-                -D__KERNEL__ -Wno-unused-value -Wno-pointer-sign \
+                -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \
                 -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=asm -o $@.s
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 125b906cd1d4..638a38e1b419 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -2711,7 +2711,7 @@ $kernelversion = get_kernel_version();
 
 # generate a sequence of code that will splice in highlighting information
 # using the s// operator.
-foreach my $k (keys @highlights) {
+for (my $k = 0; $k < @highlights; $k++) {
     my $pattern = $highlights[$k][0];
     my $result = $highlights[$k][1];
 #   print STDERR "scanning pattern:$pattern, highlight:($result)\n";
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 927db9f35ad6..696ccfa08d10 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -845,6 +845,8 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
         size_t datalen = prep->datalen;
         int ret = 0;
 
+        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+                return -ENOKEY;
         if (datalen <= 0 || datalen > 32767 || !prep->data)
                 return -EINVAL;
 
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 903dace648a1..16dec53184b6 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1007,13 +1007,16 @@ static void trusted_rcu_free(struct rcu_head *rcu)
  */
 static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
 {
-        struct trusted_key_payload *p = key->payload.data[0];
+        struct trusted_key_payload *p;
         struct trusted_key_payload *new_p;
         struct trusted_key_options *new_o;
         size_t datalen = prep->datalen;
         char *datablob;
         int ret = 0;
 
+        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+                return -ENOKEY;
+        p = key->payload.data[0];
         if (!p->migratable)
                 return -EPERM;
         if (datalen <= 0 || datalen > 32767 || !prep->data)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 28cb30f80256..8705d79b2c6f 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -120,7 +120,10 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
 
         if (ret == 0) {
                 /* attach the new data, displacing the old */
-                zap = key->payload.data[0];
+                if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+                        zap = key->payload.data[0];
+                else
+                        zap = NULL;
                 rcu_assign_keypointer(key, upayload);
                 key->expiry = 0;
         }
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 18643bf9894d..456e1a9bcfde 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -638,7 +638,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
 {
         struct avtab_node *node;
 
-        if (!ctab || !key || !avd || !xperms)
+        if (!ctab || !key || !avd)
                 return;
 
         for (node = avtab_search_node(ctab, key); node;
@@ -657,7 +657,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
                         avd->auditallow |= node->datum.u.data;
-                if ((node->key.specified & AVTAB_ENABLED) &&
+                if (xperms && (node->key.specified & AVTAB_ENABLED) &&
                                 (node->key.specified & AVTAB_XPERMS))
                         services_compute_xperms_drivers(xperms, node);
         }
diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
index 5d99436dfcae..0cda05c72f50 100644
--- a/sound/firewire/dice/dice.c
+++ b/sound/firewire/dice/dice.c
@@ -12,9 +12,11 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
 MODULE_LICENSE("GPL v2");
 
 #define OUI_WEISS               0x001c6a
+#define OUI_LOUD                0x000ff2
 
 #define DICE_CATEGORY_ID        0x04
 #define WEISS_CATEGORY_ID       0x00
+#define LOUD_CATEGORY_ID        0x10
 
 static int dice_interface_check(struct fw_unit *unit)
 {
@@ -57,6 +59,8 @@ static int dice_interface_check(struct fw_unit *unit)
         }
         if (vendor == OUI_WEISS)
                 category = WEISS_CATEGORY_ID;
+        else if (vendor == OUI_LOUD)
+                category = LOUD_CATEGORY_ID;
         else
                 category = DICE_CATEGORY_ID;
         if (device->config_rom[3] != ((vendor << 8) | category) ||
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8a7fbdcb4072..963f82430938 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -312,6 +312,10 @@ enum {
         (AZX_DCAPS_INTEL_PCH | AZX_DCAPS_SEPARATE_STREAM_TAG |\
          AZX_DCAPS_I915_POWERWELL)
 
+#define AZX_DCAPS_INTEL_BROXTON \
+        (AZX_DCAPS_INTEL_PCH | AZX_DCAPS_SEPARATE_STREAM_TAG |\
+         AZX_DCAPS_I915_POWERWELL)
+
 /* quirks for ATI SB / AMD Hudson */
 #define AZX_DCAPS_PRESET_ATI_SB \
         (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB |\
@@ -2124,6 +2128,9 @@ static const struct pci_device_id azx_ids[] = {
         /* Sunrise Point-LP */
         { PCI_DEVICE(0x8086, 0x9d70),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+        /* Broxton-P(Apollolake) */
+        { PCI_DEVICE(0x8086, 0x5a98),
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
         /* Haswell */
         { PCI_DEVICE(0x8086, 0x0a0c),
           .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 60cd9e700909..bdb6f226d006 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2378,7 +2378,8 @@ static int patch_generic_hdmi(struct hda_codec *codec)
          * can cover the codec power request, and so need not set this flag.
          * For previous platforms, there is no such power well feature.
          */
-        if (is_valleyview_plus(codec) || is_skylake(codec))
+        if (is_valleyview_plus(codec) || is_skylake(codec) ||
+                        is_broxton(codec))
                 codec->core.link_power_control = 1;
 
         if (is_haswell_plus(codec) || is_valleyview_plus(codec)) {
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 2f7b065f9ac4..9bedf7c85e29 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1759,6 +1759,7 @@ enum {
         ALC882_FIXUP_NO_PRIMARY_HP,
         ALC887_FIXUP_ASUS_BASS,
         ALC887_FIXUP_BASS_CHMAP,
+        ALC882_FIXUP_DISABLE_AAMIX,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1920,6 +1921,8 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
 
 static void alc_fixup_bass_chmap(struct hda_codec *codec,
                                  const struct hda_fixup *fix, int action);
+static void alc_fixup_disable_aamix(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action);
 
 static const struct hda_fixup alc882_fixups[] = {
         [ALC882_FIXUP_ABIT_AW9D_MAX] = {
@@ -2151,6 +2154,10 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_bass_chmap,
         },
+        [ALC882_FIXUP_DISABLE_AAMIX] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_disable_aamix,
+        },
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2218,6 +2225,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1458, 0xa182, "Gigabyte Z170X-UD3", ALC882_FIXUP_DISABLE_AAMIX),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -4587,6 +4595,7 @@ enum {
         ALC292_FIXUP_DISABLE_AAMIX,
         ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC275_FIXUP_DELL_XPS,
+        ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5167,6 +5176,17 @@ static const struct hda_fixup alc269_fixups[] = {
                         {}
                 }
         },
+        [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        /* Disable pass-through path for FRONT 14h */
+                        {0x20, AC_VERB_SET_COEF_INDEX, 0x36},
+                        {0x20, AC_VERB_SET_PROC_COEF, 0x1737},
+                        {}
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5180,8 +5200,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
         SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
         SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+        SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+        SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
         SND_PCI_QUIRK(0x1028, 0x05ca, "Dell Latitude E7240", ALC292_FIXUP_DELL_E7X),
         SND_PCI_QUIRK(0x1028, 0x05cb, "Dell Latitude E7440", ALC292_FIXUP_DELL_E7X),
         SND_PCI_QUIRK(0x1028, 0x05da, "Dell Vostro 5460", ALC290_FIXUP_SUBWOOFER),
@@ -5204,6 +5226,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
         SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
         SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+        SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 826122d8acee..2c7c5eb8b1e9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -3110,6 +3110,29 @@ static void stac92hd71bxx_fixup_hp_hdx(struct hda_codec *codec,
         spec->gpio_led = 0x08;
 }
 
+static bool is_hp_output(struct hda_codec *codec, hda_nid_t pin)
+{
+        unsigned int pin_cfg = snd_hda_codec_get_pincfg(codec, pin);
+
+        /* count line-out, too, as BIOS sets often so */
+        return get_defcfg_connect(pin_cfg) != AC_JACK_PORT_NONE &&
+                (get_defcfg_device(pin_cfg) == AC_JACK_LINE_OUT ||
+                 get_defcfg_device(pin_cfg) == AC_JACK_HP_OUT);
+}
+
+static void fixup_hp_headphone(struct hda_codec *codec, hda_nid_t pin)
+{
+        unsigned int pin_cfg = snd_hda_codec_get_pincfg(codec, pin);
+
+        /* It was changed in the BIOS to just satisfy MS DTM.
+         * Lets turn it back into slaved HP
+         */
+        pin_cfg = (pin_cfg & (~AC_DEFCFG_DEVICE)) |
+                (AC_JACK_HP_OUT << AC_DEFCFG_DEVICE_SHIFT);
+        pin_cfg = (pin_cfg & (~(AC_DEFCFG_DEF_ASSOC | AC_DEFCFG_SEQUENCE))) |
+                0x1f;
+        snd_hda_codec_set_pincfg(codec, pin, pin_cfg);
+}
 
 static void stac92hd71bxx_fixup_hp(struct hda_codec *codec,
                                    const struct hda_fixup *fix, int action)
@@ -3119,22 +3142,12 @@ static void stac92hd71bxx_fixup_hp(struct hda_codec *codec,
         if (action != HDA_FIXUP_ACT_PRE_PROBE)
                 return;
 
-        if (hp_blike_system(codec->core.subsystem_id)) {
-                unsigned int pin_cfg = snd_hda_codec_get_pincfg(codec, 0x0f);
-                if (get_defcfg_device(pin_cfg) == AC_JACK_LINE_OUT ||
-                        get_defcfg_device(pin_cfg) == AC_JACK_SPEAKER  ||
-                        get_defcfg_device(pin_cfg) == AC_JACK_HP_OUT) {
-                        /* It was changed in the BIOS to just satisfy MS DTM.
-                         * Lets turn it back into slaved HP
-                         */
-                        pin_cfg = (pin_cfg & (~AC_DEFCFG_DEVICE))
-                                        | (AC_JACK_HP_OUT <<
-                                                AC_DEFCFG_DEVICE_SHIFT);
-                        pin_cfg = (pin_cfg & (~(AC_DEFCFG_DEF_ASSOC
-                                                        | AC_DEFCFG_SEQUENCE)))
-                                                                | 0x1f;
-                        snd_hda_codec_set_pincfg(codec, 0x0f, pin_cfg);
-                }
+        /* when both output A and F are assigned, these are supposedly
+         * dock and built-in headphones; fix both pin configs
+         */
+        if (is_hp_output(codec, 0x0a) && is_hp_output(codec, 0x0f)) {
+                fixup_hp_headphone(codec, 0x0a);
+                fixup_hp_headphone(codec, 0x0f);
         }
 
         if (find_mute_led_cfg(codec, 1))
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 7661616f3636..5b4c58c3e2c5 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -174,6 +174,8 @@ struct snd_usb_midi_in_endpoint {
                 u8 running_status_length;
         } ports[0x10];
         u8 seen_f5;
+        bool in_sysex;
+        u8 last_cin;
         u8 error_resubmit;
         int current_port;
 };
@@ -468,6 +470,39 @@ static void snd_usbmidi_maudio_broken_running_status_input(
 }
 
 /*
+ * QinHeng CH345 is buggy: every second packet inside a SysEx has not CIN 4
+ * but the previously seen CIN, but still with three data bytes.
+ */
+static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep,
+                                     uint8_t *buffer, int buffer_length)
+{
+        unsigned int i, cin, length;
+
+        for (i = 0; i + 3 < buffer_length; i += 4) {
+                if (buffer[i] == 0 && i > 0)
+                        break;
+                cin = buffer[i] & 0x0f;
+                if (ep->in_sysex &&
+                    cin == ep->last_cin &&
+                    (buffer[i + 1 + (cin == 0x6)] & 0x80) == 0)
+                        cin = 0x4;
+#if 0
+                if (buffer[i + 1] == 0x90) {
+                        /*
+                         * Either a corrupted running status or a real note-on
+                         * message; impossible to detect reliably.
+                         */
+                }
+#endif
+                length = snd_usbmidi_cin_length[cin];
+                snd_usbmidi_input_data(ep, 0, &buffer[i + 1], length);
+                ep->in_sysex = cin == 0x4;
+                if (!ep->in_sysex)
+                        ep->last_cin = cin;
+        }
+}
+
+/*
  * CME protocol: like the standard protocol, but SysEx commands are sent as a
  * single USB packet preceded by a 0x0F byte.
  */
@@ -660,6 +695,12 @@ static struct usb_protocol_ops snd_usbmidi_cme_ops = {
         .output_packet = snd_usbmidi_output_standard_packet,
 };
 
+static struct usb_protocol_ops snd_usbmidi_ch345_broken_sysex_ops = {
+        .input = ch345_broken_sysex_input,
+        .output = snd_usbmidi_standard_output,
+        .output_packet = snd_usbmidi_output_standard_packet,
+};
+
 /*
  * AKAI MPD16 protocol:
  *
@@ -1341,6 +1382,7 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi *umidi,
                  * Various chips declare a packet size larger than 4 bytes, but
                  * do not actually work with larger packets:
                  */
+        case USB_ID(0x0a67, 0x5011): /* Medeli DD305 */
         case USB_ID(0x0a92, 0x1020): /* ESI M4U */
         case USB_ID(0x1430, 0x474b): /* RedOctane GH MIDI INTERFACE */
         case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */
@@ -2378,6 +2420,10 @@ int snd_usbmidi_create(struct snd_card *card,
 
                 err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
                 break;
+        case QUIRK_MIDI_CH345:
+                umidi->usb_protocol_ops = &snd_usbmidi_ch345_broken_sysex_ops;
+                err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
+                break;
         default:
                 dev_err(&umidi->dev->dev, "invalid quirk type %d\n",
                         quirk->type);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 1a1e2e4df35e..c60a776e815d 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2829,6 +2829,17 @@ YAMAHA_DEVICE(0x7010, "UB99"),
         .idProduct = 0x1020,
 },
 
+/* QinHeng devices */
+{
+        USB_DEVICE(0x1a86, 0x752d),
+        .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+                .vendor_name = "QinHeng",
+                .product_name = "CH345",
+                .ifnum = 1,
+                .type = QUIRK_MIDI_CH345
+        }
+},
+
 /* KeithMcMillen Stringport */
 {
         USB_DEVICE(0x1f38, 0x0001),
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 5ca80e7d30cd..7016ad898187 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -538,6 +538,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip,
                 [QUIRK_MIDI_CME] = create_any_midi_quirk,
                 [QUIRK_MIDI_AKAI] = create_any_midi_quirk,
                 [QUIRK_MIDI_FTDI] = create_any_midi_quirk,
+                [QUIRK_MIDI_CH345] = create_any_midi_quirk,
                 [QUIRK_AUDIO_STANDARD_INTERFACE] = create_standard_audio_quirk,
                 [QUIRK_AUDIO_FIXED_ENDPOINT] = create_fixed_stream_quirk,
                 [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk,
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index 15a12715bd05..b665d85555cb 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -95,6 +95,7 @@ enum quirk_type {
         QUIRK_MIDI_AKAI,
         QUIRK_MIDI_US122L,
         QUIRK_MIDI_FTDI,
+        QUIRK_MIDI_CH345,
         QUIRK_AUDIO_STANDARD_INTERFACE,
         QUIRK_AUDIO_FIXED_ENDPOINT,
         QUIRK_AUDIO_EDIROL_UAXX,
diff --git a/tools/Makefile b/tools/Makefile
index d6f307dfb1a3..7dc820a8c1f1 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -32,6 +32,10 @@ help:
         @echo '  from the kernel command line to build and install one of'
         @echo '  the tools above'
         @echo ''
+        @echo '  $$ make tools/all'
+        @echo ''
+        @echo '  builds all tools.'
+        @echo ''
         @echo '  $$ make tools/install'
         @echo ''
         @echo '  installs all tools.'
@@ -77,6 +81,11 @@ tmon: FORCE
 freefall: FORCE
         $(call descend,laptop/$@)
 
+all: acpi cgroup cpupower hv firewire lguest \
+                perf selftests turbostat usb \
+                virtio vm net x86_energy_perf_policy \
+                tmon freefall
+
 acpi_install:
         $(call descend,power/$(@:_install=),install)
 
@@ -101,7 +110,7 @@ freefall_install:
 install: acpi_install cgroup_install cpupower_install hv_install firewire_install lguest_install \
                 perf_install selftests_install turbostat_install usb_install \
                 virtio_install vm_install net_install x86_energy_perf_policy_install \
-                tmon freefall_install
+                tmon_install freefall_install
 
 acpi_clean:
         $(call descend,power/acpi,clean)
diff --git a/tools/net/Makefile b/tools/net/Makefile
index ee577ea03ba5..ddf888010652 100644
--- a/tools/net/Makefile
+++ b/tools/net/Makefile
@@ -4,6 +4,9 @@ CC = gcc
 LEX = flex
 YACC = bison
 
+CFLAGS += -Wall -O2
+CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
+
 %.yacc.c: %.y
         $(YACC) -o $@ -d $<
 
@@ -12,15 +15,13 @@ YACC = bison
 
 all : bpf_jit_disasm bpf_dbg bpf_asm
 
-bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm'
+bpf_jit_disasm : CFLAGS += -DPACKAGE='bpf_jit_disasm'
 bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
 bpf_jit_disasm : bpf_jit_disasm.o
 
-bpf_dbg : CFLAGS = -Wall -O2
 bpf_dbg : LDLIBS = -lreadline
 bpf_dbg : bpf_dbg.o
 
-bpf_asm : CFLAGS = -Wall -O2 -I.
 bpf_asm : LDLIBS =
 bpf_asm : bpf_asm.o bpf_exp.yacc.o bpf_exp.lex.o
 bpf_exp.lex.o : bpf_exp.yacc.c
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 0a945d2e8ca5..99d127fe9c35 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -675,6 +675,7 @@ int cmd_inject(int argc, const char **argv, const char *prefix __maybe_unused)
                         .fork           = perf_event__repipe,
                         .exit           = perf_event__repipe,
                         .lost           = perf_event__repipe,
+                        .lost_samples   = perf_event__repipe,
                         .aux            = perf_event__repipe,
                         .itrace_start   = perf_event__repipe,
                         .context_switch = perf_event__repipe,
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 2853ad2bd435..f256fac1e722 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -44,7 +44,7 @@
 struct report {
         struct perf_tool        tool;
         struct perf_session     *session;
-        bool                    force, use_tui, use_gtk, use_stdio;
+        bool                    use_tui, use_gtk, use_stdio;
         bool                    hide_unresolved;
         bool                    dont_use_callchains;
         bool                    show_full_info;
@@ -678,7 +678,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
                    "file", "vmlinux pathname"),
         OPT_STRING(0, "kallsyms", &symbol_conf.kallsyms_name,
                    "file", "kallsyms pathname"),
-        OPT_BOOLEAN('f', "force", &report.force, "don't complain, do it"),
+        OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
         OPT_BOOLEAN('m', "modules", &symbol_conf.use_modules,
                     "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
@@ -832,7 +832,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
         }
 
         file.path  = input_name;
-        file.force = report.force;
+        file.force = symbol_conf.force;
 
 repeat:
         session = perf_session__new(&file, false, &report.tool);
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index e5afb8936040..fa9eb92c9e24 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1430,7 +1430,6 @@ close_file_and_continue:
 
 struct popup_action {
         struct thread           *thread;
-        struct dso              *dso;
         struct map_symbol       ms;
         int                     socket;
 
@@ -1565,7 +1564,6 @@ add_dso_opt(struct hist_browser *browser, struct popup_action *act,
                 return 0;
 
         act->ms.map = map;
-        act->dso = map->dso;
         act->fn = do_zoom_dso;
         return 1;
 }
@@ -1827,7 +1825,6 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
         while (1) {
                 struct thread *thread = NULL;
-                struct dso *dso = NULL;
                 struct map *map = NULL;
                 int choice = 0;
                 int socked_id = -1;
@@ -1839,8 +1836,6 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
                         map = browser->selection->map;
-                        if (map)
-                                dso = map->dso;
                         socked_id = browser->he_selection->socket;
                 }
                 switch (key) {
@@ -1874,7 +1869,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                         hist_browser__dump(browser);
                         continue;
                 case 'd':
-                        actions->dso = dso;
+                        actions->ms.map = map;
                         do_zoom_dso(browser, actions);
                         continue;
                 case 'V':
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index d909459fb54c..217b5a60e2ab 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -76,6 +76,7 @@ struct perf_tool build_id__mark_dso_hit_ops = {
         .exit   = perf_event__exit_del_thread,
         .attr            = perf_event__process_attr,
         .build_id        = perf_event__process_build_id,
+        .ordered_events  = true,
 };
 
 int build_id__sprintf(const u8 *build_id, int len, char *bf)
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index 7c0c08386a1d..425df5c86c9c 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -933,6 +933,7 @@ static struct dso *__dso__findlink_by_longname(struct rb_root *root,
                 /* Add new node and rebalance tree */
                 rb_link_node(&dso->rb_node, parent, p);
                 rb_insert_color(&dso->rb_node, root);
+                dso->root = root;
         }
         return NULL;
 }
@@ -945,15 +946,30 @@ static inline struct dso *__dso__find_by_longname(struct rb_root *root,
 
 void dso__set_long_name(struct dso *dso, const char *name, bool name_allocated)
 {
+        struct rb_root *root = dso->root;
+
         if (name == NULL)
                 return;
 
         if (dso->long_name_allocated)
                 free((char *)dso->long_name);
 
+        if (root) {
+                rb_erase(&dso->rb_node, root);
+                /*
+                 * __dso__findlink_by_longname() isn't guaranteed to add it
+                 * back, so a clean removal is required here.
+                 */
+                RB_CLEAR_NODE(&dso->rb_node);
+                dso->root = NULL;
+        }
+
         dso->long_name           = name;
         dso->long_name_len       = strlen(name);
         dso->long_name_allocated = name_allocated;
+
+        if (root)
+                __dso__findlink_by_longname(root, dso, NULL);
 }
 
 void dso__set_short_name(struct dso *dso, const char *name, bool name_allocated)
@@ -1046,6 +1062,7 @@ struct dso *dso__new(const char *name)
                 dso->kernel = DSO_TYPE_USER;
                 dso->needs_swap = DSO_SWAP__UNSET;
                 RB_CLEAR_NODE(&dso->rb_node);
+                dso->root = NULL;
                 INIT_LIST_HEAD(&dso->node);
                 INIT_LIST_HEAD(&dso->data.open_entry);
                 pthread_mutex_init(&dso->lock, NULL);
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index fc8db9c764ac..45ec4d0a50ed 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -135,6 +135,7 @@ struct dso {
         pthread_mutex_t  lock;
         struct list_head node;
         struct rb_node   rb_node;       /* rbtree node sorted by long name */
+        struct rb_root   *root;         /* root of rbtree that rb_node is in */
         struct rb_root   symbols[MAP__NR_TYPES];
         struct rb_root   symbol_names[MAP__NR_TYPES];
         struct {
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 5ef90be2a249..8b303ff20289 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -91,6 +91,7 @@ static void dsos__purge(struct dsos *dsos)
 
         list_for_each_entry_safe(pos, n, &dsos->head, node) {
                 RB_CLEAR_NODE(&pos->rb_node);
+                pos->root = NULL;
                 list_del_init(&pos->node);
                 dso__put(pos);
         }
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index bd8f03de5e40..05012bb178d7 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1183,7 +1183,7 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
                         container_of(pf, struct trace_event_finder, pf);
         struct perf_probe_point *pp = &pf->pev->point;
         struct probe_trace_event *tev;
-        struct perf_probe_arg *args;
+        struct perf_probe_arg *args = NULL;
         int ret, i;
 
         /* Check number of tevs */
@@ -1198,19 +1198,23 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
         ret = convert_to_trace_point(&pf->sp_die, tf->mod, pf->addr,
                                      pp->retprobe, pp->function, &tev->point);
         if (ret < 0)
-                return ret;
+                goto end;
 
         tev->point.realname = strdup(dwarf_diename(sc_die));
-        if (!tev->point.realname)
-                return -ENOMEM;
+        if (!tev->point.realname) {
+                ret = -ENOMEM;
+                goto end;
+        }
 
         pr_debug("Probe point found: %s+%lu\n", tev->point.symbol,
                  tev->point.offset);
 
         /* Expand special probe argument if exist */
         args = zalloc(sizeof(struct perf_probe_arg) * MAX_PROBE_ARGS);
-        if (args == NULL)
-                return -ENOMEM;
+        if (args == NULL) {
+                ret = -ENOMEM;
+                goto end;
+        }
 
         ret = expand_probe_args(sc_die, pf, args);
         if (ret < 0)
@@ -1234,6 +1238,10 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
         }
 
 end:
+        if (ret) {
+                clear_probe_trace_event(tev);
+                tf->ntevs--;
+        }
         free(args);
         return ret;
 }
@@ -1246,7 +1254,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
         struct trace_event_finder tf = {
                         .pf = {.pev = pev, .callback = add_probe_trace_event},
                         .max_tevs = probe_conf.max_probes, .mod = dbg->mod};
-        int ret;
+        int ret, i;
 
         /* Allocate result tevs array */
         *tevs = zalloc(sizeof(struct probe_trace_event) * tf.max_tevs);
@@ -1258,6 +1266,8 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
 
         ret = debuginfo__find_probes(dbg, &tf.pf);
         if (ret < 0) {
+                for (i = 0; i < tf.ntevs; i++)
+                        clear_probe_trace_event(&tf.tevs[i]);
                 zfree(tevs);
                 return ret;
         }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index b4cc7662677e..cd08027a6d2c 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -654,19 +654,24 @@ static int dso__split_kallsyms_for_kcore(struct dso *dso, struct map *map,
         struct map_groups *kmaps = map__kmaps(map);
         struct map *curr_map;
         struct symbol *pos;
-        int count = 0, moved = 0;
+        int count = 0;
+        struct rb_root old_root = dso->symbols[map->type];
         struct rb_root *root = &dso->symbols[map->type];
         struct rb_node *next = rb_first(root);
 
         if (!kmaps)
                 return -1;
 
+        *root = RB_ROOT;
+
         while (next) {
                 char *module;
 
                 pos = rb_entry(next, struct symbol, rb_node);
                 next = rb_next(&pos->rb_node);
 
+                rb_erase_init(&pos->rb_node, &old_root);
+
                 module = strchr(pos->name, '\t');
                 if (module)
                         *module = '\0';
@@ -674,28 +679,21 @@ static int dso__split_kallsyms_for_kcore(struct dso *dso, struct map *map,
                 curr_map = map_groups__find(kmaps, map->type, pos->start);
 
                 if (!curr_map || (filter && filter(curr_map, pos))) {
-                        rb_erase_init(&pos->rb_node, root);
                         symbol__delete(pos);
-                } else {
-                        pos->start -= curr_map->start - curr_map->pgoff;
-                        if (pos->end)
-                                pos->end -= curr_map->start - curr_map->pgoff;
-                        if (curr_map->dso != map->dso) {
-                                rb_erase_init(&pos->rb_node, root);
-                                symbols__insert(
-                                        &curr_map->dso->symbols[curr_map->type],
-                                        pos);
-                                ++moved;
-                        } else {
-                                ++count;
-                        }
+                        continue;
                 }
+
+                pos->start -= curr_map->start - curr_map->pgoff;
+                if (pos->end)
+                        pos->end -= curr_map->start - curr_map->pgoff;
+                symbols__insert(&curr_map->dso->symbols[curr_map->type], pos);
+                ++count;
         }
 
         /* Symbols have been adjusted */
         dso->adjust_symbols = 1;
 
-        return count + moved;
+        return count;
 }
 
 /*
@@ -1438,9 +1436,9 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
                 if (lstat(dso->name, &st) < 0)
                         goto out;
 
-                if (st.st_uid && (st.st_uid != geteuid())) {
+                if (!symbol_conf.force && st.st_uid && (st.st_uid != geteuid())) {
                         pr_warning("File %s not owned by current user or root, "
-                                "ignoring it.\n", dso->name);
+                                   "ignoring it (use -f to override).\n", dso->name);
                         goto out;
                 }
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 40073c60b83d..dcd786e364f2 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -84,6 +84,7 @@ struct symbol_conf {
         unsigned short  priv_size;
         unsigned short  nr_events;
         bool            try_vmlinux_path,
+                        force,
                         ignore_vmlinux,
                         ignore_vmlinux_buildid,
                         show_kernel_path,
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index d8e4b20b6d54..0dac7e05a6ac 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1173,9 +1173,9 @@ dump_nhm_platform_info(void)
         unsigned long long msr;
         unsigned int ratio;
 
-        get_msr(base_cpu, MSR_NHM_PLATFORM_INFO, &msr);
+        get_msr(base_cpu, MSR_PLATFORM_INFO, &msr);
 
-        fprintf(stderr, "cpu%d: MSR_NHM_PLATFORM_INFO: 0x%08llx\n", base_cpu, msr);
+        fprintf(stderr, "cpu%d: MSR_PLATFORM_INFO: 0x%08llx\n", base_cpu, msr);
 
         ratio = (msr >> 40) & 0xFF;
         fprintf(stderr, "%d * %.0f = %.0f MHz max efficiency frequency\n",
@@ -1807,7 +1807,7 @@ void check_permissions()
  *
  * MSR_SMI_COUNT                   0x00000034
  *
- * MSR_NHM_PLATFORM_INFO           0x000000ce
+ * MSR_PLATFORM_INFO               0x000000ce
  * MSR_NHM_SNB_PKG_CST_CFG_CTL     0x000000e2
  *
  * MSR_PKG_C3_RESIDENCY            0x000003f8
@@ -1876,7 +1876,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
         get_msr(base_cpu, MSR_NHM_SNB_PKG_CST_CFG_CTL, &msr);
         pkg_cstate_limit = pkg_cstate_limits[msr & 0xF];
 
-        get_msr(base_cpu, MSR_NHM_PLATFORM_INFO, &msr);
+        get_msr(base_cpu, MSR_PLATFORM_INFO, &msr);
         base_ratio = (msr >> 8) & 0xFF;
 
         base_hz = base_ratio * bclk * 1000000;
diff --git a/tools/testing/selftests/futex/README b/tools/testing/selftests/futex/README
index 3224a049b196..0558bb9ce0a6 100644
--- a/tools/testing/selftests/futex/README
+++ b/tools/testing/selftests/futex/README
@@ -27,7 +27,7 @@ o The build system shall remain as simple as possible, avoiding any archive or
 o Where possible, any helper functions or other package-wide code shall be
   implemented in header files, avoiding the need to compile intermediate object
   files.
-o External dependendencies shall remain as minimal as possible. Currently gcc
+o External dependencies shall remain as minimal as possible. Currently gcc
   and glibc are the only dependencies.
 o Tests return 0 for success and < 0 for failure.
 
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index e38cc54942db..882fe83a3554 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -492,6 +492,9 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
         pid_t parent = getppid();
         int fd;
         void *map1, *map2;
+        int page_size = sysconf(_SC_PAGESIZE);
+
+        ASSERT_LT(0, page_size);
 
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
@@ -504,16 +507,16 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
 
         EXPECT_EQ(parent, syscall(__NR_getppid));
         map1 = (void *)syscall(sysno,
-                NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, PAGE_SIZE);
+                NULL, page_size, PROT_READ, MAP_PRIVATE, fd, page_size);
         EXPECT_NE(MAP_FAILED, map1);
         /* mmap2() should never return. */
         map2 = (void *)syscall(sysno,
-                 NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
+                 NULL, page_size, PROT_READ, MAP_PRIVATE, fd, 0x0C0FFEE);
         EXPECT_EQ(MAP_FAILED, map2);
 
         /* The test failed, so clean up the resources. */
-        munmap(map1, PAGE_SIZE);
-        munmap(map2, PAGE_SIZE);
+        munmap(map1, page_size);
+        munmap(map2, page_size);
         close(fd);
 }
 
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index bcf5ec760eb9..5a6016224bb9 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -128,6 +128,7 @@ static const char * const page_flag_names[] = {
         [KPF_THP]               = "t:thp",
         [KPF_BALLOON]           = "o:balloon",
         [KPF_ZERO_PAGE]         = "z:zero_page",
+        [KPF_IDLE]              = "i:idle_page",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 21a0ab2d8919..69bca185c471 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -221,17 +221,23 @@ void kvm_timer_flush_hwstate(struct kvm_vcpu *vcpu)
         kvm_timer_update_state(vcpu);
 
         /*
-         * If we enter the guest with the virtual input level to the VGIC
-         * asserted, then we have already told the VGIC what we need to, and
-         * we don't need to exit from the guest until the guest deactivates
-         * the already injected interrupt, so therefore we should set the
-         * hardware active state to prevent unnecessary exits from the guest.
-         *
-         * Conversely, if the virtual input level is deasserted, then always
-         * clear the hardware active state to ensure that hardware interrupts
-         * from the timer triggers a guest exit.
-         */
-        if (timer->irq.level)
+        * If we enter the guest with the virtual input level to the VGIC
+        * asserted, then we have already told the VGIC what we need to, and
+        * we don't need to exit from the guest until the guest deactivates
+        * the already injected interrupt, so therefore we should set the
+        * hardware active state to prevent unnecessary exits from the guest.
+        *
+        * Also, if we enter the guest with the virtual timer interrupt active,
+        * then it must be active on the physical distributor, because we set
+        * the HW bit and the guest must be able to deactivate the virtual and
+        * physical interrupt at the same time.
+        *
+        * Conversely, if the virtual input level is deasserted and the virtual
+        * interrupt is not active, then always clear the hardware active state
+        * to ensure that hardware interrupts from the timer triggers a guest
+        * exit.
+        */
+        if (timer->irq.level || kvm_vgic_map_is_active(vcpu, timer->map))
                 phys_active = true;
         else
                 phys_active = false;
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 533538385d5d..65461f821a75 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1096,6 +1096,27 @@ static void vgic_retire_lr(int lr_nr, struct kvm_vcpu *vcpu)
         vgic_set_lr(vcpu, lr_nr, vlr);
 }
 
+static bool dist_active_irq(struct kvm_vcpu *vcpu)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        return test_bit(vcpu->vcpu_id, dist->irq_active_on_cpu);
+}
+
+bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, struct irq_phys_map *map)
+{
+        int i;
+
+        for (i = 0; i < vcpu->arch.vgic_cpu.nr_lr; i++) {
+                struct vgic_lr vlr = vgic_get_lr(vcpu, i);
+
+                if (vlr.irq == map->virt_irq && vlr.state & LR_STATE_ACTIVE)
+                        return true;
+        }
+
+        return dist_active_irq(vcpu);
+}
+
 /*
  * An interrupt may have been disabled after being made pending on the
  * CPU interface (the classic case is a timer running while we're
@@ -1248,7 +1269,7 @@ static void __kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
          * may have been serviced from another vcpu. In all cases,
          * move along.
          */
-        if (!kvm_vgic_vcpu_pending_irq(vcpu) && !kvm_vgic_vcpu_active_irq(vcpu))
+        if (!kvm_vgic_vcpu_pending_irq(vcpu) && !dist_active_irq(vcpu))
                 goto epilog;
 
         /* SGIs */
@@ -1396,25 +1417,13 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
 static bool vgic_sync_hwirq(struct kvm_vcpu *vcpu, int lr, struct vgic_lr vlr)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
-        struct irq_phys_map *map;
-        bool phys_active;
         bool level_pending;
-        int ret;
 
         if (!(vlr.state & LR_HW))
                 return false;
 
-        map = vgic_irq_map_search(vcpu, vlr.irq);
-        BUG_ON(!map);
-
-        ret = irq_get_irqchip_state(map->irq,
-                                    IRQCHIP_STATE_ACTIVE,
-                                    &phys_active);
-
-        WARN_ON(ret);
-
-        if (phys_active)
-                return 0;
+        if (vlr.state & LR_STATE_ACTIVE)
+                return false;
 
         spin_lock(&dist->lock);
         level_pending = process_queued_irq(vcpu, lr, vlr);
@@ -1479,17 +1488,6 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
         return test_bit(vcpu->vcpu_id, dist->irq_pending_on_cpu);
 }
 
-int kvm_vgic_vcpu_active_irq(struct kvm_vcpu *vcpu)
-{
-        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
-
-        if (!irqchip_in_kernel(vcpu->kvm))
-                return 0;
-
-        return test_bit(vcpu->vcpu_id, dist->irq_active_on_cpu);
-}
-
-
 void vgic_kick_vcpus(struct kvm *kvm)
 {
         struct kvm_vcpu *vcpu;