227 files changed, 2308 insertions, 1758 deletions
diff --git a/CREDITS b/CREDITS
index 513aaa3546bf..837367624e45 100644
--- a/CREDITS
+++ b/CREDITS
@@ -1864,10 +1864,11 @@ S: The Netherlands
 N: Martin Kepplinger
 E: martink@posteo.de
-E: martin.kepplinger@theobroma-systems.com
+E: martin.kepplinger@ginzinger.com
 W: http://www.martinkepplinger.com
 D: mma8452 accelerators iio driver
-D: Kernel cleanups
+D: pegasus_notetaker input driver
+D: Kernel fixes and cleanups
 S: Garnisonstraße 26
 S: 4020 Linz
 S: Austria
diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index e5b6497116f4..c75b64a85859 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -309,3 +309,4 @@ Version History
        with a reshape in progress.
 1.9.0   Add support for RAID level takeover/reshape/region size
        and set size reduction.
+1.9.1   Fix activation of existing RAID 4/10 mapped devices
diff --git a/Documentation/devicetree/bindings/clock/uniphier-clock.txt b/Documentation/devicetree/bindings/clock/uniphier-clock.txt
index c7179d3b5c33..812163060fa3 100644
--- a/Documentation/devicetree/bindings/clock/uniphier-clock.txt
+++ b/Documentation/devicetree/bindings/clock/uniphier-clock.txt
@@ -24,7 +24,7 @@ Example:
                reg = <0x61840000 0x4000>;
                clock {
-                        compatible = "socionext,uniphier-ld20-clock";
+                        compatible = "socionext,uniphier-ld11-clock";
                        #clock-cells = <1>;
                };
@@ -43,8 +43,8 @@ Provided clocks:
 21: USB3 ch1 PHY1
-Media I/O (MIO) clock
+Media I/O (MIO) clock, SD clock
---------------------
+-------------------------------
 Required properties:
 - compatible: should be one of the following:
@@ -52,10 +52,10 @@ Required properties:
    "socionext,uniphier-ld4-mio-clock"  - for LD4 SoC.
    "socionext,uniphier-pro4-mio-clock" - for Pro4 SoC.
    "socionext,uniphier-sld8-mio-clock" - for sLD8 SoC.
-    "socionext,uniphier-pro5-mio-clock" - for Pro5 SoC.
+    "socionext,uniphier-pro5-sd-clock"  - for Pro5 SoC.
-    "socionext,uniphier-pxs2-mio-clock" - for PXs2/LD6b SoC.
+    "socionext,uniphier-pxs2-sd-clock"  - for PXs2/LD6b SoC.
    "socionext,uniphier-ld11-mio-clock" - for LD11 SoC.
-    "socionext,uniphier-ld20-mio-clock" - for LD20 SoC.
+    "socionext,uniphier-ld20-sd-clock"  - for LD20 SoC.
 - #clock-cells: should be 1.
 Example:
@@ -66,7 +66,7 @@ Example:
                reg = <0x59810000 0x800>;
                clock {
-                        compatible = "socionext,uniphier-ld20-mio-clock";
+                        compatible = "socionext,uniphier-ld11-mio-clock";
                        #clock-cells = <1>;
                };
@@ -112,7 +112,7 @@ Example:
                reg = <0x59820000 0x200>;
                clock {
-                        compatible = "socionext,uniphier-ld20-peri-clock";
+                        compatible = "socionext,uniphier-ld11-peri-clock";
                        #clock-cells = <1>;
                };
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index 455f2c310a1b..2c30a5479069 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -28,10 +28,7 @@ Refer to phy/phy-bindings.txt for generic phy consumer properties
 - g-use-dma: enable dma usage in gadget driver.
 - g-rx-fifo-size: size of rx fifo size in gadget mode.
 - g-np-tx-fifo-size: size of non-periodic tx fifo size in gadget mode.
+- g-tx-fifo-size: size of periodic tx fifo per endpoint (except ep0) in gadget mode.
-Deprecated properties:
- g-tx-fifo-size: size of periodic tx fifo per endpoint (except ep0)
-  in gadget mode.
 Example:
diff --git a/Documentation/gpio/board.txt b/Documentation/gpio/board.txt
index 40884c4fe40c..a0f61898d493 100644
--- a/Documentation/gpio/board.txt
+++ b/Documentation/gpio/board.txt
@@ -6,7 +6,7 @@ Note that it only applies to the new descriptor-based interface. For a
 description of the deprecated integer-based GPIO interface please refer to
 gpio-legacy.txt (actually, there is no real mapping possible with the old
 interface; you just fetch an integer from somewhere and request the
-corresponding GPIO.
+corresponding GPIO).
 All platforms can enable the GPIO library, but if the platform strictly
 requires GPIO functionality to be present, it needs to select GPIOLIB from its
@@ -162,6 +162,9 @@ The driver controlling "foo.0" will then be able to obtain its GPIOs as follows:
 Since the "led" GPIOs are mapped as active-high, this example will switch their
 signals to 1, i.e. enabling the LEDs. And for the "power" GPIO, which is mapped
-as active-low, its actual signal will be 0 after this code. Contrary to the legacy
+as active-low, its actual signal will be 0 after this code. Contrary to the
-integer GPIO interface, the active-low property is handled during mapping and is
+legacy integer GPIO interface, the active-low property is handled during
-thus transparent to GPIO consumers.
+mapping and is thus transparent to GPIO consumers.
+A set of functions such as gpiod_set_value() is available to work with
+the new descriptor-oriented interface.
diff --git a/MAINTAINERS b/MAINTAINERS
index c44795306342..f30b8ea700fd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8100,6 +8100,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/mn88473*
 MODULE SUPPORT
+M:      Jessica Yu <jeyu@redhat.com>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 S:      Maintained
 F:      include/linux/module.h
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index ecd12379e2cd..bd204bfa29ed 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -41,6 +41,8 @@ config ARC
        select PERF_USE_VMALLOC
        select HAVE_DEBUG_STACKOVERFLOW
        select HAVE_GENERIC_DMA_COHERENT
+        select HAVE_KERNEL_GZIP
+        select HAVE_KERNEL_LZMA
 config MIGHT_HAVE_PCI
        bool
@@ -186,14 +188,6 @@ if SMP
 config ARC_HAS_COH_CACHES
        def_bool n
-config ARC_MCIP
-        bool "ARConnect Multicore IP (MCIP) Support "
-        depends on ISA_ARCV2
-        help
-          This IP block enables SMP in ARC-HS38 cores.
-          It provides for cross-core interrupts, multi-core debug
-          hardware semaphores, shared memory,....
 config NR_CPUS
        int "Maximum number of CPUs (2-4096)"
        range 2 4096
@@ -211,6 +205,15 @@ config ARC_SMP_HALT_ON_RESET
 endif   #SMP
+config ARC_MCIP
+        bool "ARConnect Multicore IP (MCIP) Support "
+        depends on ISA_ARCV2
+        default y if SMP
+        help
+          This IP block enables SMP in ARC-HS38 cores.
+          It provides for cross-core interrupts, multi-core debug
+          hardware semaphores, shared memory,....
 menuconfig ARC_CACHE
        bool "Enable Cache Support"
        default y
@@ -537,14 +540,6 @@ config ARC_DBG_TLB_PARANOIA
        bool "Paranoia Checks in Low Level TLB Handlers"
        default n
-config ARC_DBG_TLB_MISS_COUNT
-        bool "Profile TLB Misses"
-        default n
-        select DEBUG_FS
-        help
-          Counts number of I and D TLB Misses and exports them via Debugfs
-          The counters can be cleared via Debugfs as well
 endif
 config ARC_UBOOT_SUPPORT
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index aa82d13d4213..864adad52280 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -50,9 +50,6 @@ atleast_gcc44 :=  $(call cc-ifversion, -ge, 0404, y)
 cflags-$(atleast_gcc44)                 += -fsection-anchors
-cflags-$(CONFIG_ARC_HAS_LLSC)           += -mlock
-cflags-$(CONFIG_ARC_HAS_SWAPE)          += -mswape
 ifdef CONFIG_ISA_ARCV2
 ifndef CONFIG_ARC_HAS_LL64
diff --git a/arch/arc/boot/Makefile b/arch/arc/boot/Makefile
index e597cb34c16a..f94cf151e06a 100644
--- a/arch/arc/boot/Makefile
+++ b/arch/arc/boot/Makefile
@@ -14,9 +14,15 @@ UIMAGE_ENTRYADDR   = $(LINUX_START_TEXT)
 suffix-y := bin
 suffix-$(CONFIG_KERNEL_GZIP)    := gz
+suffix-$(CONFIG_KERNEL_LZMA)    := lzma
-targets += uImage uImage.bin uImage.gz
+targets += uImage
-extra-y += vmlinux.bin vmlinux.bin.gz
+targets += uImage.bin
+targets += uImage.gz
+targets += uImage.lzma
+extra-y += vmlinux.bin
+extra-y += vmlinux.bin.gz
+extra-y += vmlinux.bin.lzma
 $(obj)/vmlinux.bin: vmlinux FORCE
        $(call if_changed,objcopy)
@@ -24,12 +30,18 @@ $(obj)/vmlinux.bin: vmlinux FORCE
 $(obj)/vmlinux.bin.gz: $(obj)/vmlinux.bin FORCE
        $(call if_changed,gzip)
+$(obj)/vmlinux.bin.lzma: $(obj)/vmlinux.bin FORCE
+        $(call if_changed,lzma)
 $(obj)/uImage.bin: $(obj)/vmlinux.bin FORCE
        $(call if_changed,uimage,none)
 $(obj)/uImage.gz: $(obj)/vmlinux.bin.gz FORCE
        $(call if_changed,uimage,gzip)
+$(obj)/uImage.lzma: $(obj)/vmlinux.bin.lzma FORCE
+        $(call if_changed,uimage,lzma)
 $(obj)/uImage: $(obj)/uImage.$(suffix-y)
        @ln -sf $(notdir $<) $@
        @echo '  Image $@ is ready'
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index db25c65155cb..7f3f9f63708c 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -349,10 +349,11 @@ struct cpuinfo_arc {
        struct cpuinfo_arc_bpu bpu;
        struct bcr_identity core;
        struct bcr_isa isa;
+        const char *details, *name;
        unsigned int vec_base;
        struct cpuinfo_arc_ccm iccm, dccm;
        struct {
-                unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, pad1:3,
+                unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
                             fpu_sp:1, fpu_dp:1, pad2:6,
                             debug:1, ap:1, smart:1, rtt:1, pad3:4,
                             timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index fb781e34f322..b3410ff6a62d 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -53,7 +53,7 @@ extern void arc_cache_init(void);
 extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
 extern void read_decode_cache_bcr(void);
-extern int ioc_exists;
+extern int ioc_enable;
 extern unsigned long perip_base, perip_end;
 #endif  /* !__ASSEMBLY__ */
diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
index 7096f97a1434..aa2d6da9d187 100644
--- a/arch/arc/include/asm/elf.h
+++ b/arch/arc/include/asm/elf.h
@@ -54,7 +54,7 @@ extern int elf_check_arch(const struct elf32_hdr *);
 * the loader.  We need to make sure that it is out of the way of the program
 * that it will "exec", and that there is sufficient room for the brk.
 */
-#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
+#define ELF_ET_DYN_BASE         (2UL * TASK_SIZE / 3)
 /*
 * When the program starts, a1 contains a pointer to a function to be
diff --git a/arch/arc/include/asm/mcip.h b/arch/arc/include/asm/mcip.h
index 847e3bbe387f..c8fbe4114bad 100644
--- a/arch/arc/include/asm/mcip.h
+++ b/arch/arc/include/asm/mcip.h
@@ -55,6 +55,22 @@ struct mcip_cmd {
 #define IDU_M_DISTRI_DEST               0x2
 };
+struct mcip_bcr {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+                unsigned int pad3:8,
+                             idu:1, llm:1, num_cores:6,
+                             iocoh:1,  gfrc:1, dbg:1, pad2:1,
+                             msg:1, sem:1, ipi:1, pad:1,
+                             ver:8;
+#else
+                unsigned int ver:8,
+                             pad:1, ipi:1, sem:1, msg:1,
+                             pad2:1, dbg:1, gfrc:1, iocoh:1,
+                             num_cores:6, llm:1, idu:1,
+                             pad3:8;
+#endif
+};
 /*
 * MCIP programming model
 *
diff --git a/arch/arc/include/asm/module.h b/arch/arc/include/asm/module.h
index 518222bb3f8e..6e91d8b339c3 100644
--- a/arch/arc/include/asm/module.h
+++ b/arch/arc/include/asm/module.h
@@ -18,6 +18,7 @@
 struct mod_arch_specific {
        void *unw_info;
        int unw_sec_idx;
+        const char *secstr;
 };
 #endif
diff --git a/arch/arc/include/asm/setup.h b/arch/arc/include/asm/setup.h
index 48b37c693db3..cb954cdab070 100644
--- a/arch/arc/include/asm/setup.h
+++ b/arch/arc/include/asm/setup.h
@@ -27,11 +27,6 @@ struct id_to_str {
        const char *str;
 };
-struct cpuinfo_data {
-        struct id_to_str info;
-        int up_range;
-};
 extern int root_mountflags, end_mem;
 void setup_processor(void);
@@ -43,5 +38,6 @@ void __init setup_arch_memory(void);
 #define IS_USED_RUN(v)          ((v) ? "" : "(not used) ")
 #define IS_USED_CFG(cfg)        IS_USED_RUN(IS_ENABLED(cfg))
 #define IS_AVAIL2(v, s, cfg)    IS_AVAIL1(v, s), IS_AVAIL1(v, IS_USED_CFG(cfg))
+#define IS_AVAIL3(v, v2, s)     IS_AVAIL1(v, s), IS_AVAIL1(v, IS_DISABLED_RUN(v2))
 #endif /* __ASMARC_SETUP_H */
diff --git a/arch/arc/include/asm/syscalls.h b/arch/arc/include/asm/syscalls.h
index e56f9fcc5581..772b67ca56e7 100644
--- a/arch/arc/include/asm/syscalls.h
+++ b/arch/arc/include/asm/syscalls.h
@@ -17,6 +17,7 @@ int sys_clone_wrapper(int, int, int, int, int);
 int sys_cacheflush(uint32_t, uint32_t uint32_t);
 int sys_arc_settls(void *);
 int sys_arc_gettls(void);
+int sys_arc_usr_cmpxchg(int *, int, int);
 #include <asm-generic/syscalls.h>
diff --git a/arch/arc/include/uapi/asm/unistd.h b/arch/arc/include/uapi/asm/unistd.h
index 41fa2ec9e02c..9a34136d84b2 100644
--- a/arch/arc/include/uapi/asm/unistd.h
+++ b/arch/arc/include/uapi/asm/unistd.h
@@ -27,18 +27,19 @@
 #define NR_syscalls     __NR_syscalls
+/* Generic syscall (fs/filesystems.c - lost in asm-generic/unistd.h */
+#define __NR_sysfs              (__NR_arch_specific_syscall + 3)
 /* ARC specific syscall */
 #define __NR_cacheflush         (__NR_arch_specific_syscall + 0)
 #define __NR_arc_settls         (__NR_arch_specific_syscall + 1)
 #define __NR_arc_gettls         (__NR_arch_specific_syscall + 2)
+#define __NR_arc_usr_cmpxchg    (__NR_arch_specific_syscall + 4)
 __SYSCALL(__NR_cacheflush, sys_cacheflush)
 __SYSCALL(__NR_arc_settls, sys_arc_settls)
 __SYSCALL(__NR_arc_gettls, sys_arc_gettls)
+__SYSCALL(__NR_arc_usr_cmpxchg, sys_arc_usr_cmpxchg)
-/* Generic syscall (fs/filesystems.c - lost in asm-generic/unistd.h */
-#define __NR_sysfs              (__NR_arch_specific_syscall + 3)
 __SYSCALL(__NR_sysfs, sys_sysfs)
 #undef __SYSCALL
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 72f9179b1a24..c424d5abc318 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -15,11 +15,12 @@
 #include <asm/mcip.h>
 #include <asm/setup.h>
-static char smp_cpuinfo_buf[128];
-static int idu_detected;
 static DEFINE_RAW_SPINLOCK(mcip_lock);
+#ifdef CONFIG_SMP
+static char smp_cpuinfo_buf[128];
 static void mcip_setup_per_cpu(int cpu)
 {
        smp_ipi_irq_setup(cpu, IPI_IRQ);
@@ -86,21 +87,7 @@ static void mcip_ipi_clear(int irq)
 static void mcip_probe_n_setup(void)
 {
-        struct mcip_bcr {
+        struct mcip_bcr mp;
-#ifdef CONFIG_CPU_BIG_ENDIAN
-                unsigned int pad3:8,
-                             idu:1, llm:1, num_cores:6,
-                             iocoh:1,  gfrc:1, dbg:1, pad2:1,
-                             msg:1, sem:1, ipi:1, pad:1,
-                             ver:8;
-#else
-                unsigned int ver:8,
-                             pad:1, ipi:1, sem:1, msg:1,
-                             pad2:1, dbg:1, gfrc:1, iocoh:1,
-                             num_cores:6, llm:1, idu:1,
-                             pad3:8;
-#endif
-        } mp;
        READ_BCR(ARC_REG_MCIP_BCR, mp);
@@ -114,7 +101,6 @@ static void mcip_probe_n_setup(void)
                IS_AVAIL1(mp.gfrc, "GFRC"));
        cpuinfo_arc700[0].extn.gfrc = mp.gfrc;
-        idu_detected = mp.idu;
        if (mp.dbg) {
                __mcip_cmd_data(CMD_DEBUG_SET_SELECT, 0, 0xf);
@@ -130,6 +116,8 @@ struct plat_smp_ops plat_smp_ops = {
        .ipi_clear      = mcip_ipi_clear,
 };
+#endif
 /***************************************************************************
 * ARCv2 Interrupt Distribution Unit (IDU)
 *
@@ -295,8 +283,11 @@ idu_of_init(struct device_node *intc, struct device_node *parent)
        /* Read IDU BCR to confirm nr_irqs */
        int nr_irqs = of_irq_count(intc);
        int i, irq;
+        struct mcip_bcr mp;
+        READ_BCR(ARC_REG_MCIP_BCR, mp);
-        if (!idu_detected)
+        if (!mp.idu)
                panic("IDU not detected, but DeviceTree using it");
        pr_info("MCIP: IDU referenced from Devicetree %d irqs\n", nr_irqs);
diff --git a/arch/arc/kernel/module.c b/arch/arc/kernel/module.c
index 9a2849756022..42e964db2967 100644
--- a/arch/arc/kernel/module.c
+++ b/arch/arc/kernel/module.c
@@ -30,17 +30,9 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
                              char *secstr, struct module *mod)
 {
 #ifdef CONFIG_ARC_DW2_UNWIND
-        int i;
        mod->arch.unw_sec_idx = 0;
        mod->arch.unw_info = NULL;
+        mod->arch.secstr = secstr;
-        for (i = 1; i < hdr->e_shnum; i++) {
-                if (strcmp(secstr+sechdrs[i].sh_name, ".eh_frame") == 0) {
-                        mod->arch.unw_sec_idx = i;
-                        break;
-                }
-        }
 #endif
        return 0;
 }
@@ -59,29 +51,33 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
                       unsigned int relsec,     /* sec index for relo sec */
                       struct module *module)
 {
-        int i, n;
+        int i, n, relo_type;
        Elf32_Rela *rel_entry = (void *)sechdrs[relsec].sh_addr;
        Elf32_Sym *sym_entry, *sym_sec;
-        Elf32_Addr relocation;
+        Elf32_Addr relocation, location, tgt_addr;
-        Elf32_Addr location;
+        unsigned int tgtsec;
-        Elf32_Addr sec_to_patch;
-        int relo_type;
+        /*
+         * @relsec has relocations e.g. .rela.init.text
-        sec_to_patch = sechdrs[sechdrs[relsec].sh_info].sh_addr;
+         * @tgtsec is section to patch e.g. .init.text
+         */
+        tgtsec = sechdrs[relsec].sh_info;
+        tgt_addr = sechdrs[tgtsec].sh_addr;
        sym_sec = (Elf32_Sym *) sechdrs[symindex].sh_addr;
        n = sechdrs[relsec].sh_size / sizeof(*rel_entry);
-        pr_debug("\n========== Module Sym reloc ===========================\n");
+        pr_debug("\nSection to fixup %s @%x\n",
-        pr_debug("Section to fixup %x\n", sec_to_patch);
+                 module->arch.secstr + sechdrs[tgtsec].sh_name, tgt_addr);
        pr_debug("=========================================================\n");
-        pr_debug("rela->r_off | rela->addend | sym->st_value | ADDR | VALUE\n");
+        pr_debug("r_off\tr_add\tst_value ADDRESS  VALUE\n");
        pr_debug("=========================================================\n");
        /* Loop thru entries in relocation section */
        for (i = 0; i < n; i++) {
+                const char *s;
                /* This is where to make the change */
-                location = sec_to_patch + rel_entry[i].r_offset;
+                location = tgt_addr + rel_entry[i].r_offset;
                /* This is the symbol it is referring to.  Note that all
                   undefined symbols have been resolved.  */
@@ -89,10 +85,15 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
                relocation = sym_entry->st_value + rel_entry[i].r_addend;
-                pr_debug("\t%x\t\t%x\t\t%x  %x %x [%s]\n",
+                if (sym_entry->st_name == 0 && ELF_ST_TYPE (sym_entry->st_info) == STT_SECTION) {
-                        rel_entry[i].r_offset, rel_entry[i].r_addend,
+                        s = module->arch.secstr + sechdrs[sym_entry->st_shndx].sh_name;
-                        sym_entry->st_value, location, relocation,
+                } else {
-                        strtab + sym_entry->st_name);
+                        s = strtab + sym_entry->st_name;
+                }
+                pr_debug("   %x\t%x\t%x %x %x [%s]\n",
+                         rel_entry[i].r_offset, rel_entry[i].r_addend,
+                         sym_entry->st_value, location, relocation, s);
                /* This assumes modules are built with -mlong-calls
                 * so any branches/jumps are absolute 32 bit jmps
@@ -111,6 +112,10 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
                        goto relo_err;
        }
+        if (strcmp(module->arch.secstr+sechdrs[tgtsec].sh_name, ".eh_frame") == 0)
+                module->arch.unw_sec_idx = tgtsec;
        return 0;
 relo_err:
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index be1972bd2729..59aa43cb146e 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -41,6 +41,39 @@ SYSCALL_DEFINE0(arc_gettls)
        return task_thread_info(current)->thr_ptr;
 }
+SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+{
+        int uval;
+        int ret;
+        /*
+         * This is only for old cores lacking LLOCK/SCOND, which by defintion
+         * can't possibly be SMP. Thus doesn't need to be SMP safe.
+         * And this also helps reduce the overhead for serializing in
+         * the UP case
+         */
+        WARN_ON_ONCE(IS_ENABLED(CONFIG_SMP));
+        if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+                return -EFAULT;
+        preempt_disable();
+        ret = __get_user(uval, uaddr);
+        if (ret)
+                goto done;
+        if (uval != expected)
+                ret = -EAGAIN;
+        else
+                ret = __put_user(new, uaddr);
+done:
+        preempt_enable();
+        return ret;
+}
 void arch_cpu_idle(void)
 {
        /* sleep, but enable all interrupts before committing */
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 3df7f9c72f42..0385df77a697 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -40,6 +40,29 @@ struct task_struct *_current_task[NR_CPUS];	/* For stack switching */
 struct cpuinfo_arc cpuinfo_arc700[NR_CPUS];
+static const struct id_to_str arc_cpu_rel[] = {
+#ifdef CONFIG_ISA_ARCOMPACT
+        { 0x34, "R4.10"},
+        { 0x35, "R4.11"},
+#else
+        { 0x51, "R2.0" },
+        { 0x52, "R2.1" },
+        { 0x53, "R3.0" },
+#endif
+        { 0x00, NULL   }
+};
+static const struct id_to_str arc_cpu_nm[] = {
+#ifdef CONFIG_ISA_ARCOMPACT
+        { 0x20, "ARC 600"   },
+        { 0x30, "ARC 770"   },  /* 750 identified seperately */
+#else
+        { 0x40, "ARC EM"  },
+        { 0x50, "ARC HS38"  },
+#endif
+        { 0x00, "Unknown"   }
+};
 static void read_decode_ccm_bcr(struct cpuinfo_arc *cpu)
 {
        if (is_isa_arcompact()) {
@@ -92,11 +115,26 @@ static void read_arc_build_cfg_regs(void)
        struct bcr_timer timer;
        struct bcr_generic bcr;
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
+        const struct id_to_str *tbl;
        FIX_PTR(cpu);
        READ_BCR(AUX_IDENTITY, cpu->core);
        READ_BCR(ARC_REG_ISA_CFG_BCR, cpu->isa);
+        for (tbl = &arc_cpu_rel[0]; tbl->id != 0; tbl++) {
+                if (cpu->core.family == tbl->id) {
+                        cpu->details = tbl->str;
+                        break;
+                }
+        }
+        for (tbl = &arc_cpu_nm[0]; tbl->id != 0; tbl++) {
+                if ((cpu->core.family & 0xF0) == tbl->id)
+                        break;
+        }
+        cpu->name = tbl->str;
        READ_BCR(ARC_REG_TIMERS_BCR, timer);
        cpu->extn.timer0 = timer.t0;
        cpu->extn.timer1 = timer.t1;
@@ -111,6 +149,9 @@ static void read_arc_build_cfg_regs(void)
        cpu->extn.swap = read_aux_reg(ARC_REG_SWAP_BCR) ? 1 : 0;        /* 1,3 */
        cpu->extn.crc = read_aux_reg(ARC_REG_CRC_BCR) ? 1 : 0;
        cpu->extn.minmax = read_aux_reg(ARC_REG_MIXMAX_BCR) > 1 ? 1 : 0; /* 2 */
+        cpu->extn.swape = (cpu->core.family >= 0x34) ? 1 :
+                                IS_ENABLED(CONFIG_ARC_HAS_SWAPE);
        READ_BCR(ARC_REG_XY_MEM_BCR, cpu->extn_xymem);
        /* Read CCM BCRs for boot reporting even if not enabled in Kconfig */
@@ -160,64 +201,38 @@ static void read_arc_build_cfg_regs(void)
        cpu->extn.rtt = bcr.ver ? 1 : 0;
        cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
-}
-static const struct cpuinfo_data arc_cpu_tbl[] = {
+        /* some hacks for lack of feature BCR info in old ARC700 cores */
-#ifdef CONFIG_ISA_ARCOMPACT
+        if (is_isa_arcompact()) {
-        { {0x20, "ARC 600"      }, 0x2F},
+                if (!cpu->isa.ver)      /* ISA BCR absent, use Kconfig info */
-        { {0x30, "ARC 700"      }, 0x33},
+                        cpu->isa.atomic = IS_ENABLED(CONFIG_ARC_HAS_LLSC);
-        { {0x34, "ARC 700 R4.10"}, 0x34},
+                else
-        { {0x35, "ARC 700 R4.11"}, 0x35},
+                        cpu->isa.atomic = cpu->isa.atomic1;
-#else
-        { {0x50, "ARC HS38 R2.0"}, 0x51},
-        { {0x52, "ARC HS38 R2.1"}, 0x52},
-        { {0x53, "ARC HS38 R3.0"}, 0x53},
-#endif
-        { {0x00, NULL           } }
-};
+                cpu->isa.be = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN);
+                 /* there's no direct way to distinguish 750 vs. 770 */
+                if (unlikely(cpu->core.family < 0x34 || cpu->mmu.ver < 3))
+                        cpu->name = "ARC750";
+        }
+}
 static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[cpu_id];
        struct bcr_identity *core = &cpu->core;
-        const struct cpuinfo_data *tbl;
+        int i, n = 0;
-        char *isa_nm;
-        int i, be, atomic;
-        int n = 0;
        FIX_PTR(cpu);
-        if (is_isa_arcompact()) {
-                isa_nm = "ARCompact";
-                be = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN);
-                atomic = cpu->isa.atomic1;
-                if (!cpu->isa.ver)      /* ISA BCR absent, use Kconfig info */
-                        atomic = IS_ENABLED(CONFIG_ARC_HAS_LLSC);
-        } else {
-                isa_nm = "ARCv2";
-                be = cpu->isa.be;
-                atomic = cpu->isa.atomic;
-        }
        n += scnprintf(buf + n, len - n,
                       "\nIDENTITY\t: ARCVER [%#02x] ARCNUM [%#02x] CHIPID [%#4x]\n",
                       core->family, core->cpu_id, core->chip_id);
-        for (tbl = &arc_cpu_tbl[0]; tbl->info.id != 0; tbl++) {
+        n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s\n",
-                if ((core->family >= tbl->info.id) &&
+                       cpu_id, cpu->name, cpu->details,
-                    (core->family <= tbl->up_range)) {
+                       is_isa_arcompact() ? "ARCompact" : "ARCv2",
-                        n += scnprintf(buf + n, len - n,
+                       IS_AVAIL1(cpu->isa.be, "[Big-Endian]"));
-                                       "processor [%d]\t: %s (%s ISA) %s\n",
-                                       cpu_id, tbl->info.str, isa_nm,
-                                       IS_AVAIL1(be, "[Big-Endian]"));
-                        break;
-                }
-        }
-        if (tbl->info.id == 0)
-                n += scnprintf(buf + n, len - n, "UNKNOWN ARC Processor\n");
        n += scnprintf(buf + n, len - n, "Timers\t\t: %s%s%s%s\nISA Extn\t: ",
                       IS_AVAIL1(cpu->extn.timer0, "Timer0 "),
@@ -226,7 +241,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                                 CONFIG_ARC_HAS_RTC));
        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s",
-                           IS_AVAIL2(atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
+                           IS_AVAIL2(cpu->isa.atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
                           IS_AVAIL2(cpu->isa.ldd, "ll64 ", CONFIG_ARC_HAS_LL64),
                           IS_AVAIL1(cpu->isa.unalign, "unalign (not used)"));
@@ -253,7 +268,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                       IS_AVAIL1(cpu->extn.swap, "swap "),
                       IS_AVAIL1(cpu->extn.minmax, "minmax "),
                       IS_AVAIL1(cpu->extn.crc, "crc "),
-                       IS_AVAIL2(1, "swape", CONFIG_ARC_HAS_SWAPE));
+                       IS_AVAIL2(cpu->extn.swape, "swape", CONFIG_ARC_HAS_SWAPE));
        if (cpu->bpu.ver)
                n += scnprintf(buf + n, len - n,
@@ -272,9 +287,7 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
        FIX_PTR(cpu);
-        n += scnprintf(buf + n, len - n,
+        n += scnprintf(buf + n, len - n, "Vector Table\t: %#x\n", cpu->vec_base);
-                       "Vector Table\t: %#x\nPeripherals\t: %#lx:%#lx\n",
-                       cpu->vec_base, perip_base, perip_end);
        if (cpu->extn.fpu_sp || cpu->extn.fpu_dp)
                n += scnprintf(buf + n, len - n, "FPU\t\t: %s%s\n",
@@ -507,7 +520,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
         * way to pass it w/o having to kmalloc/free a 2 byte string.
         * Encode cpu-id as 0xFFcccc, which is decoded by show routine.
         */
-        return *pos < num_possible_cpus() ? cpu_to_ptr(*pos) : NULL;
+        return *pos < nr_cpu_ids ? cpu_to_ptr(*pos) : NULL;
 }
 static void *c_next(struct seq_file *m, void *v, loff_t *pos)
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 934150e7ac48..82f9bc819f4a 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -237,113 +237,3 @@ void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
        if (!user_mode(regs))
                show_stacktrace(current, regs);
 }
-#ifdef CONFIG_DEBUG_FS
-#include <linux/module.h>
-#include <linux/fs.h>
-#include <linux/mount.h>
-#include <linux/pagemap.h>
-#include <linux/init.h>
-#include <linux/namei.h>
-#include <linux/debugfs.h>
-static struct dentry *test_dentry;
-static struct dentry *test_dir;
-static struct dentry *test_u32_dentry;
-static u32 clr_on_read = 1;
-#ifdef CONFIG_ARC_DBG_TLB_MISS_COUNT
-u32 numitlb, numdtlb, num_pte_not_present;
-static int fill_display_data(char *kbuf)
-{
-        size_t num = 0;
-        num += sprintf(kbuf + num, "I-TLB Miss %x\n", numitlb);
-        num += sprintf(kbuf + num, "D-TLB Miss %x\n", numdtlb);
-        num += sprintf(kbuf + num, "PTE not present %x\n", num_pte_not_present);
-        if (clr_on_read)
-                numitlb = numdtlb = num_pte_not_present = 0;
-        return num;
-}
-static int tlb_stats_open(struct inode *inode, struct file *file)
-{
-        file->private_data = (void *)__get_free_page(GFP_KERNEL);
-        return 0;
-}
-/* called on user read(): display the counters */
-static ssize_t tlb_stats_output(struct file *file,      /* file descriptor */
-                                char __user *user_buf,  /* user buffer */
-                                size_t len,             /* length of buffer */
-                                loff_t *offset)         /* offset in the file */
-{
-        size_t num;
-        char *kbuf = (char *)file->private_data;
-        /* All of the data can he shoved in one iteration */
-        if (*offset != 0)
-                return 0;
-        num = fill_display_data(kbuf);
-        /* simple_read_from_buffer() is helper for copy to user space
-           It copies up to @2 (num) bytes from kernel buffer @4 (kbuf) at offset
-           @3 (offset) into the user space address starting at @1 (user_buf).
-           @5 (len) is max size of user buffer
-         */
-        return simple_read_from_buffer(user_buf, num, offset, kbuf, len);
-}
-/* called on user write : clears the counters */
-static ssize_t tlb_stats_clear(struct file *file, const char __user *user_buf,
-                               size_t length, loff_t *offset)
-{
-        numitlb = numdtlb = num_pte_not_present = 0;
-        return length;
-}
-static int tlb_stats_close(struct inode *inode, struct file *file)
-{
-        free_page((unsigned long)(file->private_data));
-        return 0;
-}
-static const struct file_operations tlb_stats_file_ops = {
-        .read = tlb_stats_output,
-        .write = tlb_stats_clear,
-        .open = tlb_stats_open,
-        .release = tlb_stats_close
-};
-#endif
-static int __init arc_debugfs_init(void)
-{
-        test_dir = debugfs_create_dir("arc", NULL);
-#ifdef CONFIG_ARC_DBG_TLB_MISS_COUNT
-        test_dentry = debugfs_create_file("tlb_stats", 0444, test_dir, NULL,
-                                          &tlb_stats_file_ops);
-#endif
-        test_u32_dentry =
-            debugfs_create_u32("clr_on_read", 0444, test_dir, &clr_on_read);
-        return 0;
-}
-module_init(arc_debugfs_init);
-static void __exit arc_debugfs_exit(void)
-{
-        debugfs_remove(test_u32_dentry);
-        debugfs_remove(test_dentry);
-        debugfs_remove(test_dir);
-}
-module_exit(arc_debugfs_exit);
-#endif
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 97dddbefb86a..2b96cfc3be75 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -22,8 +22,8 @@
 #include <asm/setup.h>
 static int l2_line_sz;
-int ioc_exists;
+static int ioc_exists;
-volatile int slc_enable = 1, ioc_enable = 1;
+int slc_enable = 1, ioc_enable = 1;
 unsigned long perip_base = ARC_UNCACHED_ADDR_SPACE; /* legacy value for boot */
 unsigned long perip_end = 0xFFFFFFFF; /* legacy value */
@@ -53,18 +53,15 @@ char *arc_cache_mumbojumbo(int c, char *buf, int len)
        PR_CACHE(&cpuinfo_arc700[c].icache, CONFIG_ARC_HAS_ICACHE, "I-Cache");
        PR_CACHE(&cpuinfo_arc700[c].dcache, CONFIG_ARC_HAS_DCACHE, "D-Cache");
-        if (!is_isa_arcv2())
-                return buf;
        p = &cpuinfo_arc700[c].slc;
        if (p->ver)
                n += scnprintf(buf + n, len - n,
                               "SLC\t\t: %uK, %uB Line%s\n",
                               p->sz_k, p->line_len, IS_USED_RUN(slc_enable));
-        if (ioc_exists)
+        n += scnprintf(buf + n, len - n, "Peripherals\t: %#lx%s%s\n",
-                n += scnprintf(buf + n, len - n, "IOC\t\t:%s\n",
+                       perip_base,
-                                IS_DISABLED_RUN(ioc_enable));
+                       IS_AVAIL3(ioc_exists, ioc_enable, ", IO-Coherency "));
        return buf;
 }
@@ -113,8 +110,10 @@ static void read_decode_cache_bcr_arcv2(int cpu)
        }
        READ_BCR(ARC_REG_CLUSTER_BCR, cbcr);
-        if (cbcr.c && ioc_enable)
+        if (cbcr.c)
                ioc_exists = 1;
+        else
+                ioc_enable = 0;
        /* HS 2.0 didn't have AUX_VOL */
        if (cpuinfo_arc700[cpu].core.family > 0x51) {
@@ -1002,7 +1001,7 @@ void arc_cache_init(void)
                        read_aux_reg(ARC_REG_SLC_CTRL) | SLC_CTRL_DISABLE);
        }
-        if (is_isa_arcv2() && ioc_exists) {
+        if (is_isa_arcv2() && ioc_enable) {
                /* IO coherency base - 0x8z */
                write_aux_reg(ARC_REG_IO_COH_AP0_BASE, 0x80000);
                /* IO coherency aperture size - 512Mb: 0x8z-0xAz */
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 20afc65e22dc..60aab5a7522b 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -45,7 +45,7 @@ static void *arc_dma_alloc(struct device *dev, size_t size,
         *   -For coherent data, Read/Write to buffers terminate early in cache
         *   (vs. always going to memory - thus are faster)
         */
-        if ((is_isa_arcv2() && ioc_exists) ||
+        if ((is_isa_arcv2() && ioc_enable) ||
            (attrs & DMA_ATTR_NON_CONSISTENT))
                need_coh = 0;
@@ -97,7 +97,7 @@ static void arc_dma_free(struct device *dev, size_t size, void *vaddr,
        int is_non_coh = 1;
        is_non_coh = (attrs & DMA_ATTR_NON_CONSISTENT) ||
-                        (is_isa_arcv2() && ioc_exists);
+                        (is_isa_arcv2() && ioc_enable);
        if (PageHighMem(page) || !is_non_coh)
                iounmap((void __force __iomem *)vaddr);
diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
index ec868a9081a1..bdb295e09160 100644
--- a/arch/arc/mm/tlb.c
+++ b/arch/arc/mm/tlb.c
@@ -793,16 +793,16 @@ char *arc_mmu_mumbojumbo(int cpu_id, char *buf, int len)
        char super_pg[64] = "";
        if (p_mmu->s_pg_sz_m)
-                scnprintf(super_pg, 64, "%dM Super Page%s, ",
+                scnprintf(super_pg, 64, "%dM Super Page %s",
                          p_mmu->s_pg_sz_m,
                          IS_USED_CFG(CONFIG_TRANSPARENT_HUGEPAGE));
        n += scnprintf(buf + n, len - n,
-                      "MMU [v%x]\t: %dk PAGE, %sJTLB %d (%dx%d), uDTLB %d, uITLB %d %s%s\n",
+                      "MMU [v%x]\t: %dk PAGE, %sJTLB %d (%dx%d), uDTLB %d, uITLB %d%s%s\n",
                       p_mmu->ver, p_mmu->pg_sz_k, super_pg,
                       p_mmu->sets * p_mmu->ways, p_mmu->sets, p_mmu->ways,
                       p_mmu->u_dtlb, p_mmu->u_itlb,
-                       IS_AVAIL2(p_mmu->pae, "PAE40 ", CONFIG_ARC_HAS_PAE40));
+                       IS_AVAIL2(p_mmu->pae, ", PAE40 ", CONFIG_ARC_HAS_PAE40));
        return buf;
 }
diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S
index f1967eeb32e7..b30e4e36bb00 100644
--- a/arch/arc/mm/tlbex.S
+++ b/arch/arc/mm/tlbex.S
@@ -237,15 +237,6 @@ ex_saved_reg1:
 2:
-#ifdef CONFIG_ARC_DBG_TLB_MISS_COUNT
-        and.f 0, r0, _PAGE_PRESENT
-        bz   1f
-        ld   r3, [num_pte_not_present]
-        add  r3, r3, 1
-        st   r3, [num_pte_not_present]
-1:
-#endif
 .endm
 ;-----------------------------------------------------------------
@@ -309,12 +300,6 @@ ENTRY(EV_TLBMissI)
        TLBMISS_FREEUP_REGS
-#ifdef CONFIG_ARC_DBG_TLB_MISS_COUNT
-        ld  r0, [@numitlb]
-        add r0, r0, 1
-        st  r0, [@numitlb]
-#endif
        ;----------------------------------------------------------------
        ; Get the PTE corresponding to V-addr accessed, r2 is setup with EFA
        LOAD_FAULT_PTE
@@ -349,12 +334,6 @@ ENTRY(EV_TLBMissD)
        TLBMISS_FREEUP_REGS
-#ifdef CONFIG_ARC_DBG_TLB_MISS_COUNT
-        ld  r0, [@numdtlb]
-        add r0, r0, 1
-        st  r0, [@numdtlb]
-#endif
        ;----------------------------------------------------------------
        ; Get the PTE corresponding to V-addr accessed
        ; If PTE exists, it will setup, r0 = PTE, r1 = Ptr to PTE, r2 = EFA
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index ba62df8c6e35..b71086d25195 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -217,7 +217,7 @@ static inline void *phys_to_virt(phys_addr_t x)
 #define _virt_addr_valid(kaddr) pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 #else
 #define __virt_to_pgoff(kaddr)  (((u64)(kaddr) & ~PAGE_OFFSET) / PAGE_SIZE * sizeof(struct page))
-#define __page_to_voff(kaddr)   (((u64)(page) & ~VMEMMAP_START) * PAGE_SIZE / sizeof(struct page))
+#define __page_to_voff(page)    (((u64)(page) & ~VMEMMAP_START) * PAGE_SIZE / sizeof(struct page))
 #define page_to_virt(page)      ((void *)((__page_to_voff(page)) | PAGE_OFFSET))
 #define virt_to_page(vaddr)     ((struct page *)((__virt_to_pgoff(vaddr)) | VMEMMAP_START))
diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
index 778a985c8a70..4b32168cf91a 100644
--- a/arch/arm64/mm/numa.c
+++ b/arch/arm64/mm/numa.c
@@ -147,7 +147,7 @@ static int __init early_cpu_to_node(int cpu)
 static int __init pcpu_cpu_distance(unsigned int from, unsigned int to)
 {
-        return node_distance(from, to);
+        return node_distance(early_cpu_to_node(from), early_cpu_to_node(to));
 }
 static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size,
@@ -223,8 +223,11 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
        void *nd;
        int tnid;
-        pr_info("Initmem setup node %d [mem %#010Lx-%#010Lx]\n",
+        if (start_pfn < end_pfn)
-                nid, start_pfn << PAGE_SHIFT, (end_pfn << PAGE_SHIFT) - 1);
+                pr_info("Initmem setup node %d [mem %#010Lx-%#010Lx]\n", nid,
+                        start_pfn << PAGE_SHIFT, (end_pfn << PAGE_SHIFT) - 1);
+        else
+                pr_info("Initmem setup node %d [<memory-less node>]\n", nid);
        nd_pa = memblock_alloc_try_nid(nd_size, SMP_CACHE_BYTES, nid);
        nd = __va(nd_pa);
diff --git a/arch/cris/arch-v32/drivers/cryptocop.c b/arch/cris/arch-v32/drivers/cryptocop.c
index 099e170a93ee..0068fd411a84 100644
--- a/arch/cris/arch-v32/drivers/cryptocop.c
+++ b/arch/cris/arch-v32/drivers/cryptocop.c
@@ -3149,7 +3149,7 @@ static void print_dma_descriptors(struct cryptocop_int_operation *iop)
        printk("print_dma_descriptors start\n");
        printk("iop:\n");
-        printk("\tsid: 0x%lld\n", iop->sid);
+        printk("\tsid: 0x%llx\n", iop->sid);
        printk("\tcdesc_out: 0x%p\n", iop->cdesc_out);
        printk("\tcdesc_in: 0x%p\n", iop->cdesc_in);
diff --git a/arch/h8300/include/asm/thread_info.h b/arch/h8300/include/asm/thread_info.h
index b408fe660cf8..3cef06875f5c 100644
--- a/arch/h8300/include/asm/thread_info.h
+++ b/arch/h8300/include/asm/thread_info.h
@@ -31,7 +31,6 @@ struct thread_info {
        int                cpu;                 /* cpu we're on */
        int                preempt_count;       /* 0 => preemptable, <0 => BUG */
        mm_segment_t            addr_limit;
-        struct restart_block restart_block;
 };
 /*
@@ -44,9 +43,6 @@ struct thread_info {
        .cpu =          0,                      \
        .preempt_count = INIT_PREEMPT_COUNT,    \
        .addr_limit     = KERNEL_DS,            \
-        .restart_block  = {                     \
-                .fn = do_no_restart_syscall,    \
-        },                                      \
 }
 #define init_thread_info        (init_thread_union.thread_info)
diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c
index ad1f81f574e5..7138303cbbf2 100644
--- a/arch/h8300/kernel/signal.c
+++ b/arch/h8300/kernel/signal.c
@@ -79,7 +79,7 @@ restore_sigcontext(struct sigcontext *usc, int *pd0)
        unsigned int er0;
        /* Always make any pending restarted system calls return -EINTR */
-        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+        current->restart_block.fn = do_no_restart_syscall;
        /* restore passed registers */
 #define COPY(r)  do { err |= get_user(regs->r, &usc->sc_##r); } while (0)
diff --git a/arch/powerpc/include/asm/cpuidle.h b/arch/powerpc/include/asm/cpuidle.h
index 01b8a13f0224..3919332965af 100644
--- a/arch/powerpc/include/asm/cpuidle.h
+++ b/arch/powerpc/include/asm/cpuidle.h
@@ -26,7 +26,7 @@ extern u64 pnv_first_deep_stop_state;
        std     r0,0(r1);                                       \
        ptesync;                                                \
        ld      r0,0(r1);                                       \
-1:      cmp     cr0,r0,r0;                                      \
+1:      cmpd    cr0,r0,r0;                                      \
        bne     1b;                                             \
        IDLE_INST;                                              \
        b       .
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 2e4e7d878c8e..84d49b197c32 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -93,6 +93,10 @@
        ld      reg,PACAKBASE(r13);     /* get high part of &label */   \
        ori     reg,reg,(FIXED_SYMBOL_ABS_ADDR(label))@l;
+#define __LOAD_HANDLER(reg, label)                                      \
+        ld      reg,PACAKBASE(r13);                                     \
+        ori     reg,reg,(ABS_ADDR(label))@l;
 /* Exception register prefixes */
 #define EXC_HV  H
 #define EXC_STD
@@ -208,6 +212,18 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
 #define kvmppc_interrupt kvmppc_interrupt_pr
 #endif
+#ifdef CONFIG_RELOCATABLE
+#define BRANCH_TO_COMMON(reg, label)                                    \
+        __LOAD_HANDLER(reg, label);                                     \
+        mtctr   reg;                                                    \
+        bctr
+#else
+#define BRANCH_TO_COMMON(reg, label)                                    \
+        b       label
+#endif
 #define __KVM_HANDLER_PROLOG(area, n)                                   \
        BEGIN_FTR_SECTION_NESTED(947)                                   \
        ld      r10,area+EX_CFAR(r13);                                  \
diff --git a/arch/powerpc/include/asm/tlb.h b/arch/powerpc/include/asm/tlb.h
index f6f68f73e858..99e1397b71da 100644
--- a/arch/powerpc/include/asm/tlb.h
+++ b/arch/powerpc/include/asm/tlb.h
@@ -52,11 +52,23 @@ static inline int mm_is_core_local(struct mm_struct *mm)
        return cpumask_subset(mm_cpumask(mm),
                              topology_sibling_cpumask(smp_processor_id()));
 }
+static inline int mm_is_thread_local(struct mm_struct *mm)
+{
+        return cpumask_equal(mm_cpumask(mm),
+                              cpumask_of(smp_processor_id()));
+}
 #else
 static inline int mm_is_core_local(struct mm_struct *mm)
 {
        return 1;
 }
+static inline int mm_is_thread_local(struct mm_struct *mm)
+{
+        return 1;
+}
 #endif
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index f129408c6022..08ba447a4b3d 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -95,19 +95,35 @@ __start_interrupts:
 /* No virt vectors corresponding with 0x0..0x100 */
 EXC_VIRT_NONE(0x4000, 0x4100)
-EXC_REAL_BEGIN(system_reset, 0x100, 0x200)
-        SET_SCRATCH0(r13)
 #ifdef CONFIG_PPC_P7_NAP
-BEGIN_FTR_SECTION
+        /*
-        /* Running native on arch 2.06 or later, check if we are
+         * If running native on arch 2.06 or later, check if we are waking up
-         * waking up from nap/sleep/winkle.
+         * from nap/sleep/winkle, and branch to idle handler.
         */
-        mfspr   r13,SPRN_SRR1
+#define IDLETEST(n)                                                     \
-        rlwinm. r13,r13,47-31,30,31
+        BEGIN_FTR_SECTION ;                                             \
-        beq     9f
+        mfspr   r10,SPRN_SRR1 ;                                         \
+        rlwinm. r10,r10,47-31,30,31 ;                                   \
+        beq-    1f ;                                                    \
+        cmpwi   cr3,r10,2 ;                                             \
+        BRANCH_TO_COMMON(r10, system_reset_idle_common) ;               \
+1:                                                                      \
+        END_FTR_SECTION_IFSET(CPU_FTR_HVMODE | CPU_FTR_ARCH_206)
+#else
+#define IDLETEST NOTEST
+#endif
-        cmpwi   cr3,r13,2
+EXC_REAL_BEGIN(system_reset, 0x100, 0x200)
-        GET_PACA(r13)
+        SET_SCRATCH0(r13)
+        EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common, EXC_STD,
+                                 IDLETEST, 0x100)
+EXC_REAL_END(system_reset, 0x100, 0x200)
+EXC_VIRT_NONE(0x4100, 0x4200)
+#ifdef CONFIG_PPC_P7_NAP
+EXC_COMMON_BEGIN(system_reset_idle_common)
        bl      pnv_restore_hyp_resource
        li      r0,PNV_THREAD_RUNNING
@@ -130,14 +146,8 @@ BEGIN_FTR_SECTION
        blt     cr3,2f
        b       pnv_wakeup_loss
 2:      b       pnv_wakeup_noloss
+#endif
-9:
-END_FTR_SECTION_IFSET(CPU_FTR_HVMODE | CPU_FTR_ARCH_206)
-#endif /* CONFIG_PPC_P7_NAP */
-        EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common, EXC_STD,
-                                 NOTEST, 0x100)
-EXC_REAL_END(system_reset, 0x100, 0x200)
-EXC_VIRT_NONE(0x4100, 0x4200)
 EXC_COMMON(system_reset_common, 0x100, system_reset_exception)
 #ifdef CONFIG_PPC_PSERIES
@@ -817,10 +827,8 @@ EXC_VIRT(trap_0b, 0x4b00, 0x4c00, 0xb00)
 TRAMP_KVM(PACA_EXGEN, 0xb00)
 EXC_COMMON(trap_0b_common, 0xb00, unknown_exception)
+#define LOAD_SYSCALL_HANDLER(reg)                                       \
-#define LOAD_SYSCALL_HANDLER(reg)                               \
+        __LOAD_HANDLER(reg, system_call_common)
-        ld      reg,PACAKBASE(r13);                             \
-        ori     reg,reg,(ABS_ADDR(system_call_common))@l;
 /* Syscall routine is used twice, in reloc-off and reloc-on paths */
 #define SYSCALL_PSERIES_1                                       \
diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
index 9781c69eae57..03d089b3ed72 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -275,7 +275,7 @@ int hw_breakpoint_handler(struct die_args *args)
        if (!stepped) {
                WARN(1, "Unable to handle hardware breakpoint. Breakpoint at "
                        "0x%lx will be disabled.", info->address);
-                perf_event_disable(bp);
+                perf_event_disable_inatomic(bp);
                goto out;
        }
        /*
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index bd739fed26e3..72dac0b58061 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -90,6 +90,7 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_300)
 * Threads will spin in HMT_LOW until the lock bit is cleared.
 * r14 - pointer to core_idle_state
 * r15 - used to load contents of core_idle_state
+ * r9  - used as a temporary variable
 */
 core_idle_lock_held:
@@ -99,6 +100,8 @@ core_idle_lock_held:
        bne     3b
        HMT_MEDIUM
        lwarx   r15,0,r14
+        andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
+        bne     core_idle_lock_held
        blr
 /*
@@ -163,12 +166,6 @@ _GLOBAL(pnv_powersave_common)
        std     r9,_MSR(r1)
        std     r1,PACAR1(r13)
-#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
-        /* Tell KVM we're entering idle */
-        li      r4,KVM_HWTHREAD_IN_IDLE
-        stb     r4,HSTATE_HWTHREAD_STATE(r13)
-#endif
        /*
         * Go to real mode to do the nap, as required by the architecture.
         * Also, we need to be in real mode before setting hwthread_state,
@@ -185,6 +182,26 @@ _GLOBAL(pnv_powersave_common)
        .globl pnv_enter_arch207_idle_mode
 pnv_enter_arch207_idle_mode:
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+        /* Tell KVM we're entering idle */
+        li      r4,KVM_HWTHREAD_IN_IDLE
+        /******************************************************/
+        /*  N O T E   W E L L    ! ! !    N O T E   W E L L   */
+        /* The following store to HSTATE_HWTHREAD_STATE(r13)  */
+        /* MUST occur in real mode, i.e. with the MMU off,    */
+        /* and the MMU must stay off until we clear this flag */
+        /* and test HSTATE_HWTHREAD_REQ(r13) in the system    */
+        /* reset interrupt vector in exceptions-64s.S.        */
+        /* The reason is that another thread can switch the   */
+        /* MMU to a guest context whenever this flag is set   */
+        /* to KVM_HWTHREAD_IN_IDLE, and if the MMU was on,    */
+        /* that would potentially cause this thread to start  */
+        /* executing instructions from guest memory in        */
+        /* hypervisor mode, leading to a host crash or data   */
+        /* corruption, or worse.                              */
+        /******************************************************/
+        stb     r4,HSTATE_HWTHREAD_STATE(r13)
+#endif
        stb     r3,PACA_THREAD_IDLE_STATE(r13)
        cmpwi   cr3,r3,PNV_THREAD_SLEEP
        bge     cr3,2f
@@ -250,6 +267,12 @@ enter_winkle:
 * r3 - requested stop state
 */
 power_enter_stop:
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+        /* Tell KVM we're entering idle */
+        li      r4,KVM_HWTHREAD_IN_IDLE
+        /* DO THIS IN REAL MODE!  See comment above. */
+        stb     r4,HSTATE_HWTHREAD_STATE(r13)
+#endif
 /*
 * Check if the requested state is a deep idle state.
 */
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 9e7c10fe205f..ce6dc61b15b2 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1012,7 +1012,7 @@ void restore_tm_state(struct pt_regs *regs)
        /* Ensure that restore_math() will restore */
        if (msr_diff & MSR_FP)
                current->thread.load_fp = 1;
-#ifdef CONFIG_ALIVEC
+#ifdef CONFIG_ALTIVEC
        if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC)
                current->thread.load_vec = 1;
 #endif
diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
index 82ff5de8b1e7..a0ea63ac2b52 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
@@ -23,6 +23,7 @@
 #include <asm/ppc-opcode.h>
 #include <asm/pnv-pci.h>
 #include <asm/opal.h>
+#include <asm/smp.h>
 #include "book3s_xics.h"
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 0e49ec541ab5..bda8c43be78a 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -175,7 +175,7 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
        if (unlikely(pid == MMU_NO_CONTEXT))
                goto no_context;
-        if (!mm_is_core_local(mm)) {
+        if (!mm_is_thread_local(mm)) {
                int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
                if (lock_tlbie)
@@ -201,7 +201,7 @@ void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr)
        if (unlikely(pid == MMU_NO_CONTEXT))
                goto no_context;
-        if (!mm_is_core_local(mm)) {
+        if (!mm_is_thread_local(mm)) {
                int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
                if (lock_tlbie)
@@ -226,7 +226,7 @@ void radix__flush_tlb_page_psize(struct mm_struct *mm, unsigned long vmaddr,
        pid = mm ? mm->context.id : 0;
        if (unlikely(pid == MMU_NO_CONTEXT))
                goto bail;
-        if (!mm_is_core_local(mm)) {
+        if (!mm_is_thread_local(mm)) {
                int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
                if (lock_tlbie)
@@ -321,7 +321,7 @@ void radix__flush_tlb_range_psize(struct mm_struct *mm, unsigned long start,
 {
        unsigned long pid;
        unsigned long addr;
-        int local = mm_is_core_local(mm);
+        int local = mm_is_thread_local(mm);
        unsigned long ap = mmu_get_ap(psize);
        int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
        unsigned long page_size = 1UL << mmu_psize_defs[psize].shift;
diff --git a/arch/s390/include/asm/ftrace.h b/arch/s390/include/asm/ftrace.h
index 64053d9ac3f2..836c56290499 100644
--- a/arch/s390/include/asm/ftrace.h
+++ b/arch/s390/include/asm/ftrace.h
@@ -12,9 +12,7 @@
 #ifndef __ASSEMBLY__
-unsigned long return_address(int depth);
+#define ftrace_return_address(n) __builtin_return_address(n)
-#define ftrace_return_address(n) return_address(n)
 void _mcount(void);
 void ftrace_caller(void);
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 03323175de30..602af692efdc 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -192,7 +192,7 @@ struct task_struct;
 struct mm_struct;
 struct seq_file;
-typedef int (*dump_trace_func_t)(void *data, unsigned long address);
+typedef int (*dump_trace_func_t)(void *data, unsigned long address, int reliable);
 void dump_trace(dump_trace_func_t func, void *data,
                struct task_struct *task, unsigned long sp);
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index 02613bad8bbb..3066031a73fe 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -9,6 +9,9 @@
 #include <uapi/asm/unistd.h>
 #define __IGNORE_time
+#define __IGNORE_pkey_mprotect
+#define __IGNORE_pkey_alloc
+#define __IGNORE_pkey_free
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index 43446fa2a4e5..c74c59236f44 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -2014,12 +2014,12 @@ void show_code(struct pt_regs *regs)
                        *ptr++ = '\t';
                ptr += print_insn(ptr, code + start, addr);
                start += opsize;
-                printk("%s", buffer);
+                pr_cont("%s", buffer);
                ptr = buffer;
                ptr += sprintf(ptr, "\n          ");
                hops++;
        }
-        printk("\n");
+        pr_cont("\n");
 }
 void print_fn_code(unsigned char *code, unsigned long len)
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index 6693383bc01b..55d4fe174fd9 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -38,10 +38,10 @@ __dump_trace(dump_trace_func_t func, void *data, unsigned long sp,
                if (sp < low || sp > high - sizeof(*sf))
                        return sp;
                sf = (struct stack_frame *) sp;
+                if (func(data, sf->gprs[8], 0))
+                        return sp;
                /* Follow the backchain. */
                while (1) {
-                        if (func(data, sf->gprs[8]))
-                                return sp;
                        low = sp;
                        sp = sf->back_chain;
                        if (!sp)
@@ -49,6 +49,8 @@ __dump_trace(dump_trace_func_t func, void *data, unsigned long sp,
                        if (sp <= low || sp > high - sizeof(*sf))
                                return sp;
                        sf = (struct stack_frame *) sp;
+                        if (func(data, sf->gprs[8], 1))
+                                return sp;
                }
                /* Zero backchain detected, check for interrupt frame. */
                sp = (unsigned long) (sf + 1);
@@ -56,7 +58,7 @@ __dump_trace(dump_trace_func_t func, void *data, unsigned long sp,
                        return sp;
                regs = (struct pt_regs *) sp;
                if (!user_mode(regs)) {
-                        if (func(data, regs->psw.addr))
+                        if (func(data, regs->psw.addr, 1))
                                return sp;
                }
                low = sp;
@@ -85,33 +87,12 @@ void dump_trace(dump_trace_func_t func, void *data, struct task_struct *task,
 }
 EXPORT_SYMBOL_GPL(dump_trace);
-struct return_address_data {
+static int show_address(void *data, unsigned long address, int reliable)
-        unsigned long address;
-        int depth;
-};
-static int __return_address(void *data, unsigned long address)
-{
-        struct return_address_data *rd = data;
-        if (rd->depth--)
-                return 0;
-        rd->address = address;
-        return 1;
-}
-unsigned long return_address(int depth)
-{
-        struct return_address_data rd = { .depth = depth + 2 };
-        dump_trace(__return_address, &rd, NULL, current_stack_pointer());
-        return rd.address;
-}
-EXPORT_SYMBOL_GPL(return_address);
-static int show_address(void *data, unsigned long address)
 {
-        printk("([<%016lx>] %pSR)\n", address, (void *)address);
+        if (reliable)
+                printk(" [<%016lx>] %pSR \n", address, (void *)address);
+        else
+                printk("([<%016lx>] %pSR)\n", address, (void *)address);
        return 0;
 }
@@ -138,14 +119,14 @@ void show_stack(struct task_struct *task, unsigned long *sp)
                else
                        stack = (unsigned long *)task->thread.ksp;
        }
+        printk(KERN_DEFAULT "Stack:\n");
        for (i = 0; i < 20; i++) {
                if (((addr_t) stack & (THREAD_SIZE-1)) == 0)
                        break;
-                if ((i * sizeof(long) % 32) == 0)
+                if (i % 4 == 0)
-                        printk("%s       ", i == 0 ? "" : "\n");
+                        printk(KERN_DEFAULT "       ");
-                printk("%016lx ", *stack++);
+                pr_cont("%016lx%c", *stack++, i % 4 == 3 ? '\n' : ' ');
        }
-        printk("\n");
        show_trace(task, (unsigned long)sp);
 }
@@ -163,13 +144,13 @@ void show_registers(struct pt_regs *regs)
        mode = user_mode(regs) ? "User" : "Krnl";
        printk("%s PSW : %p %p", mode, (void *)regs->psw.mask, (void *)regs->psw.addr);
        if (!user_mode(regs))
-                printk(" (%pSR)", (void *)regs->psw.addr);
+                pr_cont(" (%pSR)", (void *)regs->psw.addr);
-        printk("\n");
+        pr_cont("\n");
        printk("           R:%x T:%x IO:%x EX:%x Key:%x M:%x W:%x "
               "P:%x AS:%x CC:%x PM:%x", psw->r, psw->t, psw->i, psw->e,
               psw->key, psw->m, psw->w, psw->p, psw->as, psw->cc, psw->pm);
-        printk(" RI:%x EA:%x", psw->ri, psw->eaba);
+        pr_cont(" RI:%x EA:%x\n", psw->ri, psw->eaba);
-        printk("\n%s GPRS: %016lx %016lx %016lx %016lx\n", mode,
+        printk("%s GPRS: %016lx %016lx %016lx %016lx\n", mode,
               regs->gprs[0], regs->gprs[1], regs->gprs[2], regs->gprs[3]);
        printk("           %016lx %016lx %016lx %016lx\n",
               regs->gprs[4], regs->gprs[5], regs->gprs[6], regs->gprs[7]);
@@ -205,14 +186,14 @@ void die(struct pt_regs *regs, const char *str)
        printk("%s: %04x ilc:%d [#%d] ", str, regs->int_code & 0xffff,
               regs->int_code >> 17, ++die_counter);
 #ifdef CONFIG_PREEMPT
-        printk("PREEMPT ");
+        pr_cont("PREEMPT ");
 #endif
 #ifdef CONFIG_SMP
-        printk("SMP ");
+        pr_cont("SMP ");
 #endif
        if (debug_pagealloc_enabled())
-                printk("DEBUG_PAGEALLOC");
+                pr_cont("DEBUG_PAGEALLOC");
-        printk("\n");
+        pr_cont("\n");
        notify_die(DIE_OOPS, str, regs, 0, regs->int_code & 0xffff, SIGSEGV);
        print_modules();
        show_regs(regs);
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index 17431f63de00..955a7b6fa0a4 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -222,7 +222,7 @@ static int __init service_level_perf_register(void)
 }
 arch_initcall(service_level_perf_register);
-static int __perf_callchain_kernel(void *data, unsigned long address)
+static int __perf_callchain_kernel(void *data, unsigned long address, int reliable)
 {
        struct perf_callchain_entry_ctx *entry = data;
diff --git a/arch/s390/kernel/stacktrace.c b/arch/s390/kernel/stacktrace.c
index 44f84b23d4e5..355db9db8210 100644
--- a/arch/s390/kernel/stacktrace.c
+++ b/arch/s390/kernel/stacktrace.c
@@ -27,12 +27,12 @@ static int __save_address(void *data, unsigned long address, int nosched)
        return 1;
 }
-static int save_address(void *data, unsigned long address)
+static int save_address(void *data, unsigned long address, int reliable)
 {
        return __save_address(data, address, 0);
 }
-static int save_address_nosched(void *data, unsigned long address)
+static int save_address_nosched(void *data, unsigned long address, int reliable)
 {
        return __save_address(data, address, 1);
 }
diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index cd404aa3931c..4a0c5bce3552 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c
@@ -217,6 +217,7 @@ static __init int setup_hugepagesz(char *opt)
        } else if (MACHINE_HAS_EDAT2 && size == PUD_SIZE) {
                hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
        } else {
+                hugetlb_bad_size();
                pr_err("hugepagesz= specifies an unsupported page size %s\n",
                        string);
                return 0;
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index f56a39bd8ba6..b3e9d18f2ec6 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -151,36 +151,40 @@ void __init free_initrd_mem(unsigned long start, unsigned long end)
 #ifdef CONFIG_MEMORY_HOTPLUG
 int arch_add_memory(int nid, u64 start, u64 size, bool for_device)
 {
-        unsigned long normal_end_pfn = PFN_DOWN(memblock_end_of_DRAM());
+        unsigned long zone_start_pfn, zone_end_pfn, nr_pages;
-        unsigned long dma_end_pfn = PFN_DOWN(MAX_DMA_ADDRESS);
        unsigned long start_pfn = PFN_DOWN(start);
        unsigned long size_pages = PFN_DOWN(size);
-        unsigned long nr_pages;
+        pg_data_t *pgdat = NODE_DATA(nid);
-        int rc, zone_enum;
+        struct zone *zone;
+        int rc, i;
        rc = vmem_add_mapping(start, size);
        if (rc)
                return rc;
-        while (size_pages > 0) {
+        for (i = 0; i < MAX_NR_ZONES; i++) {
-                if (start_pfn < dma_end_pfn) {
+                zone = pgdat->node_zones + i;
-                        nr_pages = (start_pfn + size_pages > dma_end_pfn) ?
+                if (zone_idx(zone) != ZONE_MOVABLE) {
-                                   dma_end_pfn - start_pfn : size_pages;
+                        /* Add range within existing zone limits, if possible */
-                        zone_enum = ZONE_DMA;
+                        zone_start_pfn = zone->zone_start_pfn;
-                } else if (start_pfn < normal_end_pfn) {
+                        zone_end_pfn = zone->zone_start_pfn +
-                        nr_pages = (start_pfn + size_pages > normal_end_pfn) ?
+                                       zone->spanned_pages;
-                                   normal_end_pfn - start_pfn : size_pages;
-                        zone_enum = ZONE_NORMAL;
                } else {
-                        nr_pages = size_pages;
+                        /* Add remaining range to ZONE_MOVABLE */
-                        zone_enum = ZONE_MOVABLE;
+                        zone_start_pfn = start_pfn;
+                        zone_end_pfn = start_pfn + size_pages;
                }
-                rc = __add_pages(nid, NODE_DATA(nid)->node_zones + zone_enum,
+                if (start_pfn < zone_start_pfn || start_pfn >= zone_end_pfn)
-                                 start_pfn, size_pages);
+                        continue;
+                nr_pages = (start_pfn + size_pages > zone_end_pfn) ?
+                           zone_end_pfn - start_pfn : size_pages;
+                rc = __add_pages(nid, zone, start_pfn, nr_pages);
                if (rc)
                        break;
                start_pfn += nr_pages;
                size_pages -= nr_pages;
+                if (!size_pages)
+                        break;
        }
        if (rc)
                vmem_remove_mapping(start, size);
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index 16f4c3960b87..9a4de4599c7b 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -13,7 +13,7 @@
 #include <linux/init.h>
 #include <asm/processor.h>
-static int __s390_backtrace(void *data, unsigned long address)
+static int __s390_backtrace(void *data, unsigned long address, int reliable)
 {
        unsigned int *depth = data;
diff --git a/arch/x86/entry/Makefile b/arch/x86/entry/Makefile
index 77f28ce9c646..9976fcecd17e 100644
--- a/arch/x86/entry/Makefile
+++ b/arch/x86/entry/Makefile
@@ -5,8 +5,8 @@
 OBJECT_FILES_NON_STANDARD_entry_$(BITS).o   := y
 OBJECT_FILES_NON_STANDARD_entry_64_compat.o := y
-CFLAGS_syscall_64.o             += -Wno-override-init
+CFLAGS_syscall_64.o             += $(call cc-option,-Wno-override-init,)
-CFLAGS_syscall_32.o             += -Wno-override-init
+CFLAGS_syscall_32.o             += $(call cc-option,-Wno-override-init,)
 obj-y                           := entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o
 obj-y                           += common.o
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index eab0915f5995..a74a2dbc0180 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3607,10 +3607,14 @@ __init int intel_pmu_init(void)
        /*
         * Quirk: v2 perfmon does not report fixed-purpose events, so
-         * assume at least 3 events:
+         * assume at least 3 events, when not running in a hypervisor:
         */
-        if (version > 1)
+        if (version > 1) {
-                x86_pmu.num_counters_fixed = max((int)edx.split.num_counters_fixed, 3);
+                int assume = 3 * !boot_cpu_has(X86_FEATURE_HYPERVISOR);
+                x86_pmu.num_counters_fixed =
+                        max((int)edx.split.num_counters_fixed, assume);
+        }
        if (boot_cpu_has(X86_FEATURE_PDCM)) {
                u64 capabilities;
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 3ca87b5a8677..4f5ac726335f 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -48,7 +48,8 @@
 *                             Scope: Core
 *      MSR_CORE_C6_RESIDENCY: CORE C6 Residency Counter
 *                             perf code: 0x02
- *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW,SKL
+ *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW
+ *                                              SKL,KNL
 *                             Scope: Core
 *      MSR_CORE_C7_RESIDENCY: CORE C7 Residency Counter
 *                             perf code: 0x03
@@ -56,15 +57,16 @@
 *                             Scope: Core
 *      MSR_PKG_C2_RESIDENCY:  Package C2 Residency Counter.
 *                             perf code: 0x00
- *                             Available model: SNB,IVB,HSW,BDW,SKL
+ *                             Available model: SNB,IVB,HSW,BDW,SKL,KNL
 *                             Scope: Package (physical package)
 *      MSR_PKG_C3_RESIDENCY:  Package C3 Residency Counter.
 *                             perf code: 0x01
- *                             Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL
+ *                             Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,KNL
 *                             Scope: Package (physical package)
 *      MSR_PKG_C6_RESIDENCY:  Package C6 Residency Counter.
 *                             perf code: 0x02
- *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW,SKL
+ *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW
+ *                                              SKL,KNL
 *                             Scope: Package (physical package)
 *      MSR_PKG_C7_RESIDENCY:  Package C7 Residency Counter.
 *                             perf code: 0x03
@@ -118,6 +120,7 @@ struct cstate_model {
 /* Quirk flags */
 #define SLM_PKG_C6_USE_C7_MSR   (1UL << 0)
+#define KNL_CORE_C6_MSR         (1UL << 1)
 struct perf_cstate_msr {
        u64     msr;
@@ -488,6 +491,18 @@ static const struct cstate_model slm_cstates __initconst = {
        .quirks                 = SLM_PKG_C6_USE_C7_MSR,
 };
+static const struct cstate_model knl_cstates __initconst = {
+        .core_events            = BIT(PERF_CSTATE_CORE_C6_RES),
+        .pkg_events             = BIT(PERF_CSTATE_PKG_C2_RES) |
+                                  BIT(PERF_CSTATE_PKG_C3_RES) |
+                                  BIT(PERF_CSTATE_PKG_C6_RES),
+        .quirks                 = KNL_CORE_C6_MSR,
+};
 #define X86_CSTATES_MODEL(model, states)                                \
        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long) &(states) }
@@ -523,6 +538,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
        X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_MOBILE,  snb_cstates),
        X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNL, knl_cstates),
        { },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
@@ -558,6 +575,11 @@ static int __init cstate_probe(const struct cstate_model *cm)
        if (cm->quirks & SLM_PKG_C6_USE_C7_MSR)
                pkg_msr[PERF_CSTATE_PKG_C6_RES].msr = MSR_PKG_C7_RESIDENCY;
+        /* KNL has different MSR for CORE C6 */
+        if (cm->quirks & KNL_CORE_C6_MSR)
+                pkg_msr[PERF_CSTATE_CORE_C6_RES].msr = MSR_KNL_CORE_C6_RESIDENCY;
        has_cstate_core = cstate_probe_msr(cm->core_events,
                                           PERF_CSTATE_CORE_EVENT_MAX,
                                           core_msr, core_events_attrs);
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index de25aad07853..d34bd370074b 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -351,4 +351,10 @@ extern void arch_phys_wc_del(int handle);
 #define arch_phys_wc_add arch_phys_wc_add
 #endif
+#ifdef CONFIG_X86_PAT
+extern int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size);
+extern void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size);
+#define arch_io_reserve_memtype_wc arch_io_reserve_memtype_wc
+#endif
 #endif /* _ASM_X86_IO_H */
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 8a5abaa7d453..931ced8ca345 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -454,6 +454,7 @@ static void __init acpi_sci_ioapic_setup(u8 bus_irq, u16 polarity, u16 trigger,
                polarity = acpi_sci_flags & ACPI_MADT_POLARITY_MASK;
        mp_override_legacy_irq(bus_irq, polarity, trigger, gsi);
+        acpi_penalize_sci_irq(bus_irq, trigger, polarity);
        /*
         * stash over-ride to indicate we've been here
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 620ab06bcf45..017bda12caae 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -429,7 +429,7 @@ int __init save_microcode_in_initrd_amd(void)
         * We need the physical address of the container for both bitness since
         * boot_params.hdr.ramdisk_image is a physical address.
         */
-        cont    = __pa(container);
+        cont    = __pa_nodebug(container);
        cont_va = container;
 #endif
diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S
index efe73aacf966..7b0d3da52fb4 100644
--- a/arch/x86/kernel/mcount_64.S
+++ b/arch/x86/kernel/mcount_64.S
@@ -18,8 +18,10 @@
 #ifdef CC_USING_FENTRY
 # define function_hook  __fentry__
+EXPORT_SYMBOL(__fentry__)
 #else
 # define function_hook  mcount
+EXPORT_SYMBOL(mcount)
 #endif
 /* All cases save the original rbp (8 bytes) */
@@ -295,7 +297,6 @@ trace:
        jmp fgraph_trace
 END(function_hook)
 #endif /* CONFIG_DYNAMIC_FTRACE */
-EXPORT_SYMBOL(function_hook)
 #endif /* CONFIG_FUNCTION_TRACER */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 51402a7e4ca6..0bee04d41bed 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -625,8 +625,6 @@ static void amd_disable_seq_and_redirect_scrub(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3,
                        amd_disable_seq_and_redirect_scrub);
-#endif
 #if defined(CONFIG_X86_64) && defined(CONFIG_X86_MCE)
 #include <linux/jump_label.h>
 #include <asm/string_64.h>
@@ -657,3 +655,4 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, quirk_intel_brickland_xeon_
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, quirk_intel_brickland_xeon_ras_cap);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras_cap);
 #endif
+#endif
diff --git a/arch/x86/kernel/unwind_guess.c b/arch/x86/kernel/unwind_guess.c
index 9298993dc8b7..2d721e533cf4 100644
--- a/arch/x86/kernel/unwind_guess.c
+++ b/arch/x86/kernel/unwind_guess.c
@@ -47,7 +47,14 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
        get_stack_info(first_frame, state->task, &state->stack_info,
                       &state->stack_mask);
-        if (!__kernel_text_address(*first_frame))
+        /*
+         * The caller can provide the address of the first frame directly
+         * (first_frame) or indirectly (regs->sp) to indicate which stack frame
+         * to start unwinding at.  Skip ahead until we reach it.
+         */
+        if (!unwind_done(state) &&
+            (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
+            !__kernel_text_address(*first_frame)))
                unwind_next_frame(state);
 }
 EXPORT_SYMBOL_GPL(__unwind_start);
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index ddd2661c4502..887e57182716 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -104,10 +104,10 @@ void __init kernel_randomize_memory(void)
         * consistent with the vaddr_start/vaddr_end variables.
         */
        BUILD_BUG_ON(vaddr_start >= vaddr_end);
-        BUILD_BUG_ON(config_enabled(CONFIG_X86_ESPFIX64) &&
+        BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) &&
                     vaddr_end >= EFI_VA_START);
-        BUILD_BUG_ON((config_enabled(CONFIG_X86_ESPFIX64) ||
+        BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) ||
-                      config_enabled(CONFIG_EFI)) &&
+                      IS_ENABLED(CONFIG_EFI)) &&
                     vaddr_end >= __START_KERNEL_map);
        BUILD_BUG_ON(vaddr_end > __START_KERNEL_map);
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 170cc4ff057b..83e701f160a9 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -730,6 +730,20 @@ void io_free_memtype(resource_size_t start, resource_size_t end)
        free_memtype(start, end);
 }
+int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size)
+{
+        enum page_cache_mode type = _PAGE_CACHE_MODE_WC;
+        return io_reserve_memtype(start, start + size, &type);
+}
+EXPORT_SYMBOL(arch_io_reserve_memtype_wc);
+void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size)
+{
+        io_free_memtype(start, start + size);
+}
+EXPORT_SYMBOL(arch_io_free_memtype_wc);
 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
                                unsigned long size, pgprot_t vma_prot)
 {
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index c0fdd57da7aa..bdd855685403 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1837,6 +1837,7 @@ static void __init init_hvm_pv_info(void)
        xen_domain_type = XEN_HVM_DOMAIN;
 }
+#endif
 static int xen_cpu_up_prepare(unsigned int cpu)
 {
@@ -1887,6 +1888,7 @@ static int xen_cpu_up_online(unsigned int cpu)
        return 0;
 }
+#ifdef CONFIG_XEN_PVHVM
 #ifdef CONFIG_KEXEC_CORE
 static void xen_hvm_shutdown(void)
 {
diff --git a/block/badblocks.c b/block/badblocks.c
index 6610e282a03e..6ebcef282314 100644
--- a/block/badblocks.c
+++ b/block/badblocks.c
@@ -133,6 +133,26 @@ retry:
 }
 EXPORT_SYMBOL_GPL(badblocks_check);
+static void badblocks_update_acked(struct badblocks *bb)
+{
+        u64 *p = bb->page;
+        int i;
+        bool unacked = false;
+        if (!bb->unacked_exist)
+                return;
+        for (i = 0; i < bb->count ; i++) {
+                if (!BB_ACK(p[i])) {
+                        unacked = true;
+                        break;
+                }
+        }
+        if (!unacked)
+                bb->unacked_exist = 0;
+}
 /**
 * badblocks_set() - Add a range of bad blocks to the table.
 * @bb:         the badblocks structure that holds all badblock information
@@ -294,6 +314,8 @@ int badblocks_set(struct badblocks *bb, sector_t s, int sectors,
        bb->changed = 1;
        if (!acknowledged)
                bb->unacked_exist = 1;
+        else
+                badblocks_update_acked(bb);
        write_sequnlock_irqrestore(&bb->lock, flags);
        return rv;
@@ -401,6 +423,7 @@ int badblocks_clear(struct badblocks *bb, sector_t s, int sectors)
                }
        }
+        badblocks_update_acked(bb);
        bb->changed = 1;
 out:
        write_sequnlock_irq(&bb->lock);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 6a14b68b9135..3c882cbc7541 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -343,6 +343,34 @@ static void flush_data_end_io(struct request *rq, int error)
        struct blk_flush_queue *fq = blk_get_flush_queue(q, NULL);
        /*
+         * Updating q->in_flight[] here for making this tag usable
+         * early. Because in blk_queue_start_tag(),
+         * q->in_flight[BLK_RW_ASYNC] is used to limit async I/O and
+         * reserve tags for sync I/O.
+         *
+         * More importantly this way can avoid the following I/O
+         * deadlock:
+         *
+         * - suppose there are 40 fua requests comming to flush queue
+         *   and queue depth is 31
+         * - 30 rqs are scheduled then blk_queue_start_tag() can't alloc
+         *   tag for async I/O any more
+         * - all the 30 rqs are completed before FLUSH_PENDING_TIMEOUT
+         *   and flush_data_end_io() is called
+         * - the other rqs still can't go ahead if not updating
+         *   q->in_flight[BLK_RW_ASYNC] here, meantime these rqs
+         *   are held in flush data queue and make no progress of
+         *   handling post flush rq
+         * - only after the post flush rq is handled, all these rqs
+         *   can be completed
+         */
+        elv_completed_request(q, rq);
+        /* for avoiding double accounting */
+        rq->cmd_flags &= ~REQ_STARTED;
+        /*
         * After populating an empty queue, kick it to avoid stall.  Read
         * the comment in flush_end_io().
         */
diff --git a/block/blk-mq.c b/block/blk-mq.c
index ddc2eed64771..f3d27a6dee09 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1217,9 +1217,9 @@ static struct request *blk_mq_map_request(struct request_queue *q,
        blk_mq_set_alloc_data(&alloc_data, q, 0, ctx, hctx);
        rq = __blk_mq_alloc_request(&alloc_data, op, op_flags);
-        hctx->queued++;
+        data->hctx = alloc_data.hctx;
-        data->hctx = hctx;
+        data->ctx = alloc_data.ctx;
-        data->ctx = ctx;
+        data->hctx->queued++;
        return rq;
 }
diff --git a/drivers/acpi/acpica/dsinit.c b/drivers/acpi/acpica/dsinit.c
index f1e6dcc7a827..54d48b90de2c 100644
--- a/drivers/acpi/acpica/dsinit.c
+++ b/drivers/acpi/acpica/dsinit.c
@@ -46,6 +46,7 @@
 #include "acdispat.h"
 #include "acnamesp.h"
 #include "actables.h"
+#include "acinterp.h"
 #define _COMPONENT          ACPI_DISPATCHER
 ACPI_MODULE_NAME("dsinit")
@@ -214,23 +215,17 @@ acpi_ds_initialize_objects(u32 table_index,
        /* Walk entire namespace from the supplied root */
-        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
-        }
        /*
         * We don't use acpi_walk_namespace since we do not want to acquire
         * the namespace reader lock.
         */
        status =
            acpi_ns_walk_namespace(ACPI_TYPE_ANY, start_node, ACPI_UINT32_MAX,
-                                   ACPI_NS_WALK_UNLOCK, acpi_ds_init_one_object,
+                                   0, acpi_ds_init_one_object, NULL, &info,
-                                   NULL, &info, NULL);
+                                   NULL);
        if (ACPI_FAILURE(status)) {
                ACPI_EXCEPTION((AE_INFO, status, "During WalkNamespace"));
        }
-        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
        status = acpi_get_table_by_index(table_index, &table);
        if (ACPI_FAILURE(status)) {
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 32e9ddc0cf2b..2b3210f42a46 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -99,14 +99,11 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
                          "Method auto-serialization parse [%4.4s] %p\n",
                          acpi_ut_get_node_name(node), node));
-        acpi_ex_enter_interpreter();
        /* Create/Init a root op for the method parse tree */
        op = acpi_ps_alloc_op(AML_METHOD_OP, obj_desc->method.aml_start);
        if (!op) {
-                status = AE_NO_MEMORY;
+                return_ACPI_STATUS(AE_NO_MEMORY);
-                goto unlock;
        }
        acpi_ps_set_name(op, node->name.integer);
@@ -118,8 +115,7 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
            acpi_ds_create_walk_state(node->owner_id, NULL, NULL, NULL);
        if (!walk_state) {
                acpi_ps_free_op(op);
-                status = AE_NO_MEMORY;
+                return_ACPI_STATUS(AE_NO_MEMORY);
-                goto unlock;
        }
        status = acpi_ds_init_aml_walk(walk_state, op, node,
@@ -138,8 +134,6 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
        status = acpi_ps_parse_aml(walk_state);
        acpi_ps_delete_parse_tree(op);
-unlock:
-        acpi_ex_exit_interpreter();
        return_ACPI_STATUS(status);
 }
@@ -731,26 +725,6 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                acpi_ds_method_data_delete_all(walk_state);
                /*
-                 * If method is serialized, release the mutex and restore the
-                 * current sync level for this thread
-                 */
-                if (method_desc->method.mutex) {
-                        /* Acquisition Depth handles recursive calls */
-                        method_desc->method.mutex->mutex.acquisition_depth--;
-                        if (!method_desc->method.mutex->mutex.acquisition_depth) {
-                                walk_state->thread->current_sync_level =
-                                    method_desc->method.mutex->mutex.
-                                    original_sync_level;
-                                acpi_os_release_mutex(method_desc->method.
-                                                      mutex->mutex.os_mutex);
-                                method_desc->method.mutex->mutex.thread_id = 0;
-                        }
-                }
-                /*
                 * Delete any namespace objects created anywhere within the
                 * namespace by the execution of this method. Unless:
                 * 1) This method is a module-level executable code method, in which
@@ -786,6 +760,26 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                                    ~ACPI_METHOD_MODIFIED_NAMESPACE;
                        }
                }
+                /*
+                 * If method is serialized, release the mutex and restore the
+                 * current sync level for this thread
+                 */
+                if (method_desc->method.mutex) {
+                        /* Acquisition Depth handles recursive calls */
+                        method_desc->method.mutex->mutex.acquisition_depth--;
+                        if (!method_desc->method.mutex->mutex.acquisition_depth) {
+                                walk_state->thread->current_sync_level =
+                                    method_desc->method.mutex->mutex.
+                                    original_sync_level;
+                                acpi_os_release_mutex(method_desc->method.
+                                                      mutex->mutex.os_mutex);
+                                method_desc->method.mutex->mutex.thread_id = 0;
+                        }
+                }
        }
        /* Decrement the thread count on the method */
diff --git a/drivers/acpi/acpica/dswload2.c b/drivers/acpi/acpica/dswload2.c
index 028b22a3154e..e36218206bb0 100644
--- a/drivers/acpi/acpica/dswload2.c
+++ b/drivers/acpi/acpica/dswload2.c
@@ -607,11 +607,9 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
                                }
                        }
-                        acpi_ex_exit_interpreter();
                        status =
                            acpi_ev_initialize_region
                            (acpi_ns_get_attached_object(node), FALSE);
-                        acpi_ex_enter_interpreter();
                        if (ACPI_FAILURE(status)) {
                                /*
diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c
index 3843f1fc5dbb..75ddd160a716 100644
--- a/drivers/acpi/acpica/evrgnini.c
+++ b/drivers/acpi/acpica/evrgnini.c
@@ -45,6 +45,7 @@
 #include "accommon.h"
 #include "acevents.h"
 #include "acnamesp.h"
+#include "acinterp.h"
 #define _COMPONENT          ACPI_EVENTS
 ACPI_MODULE_NAME("evrgnini")
@@ -597,9 +598,11 @@ acpi_ev_initialize_region(union acpi_operand_object *region_obj,
                                        }
                                }
+                                acpi_ex_exit_interpreter();
                                status =
                                    acpi_ev_execute_reg_method(region_obj,
                                                               ACPI_REG_CONNECT);
+                                acpi_ex_enter_interpreter();
                                if (acpi_ns_locked) {
                                        status =
diff --git a/drivers/acpi/acpica/nsload.c b/drivers/acpi/acpica/nsload.c
index 334d3c5ba617..d1f20143bb11 100644
--- a/drivers/acpi/acpica/nsload.c
+++ b/drivers/acpi/acpica/nsload.c
@@ -137,7 +137,9 @@ unlock:
        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                          "**** Begin Table Object Initialization\n"));
+        acpi_ex_enter_interpreter();
        status = acpi_ds_initialize_objects(table_index, node);
+        acpi_ex_exit_interpreter();
        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                          "**** Completed Table Object Initialization\n"));
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index f0a029e68d3e..0d099a24f776 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -662,7 +662,7 @@ static int ghes_proc(struct ghes *ghes)
        ghes_do_proc(ghes, ghes->estatus);
 out:
        ghes_clear_estatus(ghes);
-        return 0;
+        return rc;
 }
 static void ghes_add_timer(struct ghes *ghes)
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index c983bf733ad3..bc3d914dfc3e 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -87,6 +87,7 @@ struct acpi_pci_link {
 static LIST_HEAD(acpi_link_list);
 static DEFINE_MUTEX(acpi_link_lock);
+static int sci_irq = -1, sci_penalty;
 /* --------------------------------------------------------------------------
                            PCI Link Device Management
@@ -496,25 +497,13 @@ static int acpi_irq_get_penalty(int irq)
 {
        int penalty = 0;
-        /*
+        if (irq == sci_irq)
-        * Penalize IRQ used by ACPI SCI. If ACPI SCI pin attributes conflict
+                penalty += sci_penalty;
-        * with PCI IRQ attributes, mark ACPI SCI as ISA_ALWAYS so it won't be
-        * use for PCI IRQs.
-        */
-        if (irq == acpi_gbl_FADT.sci_interrupt) {
-                u32 type = irq_get_trigger_type(irq) & IRQ_TYPE_SENSE_MASK;
-                if (type != IRQ_TYPE_LEVEL_LOW)
-                        penalty += PIRQ_PENALTY_ISA_ALWAYS;
-                else
-                        penalty += PIRQ_PENALTY_PCI_USING;
-        }
        if (irq < ACPI_MAX_ISA_IRQS)
                return penalty + acpi_isa_irq_penalty[irq];
-        penalty += acpi_irq_pci_sharing_penalty(irq);
+        return penalty + acpi_irq_pci_sharing_penalty(irq);
-        return penalty;
 }
 int __init acpi_irq_penalty_init(void)
@@ -619,6 +608,10 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                            acpi_device_bid(link->device));
                return -ENODEV;
        } else {
+                if (link->irq.active < ACPI_MAX_ISA_IRQS)
+                        acpi_isa_irq_penalty[link->irq.active] +=
+                                PIRQ_PENALTY_PCI_USING;
                printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                       acpi_device_name(link->device),
                       acpi_device_bid(link->device), link->irq.active);
@@ -849,7 +842,7 @@ static int __init acpi_irq_penalty_update(char *str, int used)
                        continue;
                if (used)
-                        new_penalty = acpi_irq_get_penalty(irq) +
+                        new_penalty = acpi_isa_irq_penalty[irq] +
                                        PIRQ_PENALTY_ISA_USED;
                else
                        new_penalty = 0;
@@ -871,7 +864,7 @@ static int __init acpi_irq_penalty_update(char *str, int used)
 void acpi_penalize_isa_irq(int irq, int active)
 {
        if ((irq >= 0) && (irq < ARRAY_SIZE(acpi_isa_irq_penalty)))
-                acpi_isa_irq_penalty[irq] = acpi_irq_get_penalty(irq) +
+                acpi_isa_irq_penalty[irq] +=
                  (active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING);
 }
@@ -881,6 +874,17 @@ bool acpi_isa_irq_available(int irq)
                    acpi_irq_get_penalty(irq) < PIRQ_PENALTY_ISA_ALWAYS);
 }
+void acpi_penalize_sci_irq(int irq, int trigger, int polarity)
+{
+        sci_irq = irq;
+        if (trigger == ACPI_MADT_TRIGGER_LEVEL &&
+            polarity == ACPI_MADT_POLARITY_ACTIVE_LOW)
+                sci_penalty = PIRQ_PENALTY_PCI_USING;
+        else
+                sci_penalty = PIRQ_PENALTY_ISA_ALWAYS;
+}
 /*
 * Over-ride default table to reserve additional IRQs for use by ISA
 * e.g. acpi_irq_isa=5
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ba5f11cebee2..9669fc7c19df 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1418,31 +1418,34 @@ static int ahci_init_msi(struct pci_dev *pdev, unsigned int n_ports,
         * Message mode could be enforced. In this case assume that advantage
         * of multipe MSIs is negated and use single MSI mode instead.
         */
-        nvec = pci_alloc_irq_vectors(pdev, n_ports, INT_MAX,
+        if (n_ports > 1) {
-                        PCI_IRQ_MSIX | PCI_IRQ_MSI);
+                nvec = pci_alloc_irq_vectors(pdev, n_ports, INT_MAX,
-        if (nvec > 0) {
+                                PCI_IRQ_MSIX | PCI_IRQ_MSI);
-                if (!(readl(hpriv->mmio + HOST_CTL) & HOST_MRSM)) {
+                if (nvec > 0) {
-                        hpriv->get_irq_vector = ahci_get_irq_vector;
+                        if (!(readl(hpriv->mmio + HOST_CTL) & HOST_MRSM)) {
-                        hpriv->flags |= AHCI_HFLAG_MULTI_MSI;
+                                hpriv->get_irq_vector = ahci_get_irq_vector;
-                        return nvec;
+                                hpriv->flags |= AHCI_HFLAG_MULTI_MSI;
+                                return nvec;
+                        }
+                        /*
+                         * Fallback to single MSI mode if the controller
+                         * enforced MRSM mode.
+                         */
+                        printk(KERN_INFO
+                                "ahci: MRSM is on, fallback to single MSI\n");
+                        pci_free_irq_vectors(pdev);
                }
                /*
-                 * Fallback to single MSI mode if the controller enforced MRSM
+                 * -ENOSPC indicated we don't have enough vectors.  Don't bother
-                 * mode.
+                 * trying a single vectors for any other error:
                 */
-                printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n");
+                if (nvec < 0 && nvec != -ENOSPC)
-                pci_free_irq_vectors(pdev);
+                        return nvec;
        }
        /*
-         * -ENOSPC indicated we don't have enough vectors.  Don't bother trying
-         * a single vectors for any other error:
-         */
-        if (nvec < 0 && nvec != -ENOSPC)
-                return nvec;
-        /*
         * If the host is not capable of supporting per-port vectors, fall
         * back to single MSI before finally attempting single MSI-X.
         */
@@ -1617,7 +1620,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                /* legacy intx interrupts */
                pci_intx(pdev, 1);
        }
-        hpriv->irq = pdev->irq;
+        hpriv->irq = pci_irq_vector(pdev, 0);
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 811e11c82f32..0809cda93cc0 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -2954,7 +2954,7 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
        case DAC960_PD_Controller:
          if (!request_region(Controller->IO_Address, 0x80,
                              Controller->FullModelName)) {
-                DAC960_Error("IO port 0x%d busy for Controller at\n",
+                DAC960_Error("IO port 0x%lx busy for Controller at\n",
                             Controller, Controller->IO_Address);
                goto Failure;
          }
@@ -2990,7 +2990,7 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
        case DAC960_P_Controller:
          if (!request_region(Controller->IO_Address, 0x80,
                              Controller->FullModelName)){
-                DAC960_Error("IO port 0x%d busy for Controller at\n",
+                DAC960_Error("IO port 0x%lx busy for Controller at\n",
                             Controller, Controller->IO_Address);
                goto Failure;
          }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index ba405b55329f..19a16b2dbb91 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -164,7 +164,7 @@ static void sock_shutdown(struct nbd_device *nbd)
        spin_lock(&nbd->sock_lock);
        if (!nbd->sock) {
-                spin_unlock_irq(&nbd->sock_lock);
+                spin_unlock(&nbd->sock_lock);
                return;
        }
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 482794526e8c..d2d2c89de5b4 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -84,14 +84,14 @@ static size_t rng_buffer_size(void)
 static void add_early_randomness(struct hwrng *rng)
 {
-        unsigned char bytes[16];
        int bytes_read;
+        size_t size = min_t(size_t, 16, rng_buffer_size());
        mutex_lock(&reading_mutex);
-        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        bytes_read = rng_get_data(rng, rng_buffer, size, 1);
        mutex_unlock(&reading_mutex);
        if (bytes_read > 0)
-                add_device_randomness(bytes, bytes_read);
+                add_device_randomness(rng_buffer, bytes_read);
 }
 static inline void cleanup_rng(struct kref *kref)
diff --git a/drivers/clk/at91/clk-programmable.c b/drivers/clk/at91/clk-programmable.c
index 190122e64a3a..85a449cf61e3 100644
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -203,7 +203,7 @@ at91_clk_register_programmable(struct regmap *regmap,
        ret = clk_hw_register(NULL, &prog->hw);
        if (ret) {
                kfree(prog);
-                hw = &prog->hw;
+                hw = ERR_PTR(ret);
        }
        return hw;
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index b68bf573dcfb..8c7763fd9efc 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -502,8 +502,12 @@ static long bcm2835_pll_rate_from_divisors(unsigned long parent_rate,
 static long bcm2835_pll_round_rate(struct clk_hw *hw, unsigned long rate,
                                   unsigned long *parent_rate)
 {
+        struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);
+        const struct bcm2835_pll_data *data = pll->data;
        u32 ndiv, fdiv;
+        rate = clamp(rate, data->min_rate, data->max_rate);
        bcm2835_pll_choose_ndiv_and_fdiv(rate, *parent_rate, &ndiv, &fdiv);
        return bcm2835_pll_rate_from_divisors(*parent_rate, ndiv, fdiv, 1);
@@ -608,13 +612,6 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
        u32 ana[4];
        int i;
-        if (rate < data->min_rate || rate > data->max_rate) {
-                dev_err(cprman->dev, "%s: rate out of spec: %lu vs (%lu, %lu)\n",
-                        clk_hw_get_name(hw), rate,
-                        data->min_rate, data->max_rate);
-                return -EINVAL;
-        }
        if (rate > data->max_fb_rate) {
                use_fb_prediv = true;
                rate /= 2;
diff --git a/drivers/clk/clk-max77686.c b/drivers/clk/clk-max77686.c
index b637f5979023..eb953d3b0b69 100644
--- a/drivers/clk/clk-max77686.c
+++ b/drivers/clk/clk-max77686.c
@@ -216,6 +216,7 @@ static int max77686_clk_probe(struct platform_device *pdev)
                return -EINVAL;
        }
+        drv_data->num_clks = num_clks;
        drv_data->max_clk_data = devm_kcalloc(dev, num_clks,
                                              sizeof(*drv_data->max_clk_data),
                                              GFP_KERNEL);
diff --git a/drivers/clk/hisilicon/clk-hi6220.c b/drivers/clk/hisilicon/clk-hi6220.c
index fe364e63f8de..c0e8e1f196aa 100644
--- a/drivers/clk/hisilicon/clk-hi6220.c
+++ b/drivers/clk/hisilicon/clk-hi6220.c
@@ -195,7 +195,7 @@ static void __init hi6220_clk_sys_init(struct device_node *np)
        hi6220_clk_register_divider(hi6220_div_clks_sys,
                        ARRAY_SIZE(hi6220_div_clks_sys), clk_data);
 }
-CLK_OF_DECLARE(hi6220_clk_sys, "hisilicon,hi6220-sysctrl", hi6220_clk_sys_init);
+CLK_OF_DECLARE_DRIVER(hi6220_clk_sys, "hisilicon,hi6220-sysctrl", hi6220_clk_sys_init);
 /* clocks in media controller */
@@ -252,7 +252,7 @@ static void __init hi6220_clk_media_init(struct device_node *np)
        hi6220_clk_register_divider(hi6220_div_clks_media,
                                ARRAY_SIZE(hi6220_div_clks_media), clk_data);
 }
-CLK_OF_DECLARE(hi6220_clk_media, "hisilicon,hi6220-mediactrl", hi6220_clk_media_init);
+CLK_OF_DECLARE_DRIVER(hi6220_clk_media, "hisilicon,hi6220-mediactrl", hi6220_clk_media_init);
 /* clocks in pmctrl */
diff --git a/drivers/clk/mediatek/Kconfig b/drivers/clk/mediatek/Kconfig
index 380c372d528e..f042bd2a6a99 100644
--- a/drivers/clk/mediatek/Kconfig
+++ b/drivers/clk/mediatek/Kconfig
@@ -8,6 +8,7 @@ config COMMON_CLK_MEDIATEK
 config COMMON_CLK_MT8135
        bool "Clock driver for Mediatek MT8135"
+        depends on ARCH_MEDIATEK || COMPILE_TEST
        select COMMON_CLK_MEDIATEK
        default ARCH_MEDIATEK
        ---help---
@@ -15,6 +16,7 @@ config COMMON_CLK_MT8135
 config COMMON_CLK_MT8173
        bool "Clock driver for Mediatek MT8173"
+        depends on ARCH_MEDIATEK || COMPILE_TEST
        select COMMON_CLK_MEDIATEK
        default ARCH_MEDIATEK
        ---help---
diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
index 45905fc0d75b..cecb0fdfaef6 100644
--- a/drivers/clk/mvebu/armada-37xx-periph.c
+++ b/drivers/clk/mvebu/armada-37xx-periph.c
@@ -305,7 +305,7 @@ static const struct of_device_id armada_3700_periph_clock_of_match[] = {
 };
 static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                                         void __iomem *reg, spinlock_t *lock,
-                                         struct device *dev, struct clk_hw *hw)
+                                         struct device *dev, struct clk_hw **hw)
 {
        const struct clk_ops *mux_ops = NULL, *gate_ops = NULL,
                *rate_ops = NULL;
@@ -329,6 +329,7 @@ static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                gate->lock = lock;
                gate_ops = gate_hw->init->ops;
                gate->reg = reg + (u64)gate->reg;
+                gate->flags = CLK_GATE_SET_TO_DISABLE;
        }
        if (data->rate_hw) {
@@ -353,13 +354,13 @@ static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                }
        }
-        hw = clk_hw_register_composite(dev, data->name, data->parent_names,
+        *hw = clk_hw_register_composite(dev, data->name, data->parent_names,
                                       data->num_parents, mux_hw,
                                       mux_ops, rate_hw, rate_ops,
                                       gate_hw, gate_ops, CLK_IGNORE_UNUSED);
-        if (IS_ERR(hw))
+        if (IS_ERR(*hw))
-                return PTR_ERR(hw);
+                return PTR_ERR(*hw);
        return 0;
 }
@@ -400,7 +401,7 @@ static int armada_3700_periph_clock_probe(struct platform_device *pdev)
        spin_lock_init(&driver_data->lock);
        for (i = 0; i < num_periph; i++) {
-                struct clk_hw *hw = driver_data->hw_data->hws[i];
+                struct clk_hw **hw = &driver_data->hw_data->hws[i];
                if (armada_3700_add_composite_clk(&data[i], reg,
                                                  &driver_data->lock, dev, hw))
diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
index 51d152f735cc..17e68a724945 100644
--- a/drivers/clk/samsung/clk-exynos-audss.c
+++ b/drivers/clk/samsung/clk-exynos-audss.c
@@ -106,6 +106,7 @@ static const struct of_device_id exynos_audss_clk_of_match[] = {
        },
        { },
 };
+MODULE_DEVICE_TABLE(of, exynos_audss_clk_of_match);
 static void exynos_audss_clk_teardown(void)
 {
diff --git a/drivers/clk/uniphier/clk-uniphier-core.c b/drivers/clk/uniphier/clk-uniphier-core.c
index 5ffb898d0839..26c53f7963a4 100644
--- a/drivers/clk/uniphier/clk-uniphier-core.c
+++ b/drivers/clk/uniphier/clk-uniphier-core.c
@@ -79,7 +79,7 @@ static int uniphier_clk_probe(struct platform_device *pdev)
        hw_data->num = clk_num;
        /* avoid returning NULL for unused idx */
-        for (; clk_num >= 0; clk_num--)
+        while (--clk_num >= 0)
                hw_data->hws[clk_num] = ERR_PTR(-EINVAL);
        for (p = data; p->name; p++) {
@@ -111,6 +111,10 @@ static int uniphier_clk_remove(struct platform_device *pdev)
 static const struct of_device_id uniphier_clk_match[] = {
        /* System clock */
        {
+                .compatible = "socionext,uniphier-sld3-clock",
+                .data = uniphier_sld3_sys_clk_data,
+        },
+        {
                .compatible = "socionext,uniphier-ld4-clock",
                .data = uniphier_ld4_sys_clk_data,
        },
@@ -138,7 +142,7 @@ static const struct of_device_id uniphier_clk_match[] = {
                .compatible = "socionext,uniphier-ld20-clock",
                .data = uniphier_ld20_sys_clk_data,
        },
-        /* Media I/O clock */
+        /* Media I/O clock, SD clock */
        {
                .compatible = "socionext,uniphier-sld3-mio-clock",
                .data = uniphier_sld3_mio_clk_data,
@@ -156,20 +160,20 @@ static const struct of_device_id uniphier_clk_match[] = {
                .data = uniphier_sld3_mio_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-pro5-mio-clock",
+                .compatible = "socionext,uniphier-pro5-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-pxs2-mio-clock",
+                .compatible = "socionext,uniphier-pxs2-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        {
                .compatible = "socionext,uniphier-ld11-mio-clock",
                .data = uniphier_sld3_mio_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-ld20-mio-clock",
+                .compatible = "socionext,uniphier-ld20-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        /* Peripheral clock */
        {
diff --git a/drivers/clk/uniphier/clk-uniphier-mio.c b/drivers/clk/uniphier/clk-uniphier-mio.c
index 6aa7ec768d0b..218d20f099ce 100644
--- a/drivers/clk/uniphier/clk-uniphier-mio.c
+++ b/drivers/clk/uniphier/clk-uniphier-mio.c
@@ -93,7 +93,7 @@ const struct uniphier_clk_data uniphier_sld3_mio_clk_data[] = {
        { /* sentinel */ }
 };
-const struct uniphier_clk_data uniphier_pro5_mio_clk_data[] = {
+const struct uniphier_clk_data uniphier_pro5_sd_clk_data[] = {
        UNIPHIER_MIO_CLK_SD_FIXED,
        UNIPHIER_MIO_CLK_SD(0, 0),
        UNIPHIER_MIO_CLK_SD(1, 1),
diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c
index 15a2f2cbe0d9..2c243a894f3b 100644
--- a/drivers/clk/uniphier/clk-uniphier-mux.c
+++ b/drivers/clk/uniphier/clk-uniphier-mux.c
@@ -42,7 +42,7 @@ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
        struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
        int num_parents = clk_hw_get_num_parents(hw);
        int ret;
-        u32 val;
+        unsigned int val;
        u8 i;
        ret = regmap_read(mux->regmap, mux->reg, &val);
diff --git a/drivers/clk/uniphier/clk-uniphier.h b/drivers/clk/uniphier/clk-uniphier.h
index 3ae184062388..0244dba1f4cf 100644
--- a/drivers/clk/uniphier/clk-uniphier.h
+++ b/drivers/clk/uniphier/clk-uniphier.h
@@ -115,7 +115,7 @@ extern const struct uniphier_clk_data uniphier_pxs2_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld11_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld20_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_sld3_mio_clk_data[];
-extern const struct uniphier_clk_data uniphier_pro5_mio_clk_data[];
+extern const struct uniphier_clk_data uniphier_pro5_sd_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld4_peri_clk_data[];
 extern const struct uniphier_clk_data uniphier_pro4_peri_clk_data[];
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index f535f8123258..4737520ec823 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -179,6 +179,7 @@ struct _pid {
 /**
 * struct cpudata -     Per CPU instance data storage
 * @cpu:                CPU number for this instance data
+ * @policy:             CPUFreq policy value
 * @update_util:        CPUFreq utility callback information
 * @update_util_set:    CPUFreq utility callback is set
 * @iowait_boost:       iowait-related boost fraction
@@ -201,6 +202,7 @@ struct _pid {
 struct cpudata {
        int cpu;
+        unsigned int policy;
        struct update_util_data update_util;
        bool   update_util_set;
@@ -1142,10 +1144,8 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
        *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
 }
-static void intel_pstate_set_min_pstate(struct cpudata *cpu)
+static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
-        int pstate = cpu->pstate.min_pstate;
        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
        cpu->pstate.current_pstate = pstate;
        /*
@@ -1157,6 +1157,20 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu)
                      pstate_funcs.get_val(cpu, pstate));
 }
+static void intel_pstate_set_min_pstate(struct cpudata *cpu)
+{
+        intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
+}
+static void intel_pstate_max_within_limits(struct cpudata *cpu)
+{
+        int min_pstate, max_pstate;
+        update_turbo_state();
+        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        intel_pstate_set_pstate(cpu, max_pstate);
+}
 static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
 {
        cpu->pstate.min_pstate = pstate_funcs.get_min();
@@ -1325,7 +1339,8 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
        from = cpu->pstate.current_pstate;
-        target_pstate = pstate_funcs.get_target_pstate(cpu);
+        target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ?
+                cpu->pstate.turbo_pstate : pstate_funcs.get_target_pstate(cpu);
        intel_pstate_update_pstate(cpu, target_pstate);
@@ -1491,7 +1506,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        pr_debug("set_policy cpuinfo.max %u policy->max %u\n",
                 policy->cpuinfo.max_freq, policy->max);
-        cpu = all_cpu_data[0];
+        cpu = all_cpu_data[policy->cpu];
+        cpu->policy = policy->policy;
        if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
            policy->max < policy->cpuinfo.max_freq &&
            policy->max > cpu->pstate.max_pstate * cpu->pstate.scaling) {
@@ -1499,7 +1516,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                policy->max = policy->cpuinfo.max_freq;
        }
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                limits = &performance_limits;
                if (policy->max >= policy->cpuinfo.max_freq) {
                        pr_debug("set performance\n");
@@ -1535,6 +1552,15 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 out:
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
+                /*
+                 * NOHZ_FULL CPUs need this as the governor callback may not
+                 * be invoked on them.
+                 */
+                intel_pstate_clear_update_util_hook(policy->cpu);
+                intel_pstate_max_within_limits(cpu);
+        }
        intel_pstate_set_update_util_hook(policy->cpu);
        intel_pstate_hwp_set_policy(policy);
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index daadd20aa936..3e2ab3b14eea 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -14,7 +14,7 @@ if DEV_DAX
 config DEV_DAX_PMEM
        tristate "PMEM DAX: direct access to persistent memory"
-        depends on NVDIMM_DAX
+        depends on LIBNVDIMM && NVDIMM_DAX
        default DEV_DAX
        help
          Support raw access to persistent memory.  Note that this
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index 9630d8837ba9..4a15fa5df98b 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -44,7 +44,6 @@ static void dax_pmem_percpu_exit(void *data)
        dev_dbg(dax_pmem->dev, "%s\n", __func__);
        percpu_ref_exit(ref);
-        wait_for_completion(&dax_pmem->cmp);
 }
 static void dax_pmem_percpu_kill(void *data)
@@ -54,6 +53,7 @@ static void dax_pmem_percpu_kill(void *data)
        dev_dbg(dax_pmem->dev, "%s\n", __func__);
        percpu_ref_kill(ref);
+        wait_for_completion(&dax_pmem->cmp);
 }
 static int dax_pmem_probe(struct device *dev)
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 26ee00f6bd58..d011cb89d25e 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -284,7 +284,7 @@ config GPIO_MM_LANTIQ
 config GPIO_MOCKUP
        tristate "GPIO Testing Driver"
-        depends on GPIOLIB
+        depends on GPIOLIB && SYSFS
        select GPIO_SYSFS
        help
          This enables GPIO Testing driver, which provides a way to test GPIO
diff --git a/drivers/gpio/gpio-ath79.c b/drivers/gpio/gpio-ath79.c
index 9457e2022bf6..dc37dbe4b46d 100644
--- a/drivers/gpio/gpio-ath79.c
+++ b/drivers/gpio/gpio-ath79.c
@@ -219,6 +219,7 @@ static const struct of_device_id ath79_gpio_of_match[] = {
        { .compatible = "qca,ar9340-gpio" },
        {},
 };
+MODULE_DEVICE_TABLE(of, ath79_gpio_of_match);
 static int ath79_gpio_probe(struct platform_device *pdev)
 {
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 425501c39527..793518a30afe 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -239,7 +239,7 @@ static int mpc8xxx_gpio_irq_map(struct irq_domain *h, unsigned int irq,
                                irq_hw_number_t hwirq)
 {
        irq_set_chip_data(irq, h->host_data);
-        irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_level_irq);
+        irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_edge_irq);
        return 0;
 }
diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
index b9daa0bf32a4..ee1724806f46 100644
--- a/drivers/gpio/gpio-mxs.c
+++ b/drivers/gpio/gpio-mxs.c
@@ -308,8 +308,10 @@ static int mxs_gpio_probe(struct platform_device *pdev)
        writel(~0U, port->base + PINCTRL_IRQSTAT(port) + MXS_CLR);
        irq_base = irq_alloc_descs(-1, 0, 32, numa_node_id());
-        if (irq_base < 0)
+        if (irq_base < 0) {
-                return irq_base;
+                err = irq_base;
+                goto out_iounmap;
+        }
        port->domain = irq_domain_add_legacy(np, 32, irq_base, 0,
                                             &irq_domain_simple_ops, NULL);
@@ -349,6 +351,8 @@ out_irqdomain_remove:
        irq_domain_remove(port->domain);
 out_irqdesc_free:
        irq_free_descs(irq_base, 32);
+out_iounmap:
+        iounmap(port->base);
        return err;
 }
diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
index e7d422a6b90b..5b0042776ec7 100644
--- a/drivers/gpio/gpio-stmpe.c
+++ b/drivers/gpio/gpio-stmpe.c
@@ -409,7 +409,7 @@ static irqreturn_t stmpe_gpio_irq(int irq, void *dev)
                 * 801/1801/1600, bits are cleared when read.
                 * Edge detect register is not present on 801/1600/1801
                 */
-                if (stmpe->partnum != STMPE801 || stmpe->partnum != STMPE1600 ||
+                if (stmpe->partnum != STMPE801 && stmpe->partnum != STMPE1600 &&
                    stmpe->partnum != STMPE1801) {
                        stmpe_reg_write(stmpe, statmsbreg + i, status[i]);
                        stmpe_reg_write(stmpe,
diff --git a/drivers/gpio/gpio-ts4800.c b/drivers/gpio/gpio-ts4800.c
index 99256115bea5..c2a80b4cbf32 100644
--- a/drivers/gpio/gpio-ts4800.c
+++ b/drivers/gpio/gpio-ts4800.c
@@ -66,6 +66,7 @@ static const struct of_device_id ts4800_gpio_of_match[] = {
        { .compatible = "technologic,ts4800-gpio", },
        {},
 };
+MODULE_DEVICE_TABLE(of, ts4800_gpio_of_match);
 static struct platform_driver ts4800_gpio_driver = {
        .driver = {
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 58ece201b8e6..72a4b326fd0d 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -653,14 +653,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
 {
        int idx, i;
        unsigned int irq_flags;
+        int ret = -ENOENT;
        for (i = 0, idx = 0; idx <= index; i++) {
                struct acpi_gpio_info info;
                struct gpio_desc *desc;
                desc = acpi_get_gpiod_by_index(adev, NULL, i, &info);
-                if (IS_ERR(desc))
+                if (IS_ERR(desc)) {
+                        ret = PTR_ERR(desc);
                        break;
+                }
                if (info.gpioint && idx++ == index) {
                        int irq = gpiod_to_irq(desc);
@@ -679,7 +682,7 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
                }
        }
-        return -ENOENT;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index f0fc3a0d37c8..20e09b7c2de3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -333,6 +333,13 @@ struct linehandle_state {
        u32 numdescs;
 };
+#define GPIOHANDLE_REQUEST_VALID_FLAGS \
+        (GPIOHANDLE_REQUEST_INPUT | \
+        GPIOHANDLE_REQUEST_OUTPUT | \
+        GPIOHANDLE_REQUEST_ACTIVE_LOW | \
+        GPIOHANDLE_REQUEST_OPEN_DRAIN | \
+        GPIOHANDLE_REQUEST_OPEN_SOURCE)
 static long linehandle_ioctl(struct file *filep, unsigned int cmd,
                             unsigned long arg)
 {
@@ -344,6 +351,8 @@ static long linehandle_ioctl(struct file *filep, unsigned int cmd,
        if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
                int val;
+                memset(&ghd, 0, sizeof(ghd));
                /* TODO: check if descriptors are really input */
                for (i = 0; i < lh->numdescs; i++) {
                        val = gpiod_get_value_cansleep(lh->descs[i]);
@@ -444,6 +453,17 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
                u32 lflags = handlereq.flags;
                struct gpio_desc *desc;
+                if (offset >= gdev->ngpio) {
+                        ret = -EINVAL;
+                        goto out_free_descs;
+                }
+                /* Return an error if a unknown flag is set */
+                if (lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) {
+                        ret = -EINVAL;
+                        goto out_free_descs;
+                }
                desc = &gdev->descs[offset];
                ret = gpiod_request(desc, lh->label);
                if (ret)
@@ -536,6 +556,10 @@ struct lineevent_state {
        struct mutex read_lock;
 };
+#define GPIOEVENT_REQUEST_VALID_FLAGS \
+        (GPIOEVENT_REQUEST_RISING_EDGE | \
+        GPIOEVENT_REQUEST_FALLING_EDGE)
 static unsigned int lineevent_poll(struct file *filep,
                                   struct poll_table_struct *wait)
 {
@@ -623,6 +647,8 @@ static long lineevent_ioctl(struct file *filep, unsigned int cmd,
        if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
                int val;
+                memset(&ghd, 0, sizeof(ghd));
                val = gpiod_get_value_cansleep(le->desc);
                if (val < 0)
                        return val;
@@ -726,6 +752,18 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
        lflags = eventreq.handleflags;
        eflags = eventreq.eventflags;
+        if (offset >= gdev->ngpio) {
+                ret = -EINVAL;
+                goto out_free_label;
+        }
+        /* Return an error if a unknown flag is set */
+        if ((lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) ||
+            (eflags & ~GPIOEVENT_REQUEST_VALID_FLAGS)) {
+                ret = -EINVAL;
+                goto out_free_label;
+        }
        /* This is just wrong: we don't look for events on output lines */
        if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
                ret = -EINVAL;
@@ -823,6 +861,8 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        if (cmd == GPIO_GET_CHIPINFO_IOCTL) {
                struct gpiochip_info chipinfo;
+                memset(&chipinfo, 0, sizeof(chipinfo));
                strncpy(chipinfo.name, dev_name(&gdev->dev),
                        sizeof(chipinfo.name));
                chipinfo.name[sizeof(chipinfo.name)-1] = '\0';
@@ -839,7 +879,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
                        return -EFAULT;
-                if (lineinfo.line_offset > gdev->ngpio)
+                if (lineinfo.line_offset >= gdev->ngpio)
                        return -EINVAL;
                desc = &gdev->descs[lineinfo.line_offset];
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index aa074fac0c7f..f3efb1c5dae9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -754,6 +754,10 @@ static const char *amdgpu_vram_names[] = {
 int amdgpu_bo_init(struct amdgpu_device *adev)
 {
+        /* reserve PAT memory space to WC for VRAM */
+        arch_io_reserve_memtype_wc(adev->mc.aper_base,
+                                   adev->mc.aper_size);
        /* Add an MTRR for the VRAM */
        adev->mc.vram_mtrr = arch_phys_wc_add(adev->mc.aper_base,
                                              adev->mc.aper_size);
@@ -769,6 +773,7 @@ void amdgpu_bo_fini(struct amdgpu_device *adev)
 {
        amdgpu_ttm_fini(adev);
        arch_phys_wc_del(adev->mc.vram_mtrr);
+        arch_io_free_memtype_wc(adev->mc.aper_base, adev->mc.aper_size);
 }
 int amdgpu_bo_fbdev_mmap(struct amdgpu_bo *bo,
diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
index 608df4c90520..0743e65cb240 100644
--- a/drivers/gpu/drm/ast/ast_ttm.c
+++ b/drivers/gpu/drm/ast/ast_ttm.c
@@ -267,6 +267,8 @@ int ast_mm_init(struct ast_private *ast)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        ast->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                        pci_resource_len(dev->pdev, 0));
@@ -275,11 +277,15 @@ int ast_mm_init(struct ast_private *ast)
 void ast_mm_fini(struct ast_private *ast)
 {
+        struct drm_device *dev = ast->dev;
        ttm_bo_device_release(&ast->ttm.bdev);
        ast_ttm_global_release(ast);
        arch_phys_wc_del(ast->fb_mtrr);
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
 }
 void ast_ttm_placement(struct ast_bo *bo, int domain)
diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
index bb2438dd8733..5e7e63ce7bce 100644
--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
@@ -267,6 +267,9 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        cirrus->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                           pci_resource_len(dev->pdev, 0));
@@ -276,6 +279,8 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
 void cirrus_mm_fini(struct cirrus_device *cirrus)
 {
+        struct drm_device *dev = cirrus->dev;
        if (!cirrus->mm_inited)
                return;
@@ -285,6 +290,8 @@ void cirrus_mm_fini(struct cirrus_device *cirrus)
        arch_phys_wc_del(cirrus->fb_mtrr);
        cirrus->fb_mtrr = 0;
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
 }
 void cirrus_ttm_placement(struct cirrus_bo *bo, int domain)
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 919b35f2ad24..dcf7d11ac380 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -266,6 +266,9 @@ int mgag200_mm_init(struct mga_device *mdev)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        mdev->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                         pci_resource_len(dev->pdev, 0));
@@ -274,10 +277,14 @@ int mgag200_mm_init(struct mga_device *mdev)
 void mgag200_mm_fini(struct mga_device *mdev)
 {
+        struct drm_device *dev = mdev->dev;
        ttm_bo_device_release(&mdev->ttm.bdev);
        mgag200_ttm_global_release(mdev);
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
        arch_phys_wc_del(mdev->fb_mtrr);
        mdev->fb_mtrr = 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 1825dbc33192..a6dbe8258040 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -398,6 +398,9 @@ nouveau_ttm_init(struct nouveau_drm *drm)
        /* VRAM init */
        drm->gem.vram_available = drm->device.info.ram_user;
+        arch_io_reserve_memtype_wc(device->func->resource_addr(device, 1),
+                                   device->func->resource_size(device, 1));
        ret = ttm_bo_init_mm(&drm->ttm.bdev, TTM_PL_VRAM,
                              drm->gem.vram_available >> PAGE_SHIFT);
        if (ret) {
@@ -430,6 +433,8 @@ nouveau_ttm_init(struct nouveau_drm *drm)
 void
 nouveau_ttm_fini(struct nouveau_drm *drm)
 {
+        struct nvkm_device *device = nvxx_device(&drm->device);
        ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_VRAM);
        ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_TT);
@@ -439,4 +444,7 @@ nouveau_ttm_fini(struct nouveau_drm *drm)
        arch_phys_wc_del(drm->ttm.mtrr);
        drm->ttm.mtrr = 0;
+        arch_io_free_memtype_wc(device->func->resource_addr(device, 1),
+                                device->func->resource_size(device, 1));
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index be30861afae9..41b72ce6613f 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -446,6 +446,10 @@ void radeon_bo_force_delete(struct radeon_device *rdev)
 int radeon_bo_init(struct radeon_device *rdev)
 {
+        /* reserve PAT memory space to WC for VRAM */
+        arch_io_reserve_memtype_wc(rdev->mc.aper_base,
+                                   rdev->mc.aper_size);
        /* Add an MTRR for the VRAM */
        if (!rdev->fastfb_working) {
                rdev->mc.vram_mtrr = arch_phys_wc_add(rdev->mc.aper_base,
@@ -463,6 +467,7 @@ void radeon_bo_fini(struct radeon_device *rdev)
 {
        radeon_ttm_fini(rdev);
        arch_phys_wc_del(rdev->mc.vram_mtrr);
+        arch_io_free_memtype_wc(rdev->mc.aper_base, rdev->mc.aper_size);
 }
 /* Returns how many bytes TTM can move per IB.
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 6d94e2ec5b4f..d252276feadf 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -79,12 +79,12 @@ config I2C_AMD8111
 config I2C_HIX5HD2
        tristate "Hix5hd2 high-speed I2C driver"
-        depends on ARCH_HIX5HD2 || COMPILE_TEST
+        depends on ARCH_HISI || ARCH_HIX5HD2 || COMPILE_TEST
        help
-          Say Y here to include support for high-speed I2C controller in the
+          Say Y here to include support for the high-speed I2C controller
-          Hisilicon based hix5hd2 SoCs.
+          used in HiSilicon hix5hd2 SoCs.
-          This driver can also be built as a module.  If so, the module
+          This driver can also be built as a module. If so, the module
          will be called i2c-hix5hd2.
 config I2C_I801
@@ -589,10 +589,10 @@ config I2C_IMG
 config I2C_IMX
        tristate "IMX I2C interface"
-        depends on ARCH_MXC || ARCH_LAYERSCAPE
+        depends on ARCH_MXC || ARCH_LAYERSCAPE || COLDFIRE
        help
          Say Y here if you want to use the IIC bus controller on
-          the Freescale i.MX/MXC or Layerscape processors.
+          the Freescale i.MX/MXC, Layerscape or ColdFire processors.
          This driver can also be built as a module.  If so, the module
          will be called i2c-imx.
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 1fe93c43215c..11e866d05368 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -95,6 +95,9 @@
 #define DW_IC_STATUS_TFE                BIT(2)
 #define DW_IC_STATUS_MST_ACTIVITY       BIT(5)
+#define DW_IC_SDA_HOLD_RX_SHIFT         16
+#define DW_IC_SDA_HOLD_RX_MASK          GENMASK(23, DW_IC_SDA_HOLD_RX_SHIFT)
 #define DW_IC_ERR_TX_ABRT       0x1
 #define DW_IC_TAR_10BITADDR_MASTER BIT(12)
@@ -420,12 +423,20 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
        /* Configure SDA Hold Time if required */
        reg = dw_readl(dev, DW_IC_COMP_VERSION);
        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
-                if (dev->sda_hold_time) {
+                if (!dev->sda_hold_time) {
-                        dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                } else {
                        /* Keep previous hold time setting if no one set it */
                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
                }
+                /*
+                 * Workaround for avoiding TX arbitration lost in case I2C
+                 * slave pulls SDA down "too quickly" after falling egde of
+                 * SCL by enabling non-zero SDA RX hold. Specification says it
+                 * extends incoming SDA low to high transition while SCL is
+                 * high but it apprears to help also above issue.
+                 */
+                if (!(dev->sda_hold_time & DW_IC_SDA_HOLD_RX_MASK))
+                        dev->sda_hold_time |= 1 << DW_IC_SDA_HOLD_RX_SHIFT;
+                dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
        } else {
                dev_warn(dev->dev,
                        "Hardware too old to adjust SDA hold time.\n");
diff --git a/drivers/i2c/busses/i2c-digicolor.c b/drivers/i2c/busses/i2c-digicolor.c
index 9604024e0eb0..49f2084f7bb5 100644
--- a/drivers/i2c/busses/i2c-digicolor.c
+++ b/drivers/i2c/busses/i2c-digicolor.c
@@ -368,6 +368,7 @@ static const struct of_device_id dc_i2c_match[] = {
        { .compatible = "cnxt,cx92755-i2c" },
        { },
 };
+MODULE_DEVICE_TABLE(of, dc_i2c_match);
 static struct platform_driver dc_i2c_driver = {
        .probe   = dc_i2c_probe,
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 08847e8b8998..eb3627f35d12 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -146,6 +146,7 @@
 #define SMBHSTCFG_HST_EN        1
 #define SMBHSTCFG_SMB_SMI_EN    2
 #define SMBHSTCFG_I2C_EN        4
+#define SMBHSTCFG_SPD_WD        0x10
 /* TCO configuration bits for TCOCTL */
 #define TCOCTL_EN               0x0100
@@ -865,9 +866,16 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr,
                block = 1;
                break;
        case I2C_SMBUS_I2C_BLOCK_DATA:
-                /* NB: page 240 of ICH5 datasheet shows that the R/#W
+                /*
-                 * bit should be cleared here, even when reading */
+                 * NB: page 240 of ICH5 datasheet shows that the R/#W
-                outb_p((addr & 0x7f) << 1, SMBHSTADD(priv));
+                 * bit should be cleared here, even when reading.
+                 * However if SPD Write Disable is set (Lynx Point and later),
+                 * the read will fail if we don't set the R/#W bit.
+                 */
+                outb_p(((addr & 0x7f) << 1) |
+                       ((priv->original_hstcfg & SMBHSTCFG_SPD_WD) ?
+                        (read_write & 0x01) : 0),
+                       SMBHSTADD(priv));
                if (read_write == I2C_SMBUS_READ) {
                        /* NB: page 240 of ICH5 datasheet also shows
                         * that DATA1 is the cmd field when reading */
@@ -1573,6 +1581,8 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
                /* Disable SMBus interrupt feature if SMBus using SMI# */
                priv->features &= ~FEATURE_IRQ;
        }
+        if (temp & SMBHSTCFG_SPD_WD)
+                dev_info(&dev->dev, "SPD Write Disable is set\n");
        /* Clear special mode bits */
        if (priv->features & (FEATURE_SMBUS_PEC | FEATURE_BLOCK_BUFFER))
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 592a8f26a708..47fc1f1acff7 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1009,10 +1009,13 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
        rinfo->sda_gpio = of_get_named_gpio(pdev->dev.of_node, "sda-gpios", 0);
        rinfo->scl_gpio = of_get_named_gpio(pdev->dev.of_node, "scl-gpios", 0);
-        if (!gpio_is_valid(rinfo->sda_gpio) ||
+        if (rinfo->sda_gpio == -EPROBE_DEFER ||
-            !gpio_is_valid(rinfo->scl_gpio) ||
+            rinfo->scl_gpio == -EPROBE_DEFER) {
-            IS_ERR(i2c_imx->pinctrl_pins_default) ||
+                return -EPROBE_DEFER;
-            IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
+        } else if (!gpio_is_valid(rinfo->sda_gpio) ||
+                   !gpio_is_valid(rinfo->scl_gpio) ||
+                   IS_ERR(i2c_imx->pinctrl_pins_default) ||
+                   IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
                dev_dbg(&pdev->dev, "recovery information incomplete\n");
                return 0;
        }
diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
index b8ea62105f42..30132c3957cd 100644
--- a/drivers/i2c/busses/i2c-jz4780.c
+++ b/drivers/i2c/busses/i2c-jz4780.c
@@ -729,6 +729,7 @@ static const struct of_device_id jz4780_i2c_of_matches[] = {
        { .compatible = "ingenic,jz4780-i2c", },
        { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, jz4780_i2c_of_matches);
 static int jz4780_i2c_probe(struct platform_device *pdev)
 {
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 50702c7bb244..df220666d627 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -694,6 +694,8 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate,
        t_calc->div_low--;
        t_calc->div_high--;
+        /* Give the tuning value 0, that would not update con register */
+        t_calc->tuning = 0;
        /* Maximum divider supported by hw is 0xffff */
        if (t_calc->div_low > 0xffff) {
                t_calc->div_low = 0xffff;
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
index 263685c7a512..05cf192ef1ac 100644
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -105,7 +105,7 @@ struct slimpro_i2c_dev {
        struct mbox_chan *mbox_chan;
        struct mbox_client mbox_client;
        struct completion rd_complete;
-        u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];
+        u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */
        u32 *resp_msg;
 };
diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c
index 2a972ed7aa0d..e29ff37a43bd 100644
--- a/drivers/i2c/busses/i2c-xlp9xx.c
+++ b/drivers/i2c/busses/i2c-xlp9xx.c
@@ -426,6 +426,7 @@ static const struct of_device_id xlp9xx_i2c_of_match[] = {
        { .compatible = "netlogic,xlp980-i2c", },
        { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, xlp9xx_i2c_of_match);
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xlp9xx_i2c_acpi_ids[] = {
diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c
index 0968f59b6df5..ad17d88d8573 100644
--- a/drivers/i2c/busses/i2c-xlr.c
+++ b/drivers/i2c/busses/i2c-xlr.c
@@ -358,6 +358,7 @@ static const struct of_device_id xlr_i2c_dt_ids[] = {
        },
        { }
 };
+MODULE_DEVICE_TABLE(of, xlr_i2c_dt_ids);
 static int xlr_i2c_probe(struct platform_device *pdev)
 {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 5ab67219f71e..1704fc84d647 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1681,6 +1681,7 @@ static struct i2c_client *of_i2c_register_device(struct i2c_adapter *adap,
 static void of_i2c_register_devices(struct i2c_adapter *adap)
 {
        struct device_node *bus, *node;
+        struct i2c_client *client;
        /* Only register child devices if the adapter has a node pointer set */
        if (!adap->dev.of_node)
@@ -1695,7 +1696,14 @@ static void of_i2c_register_devices(struct i2c_adapter *adap)
        for_each_available_child_of_node(bus, node) {
                if (of_node_test_and_set_flag(node, OF_POPULATED))
                        continue;
-                of_i2c_register_device(adap, node);
+                client = of_i2c_register_device(adap, node);
+                if (IS_ERR(client)) {
+                        dev_warn(&adap->dev,
+                                 "Failed to create I2C device for %s\n",
+                                 node->full_name);
+                        of_node_clear_flag(node, OF_POPULATED);
+                }
        }
        of_node_put(bus);
@@ -2299,6 +2307,7 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
                if (IS_ERR(client)) {
                        dev_err(&adap->dev, "failed to create client for '%s'\n",
                                 rd->dn->full_name);
+                        of_node_clear_flag(rd->dn, OF_POPULATED);
                        return notifier_from_errno(PTR_ERR(client));
                }
                break;
diff --git a/drivers/ipack/ipack.c b/drivers/ipack/ipack.c
index c0e7b624ce54..12102448fddd 100644
--- a/drivers/ipack/ipack.c
+++ b/drivers/ipack/ipack.c
@@ -178,7 +178,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
                       idev->id_vendor, idev->id_device);
 }
-ipack_device_attr(id_format, "0x%hhu\n");
+ipack_device_attr(id_format, "0x%hhx\n");
 static DEVICE_ATTR_RO(id);
 static DEVICE_ATTR_RO(id_device);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8abde6b8cedc..6d53810963f7 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -266,7 +266,7 @@ static struct raid_type {
        {"raid10_offset", "raid10 offset (striped mirrors)",        0, 2, 10, ALGORITHM_RAID10_OFFSET},
        {"raid10_near",   "raid10 near (striped mirrors)",          0, 2, 10, ALGORITHM_RAID10_NEAR},
        {"raid10",        "raid10 (striped mirrors)",               0, 2, 10, ALGORITHM_RAID10_DEFAULT},
-        {"raid4",         "raid4 (dedicated last parity disk)",     1, 2, 4,  ALGORITHM_PARITY_N}, /* raid4 layout = raid5_n */
+        {"raid4",         "raid4 (dedicated first parity disk)",    1, 2, 5,  ALGORITHM_PARITY_0}, /* raid4 layout = raid5_0 */
        {"raid5_n",       "raid5 (dedicated last parity disk)",     1, 2, 5,  ALGORITHM_PARITY_N},
        {"raid5_ls",      "raid5 (left symmetric)",                 1, 2, 5,  ALGORITHM_LEFT_SYMMETRIC},
        {"raid5_rs",      "raid5 (right symmetric)",                1, 2, 5,  ALGORITHM_RIGHT_SYMMETRIC},
@@ -2087,11 +2087,11 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                /*
                 * No takeover/reshaping, because we don't have the extended v1.9.0 metadata
                 */
-                if (le32_to_cpu(sb->level) != mddev->level) {
+                if (le32_to_cpu(sb->level) != mddev->new_level) {
                        DMERR("Reshaping/takeover raid sets not yet supported. (raid level/stripes/size change)");
                        return -EINVAL;
                }
-                if (le32_to_cpu(sb->layout) != mddev->layout) {
+                if (le32_to_cpu(sb->layout) != mddev->new_layout) {
                        DMERR("Reshaping raid sets not yet supported. (raid layout change)");
                        DMERR("  0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
                        DMERR("  Old layout: %s w/ %d copies",
@@ -2102,7 +2102,7 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                              raid10_md_layout_to_copies(mddev->layout));
                        return -EINVAL;
                }
-                if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
+                if (le32_to_cpu(sb->stripe_sectors) != mddev->new_chunk_sectors) {
                        DMERR("Reshaping raid sets not yet supported. (stripe sectors change)");
                        return -EINVAL;
                }
@@ -2115,6 +2115,8 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                        return -EINVAL;
                }
+                DMINFO("Discovered old metadata format; upgrading to extended metadata format");
                /* Table line is checked vs. authoritative superblock */
                rs_set_new(rs);
        }
@@ -2258,7 +2260,8 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
        if (!mddev->events && super_init_validation(rs, rdev))
                return -EINVAL;
-        if (le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
+        if (le32_to_cpu(sb->compat_features) &&
+            le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
                rs->ti->error = "Unable to assemble array: Unknown flag(s) in compatible feature flags";
                return -EINVAL;
        }
@@ -3646,7 +3649,7 @@ static void raid_resume(struct dm_target *ti)
 static struct target_type raid_target = {
        .name = "raid",
-        .version = {1, 9, 0},
+        .version = {1, 9, 1},
        .module = THIS_MODULE,
        .ctr = raid_ctr,
        .dtr = raid_dtr,
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index bdf1606f67bc..9a8b71067c6e 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -145,7 +145,6 @@ static void dispatch_bios(void *context, struct bio_list *bio_list)
 struct dm_raid1_bio_record {
        struct mirror *m;
-        /* if details->bi_bdev == NULL, details were not saved */
        struct dm_bio_details details;
        region_t write_region;
 };
@@ -1200,8 +1199,6 @@ static int mirror_map(struct dm_target *ti, struct bio *bio)
        struct dm_raid1_bio_record *bio_record =
          dm_per_bio_data(bio, sizeof(struct dm_raid1_bio_record));
-        bio_record->details.bi_bdev = NULL;
        if (rw == WRITE) {
                /* Save region for mirror_end_io() handler */
                bio_record->write_region = dm_rh_bio_to_region(ms->rh, bio);
@@ -1260,22 +1257,12 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
        }
        if (error == -EOPNOTSUPP)
-                goto out;
+                return error;
        if ((error == -EWOULDBLOCK) && (bio->bi_opf & REQ_RAHEAD))
-                goto out;
+                return error;
        if (unlikely(error)) {
-                if (!bio_record->details.bi_bdev) {
-                        /*
-                         * There wasn't enough memory to record necessary
-                         * information for a retry or there was no other
-                         * mirror in-sync.
-                         */
-                        DMERR_LIMIT("Mirror read failed.");
-                        return -EIO;
-                }
                m = bio_record->m;
                DMERR("Mirror read failed from %s. Trying alternative device.",
@@ -1291,7 +1278,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                        bd = &bio_record->details;
                        dm_bio_restore(bd, bio);
-                        bio_record->details.bi_bdev = NULL;
+                        bio->bi_error = 0;
                        queue_bio(ms, bio, rw);
                        return DM_ENDIO_INCOMPLETE;
@@ -1299,9 +1286,6 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                DMERR("All replicated volumes dead, failing I/O");
        }
-out:
-        bio_record->details.bi_bdev = NULL;
        return error;
 }
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index dc75bea0d541..1d0d2adc050a 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -856,8 +856,11 @@ int dm_old_init_request_queue(struct mapped_device *md)
        kthread_init_worker(&md->kworker);
        md->kworker_task = kthread_run(kthread_worker_fn, &md->kworker,
                                       "kdmwork-%s", dm_device_name(md));
-        if (IS_ERR(md->kworker_task))
+        if (IS_ERR(md->kworker_task)) {
-                return PTR_ERR(md->kworker_task);
+                int error = PTR_ERR(md->kworker_task);
+                md->kworker_task = NULL;
+                return error;
+        }
        elv_register_queue(md->queue);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 3e407a9cde1f..c4b53b332607 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -695,37 +695,32 @@ int dm_table_add_target(struct dm_table *t, const char *type,
        tgt->type = dm_get_target_type(type);
        if (!tgt->type) {
-                DMERR("%s: %s: unknown target type", dm_device_name(t->md),
+                DMERR("%s: %s: unknown target type", dm_device_name(t->md), type);
-                      type);
                return -EINVAL;
        }
        if (dm_target_needs_singleton(tgt->type)) {
                if (t->num_targets) {
-                        DMERR("%s: target type %s must appear alone in table",
+                        tgt->error = "singleton target type must appear alone in table";
-                              dm_device_name(t->md), type);
+                        goto bad;
-                        return -EINVAL;
                }
                t->singleton = true;
        }
        if (dm_target_always_writeable(tgt->type) && !(t->mode & FMODE_WRITE)) {
-                DMERR("%s: target type %s may not be included in read-only tables",
+                tgt->error = "target type may not be included in a read-only table";
-                      dm_device_name(t->md), type);
+                goto bad;
-                return -EINVAL;
        }
        if (t->immutable_target_type) {
                if (t->immutable_target_type != tgt->type) {
-                        DMERR("%s: immutable target type %s cannot be mixed with other target types",
+                        tgt->error = "immutable target type cannot be mixed with other target types";
-                              dm_device_name(t->md), t->immutable_target_type->name);
+                        goto bad;
-                        return -EINVAL;
                }
        } else if (dm_target_is_immutable(tgt->type)) {
                if (t->num_targets) {
-                        DMERR("%s: immutable target type %s cannot be mixed with other target types",
+                        tgt->error = "immutable target type cannot be mixed with other target types";
-                              dm_device_name(t->md), tgt->type->name);
+                        goto bad;
-                        return -EINVAL;
                }
                t->immutable_target_type = tgt->type;
        }
@@ -740,7 +735,6 @@ int dm_table_add_target(struct dm_table *t, const char *type,
         */
        if (!adjoin(t, tgt)) {
                tgt->error = "Gap in table";
-                r = -EINVAL;
                goto bad;
        }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 147af9536d0c..ef7bf1dd6900 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct mapped_device *md)
        if (md->bs)
                bioset_free(md->bs);
-        cleanup_srcu_struct(&md->io_barrier);
        if (md->disk) {
                spin_lock(&_minor_lock);
                md->disk->private_data = NULL;
@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
        if (md->queue)
                blk_cleanup_queue(md->queue);
+        cleanup_srcu_struct(&md->io_barrier);
        if (md->bdev) {
                bdput(md->bdev);
                md->bdev = NULL;
diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
index af23d7dfe752..2e5233b60971 100644
--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -247,7 +247,9 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
        cxl_ctx_get();
        if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
+                put_pid(ctx->glpid);
                put_pid(ctx->pid);
+                ctx->glpid = ctx->pid = NULL;
                cxl_adapter_context_put(ctx->afu->adapter);
                cxl_ctx_put();
                goto out;
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index d0b421f49b39..77080cc5fa0a 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -194,6 +194,16 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        ctx->mmio_err_ff = !!(work.flags & CXL_START_WORK_ERR_FF);
        /*
+         * Increment the mapped context count for adapter. This also checks
+         * if adapter_context_lock is taken.
+         */
+        rc = cxl_adapter_context_get(ctx->afu->adapter);
+        if (rc) {
+                afu_release_irqs(ctx, ctx);
+                goto out;
+        }
+        /*
         * We grab the PID here and not in the file open to allow for the case
         * where a process (master, some daemon, etc) has opened the chardev on
         * behalf of another process, so the AFU's mm gets bound to the process
@@ -205,15 +215,6 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        ctx->pid = get_task_pid(current, PIDTYPE_PID);
        ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
-        /*
-         * Increment the mapped context count for adapter. This also checks
-         * if adapter_context_lock is taken.
-         */
-        rc = cxl_adapter_context_get(ctx->afu->adapter);
-        if (rc) {
-                afu_release_irqs(ctx, ctx);
-                goto out;
-        }
        trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
@@ -221,6 +222,9 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
                                                        amr))) {
                afu_release_irqs(ctx, ctx);
                cxl_adapter_context_put(ctx->afu->adapter);
+                put_pid(ctx->glpid);
+                put_pid(ctx->pid);
+                ctx->glpid = ctx->pid = NULL;
                goto out;
        }
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 1525870f460a..33741ad4a74a 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -283,7 +283,7 @@ static void gru_unload_mm_tracker(struct gru_state *gru,
        spin_lock(&gru->gs_asid_lock);
        BUG_ON((asids->mt_ctxbitmap & ctxbitmap) != ctxbitmap);
        asids->mt_ctxbitmap ^= ctxbitmap;
-        gru_dbg(grudev, "gid %d, gts %p, gms %p, ctxnum 0x%d, asidmap 0x%lx\n",
+        gru_dbg(grudev, "gid %d, gts %p, gms %p, ctxnum %d, asidmap 0x%lx\n",
                gru->gs_gid, gts, gms, gts->ts_ctxnum, gms->ms_asidmap[0]);
        spin_unlock(&gru->gs_asid_lock);
        spin_unlock(&gms->ms_asid_lock);
diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig
index 8b2b740d6679..124c2432ac9c 100644
--- a/drivers/nvdimm/Kconfig
+++ b/drivers/nvdimm/Kconfig
@@ -89,7 +89,7 @@ config NVDIMM_PFN
          Select Y if unsure
 config NVDIMM_DAX
-        tristate "NVDIMM DAX: Raw access to persistent memory"
+        bool "NVDIMM DAX: Raw access to persistent memory"
        default LIBNVDIMM
        depends on NVDIMM_PFN
        help
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 3509cff68ef9..abe5c6bc756c 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -2176,12 +2176,14 @@ static struct device **scan_labels(struct nd_region *nd_region)
        return devs;
 err:
-        for (i = 0; devs[i]; i++)
+        if (devs) {
-                if (is_nd_blk(&nd_region->dev))
+                for (i = 0; devs[i]; i++)
-                        namespace_blk_release(devs[i]);
+                        if (is_nd_blk(&nd_region->dev))
-                else
+                                namespace_blk_release(devs[i]);
-                        namespace_pmem_release(devs[i]);
+                        else
-        kfree(devs);
+                                namespace_pmem_release(devs[i]);
+                kfree(devs);
+        }
        return NULL;
 }
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 42b3a8217073..24618431a14b 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -47,7 +47,7 @@ static struct nd_region *to_region(struct pmem_device *pmem)
        return to_nd_region(to_dev(pmem)->parent);
 }
-static void pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
+static int pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
                unsigned int len)
 {
        struct device *dev = to_dev(pmem);
@@ -62,8 +62,12 @@ static void pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
                                __func__, (unsigned long long) sector,
                                cleared / 512, cleared / 512 > 1 ? "s" : "");
                badblocks_clear(&pmem->bb, sector, cleared / 512);
+        } else {
+                return -EIO;
        }
        invalidate_pmem(pmem->virt_addr + offset, len);
+        return 0;
 }
 static void write_pmem(void *pmem_addr, struct page *page,
@@ -123,7 +127,7 @@ static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
                flush_dcache_page(page);
                write_pmem(pmem_addr, page, off, len);
                if (unlikely(bad_pmem)) {
-                        pmem_clear_poison(pmem, pmem_off, len);
+                        rc = pmem_clear_poison(pmem, pmem_off, len);
                        write_pmem(pmem_addr, page, off, len);
                }
        }
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index bfdd0744b686..ad70507cfb56 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -610,6 +610,7 @@ static int msi_verify_entries(struct pci_dev *dev)
 * msi_capability_init - configure device's MSI capability structure
 * @dev: pointer to the pci_dev data structure of MSI device function
 * @nvec: number of interrupts to allocate
+ * @affinity: flag to indicate cpu irq affinity mask should be set
 *
 * Setup the MSI capability structure of the device with the requested
 * number of interrupts.  A return value of zero indicates the successful
@@ -752,6 +753,7 @@ static void msix_program_entries(struct pci_dev *dev,
 * @dev: pointer to the pci_dev data structure of MSI-X device function
 * @entries: pointer to an array of struct msix_entry entries
 * @nvec: number of @entries
+ * @affinity: flag to indicate cpu irq affinity mask should be set
 *
 * Setup the MSI-X capability structure of device function with a
 * single MSI-X irq. A return of zero indicates the successful setup of
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 831935af7389..a7a88476e215 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1205,7 +1205,7 @@ static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm)
                                 mdc, lpm);
                        return mdc;
                }
-                fcx_max_data = mdc * FCX_MAX_DATA_FACTOR;
+                fcx_max_data = (u32)mdc * FCX_MAX_DATA_FACTOR;
                if (fcx_max_data < private->fcx_max_data) {
                        dev_warn(&device->cdev->dev,
                                 "The maximum data size for zHPF requests %u "
@@ -1675,7 +1675,7 @@ static u32 get_fcx_max_data(struct dasd_device *device)
                         " data size for zHPF requests failed\n");
                return 0;
        } else
-                return mdc * FCX_MAX_DATA_FACTOR;
+                return (u32)mdc * FCX_MAX_DATA_FACTOR;
 }
 /*
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index 46be25c7461e..876c7e6e3a99 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -780,7 +780,7 @@ static int cfg_wait_idle(void)
 static int __init chp_init(void)
 {
        struct chp_id chpid;
-        int ret;
+        int state, ret;
        ret = crw_register_handler(CRW_RSC_CPATH, chp_process_crw);
        if (ret)
@@ -791,7 +791,9 @@ static int __init chp_init(void)
                return 0;
        /* Register available channel-paths. */
        chp_id_for_each(&chpid) {
-                if (chp_info_get_status(chpid) != CHP_STATUS_NOT_RECOGNIZED)
+                state = chp_info_get_status(chpid);
+                if (state == CHP_STATUS_CONFIGURED ||
+                    state == CHP_STATUS_STANDBY)
                        chp_new(chpid);
        }
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index db2739079cbb..790babc5ef66 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -353,7 +353,7 @@ static void NCR5380_print_phase(struct Scsi_Host *instance)
 #endif
-static int probe_irq __initdata;
+static int probe_irq;
 /**
 * probe_intr   -       helper for IRQ autoprobe
@@ -365,7 +365,7 @@ static int probe_irq __initdata;
 * used by the IRQ probe code.
 */
-static irqreturn_t __init probe_intr(int irq, void *dev_id)
+static irqreturn_t probe_intr(int irq, void *dev_id)
 {
        probe_irq = irq;
        return IRQ_HANDLED;
@@ -380,7 +380,7 @@ static irqreturn_t __init probe_intr(int irq, void *dev_id)
 * and then looking to see what interrupt actually turned up.
 */
-static int __init __maybe_unused NCR5380_probe_irq(struct Scsi_Host *instance,
+static int __maybe_unused NCR5380_probe_irq(struct Scsi_Host *instance,
                                                int possible)
 {
        struct NCR5380_hostdata *hostdata = shost_priv(instance);
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 68138a647dfc..d9239c2d49b1 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -900,8 +900,9 @@ void hwi_ring_cq_db(struct beiscsi_hba *phba,
 static struct sgl_handle *alloc_io_sgl_handle(struct beiscsi_hba *phba)
 {
        struct sgl_handle *psgl_handle;
+        unsigned long flags;
-        spin_lock_bh(&phba->io_sgl_lock);
+        spin_lock_irqsave(&phba->io_sgl_lock, flags);
        if (phba->io_sgl_hndl_avbl) {
                beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_IO,
                            "BM_%d : In alloc_io_sgl_handle,"
@@ -919,14 +920,16 @@ static struct sgl_handle *alloc_io_sgl_handle(struct beiscsi_hba *phba)
                        phba->io_sgl_alloc_index++;
        } else
                psgl_handle = NULL;
-        spin_unlock_bh(&phba->io_sgl_lock);
+        spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
        return psgl_handle;
 }
 static void
 free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
 {
-        spin_lock_bh(&phba->io_sgl_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&phba->io_sgl_lock, flags);
        beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_IO,
                    "BM_%d : In free_,io_sgl_free_index=%d\n",
                    phba->io_sgl_free_index);
@@ -941,7 +944,7 @@ free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                             "value there=%p\n", phba->io_sgl_free_index,
                             phba->io_sgl_hndl_base
                             [phba->io_sgl_free_index]);
-                 spin_unlock_bh(&phba->io_sgl_lock);
+                 spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
                return;
        }
        phba->io_sgl_hndl_base[phba->io_sgl_free_index] = psgl_handle;
@@ -950,7 +953,7 @@ free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                phba->io_sgl_free_index = 0;
        else
                phba->io_sgl_free_index++;
-        spin_unlock_bh(&phba->io_sgl_lock);
+        spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
 }
 static inline struct wrb_handle *
@@ -958,15 +961,16 @@ beiscsi_get_wrb_handle(struct hwi_wrb_context *pwrb_context,
                       unsigned int wrbs_per_cxn)
 {
        struct wrb_handle *pwrb_handle;
+        unsigned long flags;
-        spin_lock_bh(&pwrb_context->wrb_lock);
+        spin_lock_irqsave(&pwrb_context->wrb_lock, flags);
        pwrb_handle = pwrb_context->pwrb_handle_base[pwrb_context->alloc_index];
        pwrb_context->wrb_handles_available--;
        if (pwrb_context->alloc_index == (wrbs_per_cxn - 1))
                pwrb_context->alloc_index = 0;
        else
                pwrb_context->alloc_index++;
-        spin_unlock_bh(&pwrb_context->wrb_lock);
+        spin_unlock_irqrestore(&pwrb_context->wrb_lock, flags);
        if (pwrb_handle)
                memset(pwrb_handle->pwrb, 0, sizeof(*pwrb_handle->pwrb));
@@ -1001,14 +1005,16 @@ beiscsi_put_wrb_handle(struct hwi_wrb_context *pwrb_context,
                       struct wrb_handle *pwrb_handle,
                       unsigned int wrbs_per_cxn)
 {
-        spin_lock_bh(&pwrb_context->wrb_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&pwrb_context->wrb_lock, flags);
        pwrb_context->pwrb_handle_base[pwrb_context->free_index] = pwrb_handle;
        pwrb_context->wrb_handles_available++;
        if (pwrb_context->free_index == (wrbs_per_cxn - 1))
                pwrb_context->free_index = 0;
        else
                pwrb_context->free_index++;
-        spin_unlock_bh(&pwrb_context->wrb_lock);
+        spin_unlock_irqrestore(&pwrb_context->wrb_lock, flags);
 }
 /**
@@ -1037,8 +1043,9 @@ free_wrb_handle(struct beiscsi_hba *phba, struct hwi_wrb_context *pwrb_context,
 static struct sgl_handle *alloc_mgmt_sgl_handle(struct beiscsi_hba *phba)
 {
        struct sgl_handle *psgl_handle;
+        unsigned long flags;
-        spin_lock_bh(&phba->mgmt_sgl_lock);
+        spin_lock_irqsave(&phba->mgmt_sgl_lock, flags);
        if (phba->eh_sgl_hndl_avbl) {
                psgl_handle = phba->eh_sgl_hndl_base[phba->eh_sgl_alloc_index];
                phba->eh_sgl_hndl_base[phba->eh_sgl_alloc_index] = NULL;
@@ -1056,14 +1063,16 @@ static struct sgl_handle *alloc_mgmt_sgl_handle(struct beiscsi_hba *phba)
                        phba->eh_sgl_alloc_index++;
        } else
                psgl_handle = NULL;
-        spin_unlock_bh(&phba->mgmt_sgl_lock);
+        spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
        return psgl_handle;
 }
 void
 free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
 {
-        spin_lock_bh(&phba->mgmt_sgl_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&phba->mgmt_sgl_lock, flags);
        beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
                    "BM_%d : In  free_mgmt_sgl_handle,"
                    "eh_sgl_free_index=%d\n",
@@ -1078,7 +1087,7 @@ free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                            "BM_%d : Double Free in eh SGL ,"
                            "eh_sgl_free_index=%d\n",
                            phba->eh_sgl_free_index);
-                spin_unlock_bh(&phba->mgmt_sgl_lock);
+                spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
                return;
        }
        phba->eh_sgl_hndl_base[phba->eh_sgl_free_index] = psgl_handle;
@@ -1088,7 +1097,7 @@ free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                phba->eh_sgl_free_index = 0;
        else
                phba->eh_sgl_free_index++;
-        spin_unlock_bh(&phba->mgmt_sgl_lock);
+        spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
 }
 static void
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index c051694bfcb0..f9b6fba689ff 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -791,9 +791,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 free_task:
        /* regular RX path uses back_lock */
-        spin_lock_bh(&session->back_lock);
+        spin_lock(&session->back_lock);
        __iscsi_put_task(task);
-        spin_unlock_bh(&session->back_lock);
+        spin_unlock(&session->back_lock);
        return NULL;
 }
diff --git a/drivers/thermal/intel_pch_thermal.c b/drivers/thermal/intel_pch_thermal.c
index 9b4815e81b0d..19bf2028e508 100644
--- a/drivers/thermal/intel_pch_thermal.c
+++ b/drivers/thermal/intel_pch_thermal.c
@@ -20,10 +20,13 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/acpi.h>
 #include <linux/thermal.h>
 #include <linux/pm.h>
 /* Intel PCH thermal Device IDs */
+#define PCH_THERMAL_DID_HSW_1   0x9C24 /* Haswell PCH */
+#define PCH_THERMAL_DID_HSW_2   0x8C24 /* Haswell PCH */
 #define PCH_THERMAL_DID_WPT     0x9CA4 /* Wildcat Point */
 #define PCH_THERMAL_DID_SKL     0x9D31 /* Skylake PCH */
@@ -66,9 +69,53 @@ struct pch_thermal_device {
        unsigned long crt_temp;
        int hot_trip_id;
        unsigned long hot_temp;
+        int psv_trip_id;
+        unsigned long psv_temp;
        bool bios_enabled;
 };
+#ifdef CONFIG_ACPI
+/*
+ * On some platforms, there is a companion ACPI device, which adds
+ * passive trip temperature using _PSV method. There is no specific
+ * passive temperature setting in MMIO interface of this PCI device.
+ */
+static void pch_wpt_add_acpi_psv_trip(struct pch_thermal_device *ptd,
+                                      int *nr_trips)
+{
+        struct acpi_device *adev;
+        ptd->psv_trip_id = -1;
+        adev = ACPI_COMPANION(&ptd->pdev->dev);
+        if (adev) {
+                unsigned long long r;
+                acpi_status status;
+                status = acpi_evaluate_integer(adev->handle, "_PSV", NULL,
+                                               &r);
+                if (ACPI_SUCCESS(status)) {
+                        unsigned long trip_temp;
+                        trip_temp = DECI_KELVIN_TO_MILLICELSIUS(r);
+                        if (trip_temp) {
+                                ptd->psv_temp = trip_temp;
+                                ptd->psv_trip_id = *nr_trips;
+                                ++(*nr_trips);
+                        }
+                }
+        }
+}
+#else
+static void pch_wpt_add_acpi_psv_trip(struct pch_thermal_device *ptd,
+                                      int *nr_trips)
+{
+        ptd->psv_trip_id = -1;
+}
+#endif
 static int pch_wpt_init(struct pch_thermal_device *ptd, int *nr_trips)
 {
        u8 tsel;
@@ -119,6 +166,8 @@ read_trips:
                ++(*nr_trips);
        }
+        pch_wpt_add_acpi_psv_trip(ptd, nr_trips);
        return 0;
 }
@@ -194,6 +243,8 @@ static int pch_get_trip_type(struct thermal_zone_device *tzd, int trip,
                *type = THERMAL_TRIP_CRITICAL;
        else if (ptd->hot_trip_id == trip)
                *type = THERMAL_TRIP_HOT;
+        else if (ptd->psv_trip_id == trip)
+                *type = THERMAL_TRIP_PASSIVE;
        else
                return -EINVAL;
@@ -208,6 +259,8 @@ static int pch_get_trip_temp(struct thermal_zone_device *tzd, int trip, int *tem
                *temp = ptd->crt_temp;
        else if (ptd->hot_trip_id == trip)
                *temp = ptd->hot_temp;
+        else if (ptd->psv_trip_id == trip)
+                *temp = ptd->psv_temp;
        else
                return -EINVAL;
@@ -242,6 +295,11 @@ static int intel_pch_thermal_probe(struct pci_dev *pdev,
                ptd->ops = &pch_dev_ops_wpt;
                dev_name = "pch_skylake";
                break;
+        case PCH_THERMAL_DID_HSW_1:
+        case PCH_THERMAL_DID_HSW_2:
+                ptd->ops = &pch_dev_ops_wpt;
+                dev_name = "pch_haswell";
+                break;
        default:
                dev_err(&pdev->dev, "unknown pch thermal device\n");
                return -ENODEV;
@@ -324,6 +382,8 @@ static int intel_pch_thermal_resume(struct device *device)
 static struct pci_device_id intel_pch_thermal_id[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WPT) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_SKL) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_HSW_1) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_HSW_2) },
        { 0, },
 };
 MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 0e4dc0afcfd2..7a223074df3d 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -669,20 +669,10 @@ static struct thermal_cooling_device_ops powerclamp_cooling_ops = {
        .set_cur_state = powerclamp_set_cur_state,
 };
-static const struct x86_cpu_id intel_powerclamp_ids[] __initconst = {
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_MWAIT },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_ARAT },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_NONSTOP_TSC },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_CONSTANT_TSC},
-        {}
-};
-MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids);
 static int __init powerclamp_probe(void)
 {
-        if (!x86_match_cpu(intel_powerclamp_ids)) {
+        if (!boot_cpu_has(X86_FEATURE_MWAIT)) {
-                pr_err("Intel powerclamp does not run on family %d model %d\n",
+                pr_err("CPU does not support MWAIT");
-                                boot_cpu_data.x86, boot_cpu_data.x86_model);
                return -ENODEV;
        }
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 96ae69502c86..111b0e0b8698 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -188,6 +188,8 @@ static void host_stop(struct ci_hdrc *ci)
        if (hcd) {
                usb_remove_hcd(hcd);
+                ci->role = CI_ROLE_END;
+                synchronize_irq(ci->irq);
                usb_put_hcd(hcd);
                if (ci->platdata->reg_vbus && !ci_otg_is_fsm_mode(ci) &&
                        (ci->platdata->flags & CI_HDRC_TURN_VBUS_EARLY_ON))
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index fa9b26b91507..4c0fa0b17353 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -463,9 +463,18 @@ static void dwc2_clear_force_mode(struct dwc2_hsotg *hsotg)
 */
 void dwc2_force_dr_mode(struct dwc2_hsotg *hsotg)
 {
+        bool ret;
        switch (hsotg->dr_mode) {
        case USB_DR_MODE_HOST:
-                dwc2_force_mode(hsotg, true);
+                ret = dwc2_force_mode(hsotg, true);
+                /*
+                 * NOTE: This is required for some rockchip soc based
+                 * platforms on their host-only dwc2.
+                 */
+                if (!ret)
+                        msleep(50);
                break;
        case USB_DR_MODE_PERIPHERAL:
                dwc2_force_mode(hsotg, false);
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index aad4107ef927..2a21a0414b1d 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -259,6 +259,13 @@ enum dwc2_lx_state {
        DWC2_L3,        /* Off state */
 };
+/*
+ * Gadget periodic tx fifo sizes as used by legacy driver
+ * EP0 is not included
+ */
+#define DWC2_G_P_LEGACY_TX_FIFO_SIZE {256, 256, 256, 256, 768, 768, 768, \
+                                           768, 0, 0, 0, 0, 0, 0, 0}
 /* Gadget ep0 states */
 enum dwc2_ep0_state {
        DWC2_EP0_SETUP,
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 4cd6403a7566..24fbebc9b409 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -186,10 +186,9 @@ static void dwc2_hsotg_ctrl_epint(struct dwc2_hsotg *hsotg,
 */
 static void dwc2_hsotg_init_fifo(struct dwc2_hsotg *hsotg)
 {
-        unsigned int fifo;
+        unsigned int ep;
        unsigned int addr;
        int timeout;
-        u32 dptxfsizn;
        u32 val;
        /* Reset fifo map if not correctly cleared during previous session */
@@ -217,16 +216,16 @@ static void dwc2_hsotg_init_fifo(struct dwc2_hsotg *hsotg)
         * them to endpoints dynamically according to maxpacket size value of
         * given endpoint.
         */
-        for (fifo = 1; fifo < MAX_EPS_CHANNELS; fifo++) {
+        for (ep = 1; ep < MAX_EPS_CHANNELS; ep++) {
-                dptxfsizn = dwc2_readl(hsotg->regs + DPTXFSIZN(fifo));
+                if (!hsotg->g_tx_fifo_sz[ep])
+                        continue;
-                val = (dptxfsizn & FIFOSIZE_DEPTH_MASK) | addr;
+                val = addr;
-                addr += dptxfsizn >> FIFOSIZE_DEPTH_SHIFT;
+                val |= hsotg->g_tx_fifo_sz[ep] << FIFOSIZE_DEPTH_SHIFT;
+                WARN_ONCE(addr + hsotg->g_tx_fifo_sz[ep] > hsotg->fifo_mem,
-                if (addr > hsotg->fifo_mem)
+                          "insufficient fifo memory");
-                        break;
+                addr += hsotg->g_tx_fifo_sz[ep];
-                dwc2_writel(val, hsotg->regs + DPTXFSIZN(fifo));
+                dwc2_writel(val, hsotg->regs + DPTXFSIZN(ep));
        }
        /*
@@ -3807,10 +3806,36 @@ static void dwc2_hsotg_dump(struct dwc2_hsotg *hsotg)
 static void dwc2_hsotg_of_probe(struct dwc2_hsotg *hsotg)
 {
        struct device_node *np = hsotg->dev->of_node;
+        u32 len = 0;
+        u32 i = 0;
        /* Enable dma if requested in device tree */
        hsotg->g_using_dma = of_property_read_bool(np, "g-use-dma");
+        /*
+        * Register TX periodic fifo size per endpoint.
+        * EP0 is excluded since it has no fifo configuration.
+        */
+        if (!of_find_property(np, "g-tx-fifo-size", &len))
+                goto rx_fifo;
+        len /= sizeof(u32);
+        /* Read tx fifo sizes other than ep0 */
+        if (of_property_read_u32_array(np, "g-tx-fifo-size",
+                                                &hsotg->g_tx_fifo_sz[1], len))
+                goto rx_fifo;
+        /* Add ep0 */
+        len++;
+        /* Make remaining TX fifos unavailable */
+        if (len < MAX_EPS_CHANNELS) {
+                for (i = len; i < MAX_EPS_CHANNELS; i++)
+                        hsotg->g_tx_fifo_sz[i] = 0;
+        }
+rx_fifo:
        /* Register RX fifo size */
        of_property_read_u32(np, "g-rx-fifo-size", &hsotg->g_rx_fifo_sz);
@@ -3832,10 +3857,13 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
        struct device *dev = hsotg->dev;
        int epnum;
        int ret;
+        int i;
+        u32 p_tx_fifo[] = DWC2_G_P_LEGACY_TX_FIFO_SIZE;
        /* Initialize to legacy fifo configuration values */
        hsotg->g_rx_fifo_sz = 2048;
        hsotg->g_np_g_tx_fifo_sz = 1024;
+        memcpy(&hsotg->g_tx_fifo_sz[1], p_tx_fifo, sizeof(p_tx_fifo));
        /* Device tree specific probe */
        dwc2_hsotg_of_probe(hsotg);
@@ -3853,6 +3881,9 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
        dev_dbg(dev, "NonPeriodic TXFIFO size: %d\n",
                                                hsotg->g_np_g_tx_fifo_sz);
        dev_dbg(dev, "RXFIFO size: %d\n", hsotg->g_rx_fifo_sz);
+        for (i = 0; i < MAX_EPS_CHANNELS; i++)
+                dev_dbg(dev, "Periodic TXFIFO%2d size: %d\n", i,
+                                                hsotg->g_tx_fifo_sz[i]);
        hsotg->gadget.max_speed = USB_SPEED_HIGH;
        hsotg->gadget.ops = &dwc2_hsotg_gadget_ops;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07cc8929f271..1dfa56a5f1c5 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -783,6 +783,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
                req->trb = trb;
                req->trb_dma = dwc3_trb_dma_offset(dep, trb);
                req->first_trb_index = dep->trb_enqueue;
+                dep->queued_requests++;
        }
        dwc3_ep_inc_enq(dep);
@@ -833,8 +834,6 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
        trb->ctrl |= DWC3_TRB_CTRL_HWO;
-        dep->queued_requests++;
        trace_dwc3_prepare_trb(dep, trb);
 }
@@ -1074,9 +1073,17 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
        list_add_tail(&req->list, &dep->pending_list);
-        if (usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+        /*
-                        dep->flags & DWC3_EP_PENDING_REQUEST) {
+         * NOTICE: Isochronous endpoints should NEVER be prestarted. We must
-                if (list_empty(&dep->started_list)) {
+         * wait for a XferNotReady event so we will know what's the current
+         * (micro-)frame number.
+         *
+         * Without this trick, we are very, very likely gonna get Bus Expiry
+         * errors which will force us issue EndTransfer command.
+         */
+        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                if ((dep->flags & DWC3_EP_PENDING_REQUEST) &&
+                                list_empty(&dep->started_list)) {
                        dwc3_stop_active_transfer(dwc, dep->number, true);
                        dep->flags = DWC3_EP_ENABLED;
                }
@@ -1861,8 +1868,11 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
        unsigned int            s_pkt = 0;
        unsigned int            trb_status;
-        dep->queued_requests--;
        dwc3_ep_inc_deq(dep);
+        if (req->trb == trb)
+                dep->queued_requests--;
        trace_dwc3_complete_trb(dep, trb);
        /*
@@ -2980,7 +2990,7 @@ err3:
        kfree(dwc->setup_buf);
 err2:
-        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
+        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
                        dwc->ep0_trb, dwc->ep0_trb_addr);
 err1:
@@ -3005,7 +3015,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
        kfree(dwc->setup_buf);
        kfree(dwc->zlp_buf);
-        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
+        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
                        dwc->ep0_trb, dwc->ep0_trb_addr);
        dma_free_coherent(dwc->dev, sizeof(*dwc->ctrl_req),
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 54ad100af35b..e40d47d47d82 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -136,8 +136,60 @@ struct ffs_epfile {
        /*
         * Buffer for holding data from partial reads which may happen since
         * we’re rounding user read requests to a multiple of a max packet size.
+         *
+         * The pointer is initialised with NULL value and may be set by
+         * __ffs_epfile_read_data function to point to a temporary buffer.
+         *
+         * In normal operation, calls to __ffs_epfile_read_buffered will consume
+         * data from said buffer and eventually free it.  Importantly, while the
+         * function is using the buffer, it sets the pointer to NULL.  This is
+         * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
+         * can never run concurrently (they are synchronised by epfile->mutex)
+         * so the latter will not assign a new value to the pointer.
+         *
+         * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
+         * valid) and sets the pointer to READ_BUFFER_DROP value.  This special
+         * value is crux of the synchronisation between ffs_func_eps_disable and
+         * __ffs_epfile_read_data.
+         *
+         * Once __ffs_epfile_read_data is about to finish it will try to set the
+         * pointer back to its old value (as described above), but seeing as the
+         * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
+         * the buffer.
+         *
+         * == State transitions ==
+         *
+         * • ptr == NULL:  (initial state)
+         *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
+         *   ◦ __ffs_epfile_read_buffered:    nop
+         *   ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == DROP:
+         *   ◦ __ffs_epfile_read_buffer_free: nop
+         *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL
+         *   ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == buf:
+         *   ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
+         *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL and reading
+         *   ◦ __ffs_epfile_read_data:        n/a, __ffs_epfile_read_buffered
+         *                                    is always called first
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == NULL and reading:
+         *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
+         *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
+         *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
+         *   ◦ reading finishes and …
+         *     … all data read:               free buf, go to ptr == NULL
+         *     … otherwise:                   go to ptr == buf and reading
+         * • ptr == DROP and reading:
+         *   ◦ __ffs_epfile_read_buffer_free: nop
+         *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
+         *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
+         *   ◦ reading finishes:              free buf, go to ptr == DROP
         */
-        struct ffs_buffer               *read_buffer;   /* P: epfile->mutex */
+        struct ffs_buffer               *read_buffer;
+#define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))
        char                            name[5];
@@ -736,25 +788,47 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
        schedule_work(&io_data->work);
 }
+static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
+{
+        /*
+         * See comment in struct ffs_epfile for full read_buffer pointer
+         * synchronisation story.
+         */
+        struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
+        if (buf && buf != READ_BUFFER_DROP)
+                kfree(buf);
+}
 /* Assumes epfile->mutex is held. */
 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
                                          struct iov_iter *iter)
 {
-        struct ffs_buffer *buf = epfile->read_buffer;
+        /*
+         * Null out epfile->read_buffer so ffs_func_eps_disable does not free
+         * the buffer while we are using it.  See comment in struct ffs_epfile
+         * for full read_buffer pointer synchronisation story.
+         */
+        struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
        ssize_t ret;
-        if (!buf)
+        if (!buf || buf == READ_BUFFER_DROP)
                return 0;
        ret = copy_to_iter(buf->data, buf->length, iter);
        if (buf->length == ret) {
                kfree(buf);
-                epfile->read_buffer = NULL;
+                return ret;
-        } else if (unlikely(iov_iter_count(iter))) {
+        }
+        if (unlikely(iov_iter_count(iter))) {
                ret = -EFAULT;
        } else {
                buf->length -= ret;
                buf->data += ret;
        }
+        if (cmpxchg(&epfile->read_buffer, NULL, buf))
+                kfree(buf);
        return ret;
 }
@@ -783,7 +857,15 @@ static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
        buf->length = data_len;
        buf->data = buf->storage;
        memcpy(buf->storage, data + ret, data_len);
-        epfile->read_buffer = buf;
+        /*
+         * At this point read_buffer is NULL or READ_BUFFER_DROP (if
+         * ffs_func_eps_disable has been called in the meanwhile).  See comment
+         * in struct ffs_epfile for full read_buffer pointer synchronisation
+         * story.
+         */
+        if (unlikely(cmpxchg(&epfile->read_buffer, NULL, buf)))
+                kfree(buf);
        return ret;
 }
@@ -1097,8 +1179,7 @@ ffs_epfile_release(struct inode *inode, struct file *file)
        ENTER();
-        kfree(epfile->read_buffer);
+        __ffs_epfile_read_buffer_free(epfile);
-        epfile->read_buffer = NULL;
        ffs_data_closed(epfile->ffs);
        return 0;
@@ -1724,24 +1805,20 @@ static void ffs_func_eps_disable(struct ffs_function *func)
        unsigned count            = func->ffs->eps_count;
        unsigned long flags;
+        spin_lock_irqsave(&func->ffs->eps_lock, flags);
        do {
-                if (epfile)
-                        mutex_lock(&epfile->mutex);
-                spin_lock_irqsave(&func->ffs->eps_lock, flags);
                /* pending requests get nuked */
                if (likely(ep->ep))
                        usb_ep_disable(ep->ep);
                ++ep;
-                spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
                if (epfile) {
                        epfile->ep = NULL;
-                        kfree(epfile->read_buffer);
+                        __ffs_epfile_read_buffer_free(epfile);
-                        epfile->read_buffer = NULL;
-                        mutex_unlock(&epfile->mutex);
                        ++epfile;
                }
        } while (--count);
+        spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 }
 static int ffs_func_eps_enable(struct ffs_function *func)
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 9c8c9ed1dc9e..fe1811650dbc 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -590,8 +590,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
        /* throttle high/super speed IRQ rate back slightly */
        if (gadget_is_dualspeed(dev->gadget))
-                req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
+                req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
-                                     dev->gadget->speed == USB_SPEED_SUPER)
+                                       dev->gadget->speed == USB_SPEED_SUPER)) &&
+                                        !list_empty(&dev->tx_reqs))
                        ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
                        : 0;
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index bb1f6c8f0f01..45bc997d0711 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1978,7 +1978,7 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
                        dev_err(&pdev->dev, "of_probe: name error(%d)\n", ret);
                        goto err;
                }
-                ep->ep.name = name;
+                ep->ep.name = kasprintf(GFP_KERNEL, "ep%d", ep->index);
                ep->ep_regs = udc->regs + USBA_EPT_BASE(i);
                ep->dma_regs = udc->regs + USBA_DMA_BASE(i);
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index 876dca4fc216..a268d9e8d6cf 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -39,7 +39,7 @@
 #define DRIVER_DESC "EHCI generic platform driver"
 #define EHCI_MAX_CLKS 4
-#define EHCI_MAX_RSTS 3
+#define EHCI_MAX_RSTS 4
 #define hcd_to_ehci_priv(h) ((struct ehci_platform_priv *)hcd_to_ehci(h)->priv)
 struct ehci_platform_priv {
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 5b5880c0ae19..b38a228134df 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -221,6 +221,12 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        ohci->num_ports = board->ports;
        at91_start_hc(pdev);
+        /*
+         * The RemoteWakeupConnected bit has to be set explicitly
+         * before calling ohci_run. The reset value of this bit is 0.
+         */
+        ohci->hc_control = OHCI_CTRL_RWC;
        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (retval == 0) {
                device_wakeup_enable(hcd->self.controller);
@@ -677,9 +683,6 @@ ohci_hcd_at91_drv_suspend(struct device *dev)
         * REVISIT: some boards will be able to turn VBUS off...
         */
        if (!ohci_at91->wakeup) {
-                ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
-                ohci->hc_control &= OHCI_CTRL_RWC;
-                ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
                ohci->rh_state = OHCI_RH_HALTED;
                /* flush the writes */
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 1700908b84ef..86612ac3fda2 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -72,7 +72,7 @@
 static const char       hcd_name [] = "ohci_hcd";
 #define STATECHANGE_DELAY       msecs_to_jiffies(300)
-#define IO_WATCHDOG_DELAY       msecs_to_jiffies(250)
+#define IO_WATCHDOG_DELAY       msecs_to_jiffies(275)
 #include "ohci.h"
 #include "pci-quirks.h"
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 730b9fd26685..0ef16900efed 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1166,7 +1166,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_RESUME);
                                spin_unlock_irqrestore(&xhci->lock, flags);
-                                msleep(20);
+                                msleep(USB_RESUME_TIMEOUT);
                                spin_lock_irqsave(&xhci->lock, flags);
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_U0);
@@ -1355,6 +1355,35 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
        return 0;
 }
+/*
+ * Workaround for missing Cold Attach Status (CAS) if device re-plugged in S3.
+ * warm reset a USB3 device stuck in polling or compliance mode after resume.
+ * See Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
+ */
+static bool xhci_port_missing_cas_quirk(int port_index,
+                                             __le32 __iomem **port_array)
+{
+        u32 portsc;
+        portsc = readl(port_array[port_index]);
+        /* if any of these are set we are not stuck */
+        if (portsc & (PORT_CONNECT | PORT_CAS))
+                return false;
+        if (((portsc & PORT_PLS_MASK) != XDEV_POLLING) &&
+            ((portsc & PORT_PLS_MASK) != XDEV_COMP_MODE))
+                return false;
+        /* clear wakeup/change bits, and do a warm port reset */
+        portsc &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
+        portsc |= PORT_WR;
+        writel(portsc, port_array[port_index]);
+        /* flush write */
+        readl(port_array[port_index]);
+        return true;
+}
 int xhci_bus_resume(struct usb_hcd *hcd)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
@@ -1392,6 +1421,14 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                u32 temp;
                temp = readl(port_array[port_index]);
+                /* warm reset CAS limited ports stuck in polling/compliance */
+                if ((xhci->quirks & XHCI_MISSING_CAS) &&
+                    (hcd->speed >= HCD_USB3) &&
+                    xhci_port_missing_cas_quirk(port_index, port_array)) {
+                        xhci_dbg(xhci, "reset stuck port %d\n", port_index);
+                        continue;
+                }
                if (DEV_SUPERSPEED_ANY(temp))
                        temp &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
                else
@@ -1410,7 +1447,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
        if (need_usb2_u3_exit) {
                spin_unlock_irqrestore(&xhci->lock, flags);
-                msleep(20);
+                msleep(USB_RESUME_TIMEOUT);
                spin_lock_irqsave(&xhci->lock, flags);
        }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index d7b0f97abbad..e96ae80d107e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -45,11 +45,13 @@
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
+#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI        0x9cb1
 #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI             0x22b5
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI         0xa12f
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI        0x9d2f
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
+#define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 static const char hcd_name[] = "xhci_hcd";
@@ -153,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-                pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+                (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
        }
@@ -169,6 +172,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
                xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
        }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+            (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+                xhci->quirks |= XHCI_MISSING_CAS;
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_EJ168) {
                xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index b2c1dc5dc0f3..f945380035d0 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -314,6 +314,8 @@ struct xhci_op_regs {
 #define XDEV_U2         (0x2 << 5)
 #define XDEV_U3         (0x3 << 5)
 #define XDEV_INACTIVE   (0x6 << 5)
+#define XDEV_POLLING    (0x7 << 5)
+#define XDEV_COMP_MODE  (0xa << 5)
 #define XDEV_RESUME     (0xf << 5)
 /* true: port has power (see HCC_PPC) */
 #define PORT_POWER      (1 << 9)
@@ -1653,6 +1655,7 @@ struct xhci_hcd {
 #define XHCI_MTK_HOST           (1 << 21)
 #define XHCI_SSIC_PORT_UNUSED   (1 << 22)
 #define XHCI_NO_64BIT_SUPPORT   (1 << 23)
+#define XHCI_MISSING_CAS        (1 << 24)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
        /* There are two roothubs to keep track of bus suspend info for */
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index bff4869a57cd..4042ea017985 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1255,6 +1255,7 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
        map_dma_buffer(request, musb, musb_ep);
+        pm_runtime_get_sync(musb->controller);
        spin_lock_irqsave(&musb->lock, lockflags);
        /* don't queue if the ep is down */
@@ -1275,6 +1276,9 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
 unlock:
        spin_unlock_irqrestore(&musb->lock, lockflags);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
        return status;
 }
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 1ab6973d4f61..cc1225485509 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -287,6 +287,7 @@ static int omap2430_musb_init(struct musb *musb)
        }
        musb->isr = omap2430_musb_interrupt;
        phy_init(musb->phy);
+        phy_power_on(musb->phy);
        l = musb_readl(musb->mregs, OTG_INTERFSEL);
@@ -323,8 +324,6 @@ static void omap2430_musb_enable(struct musb *musb)
        struct musb_hdrc_platform_data *pdata = dev_get_platdata(dev);
        struct omap_musb_board_data *data = pdata->board_data;
-        if (!WARN_ON(!musb->phy))
-                phy_power_on(musb->phy);
        switch (glue->status) {
@@ -361,9 +360,6 @@ static void omap2430_musb_disable(struct musb *musb)
        struct device *dev = musb->controller;
        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
-        if (!WARN_ON(!musb->phy))
-                phy_power_off(musb->phy);
        if (glue->status != MUSB_UNKNOWN)
                omap_control_usb_set_mode(glue->control_otghs,
                        USB_MODE_DISCONNECT);
@@ -375,6 +371,7 @@ static int omap2430_musb_exit(struct musb *musb)
        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
        omap2430_low_level_exit(musb);
+        phy_power_off(musb->phy);
        phy_exit(musb->phy);
        musb->phy = NULL;
        cancel_work_sync(&glue->omap_musb_mailbox_work);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index 1d70add926f0..d544b331c9f2 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -9,6 +9,7 @@
 *
 */
+#include <linux/delay.h>
 #include <linux/io.h>
 #include "common.h"
 #include "rcar3.h"
@@ -35,10 +36,13 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
-        if (enable)
+        if (enable) {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
-        else
+                /* The controller on R-Car Gen3 needs to wait up to 45 usec */
+                udelay(45);
+        } else {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, 0);
+        }
        return 0;
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 54a4de0efdba..f61477bed3a8 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -1077,7 +1077,9 @@ static int cp210x_tiocmget(struct tty_struct *tty)
        u8 control;
        int result;
-        cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
+        result = cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
+        if (result)
+                return result;
        result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0)
                |((control & CONTROL_RTS) ? TIOCM_RTS : 0)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b2d767e743fc..0ff7f38d7800 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = {
        /* ekey Devices */
        { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
        /* Infineon Devices */
-        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) },
        /* GE Healthcare devices */
        { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
        /* Active Research (Actisense) devices */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f87a938cf005..21011c0a4c64 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -626,8 +626,9 @@
 /*
 * Infineon Technologies
 */
-#define INFINEON_VID            0x058b
+#define INFINEON_VID                    0x058b
-#define INFINEON_TRIBOARD_PID   0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+#define INFINEON_TRIBOARD_TC1798_PID    0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+#define INFINEON_TRIBOARD_TC2X7_PID     0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
 /*
 * Acton Research Corp.
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index d213cf44a7e4..4a037b4a79cf 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1078,7 +1078,8 @@ static int usb_serial_probe(struct usb_interface *interface,
        serial->disconnected = 0;
-        usb_serial_console_init(serial->port[0]->minor);
+        if (num_ports > 0)
+                usb_serial_console_init(serial->port[0]->minor);
 exit:
        module_put(type->driver.owner);
        return 0;
diff --git a/drivers/usb/wusbcore/crypto.c b/drivers/usb/wusbcore/crypto.c
index 79b2b628066d..79451f7ef1b7 100644
--- a/drivers/usb/wusbcore/crypto.c
+++ b/drivers/usb/wusbcore/crypto.c
@@ -133,6 +133,13 @@ static void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2,
                bo[itr] = bi1[itr] ^ bi2[itr];
 }
+/* Scratch space for MAC calculations. */
+struct wusb_mac_scratch {
+        struct aes_ccm_b0 b0;
+        struct aes_ccm_b1 b1;
+        struct aes_ccm_a ax;
+};
 /*
 * CC-MAC function WUSB1.0[6.5]
 *
@@ -197,16 +204,15 @@ static void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2,
 *       what sg[4] is for. Maybe there is a smarter way to do this.
 */
 static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
-                        struct crypto_cipher *tfm_aes, void *mic,
+                        struct crypto_cipher *tfm_aes,
+                        struct wusb_mac_scratch *scratch,
+                        void *mic,
                        const struct aes_ccm_nonce *n,
                        const struct aes_ccm_label *a, const void *b,
                        size_t blen)
 {
        int result = 0;
        SKCIPHER_REQUEST_ON_STACK(req, tfm_cbc);
-        struct aes_ccm_b0 b0;
-        struct aes_ccm_b1 b1;
-        struct aes_ccm_a ax;
        struct scatterlist sg[4], sg_dst;
        void *dst_buf;
        size_t dst_size;
@@ -218,16 +224,17 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * These checks should be compile time optimized out
         * ensure @a fills b1's mac_header and following fields
         */
-        WARN_ON(sizeof(*a) != sizeof(b1) - sizeof(b1.la));
+        WARN_ON(sizeof(*a) != sizeof(scratch->b1) - sizeof(scratch->b1.la));
-        WARN_ON(sizeof(b0) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->b0) != sizeof(struct aes_ccm_block));
-        WARN_ON(sizeof(b1) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->b1) != sizeof(struct aes_ccm_block));
-        WARN_ON(sizeof(ax) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->ax) != sizeof(struct aes_ccm_block));
        result = -ENOMEM;
        zero_padding = blen % sizeof(struct aes_ccm_block);
        if (zero_padding)
                zero_padding = sizeof(struct aes_ccm_block) - zero_padding;
-        dst_size = blen + sizeof(b0) + sizeof(b1) + zero_padding;
+        dst_size = blen + sizeof(scratch->b0) + sizeof(scratch->b1) +
+                zero_padding;
        dst_buf = kzalloc(dst_size, GFP_KERNEL);
        if (!dst_buf)
                goto error_dst_buf;
@@ -235,9 +242,9 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
        memset(iv, 0, sizeof(iv));
        /* Setup B0 */
-        b0.flags = 0x59;        /* Format B0 */
+        scratch->b0.flags = 0x59;       /* Format B0 */
-        b0.ccm_nonce = *n;
+        scratch->b0.ccm_nonce = *n;
-        b0.lm = cpu_to_be16(0); /* WUSB1.0[6.5] sez l(m) is 0 */
+        scratch->b0.lm = cpu_to_be16(0);        /* WUSB1.0[6.5] sez l(m) is 0 */
        /* Setup B1
         *
@@ -246,12 +253,12 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * 14'--after clarification, it means to use A's contents
         * for MAC Header, EO, sec reserved and padding.
         */
-        b1.la = cpu_to_be16(blen + 14);
+        scratch->b1.la = cpu_to_be16(blen + 14);
-        memcpy(&b1.mac_header, a, sizeof(*a));
+        memcpy(&scratch->b1.mac_header, a, sizeof(*a));
        sg_init_table(sg, ARRAY_SIZE(sg));
-        sg_set_buf(&sg[0], &b0, sizeof(b0));
+        sg_set_buf(&sg[0], &scratch->b0, sizeof(scratch->b0));
-        sg_set_buf(&sg[1], &b1, sizeof(b1));
+        sg_set_buf(&sg[1], &scratch->b1, sizeof(scratch->b1));
        sg_set_buf(&sg[2], b, blen);
        /* 0 if well behaved :) */
        sg_set_buf(&sg[3], bzero, zero_padding);
@@ -276,11 +283,12 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * POS Crypto API: size is assumed to be AES's block size.
         * Thanks for documenting it -- tip taken from airo.c
         */
-        ax.flags = 0x01;                /* as per WUSB 1.0 spec */
+        scratch->ax.flags = 0x01;               /* as per WUSB 1.0 spec */
-        ax.ccm_nonce = *n;
+        scratch->ax.ccm_nonce = *n;
-        ax.counter = 0;
+        scratch->ax.counter = 0;
-        crypto_cipher_encrypt_one(tfm_aes, (void *)&ax, (void *)&ax);
+        crypto_cipher_encrypt_one(tfm_aes, (void *)&scratch->ax,
-        bytewise_xor(mic, &ax, iv, 8);
+                                  (void *)&scratch->ax);
+        bytewise_xor(mic, &scratch->ax, iv, 8);
        result = 8;
 error_cbc_crypt:
        kfree(dst_buf);
@@ -303,6 +311,7 @@ ssize_t wusb_prf(void *out, size_t out_size,
        struct aes_ccm_nonce n = *_n;
        struct crypto_skcipher *tfm_cbc;
        struct crypto_cipher *tfm_aes;
+        struct wusb_mac_scratch *scratch;
        u64 sfn = 0;
        __le64 sfn_le;
@@ -329,17 +338,25 @@ ssize_t wusb_prf(void *out, size_t out_size,
                printk(KERN_ERR "E: can't set AES key: %d\n", (int)result);
                goto error_setkey_aes;
        }
+        scratch = kmalloc(sizeof(*scratch), GFP_KERNEL);
+        if (!scratch) {
+                result = -ENOMEM;
+                goto error_alloc_scratch;
+        }
        for (bitr = 0; bitr < (len + 63) / 64; bitr++) {
                sfn_le = cpu_to_le64(sfn++);
                memcpy(&n.sfn, &sfn_le, sizeof(n.sfn)); /* n.sfn++... */
-                result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes,
+                result = wusb_ccm_mac(tfm_cbc, tfm_aes, scratch, out + bytes,
                                      &n, a, b, blen);
                if (result < 0)
                        goto error_ccm_mac;
                bytes += result;
        }
        result = bytes;
+        kfree(scratch);
+error_alloc_scratch:
 error_ccm_mac:
 error_setkey_aes:
        crypto_free_cipher(tfm_aes);
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index e12bd3635f83..26e5e8507f03 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -168,7 +168,9 @@ out:
 #endif  /* CONFIG_HIBERNATE_CALLBACKS */
 struct shutdown_handler {
-        const char *command;
+#define SHUTDOWN_CMD_SIZE 11
+        const char command[SHUTDOWN_CMD_SIZE];
+        bool flag;
        void (*cb)(void);
 };
@@ -206,22 +208,22 @@ static void do_reboot(void)
        ctrl_alt_del();
 }
+static struct shutdown_handler shutdown_handlers[] = {
+        { "poweroff",   true,   do_poweroff },
+        { "halt",       false,  do_poweroff },
+        { "reboot",     true,   do_reboot   },
+#ifdef CONFIG_HIBERNATE_CALLBACKS
+        { "suspend",    true,   do_suspend  },
+#endif
+};
 static void shutdown_handler(struct xenbus_watch *watch,
                             const char **vec, unsigned int len)
 {
        char *str;
        struct xenbus_transaction xbt;
        int err;
-        static struct shutdown_handler handlers[] = {
+        int idx;
-                { "poweroff",   do_poweroff },
-                { "halt",       do_poweroff },
-                { "reboot",     do_reboot   },
-#ifdef CONFIG_HIBERNATE_CALLBACKS
-                { "suspend",    do_suspend  },
-#endif
-                {NULL, NULL},
-        };
-        static struct shutdown_handler *handler;
        if (shutting_down != SHUTDOWN_INVALID)
                return;
@@ -238,13 +240,13 @@ static void shutdown_handler(struct xenbus_watch *watch,
                return;
        }
-        for (handler = &handlers[0]; handler->command; handler++) {
+        for (idx = 0; idx < ARRAY_SIZE(shutdown_handlers); idx++) {
-                if (strcmp(str, handler->command) == 0)
+                if (strcmp(str, shutdown_handlers[idx].command) == 0)
                        break;
        }
        /* Only acknowledge commands which we are prepared to handle. */
-        if (handler->cb)
+        if (idx < ARRAY_SIZE(shutdown_handlers))
                xenbus_write(xbt, "control", "shutdown", "");
        err = xenbus_transaction_end(xbt, 0);
@@ -253,8 +255,8 @@ static void shutdown_handler(struct xenbus_watch *watch,
                goto again;
        }
-        if (handler->cb) {
+        if (idx < ARRAY_SIZE(shutdown_handlers)) {
-                handler->cb();
+                shutdown_handlers[idx].cb();
        } else {
                pr_info("Ignoring shutdown request: %s\n", str);
                shutting_down = SHUTDOWN_INVALID;
@@ -310,6 +312,9 @@ static struct notifier_block xen_reboot_nb = {
 static int setup_shutdown_watcher(void)
 {
        int err;
+        int idx;
+#define FEATURE_PATH_SIZE (SHUTDOWN_CMD_SIZE + sizeof("feature-"))
+        char node[FEATURE_PATH_SIZE];
        err = register_xenbus_watch(&shutdown_watch);
        if (err) {
@@ -326,6 +331,14 @@ static int setup_shutdown_watcher(void)
        }
 #endif
+        for (idx = 0; idx < ARRAY_SIZE(shutdown_handlers); idx++) {
+                if (!shutdown_handlers[idx].flag)
+                        continue;
+                snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
+                         shutdown_handlers[idx].command);
+                xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+        }
        return 0;
 }
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index c1010f018bd8..1e8be12ebb55 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -364,7 +364,7 @@ out:
 static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
 {
-        struct watch_adapter *watch, *tmp_watch;
+        struct watch_adapter *watch;
        char *path, *token;
        int err, rc;
        LIST_HEAD(staging_q);
@@ -399,7 +399,7 @@ static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
                }
                list_add(&watch->list, &u->watches);
        } else {
-                list_for_each_entry_safe(watch, tmp_watch, &u->watches, list) {
+                list_for_each_entry(watch, &u->watches, list) {
                        if (!strcmp(watch->token, token) &&
                            !strcmp(watch->watch.node, path)) {
                                unregister_xenbus_watch(&watch->watch);
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 611a23119675..6d40a972ffb2 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -335,7 +335,9 @@ static int backend_state;
 static void xenbus_reset_backend_state_changed(struct xenbus_watch *w,
                                        const char **v, unsigned int l)
 {
-        xenbus_scanf(XBT_NIL, v[XS_WATCH_PATH], "", "%i", &backend_state);
+        if (xenbus_scanf(XBT_NIL, v[XS_WATCH_PATH], "", "%i",
+                         &backend_state) != 1)
+                backend_state = XenbusStateUnknown;
        printk(KERN_DEBUG "XENBUS: backend %s %s\n",
                        v[XS_WATCH_PATH], xenbus_strstate(backend_state));
        wake_up(&backend_state_wq);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 01bc36cec26e..71261b459863 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5805,6 +5805,64 @@ static int changed_extent(struct send_ctx *sctx,
        int ret = 0;
        if (sctx->cur_ino != sctx->cmp_key->objectid) {
+                if (result == BTRFS_COMPARE_TREE_CHANGED) {
+                        struct extent_buffer *leaf_l;
+                        struct extent_buffer *leaf_r;
+                        struct btrfs_file_extent_item *ei_l;
+                        struct btrfs_file_extent_item *ei_r;
+                        leaf_l = sctx->left_path->nodes[0];
+                        leaf_r = sctx->right_path->nodes[0];
+                        ei_l = btrfs_item_ptr(leaf_l,
+                                              sctx->left_path->slots[0],
+                                              struct btrfs_file_extent_item);
+                        ei_r = btrfs_item_ptr(leaf_r,
+                                              sctx->right_path->slots[0],
+                                              struct btrfs_file_extent_item);
+                        /*
+                         * We may have found an extent item that has changed
+                         * only its disk_bytenr field and the corresponding
+                         * inode item was not updated. This case happens due to
+                         * very specific timings during relocation when a leaf
+                         * that contains file extent items is COWed while
+                         * relocation is ongoing and its in the stage where it
+                         * updates data pointers. So when this happens we can
+                         * safely ignore it since we know it's the same extent,
+                         * but just at different logical and physical locations
+                         * (when an extent is fully replaced with a new one, we
+                         * know the generation number must have changed too,
+                         * since snapshot creation implies committing the current
+                         * transaction, and the inode item must have been updated
+                         * as well).
+                         * This replacement of the disk_bytenr happens at
+                         * relocation.c:replace_file_extents() through
+                         * relocation.c:btrfs_reloc_cow_block().
+                         */
+                        if (btrfs_file_extent_generation(leaf_l, ei_l) ==
+                            btrfs_file_extent_generation(leaf_r, ei_r) &&
+                            btrfs_file_extent_ram_bytes(leaf_l, ei_l) ==
+                            btrfs_file_extent_ram_bytes(leaf_r, ei_r) &&
+                            btrfs_file_extent_compression(leaf_l, ei_l) ==
+                            btrfs_file_extent_compression(leaf_r, ei_r) &&
+                            btrfs_file_extent_encryption(leaf_l, ei_l) ==
+                            btrfs_file_extent_encryption(leaf_r, ei_r) &&
+                            btrfs_file_extent_other_encoding(leaf_l, ei_l) ==
+                            btrfs_file_extent_other_encoding(leaf_r, ei_r) &&
+                            btrfs_file_extent_type(leaf_l, ei_l) ==
+                            btrfs_file_extent_type(leaf_r, ei_r) &&
+                            btrfs_file_extent_disk_bytenr(leaf_l, ei_l) !=
+                            btrfs_file_extent_disk_bytenr(leaf_r, ei_r) &&
+                            btrfs_file_extent_disk_num_bytes(leaf_l, ei_l) ==
+                            btrfs_file_extent_disk_num_bytes(leaf_r, ei_r) &&
+                            btrfs_file_extent_offset(leaf_l, ei_l) ==
+                            btrfs_file_extent_offset(leaf_r, ei_r) &&
+                            btrfs_file_extent_num_bytes(leaf_l, ei_l) ==
+                            btrfs_file_extent_num_bytes(leaf_r, ei_r))
+                                return 0;
+                }
                inconsistent_snapshot_error(sctx, result, "extent");
                return -EIO;
        }
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 528cae123dc9..3d33c4e41e5f 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2713,14 +2713,12 @@ static inline void btrfs_remove_all_log_ctxs(struct btrfs_root *root,
                                             int index, int error)
 {
        struct btrfs_log_ctx *ctx;
+        struct btrfs_log_ctx *safe;
-        if (!error) {
+        list_for_each_entry_safe(ctx, safe, &root->log_ctxs[index], list) {
-                INIT_LIST_HEAD(&root->log_ctxs[index]);
+                list_del_init(&ctx->list);
-                return;
-        }
-        list_for_each_entry(ctx, &root->log_ctxs[index], list)
                ctx->log_ret = error;
+        }
        INIT_LIST_HEAD(&root->log_ctxs[index]);
 }
@@ -2961,13 +2959,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
        mutex_unlock(&root->log_mutex);
 out_wake_log_root:
-        /*
+        mutex_lock(&log_root_tree->log_mutex);
-         * We needn't get log_mutex here because we are sure all
-         * the other tasks are blocked.
-         */
        btrfs_remove_all_log_ctxs(log_root_tree, index2, ret);
-        mutex_lock(&log_root_tree->log_mutex);
        log_root_tree->log_transid_committed++;
        atomic_set(&log_root_tree->log_commit[index2], 0);
        mutex_unlock(&log_root_tree->log_mutex);
@@ -2978,10 +2972,8 @@ out_wake_log_root:
        if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
                wake_up(&log_root_tree->log_commit_wait[index2]);
 out:
-        /* See above. */
-        btrfs_remove_all_log_ctxs(root, index1, ret);
        mutex_lock(&root->log_mutex);
+        btrfs_remove_all_log_ctxs(root, index1, ret);
        root->log_transid_committed++;
        atomic_set(&root->log_commit[index1], 0);
        mutex_unlock(&root->log_mutex);
diff --git a/fs/exofs/dir.c b/fs/exofs/dir.c
index 79101651fe9e..42f9a0a0c4ca 100644
--- a/fs/exofs/dir.c
+++ b/fs/exofs/dir.c
@@ -137,7 +137,7 @@ Espan:
 bad_entry:
        EXOFS_ERR(
                "ERROR [exofs_check_page]: bad entry in directory(0x%lx): %s - "
-                "offset=%lu, inode=0x%llu, rec_len=%d, name_len=%d\n",
+                "offset=%lu, inode=0x%llx, rec_len=%d, name_len=%d\n",
                dir->i_ino, error, (page->index<<PAGE_SHIFT)+offs,
                _LLU(le64_to_cpu(p->inode_no)),
                rec_len, p->name_len);
diff --git a/fs/iomap.c b/fs/iomap.c
index 013d1d36fbbf..a8ee8c33ca78 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -433,8 +433,7 @@ iomap_page_mkwrite_actor(struct inode *inode, loff_t pos, loff_t length,
        struct page *page = data;
        int ret;
-        ret = __block_write_begin_int(page, pos & ~PAGE_MASK, length,
+        ret = __block_write_begin_int(page, pos, length, NULL, iomap);
-                        NULL, iomap);
        if (ret)
                return ret;
@@ -561,7 +560,7 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
        }
        while (len > 0) {
-                ret = iomap_apply(inode, start, len, 0, ops, &ctx,
+                ret = iomap_apply(inode, start, len, IOMAP_REPORT, ops, &ctx,
                                iomap_fiemap_actor);
                /* inode with no (attribute) mapping will give ENOENT */
                if (ret == -ENOENT)
diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c
index 1e8fe844e69f..5355efba4bc8 100644
--- a/fs/orangefs/dcache.c
+++ b/fs/orangefs/dcache.c
@@ -73,7 +73,7 @@ static int orangefs_revalidate_lookup(struct dentry *dentry)
                }
        }
-        dentry->d_time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        orangefs_set_timeout(dentry);
        ret = 1;
 out_release_op:
        op_release(new_op);
@@ -94,8 +94,9 @@ out_drop:
 static int orangefs_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
        int ret;
+        unsigned long time = (unsigned long) dentry->d_fsdata;
-        if (time_before(jiffies, dentry->d_time))
+        if (time_before(jiffies, time))
                return 1;
        if (flags & LOOKUP_RCU)
diff --git a/fs/orangefs/file.c b/fs/orangefs/file.c
index 66ea0cc37b18..02cc6139ec90 100644
--- a/fs/orangefs/file.c
+++ b/fs/orangefs/file.c
@@ -621,9 +621,9 @@ static int orangefs_file_release(struct inode *inode, struct file *file)
         * readahead cache (if any); this forces an expensive refresh of
         * data for the next caller of mmap (or 'get_block' accesses)
         */
-        if (file->f_path.dentry->d_inode &&
+        if (file_inode(file) &&
-            file->f_path.dentry->d_inode->i_mapping &&
+            file_inode(file)->i_mapping &&
-            mapping_nrpages(&file->f_path.dentry->d_inode->i_data)) {
+            mapping_nrpages(&file_inode(file)->i_data)) {
                if (orangefs_features & ORANGEFS_FEATURE_READAHEAD) {
                        gossip_debug(GOSSIP_INODE_DEBUG,
                            "calling flush_racache on %pU\n",
@@ -632,7 +632,7 @@ static int orangefs_file_release(struct inode *inode, struct file *file)
                        gossip_debug(GOSSIP_INODE_DEBUG,
                            "flush_racache finished\n");
                }
-                truncate_inode_pages(file->f_path.dentry->d_inode->i_mapping,
+                truncate_inode_pages(file_inode(file)->i_mapping,
                                     0);
        }
        return 0;
@@ -648,7 +648,7 @@ static int orangefs_fsync(struct file *file,
 {
        int ret = -EINVAL;
        struct orangefs_inode_s *orangefs_inode =
-                ORANGEFS_I(file->f_path.dentry->d_inode);
+                ORANGEFS_I(file_inode(file));
        struct orangefs_kernel_op_s *new_op = NULL;
        /* required call */
@@ -661,7 +661,7 @@ static int orangefs_fsync(struct file *file,
        ret = service_operation(new_op,
                        "orangefs_fsync",
-                        get_interruptible_flag(file->f_path.dentry->d_inode));
+                        get_interruptible_flag(file_inode(file)));
        gossip_debug(GOSSIP_FILE_DEBUG,
                     "orangefs_fsync got return value of %d\n",
@@ -669,7 +669,7 @@ static int orangefs_fsync(struct file *file,
        op_release(new_op);
-        orangefs_flush_inode(file->f_path.dentry->d_inode);
+        orangefs_flush_inode(file_inode(file));
        return ret;
 }
diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c
index d15d3d2dba62..a290ff6ec756 100644
--- a/fs/orangefs/namei.c
+++ b/fs/orangefs/namei.c
@@ -72,7 +72,7 @@ static int orangefs_create(struct inode *dir,
        d_instantiate(dentry, inode);
        unlock_new_inode(inode);
-        dentry->d_time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        orangefs_set_timeout(dentry);
        ORANGEFS_I(inode)->getattr_time = jiffies - 1;
        gossip_debug(GOSSIP_NAME_DEBUG,
@@ -183,7 +183,7 @@ static struct dentry *orangefs_lookup(struct inode *dir, struct dentry *dentry,
                goto out;
        }
-        dentry->d_time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        orangefs_set_timeout(dentry);
        inode = orangefs_iget(dir->i_sb, &new_op->downcall.resp.lookup.refn);
        if (IS_ERR(inode)) {
@@ -322,7 +322,7 @@ static int orangefs_symlink(struct inode *dir,
        d_instantiate(dentry, inode);
        unlock_new_inode(inode);
-        dentry->d_time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        orangefs_set_timeout(dentry);
        ORANGEFS_I(inode)->getattr_time = jiffies - 1;
        gossip_debug(GOSSIP_NAME_DEBUG,
@@ -386,7 +386,7 @@ static int orangefs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
        d_instantiate(dentry, inode);
        unlock_new_inode(inode);
-        dentry->d_time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        orangefs_set_timeout(dentry);
        ORANGEFS_I(inode)->getattr_time = jiffies - 1;
        gossip_debug(GOSSIP_NAME_DEBUG,
diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
index 0a82048f3aaf..3bf803d732c5 100644
--- a/fs/orangefs/orangefs-kernel.h
+++ b/fs/orangefs/orangefs-kernel.h
@@ -580,4 +580,11 @@ static inline void orangefs_i_size_write(struct inode *inode, loff_t i_size)
 #endif
 }
+static inline void orangefs_set_timeout(struct dentry *dentry)
+{
+        unsigned long time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
+        dentry->d_fsdata = (void *) time;
+}
 #endif /* __ORANGEFSKERNEL_H */
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8e654468ab67..ca651ac00660 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -252,7 +252,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
         * Inherently racy -- command line shares address space
         * with code and data.
         */
-        rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_FORCE);
+        rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0);
        if (rv <= 0)
                goto out_free_page;
@@ -270,8 +270,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
                        int nr_read;
                        _count = min3(count, len, PAGE_SIZE);
-                        nr_read = access_remote_vm(mm, p, page, _count,
+                        nr_read = access_remote_vm(mm, p, page, _count, 0);
-                                        FOLL_FORCE);
                        if (nr_read < 0)
                                rv = nr_read;
                        if (nr_read <= 0)
@@ -306,8 +305,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
                        bool final;
                        _count = min3(count, len, PAGE_SIZE);
-                        nr_read = access_remote_vm(mm, p, page, _count,
+                        nr_read = access_remote_vm(mm, p, page, _count, 0);
-                                        FOLL_FORCE);
                        if (nr_read < 0)
                                rv = nr_read;
                        if (nr_read <= 0)
@@ -356,8 +354,7 @@ skip_argv:
                        bool final;
                        _count = min3(count, len, PAGE_SIZE);
-                        nr_read = access_remote_vm(mm, p, page, _count,
+                        nr_read = access_remote_vm(mm, p, page, _count, 0);
-                                        FOLL_FORCE);
                        if (nr_read < 0)
                                rv = nr_read;
                        if (nr_read <= 0)
@@ -835,7 +832,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
        unsigned long addr = *ppos;
        ssize_t copied;
        char *page;
-        unsigned int flags = FOLL_FORCE;
+        unsigned int flags;
        if (!mm)
                return 0;
@@ -848,6 +845,8 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
        if (!atomic_inc_not_zero(&mm->mm_users))
                goto free;
+        /* Maybe we should limit FOLL_FORCE to actual ptrace users? */
+        flags = FOLL_FORCE;
        if (write)
                flags |= FOLL_WRITE;
@@ -971,8 +970,7 @@ static ssize_t environ_read(struct file *file, char __user *buf,
                max_len = min_t(size_t, PAGE_SIZE, count);
                this_len = min(max_len, this_len);
-                retval = access_remote_vm(mm, (env_start + src),
+                retval = access_remote_vm(mm, (env_start + src), page, this_len, 0);
-                        page, this_len, FOLL_FORCE);
                if (retval <= 0) {
                        ret = retval;
@@ -1014,6 +1012,9 @@ static ssize_t auxv_read(struct file *file, char __user *buf,
 {
        struct mm_struct *mm = file->private_data;
        unsigned int nwords = 0;
+        if (!mm)
+                return 0;
        do {
                nwords += 2;
        } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index c27344cf38e1..c6eb21940783 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3974,9 +3974,6 @@ xfs_bmap_remap_alloc(
         * allocating, so skip that check by pretending to be freeing.
         */
        error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING);
-        if (error)
-                goto error0;
-error0:
        xfs_perag_put(args.pag);
        if (error)
                trace_xfs_bmap_remap_alloc_error(ap->ip, error, _RET_IP_);
@@ -3999,6 +3996,39 @@ xfs_bmap_alloc(
        return xfs_bmap_btalloc(ap);
 }
+/* Trim extent to fit a logical block range. */
+void
+xfs_trim_extent(
+        struct xfs_bmbt_irec    *irec,
+        xfs_fileoff_t           bno,
+        xfs_filblks_t           len)
+{
+        xfs_fileoff_t           distance;
+        xfs_fileoff_t           end = bno + len;
+        if (irec->br_startoff + irec->br_blockcount <= bno ||
+            irec->br_startoff >= end) {
+                irec->br_blockcount = 0;
+                return;
+        }
+        if (irec->br_startoff < bno) {
+                distance = bno - irec->br_startoff;
+                if (isnullstartblock(irec->br_startblock))
+                        irec->br_startblock = DELAYSTARTBLOCK;
+                if (irec->br_startblock != DELAYSTARTBLOCK &&
+                    irec->br_startblock != HOLESTARTBLOCK)
+                        irec->br_startblock += distance;
+                irec->br_startoff += distance;
+                irec->br_blockcount -= distance;
+        }
+        if (end < irec->br_startoff + irec->br_blockcount) {
+                distance = irec->br_startoff + irec->br_blockcount - end;
+                irec->br_blockcount -= distance;
+        }
+}
 /*
 * Trim the returned map to the required bounds
 */
@@ -4829,6 +4859,219 @@ xfs_bmap_split_indlen(
        return stolen;
 }
+int
+xfs_bmap_del_extent_delay(
+        struct xfs_inode        *ip,
+        int                     whichfork,
+        xfs_extnum_t            *idx,
+        struct xfs_bmbt_irec    *got,
+        struct xfs_bmbt_irec    *del)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, whichfork);
+        struct xfs_bmbt_irec    new;
+        int64_t                 da_old, da_new, da_diff = 0;
+        xfs_fileoff_t           del_endoff, got_endoff;
+        xfs_filblks_t           got_indlen, new_indlen, stolen;
+        int                     error = 0, state = 0;
+        bool                    isrt;
+        XFS_STATS_INC(mp, xs_del_exlist);
+        isrt = (whichfork == XFS_DATA_FORK) && XFS_IS_REALTIME_INODE(ip);
+        del_endoff = del->br_startoff + del->br_blockcount;
+        got_endoff = got->br_startoff + got->br_blockcount;
+        da_old = startblockval(got->br_startblock);
+        da_new = 0;
+        ASSERT(*idx >= 0);
+        ASSERT(*idx < ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
+        ASSERT(del->br_blockcount > 0);
+        ASSERT(got->br_startoff <= del->br_startoff);
+        ASSERT(got_endoff >= del_endoff);
+        if (isrt) {
+                int64_t rtexts = XFS_FSB_TO_B(mp, del->br_blockcount);
+                do_div(rtexts, mp->m_sb.sb_rextsize);
+                xfs_mod_frextents(mp, rtexts);
+        }
+        /*
+         * Update the inode delalloc counter now and wait to update the
+         * sb counters as we might have to borrow some blocks for the
+         * indirect block accounting.
+         */
+        xfs_trans_reserve_quota_nblks(NULL, ip, -((long)del->br_blockcount), 0,
+                        isrt ? XFS_QMOPT_RES_RTBLKS : XFS_QMOPT_RES_REGBLKS);
+        ip->i_delayed_blks -= del->br_blockcount;
+        if (whichfork == XFS_COW_FORK)
+                state |= BMAP_COWFORK;
+        if (got->br_startoff == del->br_startoff)
+                state |= BMAP_LEFT_CONTIG;
+        if (got_endoff == del_endoff)
+                state |= BMAP_RIGHT_CONTIG;
+        switch (state & (BMAP_LEFT_CONTIG | BMAP_RIGHT_CONTIG)) {
+        case BMAP_LEFT_CONTIG | BMAP_RIGHT_CONTIG:
+                /*
+                 * Matches the whole extent.  Delete the entry.
+                 */
+                xfs_iext_remove(ip, *idx, 1, state);
+                --*idx;
+                break;
+        case BMAP_LEFT_CONTIG:
+                /*
+                 * Deleting the first part of the extent.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_startoff = del_endoff;
+                got->br_blockcount -= del->br_blockcount;
+                da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip,
+                                got->br_blockcount), da_old);
+                got->br_startblock = nullstartblock((int)da_new);
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
+                break;
+        case BMAP_RIGHT_CONTIG:
+                /*
+                 * Deleting the last part of the extent.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_blockcount = got->br_blockcount - del->br_blockcount;
+                da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip,
+                                got->br_blockcount), da_old);
+                got->br_startblock = nullstartblock((int)da_new);
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
+                break;
+        case 0:
+                /*
+                 * Deleting the middle of the extent.
+                 *
+                 * Distribute the original indlen reservation across the two new
+                 * extents.  Steal blocks from the deleted extent if necessary.
+                 * Stealing blocks simply fudges the fdblocks accounting below.
+                 * Warn if either of the new indlen reservations is zero as this
+                 * can lead to delalloc problems.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_blockcount = del->br_startoff - got->br_startoff;
+                got_indlen = xfs_bmap_worst_indlen(ip, got->br_blockcount);
+                new.br_blockcount = got_endoff - del_endoff;
+                new_indlen = xfs_bmap_worst_indlen(ip, new.br_blockcount);
+                WARN_ON_ONCE(!got_indlen || !new_indlen);
+                stolen = xfs_bmap_split_indlen(da_old, &got_indlen, &new_indlen,
+                                                       del->br_blockcount);
+                got->br_startblock = nullstartblock((int)got_indlen);
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, 0, _THIS_IP_);
+                new.br_startoff = del_endoff;
+                new.br_state = got->br_state;
+                new.br_startblock = nullstartblock((int)new_indlen);
+                ++*idx;
+                xfs_iext_insert(ip, *idx, 1, &new, state);
+                da_new = got_indlen + new_indlen - stolen;
+                del->br_blockcount -= stolen;
+                break;
+        }
+        ASSERT(da_old >= da_new);
+        da_diff = da_old - da_new;
+        if (!isrt)
+                da_diff += del->br_blockcount;
+        if (da_diff)
+                xfs_mod_fdblocks(mp, da_diff, false);
+        return error;
+}
+void
+xfs_bmap_del_extent_cow(
+        struct xfs_inode        *ip,
+        xfs_extnum_t            *idx,
+        struct xfs_bmbt_irec    *got,
+        struct xfs_bmbt_irec    *del)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_ifork        *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
+        struct xfs_bmbt_irec    new;
+        xfs_fileoff_t           del_endoff, got_endoff;
+        int                     state = BMAP_COWFORK;
+        XFS_STATS_INC(mp, xs_del_exlist);
+        del_endoff = del->br_startoff + del->br_blockcount;
+        got_endoff = got->br_startoff + got->br_blockcount;
+        ASSERT(*idx >= 0);
+        ASSERT(*idx < ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
+        ASSERT(del->br_blockcount > 0);
+        ASSERT(got->br_startoff <= del->br_startoff);
+        ASSERT(got_endoff >= del_endoff);
+        ASSERT(!isnullstartblock(got->br_startblock));
+        if (got->br_startoff == del->br_startoff)
+                state |= BMAP_LEFT_CONTIG;
+        if (got_endoff == del_endoff)
+                state |= BMAP_RIGHT_CONTIG;
+        switch (state & (BMAP_LEFT_CONTIG | BMAP_RIGHT_CONTIG)) {
+        case BMAP_LEFT_CONTIG | BMAP_RIGHT_CONTIG:
+                /*
+                 * Matches the whole extent.  Delete the entry.
+                 */
+                xfs_iext_remove(ip, *idx, 1, state);
+                --*idx;
+                break;
+        case BMAP_LEFT_CONTIG:
+                /*
+                 * Deleting the first part of the extent.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_startoff = del_endoff;
+                got->br_blockcount -= del->br_blockcount;
+                got->br_startblock = del->br_startblock + del->br_blockcount;
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
+                break;
+        case BMAP_RIGHT_CONTIG:
+                /*
+                 * Deleting the last part of the extent.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_blockcount -= del->br_blockcount;
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
+                break;
+        case 0:
+                /*
+                 * Deleting the middle of the extent.
+                 */
+                trace_xfs_bmap_pre_update(ip, *idx, state, _THIS_IP_);
+                got->br_blockcount = del->br_startoff - got->br_startoff;
+                xfs_bmbt_set_all(xfs_iext_get_ext(ifp, *idx), got);
+                trace_xfs_bmap_post_update(ip, *idx, state, _THIS_IP_);
+                new.br_startoff = del_endoff;
+                new.br_blockcount = got_endoff - del_endoff;
+                new.br_state = got->br_state;
+                new.br_startblock = del->br_startblock + del->br_blockcount;
+                ++*idx;
+                xfs_iext_insert(ip, *idx, 1, &new, state);
+                break;
+        }
+}
 /*
 * Called by xfs_bmapi to update file extent records and the btree
 * after removing space (or undoing a delayed allocation).
@@ -5171,175 +5414,6 @@ done:
        return error;
 }
-/* Remove an extent from the CoW fork.  Similar to xfs_bmap_del_extent. */
-int
-xfs_bunmapi_cow(
-        struct xfs_inode                *ip,
-        struct xfs_bmbt_irec            *del)
-{
-        xfs_filblks_t                   da_new;
-        xfs_filblks_t                   da_old;
-        xfs_fsblock_t                   del_endblock = 0;
-        xfs_fileoff_t                   del_endoff;
-        int                             delay;
-        struct xfs_bmbt_rec_host        *ep;
-        int                             error;
-        struct xfs_bmbt_irec            got;
-        xfs_fileoff_t                   got_endoff;
-        struct xfs_ifork                *ifp;
-        struct xfs_mount                *mp;
-        xfs_filblks_t                   nblks;
-        struct xfs_bmbt_irec            new;
-        /* REFERENCED */
-        uint                            qfield;
-        xfs_filblks_t                   temp;
-        xfs_filblks_t                   temp2;
-        int                             state = BMAP_COWFORK;
-        int                             eof;
-        xfs_extnum_t                    eidx;
-        mp = ip->i_mount;
-        XFS_STATS_INC(mp, xs_del_exlist);
-        ep = xfs_bmap_search_extents(ip, del->br_startoff, XFS_COW_FORK, &eof,
-                        &eidx, &got, &new);
-        ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK); ifp = ifp;
-        ASSERT((eidx >= 0) && (eidx < ifp->if_bytes /
-                (uint)sizeof(xfs_bmbt_rec_t)));
-        ASSERT(del->br_blockcount > 0);
-        ASSERT(got.br_startoff <= del->br_startoff);
-        del_endoff = del->br_startoff + del->br_blockcount;
-        got_endoff = got.br_startoff + got.br_blockcount;
-        ASSERT(got_endoff >= del_endoff);
-        delay = isnullstartblock(got.br_startblock);
-        ASSERT(isnullstartblock(del->br_startblock) == delay);
-        qfield = 0;
-        error = 0;
-        /*
-         * If deleting a real allocation, must free up the disk space.
-         */
-        if (!delay) {
-                nblks = del->br_blockcount;
-                qfield = XFS_TRANS_DQ_BCOUNT;
-                /*
-                 * Set up del_endblock and cur for later.
-                 */
-                del_endblock = del->br_startblock + del->br_blockcount;
-                da_old = da_new = 0;
-        } else {
-                da_old = startblockval(got.br_startblock);
-                da_new = 0;
-                nblks = 0;
-        }
-        qfield = qfield;
-        nblks = nblks;
-        /*
-         * Set flag value to use in switch statement.
-         * Left-contig is 2, right-contig is 1.
-         */
-        switch (((got.br_startoff == del->br_startoff) << 1) |
-                (got_endoff == del_endoff)) {
-        case 3:
-                /*
-                 * Matches the whole extent.  Delete the entry.
-                 */
-                xfs_iext_remove(ip, eidx, 1, BMAP_COWFORK);
-                --eidx;
-                break;
-        case 2:
-                /*
-                 * Deleting the first part of the extent.
-                 */
-                trace_xfs_bmap_pre_update(ip, eidx, state, _THIS_IP_);
-                xfs_bmbt_set_startoff(ep, del_endoff);
-                temp = got.br_blockcount - del->br_blockcount;
-                xfs_bmbt_set_blockcount(ep, temp);
-                if (delay) {
-                        temp = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip, temp),
-                                da_old);
-                        xfs_bmbt_set_startblock(ep, nullstartblock((int)temp));
-                        trace_xfs_bmap_post_update(ip, eidx, state, _THIS_IP_);
-                        da_new = temp;
-                        break;
-                }
-                xfs_bmbt_set_startblock(ep, del_endblock);
-                trace_xfs_bmap_post_update(ip, eidx, state, _THIS_IP_);
-                break;
-        case 1:
-                /*
-                 * Deleting the last part of the extent.
-                 */
-                temp = got.br_blockcount - del->br_blockcount;
-                trace_xfs_bmap_pre_update(ip, eidx, state, _THIS_IP_);
-                xfs_bmbt_set_blockcount(ep, temp);
-                if (delay) {
-                        temp = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(ip, temp),
-                                da_old);
-                        xfs_bmbt_set_startblock(ep, nullstartblock((int)temp));
-                        trace_xfs_bmap_post_update(ip, eidx, state, _THIS_IP_);
-                        da_new = temp;
-                        break;
-                }
-                trace_xfs_bmap_post_update(ip, eidx, state, _THIS_IP_);
-                break;
-        case 0:
-                /*
-                 * Deleting the middle of the extent.
-                 */
-                temp = del->br_startoff - got.br_startoff;
-                trace_xfs_bmap_pre_update(ip, eidx, state, _THIS_IP_);
-                xfs_bmbt_set_blockcount(ep, temp);
-                new.br_startoff = del_endoff;
-                temp2 = got_endoff - del_endoff;
-                new.br_blockcount = temp2;
-                new.br_state = got.br_state;
-                if (!delay) {
-                        new.br_startblock = del_endblock;
-                } else {
-                        temp = xfs_bmap_worst_indlen(ip, temp);
-                        xfs_bmbt_set_startblock(ep, nullstartblock((int)temp));
-                        temp2 = xfs_bmap_worst_indlen(ip, temp2);
-                        new.br_startblock = nullstartblock((int)temp2);
-                        da_new = temp + temp2;
-                        while (da_new > da_old) {
-                                if (temp) {
-                                        temp--;
-                                        da_new--;
-                                        xfs_bmbt_set_startblock(ep,
-                                                nullstartblock((int)temp));
-                                }
-                                if (da_new == da_old)
-                                        break;
-                                if (temp2) {
-                                        temp2--;
-                                        da_new--;
-                                        new.br_startblock =
-                                                nullstartblock((int)temp2);
-                                }
-                        }
-                }
-                trace_xfs_bmap_post_update(ip, eidx, state, _THIS_IP_);
-                xfs_iext_insert(ip, eidx + 1, 1, &new, state);
-                ++eidx;
-                break;
-        }
-        /*
-         * Account for change in delayed indirect blocks.
-         * Nothing to do for disk quota accounting here.
-         */
-        ASSERT(da_old >= da_new);
-        if (da_old > da_new)
-                xfs_mod_fdblocks(mp, (int64_t)(da_old - da_new), false);
-        return error;
-}
 /*
 * Unmap (remove) blocks from a file.
 * If nexts is nonzero then the number of extents to remove is limited to
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index f97db7132564..7cae6ec27fa6 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -190,6 +190,8 @@ void	xfs_bmap_trace_exlist(struct xfs_inode *ip, xfs_extnum_t cnt,
 #define XFS_BMAP_TRACE_EXLIST(ip,c,w)
 #endif
+void    xfs_trim_extent(struct xfs_bmbt_irec *irec, xfs_fileoff_t bno,
+                xfs_filblks_t len);
 int     xfs_bmap_add_attrfork(struct xfs_inode *ip, int size, int rsvd);
 void    xfs_bmap_local_to_extents_empty(struct xfs_inode *ip, int whichfork);
 void    xfs_bmap_add_free(struct xfs_mount *mp, struct xfs_defer_ops *dfops,
@@ -221,7 +223,11 @@ int	xfs_bunmapi(struct xfs_trans *tp, struct xfs_inode *ip,
                xfs_fileoff_t bno, xfs_filblks_t len, int flags,
                xfs_extnum_t nexts, xfs_fsblock_t *firstblock,
                struct xfs_defer_ops *dfops, int *done);
-int     xfs_bunmapi_cow(struct xfs_inode *ip, struct xfs_bmbt_irec *del);
+int     xfs_bmap_del_extent_delay(struct xfs_inode *ip, int whichfork,
+                xfs_extnum_t *idx, struct xfs_bmbt_irec *got,
+                struct xfs_bmbt_irec *del);
+void    xfs_bmap_del_extent_cow(struct xfs_inode *ip, xfs_extnum_t *idx,
+                struct xfs_bmbt_irec *got, struct xfs_bmbt_irec *del);
 int     xfs_check_nostate_extents(struct xfs_ifork *ifp, xfs_extnum_t idx,
                xfs_extnum_t num);
 uint    xfs_default_attroffset(struct xfs_inode *ip);
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 5c8e6f2ce44f..0e80993c8a59 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -4826,7 +4826,7 @@ xfs_btree_calc_size(
        return rval;
 }
-int
+static int
 xfs_btree_count_blocks_helper(
        struct xfs_btree_cur    *cur,
        int                     level,
diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
index 3cc3cf767474..ac9a003dd29a 100644
--- a/fs/xfs/libxfs/xfs_dquot_buf.c
+++ b/fs/xfs/libxfs/xfs_dquot_buf.c
@@ -191,8 +191,7 @@ xfs_dquot_buf_verify_crc(
        if (mp->m_quotainfo)
                ndquots = mp->m_quotainfo->qi_dqperchunk;
        else
-                ndquots = xfs_calc_dquots_per_chunk(
+                ndquots = xfs_calc_dquots_per_chunk(bp->b_length);
-                                        XFS_BB_TO_FSB(mp, bp->b_length));
        for (i = 0; i < ndquots; i++, d++) {
                if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk),
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index f6547fc5e016..6b7579e7b60a 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -865,7 +865,6 @@ typedef struct xfs_timestamp {
 * padding field for v3 inodes.
 */
 #define XFS_DINODE_MAGIC                0x494e  /* 'IN' */
-#define XFS_DINODE_GOOD_VERSION(v)      ((v) >= 1 && (v) <= 3)
 typedef struct xfs_dinode {
        __be16          di_magic;       /* inode magic # = XFS_DINODE_MAGIC */
        __be16          di_mode;        /* mode and type of file */
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index 8de9a3a29589..134424fac434 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -57,6 +57,17 @@ xfs_inobp_check(
 }
 #endif
+bool
+xfs_dinode_good_version(
+        struct xfs_mount *mp,
+        __u8            version)
+{
+        if (xfs_sb_version_hascrc(&mp->m_sb))
+                return version == 3;
+        return version == 1 || version == 2;
+}
 /*
 * If we are doing readahead on an inode buffer, we might be in log recovery
 * reading an inode allocation buffer that hasn't yet been replayed, and hence
@@ -91,7 +102,7 @@ xfs_inode_buf_verify(
                dip = xfs_buf_offset(bp, (i << mp->m_sb.sb_inodelog));
                di_ok = dip->di_magic == cpu_to_be16(XFS_DINODE_MAGIC) &&
-                            XFS_DINODE_GOOD_VERSION(dip->di_version);
+                        xfs_dinode_good_version(mp, dip->di_version);
                if (unlikely(XFS_TEST_ERROR(!di_ok, mp,
                                                XFS_ERRTAG_ITOBP_INOTOBP,
                                                XFS_RANDOM_ITOBP_INOTOBP))) {
diff --git a/fs/xfs/libxfs/xfs_inode_buf.h b/fs/xfs/libxfs/xfs_inode_buf.h
index 62d9d4681c8c..3cfe12a4f58a 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.h
+++ b/fs/xfs/libxfs/xfs_inode_buf.h
@@ -74,6 +74,8 @@ void	xfs_inode_from_disk(struct xfs_inode *ip, struct xfs_dinode *from);
 void    xfs_log_dinode_to_disk(struct xfs_log_dinode *from,
                               struct xfs_dinode *to);
+bool    xfs_dinode_good_version(struct xfs_mount *mp, __u8 version);
 #if defined(DEBUG)
 void    xfs_inobp_check(struct xfs_mount *, struct xfs_buf *);
 #else
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index a314fc7b56fa..6e4f7f900fea 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -249,6 +249,7 @@ xfs_file_dio_aio_read(
        struct xfs_inode        *ip = XFS_I(inode);
        loff_t                  isize = i_size_read(inode);
        size_t                  count = iov_iter_count(to);
+        loff_t                  end = iocb->ki_pos + count - 1;
        struct iov_iter         data;
        struct xfs_buftarg      *target;
        ssize_t                 ret = 0;
@@ -272,49 +273,21 @@ xfs_file_dio_aio_read(
        file_accessed(iocb->ki_filp);
-        /*
-         * Locking is a bit tricky here. If we take an exclusive lock for direct
-         * IO, we effectively serialise all new concurrent read IO to this file
-         * and block it behind IO that is currently in progress because IO in
-         * progress holds the IO lock shared. We only need to hold the lock
-         * exclusive to blow away the page cache, so only take lock exclusively
-         * if the page cache needs invalidation. This allows the normal direct
-         * IO case of no page cache pages to proceeed concurrently without
-         * serialisation.
-         */
        xfs_rw_ilock(ip, XFS_IOLOCK_SHARED);
        if (mapping->nrpages) {
-                xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED);
+                ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, end);
-                xfs_rw_ilock(ip, XFS_IOLOCK_EXCL);
+                if (ret)
+                        goto out_unlock;
                /*
-                 * The generic dio code only flushes the range of the particular
+                 * Invalidate whole pages. This can return an error if we fail
-                 * I/O. Because we take an exclusive lock here, this whole
+                 * to invalidate a page, but this should never happen on XFS.
-                 * sequence is considerably more expensive for us. This has a
+                 * Warn if it does fail.
-                 * noticeable performance impact for any file with cached pages,
-                 * even when outside of the range of the particular I/O.
-                 *
-                 * Hence, amortize the cost of the lock against a full file
-                 * flush and reduce the chances of repeated iolock cycles going
-                 * forward.
                 */
-                if (mapping->nrpages) {
+                ret = invalidate_inode_pages2_range(mapping,
-                        ret = filemap_write_and_wait(mapping);
+                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
-                        if (ret) {
+                WARN_ON_ONCE(ret);
-                                xfs_rw_iunlock(ip, XFS_IOLOCK_EXCL);
+                ret = 0;
-                                return ret;
-                        }
-                        /*
-                         * Invalidate whole pages. This can return an error if
-                         * we fail to invalidate a page, but this should never
-                         * happen on XFS. Warn if it does fail.
-                         */
-                        ret = invalidate_inode_pages2(mapping);
-                        WARN_ON_ONCE(ret);
-                        ret = 0;
-                }
-                xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
        }
        data = *to;
@@ -324,8 +297,9 @@ xfs_file_dio_aio_read(
                iocb->ki_pos += ret;
                iov_iter_advance(to, ret);
        }
-        xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED);
+out_unlock:
+        xfs_rw_iunlock(ip, XFS_IOLOCK_SHARED);
        return ret;
 }
@@ -570,61 +544,49 @@ xfs_file_dio_aio_write(
        if ((iocb->ki_pos | count) & target->bt_logical_sectormask)
                return -EINVAL;
-        /* "unaligned" here means not aligned to a filesystem block */
-        if ((iocb->ki_pos & mp->m_blockmask) ||
-            ((iocb->ki_pos + count) & mp->m_blockmask))
-                unaligned_io = 1;
        /*
-         * We don't need to take an exclusive lock unless there page cache needs
+         * Don't take the exclusive iolock here unless the I/O is unaligned to
-         * to be invalidated or unaligned IO is being executed. We don't need to
+         * the file system block size.  We don't need to consider the EOF
-         * consider the EOF extension case here because
+         * extension case here because xfs_file_aio_write_checks() will relock
-         * xfs_file_aio_write_checks() will relock the inode as necessary for
+         * the inode as necessary for EOF zeroing cases and fill out the new
-         * EOF zeroing cases and fill out the new inode size as appropriate.
+         * inode size as appropriate.
         */
-        if (unaligned_io || mapping->nrpages)
+        if ((iocb->ki_pos & mp->m_blockmask) ||
+            ((iocb->ki_pos + count) & mp->m_blockmask)) {
+                unaligned_io = 1;
                iolock = XFS_IOLOCK_EXCL;
-        else
+        } else {
                iolock = XFS_IOLOCK_SHARED;
-        xfs_rw_ilock(ip, iolock);
-        /*
-         * Recheck if there are cached pages that need invalidate after we got
-         * the iolock to protect against other threads adding new pages while
-         * we were waiting for the iolock.
-         */
-        if (mapping->nrpages && iolock == XFS_IOLOCK_SHARED) {
-                xfs_rw_iunlock(ip, iolock);
-                iolock = XFS_IOLOCK_EXCL;
-                xfs_rw_ilock(ip, iolock);
        }
+        xfs_rw_ilock(ip, iolock);
        ret = xfs_file_aio_write_checks(iocb, from, &iolock);
        if (ret)
                goto out;
        count = iov_iter_count(from);
        end = iocb->ki_pos + count - 1;
-        /*
-         * See xfs_file_dio_aio_read() for why we do a full-file flush here.
-         */
        if (mapping->nrpages) {
-                ret = filemap_write_and_wait(VFS_I(ip)->i_mapping);
+                ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, end);
                if (ret)
                        goto out;
                /*
                 * Invalidate whole pages. This can return an error if we fail
                 * to invalidate a page, but this should never happen on XFS.
                 * Warn if it does fail.
                 */
-                ret = invalidate_inode_pages2(VFS_I(ip)->i_mapping);
+                ret = invalidate_inode_pages2_range(mapping,
+                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
                WARN_ON_ONCE(ret);
                ret = 0;
        }
        /*
         * If we are doing unaligned IO, wait for all other IO to drain,
-         * otherwise demote the lock if we had to flush cached pages
+         * otherwise demote the lock if we had to take the exclusive lock
+         * for other reasons in xfs_file_aio_write_checks.
         */
        if (unaligned_io)
                inode_dio_wait(inode);
@@ -947,134 +909,6 @@ out_unlock:
        return error;
 }
-/*
- * Flush all file writes out to disk.
- */
-static int
-xfs_file_wait_for_io(
-        struct inode    *inode,
-        loff_t          offset,
-        size_t          len)
-{
-        loff_t          rounding;
-        loff_t          ioffset;
-        loff_t          iendoffset;
-        loff_t          bs;
-        int             ret;
-        bs = inode->i_sb->s_blocksize;
-        inode_dio_wait(inode);
-        rounding = max_t(xfs_off_t, bs, PAGE_SIZE);
-        ioffset = round_down(offset, rounding);
-        iendoffset = round_up(offset + len, rounding) - 1;
-        ret = filemap_write_and_wait_range(inode->i_mapping, ioffset,
-                                           iendoffset);
-        return ret;
-}
-/* Hook up to the VFS reflink function */
-STATIC int
-xfs_file_share_range(
-        struct file     *file_in,
-        loff_t          pos_in,
-        struct file     *file_out,
-        loff_t          pos_out,
-        u64             len,
-        bool            is_dedupe)
-{
-        struct inode    *inode_in;
-        struct inode    *inode_out;
-        ssize_t         ret;
-        loff_t          bs;
-        loff_t          isize;
-        int             same_inode;
-        loff_t          blen;
-        unsigned int    flags = 0;
-        inode_in = file_inode(file_in);
-        inode_out = file_inode(file_out);
-        bs = inode_out->i_sb->s_blocksize;
-        /* Don't touch certain kinds of inodes */
-        if (IS_IMMUTABLE(inode_out))
-                return -EPERM;
-        if (IS_SWAPFILE(inode_in) ||
-            IS_SWAPFILE(inode_out))
-                return -ETXTBSY;
-        /* Reflink only works within this filesystem. */
-        if (inode_in->i_sb != inode_out->i_sb)
-                return -EXDEV;
-        same_inode = (inode_in->i_ino == inode_out->i_ino);
-        /* Don't reflink dirs, pipes, sockets... */
-        if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
-                return -EISDIR;
-        if (S_ISFIFO(inode_in->i_mode) || S_ISFIFO(inode_out->i_mode))
-                return -EINVAL;
-        if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode))
-                return -EINVAL;
-        /* Don't share DAX file data for now. */
-        if (IS_DAX(inode_in) || IS_DAX(inode_out))
-                return -EINVAL;
-        /* Are we going all the way to the end? */
-        isize = i_size_read(inode_in);
-        if (isize == 0)
-                return 0;
-        if (len == 0)
-                len = isize - pos_in;
-        /* Ensure offsets don't wrap and the input is inside i_size */
-        if (pos_in + len < pos_in || pos_out + len < pos_out ||
-            pos_in + len > isize)
-                return -EINVAL;
-        /* Don't allow dedupe past EOF in the dest file */
-        if (is_dedupe) {
-                loff_t  disize;
-                disize = i_size_read(inode_out);
-                if (pos_out >= disize || pos_out + len > disize)
-                        return -EINVAL;
-        }
-        /* If we're linking to EOF, continue to the block boundary. */
-        if (pos_in + len == isize)
-                blen = ALIGN(isize, bs) - pos_in;
-        else
-                blen = len;
-        /* Only reflink if we're aligned to block boundaries */
-        if (!IS_ALIGNED(pos_in, bs) || !IS_ALIGNED(pos_in + blen, bs) ||
-            !IS_ALIGNED(pos_out, bs) || !IS_ALIGNED(pos_out + blen, bs))
-                return -EINVAL;
-        /* Don't allow overlapped reflink within the same file */
-        if (same_inode && pos_out + blen > pos_in && pos_out < pos_in + blen)
-                return -EINVAL;
-        /* Wait for the completion of any pending IOs on srcfile */
-        ret = xfs_file_wait_for_io(inode_in, pos_in, len);
-        if (ret)
-                goto out;
-        ret = xfs_file_wait_for_io(inode_out, pos_out, len);
-        if (ret)
-                goto out;
-        if (is_dedupe)
-                flags |= XFS_REFLINK_DEDUPE;
-        ret = xfs_reflink_remap_range(XFS_I(inode_in), pos_in, XFS_I(inode_out),
-                        pos_out, len, flags);
-        if (ret < 0)
-                goto out;
-out:
-        return ret;
-}
 STATIC ssize_t
 xfs_file_copy_range(
        struct file     *file_in,
@@ -1086,7 +920,7 @@ xfs_file_copy_range(
 {
        int             error;
-        error = xfs_file_share_range(file_in, pos_in, file_out, pos_out,
+        error = xfs_reflink_remap_range(file_in, pos_in, file_out, pos_out,
                                     len, false);
        if (error)
                return error;
@@ -1101,7 +935,7 @@ xfs_file_clone_range(
        loff_t          pos_out,
        u64             len)
 {
-        return xfs_file_share_range(file_in, pos_in, file_out, pos_out,
+        return xfs_reflink_remap_range(file_in, pos_in, file_out, pos_out,
                                     len, false);
 }
@@ -1124,7 +958,7 @@ xfs_file_dedupe_range(
        if (len > XFS_MAX_DEDUPE_LEN)
                len = XFS_MAX_DEDUPE_LEN;
-        error = xfs_file_share_range(src_file, loff, dst_file, dst_loff,
+        error = xfs_reflink_remap_range(src_file, loff, dst_file, dst_loff,
                                     len, true);
        if (error)
                return error;
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 14796b744e0a..f295049db681 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1656,9 +1656,9 @@ void
 xfs_inode_set_cowblocks_tag(
        xfs_inode_t     *ip)
 {
-        trace_xfs_inode_set_eofblocks_tag(ip);
+        trace_xfs_inode_set_cowblocks_tag(ip);
        return __xfs_inode_set_eofblocks_tag(ip, xfs_queue_cowblocks,
-                        trace_xfs_perag_set_eofblocks,
+                        trace_xfs_perag_set_cowblocks,
                        XFS_ICI_COWBLOCKS_TAG);
 }
@@ -1666,7 +1666,7 @@ void
 xfs_inode_clear_cowblocks_tag(
        xfs_inode_t     *ip)
 {
-        trace_xfs_inode_clear_eofblocks_tag(ip);
+        trace_xfs_inode_clear_cowblocks_tag(ip);
        return __xfs_inode_clear_eofblocks_tag(ip,
-                        trace_xfs_perag_clear_eofblocks, XFS_ICI_COWBLOCKS_TAG);
+                        trace_xfs_perag_clear_cowblocks, XFS_ICI_COWBLOCKS_TAG);
 }
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index d907eb9f8ef3..436e109bb01e 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -566,6 +566,17 @@ xfs_file_iomap_begin_delay(
        xfs_bmap_search_extents(ip, offset_fsb, XFS_DATA_FORK, &eof, &idx,
                        &got, &prev);
        if (!eof && got.br_startoff <= offset_fsb) {
+                if (xfs_is_reflink_inode(ip)) {
+                        bool            shared;
+                        end_fsb = min(XFS_B_TO_FSB(mp, offset + count),
+                                        maxbytes_fsb);
+                        xfs_trim_extent(&got, offset_fsb, end_fsb - offset_fsb);
+                        error = xfs_reflink_reserve_cow(ip, &got, &shared);
+                        if (error)
+                                goto out_unlock;
+                }
                trace_xfs_iomap_found(ip, offset, count, 0, &got);
                goto done;
        }
@@ -961,19 +972,13 @@ xfs_file_iomap_begin(
        struct xfs_mount        *mp = ip->i_mount;
        struct xfs_bmbt_irec    imap;
        xfs_fileoff_t           offset_fsb, end_fsb;
-        bool                    shared, trimmed;
        int                     nimaps = 1, error = 0;
+        bool                    shared = false, trimmed = false;
        unsigned                lockmode;
        if (XFS_FORCED_SHUTDOWN(mp))
                return -EIO;
-        if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
-                error = xfs_reflink_reserve_cow_range(ip, offset, length);
-                if (error < 0)
-                        return error;
-        }
        if ((flags & IOMAP_WRITE) && !IS_DAX(inode) &&
                   !xfs_get_extsz_hint(ip)) {
                /* Reserve delalloc blocks for regular writeback. */
@@ -981,7 +986,16 @@ xfs_file_iomap_begin(
                                iomap);
        }
-        lockmode = xfs_ilock_data_map_shared(ip);
+        /*
+         * COW writes will allocate delalloc space, so we need to make sure
+         * to take the lock exclusively here.
+         */
+        if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
+                lockmode = XFS_ILOCK_EXCL;
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+        } else {
+                lockmode = xfs_ilock_data_map_shared(ip);
+        }
        ASSERT(offset <= mp->m_super->s_maxbytes);
        if ((xfs_fsize_t)offset + length > mp->m_super->s_maxbytes)
@@ -991,16 +1005,24 @@ xfs_file_iomap_begin(
        error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap,
                               &nimaps, 0);
-        if (error) {
+        if (error)
-                xfs_iunlock(ip, lockmode);
+                goto out_unlock;
-                return error;
+        if (flags & IOMAP_REPORT) {
+                /* Trim the mapping to the nearest shared extent boundary. */
+                error = xfs_reflink_trim_around_shared(ip, &imap, &shared,
+                                &trimmed);
+                if (error)
+                        goto out_unlock;
        }
-        /* Trim the mapping to the nearest shared extent boundary. */
+        if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
-        error = xfs_reflink_trim_around_shared(ip, &imap, &shared, &trimmed);
+                error = xfs_reflink_reserve_cow(ip, &imap, &shared);
-        if (error) {
+                if (error)
-                xfs_iunlock(ip, lockmode);
+                        goto out_unlock;
-                return error;
+                end_fsb = imap.br_startoff + imap.br_blockcount;
+                length = XFS_FSB_TO_B(mp, end_fsb) - offset;
        }
        if ((flags & IOMAP_WRITE) && imap_needs_alloc(inode, &imap, nimaps)) {
@@ -1039,6 +1061,9 @@ xfs_file_iomap_begin(
        if (shared)
                iomap->flags |= IOMAP_F_SHARED;
        return 0;
+out_unlock:
+        xfs_iunlock(ip, lockmode);
+        return error;
 }
 static int
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index fc7873942bea..b341f10cf481 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1009,6 +1009,7 @@ xfs_mountfs(
 out_quota:
        xfs_qm_unmount_quotas(mp);
 out_rtunmount:
+        mp->m_super->s_flags &= ~MS_ACTIVE;
        xfs_rtunmount_inodes(mp);
 out_rele_rip:
        IRELE(rip);
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 5965e9455d91..a279b4e7f5fe 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -182,7 +182,8 @@ xfs_reflink_trim_around_shared(
        if (!xfs_is_reflink_inode(ip) ||
            ISUNWRITTEN(irec) ||
            irec->br_startblock == HOLESTARTBLOCK ||
-            irec->br_startblock == DELAYSTARTBLOCK) {
+            irec->br_startblock == DELAYSTARTBLOCK ||
+            isnullstartblock(irec->br_startblock)) {
                *shared = false;
                return 0;
        }
@@ -227,50 +228,54 @@ xfs_reflink_trim_around_shared(
        }
 }
-/* Create a CoW reservation for a range of blocks within a file. */
+/*
-static int
+ * Trim the passed in imap to the next shared/unshared extent boundary, and
-__xfs_reflink_reserve_cow(
+ * if imap->br_startoff points to a shared extent reserve space for it in the
+ * COW fork.  In this case *shared is set to true, else to false.
+ *
+ * Note that imap will always contain the block numbers for the existing blocks
+ * in the data fork, as the upper layers need them for read-modify-write
+ * operations.
+ */
+int
+xfs_reflink_reserve_cow(
        struct xfs_inode        *ip,
-        xfs_fileoff_t           *offset_fsb,
+        struct xfs_bmbt_irec    *imap,
-        xfs_fileoff_t           end_fsb,
+        bool                    *shared)
-        bool                    *skipped)
 {
-        struct xfs_bmbt_irec    got, prev, imap;
+        struct xfs_bmbt_irec    got, prev;
-        xfs_fileoff_t           orig_end_fsb;
+        xfs_fileoff_t           end_fsb, orig_end_fsb;
-        int                     nimaps, eof = 0, error = 0;
+        int                     eof = 0, error = 0;
-        bool                    shared = false, trimmed = false;
+        bool                    trimmed;
        xfs_extnum_t            idx;
        xfs_extlen_t            align;
-        /* Already reserved?  Skip the refcount btree access. */
+        /*
-        xfs_bmap_search_extents(ip, *offset_fsb, XFS_COW_FORK, &eof, &idx,
+         * Search the COW fork extent list first.  This serves two purposes:
+         * first this implement the speculative preallocation using cowextisze,
+         * so that we also unshared block adjacent to shared blocks instead
+         * of just the shared blocks themselves.  Second the lookup in the
+         * extent list is generally faster than going out to the shared extent
+         * tree.
+         */
+        xfs_bmap_search_extents(ip, imap->br_startoff, XFS_COW_FORK, &eof, &idx,
                        &got, &prev);
-        if (!eof && got.br_startoff <= *offset_fsb) {
+        if (!eof && got.br_startoff <= imap->br_startoff) {
-                end_fsb = orig_end_fsb = got.br_startoff + got.br_blockcount;
+                trace_xfs_reflink_cow_found(ip, imap);
-                trace_xfs_reflink_cow_found(ip, &got);
+                xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
-                goto done;
-        }
-        /* Read extent from the source file. */
+                *shared = true;
-        nimaps = 1;
+                return 0;
-        error = xfs_bmapi_read(ip, *offset_fsb, end_fsb - *offset_fsb,
+        }
-                        &imap, &nimaps, 0);
-        if (error)
-                goto out_unlock;
-        ASSERT(nimaps == 1);
        /* Trim the mapping to the nearest shared extent boundary. */
-        error = xfs_reflink_trim_around_shared(ip, &imap, &shared, &trimmed);
+        error = xfs_reflink_trim_around_shared(ip, imap, shared, &trimmed);
        if (error)
-                goto out_unlock;
+                return error;
-        end_fsb = orig_end_fsb = imap.br_startoff + imap.br_blockcount;
        /* Not shared?  Just report the (potentially capped) extent. */
-        if (!shared) {
+        if (!*shared)
-                *skipped = true;
+                return 0;
-                goto done;
-        }
        /*
         * Fork all the shared blocks from our write offset until the end of
@@ -278,72 +283,38 @@ __xfs_reflink_reserve_cow(
         */
        error = xfs_qm_dqattach_locked(ip, 0);
        if (error)
-                goto out_unlock;
+                return error;
+        end_fsb = orig_end_fsb = imap->br_startoff + imap->br_blockcount;
        align = xfs_eof_alignment(ip, xfs_get_cowextsz_hint(ip));
        if (align)
                end_fsb = roundup_64(end_fsb, align);
 retry:
-        error = xfs_bmapi_reserve_delalloc(ip, XFS_COW_FORK, *offset_fsb,
+        error = xfs_bmapi_reserve_delalloc(ip, XFS_COW_FORK, imap->br_startoff,
-                        end_fsb - *offset_fsb, &got,
+                        end_fsb - imap->br_startoff, &got, &prev, &idx, eof);
-                        &prev, &idx, eof);
        switch (error) {
        case 0:
                break;
        case -ENOSPC:
        case -EDQUOT:
                /* retry without any preallocation */
-                trace_xfs_reflink_cow_enospc(ip, &imap);
+                trace_xfs_reflink_cow_enospc(ip, imap);
                if (end_fsb != orig_end_fsb) {
                        end_fsb = orig_end_fsb;
                        goto retry;
                }
                /*FALLTHRU*/
        default:
-                goto out_unlock;
+                return error;
        }
        if (end_fsb != orig_end_fsb)
                xfs_inode_set_cowblocks_tag(ip);
        trace_xfs_reflink_cow_alloc(ip, &got);
-done:
+        return 0;
-        *offset_fsb = end_fsb;
-out_unlock:
-        return error;
-}
-/* Create a CoW reservation for part of a file. */
-int
-xfs_reflink_reserve_cow_range(
-        struct xfs_inode        *ip,
-        xfs_off_t               offset,
-        xfs_off_t               count)
-{
-        struct xfs_mount        *mp = ip->i_mount;
-        xfs_fileoff_t           offset_fsb, end_fsb;
-        bool                    skipped = false;
-        int                     error;
-        trace_xfs_reflink_reserve_cow_range(ip, offset, count);
-        offset_fsb = XFS_B_TO_FSBT(mp, offset);
-        end_fsb = XFS_B_TO_FSB(mp, offset + count);
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        while (offset_fsb < end_fsb) {
-                error = __xfs_reflink_reserve_cow(ip, &offset_fsb, end_fsb,
-                                &skipped);
-                if (error) {
-                        trace_xfs_reflink_reserve_cow_range_error(ip, error,
-                                _RET_IP_);
-                        break;
-                }
-        }
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        return error;
 }
 /* Allocate all CoW reservations covering a range of blocks in a file. */
@@ -358,9 +329,8 @@ __xfs_reflink_allocate_cow(
        struct xfs_defer_ops    dfops;
        struct xfs_trans        *tp;
        xfs_fsblock_t           first_block;
-        xfs_fileoff_t           next_fsb;
        int                     nimaps = 1, error;
-        bool                    skipped = false;
+        bool                    shared;
        xfs_defer_init(&dfops, &first_block);
@@ -371,33 +341,38 @@ __xfs_reflink_allocate_cow(
        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        next_fsb = *offset_fsb;
+        /* Read extent from the source file. */
-        error = __xfs_reflink_reserve_cow(ip, &next_fsb, end_fsb, &skipped);
+        nimaps = 1;
+        error = xfs_bmapi_read(ip, *offset_fsb, end_fsb - *offset_fsb,
+                        &imap, &nimaps, 0);
+        if (error)
+                goto out_unlock;
+        ASSERT(nimaps == 1);
+        error = xfs_reflink_reserve_cow(ip, &imap, &shared);
        if (error)
                goto out_trans_cancel;
-        if (skipped) {
+        if (!shared) {
-                *offset_fsb = next_fsb;
+                *offset_fsb = imap.br_startoff + imap.br_blockcount;
                goto out_trans_cancel;
        }
        xfs_trans_ijoin(tp, ip, 0);
-        error = xfs_bmapi_write(tp, ip, *offset_fsb, next_fsb - *offset_fsb,
+        error = xfs_bmapi_write(tp, ip, imap.br_startoff, imap.br_blockcount,
                        XFS_BMAPI_COWFORK, &first_block,
                        XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK),
                        &imap, &nimaps, &dfops);
        if (error)
                goto out_trans_cancel;
-        /* We might not have been able to map the whole delalloc extent */
-        *offset_fsb = min(*offset_fsb + imap.br_blockcount, next_fsb);
        error = xfs_defer_finish(&tp, &dfops, NULL);
        if (error)
                goto out_trans_cancel;
        error = xfs_trans_commit(tp);
+        *offset_fsb = imap.br_startoff + imap.br_blockcount;
 out_unlock:
        xfs_iunlock(ip, XFS_ILOCK_EXCL);
        return error;
@@ -536,58 +511,49 @@ xfs_reflink_cancel_cow_blocks(
        xfs_fileoff_t                   offset_fsb,
        xfs_fileoff_t                   end_fsb)
 {
-        struct xfs_bmbt_irec            irec;
+        struct xfs_ifork                *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
-        xfs_filblks_t                   count_fsb;
+        struct xfs_bmbt_irec            got, prev, del;
+        xfs_extnum_t                    idx;
        xfs_fsblock_t                   firstfsb;
        struct xfs_defer_ops            dfops;
-        int                             error = 0;
+        int                             error = 0, eof = 0;
-        int                             nimaps;
        if (!xfs_is_reflink_inode(ip))
                return 0;
-        /* Go find the old extent in the CoW fork. */
+        xfs_bmap_search_extents(ip, offset_fsb, XFS_COW_FORK, &eof, &idx,
-        while (offset_fsb < end_fsb) {
+                        &got, &prev);
-                nimaps = 1;
+        if (eof)
-                count_fsb = (xfs_filblks_t)(end_fsb - offset_fsb);
+                return 0;
-                error = xfs_bmapi_read(ip, offset_fsb, count_fsb, &irec,
-                                &nimaps, XFS_BMAPI_COWFORK);
-                if (error)
-                        break;
-                ASSERT(nimaps == 1);
-                trace_xfs_reflink_cancel_cow(ip, &irec);
-                if (irec.br_startblock == DELAYSTARTBLOCK) {
+        while (got.br_startoff < end_fsb) {
-                        /* Free a delayed allocation. */
+                del = got;
-                        xfs_mod_fdblocks(ip->i_mount, irec.br_blockcount,
+                xfs_trim_extent(&del, offset_fsb, end_fsb - offset_fsb);
-                                        false);
+                trace_xfs_reflink_cancel_cow(ip, &del);
-                        ip->i_delayed_blks -= irec.br_blockcount;
-                        /* Remove the mapping from the CoW fork. */
+                if (isnullstartblock(del.br_startblock)) {
-                        error = xfs_bunmapi_cow(ip, &irec);
+                        error = xfs_bmap_del_extent_delay(ip, XFS_COW_FORK,
+                                        &idx, &got, &del);
                        if (error)
                                break;
-                } else if (irec.br_startblock == HOLESTARTBLOCK) {
-                        /* empty */
                } else {
                        xfs_trans_ijoin(*tpp, ip, 0);
                        xfs_defer_init(&dfops, &firstfsb);
                        /* Free the CoW orphan record. */
                        error = xfs_refcount_free_cow_extent(ip->i_mount,
-                                        &dfops, irec.br_startblock,
+                                        &dfops, del.br_startblock,
-                                        irec.br_blockcount);
+                                        del.br_blockcount);
                        if (error)
                                break;
                        xfs_bmap_add_free(ip->i_mount, &dfops,
-                                        irec.br_startblock, irec.br_blockcount,
+                                        del.br_startblock, del.br_blockcount,
                                        NULL);
                        /* Update quota accounting */
                        xfs_trans_mod_dquot_byino(*tpp, ip, XFS_TRANS_DQ_BCOUNT,
-                                        -(long)irec.br_blockcount);
+                                        -(long)del.br_blockcount);
                        /* Roll the transaction */
                        error = xfs_defer_finish(tpp, &dfops, ip);
@@ -597,15 +563,18 @@ xfs_reflink_cancel_cow_blocks(
                        }
                        /* Remove the mapping from the CoW fork. */
-                        error = xfs_bunmapi_cow(ip, &irec);
+                        xfs_bmap_del_extent_cow(ip, &idx, &got, &del);
-                        if (error)
-                                break;
                }
-                /* Roll on... */
+                if (++idx >= ifp->if_bytes / sizeof(struct xfs_bmbt_rec))
-                offset_fsb = irec.br_startoff + irec.br_blockcount;
+                        break;
+                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &got);
        }
+        /* clear tag if cow fork is emptied */
+        if (!ifp->if_bytes)
+                xfs_inode_clear_cowblocks_tag(ip);
        return error;
 }
@@ -668,25 +637,26 @@ xfs_reflink_end_cow(
        xfs_off_t                       offset,
        xfs_off_t                       count)
 {
-        struct xfs_bmbt_irec            irec;
+        struct xfs_ifork                *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
-        struct xfs_bmbt_irec            uirec;
+        struct xfs_bmbt_irec            got, prev, del;
        struct xfs_trans                *tp;
        xfs_fileoff_t                   offset_fsb;
        xfs_fileoff_t                   end_fsb;
-        xfs_filblks_t                   count_fsb;
        xfs_fsblock_t                   firstfsb;
        struct xfs_defer_ops            dfops;
-        int                             error;
+        int                             error, eof = 0;
        unsigned int                    resblks;
-        xfs_filblks_t                   ilen;
        xfs_filblks_t                   rlen;
-        int                             nimaps;
+        xfs_extnum_t                    idx;
        trace_xfs_reflink_end_cow(ip, offset, count);
+        /* No COW extents?  That's easy! */
+        if (ifp->if_bytes == 0)
+                return 0;
        offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
        end_fsb = XFS_B_TO_FSB(ip->i_mount, offset + count);
-        count_fsb = (xfs_filblks_t)(end_fsb - offset_fsb);
        /* Start a rolling transaction to switch the mappings */
        resblks = XFS_EXTENTADD_SPACE_RES(ip->i_mount, XFS_DATA_FORK);
@@ -698,72 +668,65 @@ xfs_reflink_end_cow(
        xfs_ilock(ip, XFS_ILOCK_EXCL);
        xfs_trans_ijoin(tp, ip, 0);
-        /* Go find the old extent in the CoW fork. */
+        xfs_bmap_search_extents(ip, end_fsb - 1, XFS_COW_FORK, &eof, &idx,
-        while (offset_fsb < end_fsb) {
+                        &got, &prev);
-                /* Read extent from the source file */
-                nimaps = 1;
-                count_fsb = (xfs_filblks_t)(end_fsb - offset_fsb);
-                error = xfs_bmapi_read(ip, offset_fsb, count_fsb, &irec,
-                                &nimaps, XFS_BMAPI_COWFORK);
-                if (error)
-                        goto out_cancel;
-                ASSERT(nimaps == 1);
-                ASSERT(irec.br_startblock != DELAYSTARTBLOCK);
+        /* If there is a hole at end_fsb - 1 go to the previous extent */
-                trace_xfs_reflink_cow_remap(ip, &irec);
+        if (eof || got.br_startoff > end_fsb) {
+                ASSERT(idx > 0);
+                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, --idx), &got);
+        }
-                /*
+        /* Walk backwards until we're out of the I/O range... */
-                 * We can have a hole in the CoW fork if part of a directio
+        while (got.br_startoff + got.br_blockcount > offset_fsb) {
-                 * write is CoW but part of it isn't.
+                del = got;
-                 */
+                xfs_trim_extent(&del, offset_fsb, end_fsb - offset_fsb);
-                rlen = ilen = irec.br_blockcount;
-                if (irec.br_startblock == HOLESTARTBLOCK)
+                /* Extent delete may have bumped idx forward */
+                if (!del.br_blockcount) {
+                        idx--;
                        goto next_extent;
+                }
+                ASSERT(!isnullstartblock(got.br_startblock));
                /* Unmap the old blocks in the data fork. */
-                while (rlen) {
+                xfs_defer_init(&dfops, &firstfsb);
-                        xfs_defer_init(&dfops, &firstfsb);
+                rlen = del.br_blockcount;
-                        error = __xfs_bunmapi(tp, ip, irec.br_startoff,
+                error = __xfs_bunmapi(tp, ip, del.br_startoff, &rlen, 0, 1,
-                                        &rlen, 0, 1, &firstfsb, &dfops);
+                                &firstfsb, &dfops);
-                        if (error)
+                if (error)
-                                goto out_defer;
+                        goto out_defer;
-                        /*
-                         * Trim the extent to whatever got unmapped.
-                         * Remember, bunmapi works backwards.
-                         */
-                        uirec.br_startblock = irec.br_startblock + rlen;
-                        uirec.br_startoff = irec.br_startoff + rlen;
-                        uirec.br_blockcount = irec.br_blockcount - rlen;
-                        irec.br_blockcount = rlen;
-                        trace_xfs_reflink_cow_remap_piece(ip, &uirec);
-                        /* Free the CoW orphan record. */
+                /* Trim the extent to whatever got unmapped. */
-                        error = xfs_refcount_free_cow_extent(tp->t_mountp,
+                if (rlen) {
-                                        &dfops, uirec.br_startblock,
+                        xfs_trim_extent(&del, del.br_startoff + rlen,
-                                        uirec.br_blockcount);
+                                del.br_blockcount - rlen);
-                        if (error)
+                }
-                                goto out_defer;
+                trace_xfs_reflink_cow_remap(ip, &del);
-                        /* Map the new blocks into the data fork. */
+                /* Free the CoW orphan record. */
-                        error = xfs_bmap_map_extent(tp->t_mountp, &dfops,
+                error = xfs_refcount_free_cow_extent(tp->t_mountp, &dfops,
-                                        ip, &uirec);
+                                del.br_startblock, del.br_blockcount);
-                        if (error)
+                if (error)
-                                goto out_defer;
+                        goto out_defer;
-                        /* Remove the mapping from the CoW fork. */
+                /* Map the new blocks into the data fork. */
-                        error = xfs_bunmapi_cow(ip, &uirec);
+                error = xfs_bmap_map_extent(tp->t_mountp, &dfops, ip, &del);
-                        if (error)
+                if (error)
-                                goto out_defer;
+                        goto out_defer;
-                        error = xfs_defer_finish(&tp, &dfops, ip);
+                /* Remove the mapping from the CoW fork. */
-                        if (error)
+                xfs_bmap_del_extent_cow(ip, &idx, &got, &del);
-                                goto out_defer;
-                }
+                error = xfs_defer_finish(&tp, &dfops, ip);
+                if (error)
+                        goto out_defer;
 next_extent:
-                /* Roll on... */
+                if (idx < 0)
-                offset_fsb = irec.br_startoff + ilen;
+                        break;
+                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &got);
        }
        error = xfs_trans_commit(tp);
@@ -774,7 +737,6 @@ next_extent:
 out_defer:
        xfs_defer_cancel(&dfops);
-out_cancel:
        xfs_trans_cancel(tp);
        xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out:
@@ -1312,19 +1274,26 @@ out_error:
 */
 int
 xfs_reflink_remap_range(
-        struct xfs_inode        *src,
+        struct file             *file_in,
-        xfs_off_t               srcoff,
+        loff_t                  pos_in,
-        struct xfs_inode        *dest,
+        struct file             *file_out,
-        xfs_off_t               destoff,
+        loff_t                  pos_out,
-        xfs_off_t               len,
+        u64                     len,
-        unsigned int            flags)
+        bool                    is_dedupe)
 {
+        struct inode            *inode_in = file_inode(file_in);
+        struct xfs_inode        *src = XFS_I(inode_in);
+        struct inode            *inode_out = file_inode(file_out);
+        struct xfs_inode        *dest = XFS_I(inode_out);
        struct xfs_mount        *mp = src->i_mount;
+        loff_t                  bs = inode_out->i_sb->s_blocksize;
+        bool                    same_inode = (inode_in == inode_out);
        xfs_fileoff_t           sfsbno, dfsbno;
        xfs_filblks_t           fsblen;
-        int                     error;
        xfs_extlen_t            cowextsize;
-        bool                    is_same;
+        loff_t                  isize;
+        ssize_t                 ret;
+        loff_t                  blen;
        if (!xfs_sb_version_hasreflink(&mp->m_sb))
                return -EOPNOTSUPP;
@@ -1332,17 +1301,8 @@ xfs_reflink_remap_range(
        if (XFS_FORCED_SHUTDOWN(mp))
                return -EIO;
-        /* Don't reflink realtime inodes */
-        if (XFS_IS_REALTIME_INODE(src) || XFS_IS_REALTIME_INODE(dest))
-                return -EINVAL;
-        if (flags & ~XFS_REFLINK_ALL)
-                return -EINVAL;
-        trace_xfs_reflink_remap_range(src, srcoff, len, dest, destoff);
        /* Lock both files against IO */
-        if (src->i_ino == dest->i_ino) {
+        if (same_inode) {
                xfs_ilock(src, XFS_IOLOCK_EXCL);
                xfs_ilock(src, XFS_MMAPLOCK_EXCL);
        } else {
@@ -1350,39 +1310,126 @@ xfs_reflink_remap_range(
                xfs_lock_two_inodes(src, dest, XFS_MMAPLOCK_EXCL);
        }
+        /* Don't touch certain kinds of inodes */
+        ret = -EPERM;
+        if (IS_IMMUTABLE(inode_out))
+                goto out_unlock;
+        ret = -ETXTBSY;
+        if (IS_SWAPFILE(inode_in) || IS_SWAPFILE(inode_out))
+                goto out_unlock;
+        /* Don't reflink dirs, pipes, sockets... */
+        ret = -EISDIR;
+        if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
+                goto out_unlock;
+        ret = -EINVAL;
+        if (S_ISFIFO(inode_in->i_mode) || S_ISFIFO(inode_out->i_mode))
+                goto out_unlock;
+        if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode))
+                goto out_unlock;
+        /* Don't reflink realtime inodes */
+        if (XFS_IS_REALTIME_INODE(src) || XFS_IS_REALTIME_INODE(dest))
+                goto out_unlock;
+        /* Don't share DAX file data for now. */
+        if (IS_DAX(inode_in) || IS_DAX(inode_out))
+                goto out_unlock;
+        /* Are we going all the way to the end? */
+        isize = i_size_read(inode_in);
+        if (isize == 0) {
+                ret = 0;
+                goto out_unlock;
+        }
+        if (len == 0)
+                len = isize - pos_in;
+        /* Ensure offsets don't wrap and the input is inside i_size */
+        if (pos_in + len < pos_in || pos_out + len < pos_out ||
+            pos_in + len > isize)
+                goto out_unlock;
+        /* Don't allow dedupe past EOF in the dest file */
+        if (is_dedupe) {
+                loff_t  disize;
+                disize = i_size_read(inode_out);
+                if (pos_out >= disize || pos_out + len > disize)
+                        goto out_unlock;
+        }
+        /* If we're linking to EOF, continue to the block boundary. */
+        if (pos_in + len == isize)
+                blen = ALIGN(isize, bs) - pos_in;
+        else
+                blen = len;
+        /* Only reflink if we're aligned to block boundaries */
+        if (!IS_ALIGNED(pos_in, bs) || !IS_ALIGNED(pos_in + blen, bs) ||
+            !IS_ALIGNED(pos_out, bs) || !IS_ALIGNED(pos_out + blen, bs))
+                goto out_unlock;
+        /* Don't allow overlapped reflink within the same file */
+        if (same_inode) {
+                if (pos_out + blen > pos_in && pos_out < pos_in + blen)
+                        goto out_unlock;
+        }
+        /* Wait for the completion of any pending IOs on both files */
+        inode_dio_wait(inode_in);
+        if (!same_inode)
+                inode_dio_wait(inode_out);
+        ret = filemap_write_and_wait_range(inode_in->i_mapping,
+                        pos_in, pos_in + len - 1);
+        if (ret)
+                goto out_unlock;
+        ret = filemap_write_and_wait_range(inode_out->i_mapping,
+                        pos_out, pos_out + len - 1);
+        if (ret)
+                goto out_unlock;
+        trace_xfs_reflink_remap_range(src, pos_in, len, dest, pos_out);
        /*
         * Check that the extents are the same.
         */
-        if (flags & XFS_REFLINK_DEDUPE) {
+        if (is_dedupe) {
-                is_same = false;
+                bool            is_same = false;
-                error = xfs_compare_extents(VFS_I(src), srcoff, VFS_I(dest),
-                                destoff, len, &is_same);
+                ret = xfs_compare_extents(inode_in, pos_in, inode_out, pos_out,
-                if (error)
+                                len, &is_same);
-                        goto out_error;
+                if (ret)
+                        goto out_unlock;
                if (!is_same) {
-                        error = -EBADE;
+                        ret = -EBADE;
-                        goto out_error;
+                        goto out_unlock;
                }
        }
-        error = xfs_reflink_set_inode_flag(src, dest);
+        ret = xfs_reflink_set_inode_flag(src, dest);
-        if (error)
+        if (ret)
-                goto out_error;
+                goto out_unlock;
        /*
         * Invalidate the page cache so that we can clear any CoW mappings
         * in the destination file.
         */
-        truncate_inode_pages_range(&VFS_I(dest)->i_data, destoff,
+        truncate_inode_pages_range(&inode_out->i_data, pos_out,
-                                   PAGE_ALIGN(destoff + len) - 1);
+                                   PAGE_ALIGN(pos_out + len) - 1);
-        dfsbno = XFS_B_TO_FSBT(mp, destoff);
+        dfsbno = XFS_B_TO_FSBT(mp, pos_out);
-        sfsbno = XFS_B_TO_FSBT(mp, srcoff);
+        sfsbno = XFS_B_TO_FSBT(mp, pos_in);
        fsblen = XFS_B_TO_FSB(mp, len);
-        error = xfs_reflink_remap_blocks(src, sfsbno, dest, dfsbno, fsblen,
+        ret = xfs_reflink_remap_blocks(src, sfsbno, dest, dfsbno, fsblen,
-                        destoff + len);
+                        pos_out + len);
-        if (error)
+        if (ret)
-                goto out_error;
+                goto out_unlock;
        /*
         * Carry the cowextsize hint from src to dest if we're sharing the
@@ -1390,26 +1437,24 @@ xfs_reflink_remap_range(
         * has a cowextsize hint, and the destination file does not.
         */
        cowextsize = 0;
-        if (srcoff == 0 && len == i_size_read(VFS_I(src)) &&
+        if (pos_in == 0 && len == i_size_read(inode_in) &&
            (src->i_d.di_flags2 & XFS_DIFLAG2_COWEXTSIZE) &&
-            destoff == 0 && len >= i_size_read(VFS_I(dest)) &&
+            pos_out == 0 && len >= i_size_read(inode_out) &&
            !(dest->i_d.di_flags2 & XFS_DIFLAG2_COWEXTSIZE))
                cowextsize = src->i_d.di_cowextsize;
-        error = xfs_reflink_update_dest(dest, destoff + len, cowextsize);
+        ret = xfs_reflink_update_dest(dest, pos_out + len, cowextsize);
-        if (error)
-                goto out_error;
-out_error:
+out_unlock:
        xfs_iunlock(src, XFS_MMAPLOCK_EXCL);
        xfs_iunlock(src, XFS_IOLOCK_EXCL);
        if (src->i_ino != dest->i_ino) {
                xfs_iunlock(dest, XFS_MMAPLOCK_EXCL);
                xfs_iunlock(dest, XFS_IOLOCK_EXCL);
        }
-        if (error)
+        if (ret)
-                trace_xfs_reflink_remap_range_error(dest, error, _RET_IP_);
+                trace_xfs_reflink_remap_range_error(dest, ret, _RET_IP_);
-        return error;
+        return ret;
 }
 /*
diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h
index 5dc3c8ac12aa..fad11607c9ad 100644
--- a/fs/xfs/xfs_reflink.h
+++ b/fs/xfs/xfs_reflink.h
@@ -26,8 +26,8 @@ extern int xfs_reflink_find_shared(struct xfs_mount *mp, xfs_agnumber_t agno,
 extern int xfs_reflink_trim_around_shared(struct xfs_inode *ip,
                struct xfs_bmbt_irec *irec, bool *shared, bool *trimmed);
-extern int xfs_reflink_reserve_cow_range(struct xfs_inode *ip,
+extern int xfs_reflink_reserve_cow(struct xfs_inode *ip,
-                xfs_off_t offset, xfs_off_t count);
+                struct xfs_bmbt_irec *imap, bool *shared);
 extern int xfs_reflink_allocate_cow_range(struct xfs_inode *ip,
                xfs_off_t offset, xfs_off_t count);
 extern bool xfs_reflink_find_cow_mapping(struct xfs_inode *ip, xfs_off_t offset,
@@ -43,11 +43,8 @@ extern int xfs_reflink_cancel_cow_range(struct xfs_inode *ip, xfs_off_t offset,
 extern int xfs_reflink_end_cow(struct xfs_inode *ip, xfs_off_t offset,
                xfs_off_t count);
 extern int xfs_reflink_recover_cow(struct xfs_mount *mp);
-#define XFS_REFLINK_DEDUPE      1       /* only reflink if contents match */
+extern int xfs_reflink_remap_range(struct file *file_in, loff_t pos_in,
-#define XFS_REFLINK_ALL         (XFS_REFLINK_DEDUPE)
+                struct file *file_out, loff_t pos_out, u64 len, bool is_dedupe);
-extern int xfs_reflink_remap_range(struct xfs_inode *src, xfs_off_t srcoff,
-                struct xfs_inode *dest, xfs_off_t destoff, xfs_off_t len,
-                unsigned int flags);
 extern int xfs_reflink_clear_inode_flag(struct xfs_inode *ip,
                struct xfs_trans **tpp);
 extern int xfs_reflink_unshare(struct xfs_inode *ip, xfs_off_t offset,
diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
index 5f8d55d29a11..276d3023d60f 100644
--- a/fs/xfs/xfs_sysfs.c
+++ b/fs/xfs/xfs_sysfs.c
@@ -512,13 +512,13 @@ static struct attribute *xfs_error_attrs[] = {
 };
-struct kobj_type xfs_error_cfg_ktype = {
+static struct kobj_type xfs_error_cfg_ktype = {
        .release = xfs_sysfs_release,
        .sysfs_ops = &xfs_sysfs_ops,
        .default_attrs = xfs_error_attrs,
 };
-struct kobj_type xfs_error_ktype = {
+static struct kobj_type xfs_error_ktype = {
        .release = xfs_sysfs_release,
        .sysfs_ops = &xfs_sysfs_ops,
 };
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index ad188d3a83f3..0907752be62d 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -3346,7 +3346,7 @@ DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_alloc);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_found);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_enospc);
-DEFINE_RW_EVENT(xfs_reflink_reserve_cow_range);
+DEFINE_RW_EVENT(xfs_reflink_reserve_cow);
 DEFINE_RW_EVENT(xfs_reflink_allocate_cow_range);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_bounce_dio_write);
@@ -3356,9 +3356,7 @@ DEFINE_INODE_IREC_EVENT(xfs_reflink_trim_irec);
 DEFINE_SIMPLE_IO_EVENT(xfs_reflink_cancel_cow_range);
 DEFINE_SIMPLE_IO_EVENT(xfs_reflink_end_cow);
 DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_remap);
-DEFINE_INODE_IREC_EVENT(xfs_reflink_cow_remap_piece);
-DEFINE_INODE_ERROR_EVENT(xfs_reflink_reserve_cow_range_error);
 DEFINE_INODE_ERROR_EVENT(xfs_reflink_allocate_cow_range_error);
 DEFINE_INODE_ERROR_EVENT(xfs_reflink_cancel_cow_range_error);
 DEFINE_INODE_ERROR_EVENT(xfs_reflink_end_cow_error);
diff --git a/include/asm-generic/export.h b/include/asm-generic/export.h
index 43199a049da5..63554e9f6e0c 100644
--- a/include/asm-generic/export.h
+++ b/include/asm-generic/export.h
@@ -70,7 +70,7 @@ KSYM(__kcrctab_\name):
 #include <generated/autoksyms.h>
 #define __EXPORT_SYMBOL(sym, val, sec)                          \
-        __cond_export_sym(sym, val, sec, config_enabled(__KSYM_##sym))
+        __cond_export_sym(sym, val, sec, __is_defined(__KSYM_##sym))
 #define __cond_export_sym(sym, val, sec, conf)                  \
        ___cond_export_sym(sym, val, sec, conf)
 #define ___cond_export_sym(sym, val, sec, enabled)              \
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index ddbeda6dbdc8..689a8b9b9c8f 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -326,6 +326,7 @@ struct pci_dev;
 int acpi_pci_irq_enable (struct pci_dev *dev);
 void acpi_penalize_isa_irq(int irq, int active);
 bool acpi_isa_irq_available(int irq);
+void acpi_penalize_sci_irq(int irq, int trigger, int polarity);
 void acpi_pci_irq_disable (struct pci_dev *dev);
 extern int ec_read(u8 addr, u8 *val);
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index af596381fa0f..a428aec36ace 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -785,7 +785,7 @@ extern struct of_device_id __clk_of_table;
 * routines, one at of_clk_init(), and one at platform device probe
 */
 #define CLK_OF_DECLARE_DRIVER(name, compat, fn) \
-        static void name##_of_clk_init_driver(struct device_node *np)   \
+        static void __init name##_of_clk_init_driver(struct device_node *np) \
        {                                                               \
                of_node_clear_flag(np, OF_POPULATED);                   \
                fn(np);                                                 \
diff --git a/include/linux/io.h b/include/linux/io.h
index e2c8419278c1..82ef36eac8a1 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -141,4 +141,26 @@ enum {
 void *memremap(resource_size_t offset, size_t size, unsigned long flags);
 void memunmap(void *addr);
+/*
+ * On x86 PAT systems we have memory tracking that keeps track of
+ * the allowed mappings on memory ranges. This tracking works for
+ * all the in-kernel mapping APIs (ioremap*), but where the user
+ * wishes to map a range from a physical device into user memory
+ * the tracking won't be updated. This API is to be used by
+ * drivers which remap physical device pages into userspace,
+ * and wants to make sure they are mapped WC and not UC.
+ */
+#ifndef arch_io_reserve_memtype_wc
+static inline int arch_io_reserve_memtype_wc(resource_size_t base,
+                                             resource_size_t size)
+{
+        return 0;
+}
+static inline void arch_io_free_memtype_wc(resource_size_t base,
+                                           resource_size_t size)
+{
+}
+#endif
 #endif /* _LINUX_IO_H */
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index e63e288dee83..7892f55a1866 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -19,11 +19,15 @@ struct vm_fault;
 #define IOMAP_UNWRITTEN 0x04    /* blocks allocated @blkno in unwritten state */
 /*
- * Flags for iomap mappings:
+ * Flags for all iomap mappings:
 */
-#define IOMAP_F_MERGED  0x01    /* contains multiple blocks/extents */
+#define IOMAP_F_NEW     0x01    /* blocks have been newly allocated */
-#define IOMAP_F_SHARED  0x02    /* block shared with another file */
-#define IOMAP_F_NEW     0x04    /* blocks have been newly allocated */
+/*
+ * Flags that only need to be reported for IOMAP_REPORT requests:
+ */
+#define IOMAP_F_MERGED  0x10    /* contains multiple blocks/extents */
+#define IOMAP_F_SHARED  0x20    /* block shared with another file */
 /*
 * Magic value for blkno:
@@ -42,8 +46,9 @@ struct iomap {
 /*
 * Flags for iomap_begin / iomap_end.  No flag implies a read.
 */
-#define IOMAP_WRITE             (1 << 0)
+#define IOMAP_WRITE             (1 << 0) /* writing, must allocate blocks */
-#define IOMAP_ZERO              (1 << 1)
+#define IOMAP_ZERO              (1 << 1) /* zeroing operation, may skip holes */
+#define IOMAP_REPORT            (1 << 2) /* report extent status, e.g. FIEMAP */
 struct iomap_ops {
        /*
diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
index 15ec117ec537..8f2e059e4d45 100644
--- a/include/linux/kconfig.h
+++ b/include/linux/kconfig.h
@@ -31,7 +31,6 @@
 * When CONFIG_BOOGER is not defined, we generate a (... 1, 0) pair, and when
 * the last step cherry picks the 2nd arg, we get a zero.
 */
-#define config_enabled(cfg)             ___is_defined(cfg)
 #define __is_defined(x)                 ___is_defined(x)
 #define ___is_defined(val)              ____is_defined(__ARG_PLACEHOLDER_##val)
 #define ____is_defined(arg1_or_junk)    __take_second_arg(arg1_or_junk 1, 0)
@@ -41,13 +40,13 @@
 * otherwise. For boolean options, this is equivalent to
 * IS_ENABLED(CONFIG_FOO).
 */
-#define IS_BUILTIN(option) config_enabled(option)
+#define IS_BUILTIN(option) __is_defined(option)
 /*
 * IS_MODULE(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'm', 0
 * otherwise.
 */
-#define IS_MODULE(option) config_enabled(option##_MODULE)
+#define IS_MODULE(option) __is_defined(option##_MODULE)
 /*
 * IS_REACHABLE(CONFIG_FOO) evaluates to 1 if the currently compiled
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3a191853faaa..a92c8d73aeaf 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1271,10 +1271,6 @@ extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *
 extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
                void *buf, int len, unsigned int gup_flags);
-long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
-                      unsigned long start, unsigned long nr_pages,
-                      unsigned int foll_flags, struct page **pages,
-                      struct vm_area_struct **vmas, int *nonblocking);
 long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm,
                            unsigned long start, unsigned long nr_pages,
                            unsigned int gup_flags, struct page **pages,
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 7f2ae99e5daf..0f088f3a2fed 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -440,33 +440,7 @@ struct zone {
        seqlock_t               span_seqlock;
 #endif
-        /*
+        int initialized;
-         * wait_table           -- the array holding the hash table
-         * wait_table_hash_nr_entries   -- the size of the hash table array
-         * wait_table_bits      -- wait_table_size == (1 << wait_table_bits)
-         *
-         * The purpose of all these is to keep track of the people
-         * waiting for a page to become available and make them
-         * runnable again when possible. The trouble is that this
-         * consumes a lot of space, especially when so few things
-         * wait on pages at a given time. So instead of using
-         * per-page waitqueues, we use a waitqueue hash table.
-         *
-         * The bucket discipline is to sleep on the same queue when
-         * colliding and wake all in that wait queue when removing.
-         * When something wakes, it must check to be sure its page is
-         * truly available, a la thundering herd. The cost of a
-         * collision is great, but given the expected load of the
-         * table, they should be so rare as to be outweighed by the
-         * benefits from the saved space.
-         *
-         * __wait_on_page_locked() and unlock_page() in mm/filemap.c, are the
-         * primary users of these fields, and in mm/page_alloc.c
-         * free_area_init_core() performs the initialization of them.
-         */
-        wait_queue_head_t       *wait_table;
-        unsigned long           wait_table_hash_nr_entries;
-        unsigned long           wait_table_bits;
        /* Write-intensive fields used from the page allocator */
        ZONE_PADDING(_pad1_)
@@ -546,7 +520,7 @@ static inline bool zone_spans_pfn(const struct zone *zone, unsigned long pfn)
 static inline bool zone_is_initialized(struct zone *zone)
 {
-        return !!zone->wait_table;
+        return zone->initialized;
 }
 static inline bool zone_is_empty(struct zone *zone)
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 060d0ede88df..4741ecdb9817 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1257,6 +1257,7 @@ extern u64 perf_swevent_set_period(struct perf_event *event);
 extern void perf_event_enable(struct perf_event *event);
 extern void perf_event_disable(struct perf_event *event);
 extern void perf_event_disable_local(struct perf_event *event);
+extern void perf_event_disable_inatomic(struct perf_event *event);
 extern void perf_event_task_tick(void);
 #else /* !CONFIG_PERF_EVENTS: */
 static inline void *
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index a521999de4f1..bf74eaa5c39f 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -53,7 +53,7 @@ static struct msg_msg *alloc_msg(size_t len)
        size_t alen;
        alen = min(len, DATALEN_MSG);
-        msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL);
+        msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT);
        if (msg == NULL)
                return NULL;
@@ -65,7 +65,7 @@ static struct msg_msg *alloc_msg(size_t len)
        while (len > 0) {
                struct msg_msgseg *seg;
                alen = min(len, DATALEN_SEG);
-                seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL);
+                seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
                if (seg == NULL)
                        goto out_err;
                *pseg = seg;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c6e47e97b33f..0e292132efac 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1960,6 +1960,12 @@ void perf_event_disable(struct perf_event *event)
 }
 EXPORT_SYMBOL_GPL(perf_event_disable);
+void perf_event_disable_inatomic(struct perf_event *event)
+{
+        event->pending_disable = 1;
+        irq_work_queue(&event->pending);
+}
 static void perf_set_shadow_time(struct perf_event *event,
                                 struct perf_event_context *ctx,
                                 u64 tstamp)
@@ -7075,8 +7081,8 @@ static int __perf_event_overflow(struct perf_event *event,
        if (events && atomic_dec_and_test(&event->event_limit)) {
                ret = 1;
                event->pending_kill = POLL_HUP;
-                event->pending_disable = 1;
-                irq_work_queue(&event->pending);
+                perf_event_disable_inatomic(event);
        }
        READ_ONCE(event->overflow_handler)(event, data, regs);
@@ -8855,7 +8861,10 @@ EXPORT_SYMBOL_GPL(perf_pmu_register);
 void perf_pmu_unregister(struct pmu *pmu)
 {
+        int remove_device;
        mutex_lock(&pmus_lock);
+        remove_device = pmu_bus_running;
        list_del_rcu(&pmu->entry);
        mutex_unlock(&pmus_lock);
@@ -8869,10 +8878,12 @@ void perf_pmu_unregister(struct pmu *pmu)
        free_percpu(pmu->pmu_disable_count);
        if (pmu->type >= PERF_TYPE_MAX)
                idr_remove(&pmu_idr, pmu->type);
-        if (pmu->nr_addr_filters)
+        if (remove_device) {
-                device_remove_file(pmu->dev, &dev_attr_nr_addr_filters);
+                if (pmu->nr_addr_filters)
-        device_del(pmu->dev);
+                        device_remove_file(pmu->dev, &dev_attr_nr_addr_filters);
-        put_device(pmu->dev);
+                device_del(pmu->dev);
+                put_device(pmu->dev);
+        }
        free_pmu_context(pmu);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 8d44b3fea9d0..30e6d05aa5a9 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -53,8 +53,15 @@ void notrace __sanitizer_cov_trace_pc(void)
        /*
         * We are interested in code coverage as a function of a syscall inputs,
         * so we ignore code executed in interrupts.
+         * The checks for whether we are in an interrupt are open-coded, because
+         * 1. We can't use in_interrupt() here, since it also returns true
+         *    when we are inside local_bh_disable() section.
+         * 2. We don't want to use (in_irq() | in_serving_softirq() | in_nmi()),
+         *    since that leads to slower generated code (three separate tests,
+         *    one for each of the flags).
         */
-        if (!t || in_interrupt())
+        if (!t || (preempt_count() & (HARDIRQ_MASK | SOFTIRQ_OFFSET
+                                                        | NMI_MASK)))
                return;
        mode = READ_ONCE(t->kcov_mode);
        if (mode == KCOV_MODE_TRACE) {
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 1e7f5da648d9..6ccb08f57fcb 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -498,9 +498,9 @@ static int enter_state(suspend_state_t state)
 #ifndef CONFIG_SUSPEND_SKIP_SYNC
        trace_suspend_resume(TPS("sync_filesystems"), 0, true);
-        printk(KERN_INFO "PM: Syncing filesystems ... ");
+        pr_info("PM: Syncing filesystems ... ");
        sys_sync();
-        printk("done.\n");
+        pr_cont("done.\n");
        trace_suspend_resume(TPS("sync_filesystems"), 0, false);
 #endif
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 94732d1ab00a..42d4027f9e26 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7515,11 +7515,27 @@ static struct kmem_cache *task_group_cache __read_mostly;
 DECLARE_PER_CPU(cpumask_var_t, load_balance_mask);
 DECLARE_PER_CPU(cpumask_var_t, select_idle_mask);
+#define WAIT_TABLE_BITS 8
+#define WAIT_TABLE_SIZE (1 << WAIT_TABLE_BITS)
+static wait_queue_head_t bit_wait_table[WAIT_TABLE_SIZE] __cacheline_aligned;
+wait_queue_head_t *bit_waitqueue(void *word, int bit)
+{
+        const int shift = BITS_PER_LONG == 32 ? 5 : 6;
+        unsigned long val = (unsigned long)word << shift | bit;
+        return bit_wait_table + hash_long(val, WAIT_TABLE_BITS);
+}
+EXPORT_SYMBOL(bit_waitqueue);
 void __init sched_init(void)
 {
        int i, j;
        unsigned long alloc_size = 0, ptr;
+        for (i = 0; i < WAIT_TABLE_SIZE; i++)
+                init_waitqueue_head(bit_wait_table + i);
 #ifdef CONFIG_FAIR_GROUP_SCHED
        alloc_size += 2 * nr_cpu_ids * sizeof(void **);
 #endif
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d941c97dfbc3..c242944f5cbd 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -8839,7 +8839,6 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
 {
        struct sched_entity *se;
        struct cfs_rq *cfs_rq;
-        struct rq *rq;
        int i;
        tg->cfs_rq = kzalloc(sizeof(cfs_rq) * nr_cpu_ids, GFP_KERNEL);
@@ -8854,8 +8853,6 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
        init_cfs_bandwidth(tg_cfs_bandwidth(tg));
        for_each_possible_cpu(i) {
-                rq = cpu_rq(i);
                cfs_rq = kzalloc_node(sizeof(struct cfs_rq),
                                      GFP_KERNEL, cpu_to_node(i));
                if (!cfs_rq)
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 4f7053579fe3..9453efe9b25a 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -480,16 +480,6 @@ void wake_up_bit(void *word, int bit)
 }
 EXPORT_SYMBOL(wake_up_bit);
-wait_queue_head_t *bit_waitqueue(void *word, int bit)
-{
-        const int shift = BITS_PER_LONG == 32 ? 5 : 6;
-        const struct zone *zone = page_zone(virt_to_page(word));
-        unsigned long val = (unsigned long)word << shift | bit;
-        return &zone->wait_table[hash_long(val, zone->wait_table_bits)];
-}
-EXPORT_SYMBOL(bit_waitqueue);
 /*
 * Manipulate the atomic_t address to produce a better bit waitqueue table hash
 * index (we're keying off bit -1, but that would produce a horrible hash
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 1bf81ef91375..744fa611cae0 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -58,7 +58,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
 const char * const softirq_to_name[NR_SOFTIRQS] = {
-        "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
+        "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "IRQ_POLL",
        "TASKLET", "SCHED", "HRTIMER", "RCU"
 };
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 2d47980a1bc4..c611c47de884 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -878,7 +878,7 @@ static inline struct timer_base *get_timer_base(u32 tflags)
 #ifdef CONFIG_NO_HZ_COMMON
 static inline struct timer_base *
-__get_target_base(struct timer_base *base, unsigned tflags)
+get_target_base(struct timer_base *base, unsigned tflags)
 {
 #ifdef CONFIG_SMP
        if ((tflags & TIMER_PINNED) || !base->migration_enabled)
@@ -891,25 +891,27 @@ __get_target_base(struct timer_base *base, unsigned tflags)
 static inline void forward_timer_base(struct timer_base *base)
 {
+        unsigned long jnow = READ_ONCE(jiffies);
        /*
         * We only forward the base when it's idle and we have a delta between
         * base clock and jiffies.
         */
-        if (!base->is_idle || (long) (jiffies - base->clk) < 2)
+        if (!base->is_idle || (long) (jnow - base->clk) < 2)
                return;
        /*
         * If the next expiry value is > jiffies, then we fast forward to
         * jiffies otherwise we forward to the next expiry value.
         */
-        if (time_after(base->next_expiry, jiffies))
+        if (time_after(base->next_expiry, jnow))
-                base->clk = jiffies;
+                base->clk = jnow;
        else
                base->clk = base->next_expiry;
 }
 #else
 static inline struct timer_base *
-__get_target_base(struct timer_base *base, unsigned tflags)
+get_target_base(struct timer_base *base, unsigned tflags)
 {
        return get_timer_this_cpu_base(tflags);
 }
@@ -917,14 +919,6 @@ __get_target_base(struct timer_base *base, unsigned tflags)
 static inline void forward_timer_base(struct timer_base *base) { }
 #endif
-static inline struct timer_base *
-get_target_base(struct timer_base *base, unsigned tflags)
-{
-        struct timer_base *target = __get_target_base(base, tflags);
-        forward_timer_base(target);
-        return target;
-}
 /*
 * We are using hashed locking: Holding per_cpu(timer_bases[x]).lock means
@@ -943,7 +937,14 @@ static struct timer_base *lock_timer_base(struct timer_list *timer,
 {
        for (;;) {
                struct timer_base *base;
-                u32 tf = timer->flags;
+                u32 tf;
+                /*
+                 * We need to use READ_ONCE() here, otherwise the compiler
+                 * might re-read @tf between the check for TIMER_MIGRATING
+                 * and spin_lock().
+                 */
+                tf = READ_ONCE(timer->flags);
                if (!(tf & TIMER_MIGRATING)) {
                        base = get_timer_base(tf);
@@ -964,6 +965,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
        unsigned long clk = 0, flags;
        int ret = 0;
+        BUG_ON(!timer->function);
        /*
         * This is a common optimization triggered by the networking code - if
         * the timer is re-modified to have the same timeout or ends up in the
@@ -972,13 +975,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
        if (timer_pending(timer)) {
                if (timer->expires == expires)
                        return 1;
                /*
-                 * Take the current timer_jiffies of base, but without holding
+                 * We lock timer base and calculate the bucket index right
-                 * the lock!
+                 * here. If the timer ends up in the same bucket, then we
+                 * just update the expiry time and avoid the whole
+                 * dequeue/enqueue dance.
                 */
-                base = get_timer_base(timer->flags);
+                base = lock_timer_base(timer, &flags);
-                clk = base->clk;
+                clk = base->clk;
                idx = calc_wheel_index(expires, clk);
                /*
@@ -988,14 +994,14 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
                 */
                if (idx == timer_get_idx(timer)) {
                        timer->expires = expires;
-                        return 1;
+                        ret = 1;
+                        goto out_unlock;
                }
+        } else {
+                base = lock_timer_base(timer, &flags);
        }
        timer_stats_timer_set_start_info(timer);
-        BUG_ON(!timer->function);
-        base = lock_timer_base(timer, &flags);
        ret = detach_if_pending(timer, base, false);
        if (!ret && pending_only)
@@ -1025,12 +1031,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
                }
        }
+        /* Try to forward a stale timer base clock */
+        forward_timer_base(base);
        timer->expires = expires;
        /*
         * If 'idx' was calculated above and the base time did not advance
-         * between calculating 'idx' and taking the lock, only enqueue_timer()
+         * between calculating 'idx' and possibly switching the base, only
-         * and trigger_dyntick_cpu() is required. Otherwise we need to
+         * enqueue_timer() and trigger_dyntick_cpu() is required. Otherwise
-         * (re)calculate the wheel index via internal_add_timer().
+         * we need to (re)calculate the wheel index via
+         * internal_add_timer().
         */
        if (idx != UINT_MAX && clk == base->clk) {
                enqueue_timer(base, timer, idx);
@@ -1510,12 +1520,16 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
        is_max_delta = (nextevt == base->clk + NEXT_TIMER_MAX_DELTA);
        base->next_expiry = nextevt;
        /*
-         * We have a fresh next event. Check whether we can forward the base:
+         * We have a fresh next event. Check whether we can forward the
+         * base. We can only do that when @basej is past base->clk
+         * otherwise we might rewind base->clk.
         */
-        if (time_after(nextevt, jiffies))
+        if (time_after(basej, base->clk)) {
-                base->clk = jiffies;
+                if (time_after(nextevt, basej))
-        else if (time_after(nextevt, base->clk))
+                        base->clk = basej;
-                base->clk = nextevt;
+                else if (time_after(nextevt, base->clk))
+                        base->clk = nextevt;
+        }
        if (time_before_eq(nextevt, basej)) {
                expires = basem;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 33bc56cf60d7..b01e547d4d04 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -198,6 +198,7 @@ config FRAME_WARN
        int "Warn for stack frames larger than (needs gcc 4.4)"
        range 0 8192
        default 0 if KASAN
+        default 2048 if GCC_PLUGIN_LATENT_ENTROPY
        default 1024 if !64BIT
        default 2048 if 64BIT
        help
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 0a1139644d32..144fe6b1a03e 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -292,7 +292,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
        struct gen_pool_chunk *chunk;
        unsigned long addr = 0;
        int order = pool->min_alloc_order;
-        int nbits, start_bit = 0, end_bit, remain;
+        int nbits, start_bit, end_bit, remain;
 #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
        BUG_ON(in_nmi());
@@ -307,6 +307,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
                if (size > atomic_read(&chunk->avail))
                        continue;
+                start_bit = 0;
                end_bit = chunk_size(chunk) >> order;
 retry:
                start_bit = algo(chunk->bits, end_bit, start_bit,
diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index 60f77f1d470a..4d830e299989 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -50,7 +50,7 @@
                                        STACK_ALLOC_ALIGN)
 #define STACK_ALLOC_INDEX_BITS (DEPOT_STACK_BITS - \
                STACK_ALLOC_NULL_PROTECTION_BITS - STACK_ALLOC_OFFSET_BITS)
-#define STACK_ALLOC_SLABS_CAP 1024
+#define STACK_ALLOC_SLABS_CAP 8192
 #define STACK_ALLOC_MAX_SLABS \
        (((1LL << (STACK_ALLOC_INDEX_BITS)) < STACK_ALLOC_SLABS_CAP) ? \
         (1LL << (STACK_ALLOC_INDEX_BITS)) : STACK_ALLOC_SLABS_CAP)
diff --git a/mm/Kconfig b/mm/Kconfig
index be0ee11fa0d9..86e3e0e74d20 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -187,7 +187,7 @@ config MEMORY_HOTPLUG
        bool "Allow for memory hot-add"
        depends on SPARSEMEM || X86_64_ACPI_NUMA
        depends on ARCH_ENABLE_MEMORY_HOTPLUG
-        depends on !KASAN
+        depends on COMPILE_TEST || !KASAN
 config MEMORY_HOTPLUG_SPARSE
        def_bool y
diff --git a/mm/filemap.c b/mm/filemap.c
index 849f459ad078..c7fe2f16503f 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -790,9 +790,7 @@ EXPORT_SYMBOL(__page_cache_alloc);
 */
 wait_queue_head_t *page_waitqueue(struct page *page)
 {
-        const struct zone *zone = page_zone(page);
+        return bit_waitqueue(page, 0);
-        return &zone->wait_table[hash_ptr(page, zone->wait_table_bits)];
 }
 EXPORT_SYMBOL(page_waitqueue);
diff --git a/mm/gup.c b/mm/gup.c
index 7aa113c2d373..ec4f82704b6f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -526,7 +526,7 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
 * instead of __get_user_pages. __get_user_pages should be used only if
 * you need some special @gup_flags.
 */
-long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                unsigned long start, unsigned long nr_pages,
                unsigned int gup_flags, struct page **pages,
                struct vm_area_struct **vmas, int *nonblocking)
@@ -631,7 +631,6 @@ next_page:
        } while (nr_pages);
        return i;
 }
-EXPORT_SYMBOL(__get_user_pages);
 bool vma_permits_fault(struct vm_area_struct *vma, unsigned int fault_flags)
 {
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index a5e453cf05c4..e5355a5b423f 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1453,8 +1453,11 @@ static void kmemleak_scan(void)
                read_lock(&tasklist_lock);
                do_each_thread(g, p) {
-                        scan_block(task_stack_page(p), task_stack_page(p) +
+                        void *stack = try_get_task_stack(p);
-                                   THREAD_SIZE, NULL);
+                        if (stack) {
+                                scan_block(stack, stack + THREAD_SIZE, NULL);
+                                put_task_stack(p);
+                        }
                } while_each_thread(g, p);
                read_unlock(&tasklist_lock);
        }
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 1d05cb9d363d..234676e31edd 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -554,6 +554,8 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware,
        err = memcg_init_list_lru(lru, memcg_aware);
        if (err) {
                kfree(lru->node);
+                /* Do this so a list_lru_destroy() doesn't crash: */
+                lru->node = NULL;
                goto out;
        }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ae052b5e3315..0f870ba43942 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1917,6 +1917,15 @@ retry:
                     current->flags & PF_EXITING))
                goto force;
+        /*
+         * Prevent unbounded recursion when reclaim operations need to
+         * allocate memory. This might exceed the limits temporarily,
+         * but we prefer facilitating memory reclaim and getting back
+         * under the limit over triggering OOM kills in these cases.
+         */
+        if (unlikely(current->flags & PF_MEMALLOC))
+                goto force;
        if (unlikely(task_in_memcg_oom(current)))
                goto nomem;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 962927309b6e..cad4b9125695 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -268,7 +268,6 @@ void __init register_page_bootmem_info_node(struct pglist_data *pgdat)
        unsigned long i, pfn, end_pfn, nr_pages;
        int node = pgdat->node_id;
        struct page *page;
-        struct zone *zone;
        nr_pages = PAGE_ALIGN(sizeof(struct pglist_data)) >> PAGE_SHIFT;
        page = virt_to_page(pgdat);
@@ -276,19 +275,6 @@ void __init register_page_bootmem_info_node(struct pglist_data *pgdat)
        for (i = 0; i < nr_pages; i++, page++)
                get_page_bootmem(node, page, NODE_INFO);
-        zone = &pgdat->node_zones[0];
-        for (; zone < pgdat->node_zones + MAX_NR_ZONES - 1; zone++) {
-                if (zone_is_initialized(zone)) {
-                        nr_pages = zone->wait_table_hash_nr_entries
-                                * sizeof(wait_queue_head_t);
-                        nr_pages = PAGE_ALIGN(nr_pages) >> PAGE_SHIFT;
-                        page = virt_to_page(zone->wait_table);
-                        for (i = 0; i < nr_pages; i++, page++)
-                                get_page_bootmem(node, page, NODE_INFO);
-                }
-        }
        pfn = pgdat->node_start_pfn;
        end_pfn = pgdat_end_pfn(pgdat);
@@ -2131,7 +2117,6 @@ void try_offline_node(int nid)
        unsigned long start_pfn = pgdat->node_start_pfn;
        unsigned long end_pfn = start_pfn + pgdat->node_spanned_pages;
        unsigned long pfn;
-        int i;
        for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
                unsigned long section_nr = pfn_to_section_nr(pfn);
@@ -2158,20 +2143,6 @@ void try_offline_node(int nid)
         */
        node_set_offline(nid);
        unregister_one_node(nid);
-        /* free waittable in each zone */
-        for (i = 0; i < MAX_NR_ZONES; i++) {
-                struct zone *zone = pgdat->node_zones + i;
-                /*
-                 * wait_table may be allocated from boot memory,
-                 * here only free if it's allocated by vmalloc.
-                 */
-                if (is_vmalloc_addr(zone->wait_table)) {
-                        vfree(zone->wait_table);
-                        zone->wait_table = NULL;
-                }
-        }
 }
 EXPORT_SYMBOL(try_offline_node);
diff --git a/mm/nommu.c b/mm/nommu.c
index db5fd1795298..8b8faaf2a9e9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -109,7 +109,7 @@ unsigned int kobjsize(const void *objp)
        return PAGE_SIZE << compound_order(page);
 }
-long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                      unsigned long start, unsigned long nr_pages,
                      unsigned int foll_flags, struct page **pages,
                      struct vm_area_struct **vmas, int *nonblocking)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2b3bf6767d54..8fd42aa7c4bd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4224,7 +4224,7 @@ static void show_migration_types(unsigned char type)
        }
        *p = '\0';
-        printk("(%s) ", tmp);
+        printk(KERN_CONT "(%s) ", tmp);
 }
 /*
@@ -4335,7 +4335,8 @@ void show_free_areas(unsigned int filter)
                        free_pcp += per_cpu_ptr(zone->pageset, cpu)->pcp.count;
                show_node(zone);
-                printk("%s"
+                printk(KERN_CONT
+                        "%s"
                        " free:%lukB"
                        " min:%lukB"
                        " low:%lukB"
@@ -4382,8 +4383,8 @@ void show_free_areas(unsigned int filter)
                        K(zone_page_state(zone, NR_FREE_CMA_PAGES)));
                printk("lowmem_reserve[]:");
                for (i = 0; i < MAX_NR_ZONES; i++)
-                        printk(" %ld", zone->lowmem_reserve[i]);
+                        printk(KERN_CONT " %ld", zone->lowmem_reserve[i]);
-                printk("\n");
+                printk(KERN_CONT "\n");
        }
        for_each_populated_zone(zone) {
@@ -4394,7 +4395,7 @@ void show_free_areas(unsigned int filter)
                if (skip_free_areas_node(filter, zone_to_nid(zone)))
                        continue;
                show_node(zone);
-                printk("%s: ", zone->name);
+                printk(KERN_CONT "%s: ", zone->name);
                spin_lock_irqsave(&zone->lock, flags);
                for (order = 0; order < MAX_ORDER; order++) {
@@ -4412,11 +4413,12 @@ void show_free_areas(unsigned int filter)
                }
                spin_unlock_irqrestore(&zone->lock, flags);
                for (order = 0; order < MAX_ORDER; order++) {
-                        printk("%lu*%lukB ", nr[order], K(1UL) << order);
+                        printk(KERN_CONT "%lu*%lukB ",
+                               nr[order], K(1UL) << order);
                        if (nr[order])
                                show_migration_types(types[order]);
                }
-                printk("= %lukB\n", K(total));
+                printk(KERN_CONT "= %lukB\n", K(total));
        }
        hugetlb_show_meminfo();
@@ -4977,72 +4979,6 @@ void __ref build_all_zonelists(pg_data_t *pgdat, struct zone *zone)
 }
 /*
- * Helper functions to size the waitqueue hash table.
- * Essentially these want to choose hash table sizes sufficiently
- * large so that collisions trying to wait on pages are rare.
- * But in fact, the number of active page waitqueues on typical
- * systems is ridiculously low, less than 200. So this is even
- * conservative, even though it seems large.
- *
- * The constant PAGES_PER_WAITQUEUE specifies the ratio of pages to
- * waitqueues, i.e. the size of the waitq table given the number of pages.
- */
-#define PAGES_PER_WAITQUEUE     256
-#ifndef CONFIG_MEMORY_HOTPLUG
-static inline unsigned long wait_table_hash_nr_entries(unsigned long pages)
-{
-        unsigned long size = 1;
-        pages /= PAGES_PER_WAITQUEUE;
-        while (size < pages)
-                size <<= 1;
-        /*
-         * Once we have dozens or even hundreds of threads sleeping
-         * on IO we've got bigger problems than wait queue collision.
-         * Limit the size of the wait table to a reasonable size.
-         */
-        size = min(size, 4096UL);
-        return max(size, 4UL);
-}
-#else
-/*
- * A zone's size might be changed by hot-add, so it is not possible to determine
- * a suitable size for its wait_table.  So we use the maximum size now.
- *
- * The max wait table size = 4096 x sizeof(wait_queue_head_t).   ie:
- *
- *    i386 (preemption config)    : 4096 x 16 = 64Kbyte.
- *    ia64, x86-64 (no preemption): 4096 x 20 = 80Kbyte.
- *    ia64, x86-64 (preemption)   : 4096 x 24 = 96Kbyte.
- *
- * The maximum entries are prepared when a zone's memory is (512K + 256) pages
- * or more by the traditional way. (See above).  It equals:
- *
- *    i386, x86-64, powerpc(4K page size) : =  ( 2G + 1M)byte.
- *    ia64(16K page size)                 : =  ( 8G + 4M)byte.
- *    powerpc (64K page size)             : =  (32G +16M)byte.
- */
-static inline unsigned long wait_table_hash_nr_entries(unsigned long pages)
-{
-        return 4096UL;
-}
-#endif
-/*
- * This is an integer logarithm so that shifts can be used later
- * to extract the more random high bits from the multiplicative
- * hash function before the remainder is taken.
- */
-static inline unsigned long wait_table_bits(unsigned long size)
-{
-        return ffz(~size);
-}
-/*
 * Initially all pages are reserved - free ones are freed
 * up by free_all_bootmem() once the early boot process is
 * done. Non-atomic initialization, single-pass.
@@ -5304,49 +5240,6 @@ void __init setup_per_cpu_pageset(void)
                        alloc_percpu(struct per_cpu_nodestat);
 }
-static noinline __ref
-int zone_wait_table_init(struct zone *zone, unsigned long zone_size_pages)
-{
-        int i;
-        size_t alloc_size;
-        /*
-         * The per-page waitqueue mechanism uses hashed waitqueues
-         * per zone.
-         */
-        zone->wait_table_hash_nr_entries =
-                 wait_table_hash_nr_entries(zone_size_pages);
-        zone->wait_table_bits =
-                wait_table_bits(zone->wait_table_hash_nr_entries);
-        alloc_size = zone->wait_table_hash_nr_entries
-                                        * sizeof(wait_queue_head_t);
-        if (!slab_is_available()) {
-                zone->wait_table = (wait_queue_head_t *)
-                        memblock_virt_alloc_node_nopanic(
-                                alloc_size, zone->zone_pgdat->node_id);
-        } else {
-                /*
-                 * This case means that a zone whose size was 0 gets new memory
-                 * via memory hot-add.
-                 * But it may be the case that a new node was hot-added.  In
-                 * this case vmalloc() will not be able to use this new node's
-                 * memory - this wait_table must be initialized to use this new
-                 * node itself as well.
-                 * To use this new node's memory, further consideration will be
-                 * necessary.
-                 */
-                zone->wait_table = vmalloc(alloc_size);
-        }
-        if (!zone->wait_table)
-                return -ENOMEM;
-        for (i = 0; i < zone->wait_table_hash_nr_entries; ++i)
-                init_waitqueue_head(zone->wait_table + i);
-        return 0;
-}
 static __meminit void zone_pcp_init(struct zone *zone)
 {
        /*
@@ -5367,10 +5260,7 @@ int __meminit init_currently_empty_zone(struct zone *zone,
                                        unsigned long size)
 {
        struct pglist_data *pgdat = zone->zone_pgdat;
-        int ret;
-        ret = zone_wait_table_init(zone, size);
-        if (ret)
-                return ret;
        pgdat->nr_zones = zone_idx(zone) + 1;
        zone->zone_start_pfn = zone_start_pfn;
@@ -5382,6 +5272,7 @@ int __meminit init_currently_empty_zone(struct zone *zone,
                        zone_start_pfn, (zone_start_pfn + size));
        zone_init_free_lists(zone);
+        zone->initialized = 1;
        return 0;
 }
diff --git a/mm/slab.c b/mm/slab.c
index 090fb26b3a39..0b0550ca85b4 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -233,6 +233,7 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
        spin_lock_init(&parent->list_lock);
        parent->free_objects = 0;
        parent->free_touched = 0;
+        parent->num_slabs = 0;
 }
 #define MAKE_LIST(cachep, listp, slab, nodeid)                          \
@@ -966,7 +967,7 @@ static int setup_kmem_cache_node(struct kmem_cache *cachep,
         * guaranteed to be valid until irq is re-enabled, because it will be
         * freed after synchronize_sched().
         */
-        if (force_change)
+        if (old_shared && force_change)
                synchronize_sched();
 fail:
@@ -1382,24 +1383,27 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
        for_each_kmem_cache_node(cachep, node, n) {
                unsigned long active_objs = 0, num_objs = 0, free_objects = 0;
                unsigned long active_slabs = 0, num_slabs = 0;
+                unsigned long num_slabs_partial = 0, num_slabs_free = 0;
+                unsigned long num_slabs_full;
                spin_lock_irqsave(&n->list_lock, flags);
-                list_for_each_entry(page, &n->slabs_full, lru) {
+                num_slabs = n->num_slabs;
-                        active_objs += cachep->num;
-                        active_slabs++;
-                }
                list_for_each_entry(page, &n->slabs_partial, lru) {
                        active_objs += page->active;
-                        active_slabs++;
+                        num_slabs_partial++;
                }
                list_for_each_entry(page, &n->slabs_free, lru)
-                        num_slabs++;
+                        num_slabs_free++;
                free_objects += n->free_objects;
                spin_unlock_irqrestore(&n->list_lock, flags);
-                num_slabs += active_slabs;
                num_objs = num_slabs * cachep->num;
+                active_slabs = num_slabs - num_slabs_free;
+                num_slabs_full = num_slabs -
+                        (num_slabs_partial + num_slabs_free);
+                active_objs += (num_slabs_full * cachep->num);
                pr_warn("  node %d: slabs: %ld/%ld, objs: %ld/%ld, free: %ld\n",
                        node, active_slabs, num_slabs, active_objs, num_objs,
                        free_objects);
@@ -2314,6 +2318,7 @@ static int drain_freelist(struct kmem_cache *cache,
                page = list_entry(p, struct page, lru);
                list_del(&page->lru);
+                n->num_slabs--;
                /*
                 * Safe to drop the lock. The slab is no longer linked
                 * to the cache.
@@ -2752,6 +2757,8 @@ static void cache_grow_end(struct kmem_cache *cachep, struct page *page)
                list_add_tail(&page->lru, &(n->slabs_free));
        else
                fixup_slab_list(cachep, n, page, &list);
+        n->num_slabs++;
        STATS_INC_GROWN(cachep);
        n->free_objects += cachep->num - page->active;
        spin_unlock(&n->list_lock);
@@ -3443,6 +3450,7 @@ static void free_block(struct kmem_cache *cachep, void **objpp,
                page = list_last_entry(&n->slabs_free, struct page, lru);
                list_move(&page->lru, list);
+                n->num_slabs--;
        }
 }
@@ -4099,6 +4107,8 @@ void get_slabinfo(struct kmem_cache *cachep, struct slabinfo *sinfo)
        unsigned long num_objs;
        unsigned long active_slabs = 0;
        unsigned long num_slabs, free_objects = 0, shared_avail = 0;
+        unsigned long num_slabs_partial = 0, num_slabs_free = 0;
+        unsigned long num_slabs_full = 0;
        const char *name;
        char *error = NULL;
        int node;
@@ -4111,33 +4121,34 @@ void get_slabinfo(struct kmem_cache *cachep, struct slabinfo *sinfo)
                check_irq_on();
                spin_lock_irq(&n->list_lock);
-                list_for_each_entry(page, &n->slabs_full, lru) {
+                num_slabs += n->num_slabs;
-                        if (page->active != cachep->num && !error)
-                                error = "slabs_full accounting error";
-                        active_objs += cachep->num;
-                        active_slabs++;
-                }
                list_for_each_entry(page, &n->slabs_partial, lru) {
                        if (page->active == cachep->num && !error)
                                error = "slabs_partial accounting error";
                        if (!page->active && !error)
                                error = "slabs_partial accounting error";
                        active_objs += page->active;
-                        active_slabs++;
+                        num_slabs_partial++;
                }
                list_for_each_entry(page, &n->slabs_free, lru) {
                        if (page->active && !error)
                                error = "slabs_free accounting error";
-                        num_slabs++;
+                        num_slabs_free++;
                }
                free_objects += n->free_objects;
                if (n->shared)
                        shared_avail += n->shared->avail;
                spin_unlock_irq(&n->list_lock);
        }
-        num_slabs += active_slabs;
        num_objs = num_slabs * cachep->num;
+        active_slabs = num_slabs - num_slabs_free;
+        num_slabs_full = num_slabs - (num_slabs_partial + num_slabs_free);
+        active_objs += (num_slabs_full * cachep->num);
        if (num_objs - active_objs != free_objects && !error)
                error = "free_objects accounting error";
diff --git a/mm/slab.h b/mm/slab.h
index 9653f2e2591a..bc05fdc3edce 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -432,6 +432,7 @@ struct kmem_cache_node {
        struct list_head slabs_partial; /* partial list first, better asm code */
        struct list_head slabs_full;
        struct list_head slabs_free;
+        unsigned long num_slabs;
        unsigned long free_objects;
        unsigned int free_limit;
        unsigned int colour_next;       /* Per-node cache coloring */
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 744f926af442..76fda2268148 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3043,7 +3043,9 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
                                            sc.gfp_mask,
                                            sc.reclaim_idx);
+        current->flags |= PF_MEMALLOC;
        nr_reclaimed = do_try_to_free_pages(zonelist, &sc);
+        current->flags &= ~PF_MEMALLOC;
        trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed);
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index f826e8739023..d942c7c2bc0a 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -41,7 +41,7 @@ config BIG_KEYS
        bool "Large payload keys"
        depends on KEYS
        depends on TMPFS
-        select CRYPTO
+        depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
        select CRYPTO_AES
        select CRYPTO_ECB
        select CRYPTO_RNG
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index c0b3030b5634..835c1ab30d01 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -9,6 +9,7 @@
 * 2 of the Licence, or (at your option) any later version.
 */
+#define pr_fmt(fmt) "big_key: "fmt
 #include <linux/init.h>
 #include <linux/seq_file.h>
 #include <linux/file.h>
@@ -341,44 +342,48 @@ error:
 */
 static int __init big_key_init(void)
 {
-        return register_key_type(&key_type_big_key);
+        struct crypto_skcipher *cipher;
-}
+        struct crypto_rng *rng;
+        int ret;
-/*
- * Initialize big_key crypto and RNG algorithms
- */
-static int __init big_key_crypto_init(void)
-{
-        int ret = -EINVAL;
-        /* init RNG */
+        rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-        big_key_rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
+        if (IS_ERR(rng)) {
-        if (IS_ERR(big_key_rng)) {
+                pr_err("Can't alloc rng: %ld\n", PTR_ERR(rng));
-                big_key_rng = NULL;
+                return PTR_ERR(rng);
-                return -EFAULT;
        }
+        big_key_rng = rng;
        /* seed RNG */
-        ret = crypto_rng_reset(big_key_rng, NULL, crypto_rng_seedsize(big_key_rng));
+        ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
-        if (ret)
+        if (ret) {
-                goto error;
+                pr_err("Can't reset rng: %d\n", ret);
+                goto error_rng;
+        }
        /* init block cipher */
-        big_key_skcipher = crypto_alloc_skcipher(big_key_alg_name,
+        cipher = crypto_alloc_skcipher(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
-                                                 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(cipher)) {
-        if (IS_ERR(big_key_skcipher)) {
+                ret = PTR_ERR(cipher);
-                big_key_skcipher = NULL;
+                pr_err("Can't alloc crypto: %d\n", ret);
-                ret = -EFAULT;
+                goto error_rng;
-                goto error;
+        }
+        big_key_skcipher = cipher;
+        ret = register_key_type(&key_type_big_key);
+        if (ret < 0) {
+                pr_err("Can't register type: %d\n", ret);
+                goto error_cipher;
        }
        return 0;
-error:
+error_cipher:
+        crypto_free_skcipher(big_key_skcipher);
+error_rng:
        crypto_free_rng(big_key_rng);
-        big_key_rng = NULL;
        return ret;
 }
-device_initcall(big_key_init);
+late_initcall(big_key_init);
-late_initcall(big_key_crypto_init);
diff --git a/security/keys/proc.c b/security/keys/proc.c
index f0611a6368cd..b9f531c9e4fa 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -181,7 +181,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
        struct timespec now;
        unsigned long timo;
        key_ref_t key_ref, skey_ref;
-        char xbuf[12];
+        char xbuf[16];
        int rc;
        struct keyring_search_context ctx = {
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index dcc102813aef..37d9cfbc29f9 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -448,8 +448,8 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
                ktime_get_ts64(&tm);
                tm = timespec64_sub(tm, tmr->last_update);
-                cur_time.tv_nsec = tm.tv_nsec;
+                cur_time.tv_nsec += tm.tv_nsec;
-                cur_time.tv_sec = tm.tv_sec;
+                cur_time.tv_sec += tm.tv_sec;
                snd_seq_sanity_real_time(&cur_time);
        }
        spin_unlock_irqrestore(&tmr->lock, flags);
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index d17937b92331..7e3aa50b21f9 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -111,7 +111,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                return -EINVAL;
        hm = kmalloc(sizeof(*hm), GFP_KERNEL);
-        hr = kmalloc(sizeof(*hr), GFP_KERNEL);
+        hr = kzalloc(sizeof(*hr), GFP_KERNEL);
        if (!hm || !hr) {
                err = -ENOMEM;
                goto out;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index c3469f756ec2..c64d986009a9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -341,8 +341,7 @@ enum {
 /* quirks for Nvidia */
 #define AZX_DCAPS_PRESET_NVIDIA \
-        (AZX_DCAPS_NO_MSI | /*AZX_DCAPS_ALIGN_BUFSIZE |*/ \
+        (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
-         AZX_DCAPS_NO_64BIT | AZX_DCAPS_CORBRP_SELF_CLEAR |\
         AZX_DCAPS_SNOOP_TYPE(NVIDIA))
 #define AZX_DCAPS_PRESET_CTHDA \
@@ -1716,6 +1715,10 @@ static int azx_first_init(struct azx *chip)
                }
        }
+        /* NVidia hardware normally only supports up to 40 bits of DMA */
+        if (chip->pci->vendor == PCI_VENDOR_ID_NVIDIA)
+                dma_bits = 40;
        /* disable 64bit DMA address on some devices */
        if (chip->driver_caps & AZX_DCAPS_NO_64BIT) {
                dev_dbg(card->dev, "Disabling 64bit DMA\n");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b58e8c76346a..2f909dd8b7b8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5811,8 +5811,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 #define ALC295_STANDARD_PINS \
        {0x12, 0xb7a60130}, \
        {0x14, 0x90170110}, \
-        {0x17, 0x21014020}, \
-        {0x18, 0x21a19030}, \
        {0x21, 0x04211020}
 #define ALC298_STANDARD_PINS \
@@ -5859,11 +5857,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x1b, 0x02011020},
                {0x21, 0x0221101f}),
        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x14, 0x90170110},
+                {0x1b, 0x01011020},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                {0x14, 0x90170130},
                {0x1b, 0x01014020},
                {0x21, 0x0221103f}),
        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                {0x14, 0x90170130},
+                {0x1b, 0x01011020},
+                {0x21, 0x0221103f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x14, 0x90170130},
                {0x1b, 0x02011020},
                {0x21, 0x0221103f}),
        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -6039,7 +6045,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                ALC292_STANDARD_PINS,
                {0x13, 0x90a60140}),
        SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-                ALC295_STANDARD_PINS),
+                ALC295_STANDARD_PINS,
+                {0x17, 0x21014020},
+                {0x18, 0x21a19030}),
+        SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC295_STANDARD_PINS,
+                {0x17, 0x21014040},
+                {0x18, 0x21a19050}),
        SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
                ALC298_STANDARD_PINS,
                {0x17, 0x90170110}),
@@ -6613,6 +6625,7 @@ enum {
        ALC891_FIXUP_HEADSET_MODE,
        ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
        ALC662_FIXUP_ACER_VERITON,
+        ALC892_FIXUP_ASROCK_MOBO,
 };
 static const struct hda_fixup alc662_fixups[] = {
@@ -6889,6 +6902,16 @@ static const struct hda_fixup alc662_fixups[] = {
                        { }
                }
        },
+        [ALC892_FIXUP_ASROCK_MOBO] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x15, 0x40f000f0 }, /* disabled */
+                        { 0x16, 0x40f000f0 }, /* disabled */
+                        { 0x18, 0x01014011 }, /* LO */
+                        { 0x1a, 0x01014012 }, /* LO */
+                        { }
+                }
+        },
 };
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6926,6 +6949,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x1849, 0x5892, "ASRock B150M", ALC892_FIXUP_ASROCK_MOBO),
        SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
        SND_PCI_QUIRK(0x1b0a, 0x01b8, "ACER Veriton", ALC662_FIXUP_ACER_VERITON),
        SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index c60a776e815d..8a59d4782a0f 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2907,6 +2907,23 @@ AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
 AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
 AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+/* Syntek STK1160 */
+{
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+                       USB_DEVICE_ID_MATCH_INT_CLASS |
+                       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+        .idVendor = 0x05e1,
+        .idProduct = 0x0408,
+        .bInterfaceClass = USB_CLASS_AUDIO,
+        .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+        .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+                .vendor_name = "Syntek",
+                .product_name = "STK1160",
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_AUDIO_ALIGN_TRANSFER
+        }
+},
 /* Digidesign Mbox */
 {
        /* Thanks to Clemens Ladisch <clemens@ladisch.de> */
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 4490601a9235..e8a1f699058a 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -754,7 +754,7 @@ static struct rela *find_switch_table(struct objtool_file *file,
                if (insn->type == INSN_JUMP_UNCONDITIONAL &&
                    insn->jump_dest &&
                    (insn->jump_dest->offset <= insn->offset ||
-                     insn->jump_dest->offset >= orig_insn->offset))
+                     insn->jump_dest->offset > orig_insn->offset))
                    break;
                text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 28510e72618a..2907b7b78654 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1346,21 +1346,19 @@ unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *w
 static int get_user_page_nowait(unsigned long start, int write,
                struct page **page)
 {
-        int flags = FOLL_TOUCH | FOLL_NOWAIT | FOLL_HWPOISON | FOLL_GET;
+        int flags = FOLL_NOWAIT | FOLL_HWPOISON;
        if (write)
                flags |= FOLL_WRITE;
-        return __get_user_pages(current, current->mm, start, 1, flags, page,
+        return get_user_pages(start, 1, flags, page, NULL);
-                        NULL, NULL);
 }
 static inline int check_user_page_hwpoison(unsigned long addr)
 {
-        int rc, flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_WRITE;
+        int rc, flags = FOLL_HWPOISON | FOLL_WRITE;
-        rc = __get_user_pages(current, current->mm, addr, 1,
+        rc = get_user_pages(addr, 1, flags, NULL, NULL);
-                              flags, NULL, NULL, NULL);
        return rc == -EHWPOISON;
 }