291 files changed, 2853 insertions, 1585 deletions
diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt
index e8d25e784214..ff49cf901148 100644
--- a/Documentation/cgroup-v2.txt
+++ b/Documentation/cgroup-v2.txt
@@ -7,7 +7,7 @@ This is the authoritative documentation on the design, interface and
 conventions of cgroup v2.  It describes all userland-visible aspects
 of cgroup including core and specific controller behaviors.  All
 future changes must be reflected in this document.  Documentation for
-v1 is available under Documentation/cgroup-legacy/.
+v1 is available under Documentation/cgroup-v1/.
 CONTENTS
diff --git a/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt b/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
index 4e8b90e43dd8..07a75094c5a8 100644
--- a/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
+++ b/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
@@ -8,6 +8,7 @@ OHCI and EHCI controllers.
 Required properties:
 - compatible: "renesas,pci-r8a7790" for the R8A7790 SoC;
              "renesas,pci-r8a7791" for the R8A7791 SoC;
+              "renesas,pci-r8a7793" for the R8A7793 SoC;
              "renesas,pci-r8a7794" for the R8A7794 SoC;
              "renesas,pci-rcar-gen2" for a generic R-Car Gen2 compatible device
diff --git a/Documentation/devicetree/bindings/pci/rcar-pci.txt b/Documentation/devicetree/bindings/pci/rcar-pci.txt
index 558fe528ae19..6cf99690eef9 100644
--- a/Documentation/devicetree/bindings/pci/rcar-pci.txt
+++ b/Documentation/devicetree/bindings/pci/rcar-pci.txt
@@ -4,6 +4,7 @@ Required properties:
 compatible: "renesas,pcie-r8a7779" for the R8A7779 SoC;
            "renesas,pcie-r8a7790" for the R8A7790 SoC;
            "renesas,pcie-r8a7791" for the R8A7791 SoC;
+            "renesas,pcie-r8a7793" for the R8A7793 SoC;
            "renesas,pcie-r8a7795" for the R8A7795 SoC;
            "renesas,pcie-rcar-gen2" for a generic R-Car Gen2 compatible device.
diff --git a/Documentation/devicetree/bindings/sound/fsl-asoc-card.txt b/Documentation/devicetree/bindings/sound/fsl-asoc-card.txt
index ce55c0a6f757..4da41bf1888e 100644
--- a/Documentation/devicetree/bindings/sound/fsl-asoc-card.txt
+++ b/Documentation/devicetree/bindings/sound/fsl-asoc-card.txt
@@ -30,6 +30,8 @@ The compatible list for this generic sound card currently:
 "fsl,imx-audio-sgtl5000"
 (compatible with Documentation/devicetree/bindings/sound/imx-audio-sgtl5000.txt)
+ "fsl,imx-audio-wm8960"
 Required properties:
  - compatible          : Contains one of entries in the compatible list.
diff --git a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
index 332e625f6ed0..e5ee3f159893 100644
--- a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
@@ -1,8 +1,9 @@
 * Renesas R-Car Thermal
 Required properties:
- compatible            : "renesas,thermal-<soctype>", "renesas,rcar-thermal"
+- compatible            : "renesas,thermal-<soctype>",
-                          as fallback.
+                           "renesas,rcar-gen2-thermal" (with thermal-zone) or
+                           "renesas,rcar-thermal" (without thermal-zone) as fallback.
                          Examples with soctypes are:
                            - "renesas,thermal-r8a73a4" (R-Mobile APE6)
                            - "renesas,thermal-r8a7779" (R-Car H1)
@@ -36,3 +37,35 @@ thermal@e61f0000 {
                0xe61f0300 0x38>;
        interrupts = <0 69 IRQ_TYPE_LEVEL_HIGH>;
 };
+Example (with thermal-zone):
+thermal-zones {
+        cpu_thermal: cpu-thermal {
+                polling-delay-passive   = <1000>;
+                polling-delay           = <5000>;
+                thermal-sensors = <&thermal>;
+                trips {
+                        cpu-crit {
+                                temperature     = <115000>;
+                                hysteresis      = <0>;
+                                type            = "critical";
+                        };
+                };
+                cooling-maps {
+                };
+        };
+};
+thermal: thermal@e61f0000 {
+        compatible =    "renesas,thermal-r8a7790",
+                        "renesas,rcar-gen2-thermal",
+                        "renesas,rcar-thermal";
+        reg = <0 0xe61f0000 0 0x14>, <0 0xe61f0100 0 0x38>;
+        interrupts = <0 69 IRQ_TYPE_LEVEL_HIGH>;
+        clocks = <&mstp5_clks R8A7790_CLK_THERMAL>;
+        power-domains = <&cpg_clocks>;
+        #thermal-sensor-cells = <0>;
+};
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 551ecf09c8dd..9a53c929f017 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -4235,6 +4235,17 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        The default value of this parameter is determined by
                        the config option CONFIG_WQ_POWER_EFFICIENT_DEFAULT.
+        workqueue.debug_force_rr_cpu
+                        Workqueue used to implicitly guarantee that work
+                        items queued without explicit CPU specified are put
+                        on the local CPU.  This guarantee is no longer true
+                        and while local CPU is still preferred work items
+                        may be put on foreign CPUs.  This debug option
+                        forces round-robin CPU selection to flush out
+                        usages which depend on the now broken guarantee.
+                        When enabled, memory and cache locality will be
+                        impacted.
        x2apic_phys     [X86-64,APIC] Use x2apic physical mode instead of
                        default x2apic cluster mode on platforms
                        supporting x2apic.
diff --git a/MAINTAINERS b/MAINTAINERS
index 7f1fa4ff300a..cc2f753cb357 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2362,14 +2362,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rpi/linux-rpi.git
 S:      Maintained
 N:      bcm2835
-BROADCOM BCM33XX MIPS ARCHITECTURE
-M:      Kevin Cernekee <cernekee@gmail.com>
-L:      linux-mips@linux-mips.org
-S:      Maintained
-F:      arch/mips/bcm3384/*
-F:      arch/mips/include/asm/mach-bcm3384/*
-F:      arch/mips/kernel/*bmips*
 BROADCOM BCM47XX MIPS ARCHITECTURE
 M:      Hauke Mehrtens <hauke@hauke-m.de>
 M:      Rafał Miłecki <zajec5@gmail.com>
@@ -9787,10 +9779,11 @@ S:	Supported
 F:      drivers/scsi/be2iscsi/
 Emulex 10Gbps NIC BE2, BE3-R, Lancer, Skyhawk-R DRIVER
-M:      Sathya Perla <sathya.perla@avagotech.com>
+M:      Sathya Perla <sathya.perla@broadcom.com>
-M:      Ajit Khaparde <ajit.khaparde@avagotech.com>
+M:      Ajit Khaparde <ajit.khaparde@broadcom.com>
-M:      Padmanabh Ratnakar <padmanabh.ratnakar@avagotech.com>
+M:      Padmanabh Ratnakar <padmanabh.ratnakar@broadcom.com>
-M:      Sriharsha Basavapatna <sriharsha.basavapatna@avagotech.com>
+M:      Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
+M:      Somnath Kotur <somnath.kotur@broadcom.com>
 L:      netdev@vger.kernel.org
 W:      http://www.emulex.com
 S:      Supported
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 76dde9db7934..0655495470ad 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -338,6 +338,19 @@ config ARC_PAGE_SIZE_4K
 endchoice
+choice
+        prompt "MMU Super Page Size"
+        depends on ISA_ARCV2 && TRANSPARENT_HUGEPAGE
+        default ARC_HUGEPAGE_2M
+config ARC_HUGEPAGE_2M
+        bool "2MB"
+config ARC_HUGEPAGE_16M
+        bool "16MB"
+endchoice
 if ISA_ARCOMPACT
 config ARC_COMPACT_IRQ_LEVELS
@@ -410,7 +423,7 @@ config ARC_HAS_RTC
        default n
        depends on !SMP
-config ARC_HAS_GRTC
+config ARC_HAS_GFRC
        bool "SMP synchronized 64-bit cycle counter"
        default y
        depends on SMP
@@ -566,6 +579,12 @@ endmenu
 endmenu  # "ARC Architecture Configuration"
 source "mm/Kconfig"
+config FORCE_MAX_ZONEORDER
+        int "Maximum zone order"
+        default "12" if ARC_HUGEPAGE_16M
+        default "11"
 source "net/Kconfig"
 source "drivers/Kconfig"
 source "fs/Kconfig"
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index f36c047b33ca..735985974a31 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -16,7 +16,7 @@ CONFIG_ARC_PLAT_AXS10X=y
 CONFIG_AXS103=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
-# CONFIG_ARC_HAS_GRTC is not set
+# CONFIG_ARC_HAS_GFRC is not set
 CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38_smp"
 CONFIG_PREEMPT=y
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 7fac7d85ed6a..fdc5be5b1029 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -349,14 +349,13 @@ struct cpuinfo_arc {
        struct cpuinfo_arc_bpu bpu;
        struct bcr_identity core;
        struct bcr_isa isa;
-        struct bcr_timer timers;
        unsigned int vec_base;
        struct cpuinfo_arc_ccm iccm, dccm;
        struct {
                unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, pad1:3,
                             fpu_sp:1, fpu_dp:1, pad2:6,
                             debug:1, ap:1, smart:1, rtt:1, pad3:4,
-                             pad4:8;
+                             timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
        } extn;
        struct bcr_mpy extn_mpy;
        struct bcr_extn_xymem extn_xymem;
diff --git a/arch/arc/include/asm/irqflags-arcv2.h b/arch/arc/include/asm/irqflags-arcv2.h
index 258b0e5ad332..1fc18ee06cf2 100644
--- a/arch/arc/include/asm/irqflags-arcv2.h
+++ b/arch/arc/include/asm/irqflags-arcv2.h
@@ -30,8 +30,11 @@
 /* Was Intr taken in User Mode */
 #define AUX_IRQ_ACT_BIT_U       31
-/* 0 is highest level, but taken by FIRQs, if present in design */
+/*
-#define ARCV2_IRQ_DEF_PRIO              0
+ * User space should be interruptable even by lowest prio interrupt
+ * Safe even if actual interrupt priorities is fewer or even one
+ */
+#define ARCV2_IRQ_DEF_PRIO      15
 /* seed value for status register */
 #define ISA_INIT_STATUS_BITS    (STATUS_IE_MASK | STATUS_AD_MASK | \
diff --git a/arch/arc/include/asm/mcip.h b/arch/arc/include/asm/mcip.h
index 46f4e5351b2a..847e3bbe387f 100644
--- a/arch/arc/include/asm/mcip.h
+++ b/arch/arc/include/asm/mcip.h
@@ -39,8 +39,8 @@ struct mcip_cmd {
 #define CMD_DEBUG_SET_MASK              0x34
 #define CMD_DEBUG_SET_SELECT            0x36
-#define CMD_GRTC_READ_LO                0x42
+#define CMD_GFRC_READ_LO                0x42
-#define CMD_GRTC_READ_HI                0x43
+#define CMD_GFRC_READ_HI                0x43
 #define CMD_IDU_ENABLE                  0x71
 #define CMD_IDU_DISABLE                 0x72
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 57af2f05ae84..d426d4215513 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -179,37 +179,44 @@
 #define __S111  PAGE_U_X_W_R
 /****************************************************************
- * Page Table Lookup split
+ * 2 tier (PGD:PTE) software page walker
 *
- * We implement 2 tier paging and since this is all software, we are free
+ * [31]             32 bit virtual address              [0]
- * to customize the span of a PGD / PTE entry to suit us
- *
- *                      32 bit virtual address
 * -------------------------------------------------------
- * | BITS_FOR_PGD    |  BITS_FOR_PTE    |  BITS_IN_PAGE  |
+ * |               | <------------ PGDIR_SHIFT ----------> |
+ * |               |                                     |
+ * | BITS_FOR_PGD  |  BITS_FOR_PTE  | <-- PAGE_SHIFT --> |
 * -------------------------------------------------------
 *       |                  |                |
 *       |                  |                --> off in page frame
- *       |                  |
 *       |                  ---> index into Page Table
- *       |
 *       ----> index into Page Directory
+ *
+ * In a single page size configuration, only PAGE_SHIFT is fixed
+ * So both PGD and PTE sizing can be tweaked
+ *  e.g. 8K page (PAGE_SHIFT 13) can have
+ *  - PGDIR_SHIFT 21  -> 11:8:13 address split
+ *  - PGDIR_SHIFT 24  -> 8:11:13 address split
+ *
+ * If Super Page is configured, PGDIR_SHIFT becomes fixed too,
+ * so the sizing flexibility is gone.
 */
-#define BITS_IN_PAGE    PAGE_SHIFT
+#if defined(CONFIG_ARC_HUGEPAGE_16M)
+#define PGDIR_SHIFT     24
-/* Optimal Sizing of Pg Tbl - based on MMU page size */
+#elif defined(CONFIG_ARC_HUGEPAGE_2M)
-#if defined(CONFIG_ARC_PAGE_SIZE_8K)
+#define PGDIR_SHIFT     21
-#define BITS_FOR_PTE    8               /* 11:8:13 */
+#else
-#elif defined(CONFIG_ARC_PAGE_SIZE_16K)
+/*
-#define BITS_FOR_PTE    8               /* 10:8:14 */
+ * Only Normal page support so "hackable" (see comment above)
-#elif defined(CONFIG_ARC_PAGE_SIZE_4K)
+ * Default value provides 11:8:13 (8K), 11:9:12 (4K)
-#define BITS_FOR_PTE    9               /* 11:9:12 */
+ */
+#define PGDIR_SHIFT     21
 #endif
-#define BITS_FOR_PGD    (32 - BITS_FOR_PTE - BITS_IN_PAGE)
+#define BITS_FOR_PTE    (PGDIR_SHIFT - PAGE_SHIFT)
+#define BITS_FOR_PGD    (32 - PGDIR_SHIFT)
-#define PGDIR_SHIFT     (32 - BITS_FOR_PGD)
 #define PGDIR_SIZE      (1UL << PGDIR_SHIFT)    /* vaddr span, not PDG sz */
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index cbfec79137bf..b17830294706 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -211,7 +211,11 @@ debug_marker_syscall:
 ; (since IRQ NOT allowed in DS in ARCv2, this can only happen if orig
 ; entry was via Exception in DS which got preempted in kernel).
 ;
-; IRQ RTIE won't reliably restore DE bit and/or BTA, needs handling
+; IRQ RTIE won't reliably restore DE bit and/or BTA, needs workaround
+;
+; Solution is return from Intr w/o any delay slot quirks into a kernel trampoline
+; and from pure kernel mode return to delay slot which handles DS bit/BTA correctly
 .Lintr_ret_to_delay_slot:
 debug_marker_ds:
@@ -222,18 +226,23 @@ debug_marker_ds:
        ld      r2, [sp, PT_ret]
        ld      r3, [sp, PT_status32]
+        ; STAT32 for Int return created from scratch
+        ; (No delay dlot, disable Further intr in trampoline)
        bic     r0, r3, STATUS_U_MASK|STATUS_DE_MASK|STATUS_IE_MASK|STATUS_L_MASK
        st      r0, [sp, PT_status32]
        mov     r1, .Lintr_ret_to_delay_slot_2
        st      r1, [sp, PT_ret]
+        ; Orig exception PC/STAT32 safekept @orig_r0 and @event stack slots
        st      r2, [sp, 0]
        st      r3, [sp, 4]
        b       .Lisr_ret_fast_path
 .Lintr_ret_to_delay_slot_2:
+        ; Trampoline to restore orig exception PC/STAT32/BTA/AUX_USER_SP
        sub     sp, sp, SZ_PT_REGS
        st      r9, [sp, -4]
@@ -243,11 +252,19 @@ debug_marker_ds:
        ld      r9, [sp, 4]
        sr      r9, [erstatus]
+        ; restore AUX_USER_SP if returning to U mode
+        bbit0   r9, STATUS_U_BIT, 1f
+        ld      r9, [sp, PT_sp]
+        sr      r9, [AUX_USER_SP]
+1:
        ld      r9, [sp, 8]
        sr      r9, [erbta]
        ld      r9, [sp, -4]
        add     sp, sp, SZ_PT_REGS
+        ; return from pure kernel mode to delay slot
        rtie
 END(ret_from_exception)
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 0394f9f61b46..942526322ae7 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -14,6 +14,8 @@
 #include <linux/irqchip.h>
 #include <asm/irq.h>
+static int irq_prio;
 /*
 * Early Hardware specific Interrupt setup
 * -Called very early (start_kernel -> setup_arch -> setup_processor)
@@ -24,6 +26,14 @@ void arc_init_IRQ(void)
 {
        unsigned int tmp;
+        struct irq_build {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+                unsigned int pad:3, firq:1, prio:4, exts:8, irqs:8, ver:8;
+#else
+                unsigned int ver:8, irqs:8, exts:8, prio:4, firq:1, pad:3;
+#endif
+        } irq_bcr;
        struct aux_irq_ctrl {
 #ifdef CONFIG_CPU_BIG_ENDIAN
                unsigned int res3:18, save_idx_regs:1, res2:1,
@@ -46,28 +56,25 @@ void arc_init_IRQ(void)
        WRITE_AUX(AUX_IRQ_CTRL, ictrl);
-        /* setup status32, don't enable intr yet as kernel doesn't want */
-        tmp = read_aux_reg(0xa);
-        tmp |= ISA_INIT_STATUS_BITS;
-        tmp &= ~STATUS_IE_MASK;
-        asm volatile("flag %0   \n"::"r"(tmp));
        /*
         * ARCv2 core intc provides multiple interrupt priorities (upto 16).
         * Typical builds though have only two levels (0-high, 1-low)
         * Linux by default uses lower prio 1 for most irqs, reserving 0 for
         * NMI style interrupts in future (say perf)
-         *
-         * Read the intc BCR to confirm that Linux default priority is avail
-         * in h/w
-         *
-         * Note:
-         *  IRQ_BCR[27..24] contains N-1 (for N priority levels) and prio level
-         *  is 0 based.
         */
-        tmp = (read_aux_reg(ARC_REG_IRQ_BCR) >> 24 ) & 0xF;
-        if (ARCV2_IRQ_DEF_PRIO > tmp)
+        READ_BCR(ARC_REG_IRQ_BCR, irq_bcr);
-                panic("Linux default irq prio incorrect\n");
+        irq_prio = irq_bcr.prio;        /* Encoded as N-1 for N levels */
+        pr_info("archs-intc\t: %d priority levels (default %d)%s\n",
+                irq_prio + 1, irq_prio,
+                irq_bcr.firq ? " FIRQ (not used)":"");
+        /* setup status32, don't enable intr yet as kernel doesn't want */
+        tmp = read_aux_reg(0xa);
+        tmp |= STATUS_AD_MASK | (irq_prio << 1);
+        tmp &= ~STATUS_IE_MASK;
+        asm volatile("flag %0   \n"::"r"(tmp));
 }
 static void arcv2_irq_mask(struct irq_data *data)
@@ -86,7 +93,7 @@ void arcv2_irq_enable(struct irq_data *data)
 {
        /* set default priority */
        write_aux_reg(AUX_IRQ_SELECT, data->irq);
-        write_aux_reg(AUX_IRQ_PRIORITY, ARCV2_IRQ_DEF_PRIO);
+        write_aux_reg(AUX_IRQ_PRIORITY, irq_prio);
        /*
         * hw auto enables (linux unmask) all by default
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index bd237acdf4f2..bc771f58fefb 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -96,13 +96,13 @@ static void mcip_probe_n_setup(void)
 #ifdef CONFIG_CPU_BIG_ENDIAN
                unsigned int pad3:8,
                             idu:1, llm:1, num_cores:6,
-                             iocoh:1,  grtc:1, dbg:1, pad2:1,
+                             iocoh:1,  gfrc:1, dbg:1, pad2:1,
                             msg:1, sem:1, ipi:1, pad:1,
                             ver:8;
 #else
                unsigned int ver:8,
                             pad:1, ipi:1, sem:1, msg:1,
-                             pad2:1, dbg:1, grtc:1, iocoh:1,
+                             pad2:1, dbg:1, gfrc:1, iocoh:1,
                             num_cores:6, llm:1, idu:1,
                             pad3:8;
 #endif
@@ -116,7 +116,7 @@ static void mcip_probe_n_setup(void)
                IS_AVAIL1(mp.ipi, "IPI "),
                IS_AVAIL1(mp.idu, "IDU "),
                IS_AVAIL1(mp.dbg, "DEBUG "),
-                IS_AVAIL1(mp.grtc, "GRTC"));
+                IS_AVAIL1(mp.gfrc, "GFRC"));
        idu_detected = mp.idu;
@@ -125,8 +125,8 @@ static void mcip_probe_n_setup(void)
                __mcip_cmd_data(CMD_DEBUG_SET_MASK, 0xf, 0xf);
        }
-        if (IS_ENABLED(CONFIG_ARC_HAS_GRTC) && !mp.grtc)
+        if (IS_ENABLED(CONFIG_ARC_HAS_GFRC) && !mp.gfrc)
-                panic("kernel trying to use non-existent GRTC\n");
+                panic("kernel trying to use non-existent GFRC\n");
 }
 struct plat_smp_ops plat_smp_ops = {
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index e1b87444ea9a..a7edceba5f84 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -45,6 +45,7 @@ struct cpuinfo_arc cpuinfo_arc700[NR_CPUS];
 static void read_arc_build_cfg_regs(void)
 {
        struct bcr_perip uncached_space;
+        struct bcr_timer timer;
        struct bcr_generic bcr;
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
        unsigned long perip_space;
@@ -53,7 +54,11 @@ static void read_arc_build_cfg_regs(void)
        READ_BCR(AUX_IDENTITY, cpu->core);
        READ_BCR(ARC_REG_ISA_CFG_BCR, cpu->isa);
-        READ_BCR(ARC_REG_TIMERS_BCR, cpu->timers);
+        READ_BCR(ARC_REG_TIMERS_BCR, timer);
+        cpu->extn.timer0 = timer.t0;
+        cpu->extn.timer1 = timer.t1;
+        cpu->extn.rtc = timer.rtc;
        cpu->vec_base = read_aux_reg(AUX_INTR_VEC_BASE);
        READ_BCR(ARC_REG_D_UNCACH_BCR, uncached_space);
@@ -208,9 +213,9 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                       (unsigned int)(arc_get_core_freq() / 10000) % 100);
        n += scnprintf(buf + n, len - n, "Timers\t\t: %s%s%s%s\nISA Extn\t: ",
-                       IS_AVAIL1(cpu->timers.t0, "Timer0 "),
+                       IS_AVAIL1(cpu->extn.timer0, "Timer0 "),
-                       IS_AVAIL1(cpu->timers.t1, "Timer1 "),
+                       IS_AVAIL1(cpu->extn.timer1, "Timer1 "),
-                       IS_AVAIL2(cpu->timers.rtc, "64-bit RTC ",
+                       IS_AVAIL2(cpu->extn.rtc, "Local-64-bit-Ctr ",
                                 CONFIG_ARC_HAS_RTC));
        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s",
@@ -293,13 +298,13 @@ static void arc_chk_core_config(void)
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
        int fpu_enabled;
-        if (!cpu->timers.t0)
+        if (!cpu->extn.timer0)
                panic("Timer0 is not present!\n");
-        if (!cpu->timers.t1)
+        if (!cpu->extn.timer1)
                panic("Timer1 is not present!\n");
-        if (IS_ENABLED(CONFIG_ARC_HAS_RTC) && !cpu->timers.rtc)
+        if (IS_ENABLED(CONFIG_ARC_HAS_RTC) && !cpu->extn.rtc)
                panic("RTC is not present\n");
 #ifdef CONFIG_ARC_HAS_DCCM
@@ -334,6 +339,7 @@ static void arc_chk_core_config(void)
                panic("FPU non-existent, disable CONFIG_ARC_FPU_SAVE_RESTORE\n");
        if (is_isa_arcv2() && IS_ENABLED(CONFIG_SMP) && cpu->isa.atomic &&
+            IS_ENABLED(CONFIG_ARC_HAS_LLSC) &&
            !IS_ENABLED(CONFIG_ARC_STAR_9000923308))
                panic("llock/scond livelock workaround missing\n");
 }
diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c
index dfad287f1db1..156d9833ff84 100644
--- a/arch/arc/kernel/time.c
+++ b/arch/arc/kernel/time.c
@@ -62,7 +62,7 @@
 /********** Clock Source Device *********/
-#ifdef CONFIG_ARC_HAS_GRTC
+#ifdef CONFIG_ARC_HAS_GFRC
 static int arc_counter_setup(void)
 {
@@ -83,10 +83,10 @@ static cycle_t arc_counter_read(struct clocksource *cs)
        local_irq_save(flags);
-        __mcip_cmd(CMD_GRTC_READ_LO, 0);
+        __mcip_cmd(CMD_GFRC_READ_LO, 0);
        stamp.l = read_aux_reg(ARC_REG_MCIP_READBACK);
-        __mcip_cmd(CMD_GRTC_READ_HI, 0);
+        __mcip_cmd(CMD_GFRC_READ_HI, 0);
        stamp.h = read_aux_reg(ARC_REG_MCIP_READBACK);
        local_irq_restore(flags);
@@ -95,7 +95,7 @@ static cycle_t arc_counter_read(struct clocksource *cs)
 }
 static struct clocksource arc_counter = {
-        .name   = "ARConnect GRTC",
+        .name   = "ARConnect GFRC",
        .rating = 400,
        .read   = arc_counter_read,
        .mask   = CLOCKSOURCE_MASK(64),
diff --git a/arch/arm/common/icst.c b/arch/arm/common/icst.c
index 2dc6da70ae59..d7ed252708c5 100644
--- a/arch/arm/common/icst.c
+++ b/arch/arm/common/icst.c
@@ -16,7 +16,7 @@
 */
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <asm/div64.h>
 #include <asm/hardware/icst.h>
 /*
@@ -29,7 +29,11 @@ EXPORT_SYMBOL(icst525_s2div);
 unsigned long icst_hz(const struct icst_params *p, struct icst_vco vco)
 {
-        return p->ref * 2 * (vco.v + 8) / ((vco.r + 2) * p->s2div[vco.s]);
+        u64 dividend = p->ref * 2 * (u64)(vco.v + 8);
+        u32 divisor = (vco.r + 2) * p->s2div[vco.s];
+        do_div(dividend, divisor);
+        return (unsigned long)dividend;
 }
 EXPORT_SYMBOL(icst_hz);
@@ -58,6 +62,7 @@ icst_hz_to_vco(const struct icst_params *p, unsigned long freq)
                if (f > p->vco_min && f <= p->vco_max)
                        break;
+                i++;
        } while (i < 8);
        if (i >= 8)
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index a7151744b85c..d18d6b42fcf5 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -292,24 +292,23 @@ CONFIG_FB=y
 CONFIG_FIRMWARE_EDID=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
-CONFIG_OMAP2_DSS=m
+CONFIG_FB_OMAP5_DSS_HDMI=y
-CONFIG_OMAP5_DSS_HDMI=y
+CONFIG_FB_OMAP2_DSS_SDI=y
-CONFIG_OMAP2_DSS_SDI=y
+CONFIG_FB_OMAP2_DSS_DSI=y
-CONFIG_OMAP2_DSS_DSI=y
 CONFIG_FB_OMAP2=m
-CONFIG_DISPLAY_ENCODER_TFP410=m
+CONFIG_FB_OMAP2_ENCODER_TFP410=m
-CONFIG_DISPLAY_ENCODER_TPD12S015=m
+CONFIG_FB_OMAP2_ENCODER_TPD12S015=m
-CONFIG_DISPLAY_CONNECTOR_DVI=m
+CONFIG_FB_OMAP2_CONNECTOR_DVI=m
-CONFIG_DISPLAY_CONNECTOR_HDMI=m
+CONFIG_FB_OMAP2_CONNECTOR_HDMI=m
-CONFIG_DISPLAY_CONNECTOR_ANALOG_TV=m
+CONFIG_FB_OMAP2_CONNECTOR_ANALOG_TV=m
-CONFIG_DISPLAY_PANEL_DPI=m
+CONFIG_FB_OMAP2_PANEL_DPI=m
-CONFIG_DISPLAY_PANEL_DSI_CM=m
+CONFIG_FB_OMAP2_PANEL_DSI_CM=m
-CONFIG_DISPLAY_PANEL_SONY_ACX565AKM=m
+CONFIG_FB_OMAP2_PANEL_SONY_ACX565AKM=m
-CONFIG_DISPLAY_PANEL_LGPHILIPS_LB035Q02=m
+CONFIG_FB_OMAP2_PANEL_LGPHILIPS_LB035Q02=m
-CONFIG_DISPLAY_PANEL_SHARP_LS037V7DW01=m
+CONFIG_FB_OMAP2_PANEL_SHARP_LS037V7DW01=m
-CONFIG_DISPLAY_PANEL_TPO_TD028TTEC1=m
+CONFIG_FB_OMAP2_PANEL_TPO_TD028TTEC1=m
-CONFIG_DISPLAY_PANEL_TPO_TD043MTEA1=m
+CONFIG_FB_OMAP2_PANEL_TPO_TD043MTEA1=m
-CONFIG_DISPLAY_PANEL_NEC_NL8048HL11=m
+CONFIG_FB_OMAP2_PANEL_NEC_NL8048HL11=m
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_LCD_CLASS_DEVICE=y
 CONFIG_LCD_PLATFORM=y
diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
index 2731d3b25ed2..8ec88e5b290f 100644
--- a/arch/arm64/include/asm/arch_gicv3.h
+++ b/arch/arm64/include/asm/arch_gicv3.h
@@ -103,6 +103,7 @@ static inline u64 gic_read_iar_common(void)
        u64 irqstat;
        asm volatile("mrs_s %0, " __stringify(ICC_IAR1_EL1) : "=r" (irqstat));
+        dsb(sy);
        return irqstat;
 }
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 738a95f93e49..bef6e9243c63 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -182,6 +182,7 @@
 #define CPTR_EL2_TCPAC  (1 << 31)
 #define CPTR_EL2_TTA    (1 << 20)
 #define CPTR_EL2_TFP    (1 << CPTR_EL2_TFP_SHIFT)
+#define CPTR_EL2_DEFAULT        0x000033ff
 /* Hyp Debug Configuration Register bits */
 #define MDCR_EL2_TDRA           (1 << 11)
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 3066328cd86b..779a5872a2c5 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -127,10 +127,14 @@ static inline unsigned long *vcpu_spsr(const struct kvm_vcpu *vcpu)
 static inline bool vcpu_mode_priv(const struct kvm_vcpu *vcpu)
 {
-        u32 mode = *vcpu_cpsr(vcpu) & PSR_MODE_MASK;
+        u32 mode;
-        if (vcpu_mode_is_32bit(vcpu))
+        if (vcpu_mode_is_32bit(vcpu)) {
+                mode = *vcpu_cpsr(vcpu) & COMPAT_PSR_MODE_MASK;
                return mode > COMPAT_PSR_MODE_USR;
+        }
+        mode = *vcpu_cpsr(vcpu) & PSR_MODE_MASK;
        return mode != PSR_MODE_EL0t;
 }
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index ca8f5a5e2f96..f0e7bdfae134 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -36,7 +36,11 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
        write_sysreg(val, hcr_el2);
        /* Trap on AArch32 cp15 c15 accesses (EL1 or EL0) */
        write_sysreg(1 << 15, hstr_el2);
-        write_sysreg(CPTR_EL2_TTA | CPTR_EL2_TFP, cptr_el2);
+        val = CPTR_EL2_DEFAULT;
+        val |= CPTR_EL2_TTA | CPTR_EL2_TFP;
+        write_sysreg(val, cptr_el2);
        write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
 }
@@ -45,7 +49,7 @@ static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
        write_sysreg(HCR_RW, hcr_el2);
        write_sysreg(0, hstr_el2);
        write_sysreg(read_sysreg(mdcr_el2) & MDCR_EL2_HPMN_MASK, mdcr_el2);
-        write_sysreg(0, cptr_el2);
+        write_sysreg(CPTR_EL2_DEFAULT, cptr_el2);
 }
 static void __hyp_text __activate_vm(struct kvm_vcpu *vcpu)
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index 648112e90ed5..4d1ac81870d2 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -27,7 +27,11 @@
 #define PSTATE_FAULT_BITS_64    (PSR_MODE_EL1h | PSR_A_BIT | PSR_F_BIT | \
                                 PSR_I_BIT | PSR_D_BIT)
-#define EL1_EXCEPT_SYNC_OFFSET  0x200
+#define CURRENT_EL_SP_EL0_VECTOR        0x0
+#define CURRENT_EL_SP_ELx_VECTOR        0x200
+#define LOWER_EL_AArch64_VECTOR         0x400
+#define LOWER_EL_AArch32_VECTOR         0x600
 static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
 {
@@ -97,6 +101,34 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt,
                *fsr = 0x14;
 }
+enum exception_type {
+        except_type_sync        = 0,
+        except_type_irq         = 0x80,
+        except_type_fiq         = 0x100,
+        except_type_serror      = 0x180,
+};
+static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type)
+{
+        u64 exc_offset;
+        switch (*vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT)) {
+        case PSR_MODE_EL1t:
+                exc_offset = CURRENT_EL_SP_EL0_VECTOR;
+                break;
+        case PSR_MODE_EL1h:
+                exc_offset = CURRENT_EL_SP_ELx_VECTOR;
+                break;
+        case PSR_MODE_EL0t:
+                exc_offset = LOWER_EL_AArch64_VECTOR;
+                break;
+        default:
+                exc_offset = LOWER_EL_AArch32_VECTOR;
+        }
+        return vcpu_sys_reg(vcpu, VBAR_EL1) + exc_offset + type;
+}
 static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
 {
        unsigned long cpsr = *vcpu_cpsr(vcpu);
@@ -108,8 +140,8 @@ static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr
        *vcpu_spsr(vcpu) = cpsr;
        *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
+        *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
        *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-        *vcpu_pc(vcpu) = vcpu_sys_reg(vcpu, VBAR_EL1) + EL1_EXCEPT_SYNC_OFFSET;
        vcpu_sys_reg(vcpu, FAR_EL1) = addr;
@@ -143,8 +175,8 @@ static void inject_undef64(struct kvm_vcpu *vcpu)
        *vcpu_spsr(vcpu) = cpsr;
        *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
+        *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
        *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-        *vcpu_pc(vcpu) = vcpu_sys_reg(vcpu, VBAR_EL1) + EL1_EXCEPT_SYNC_OFFSET;
        /*
         * Build an unknown exception, depending on the instruction
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index eec3598b4184..2e90371cfb37 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1007,10 +1007,9 @@ static int emulate_cp(struct kvm_vcpu *vcpu,
                if (likely(r->access(vcpu, params, r))) {
                        /* Skip instruction, since it was emulated */
                        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+                        /* Handled */
+                        return 0;
                }
-                /* Handled */
-                return 0;
        }
        /* Not handled */
@@ -1043,7 +1042,7 @@ static void unhandled_cp_access(struct kvm_vcpu *vcpu,
 }
 /**
- * kvm_handle_cp_64 -- handles a mrrc/mcrr trap on a guest CP15 access
+ * kvm_handle_cp_64 -- handles a mrrc/mcrr trap on a guest CP14/CP15 access
 * @vcpu: The VCPU pointer
 * @run:  The kvm_run struct
 */
@@ -1095,7 +1094,7 @@ out:
 }
 /**
- * kvm_handle_cp15_32 -- handles a mrc/mcr trap on a guest CP15 access
+ * kvm_handle_cp_32 -- handles a mrc/mcr trap on a guest CP14/CP15 access
 * @vcpu: The VCPU pointer
 * @run:  The kvm_run struct
 */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 57a945e832f4..74a3db92da1b 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2085,7 +2085,7 @@ config PAGE_SIZE_32KB
 config PAGE_SIZE_64KB
        bool "64kB"
-        depends on !CPU_R3000 && !CPU_TX39XX
+        depends on !CPU_R3000 && !CPU_TX39XX && !CPU_R6000
        help
          Using 64kB page size will result in higher performance kernel at
          the price of higher memory consumption.  This option is available on
diff --git a/arch/mips/boot/dts/brcm/bcm6328.dtsi b/arch/mips/boot/dts/brcm/bcm6328.dtsi
index 459b9b252c3b..d61b1616b604 100644
--- a/arch/mips/boot/dts/brcm/bcm6328.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm6328.dtsi
@@ -74,6 +74,7 @@
                timer: timer@10000040 {
                        compatible = "syscon";
                        reg = <0x10000040 0x2c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7125.dtsi b/arch/mips/boot/dts/brcm/bcm7125.dtsi
index 4fc7ecee273c..1a7efa883c5e 100644
--- a/arch/mips/boot/dts/brcm/bcm7125.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7125.dtsi
@@ -98,6 +98,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7125-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x60c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7346.dtsi b/arch/mips/boot/dts/brcm/bcm7346.dtsi
index a3039bb53477..d4bf52cfcf17 100644
--- a/arch/mips/boot/dts/brcm/bcm7346.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7346.dtsi
@@ -118,6 +118,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7346-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7358.dtsi b/arch/mips/boot/dts/brcm/bcm7358.dtsi
index 4274ff41ec21..8e2501694d03 100644
--- a/arch/mips/boot/dts/brcm/bcm7358.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7358.dtsi
@@ -112,6 +112,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7358-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7360.dtsi b/arch/mips/boot/dts/brcm/bcm7360.dtsi
index 0dcc9163c27b..7e5f76040fb8 100644
--- a/arch/mips/boot/dts/brcm/bcm7360.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7360.dtsi
@@ -112,6 +112,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7360-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7362.dtsi b/arch/mips/boot/dts/brcm/bcm7362.dtsi
index 2f3f9fc2c478..c739ea77acb0 100644
--- a/arch/mips/boot/dts/brcm/bcm7362.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7362.dtsi
@@ -118,6 +118,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7362-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7420.dtsi b/arch/mips/boot/dts/brcm/bcm7420.dtsi
index bee221b3b568..5f55d0a50a28 100644
--- a/arch/mips/boot/dts/brcm/bcm7420.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7420.dtsi
@@ -99,6 +99,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7420-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x60c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7425.dtsi b/arch/mips/boot/dts/brcm/bcm7425.dtsi
index 571f30f52e3f..e24d41ab4e30 100644
--- a/arch/mips/boot/dts/brcm/bcm7425.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7425.dtsi
@@ -100,6 +100,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7425-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/boot/dts/brcm/bcm7435.dtsi b/arch/mips/boot/dts/brcm/bcm7435.dtsi
index 614ee211f71a..8b9432cc062b 100644
--- a/arch/mips/boot/dts/brcm/bcm7435.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7435.dtsi
@@ -114,6 +114,7 @@
                sun_top_ctrl: syscon@404000 {
                        compatible = "brcm,bcm7425-sun-top-ctrl", "syscon";
                        reg = <0x404000 0x51c>;
+                        little-endian;
                };
                reboot {
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index cefb7a596878..e090fc388e02 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -227,7 +227,7 @@ struct mips_elf_abiflags_v0 {
        int __res = 1;                                                  \
        struct elfhdr *__h = (hdr);                                     \
                                                                        \
-        if (__h->e_machine != EM_MIPS)                                  \
+        if (!mips_elf_check_machine(__h))                               \
                __res = 0;                                              \
        if (__h->e_ident[EI_CLASS] != ELFCLASS32)                       \
                __res = 0;                                              \
@@ -258,7 +258,7 @@ struct mips_elf_abiflags_v0 {
        int __res = 1;                                                  \
        struct elfhdr *__h = (hdr);                                     \
                                                                        \
-        if (__h->e_machine != EM_MIPS)                                  \
+        if (!mips_elf_check_machine(__h))                               \
                __res = 0;                                              \
        if (__h->e_ident[EI_CLASS] != ELFCLASS64)                       \
                __res = 0;                                              \
@@ -285,6 +285,11 @@ struct mips_elf_abiflags_v0 {
 #endif /* !defined(ELF_ARCH) */
+#define mips_elf_check_machine(x) ((x)->e_machine == EM_MIPS)
+#define vmcore_elf32_check_arch mips_elf_check_machine
+#define vmcore_elf64_check_arch mips_elf_check_machine
 struct mips_abi;
 extern struct mips_abi mips_abi;
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 9cbf383b8834..f06f97bd62df 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -179,6 +179,10 @@ static inline void lose_fpu_inatomic(int save, struct task_struct *tsk)
                if (save)
                        _save_fp(tsk);
                __disable_fpu();
+        } else {
+                /* FPU should not have been left enabled with no owner */
+                WARN(read_c0_status() & ST0_CU1,
+                     "Orphaned FPU left enabled");
        }
        KSTK_STATUS(tsk) &= ~ST0_CU1;
        clear_tsk_thread_flag(tsk, TIF_USEDFPU);
diff --git a/arch/mips/include/asm/octeon/octeon-feature.h b/arch/mips/include/asm/octeon/octeon-feature.h
index 8ebd3f579b84..3ed10a8d7865 100644
--- a/arch/mips/include/asm/octeon/octeon-feature.h
+++ b/arch/mips/include/asm/octeon/octeon-feature.h
@@ -128,7 +128,8 @@ static inline int octeon_has_feature(enum octeon_feature feature)
        case OCTEON_FEATURE_PCIE:
                return OCTEON_IS_MODEL(OCTEON_CN56XX)
                        || OCTEON_IS_MODEL(OCTEON_CN52XX)
-                        || OCTEON_IS_MODEL(OCTEON_CN6XXX);
+                        || OCTEON_IS_MODEL(OCTEON_CN6XXX)
+                        || OCTEON_IS_MODEL(OCTEON_CN7XXX);
        case OCTEON_FEATURE_SRIO:
                return OCTEON_IS_MODEL(OCTEON_CN63XX)
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index 3f832c3dd8f5..041153f5cf93 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -45,7 +45,7 @@ extern unsigned int vced_count, vcei_count;
 * User space process size: 2GB. This is hardcoded into a few places,
 * so don't change it unless you know what you are doing.
 */
-#define TASK_SIZE       0x7fff8000UL
+#define TASK_SIZE       0x80000000UL
 #endif
 #define STACK_TOP_MAX   TASK_SIZE
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index a71da576883c..eebf39549606 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -289,7 +289,7 @@
                .set    reorder
                .set    noat
                mfc0    a0, CP0_STATUS
-                li      v1, 0xff00
+                li      v1, ST0_CU1 | ST0_IM
                ori     a0, STATMASK
                xori    a0, STATMASK
                mtc0    a0, CP0_STATUS
@@ -330,7 +330,7 @@
                ori     a0, STATMASK
                xori    a0, STATMASK
                mtc0    a0, CP0_STATUS
-                li      v1, 0xff00
+                li      v1, ST0_CU1 | ST0_FR | ST0_IM
                and     a0, v1
                LONG_L  v0, PT_STATUS(sp)
                nor     v1, $0, v1
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 6499d93ae68d..47bc45a67e9b 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -101,10 +101,8 @@ static inline void syscall_get_arguments(struct task_struct *task,
        /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */
        if ((config_enabled(CONFIG_32BIT) ||
            test_tsk_thread_flag(task, TIF_32BIT_REGS)) &&
-            (regs->regs[2] == __NR_syscall)) {
+            (regs->regs[2] == __NR_syscall))
                i++;
-                n++;
-        }
        while (n--)
                ret |= mips_get_syscall_arg(args++, task, regs, i++);
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index 90f03a7da665..3129795de940 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -380,16 +380,17 @@
 #define __NR_userfaultfd                (__NR_Linux + 357)
 #define __NR_membarrier                 (__NR_Linux + 358)
 #define __NR_mlock2                     (__NR_Linux + 359)
+#define __NR_copy_file_range            (__NR_Linux + 360)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             359
+#define __NR_Linux_syscalls             360
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         359
+#define __NR_O32_Linux_syscalls         360
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -717,16 +718,17 @@
 #define __NR_userfaultfd                (__NR_Linux + 317)
 #define __NR_membarrier                 (__NR_Linux + 318)
 #define __NR_mlock2                     (__NR_Linux + 319)
+#define __NR_copy_file_range            (__NR_Linux + 320)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             319
+#define __NR_Linux_syscalls             320
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          319
+#define __NR_64_Linux_syscalls          320
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -1058,15 +1060,16 @@
 #define __NR_userfaultfd                (__NR_Linux + 321)
 #define __NR_membarrier                 (__NR_Linux + 322)
 #define __NR_mlock2                     (__NR_Linux + 323)
+#define __NR_copy_file_range            (__NR_Linux + 324)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             323
+#define __NR_Linux_syscalls             324
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         323
+#define __NR_N32_Linux_syscalls         324
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index 1188e00bb120..1b992c6e3d8e 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -35,7 +35,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
        int __res = 1;                                                  \
        struct elfhdr *__h = (hdr);                                     \
                                                                        \
-        if (__h->e_machine != EM_MIPS)                                  \
+        if (!mips_elf_check_machine(__h))                               \
                __res = 0;                                              \
        if (__h->e_ident[EI_CLASS] != ELFCLASS32)                       \
                __res = 0;                                              \
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index 928767858b86..abd3affe5fb3 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -47,7 +47,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
        int __res = 1;                                                  \
        struct elfhdr *__h = (hdr);                                     \
                                                                        \
-        if (__h->e_machine != EM_MIPS)                                  \
+        if (!mips_elf_check_machine(__h))                               \
                __res = 0;                                              \
        if (__h->e_ident[EI_CLASS] != ELFCLASS32)                       \
                __res = 0;                                              \
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index f2975d4d1e44..eddd5fd6fdfa 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -65,12 +65,10 @@ void start_thread(struct pt_regs * regs, unsigned long pc, unsigned long sp)
        status = regs->cp0_status & ~(ST0_CU0|ST0_CU1|ST0_FR|KU_MASK);
        status |= KU_USER;
        regs->cp0_status = status;
+        lose_fpu(0);
+        clear_thread_flag(TIF_MSA_CTX_LIVE);
        clear_used_math();
-        clear_fpu_owner();
        init_dsp();
-        clear_thread_flag(TIF_USEDMSA);
-        clear_thread_flag(TIF_MSA_CTX_LIVE);
-        disable_msa();
        regs->cp0_epc = pc;
        regs->regs[29] = sp;
 }
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 2d23c834ba96..a56317444bda 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -595,3 +595,4 @@ EXPORT(sys_call_table)
        PTR     sys_userfaultfd
        PTR     sys_membarrier
        PTR     sys_mlock2
+        PTR     sys_copy_file_range             /* 4360 */
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index deac63315d0e..2b2dc14610d0 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -433,4 +433,5 @@ EXPORT(sys_call_table)
        PTR     sys_userfaultfd
        PTR     sys_membarrier
        PTR     sys_mlock2
+        PTR     sys_copy_file_range             /* 5320 */
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 5a69eb48d0a8..2bf5c8593d91 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -423,4 +423,5 @@ EXPORT(sysn32_call_table)
        PTR     sys_userfaultfd
        PTR     sys_membarrier
        PTR     sys_mlock2
+        PTR     sys_copy_file_range
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index e4b6d7c97822..c5b759e584c7 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -578,4 +578,5 @@ EXPORT(sys32_call_table)
        PTR     sys_userfaultfd
        PTR     sys_membarrier
        PTR     sys_mlock2
+        PTR     sys_copy_file_range             /* 4360 */
        .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 569a7d5242dd..5fdaf8bdcd2e 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -782,6 +782,7 @@ static inline void prefill_possible_map(void) {}
 void __init setup_arch(char **cmdline_p)
 {
        cpu_probe();
+        mips_cm_probe();
        prom_init();
        setup_early_fdc_console();
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index bafcb7ad5c85..ae790c575d4f 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -663,7 +663,7 @@ static int simulate_rdhwr_normal(struct pt_regs *regs, unsigned int opcode)
        return -1;
 }
-static int simulate_rdhwr_mm(struct pt_regs *regs, unsigned short opcode)
+static int simulate_rdhwr_mm(struct pt_regs *regs, unsigned int opcode)
 {
        if ((opcode & MM_POOL32A_FUNC) == MM_RDHWR) {
                int rd = (opcode & MM_RS) >> 16;
@@ -1119,11 +1119,12 @@ no_r2_instr:
        if (get_isa16_mode(regs->cp0_epc)) {
                unsigned short mmop[2] = { 0 };
-                if (unlikely(get_user(mmop[0], epc) < 0))
+                if (unlikely(get_user(mmop[0], (u16 __user *)epc + 0) < 0))
                        status = SIGSEGV;
-                if (unlikely(get_user(mmop[1], epc) < 0))
+                if (unlikely(get_user(mmop[1], (u16 __user *)epc + 1) < 0))
                        status = SIGSEGV;
-                opcode = (mmop[0] << 16) | mmop[1];
+                opcode = mmop[0];
+                opcode = (opcode << 16) | mmop[1];
                if (status < 0)
                        status = simulate_rdhwr_mm(regs, opcode);
@@ -1369,26 +1370,12 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                if (unlikely(compute_return_epc(regs) < 0))
                        break;
-                if (get_isa16_mode(regs->cp0_epc)) {
+                if (!get_isa16_mode(regs->cp0_epc)) {
-                        unsigned short mmop[2] = { 0 };
-                        if (unlikely(get_user(mmop[0], epc) < 0))
-                                status = SIGSEGV;
-                        if (unlikely(get_user(mmop[1], epc) < 0))
-                                status = SIGSEGV;
-                        opcode = (mmop[0] << 16) | mmop[1];
-                        if (status < 0)
-                                status = simulate_rdhwr_mm(regs, opcode);
-                } else {
                        if (unlikely(get_user(opcode, epc) < 0))
                                status = SIGSEGV;
                        if (!cpu_has_llsc && status < 0)
                                status = simulate_llsc(regs, opcode);
-                        if (status < 0)
-                                status = simulate_rdhwr_normal(regs, opcode);
                }
                if (status < 0)
diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c
index 3bd0597d9c3d..249647578e58 100644
--- a/arch/mips/mm/sc-mips.c
+++ b/arch/mips/mm/sc-mips.c
@@ -181,10 +181,6 @@ static int __init mips_sc_probe_cm3(void)
        return 1;
 }
-void __weak platform_early_l2_init(void)
-{
-}
 static inline int __init mips_sc_probe(void)
 {
        struct cpuinfo_mips *c = &current_cpu_data;
@@ -194,12 +190,6 @@ static inline int __init mips_sc_probe(void)
        /* Mark as not present until probe completed */
        c->scache.flags |= MIPS_CACHE_NOT_PRESENT;
-        /*
-         * Do we need some platform specific probing before
-         * we configure L2?
-         */
-        platform_early_l2_init();
        if (mips_cm_revision() >= CM_REV_CM3)
                return mips_sc_probe_cm3();
diff --git a/arch/mips/mti-malta/malta-init.c b/arch/mips/mti-malta/malta-init.c
index 571148c5fd0b..dc2c5214809d 100644
--- a/arch/mips/mti-malta/malta-init.c
+++ b/arch/mips/mti-malta/malta-init.c
@@ -293,7 +293,6 @@ mips_pci_controller:
        console_config();
 #endif
        /* Early detection of CMP support */
-        mips_cm_probe();
        mips_cpc_probe();
        if (!register_cps_smp_ops())
@@ -304,10 +303,3 @@ mips_pci_controller:
                return;
        register_up_smp_ops();
 }
-void platform_early_l2_init(void)
-{
-        /* L2 configuration lives in the CM3 */
-        if (mips_cm_revision() >= CM_REV_CM3)
-                mips_cm_probe();
-}
diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
index a009ee458934..1ae932c2d78b 100644
--- a/arch/mips/pci/pci-mt7620.c
+++ b/arch/mips/pci/pci-mt7620.c
@@ -297,12 +297,12 @@ static int mt7620_pci_probe(struct platform_device *pdev)
                return PTR_ERR(rstpcie0);
        bridge_base = devm_ioremap_resource(&pdev->dev, bridge_res);
-        if (!bridge_base)
+        if (IS_ERR(bridge_base))
-                return -ENOMEM;
+                return PTR_ERR(bridge_base);
        pcie_base = devm_ioremap_resource(&pdev->dev, pcie_res);
-        if (!pcie_base)
+        if (IS_ERR(pcie_base))
-                return -ENOMEM;
+                return PTR_ERR(pcie_base);
        iomem_resource.start = 0;
        iomem_resource.end = ~0;
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9af2e6338400..ab2ed5328f0a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -475,6 +475,7 @@ config X86_UV
        depends on X86_64
        depends on X86_EXTENDED_PLATFORM
        depends on NUMA
+        depends on EFI
        depends on X86_X2APIC
        depends on PCI
        ---help---
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 2d5a50cb61a2..20c11d1aa4cc 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -766,7 +766,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
 * Return saved PC of a blocked thread.
 * What is this good for? it will be always the scheduler or ret_from_fork.
 */
-#define thread_saved_pc(t)      (*(unsigned long *)((t)->thread.sp - 8))
+#define thread_saved_pc(t)      READ_ONCE_NOCHECK(*(unsigned long *)((t)->thread.sp - 8))
 #define task_pt_regs(tsk)       ((struct pt_regs *)(tsk)->thread.sp0 - 1)
 extern unsigned long KSTK_ESP(struct task_struct *task);
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index c3b3f653ed0c..d04f8094bc23 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -469,7 +469,7 @@ static void __init numa_clear_kernel_node_hotplug(void)
 {
        int i, nid;
        nodemask_t numa_kernel_nodes = NODE_MASK_NONE;
-        unsigned long start, end;
+        phys_addr_t start, end;
        struct memblock_region *r;
        /*
diff --git a/block/blk-core.c b/block/blk-core.c
index ab51685988c2..b83d29755b5a 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2455,14 +2455,16 @@ struct request *blk_peek_request(struct request_queue *q)
                        rq = NULL;
                        break;
-                } else if (ret == BLKPREP_KILL) {
+                } else if (ret == BLKPREP_KILL || ret == BLKPREP_INVALID) {
+                        int err = (ret == BLKPREP_INVALID) ? -EREMOTEIO : -EIO;
                        rq->cmd_flags |= REQ_QUIET;
                        /*
                         * Mark this request as started so we don't trigger
                         * any debug logic in the end I/O path.
                         */
                        blk_start_request(rq);
-                        __blk_end_request_all(rq, -EIO);
+                        __blk_end_request_all(rq, err);
                } else {
                        printk(KERN_ERR "%s: bad return=%d\n", __func__, ret);
                        break;
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 38c1aa89d3a0..28556fce4267 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -65,18 +65,10 @@ struct skcipher_async_req {
        struct skcipher_async_rsgl first_sgl;
        struct list_head list;
        struct scatterlist *tsg;
-        char iv[];
+        atomic_t *inflight;
+        struct skcipher_request req;
 };
-#define GET_SREQ(areq, ctx) (struct skcipher_async_req *)((char *)areq + \
-        crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req)))
-#define GET_REQ_SIZE(ctx) \
-        crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req))
-#define GET_IV_SIZE(ctx) \
-        crypto_skcipher_ivsize(crypto_skcipher_reqtfm(&ctx->req))
 #define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \
                      sizeof(struct scatterlist) - 1)
@@ -102,15 +94,12 @@ static void skcipher_free_async_sgls(struct skcipher_async_req *sreq)
 static void skcipher_async_cb(struct crypto_async_request *req, int err)
 {
-        struct sock *sk = req->data;
+        struct skcipher_async_req *sreq = req->data;
-        struct alg_sock *ask = alg_sk(sk);
-        struct skcipher_ctx *ctx = ask->private;
-        struct skcipher_async_req *sreq = GET_SREQ(req, ctx);
        struct kiocb *iocb = sreq->iocb;
-        atomic_dec(&ctx->inflight);
+        atomic_dec(sreq->inflight);
        skcipher_free_async_sgls(sreq);
-        kfree(req);
+        kzfree(sreq);
        iocb->ki_complete(iocb, err, err);
 }
@@ -306,8 +295,11 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
 {
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
+        struct sock *psk = ask->parent;
+        struct alg_sock *pask = alg_sk(psk);
        struct skcipher_ctx *ctx = ask->private;
-        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(&ctx->req);
+        struct skcipher_tfm *skc = pask->private;
+        struct crypto_skcipher *tfm = skc->skcipher;
        unsigned ivsize = crypto_skcipher_ivsize(tfm);
        struct skcipher_sg_list *sgl;
        struct af_alg_control con = {};
@@ -509,37 +501,43 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
 {
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
+        struct sock *psk = ask->parent;
+        struct alg_sock *pask = alg_sk(psk);
        struct skcipher_ctx *ctx = ask->private;
+        struct skcipher_tfm *skc = pask->private;
+        struct crypto_skcipher *tfm = skc->skcipher;
        struct skcipher_sg_list *sgl;
        struct scatterlist *sg;
        struct skcipher_async_req *sreq;
        struct skcipher_request *req;
        struct skcipher_async_rsgl *last_rsgl = NULL;
-        unsigned int txbufs = 0, len = 0, tx_nents = skcipher_all_sg_nents(ctx);
+        unsigned int txbufs = 0, len = 0, tx_nents;
-        unsigned int reqlen = sizeof(struct skcipher_async_req) +
+        unsigned int reqsize = crypto_skcipher_reqsize(tfm);
-                                GET_REQ_SIZE(ctx) + GET_IV_SIZE(ctx);
+        unsigned int ivsize = crypto_skcipher_ivsize(tfm);
        int err = -ENOMEM;
        bool mark = false;
+        char *iv;
-        lock_sock(sk);
+        sreq = kzalloc(sizeof(*sreq) + reqsize + ivsize, GFP_KERNEL);
-        req = kmalloc(reqlen, GFP_KERNEL);
+        if (unlikely(!sreq))
-        if (unlikely(!req))
+                goto out;
-                goto unlock;
-        sreq = GET_SREQ(req, ctx);
+        req = &sreq->req;
+        iv = (char *)(req + 1) + reqsize;
        sreq->iocb = msg->msg_iocb;
-        memset(&sreq->first_sgl, '\0', sizeof(struct skcipher_async_rsgl));
        INIT_LIST_HEAD(&sreq->list);
+        sreq->inflight = &ctx->inflight;
+        lock_sock(sk);
+        tx_nents = skcipher_all_sg_nents(ctx);
        sreq->tsg = kcalloc(tx_nents, sizeof(*sg), GFP_KERNEL);
-        if (unlikely(!sreq->tsg)) {
+        if (unlikely(!sreq->tsg))
-                kfree(req);
                goto unlock;
-        }
        sg_init_table(sreq->tsg, tx_nents);
-        memcpy(sreq->iv, ctx->iv, GET_IV_SIZE(ctx));
+        memcpy(iv, ctx->iv, ivsize);
-        skcipher_request_set_tfm(req, crypto_skcipher_reqtfm(&ctx->req));
+        skcipher_request_set_tfm(req, tfm);
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
-                                      skcipher_async_cb, sk);
+                                      skcipher_async_cb, sreq);
        while (iov_iter_count(&msg->msg_iter)) {
                struct skcipher_async_rsgl *rsgl;
@@ -615,20 +613,22 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
                sg_mark_end(sreq->tsg + txbufs - 1);
        skcipher_request_set_crypt(req, sreq->tsg, sreq->first_sgl.sgl.sg,
-                                   len, sreq->iv);
+                                   len, iv);
        err = ctx->enc ? crypto_skcipher_encrypt(req) :
                         crypto_skcipher_decrypt(req);
        if (err == -EINPROGRESS) {
                atomic_inc(&ctx->inflight);
                err = -EIOCBQUEUED;
+                sreq = NULL;
                goto unlock;
        }
 free:
        skcipher_free_async_sgls(sreq);
-        kfree(req);
 unlock:
        skcipher_wmem_wakeup(sk);
        release_sock(sk);
+        kzfree(sreq);
+out:
        return err;
 }
@@ -637,9 +637,12 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
 {
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
+        struct sock *psk = ask->parent;
+        struct alg_sock *pask = alg_sk(psk);
        struct skcipher_ctx *ctx = ask->private;
-        unsigned bs = crypto_skcipher_blocksize(crypto_skcipher_reqtfm(
+        struct skcipher_tfm *skc = pask->private;
-                &ctx->req));
+        struct crypto_skcipher *tfm = skc->skcipher;
+        unsigned bs = crypto_skcipher_blocksize(tfm);
        struct skcipher_sg_list *sgl;
        struct scatterlist *sg;
        int err = -EAGAIN;
@@ -947,7 +950,8 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
        ask->private = ctx;
        skcipher_request_set_tfm(&ctx->req, skcipher);
-        skcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+        skcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_SLEEP |
+                                                 CRYPTO_TFM_REQ_MAY_BACKLOG,
                                      af_alg_complete, &ctx->completion);
        sk->sk_destruct = skcipher_sock_destruct;
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 237f3795cfaa..43fe85f20d57 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -499,6 +499,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                if (link->dump == NULL)
                        return -EINVAL;
+                down_read(&crypto_alg_sem);
                list_for_each_entry(alg, &crypto_alg_list, cra_list)
                        dump_alloc += CRYPTO_REPORT_MAXSIZE;
@@ -508,8 +509,11 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                .done = link->done,
                                .min_dump_alloc = dump_alloc,
                        };
-                        return netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+                        err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
                }
+                up_read(&crypto_alg_sem);
+                return err;
        }
        err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 594fcabd22cd..546a3692774f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -264,6 +264,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
        { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
        { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
        { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
        { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */
        { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index a4faa438889c..a44c75d4c284 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -250,6 +250,7 @@ enum {
        AHCI_HFLAG_MULTI_MSI            = 0,
        AHCI_HFLAG_MULTI_MSIX           = 0,
 #endif
+        AHCI_HFLAG_WAKE_BEFORE_STOP     = (1 << 22), /* wake before DMA stop */
        /* ap->flags bits */
diff --git a/drivers/ata/ahci_brcmstb.c b/drivers/ata/ahci_brcmstb.c
index b36cae2fd04b..e87bcec0fd7c 100644
--- a/drivers/ata/ahci_brcmstb.c
+++ b/drivers/ata/ahci_brcmstb.c
@@ -317,6 +317,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
        if (IS_ERR(hpriv))
                return PTR_ERR(hpriv);
        hpriv->plat_data = priv;
+        hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
        brcm_sata_alpm_init(hpriv);
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index d61740e78d6d..402967902cbe 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -496,8 +496,8 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
                }
        }
-        /* fabricate port_map from cap.nr_ports */
+        /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
-        if (!port_map) {
+        if (!port_map && vers < 0x10300) {
                port_map = (1 << ahci_nr_ports(cap)) - 1;
                dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
@@ -593,8 +593,22 @@ EXPORT_SYMBOL_GPL(ahci_start_engine);
 int ahci_stop_engine(struct ata_port *ap)
 {
        void __iomem *port_mmio = ahci_port_base(ap);
+        struct ahci_host_priv *hpriv = ap->host->private_data;
        u32 tmp;
+        /*
+         * On some controllers, stopping a port's DMA engine while the port
+         * is in ALPM state (partial or slumber) results in failures on
+         * subsequent DMA engine starts.  For those controllers, put the
+         * port back in active state before stopping its DMA engine.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_WAKE_BEFORE_STOP) &&
+            (ap->link.lpm_policy > ATA_LPM_MAX_POWER) &&
+            ahci_set_lpm(&ap->link, ATA_LPM_MAX_POWER, ATA_LPM_WAKE_ONLY)) {
+                dev_err(ap->host->dev, "Failed to wake up port before engine stop\n");
+                return -EIO;
+        }
        tmp = readl(port_mmio + PORT_CMD);
        /* check if the HBA is idle */
@@ -689,6 +703,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
        void __iomem *port_mmio = ahci_port_base(ap);
        if (policy != ATA_LPM_MAX_POWER) {
+                /* wakeup flag only applies to the max power policy */
+                hints &= ~ATA_LPM_WAKE_ONLY;
                /*
                 * Disable interrupts on Phy Ready. This keeps us from
                 * getting woken up due to spurious phy ready
@@ -704,7 +721,8 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
                u32 cmd = readl(port_mmio + PORT_CMD);
                if (policy == ATA_LPM_MAX_POWER || !(hints & ATA_LPM_HIPM)) {
-                        cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
+                        if (!(hints & ATA_LPM_WAKE_ONLY))
+                                cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
                        cmd |= PORT_CMD_ICC_ACTIVE;
                        writel(cmd, port_mmio + PORT_CMD);
@@ -712,6 +730,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
                        /* wait 10ms to be sure we've come out of LPM state */
                        ata_msleep(ap, 10);
+                        if (hints & ATA_LPM_WAKE_ONLY)
+                                return 0;
                } else {
                        cmd |= PORT_CMD_ALPE;
                        if (policy == ATA_LPM_MIN_POWER)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cbb74719d2c1..55e257c268dd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4125,6 +4125,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
        { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
        { " 2GB ATA Flash Disk", "ADMA428M",    ATA_HORKAGE_NODMA },
+        { "VRFDFC22048UCHC-TE*", NULL,          ATA_HORKAGE_NODMA },
        /* Odd clown on sil3726/4726 PMPs */
        { "Config  Disk",       NULL,           ATA_HORKAGE_DISABLE },
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index cdf6215a9a22..051b6158d1b7 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap,
 static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 {
        struct ata_port *ap = qc->ap;
-        unsigned long flags;
        if (ap->ops->error_handler) {
                if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
                        /* EH might have kicked in while host lock is
                         * released.
                         */
@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                                } else
                                        ata_port_freeze(ap);
                        }
-                        spin_unlock_irqrestore(ap->lock, flags);
                } else {
                        if (likely(!(qc->err_mask & AC_ERR_HSM)))
                                ata_qc_complete(qc);
@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                }
        } else {
                if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
                        ata_sff_irq_on(ap);
                        ata_qc_complete(qc);
-                        spin_unlock_irqrestore(ap->lock, flags);
                } else
                        ata_qc_complete(qc);
        }
@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
 {
        struct ata_link *link = qc->dev->link;
        struct ata_eh_info *ehi = &link->eh_info;
-        unsigned long flags = 0;
        int poll_next;
+        lockdep_assert_held(ap->lock);
        WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0);
        /* Make sure ata_sff_qc_issue() does not throw things
@@ -1112,14 +1106,6 @@ fsm_start:
                        }
                }
-                /* Send the CDB (atapi) or the first data block (ata pio out).
-                 * During the state transition, interrupt handler shouldn't
-                 * be invoked before the data transfer is complete and
-                 * hsm_task_state is changed. Hence, the following locking.
-                 */
-                if (in_wq)
-                        spin_lock_irqsave(ap->lock, flags);
                if (qc->tf.protocol == ATA_PROT_PIO) {
                        /* PIO data out protocol.
                         * send first data block.
@@ -1135,9 +1121,6 @@ fsm_start:
                        /* send CDB */
                        atapi_send_cdb(ap, qc);
-                if (in_wq)
-                        spin_unlock_irqrestore(ap->lock, flags);
                /* if polling, ata_sff_pio_task() handles the rest.
                 * otherwise, interrupt handler takes over from here.
                 */
@@ -1296,7 +1279,8 @@ fsm_start:
                break;
        default:
                poll_next = 0;
-                BUG();
+                WARN(true, "ata%d: SFF host state machine in invalid state %d",
+                     ap->print_id, ap->hsm_task_state);
        }
        return poll_next;
@@ -1361,12 +1345,14 @@ static void ata_sff_pio_task(struct work_struct *work)
        u8 status;
        int poll_next;
+        spin_lock_irq(ap->lock);
        BUG_ON(ap->sff_pio_task_link == NULL);
        /* qc can be NULL if timeout occurred */
        qc = ata_qc_from_tag(ap, link->active_tag);
        if (!qc) {
                ap->sff_pio_task_link = NULL;
-                return;
+                goto out_unlock;
        }
 fsm_start:
@@ -1381,11 +1367,14 @@ fsm_start:
         */
        status = ata_sff_busy_wait(ap, ATA_BUSY, 5);
        if (status & ATA_BUSY) {
+                spin_unlock_irq(ap->lock);
                ata_msleep(ap, 2);
+                spin_lock_irq(ap->lock);
                status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
                if (status & ATA_BUSY) {
                        ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
-                        return;
+                        goto out_unlock;
                }
        }
@@ -1402,6 +1391,8 @@ fsm_start:
         */
        if (poll_next)
                goto fsm_start;
+out_unlock:
+        spin_unlock_irq(ap->lock);
 }
 /**
diff --git a/drivers/base/component.c b/drivers/base/component.c
index 89f5cf68d80a..04a1582e80bb 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -206,6 +206,8 @@ static void component_match_release(struct device *master,
                if (mc->release)
                        mc->release(master, mc->data);
        }
+        kfree(match->compare);
 }
 static void devm_component_match_release(struct device *dev, void *res)
@@ -221,14 +223,14 @@ static int component_match_realloc(struct device *dev,
        if (match->alloc == num)
                return 0;
-        new = devm_kmalloc_array(dev, num, sizeof(*new), GFP_KERNEL);
+        new = kmalloc_array(num, sizeof(*new), GFP_KERNEL);
        if (!new)
                return -ENOMEM;
        if (match->compare) {
                memcpy(new, match->compare, sizeof(*new) *
                                            min(match->num, num));
-                devm_kfree(dev, match->compare);
+                kfree(match->compare);
        }
        match->compare = new;
        match->alloc = num;
@@ -283,6 +285,24 @@ void component_match_add_release(struct device *master,
 }
 EXPORT_SYMBOL(component_match_add_release);
+static void free_master(struct master *master)
+{
+        struct component_match *match = master->match;
+        int i;
+        list_del(&master->node);
+        if (match) {
+                for (i = 0; i < match->num; i++) {
+                        struct component *c = match->compare[i].component;
+                        if (c)
+                                c->master = NULL;
+                }
+        }
+        kfree(master);
+}
 int component_master_add_with_match(struct device *dev,
        const struct component_master_ops *ops,
        struct component_match *match)
@@ -309,11 +329,9 @@ int component_master_add_with_match(struct device *dev,
        ret = try_to_bring_up_master(master, NULL);
-        if (ret < 0) {
+        if (ret < 0)
-                /* Delete off the list if we weren't successful */
+                free_master(master);
-                list_del(&master->node);
-                kfree(master);
-        }
        mutex_unlock(&component_mutex);
        return ret < 0 ? ret : 0;
@@ -324,25 +342,12 @@ void component_master_del(struct device *dev,
        const struct component_master_ops *ops)
 {
        struct master *master;
-        int i;
        mutex_lock(&component_mutex);
        master = __master_find(dev, ops);
        if (master) {
-                struct component_match *match = master->match;
                take_down_master(master);
+                free_master(master);
-                list_del(&master->node);
-                if (match) {
-                        for (i = 0; i < match->num; i++) {
-                                struct component *c = match->compare[i].component;
-                                if (c)
-                                        c->master = NULL;
-                        }
-                }
-                kfree(master);
        }
        mutex_unlock(&component_mutex);
 }
@@ -486,6 +491,8 @@ int component_add(struct device *dev, const struct component_ops *ops)
        ret = try_to_bring_up_masters(component);
        if (ret < 0) {
+                if (component->master)
+                        remove_component(component->master, component);
                list_del(&component->node);
                kfree(component);
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 8812bfb9e3b8..eea51569f0eb 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -133,17 +133,17 @@ static int regmap_mmio_gather_write(void *context,
        while (val_size) {
                switch (ctx->val_bytes) {
                case 1:
-                        __raw_writeb(*(u8 *)val, ctx->regs + offset);
+                        writeb(*(u8 *)val, ctx->regs + offset);
                        break;
                case 2:
-                        __raw_writew(*(u16 *)val, ctx->regs + offset);
+                        writew(*(u16 *)val, ctx->regs + offset);
                        break;
                case 4:
-                        __raw_writel(*(u32 *)val, ctx->regs + offset);
+                        writel(*(u32 *)val, ctx->regs + offset);
                        break;
 #ifdef CONFIG_64BIT
                case 8:
-                        __raw_writeq(*(u64 *)val, ctx->regs + offset);
+                        writeq(*(u64 *)val, ctx->regs + offset);
                        break;
 #endif
                default:
@@ -193,17 +193,17 @@ static int regmap_mmio_read(void *context,
        while (val_size) {
                switch (ctx->val_bytes) {
                case 1:
-                        *(u8 *)val = __raw_readb(ctx->regs + offset);
+                        *(u8 *)val = readb(ctx->regs + offset);
                        break;
                case 2:
-                        *(u16 *)val = __raw_readw(ctx->regs + offset);
+                        *(u16 *)val = readw(ctx->regs + offset);
                        break;
                case 4:
-                        *(u32 *)val = __raw_readl(ctx->regs + offset);
+                        *(u32 *)val = readl(ctx->regs + offset);
                        break;
 #ifdef CONFIG_64BIT
                case 8:
-                        *(u64 *)val = __raw_readq(ctx->regs + offset);
+                        *(u64 *)val = readq(ctx->regs + offset);
                        break;
 #endif
                default:
diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
index 20de861aa0ea..8bf9914d4d15 100644
--- a/drivers/crypto/atmel-sha.c
+++ b/drivers/crypto/atmel-sha.c
@@ -782,7 +782,7 @@ static void atmel_sha_finish_req(struct ahash_request *req, int err)
        dd->flags &= ~(SHA_FLAGS_BUSY | SHA_FLAGS_FINAL | SHA_FLAGS_CPU |
                        SHA_FLAGS_DMA_READY | SHA_FLAGS_OUTPUT_READY);
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
        if (req->base.complete)
                req->base.complete(&req->base, err);
@@ -795,7 +795,7 @@ static int atmel_sha_hw_init(struct atmel_sha_dev *dd)
 {
        int err;
-        err = clk_prepare_enable(dd->iclk);
+        err = clk_enable(dd->iclk);
        if (err)
                return err;
@@ -822,7 +822,7 @@ static void atmel_sha_hw_version_init(struct atmel_sha_dev *dd)
        dev_info(dd->dev,
                        "version: 0x%x\n", dd->hw_version);
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
 }
 static int atmel_sha_handle_queue(struct atmel_sha_dev *dd,
@@ -1410,6 +1410,10 @@ static int atmel_sha_probe(struct platform_device *pdev)
                goto res_err;
        }
+        err = clk_prepare(sha_dd->iclk);
+        if (err)
+                goto res_err;
        atmel_sha_hw_version_init(sha_dd);
        atmel_sha_get_cap(sha_dd);
@@ -1421,12 +1425,12 @@ static int atmel_sha_probe(struct platform_device *pdev)
                        if (IS_ERR(pdata)) {
                                dev_err(&pdev->dev, "platform data not available\n");
                                err = PTR_ERR(pdata);
-                                goto res_err;
+                                goto iclk_unprepare;
                        }
                }
                if (!pdata->dma_slave) {
                        err = -ENXIO;
-                        goto res_err;
+                        goto iclk_unprepare;
                }
                err = atmel_sha_dma_init(sha_dd, pdata);
                if (err)
@@ -1457,6 +1461,8 @@ err_algs:
        if (sha_dd->caps.has_dma)
                atmel_sha_dma_cleanup(sha_dd);
 err_sha_dma:
+iclk_unprepare:
+        clk_unprepare(sha_dd->iclk);
 res_err:
        tasklet_kill(&sha_dd->done_task);
 sha_dd_err:
@@ -1483,12 +1489,7 @@ static int atmel_sha_remove(struct platform_device *pdev)
        if (sha_dd->caps.has_dma)
                atmel_sha_dma_cleanup(sha_dd);
-        iounmap(sha_dd->io_base);
+        clk_unprepare(sha_dd->iclk);
-        clk_put(sha_dd->iclk);
-        if (sha_dd->irq >= 0)
-                free_irq(sha_dd->irq, sha_dd);
        return 0;
 }
diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
index 0643e3366e33..c0656e7f37b5 100644
--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mv_cesa_dev *cesa)
                return -ENOMEM;
        dma->padding_pool = dmam_pool_create("cesa_padding", dev, 72, 1, 0);
-        if (!dma->cache_pool)
+        if (!dma->padding_pool)
                return -ENOMEM;
        cesa->dma = dma;
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 2aeaebd1c6e7..3f87a03abc22 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -312,8 +312,8 @@ static int altera_gpio_probe(struct platform_device *pdev)
                handle_simple_irq, IRQ_TYPE_NONE);
        if (ret) {
-                dev_info(&pdev->dev, "could not add irqchip\n");
+                dev_err(&pdev->dev, "could not add irqchip\n");
-                return ret;
+                goto teardown;
        }
        gpiochip_set_chained_irqchip(&altera_gc->mmchip.gc,
@@ -326,6 +326,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
 skip_irq:
        return 0;
 teardown:
+        of_mm_gpiochip_remove(&altera_gc->mmchip);
        pr_err("%s: registration failed with status %d\n",
                node->full_name, ret);
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index ec58f4288649..cd007a67b302 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -195,7 +195,7 @@ static int davinci_gpio_of_xlate(struct gpio_chip *gc,
 static int davinci_gpio_probe(struct platform_device *pdev)
 {
        int i, base;
-        unsigned ngpio;
+        unsigned ngpio, nbank;
        struct davinci_gpio_controller *chips;
        struct davinci_gpio_platform_data *pdata;
        struct davinci_gpio_regs __iomem *regs;
@@ -224,8 +224,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
        if (WARN_ON(ARCH_NR_GPIOS < ngpio))
                ngpio = ARCH_NR_GPIOS;
+        nbank = DIV_ROUND_UP(ngpio, 32);
        chips = devm_kzalloc(dev,
-                             ngpio * sizeof(struct davinci_gpio_controller),
+                             nbank * sizeof(struct davinci_gpio_controller),
                             GFP_KERNEL);
        if (!chips)
                return -ENOMEM;
@@ -511,7 +512,7 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                        return irq;
                }
-                irq_domain = irq_domain_add_legacy(NULL, ngpio, irq, 0,
+                irq_domain = irq_domain_add_legacy(dev->of_node, ngpio, irq, 0,
                                                        &davinci_gpio_irq_ops,
                                                        chips);
                if (!irq_domain) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 82edf95b7740..5e7770f9a415 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -87,6 +87,8 @@ extern int amdgpu_sched_jobs;
 extern int amdgpu_sched_hw_submission;
 extern int amdgpu_enable_semaphores;
 extern int amdgpu_powerplay;
+extern unsigned amdgpu_pcie_gen_cap;
+extern unsigned amdgpu_pcie_lane_cap;
 #define AMDGPU_WAIT_IDLE_TIMEOUT_IN_MS          3000
 #define AMDGPU_MAX_USEC_TIMEOUT                 100000  /* 100 ms */
@@ -132,47 +134,6 @@ extern int amdgpu_powerplay;
 #define AMDGPU_RESET_VCE                        (1 << 13)
 #define AMDGPU_RESET_VCE1                       (1 << 14)
-/* CG block flags */
-#define AMDGPU_CG_BLOCK_GFX                     (1 << 0)
-#define AMDGPU_CG_BLOCK_MC                      (1 << 1)
-#define AMDGPU_CG_BLOCK_SDMA                    (1 << 2)
-#define AMDGPU_CG_BLOCK_UVD                     (1 << 3)
-#define AMDGPU_CG_BLOCK_VCE                     (1 << 4)
-#define AMDGPU_CG_BLOCK_HDP                     (1 << 5)
-#define AMDGPU_CG_BLOCK_BIF                     (1 << 6)
-/* CG flags */
-#define AMDGPU_CG_SUPPORT_GFX_MGCG              (1 << 0)
-#define AMDGPU_CG_SUPPORT_GFX_MGLS              (1 << 1)
-#define AMDGPU_CG_SUPPORT_GFX_CGCG              (1 << 2)
-#define AMDGPU_CG_SUPPORT_GFX_CGLS              (1 << 3)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS              (1 << 4)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS_LS           (1 << 5)
-#define AMDGPU_CG_SUPPORT_GFX_CP_LS             (1 << 6)
-#define AMDGPU_CG_SUPPORT_GFX_RLC_LS            (1 << 7)
-#define AMDGPU_CG_SUPPORT_MC_LS                 (1 << 8)
-#define AMDGPU_CG_SUPPORT_MC_MGCG               (1 << 9)
-#define AMDGPU_CG_SUPPORT_SDMA_LS               (1 << 10)
-#define AMDGPU_CG_SUPPORT_SDMA_MGCG             (1 << 11)
-#define AMDGPU_CG_SUPPORT_BIF_LS                (1 << 12)
-#define AMDGPU_CG_SUPPORT_UVD_MGCG              (1 << 13)
-#define AMDGPU_CG_SUPPORT_VCE_MGCG              (1 << 14)
-#define AMDGPU_CG_SUPPORT_HDP_LS                (1 << 15)
-#define AMDGPU_CG_SUPPORT_HDP_MGCG              (1 << 16)
-/* PG flags */
-#define AMDGPU_PG_SUPPORT_GFX_PG                (1 << 0)
-#define AMDGPU_PG_SUPPORT_GFX_SMG               (1 << 1)
-#define AMDGPU_PG_SUPPORT_GFX_DMG               (1 << 2)
-#define AMDGPU_PG_SUPPORT_UVD                   (1 << 3)
-#define AMDGPU_PG_SUPPORT_VCE                   (1 << 4)
-#define AMDGPU_PG_SUPPORT_CP                    (1 << 5)
-#define AMDGPU_PG_SUPPORT_GDS                   (1 << 6)
-#define AMDGPU_PG_SUPPORT_RLC_SMU_HS            (1 << 7)
-#define AMDGPU_PG_SUPPORT_SDMA                  (1 << 8)
-#define AMDGPU_PG_SUPPORT_ACP                   (1 << 9)
-#define AMDGPU_PG_SUPPORT_SAMU                  (1 << 10)
 /* GFX current status */
 #define AMDGPU_GFX_NORMAL_MODE                  0x00000000L
 #define AMDGPU_GFX_SAFE_MODE                    0x00000001L
@@ -606,8 +567,6 @@ struct amdgpu_sa_manager {
        uint32_t                align;
 };
-struct amdgpu_sa_bo;
 /* sub-allocation buffer */
 struct amdgpu_sa_bo {
        struct list_head                olist;
@@ -2360,6 +2319,8 @@ bool amdgpu_ttm_bo_is_amdgpu_bo(struct ttm_buffer_object *bo);
 int amdgpu_ttm_tt_set_userptr(struct ttm_tt *ttm, uint64_t addr,
                                     uint32_t flags);
 bool amdgpu_ttm_tt_has_userptr(struct ttm_tt *ttm);
+bool amdgpu_ttm_tt_affect_userptr(struct ttm_tt *ttm, unsigned long start,
+                                  unsigned long end);
 bool amdgpu_ttm_tt_is_readonly(struct ttm_tt *ttm);
 uint32_t amdgpu_ttm_tt_pte_flags(struct amdgpu_device *adev, struct ttm_tt *ttm,
                                 struct ttm_mem_reg *mem);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index a081dda9fa2f..7a4b101e10c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -795,6 +795,12 @@ static int amdgpu_cgs_query_system_info(void *cgs_device,
        case CGS_SYSTEM_INFO_PCIE_MLW:
                sys_info->value = adev->pm.pcie_mlw_mask;
                break;
+        case CGS_SYSTEM_INFO_CG_FLAGS:
+                sys_info->value = adev->cg_flags;
+                break;
+        case CGS_SYSTEM_INFO_PG_FLAGS:
+                sys_info->value = adev->pg_flags;
+                break;
        default:
                return -ENODEV;
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 65531463f88e..51bfc114584e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1795,15 +1795,20 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        }
        /* post card */
-        amdgpu_atom_asic_init(adev->mode_info.atom_context);
+        if (!amdgpu_card_posted(adev))
+                amdgpu_atom_asic_init(adev->mode_info.atom_context);
        r = amdgpu_resume(adev);
+        if (r)
+                DRM_ERROR("amdgpu_resume failed (%d).\n", r);
        amdgpu_fence_driver_resume(adev);
-        r = amdgpu_ib_ring_tests(adev);
+        if (resume) {
-        if (r)
+                r = amdgpu_ib_ring_tests(adev);
-                DRM_ERROR("ib ring test failed (%d).\n", r);
+                if (r)
+                        DRM_ERROR("ib ring test failed (%d).\n", r);
+        }
        r = amdgpu_late_init(adev);
        if (r)
@@ -1933,80 +1938,97 @@ retry:
        return r;
 }
+#define AMDGPU_DEFAULT_PCIE_GEN_MASK 0x30007  /* gen: chipset 1/2, asic 1/2/3 */
+#define AMDGPU_DEFAULT_PCIE_MLW_MASK 0x2f0000 /* 1/2/4/8/16 lanes */
 void amdgpu_get_pcie_info(struct amdgpu_device *adev)
 {
        u32 mask;
        int ret;
-        if (pci_is_root_bus(adev->pdev->bus))
+        if (amdgpu_pcie_gen_cap)
-                return;
+                adev->pm.pcie_gen_mask = amdgpu_pcie_gen_cap;
-        if (amdgpu_pcie_gen2 == 0)
+        if (amdgpu_pcie_lane_cap)
-                return;
+                adev->pm.pcie_mlw_mask = amdgpu_pcie_lane_cap;
-        if (adev->flags & AMD_IS_APU)
+        /* covers APUs as well */
+        if (pci_is_root_bus(adev->pdev->bus)) {
+                if (adev->pm.pcie_gen_mask == 0)
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
+                if (adev->pm.pcie_mlw_mask == 0)
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                return;
+        }
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+        if (adev->pm.pcie_gen_mask == 0) {
-        if (!ret) {
+                ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-                adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
+                if (!ret) {
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+                        adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
-                if (mask & DRM_PCIE_SPEED_25)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
+                        if (mask & DRM_PCIE_SPEED_25)
-                if (mask & DRM_PCIE_SPEED_50)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
+                        if (mask & DRM_PCIE_SPEED_50)
-                if (mask & DRM_PCIE_SPEED_80)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
+                        if (mask & DRM_PCIE_SPEED_80)
-        }
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
-        ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
+                } else {
-        if (!ret) {
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
-                switch (mask) {
+                }
-                case 32:
+        }
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
+        if (adev->pm.pcie_mlw_mask == 0) {
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                if (!ret) {
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                        switch (mask) {
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                        case 32:
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                        break;
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                case 16:
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                break;
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                        case 16:
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                        break;
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                case 12:
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                break;
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                        case 12:
-                        break;
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                case 8:
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
-                        break;
+                        case 8:
-                case 4:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
+                                break;
-                case 2:
+                        case 4:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                        break;
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                case 1:
+                                break;
-                        adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
+                        case 2:
-                        break;
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                default:
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
+                                break;
+                        case 1:
+                                adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                }
        }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 9c1af8976bef..9ef1db87cf26 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -83,6 +83,8 @@ int amdgpu_sched_jobs = 32;
 int amdgpu_sched_hw_submission = 2;
 int amdgpu_enable_semaphores = 0;
 int amdgpu_powerplay = -1;
+unsigned amdgpu_pcie_gen_cap = 0;
+unsigned amdgpu_pcie_lane_cap = 0;
 MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing, in megabytes");
 module_param_named(vramlimit, amdgpu_vram_limit, int, 0600);
@@ -170,6 +172,12 @@ MODULE_PARM_DESC(powerplay, "Powerplay component (1 = enable, 0 = disable, -1 =
 module_param_named(powerplay, amdgpu_powerplay, int, 0444);
 #endif
+MODULE_PARM_DESC(pcie_gen_cap, "PCIE Gen Caps (0: autodetect (default))");
+module_param_named(pcie_gen_cap, amdgpu_pcie_gen_cap, uint, 0444);
+MODULE_PARM_DESC(pcie_lane_cap, "PCIE Lane Caps (0: autodetect (default))");
+module_param_named(pcie_lane_cap, amdgpu_pcie_lane_cap, uint, 0444);
 static struct pci_device_id pciidlist[] = {
 #ifdef CONFIG_DRM_AMDGPU_CIK
        /* Kaveri */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
index b1969f2b2038..d4e2780c0796 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
@@ -142,7 +142,8 @@ static void amdgpu_mn_invalidate_range_start(struct mmu_notifier *mn,
                list_for_each_entry(bo, &node->bos, mn_list) {
-                        if (!bo->tbo.ttm || bo->tbo.ttm->state != tt_bound)
+                        if (!amdgpu_ttm_tt_affect_userptr(bo->tbo.ttm, start,
+                                                          end))
                                continue;
                        r = amdgpu_bo_reserve(bo, true);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 8b88edb0434b..ca72a2e487b9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -354,12 +354,15 @@ int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
                for (i = 0, count = 0; i < AMDGPU_MAX_RINGS; ++i)
                        if (fences[i])
-                                fences[count++] = fences[i];
+                                fences[count++] = fence_get(fences[i]);
                if (count) {
                        spin_unlock(&sa_manager->wq.lock);
                        t = fence_wait_any_timeout(fences, count, false,
                                                   MAX_SCHEDULE_TIMEOUT);
+                        for (i = 0; i < count; ++i)
+                                fence_put(fences[i]);
                        r = (t > 0) ? 0 : t;
                        spin_lock(&sa_manager->wq.lock);
                } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 55cf05e1c81c..6442a06d6fdc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -783,6 +783,25 @@ bool amdgpu_ttm_tt_has_userptr(struct ttm_tt *ttm)
        return !!gtt->userptr;
 }
+bool amdgpu_ttm_tt_affect_userptr(struct ttm_tt *ttm, unsigned long start,
+                                  unsigned long end)
+{
+        struct amdgpu_ttm_tt *gtt = (void *)ttm;
+        unsigned long size;
+        if (gtt == NULL)
+                return false;
+        if (gtt->ttm.ttm.state != tt_bound || !gtt->userptr)
+                return false;
+        size = (unsigned long)gtt->ttm.ttm.num_pages * PAGE_SIZE;
+        if (gtt->userptr > end || gtt->userptr + size <= start)
+                return false;
+        return true;
+}
 bool amdgpu_ttm_tt_is_readonly(struct ttm_tt *ttm)
 {
        struct amdgpu_ttm_tt *gtt = (void *)ttm;
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 8b4731d4e10e..474ca02b0949 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -31,6 +31,7 @@
 #include "ci_dpm.h"
 #include "gfx_v7_0.h"
 #include "atom.h"
+#include "amd_pcie.h"
 #include <linux/seq_file.h>
 #include "smu/smu_7_0_1_d.h"
@@ -5835,18 +5836,16 @@ static int ci_dpm_init(struct amdgpu_device *adev)
        u8 frev, crev;
        struct ci_power_info *pi;
        int ret;
-        u32 mask;
        pi = kzalloc(sizeof(struct ci_power_info), GFP_KERNEL);
        if (pi == NULL)
                return -ENOMEM;
        adev->pm.dpm.priv = pi;
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+        pi->sys_pcie_mask =
-        if (ret)
+                (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
-                pi->sys_pcie_mask = 0;
+                CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
-        else
-                pi->sys_pcie_mask = mask;
        pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
        pi->pcie_gen_performance.max = AMDGPU_PCIE_GEN1;
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index fd9c9588ef46..155965ed14a3 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1762,6 +1762,9 @@ static void cik_program_aspm(struct amdgpu_device *adev)
        if (amdgpu_aspm == 0)
                return;
+        if (pci_is_root_bus(adev->pdev->bus))
+                return;
        /* XXX double check APUs */
        if (adev->flags & AMD_IS_APU)
                return;
@@ -2332,72 +2335,72 @@ static int cik_common_early_init(void *handle)
        switch (adev->asic_type) {
        case CHIP_BONAIRE:
                adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
+                        AMD_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_HDP_MGCG;
                adev->pg_flags = 0;
                adev->external_rev_id = adev->rev_id + 0x14;
                break;
        case CHIP_HAWAII:
                adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
+                        AMD_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_HDP_MGCG;
                adev->pg_flags = 0;
                adev->external_rev_id = 0x28;
                break;
        case CHIP_KAVERI:
                adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
+                        AMD_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_HDP_MGCG;
                adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
+                        /*AMD_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG |
+                          AMD_PG_SUPPORT_GFX_SMG |
-                          AMDGPU_PG_SUPPORT_GFX_DMG |*/
+                          AMD_PG_SUPPORT_GFX_DMG |*/
-                        AMDGPU_PG_SUPPORT_UVD |
+                        AMD_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
+                        /*AMD_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_ACP |
+                          AMD_PG_SUPPORT_ACP |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                          AMD_PG_SUPPORT_SAMU |*/
                        0;
                if (adev->pdev->device == 0x1312 ||
                        adev->pdev->device == 0x1316 ||
@@ -2409,29 +2412,29 @@ static int cik_common_early_init(void *handle)
        case CHIP_KABINI:
        case CHIP_MULLINS:
                adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
+                        AMD_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_HDP_MGCG;
                adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
+                        /*AMD_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG | */
+                          AMD_PG_SUPPORT_GFX_SMG | */
-                        AMDGPU_PG_SUPPORT_UVD |
+                        AMD_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
+                        /*AMD_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                          AMD_PG_SUPPORT_SAMU |*/
                        0;
                if (adev->asic_type == CHIP_KABINI) {
                        if (adev->rev_id == 0)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index 5f712ceddf08..c55ecf0ea845 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -885,7 +885,7 @@ static void cik_enable_sdma_mgcg(struct amdgpu_device *adev,
 {
        u32 orig, data;
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_MGCG)) {
                WREG32(mmSDMA0_CLK_CTRL + SDMA0_REGISTER_OFFSET, 0x00000100);
                WREG32(mmSDMA0_CLK_CTRL + SDMA1_REGISTER_OFFSET, 0x00000100);
        } else {
@@ -906,7 +906,7 @@ static void cik_enable_sdma_mgls(struct amdgpu_device *adev,
 {
        u32 orig, data;
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_LS)) {
                orig = data = RREG32(mmSDMA0_POWER_CNTL + SDMA0_REGISTER_OFFSET);
                data |= 0x100;
                if (orig != data)
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index 4dd17f2dd905..9056355309d1 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -445,13 +445,13 @@ static int cz_dpm_init(struct amdgpu_device *adev)
        pi->gfx_pg_threshold = 500;
        pi->caps_fps = true;
        /* uvd */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
        pi->caps_uvd_dpm = true;
        /* vce */
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
        pi->caps_vce_dpm = true;
        /* acp */
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
        pi->caps_acp_dpm = true;
        pi->caps_stable_power_state = false;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 6c76139de1c9..7732059ae30f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -4109,7 +4109,7 @@ static void gfx_v7_0_enable_cgcg(struct amdgpu_device *adev, bool enable)
        orig = data = RREG32(mmRLC_CGCG_CGLS_CTRL);
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
                gfx_v7_0_enable_gui_idle_interrupt(adev, true);
                tmp = gfx_v7_0_halt_rlc(adev);
@@ -4147,9 +4147,9 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
        u32 data, orig, tmp = 0;
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGCG)) {
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) {
-                        if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CP_LS) {
+                        if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CP_LS) {
                                orig = data = RREG32(mmCP_MEM_SLP_CNTL);
                                data |= CP_MEM_SLP_CNTL__CP_MEM_LS_EN_MASK;
                                if (orig != data)
@@ -4176,14 +4176,14 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
                gfx_v7_0_update_rlc(adev, tmp);
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS) {
                        orig = data = RREG32(mmCGTS_SM_CTRL_REG);
                        data &= ~CGTS_SM_CTRL_REG__SM_MODE_MASK;
                        data |= (0x2 << CGTS_SM_CTRL_REG__SM_MODE__SHIFT);
                        data |= CGTS_SM_CTRL_REG__SM_MODE_ENABLE_MASK;
                        data &= ~CGTS_SM_CTRL_REG__OVERRIDE_MASK;
-                        if ((adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) &&
+                        if ((adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) &&
-                            (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS_LS))
+                            (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS_LS))
                                data &= ~CGTS_SM_CTRL_REG__LS_OVERRIDE_MASK;
                        data &= ~CGTS_SM_CTRL_REG__ON_MONITOR_ADD_MASK;
                        data |= CGTS_SM_CTRL_REG__ON_MONITOR_ADD_EN_MASK;
@@ -4249,7 +4249,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pu(struct amdgpu_device *adev,
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
        else
                data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
@@ -4263,7 +4263,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pd(struct amdgpu_device *adev,
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
        else
                data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
@@ -4276,7 +4276,7 @@ static void gfx_v7_0_enable_cp_pg(struct amdgpu_device *adev, bool enable)
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_CP))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_CP))
                data &= ~0x8000;
        else
                data |= 0x8000;
@@ -4289,7 +4289,7 @@ static void gfx_v7_0_enable_gds_pg(struct amdgpu_device *adev, bool enable)
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GDS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GDS))
                data &= ~0x2000;
        else
                data |= 0x2000;
@@ -4370,7 +4370,7 @@ static void gfx_v7_0_enable_gfx_cgpg(struct amdgpu_device *adev,
 {
        u32 data, orig;
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG)) {
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) {
                orig = data = RREG32(mmRLC_PG_CNTL);
                data |= RLC_PG_CNTL__GFX_POWER_GATING_ENABLE_MASK;
                if (orig != data)
@@ -4442,7 +4442,7 @@ static void gfx_v7_0_enable_gfx_static_mgpg(struct amdgpu_device *adev,
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_SMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_SMG))
                data |= RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
        else
                data &= ~RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
@@ -4456,7 +4456,7 @@ static void gfx_v7_0_enable_gfx_dynamic_mgpg(struct amdgpu_device *adev,
        u32 data, orig;
        orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_DMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_DMG))
                data |= RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
        else
                data &= ~RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
@@ -4623,15 +4623,15 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev,
 static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                gfx_v7_0_enable_sclk_slowdown_on_pu(adev, true);
                gfx_v7_0_enable_sclk_slowdown_on_pd(adev, true);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                        gfx_v7_0_init_gfx_cgpg(adev);
                        gfx_v7_0_enable_cp_pg(adev, true);
                        gfx_v7_0_enable_gds_pg(adev, true);
@@ -4643,14 +4643,14 @@ static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 static void gfx_v7_0_fini_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                gfx_v7_0_update_gfx_pg(adev, false);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                        gfx_v7_0_enable_cp_pg(adev, false);
                        gfx_v7_0_enable_gds_pg(adev, false);
                }
@@ -5527,14 +5527,14 @@ static int gfx_v7_0_set_powergating_state(void *handle,
        if (state == AMD_PG_STATE_GATE)
                gate = true;
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                gfx_v7_0_update_gfx_pg(adev, gate);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                        gfx_v7_0_enable_cp_pg(adev, gate);
                        gfx_v7_0_enable_gds_pg(adev, gate);
                }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 8aa2991ab379..b8060795b27b 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -792,7 +792,7 @@ static void gmc_v7_0_enable_mc_ls(struct amdgpu_device *adev,
        for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_LS))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_LS))
                        data |= mc_cg_ls_en[i];
                else
                        data &= ~mc_cg_ls_en[i];
@@ -809,7 +809,7 @@ static void gmc_v7_0_enable_mc_mgcg(struct amdgpu_device *adev,
        for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_MGCG))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_MGCG))
                        data |= mc_cg_en[i];
                else
                        data &= ~mc_cg_en[i];
@@ -825,7 +825,7 @@ static void gmc_v7_0_enable_bif_mgls(struct amdgpu_device *adev,
        orig = data = RREG32_PCIE(ixPCIE_CNTL2);
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_BIF_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_BIF_LS)) {
                data = REG_SET_FIELD(data, PCIE_CNTL2, SLV_MEM_LS_EN, 1);
                data = REG_SET_FIELD(data, PCIE_CNTL2, MST_MEM_LS_EN, 1);
                data = REG_SET_FIELD(data, PCIE_CNTL2, REPLAY_MEM_LS_EN, 1);
@@ -848,7 +848,7 @@ static void gmc_v7_0_enable_hdp_mgcg(struct amdgpu_device *adev,
        orig = data = RREG32(mmHDP_HOST_PATH_CNTL);
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_MGCG))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_MGCG))
                data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 0);
        else
                data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 1);
@@ -864,7 +864,7 @@ static void gmc_v7_0_enable_hdp_ls(struct amdgpu_device *adev,
        orig = data = RREG32(mmHDP_MEM_POWER_LS);
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_LS))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
                data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 1);
        else
                data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 0);
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 7e9154c7f1db..654d76723bc3 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2859,11 +2859,11 @@ static int kv_dpm_init(struct amdgpu_device *adev)
        pi->voltage_drop_t = 0;
        pi->caps_sclk_throttle_low_notification = false;
        pi->caps_fps = false; /* true? */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
        pi->caps_uvd_dpm = true;
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
-        pi->caps_samu_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_SAMU) ? true : false;
+        pi->caps_samu_pg = (adev->pg_flags & AMD_PG_SUPPORT_SAMU) ? true : false;
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
        pi->caps_stable_p_state = false;
        ret = kv_parse_sys_info_table(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 5e9f73af83a8..fbd3767671bb 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -611,7 +611,7 @@ static void uvd_v4_2_enable_mgcg(struct amdgpu_device *adev,
 {
        u32 orig, data;
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG)) {
                data = RREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL);
                data = 0xfff;
                WREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL, data);
@@ -830,6 +830,9 @@ static int uvd_v4_2_set_clockgating_state(void *handle,
        bool gate = false;
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
        if (state == AMD_CG_STATE_GATE)
                gate = true;
@@ -848,7 +851,10 @@ static int uvd_v4_2_set_powergating_state(void *handle,
         * revisit this when there is a cleaner line between
         * the smc and the hw blocks
         */
-         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
        if (state == AMD_PG_STATE_GATE) {
                uvd_v4_2_stop(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
index 38864f562981..57f1c5bf3bf1 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
@@ -774,6 +774,11 @@ static int uvd_v5_0_process_interrupt(struct amdgpu_device *adev,
 static int uvd_v5_0_set_clockgating_state(void *handle,
                                          enum amd_clockgating_state state)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
        return 0;
 }
@@ -789,6 +794,9 @@ static int uvd_v5_0_set_powergating_state(void *handle,
         */
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
        if (state == AMD_PG_STATE_GATE) {
                uvd_v5_0_stop(adev);
                return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index 3d5913926436..0b365b7651ff 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -532,7 +532,7 @@ static int uvd_v6_0_start(struct amdgpu_device *adev)
        uvd_v6_0_mc_resume(adev);
        /* Set dynamic clock gating in S/W control mode */
-        if (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG) {
+        if (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG) {
                if (adev->flags & AMD_IS_APU)
                        cz_set_uvd_clock_gating_branches(adev, false);
                else
@@ -1000,7 +1000,7 @@ static int uvd_v6_0_set_clockgating_state(void *handle,
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
                return 0;
        if (enable) {
@@ -1030,6 +1030,9 @@ static int uvd_v6_0_set_powergating_state(void *handle,
         */
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
        if (state == AMD_PG_STATE_GATE) {
                uvd_v6_0_stop(adev);
                return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
index 52ac7a8f1e58..a822edacfa95 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
@@ -373,7 +373,7 @@ static void vce_v2_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
        bool sw_cg = false;
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)) {
                if (sw_cg)
                        vce_v2_0_set_sw_cg(adev, true);
                else
@@ -608,6 +608,9 @@ static int vce_v2_0_set_powergating_state(void *handle,
         */
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
        if (state == AMD_PG_STATE_GATE)
                /* XXX do we need a vce_v2_0_stop()? */
                return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index e99af81e4aec..d662fa9f9091 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -277,7 +277,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                WREG32_P(mmVCE_STATUS, 0, ~1);
                /* Set Clock-Gating off */
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)
+                if (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)
                        vce_v3_0_set_vce_sw_clock_gating(adev, false);
                if (r) {
@@ -676,7 +676,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
        bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
        int i;
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG))
                return 0;
        mutex_lock(&adev->grbm_idx_mutex);
@@ -728,6 +728,9 @@ static int vce_v3_0_set_powergating_state(void *handle,
         */
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
        if (state == AMD_PG_STATE_GATE)
                /* XXX do we need a vce_v3_0_stop()? */
                return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 89f5a1ff6f43..0d14d108a6c4 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1457,8 +1457,7 @@ static int vi_common_early_init(void *handle)
        case CHIP_STONEY:
                adev->has_uvd = true;
                adev->cg_flags = 0;
-                /* Disable UVD pg */
+                adev->pg_flags = 0;
-                adev->pg_flags = /* AMDGPU_PG_SUPPORT_UVD | */AMDGPU_PG_SUPPORT_VCE;
                adev->external_rev_id = adev->rev_id + 0x1;
                break;
        default:
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index 1195d06f55bc..dbf7e6413cab 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -85,6 +85,38 @@ enum amd_powergating_state {
        AMD_PG_STATE_UNGATE,
 };
+/* CG flags */
+#define AMD_CG_SUPPORT_GFX_MGCG                 (1 << 0)
+#define AMD_CG_SUPPORT_GFX_MGLS                 (1 << 1)
+#define AMD_CG_SUPPORT_GFX_CGCG                 (1 << 2)
+#define AMD_CG_SUPPORT_GFX_CGLS                 (1 << 3)
+#define AMD_CG_SUPPORT_GFX_CGTS                 (1 << 4)
+#define AMD_CG_SUPPORT_GFX_CGTS_LS              (1 << 5)
+#define AMD_CG_SUPPORT_GFX_CP_LS                (1 << 6)
+#define AMD_CG_SUPPORT_GFX_RLC_LS               (1 << 7)
+#define AMD_CG_SUPPORT_MC_LS                    (1 << 8)
+#define AMD_CG_SUPPORT_MC_MGCG                  (1 << 9)
+#define AMD_CG_SUPPORT_SDMA_LS                  (1 << 10)
+#define AMD_CG_SUPPORT_SDMA_MGCG                (1 << 11)
+#define AMD_CG_SUPPORT_BIF_LS                   (1 << 12)
+#define AMD_CG_SUPPORT_UVD_MGCG                 (1 << 13)
+#define AMD_CG_SUPPORT_VCE_MGCG                 (1 << 14)
+#define AMD_CG_SUPPORT_HDP_LS                   (1 << 15)
+#define AMD_CG_SUPPORT_HDP_MGCG                 (1 << 16)
+/* PG flags */
+#define AMD_PG_SUPPORT_GFX_PG                   (1 << 0)
+#define AMD_PG_SUPPORT_GFX_SMG                  (1 << 1)
+#define AMD_PG_SUPPORT_GFX_DMG                  (1 << 2)
+#define AMD_PG_SUPPORT_UVD                      (1 << 3)
+#define AMD_PG_SUPPORT_VCE                      (1 << 4)
+#define AMD_PG_SUPPORT_CP                       (1 << 5)
+#define AMD_PG_SUPPORT_GDS                      (1 << 6)
+#define AMD_PG_SUPPORT_RLC_SMU_HS               (1 << 7)
+#define AMD_PG_SUPPORT_SDMA                     (1 << 8)
+#define AMD_PG_SUPPORT_ACP                      (1 << 9)
+#define AMD_PG_SUPPORT_SAMU                     (1 << 10)
 enum amd_pm_state_type {
        /* not used for dpm */
        POWER_STATE_TYPE_DEFAULT,
diff --git a/drivers/gpu/drm/amd/include/cgs_common.h b/drivers/gpu/drm/amd/include/cgs_common.h
index 713aec954692..aec38fc3834f 100644
--- a/drivers/gpu/drm/amd/include/cgs_common.h
+++ b/drivers/gpu/drm/amd/include/cgs_common.h
@@ -109,6 +109,8 @@ enum cgs_system_info_id {
        CGS_SYSTEM_INFO_ADAPTER_BDF_ID = 1,
        CGS_SYSTEM_INFO_PCIE_GEN_INFO,
        CGS_SYSTEM_INFO_PCIE_MLW,
+        CGS_SYSTEM_INFO_CG_FLAGS,
+        CGS_SYSTEM_INFO_PG_FLAGS,
        CGS_SYSTEM_INFO_ID_MAXIMUM,
 };
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index 0874ab42ee95..cf01177ca3b5 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -174,6 +174,8 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
        struct cz_hwmgr *cz_hwmgr = (struct cz_hwmgr *)(hwmgr->backend);
        uint32_t i;
+        struct cgs_system_info sys_info = {0};
+        int result;
        cz_hwmgr->gfx_ramp_step = 256*25/100;
@@ -247,6 +249,22 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                   PHM_PlatformCaps_DisableVoltageIsland);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
index 44a925006479..980d3bf8ea76 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -4451,6 +4451,7 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
        pp_atomctrl_gpio_pin_assignment gpio_pin_assignment;
        struct phm_ppt_v1_information *pptable_info = (struct phm_ppt_v1_information *)(hwmgr->pptable);
        phw_tonga_ulv_parm *ulv;
+        struct cgs_system_info sys_info = {0};
        PP_ASSERT_WITH_CODE((NULL != hwmgr),
                "Invalid Parameter!", return -1;);
@@ -4615,9 +4616,23 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
        data->vddc_phase_shed_control = 0;
-        if (0 == result) {
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
-                struct cgs_system_info sys_info = {0};
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
+        if (0 == result) {
                data->is_tlu_enabled = 0;
                hwmgr->platform_descriptor.hardwareActivityPerformanceLevels =
                        TONGA_MAX_HARDWARE_POWERLEVELS;
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index c507896aca45..197b157b73d0 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -349,8 +349,13 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
                        /* see if we can skip over some allocations */
                } while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_ref(fences[i]);
                spin_unlock(&sa_manager->wq.lock);
                r = radeon_fence_wait_any(rdev, fences, false);
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_unref(&fences[i]);
                spin_lock(&sa_manager->wq.lock);
                /* if we have nothing to wait for block */
                if (r == -ENOENT) {
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 3de93517efe4..14606afbfaa8 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -336,7 +336,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
        union ib_gid gid;
        struct ib_gid_attr gid_attr = {};
        ssize_t ret;
-        va_list args;
        ret = ib_query_gid(p->ibdev, p->port_num, tab_attr->index, &gid,
                           &gid_attr);
@@ -348,7 +347,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
 err:
        if (gid_attr.ndev)
                dev_put(gid_attr.ndev);
-        va_end(args);
        return ret;
 }
@@ -722,12 +720,11 @@ static struct attribute_group *get_counter_table(struct ib_device *dev,
        if (get_perf_mad(dev, port_num, IB_PMA_CLASS_PORT_INFO,
                                &cpi, 40, sizeof(cpi)) >= 0) {
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH)
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH)
                        /* We have extended counters */
                        return &pma_group_ext;
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
                        /* But not the IETF ones */
                        return &pma_group_noietf;
        }
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 9116bc3988a6..34cb8e87c7b8 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -270,8 +270,10 @@ static int sq_overhead(enum ib_qp_type qp_type)
                /* fall through */
        case IB_QPT_RC:
                size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_atomic_seg) +
+                        max(sizeof(struct mlx5_wqe_atomic_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg);
+                            sizeof(struct mlx5_wqe_raddr_seg),
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_mkey_seg));
                break;
        case IB_QPT_XRC_TGT:
@@ -279,9 +281,9 @@ static int sq_overhead(enum ib_qp_type qp_type)
        case IB_QPT_UC:
                size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg) +
+                        max(sizeof(struct mlx5_wqe_raddr_seg),
-                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
-                        sizeof(struct mlx5_mkey_seg);
+                            sizeof(struct mlx5_mkey_seg));
                break;
        case IB_QPT_UD:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 573849354cb9..f38743018cb4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -228,6 +228,11 @@ static int ocrdma_alloc_resources(struct ocrdma_dev *dev)
        ocrdma_alloc_pd_pool(dev);
+        if (!ocrdma_alloc_stats_resources(dev)) {
+                pr_err("%s: stats resource allocation failed\n", __func__);
+                goto alloc_err;
+        }
        spin_lock_init(&dev->av_tbl.lock);
        spin_lock_init(&dev->flush_q_lock);
        return 0;
@@ -238,6 +243,7 @@ alloc_err:
 static void ocrdma_free_resources(struct ocrdma_dev *dev)
 {
+        ocrdma_release_stats_resources(dev);
        kfree(dev->stag_arr);
        kfree(dev->qp_tbl);
        kfree(dev->cq_tbl);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index 86c303a620c1..255f774080a4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -64,10 +64,11 @@ static int ocrdma_add_stat(char *start, char *pcur,
        return cpy_len;
 }
-static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev)
 {
        struct stats_mem *mem = &dev->stats_mem;
+        mutex_init(&dev->stats_lock);
        /* Alloc mbox command mem*/
        mem->size = max_t(u32, sizeof(struct ocrdma_rdma_stats_req),
                        sizeof(struct ocrdma_rdma_stats_resp));
@@ -91,13 +92,14 @@ static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
        return true;
 }
-static void ocrdma_release_stats_mem(struct ocrdma_dev *dev)
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev)
 {
        struct stats_mem *mem = &dev->stats_mem;
        if (mem->va)
                dma_free_coherent(&dev->nic_info.pdev->dev, mem->size,
                                  mem->va, mem->pa);
+        mem->va = NULL;
        kfree(mem->debugfs_mem);
 }
@@ -838,15 +840,9 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev)
                                &dev->reset_stats, &ocrdma_dbg_ops))
                goto err;
-        /* Now create dma_mem for stats mbx command */
-        if (!ocrdma_alloc_stats_mem(dev))
-                goto err;
-        mutex_init(&dev->stats_lock);
        return;
 err:
-        ocrdma_release_stats_mem(dev);
        debugfs_remove_recursive(dev->dir);
        dev->dir = NULL;
 }
@@ -855,9 +851,7 @@ void ocrdma_rem_port_stats(struct ocrdma_dev *dev)
 {
        if (!dev->dir)
                return;
-        debugfs_remove(dev->dir);
+        debugfs_remove_recursive(dev->dir);
-        mutex_destroy(&dev->stats_lock);
-        ocrdma_release_stats_mem(dev);
 }
 void ocrdma_init_debugfs(void)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
index c9e58d04c7b8..bba1fec4f11f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
@@ -65,6 +65,8 @@ enum OCRDMA_STATS_TYPE {
 void ocrdma_rem_debugfs(void);
 void ocrdma_init_debugfs(void);
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev);
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev);
 void ocrdma_rem_port_stats(struct ocrdma_dev *dev);
 void ocrdma_add_port_stats(struct ocrdma_dev *dev);
 int ocrdma_pma_counters(struct ocrdma_dev *dev,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index d4c687b548d8..37620b4baafb 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                        IB_DEVICE_SYS_IMAGE_GUID |
                                        IB_DEVICE_LOCAL_DMA_LKEY |
                                        IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_srq_sge);
+        attr->max_sge = dev->attr.max_send_sge;
-        attr->max_sge_rd = 0;
+        attr->max_sge_rd = attr->max_sge;
        attr->max_cq = dev->attr.max_cq;
        attr->max_cqe = dev->attr.max_cqe;
        attr->max_mr = dev->attr.max_mr;
@@ -2726,8 +2726,7 @@ static int ocrdma_update_ud_rcqe(struct ib_wc *ibwc, struct ocrdma_cqe *cqe)
                OCRDMA_CQE_UD_STATUS_MASK) >> OCRDMA_CQE_UD_STATUS_SHIFT;
        ibwc->src_qp = le32_to_cpu(cqe->flags_status_srcqpn) &
                                                OCRDMA_CQE_SRCQP_MASK;
-        ibwc->pkey_index = le32_to_cpu(cqe->ud.rxlen_pkey) &
+        ibwc->pkey_index = 0;
-                                                OCRDMA_CQE_PKEY_MASK;
        ibwc->wc_flags = IB_WC_GRH;
        ibwc->byte_len = (le32_to_cpu(cqe->ud.rxlen_pkey) >>
                                        OCRDMA_CQE_UD_XFER_LEN_SHIFT);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5ea0c14070d1..fa9c42ff1fb0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -245,8 +245,6 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
        skb_reset_mac_header(skb);
        skb_pull(skb, IPOIB_ENCAP_LEN);
-        skb->truesize = SKB_TRUESIZE(skb->len);
        ++dev->stats.rx_packets;
        dev->stats.rx_bytes += skb->len;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 050dfa175d16..25889311b1e9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -456,7 +456,10 @@ out_locked:
        return status;
 }
-static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
+/*
+ * Caller must hold 'priv->lock'
+ */
+static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ib_sa_multicast *multicast;
@@ -466,6 +469,10 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
        ib_sa_comp_mask comp_mask;
        int ret = 0;
+        if (!priv->broadcast ||
+            !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
+                return -EINVAL;
        ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw);
        rec.mgid     = mcast->mcmember.mgid;
@@ -525,20 +532,23 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
                        rec.join_state = 4;
 #endif
        }
+        spin_unlock_irq(&priv->lock);
        multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
                                         &rec, comp_mask, GFP_KERNEL,
                                         ipoib_mcast_join_complete, mcast);
+        spin_lock_irq(&priv->lock);
        if (IS_ERR(multicast)) {
                ret = PTR_ERR(multicast);
                ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
-                spin_lock_irq(&priv->lock);
                /* Requeue this join task with a backoff delay */
                __ipoib_mcast_schedule_join_thread(priv, mcast, 1);
                clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
                spin_unlock_irq(&priv->lock);
                complete(&mcast->done);
+                spin_lock_irq(&priv->lock);
        }
+        return 0;
 }
 void ipoib_mcast_join_task(struct work_struct *work)
@@ -620,9 +630,10 @@ void ipoib_mcast_join_task(struct work_struct *work)
                                /* Found the next unjoined group */
                                init_completion(&mcast->done);
                                set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-                                spin_unlock_irq(&priv->lock);
+                                if (ipoib_mcast_join(dev, mcast)) {
-                                ipoib_mcast_join(dev, mcast);
+                                        spin_unlock_irq(&priv->lock);
-                                spin_lock_irq(&priv->lock);
+                                        return;
+                                }
                        } else if (!delay_until ||
                                 time_before(mcast->delay_until, delay_until))
                                delay_until = mcast->delay_until;
@@ -641,10 +652,9 @@ out:
        if (mcast) {
                init_completion(&mcast->done);
                set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                ipoib_mcast_join(dev, mcast);
        }
        spin_unlock_irq(&priv->lock);
-        if (mcast)
-                ipoib_mcast_join(dev, mcast);
 }
 int ipoib_mcast_start_thread(struct net_device *dev)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 6727954ab74b..e8a84d12b7ff 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1207,7 +1207,6 @@ static void xpad_led_disconnect(struct usb_xpad *xpad)
 #else
 static int xpad_led_probe(struct usb_xpad *xpad) { return 0; }
 static void xpad_led_disconnect(struct usb_xpad *xpad) { }
-static void xpad_identify_controller(struct usb_xpad *xpad) { }
 #endif
 static int xpad_start_input(struct usb_xpad *xpad)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 4d446d5085aa..c01a1d648f9f 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -235,7 +235,7 @@ struct adp5589_kpad {
        unsigned short gpimapsize;
        unsigned extend_cfg;
        bool is_adp5585;
-        bool adp5585_support_row5;
+        bool support_row5;
 #ifdef CONFIG_GPIOLIB
        unsigned char gpiomap[ADP5589_MAXGPIO];
        bool export_gpio;
@@ -485,7 +485,7 @@ static int adp5589_build_gpiomap(struct adp5589_kpad *kpad,
        if (kpad->extend_cfg & C4_EXTEND_CFG)
                pin_used[kpad->var->c4_extend_cfg] = true;
-        if (!kpad->adp5585_support_row5)
+        if (!kpad->support_row5)
                pin_used[5] = true;
        for (i = 0; i < kpad->var->maxgpio; i++)
@@ -884,12 +884,13 @@ static int adp5589_probe(struct i2c_client *client,
        switch (id->driver_data) {
        case ADP5585_02:
-                kpad->adp5585_support_row5 = true;
+                kpad->support_row5 = true;
        case ADP5585_01:
                kpad->is_adp5585 = true;
                kpad->var = &const_adp5585;
                break;
        case ADP5589:
+                kpad->support_row5 = true;
                kpad->var = &const_adp5589;
                break;
        }
diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c
index 378db10001df..4401be225d64 100644
--- a/drivers/input/keyboard/cap11xx.c
+++ b/drivers/input/keyboard/cap11xx.c
@@ -304,8 +304,10 @@ static int cap11xx_init_leds(struct device *dev,
                led->cdev.brightness = LED_OFF;
                error = of_property_read_u32(child, "reg", &reg);
-                if (error != 0 || reg >= num_leds)
+                if (error != 0 || reg >= num_leds) {
+                        of_node_put(child);
                        return -EINVAL;
+                }
                led->reg = reg;
                led->priv = priv;
@@ -313,8 +315,10 @@ static int cap11xx_init_leds(struct device *dev,
                INIT_WORK(&led->work, cap11xx_led_work);
                error = devm_led_classdev_register(dev, &led->cdev);
-                if (error)
+                if (error) {
+                        of_node_put(child);
                        return error;
+                }
                priv->num_leds++;
                led++;
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index d6d16fa78281..1f2337abcf2f 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -733,7 +733,7 @@ config INPUT_XEN_KBDDEV_FRONTEND
          module will be called xen-kbdfront.
 config INPUT_SIRFSOC_ONKEY
-        bool "CSR SiRFSoC power on/off/suspend key support"
+        tristate "CSR SiRFSoC power on/off/suspend key support"
        depends on ARCH_SIRF && OF
        default y
        help
diff --git a/drivers/input/misc/sirfsoc-onkey.c b/drivers/input/misc/sirfsoc-onkey.c
index 9d5b89befe6f..ed7237f19539 100644
--- a/drivers/input/misc/sirfsoc-onkey.c
+++ b/drivers/input/misc/sirfsoc-onkey.c
@@ -101,7 +101,7 @@ static void sirfsoc_pwrc_close(struct input_dev *input)
 static const struct of_device_id sirfsoc_pwrc_of_match[] = {
        { .compatible = "sirf,prima2-pwrc" },
        {},
-}
+};
 MODULE_DEVICE_TABLE(of, sirfsoc_pwrc_of_match);
 static int sirfsoc_pwrc_probe(struct platform_device *pdev)
diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index e272f06258ce..a3f0f5a47490 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -458,8 +458,6 @@ int vmmouse_init(struct psmouse *psmouse)
        priv->abs_dev = abs_dev;
        psmouse->private = priv;
-        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
        /* Set up and register absolute device */
        snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
                 psmouse->ps2dev.serio->phys);
@@ -475,10 +473,6 @@ int vmmouse_init(struct psmouse *psmouse)
        abs_dev->id.version = psmouse->model;
        abs_dev->dev.parent = &psmouse->ps2dev.serio->dev;
-        error = input_register_device(priv->abs_dev);
-        if (error)
-                goto init_fail;
        /* Set absolute device capabilities */
        input_set_capability(abs_dev, EV_KEY, BTN_LEFT);
        input_set_capability(abs_dev, EV_KEY, BTN_RIGHT);
@@ -488,6 +482,13 @@ int vmmouse_init(struct psmouse *psmouse)
        input_set_abs_params(abs_dev, ABS_X, 0, VMMOUSE_MAX_X, 0, 0);
        input_set_abs_params(abs_dev, ABS_Y, 0, VMMOUSE_MAX_Y, 0, 0);
+        error = input_register_device(priv->abs_dev);
+        if (error)
+                goto init_fail;
+        /* Add wheel capability to the relative device */
+        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
        psmouse->protocol_handler = vmmouse_process_byte;
        psmouse->disconnect = vmmouse_disconnect;
        psmouse->reconnect = vmmouse_reconnect;
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8f828975ab10..1ca7f551e2da 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -134,7 +134,7 @@ static void serio_find_driver(struct serio *serio)
        int error;
        error = device_attach(&serio->dev);
-        if (error < 0)
+        if (error < 0 && error != -EPROBE_DEFER)
                dev_warn(&serio->dev,
                         "device_attach() failed for %s (%s), error: %d\n",
                         serio->phys, serio->name, error);
diff --git a/drivers/input/touchscreen/colibri-vf50-ts.c b/drivers/input/touchscreen/colibri-vf50-ts.c
index 5d4903a402cc..69828d015d45 100644
--- a/drivers/input/touchscreen/colibri-vf50-ts.c
+++ b/drivers/input/touchscreen/colibri-vf50-ts.c
@@ -21,6 +21,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 0b0f8c17f3f7..23fbe382da8b 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -822,16 +822,22 @@ static void edt_ft5x06_ts_get_defaults(struct device *dev,
        int error;
        error = device_property_read_u32(dev, "threshold", &val);
-        if (!error)
+        if (!error) {
-                reg_addr->reg_threshold = val;
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_threshold, val);
+                tsdata->threshold = val;
+        }
        error = device_property_read_u32(dev, "gain", &val);
-        if (!error)
+        if (!error) {
-                reg_addr->reg_gain = val;
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_gain, val);
+                tsdata->gain = val;
+        }
        error = device_property_read_u32(dev, "offset", &val);
-        if (!error)
+        if (!error) {
-                reg_addr->reg_offset = val;
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_offset, val);
+                tsdata->offset = val;
+        }
 }
 static void
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 3447549fcc93..0a73632b28d5 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -66,7 +66,10 @@ struct its_node {
        unsigned long           phys_base;
        struct its_cmd_block    *cmd_base;
        struct its_cmd_block    *cmd_write;
-        void                    *tables[GITS_BASER_NR_REGS];
+        struct {
+                void            *base;
+                u32             order;
+        } tables[GITS_BASER_NR_REGS];
        struct its_collection   *collections;
        struct list_head        its_device_list;
        u64                     flags;
@@ -807,9 +810,10 @@ static void its_free_tables(struct its_node *its)
        int i;
        for (i = 0; i < GITS_BASER_NR_REGS; i++) {
-                if (its->tables[i]) {
+                if (its->tables[i].base) {
-                        free_page((unsigned long)its->tables[i]);
+                        free_pages((unsigned long)its->tables[i].base,
-                        its->tables[i] = NULL;
+                                   its->tables[i].order);
+                        its->tables[i].base = NULL;
                }
        }
 }
@@ -890,7 +894,8 @@ retry_alloc_baser:
                        goto out_free;
                }
-                its->tables[i] = base;
+                its->tables[i].base = base;
+                its->tables[i].order = order;
 retry_baser:
                val = (virt_to_phys(base)                                |
@@ -940,7 +945,7 @@ retry_baser:
                         * something is horribly wrong...
                         */
                        free_pages((unsigned long)base, order);
-                        its->tables[i] = NULL;
+                        its->tables[i].base = NULL;
                        switch (psz) {
                        case SZ_16K:
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 911758c056c1..8f9ebf714e2b 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -384,9 +384,6 @@ static struct irq_chip gic_chip = {
        .irq_unmask             = gic_unmask_irq,
        .irq_eoi                = gic_eoi_irq,
        .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
        .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
        .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
        .flags                  = IRQCHIP_SET_TYPE_MASKED |
@@ -400,9 +397,6 @@ static struct irq_chip gic_eoimode1_chip = {
        .irq_unmask             = gic_unmask_irq,
        .irq_eoi                = gic_eoimode1_eoi_irq,
        .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
        .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
        .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
        .irq_set_vcpu_affinity  = gic_irq_set_vcpu_affinity,
@@ -443,7 +437,7 @@ static void gic_cpu_if_up(struct gic_chip_data *gic)
        u32 bypass = 0;
        u32 mode = 0;
-        if (static_key_true(&supports_deactivate))
+        if (gic == &gic_data[0] && static_key_true(&supports_deactivate))
                mode = GIC_CPU_CTRL_EOImodeNS;
        /*
@@ -1039,6 +1033,11 @@ static void __init __gic_init_bases(unsigned int gic_nr, int irq_start,
                gic->chip.name = kasprintf(GFP_KERNEL, "GIC-%d", gic_nr);
        }
+#ifdef CONFIG_SMP
+        if (gic_nr == 0)
+                gic->chip.irq_set_affinity = gic_set_affinity;
+#endif
 #ifdef CONFIG_GIC_NON_BANKED
        if (percpu_offset) { /* Frankein-GIC without banked registers... */
                unsigned int cpu;
diff --git a/drivers/irqchip/irq-sun4i.c b/drivers/irqchip/irq-sun4i.c
index 0704362f4c82..376b28074e0d 100644
--- a/drivers/irqchip/irq-sun4i.c
+++ b/drivers/irqchip/irq-sun4i.c
@@ -22,7 +22,6 @@
 #include <linux/of_irq.h>
 #include <asm/exception.h>
-#include <asm/mach/irq.h>
 #define SUN4I_IRQ_VECTOR_REG            0x00
 #define SUN4I_IRQ_PROTECTION_REG        0x08
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index e6e4bacb09ee..12099b09a9a7 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2048,6 +2048,7 @@ int db8500_prcmu_config_hotmon(u8 low, u8 high)
        return 0;
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_config_hotmon);
 static int config_hot_period(u16 val)
 {
@@ -2074,11 +2075,13 @@ int db8500_prcmu_start_temp_sense(u16 cycles32k)
        return config_hot_period(cycles32k);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_start_temp_sense);
 int db8500_prcmu_stop_temp_sense(void)
 {
        return config_hot_period(0xFFFF);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_stop_temp_sense);
 static int prcmu_a9wdog(u8 cmd, u8 d0, u8 d1, u8 d2, u8 d3)
 {
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 5914263090fc..fe207e542032 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -47,13 +47,10 @@
 #include "queue.h"
 MODULE_ALIAS("mmc:block");
-#ifdef KERNEL
 #ifdef MODULE_PARAM_PREFIX
 #undef MODULE_PARAM_PREFIX
 #endif
 #define MODULE_PARAM_PREFIX "mmcblk."
-#endif
 #define INAND_CMD38_ARG_EXT_CSD  113
 #define INAND_CMD38_ARG_ERASE    0x00
@@ -655,8 +652,10 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev,
        }
        md = mmc_blk_get(bdev->bd_disk);
-        if (!md)
+        if (!md) {
+                err = -EINVAL;
                goto cmd_err;
+        }
        card = md->queue.card;
        if (IS_ERR(card)) {
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 1c1b45ef3faf..3446097a43c0 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -925,6 +925,10 @@ mmc_spi_data_do(struct mmc_spi_host *host, struct mmc_command *cmd,
                        dma_addr = dma_map_page(dma_dev, sg_page(sg), 0,
                                                PAGE_SIZE, dir);
+                        if (dma_mapping_error(dma_dev, dma_addr)) {
+                                data->error = -EFAULT;
+                                break;
+                        }
                        if (direction == DMA_TO_DEVICE)
                                t->tx_dma = dma_addr + sg->offset;
                        else
@@ -1393,10 +1397,12 @@ static int mmc_spi_probe(struct spi_device *spi)
                host->dma_dev = dev;
                host->ones_dma = dma_map_single(dev, ones,
                                MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, host->ones_dma))
+                        goto fail_ones_dma;
                host->data_dma = dma_map_single(dev, host->data,
                                sizeof(*host->data), DMA_BIDIRECTIONAL);
+                if (dma_mapping_error(dev, host->data_dma))
-                /* REVISIT in theory those map operations can fail... */
+                        goto fail_data_dma;
                dma_sync_single_for_cpu(host->dma_dev,
                                host->data_dma, sizeof(*host->data),
@@ -1462,6 +1468,11 @@ fail_glue_init:
        if (host->dma_dev)
                dma_unmap_single(host->dma_dev, host->data_dma,
                                sizeof(*host->data), DMA_BIDIRECTIONAL);
+fail_data_dma:
+        if (host->dma_dev)
+                dma_unmap_single(host->dma_dev, host->ones_dma,
+                                MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+fail_ones_dma:
        kfree(host->data);
 fail_nobuf1:
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index ce08896b9d69..da824772bbb4 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -86,7 +86,7 @@ struct pxamci_host {
 static inline void pxamci_init_ocr(struct pxamci_host *host)
 {
 #ifdef CONFIG_REGULATOR
-        host->vcc = regulator_get_optional(mmc_dev(host->mmc), "vmmc");
+        host->vcc = devm_regulator_get_optional(mmc_dev(host->mmc), "vmmc");
        if (IS_ERR(host->vcc))
                host->vcc = NULL;
@@ -654,12 +654,8 @@ static int pxamci_probe(struct platform_device *pdev)
        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        irq = platform_get_irq(pdev, 0);
-        if (!r || irq < 0)
+        if (irq < 0)
-                return -ENXIO;
+                return irq;
-        r = request_mem_region(r->start, SZ_4K, DRIVER_NAME);
-        if (!r)
-                return -EBUSY;
        mmc = mmc_alloc_host(sizeof(struct pxamci_host), &pdev->dev);
        if (!mmc) {
@@ -695,7 +691,7 @@ static int pxamci_probe(struct platform_device *pdev)
        host->pdata = pdev->dev.platform_data;
        host->clkrt = CLKRT_OFF;
-        host->clk = clk_get(&pdev->dev, NULL);
+        host->clk = devm_clk_get(&pdev->dev, NULL);
        if (IS_ERR(host->clk)) {
                ret = PTR_ERR(host->clk);
                host->clk = NULL;
@@ -727,9 +723,9 @@ static int pxamci_probe(struct platform_device *pdev)
        host->irq = irq;
        host->imask = MMC_I_MASK_ALL;
-        host->base = ioremap(r->start, SZ_4K);
+        host->base = devm_ioremap_resource(&pdev->dev, r);
-        if (!host->base) {
+        if (IS_ERR(host->base)) {
-                ret = -ENOMEM;
+                ret = PTR_ERR(host->base);
                goto out;
        }
@@ -742,7 +738,8 @@ static int pxamci_probe(struct platform_device *pdev)
        writel(64, host->base + MMC_RESTO);
        writel(host->imask, host->base + MMC_I_MASK);
-        ret = request_irq(host->irq, pxamci_irq, 0, DRIVER_NAME, host);
+        ret = devm_request_irq(&pdev->dev, host->irq, pxamci_irq, 0,
+                               DRIVER_NAME, host);
        if (ret)
                goto out;
@@ -804,7 +801,7 @@ static int pxamci_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
                goto out;
        } else {
-                mmc->caps |= host->pdata->gpio_card_ro_invert ?
+                mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
                        0 : MMC_CAP2_RO_ACTIVE_HIGH;
        }
@@ -833,14 +830,9 @@ out:
                        dma_release_channel(host->dma_chan_rx);
                if (host->dma_chan_tx)
                        dma_release_channel(host->dma_chan_tx);
-                if (host->base)
-                        iounmap(host->base);
-                if (host->clk)
-                        clk_put(host->clk);
        }
        if (mmc)
                mmc_free_host(mmc);
-        release_resource(r);
        return ret;
 }
@@ -859,9 +851,6 @@ static int pxamci_remove(struct platform_device *pdev)
                        gpio_ro = host->pdata->gpio_card_ro;
                        gpio_power = host->pdata->gpio_power;
                }
-                if (host->vcc)
-                        regulator_put(host->vcc);
                if (host->pdata && host->pdata->exit)
                        host->pdata->exit(&pdev->dev, mmc);
@@ -870,16 +859,10 @@ static int pxamci_remove(struct platform_device *pdev)
                       END_CMD_RES|PRG_DONE|DATA_TRAN_DONE,
                       host->base + MMC_I_MASK);
-                free_irq(host->irq, host);
                dmaengine_terminate_all(host->dma_chan_rx);
                dmaengine_terminate_all(host->dma_chan_tx);
                dma_release_channel(host->dma_chan_rx);
                dma_release_channel(host->dma_chan_tx);
-                iounmap(host->base);
-                clk_put(host->clk);
-                release_resource(host->res);
                mmc_free_host(mmc);
        }
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index f6047fc94062..a5cda926d38e 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -146,6 +146,33 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = {
        .ops = &sdhci_acpi_ops_int,
 };
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+        if (!gpio_cd)
+                return 0;
+        pm_runtime_get_sync(mmc->parent);
+        spin_lock_irqsave(&host->lock, flags);
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+        return ret;
+}
 static int sdhci_acpi_emmc_probe_slot(struct platform_device *pdev,
                                      const char *hid, const char *uid)
 {
@@ -196,6 +223,9 @@ static int sdhci_acpi_sd_probe_slot(struct platform_device *pdev,
        /* Platform specific code during sd probe slot goes here */
+        if (hid && !strcmp(hid, "80865ACA"))
+                host->mmc_host_ops.get_cd = bxt_get_cd;
        return 0;
 }
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 7e7d8f0c9438..9cb86fb25976 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -217,6 +217,7 @@ static int sdhci_at91_probe(struct platform_device *pdev)
 pm_runtime_disable:
        pm_runtime_disable(&pdev->dev);
        pm_runtime_set_suspended(&pdev->dev);
+        pm_runtime_put_noidle(&pdev->dev);
 clocks_disable_unprepare:
        clk_disable_unprepare(priv->gck);
        clk_disable_unprepare(priv->mainck);
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index cc851b065d0a..df3b8eced8c4 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -330,6 +330,33 @@ static void spt_read_drive_strength(struct sdhci_host *host)
        sdhci_pci_spt_drive_strength = 0x10 | ((val >> 12) & 0xf);
 }
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+        if (!gpio_cd)
+                return 0;
+        pm_runtime_get_sync(mmc->parent);
+        spin_lock_irqsave(&host->lock, flags);
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+        return ret;
+}
 static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
 {
        slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
@@ -362,6 +389,10 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
        slot->cd_con_id = NULL;
        slot->cd_idx = 0;
        slot->cd_override_level = true;
+        if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
+            slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
+                slot->host->mmc_host_ops.get_cd = bxt_get_cd;
        return 0;
 }
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index d622435d1bcc..add9fdfd1d8f 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1360,7 +1360,7 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
        sdhci_runtime_pm_get(host);
        /* Firstly check card presence */
-        present = sdhci_do_get_cd(host);
+        present = mmc->ops->get_cd(mmc);
        spin_lock_irqsave(&host->lock, flags);
@@ -2849,6 +2849,8 @@ struct sdhci_host *sdhci_alloc_host(struct device *dev,
        host = mmc_priv(mmc);
        host->mmc = mmc;
+        host->mmc_host_ops = sdhci_ops;
+        mmc->ops = &host->mmc_host_ops;
        return host;
 }
@@ -3037,7 +3039,6 @@ int sdhci_add_host(struct sdhci_host *host)
        /*
         * Set host parameters.
         */
-        mmc->ops = &sdhci_ops;
        max_clk = host->max_clk;
        if (host->ops->get_min_clock)
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 7654ae5d2b4e..0115e9907bf8 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -430,6 +430,7 @@ struct sdhci_host {
        /* Internal data */
        struct mmc_host *mmc;   /* MMC structure */
+        struct mmc_host_ops mmc_host_ops;       /* MMC host ops */
        u64 dma_mask;           /* custom DMA mask */
 #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 1ca8a1359cbc..6234eab38ff3 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -445,7 +445,7 @@ static void sh_mmcif_request_dma(struct sh_mmcif_host *host)
                                                        pdata->slave_id_rx);
        } else {
                host->chan_tx = dma_request_slave_channel(dev, "tx");
-                host->chan_tx = dma_request_slave_channel(dev, "rx");
+                host->chan_rx = dma_request_slave_channel(dev, "rx");
        }
        dev_dbg(dev, "%s: got channel TX %p RX %p\n", __func__, host->chan_tx,
                host->chan_rx);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 49eea8981332..3010080cfeee 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7831,6 +7831,14 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
        return ret;
 }
+static bool tg3_tso_bug_gso_check(struct tg3_napi *tnapi, struct sk_buff *skb)
+{
+        /* Check if we will never have enough descriptors,
+         * as gso_segs can be more than current ring size
+         */
+        return skb_shinfo(skb)->gso_segs < tnapi->tx_pending / 3;
+}
 static netdev_tx_t tg3_start_xmit(struct sk_buff *, struct net_device *);
 /* Use GSO to workaround all TSO packets that meet HW bug conditions
@@ -7934,14 +7942,19 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 * vlan encapsulated.
                 */
                if (skb->protocol == htons(ETH_P_8021Q) ||
-                    skb->protocol == htons(ETH_P_8021AD))
+                    skb->protocol == htons(ETH_P_8021AD)) {
-                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                        if (tg3_tso_bug_gso_check(tnapi, skb))
+                                return tg3_tso_bug(tp, tnapi, txq, skb);
+                        goto drop;
+                }
                if (!skb_is_gso_v6(skb)) {
                        if (unlikely((ETH_HLEN + hdr_len) > 80) &&
-                            tg3_flag(tp, TSO_BUG))
+                            tg3_flag(tp, TSO_BUG)) {
-                                return tg3_tso_bug(tp, tnapi, txq, skb);
+                                if (tg3_tso_bug_gso_check(tnapi, skb))
+                                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                                goto drop;
+                        }
                        ip_csum = iph->check;
                        ip_tot_len = iph->tot_len;
                        iph->check = 0;
@@ -8073,7 +8086,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (would_hit_hwbug) {
                tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, i);
-                if (mss) {
+                if (mss && tg3_tso_bug_gso_check(tnapi, skb)) {
                        /* If it's a TSO packet, do GSO instead of
                         * allocating and copying to a large linear SKB
                         */
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index 1671fa3332c2..7ba6d530b0c0 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -33,7 +33,7 @@
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "2.3.0.12"
+#define DRV_VERSION             "2.3.0.20"
 #define DRV_COPYRIGHT           "Copyright 2008-2013 Cisco Systems, Inc"
 #define ENIC_BARS_MAX           6
diff --git a/drivers/net/ethernet/cisco/enic/vnic_dev.c b/drivers/net/ethernet/cisco/enic/vnic_dev.c
index 1ffd1050860b..1fdf5fe12a95 100644
--- a/drivers/net/ethernet/cisco/enic/vnic_dev.c
+++ b/drivers/net/ethernet/cisco/enic/vnic_dev.c
@@ -298,7 +298,8 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
                          int wait)
 {
        struct devcmd2_controller *dc2c = vdev->devcmd2;
-        struct devcmd2_result *result = dc2c->result + dc2c->next_result;
+        struct devcmd2_result *result;
+        u8 color;
        unsigned int i;
        int delay, err;
        u32 fetch_index, new_posted;
@@ -336,13 +337,17 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
        if (dc2c->cmd_ring[posted].flags & DEVCMD2_FNORESULT)
                return 0;
+        result = dc2c->result + dc2c->next_result;
+        color = dc2c->color;
+        dc2c->next_result++;
+        if (dc2c->next_result == dc2c->result_size) {
+                dc2c->next_result = 0;
+                dc2c->color = dc2c->color ? 0 : 1;
+        }
        for (delay = 0; delay < wait; delay++) {
-                if (result->color == dc2c->color) {
+                if (result->color == color) {
-                        dc2c->next_result++;
-                        if (dc2c->next_result == dc2c->result_size) {
-                                dc2c->next_result = 0;
-                                dc2c->color = dc2c->color ? 0 : 1;
-                        }
                        if (result->error) {
                                err = result->error;
                                if (err != ERR_ECMDUNKNOWN ||
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index d48d5793407d..e94ca1c3fc7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2429,7 +2429,7 @@ err_thread:
        flush_workqueue(priv->mfunc.master.comm_wq);
        destroy_workqueue(priv->mfunc.master.comm_wq);
 err_slaves:
-        while (--i) {
+        while (i--) {
                for (port = 1; port <= MLX4_MAX_PORTS; port++)
                        kfree(priv->mfunc.master.slave_state[i].vlan_filter[port]);
        }
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 70814b7386b3..fc8bbff2d7e3 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1880,9 +1880,9 @@ static int dwceqos_open(struct net_device *ndev)
        }
        netdev_reset_queue(ndev);
+        dwceqos_init_hw(lp);
        napi_enable(&lp->napi);
        phy_start(lp->phy_dev);
-        dwceqos_init_hw(lp);
        netif_start_queue(ndev);
        tasklet_enable(&lp->tx_bdreclaim_tasklet);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 0b14ac3b8d11..028e3873c310 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1039,6 +1039,17 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
        return geneve_xmit_skb(skb, dev, info);
 }
+static int geneve_change_mtu(struct net_device *dev, int new_mtu)
+{
+        /* GENEVE overhead is not fixed, so we can't enforce a more
+         * precise max MTU.
+         */
+        if (new_mtu < 68 || new_mtu > IP_MAX_MTU)
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
 static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 {
        struct ip_tunnel_info *info = skb_tunnel_info(skb);
@@ -1083,7 +1094,7 @@ static const struct net_device_ops geneve_netdev_ops = {
        .ndo_stop               = geneve_stop,
        .ndo_start_xmit         = geneve_xmit,
        .ndo_get_stats64        = ip_tunnel_get_stats64,
-        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_change_mtu         = geneve_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_fill_metadata_dst  = geneve_fill_metadata_dst,
@@ -1442,11 +1453,21 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
        err = geneve_configure(net, dev, &geneve_remote_unspec,
                               0, 0, 0, htons(dst_port), true, 0);
-        if (err) {
+        if (err)
-                free_netdev(dev);
+                goto err;
-                return ERR_PTR(err);
-        }
+        /* openvswitch users expect packet sizes to be unrestricted,
+         * so set the largest MTU we can.
+         */
+        err = geneve_change_mtu(dev, IP_MAX_MTU);
+        if (err)
+                goto err;
        return dev;
+ err:
+        free_netdev(dev);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 65439188c582..a31cd954b308 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2367,29 +2367,43 @@ static void vxlan_set_multicast_list(struct net_device *dev)
 {
 }
-static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+static int __vxlan_change_mtu(struct net_device *dev,
+                              struct net_device *lowerdev,
+                              struct vxlan_rdst *dst, int new_mtu, bool strict)
 {
-        struct vxlan_dev *vxlan = netdev_priv(dev);
+        int max_mtu = IP_MAX_MTU;
-        struct vxlan_rdst *dst = &vxlan->default_dst;
-        struct net_device *lowerdev;
-        int max_mtu;
-        lowerdev = __dev_get_by_index(vxlan->net, dst->remote_ifindex);
+        if (lowerdev)
-        if (lowerdev == NULL)
+                max_mtu = lowerdev->mtu;
-                return eth_change_mtu(dev, new_mtu);
        if (dst->remote_ip.sa.sa_family == AF_INET6)
-                max_mtu = lowerdev->mtu - VXLAN6_HEADROOM;
+                max_mtu -= VXLAN6_HEADROOM;
        else
-                max_mtu = lowerdev->mtu - VXLAN_HEADROOM;
+                max_mtu -= VXLAN_HEADROOM;
-        if (new_mtu < 68 || new_mtu > max_mtu)
+        if (new_mtu < 68)
                return -EINVAL;
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+                new_mtu = max_mtu;
+        }
        dev->mtu = new_mtu;
        return 0;
 }
+static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+{
+        struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct vxlan_rdst *dst = &vxlan->default_dst;
+        struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
+                                                         dst->remote_ifindex);
+        return __vxlan_change_mtu(dev, lowerdev, dst, new_mtu, true);
+}
 static int egress_ipv4_tun_info(struct net_device *dev, struct sk_buff *skb,
                                struct ip_tunnel_info *info,
                                __be16 sport, __be16 dport)
@@ -2765,6 +2779,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
        int err;
        bool use_ipv6 = false;
        __be16 default_port = vxlan->cfg.dst_port;
+        struct net_device *lowerdev = NULL;
        vxlan->net = src_net;
@@ -2785,9 +2800,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
        }
        if (conf->remote_ifindex) {
-                struct net_device *lowerdev
+                lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex);
-                         = __dev_get_by_index(src_net, conf->remote_ifindex);
                dst->remote_ifindex = conf->remote_ifindex;
                if (!lowerdev) {
@@ -2811,6 +2824,12 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                needed_headroom = lowerdev->hard_header_len;
        }
+        if (conf->mtu) {
+                err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false);
+                if (err)
+                        return err;
+        }
        if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA)
                needed_headroom += VXLAN6_HEADROOM;
        else
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5648317d355f..39c4be41ef83 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -154,6 +154,7 @@ static const struct of_device_id whitelist_phys[] = {
        { .compatible = "marvell,88E1111", },
        { .compatible = "marvell,88e1116", },
        { .compatible = "marvell,88e1118", },
+        { .compatible = "marvell,88e1145", },
        { .compatible = "marvell,88e1149r", },
        { .compatible = "marvell,88e1310", },
        { .compatible = "marvell,88E1510", },
diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
index 5816bceddb65..a576aeeb22da 100644
--- a/drivers/pci/host/pcie-iproc.c
+++ b/drivers/pci/host/pcie-iproc.c
@@ -64,7 +64,6 @@
 #define OARR_SIZE_CFG                BIT(OARR_SIZE_CFG_SHIFT)
 #define MAX_NUM_OB_WINDOWS           2
-#define MAX_NUM_PAXC_PF              4
 #define IPROC_PCIE_REG_INVALID 0xffff
@@ -170,20 +169,6 @@ static inline void iproc_pcie_ob_write(struct iproc_pcie *pcie,
        writel(val, pcie->base + offset + (window * 8));
 }
-static inline bool iproc_pcie_device_is_valid(struct iproc_pcie *pcie,
-                                              unsigned int slot,
-                                              unsigned int fn)
-{
-        if (slot > 0)
-                return false;
-        /* PAXC can only support limited number of functions */
-        if (pcie->type == IPROC_PCIE_PAXC && fn >= MAX_NUM_PAXC_PF)
-                return false;
-        return true;
-}
 /**
 * Note access to the configuration registers are protected at the higher layer
 * by 'pci_lock' in drivers/pci/access.c
@@ -199,11 +184,11 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
        u32 val;
        u16 offset;
-        if (!iproc_pcie_device_is_valid(pcie, slot, fn))
-                return NULL;
        /* root complex access */
        if (busno == 0) {
+                if (slot > 0 || fn > 0)
+                        return NULL;
                iproc_pcie_write_reg(pcie, IPROC_PCIE_CFG_IND_ADDR,
                                     where & CFG_IND_ADDR_MASK);
                offset = iproc_pcie_reg_offset(pcie, IPROC_PCIE_CFG_IND_DATA);
@@ -213,6 +198,14 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
                        return (pcie->base + offset);
        }
+        /*
+         * PAXC is connected to an internally emulated EP within the SoC.  It
+         * allows only one device.
+         */
+        if (pcie->type == IPROC_PCIE_PAXC)
+                if (slot > 0)
+                        return NULL;
        /* EP device access */
        val = (busno << CFG_ADDR_BUS_NUM_SHIFT) |
                (slot << CFG_ADDR_DEV_NUM_SHIFT) |
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 0bf82a20a0fb..48d21e0edd56 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
        rpc->rpd = dev;
        INIT_WORK(&rpc->dpc_handler, aer_isr);
        mutex_init(&rpc->rpc_mutex);
-        init_waitqueue_head(&rpc->wait_release);
        /* Use PCIe bus function to store rpc into PCIe device */
        set_service_data(dev, rpc);
@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev)
                if (rpc->isr)
                        free_irq(dev->irq, dev);
-                wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx);
+                flush_work(&rpc->dpc_handler);
                aer_disable_rootport(rpc);
                kfree(rpc);
                set_service_data(dev, NULL);
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index 84420b7c9456..945c939a86c5 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -72,7 +72,6 @@ struct aer_rpc {
                                         * recovery on the same
                                         * root port hierarchy
                                         */
-        wait_queue_head_t wait_release;
 };
 struct aer_broadcast_data {
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 712392504ed9..521e39c1b66d 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -811,8 +811,6 @@ void aer_isr(struct work_struct *work)
        while (get_e_source(rpc, &e_src))
                aer_isr_one_error(p_device, &e_src);
        mutex_unlock(&rpc->rpc_mutex);
-        wake_up(&rpc->wait_release);
 }
 /**
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index e7e117d5dbbe..0124d17bd9fe 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -224,6 +224,7 @@ config PHY_MT65XX_USB3
 config PHY_HI6220_USB
        tristate "hi6220 USB PHY support"
+        depends on (ARCH_HISI && ARM64) || COMPILE_TEST
        select GENERIC_PHY
        select MFD_SYSCON
        help
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 8c7f27db6ad3..e7e574dc667a 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -275,20 +275,21 @@ EXPORT_SYMBOL_GPL(phy_exit);
 int phy_power_on(struct phy *phy)
 {
-        int ret;
+        int ret = 0;
        if (!phy)
-                return 0;
+                goto out;
        if (phy->pwr) {
                ret = regulator_enable(phy->pwr);
                if (ret)
-                        return ret;
+                        goto out;
        }
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
-                return ret;
+                goto err_pm_sync;
        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
@@ -296,19 +297,20 @@ int phy_power_on(struct phy *phy)
                ret = phy->ops->power_on(phy);
                if (ret < 0) {
                        dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
-                        goto out;
+                        goto err_pwr_on;
                }
        }
        ++phy->power_count;
        mutex_unlock(&phy->mutex);
        return 0;
-out:
+err_pwr_on:
        mutex_unlock(&phy->mutex);
        phy_pm_runtime_put_sync(phy);
+err_pm_sync:
        if (phy->pwr)
                regulator_disable(phy->pwr);
+out:
        return ret;
 }
 EXPORT_SYMBOL_GPL(phy_power_on);
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 4a3fc6e59f8e..840f3eae428b 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -715,6 +715,7 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        pm_runtime_use_autosuspend(&pdev->dev);
        pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
        pm_runtime_enable(&pdev->dev);
+        pm_runtime_get_sync(&pdev->dev);
        /* Our job is to use irqs and status from the power module
         * to keep the transceiver disabled when nothing's connected.
@@ -750,6 +751,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
        struct twl4030_usb *twl = platform_get_drvdata(pdev);
        int val;
+        usb_remove_phy(&twl->phy);
        pm_runtime_get_sync(twl->dev);
        cancel_delayed_work(&twl->id_workaround_work);
        device_remove_file(twl->dev, &dev_attr_vbus);
@@ -757,6 +759,13 @@ static int twl4030_usb_remove(struct platform_device *pdev)
        /* set transceiver mode to power on defaults */
        twl4030_usb_set_mode(twl, -1);
+        /* idle ulpi before powering off */
+        if (cable_present(twl->linkstat))
+                pm_runtime_put_noidle(twl->dev);
+        pm_runtime_mark_last_busy(twl->dev);
+        pm_runtime_put_sync_suspend(twl->dev);
+        pm_runtime_disable(twl->dev);
        /* autogate 60MHz ULPI clock,
         * clear dpll clock request for i2c access,
         * disable 32KHz
@@ -771,11 +780,6 @@ static int twl4030_usb_remove(struct platform_device *pdev)
        /* disable complete OTG block */
        twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB);
-        if (cable_present(twl->linkstat))
-                pm_runtime_put_noidle(twl->dev);
-        pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put(twl->dev);
        return 0;
 }
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index 20f0ad9bb9f3..e20f23e04c24 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -41,8 +41,7 @@ static const struct key_entry intel_hid_keymap[] = {
        { KE_KEY, 4, { KEY_HOME } },
        { KE_KEY, 5, { KEY_END } },
        { KE_KEY, 6, { KEY_PAGEUP } },
-        { KE_KEY, 4, { KEY_PAGEDOWN } },
+        { KE_KEY, 7, { KEY_PAGEDOWN } },
-        { KE_KEY, 4, { KEY_HOME } },
        { KE_KEY, 8, { KEY_RFKILL } },
        { KE_KEY, 9, { KEY_POWER } },
        { KE_KEY, 11, { KEY_SLEEP } },
diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
index 02bc5a6343c3..aa454241489c 100644
--- a/drivers/platform/x86/intel_scu_ipcutil.c
+++ b/drivers/platform/x86/intel_scu_ipcutil.c
@@ -49,7 +49,7 @@ struct scu_ipc_data {
 static int scu_reg_access(u32 cmd, struct scu_ipc_data  *data)
 {
-        int count = data->count;
+        unsigned int count = data->count;
        if (count == 0 || count == 3 || count > 4)
                return -EINVAL;
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 361358134315..93880ed6291c 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -562,7 +562,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev,
                        /*
                         * Command Lock contention
                         */
-                        err = SCSI_DH_RETRY;
+                        err = SCSI_DH_IMM_RETRY;
                break;
        default:
                break;
@@ -612,6 +612,8 @@ retry:
                err = mode_select_handle_sense(sdev, h->sense);
                if (err == SCSI_DH_RETRY && retry_cnt--)
                        goto retry;
+                if (err == SCSI_DH_IMM_RETRY)
+                        goto retry;
        }
        if (err == SCSI_DH_OK) {
                h->state = RDAC_STATE_ACTIVE;
diff --git a/drivers/scsi/hisi_sas/Kconfig b/drivers/scsi/hisi_sas/Kconfig
index b67661836c9f..d1dd1616f983 100644
--- a/drivers/scsi/hisi_sas/Kconfig
+++ b/drivers/scsi/hisi_sas/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_HISI_SAS
        tristate "HiSilicon SAS"
-        depends on HAS_DMA
+        depends on HAS_DMA && HAS_IOMEM
        depends on ARM64 || COMPILE_TEST
        select SCSI_SAS_LIBSAS
        select BLK_DEV_INTEGRITY
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index 057fdeb720ac..eea24d7531cf 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -1289,13 +1289,10 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba,
                goto out;
        }
-        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK) {
+        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK &&
-                if (!(cmplt_hdr_data & CMPLT_HDR_CMD_CMPLT_MSK) ||
+                !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK)) {
-                    !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK))
-                        ts->stat = SAS_DATA_OVERRUN;
-                else
-                        slot_err_v1_hw(hisi_hba, task, slot);
+                slot_err_v1_hw(hisi_hba, task, slot);
                goto out;
        }
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 52a87657c7dd..692a7570b5e1 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2204,7 +2204,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
        /* Clear outstanding commands array. */
        for (que = 0; que < ha->max_req_queues; que++) {
                req = ha->req_q_map[que];
-                if (!req)
+                if (!req || !test_bit(que, ha->req_qid_map))
                        continue;
                req->out_ptr = (void *)(req->ring + req->length);
                *req->out_ptr = 0;
@@ -2221,7 +2221,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
        for (que = 0; que < ha->max_rsp_queues; que++) {
                rsp = ha->rsp_q_map[que];
-                if (!rsp)
+                if (!rsp || !test_bit(que, ha->rsp_qid_map))
                        continue;
                rsp->in_ptr = (void *)(rsp->ring + rsp->length);
                *rsp->in_ptr = 0;
@@ -4981,7 +4981,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
        for (i = 1; i < ha->max_rsp_queues; i++) {
                rsp = ha->rsp_q_map[i];
-                if (rsp) {
+                if (rsp && test_bit(i, ha->rsp_qid_map)) {
                        rsp->options &= ~BIT_0;
                        ret = qla25xx_init_rsp_que(base_vha, rsp);
                        if (ret != QLA_SUCCESS)
@@ -4996,8 +4996,8 @@ qla25xx_init_queues(struct qla_hw_data *ha)
        }
        for (i = 1; i < ha->max_req_queues; i++) {
                req = ha->req_q_map[i];
-                if (req) {
+                if (req && test_bit(i, ha->req_qid_map)) {
-                /* Clear outstanding commands array. */
+                        /* Clear outstanding commands array. */
                        req->options &= ~BIT_0;
                        ret = qla25xx_init_req_que(base_vha, req);
                        if (ret != QLA_SUCCESS)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index d4d65eb0e9b4..4af95479a9db 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3063,9 +3063,9 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                    "MSI-X: Failed to enable support "
                    "-- %d/%d\n Retry with %d vectors.\n",
                    ha->msix_count, ret, ret);
+                ha->msix_count = ret;
+                ha->max_rsp_queues = ha->msix_count - 1;
        }
-        ha->msix_count = ret;
-        ha->max_rsp_queues = ha->msix_count - 1;
        ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
                                ha->msix_count, GFP_KERNEL);
        if (!ha->msix_entries) {
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c5dd594f6c31..cf7ba52bae66 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -600,7 +600,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
        /* Delete request queues */
        for (cnt = 1; cnt < ha->max_req_queues; cnt++) {
                req = ha->req_q_map[cnt];
-                if (req) {
+                if (req && test_bit(cnt, ha->req_qid_map)) {
                        ret = qla25xx_delete_req_que(vha, req);
                        if (ret != QLA_SUCCESS) {
                                ql_log(ql_log_warn, vha, 0x00ea,
@@ -614,7 +614,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
        /* Delete response queues */
        for (cnt = 1; cnt < ha->max_rsp_queues; cnt++) {
                rsp = ha->rsp_q_map[cnt];
-                if (rsp) {
+                if (rsp && test_bit(cnt, ha->rsp_qid_map)) {
                        ret = qla25xx_delete_rsp_que(vha, rsp);
                        if (ret != QLA_SUCCESS) {
                                ql_log(ql_log_warn, vha, 0x00eb,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index f1788db43195..f6c7ce35b542 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -409,6 +409,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
        int cnt;
        for (cnt = 0; cnt < ha->max_req_queues; cnt++) {
+                if (!test_bit(cnt, ha->req_qid_map))
+                        continue;
                req = ha->req_q_map[cnt];
                qla2x00_free_req_que(ha, req);
        }
@@ -416,6 +419,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
        ha->req_q_map = NULL;
        for (cnt = 0; cnt < ha->max_rsp_queues; cnt++) {
+                if (!test_bit(cnt, ha->rsp_qid_map))
+                        continue;
                rsp = ha->rsp_q_map[cnt];
                qla2x00_free_rsp_que(ha, rsp);
        }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 8075a4cdb45c..ee967becd257 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -105,7 +105,7 @@ static void qlt_response_pkt(struct scsi_qla_host *ha, response_t *pkt);
 static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
        int fn, void *iocb, int flags);
 static void qlt_send_term_exchange(struct scsi_qla_host *ha, struct qla_tgt_cmd
-        *cmd, struct atio_from_isp *atio, int ha_locked);
+        *cmd, struct atio_from_isp *atio, int ha_locked, int ul_abort);
 static void qlt_reject_free_srr_imm(struct scsi_qla_host *ha,
        struct qla_tgt_srr_imm *imm, int ha_lock);
 static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
@@ -1756,7 +1756,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
                qlt_send_notify_ack(vha, &mcmd->orig_iocb.imm_ntfy,
                    0, 0, 0, 0, 0, 0);
        else {
-                if (mcmd->se_cmd.se_tmr_req->function == TMR_ABORT_TASK)
+                if (mcmd->orig_iocb.atio.u.raw.entry_type == ABTS_RECV_24XX)
                        qlt_24xx_send_abts_resp(vha, &mcmd->orig_iocb.abts,
                            mcmd->fc_tm_rsp, false);
                else
@@ -2665,7 +2665,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
                        /* no need to terminate. FW already freed exchange. */
                        qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
                else
-                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
                spin_unlock_irqrestore(&ha->hardware_lock, flags);
                return 0;
        }
@@ -3173,7 +3173,8 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
 }
 static void qlt_send_term_exchange(struct scsi_qla_host *vha,
-        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked,
+        int ul_abort)
 {
        unsigned long flags = 0;
        int rc;
@@ -3193,8 +3194,7 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
                qlt_alloc_qfull_cmd(vha, atio, 0, 0);
 done:
-        if (cmd && (!cmd->aborted ||
+        if (cmd && !ul_abort && !cmd->aborted) {
-            !cmd->cmd_sent_to_fw)) {
                if (cmd->sg_mapped)
                        qlt_unmap_sg(vha, cmd);
                vha->hw->tgt.tgt_ops->free_cmd(cmd);
@@ -3253,21 +3253,38 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
 }
-void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
 {
        struct qla_tgt *tgt = cmd->tgt;
        struct scsi_qla_host *vha = tgt->vha;
        struct se_cmd *se_cmd = &cmd->se_cmd;
+        unsigned long flags;
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
            "qla_target(%d): terminating exchange for aborted cmd=%p "
            "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
            se_cmd->tag);
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if (cmd->aborted) {
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /*
+                 * It's normal to see 2 calls in this path:
+                 *  1) XFER Rdy completion + CMD_T_ABORT
+                 *  2) TCM TMR - drain_state_list
+                 */
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                        "multiple abort. %p transport_state %x, t_state %x,"
+                        " se_cmd_flags %x \n", cmd, cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,cmd->se_cmd.se_cmd_flags);
+                return EIO;
+        }
        cmd->aborted = 1;
        cmd->cmd_flags |= BIT_6;
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0, 1);
+        return 0;
 }
 EXPORT_SYMBOL(qlt_abort_cmd);
@@ -3282,6 +3299,9 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
        BUG_ON(cmd->cmd_in_wq);
+        if (cmd->sg_mapped)
+                qlt_unmap_sg(cmd->vha, cmd);
        if (!cmd->q_full)
                qlt_decr_num_pend_cmds(cmd->vha);
@@ -3399,7 +3419,7 @@ static int qlt_term_ctio_exchange(struct scsi_qla_host *vha, void *ctio,
                term = 1;
        if (term)
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
        return term;
 }
@@ -3580,12 +3600,13 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                case CTIO_PORT_LOGGED_OUT:
                case CTIO_PORT_UNAVAILABLE:
                {
-                        int logged_out = (status & 0xFFFF);
+                        int logged_out =
+                                (status & 0xFFFF) == CTIO_PORT_LOGGED_OUT;
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf059,
                            "qla_target(%d): CTIO with %s status %x "
                            "received (state %x, se_cmd %p)\n", vha->vp_idx,
-                            (logged_out == CTIO_PORT_LOGGED_OUT) ?
+                            logged_out ? "PORT LOGGED OUT" : "PORT UNAVAILABLE",
-                            "PORT LOGGED OUT" : "PORT UNAVAILABLE",
                            status, cmd->state, se_cmd);
                        if (logged_out && cmd->sess) {
@@ -3754,6 +3775,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
                goto out_term;
        }
+        spin_lock_init(&cmd->cmd_lock);
        cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
        cmd->se_cmd.tag = atio->u.isp24.exchange_addr;
        cmd->unpacked_lun = scsilun_to_int(
@@ -3796,7 +3818,7 @@ out_term:
         */
        cmd->cmd_flags |= BIT_2;
        spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1, 0);
        qlt_decr_num_pend_cmds(vha);
        percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
@@ -3918,7 +3940,7 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
 out_term:
        spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &op->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &op->atio, 1, 0);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        kfree(op);
@@ -3982,7 +4004,8 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
        cmd->cmd_in_wq = 1;
        cmd->cmd_flags |= BIT_0;
-        cmd->se_cmd.cpuid = -1;
+        cmd->se_cmd.cpuid = ha->msix_count ?
+                ha->tgt.rspq_vector_cpuid : WORK_CPU_UNBOUND;
        spin_lock(&vha->cmd_list_lock);
        list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
@@ -3990,7 +4013,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
        INIT_WORK(&cmd->work, qlt_do_work);
        if (ha->msix_count) {
-                cmd->se_cmd.cpuid = ha->tgt.rspq_vector_cpuid;
                if (cmd->atio.u.isp24.fcp_cmnd.rddata)
                        queue_work_on(smp_processor_id(), qla_tgt_wq,
                            &cmd->work);
@@ -4771,7 +4793,7 @@ out_reject:
                dump_stack();
        } else {
                cmd->cmd_flags |= BIT_9;
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
        }
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
@@ -4950,7 +4972,7 @@ static void qlt_prepare_srr_imm(struct scsi_qla_host *vha,
                                    sctio, sctio->srr_id);
                                list_del(&sctio->srr_list_entry);
                                qlt_send_term_exchange(vha, sctio->cmd,
-                                    &sctio->cmd->atio, 1);
+                                    &sctio->cmd->atio, 1, 0);
                                kfree(sctio);
                        }
                }
@@ -5123,7 +5145,7 @@ static int __qlt_send_busy(struct scsi_qla_host *vha,
            atio->u.isp24.fcp_hdr.s_id);
        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
        if (!sess) {
-                qlt_send_term_exchange(vha, NULL, atio, 1);
+                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
                return 0;
        }
        /* Sending marker isn't necessary, since we called from ISR */
@@ -5406,7 +5428,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                qlt_send_busy(vha, atio, SAM_STAT_BUSY);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
                                if (!ha_locked)
@@ -5523,7 +5545,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                qlt_send_busy(vha, atio, 0);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
                        } else {
                                if (tgt->tgt_stop) {
@@ -5532,7 +5554,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
                                            "command to target, sending TERM "
                                            "EXCHANGE for rsp\n");
                                        qlt_send_term_exchange(vha, NULL,
-                                            atio, 1);
+                                            atio, 1, 0);
                                } else {
                                        ql_dbg(ql_dbg_tgt, vha, 0xe060,
                                            "qla_target(%d): Unable to send "
@@ -5960,7 +5982,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
        return;
 out_term:
-        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 0);
+        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 1, 0);
        if (sess)
                ha->tgt.tgt_ops->put_sess(sess);
        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 71b2865ba3c8..22a6a767fe07 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -943,6 +943,36 @@ struct qla_tgt_sess {
        qlt_plogi_ack_t *plogi_link[QLT_PLOGI_LINK_MAX];
 };
+typedef enum {
+        /*
+         * BIT_0 - Atio Arrival / schedule to work
+         * BIT_1 - qlt_do_work
+         * BIT_2 - qlt_do work failed
+         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
+         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
+         * BIT_5 - status respond / tcm_qla2xx_queue_status
+         * BIT_6 - tcm request to abort/Term exchange.
+         *      pre_xmit_response->qlt_send_term_exchange
+         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
+         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
+         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
+         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
+         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
+         * BIT_13 - Bad completion -
+         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
+         * BIT_14 - Back end data received/sent.
+         * BIT_15 - SRR prepare ctio
+         * BIT_16 - complete free
+         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
+         * BIT_18 - completion w/abort status
+         * BIT_19 - completion w/unknown status
+         * BIT_20 - tcm_qla2xxx_free_cmd
+         */
+        CMD_FLAG_DATA_WORK = BIT_11,
+        CMD_FLAG_DATA_WORK_FREE = BIT_21,
+} cmd_flags_t;
 struct qla_tgt_cmd {
        struct se_cmd se_cmd;
        struct qla_tgt_sess *sess;
@@ -952,6 +982,7 @@ struct qla_tgt_cmd {
        /* Sense buffer that will be mapped into outgoing status */
        unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
+        spinlock_t cmd_lock;
        /* to save extra sess dereferences */
        unsigned int conf_compl_supported:1;
        unsigned int sg_mapped:1;
@@ -986,30 +1017,8 @@ struct qla_tgt_cmd {
        uint64_t jiffies_at_alloc;
        uint64_t jiffies_at_free;
-        /* BIT_0 - Atio Arrival / schedule to work
-         * BIT_1 - qlt_do_work
+        cmd_flags_t cmd_flags;
-         * BIT_2 - qlt_do work failed
-         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
-         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
-         * BIT_5 - status respond / tcm_qla2xx_queue_status
-         * BIT_6 - tcm request to abort/Term exchange.
-         *      pre_xmit_response->qlt_send_term_exchange
-         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
-         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
-         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
-         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
-         * BIT_11 - Data actually going to TCM : tcm_qla2xx_handle_data_work
-         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
-         * BIT_13 - Bad completion -
-         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
-         * BIT_14 - Back end data received/sent.
-         * BIT_15 - SRR prepare ctio
-         * BIT_16 - complete free
-         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
-         * BIT_18 - completion w/abort status
-         * BIT_19 - completion w/unknown status
-         */
-        uint32_t cmd_flags;
 };
 struct qla_tgt_sess_work_param {
@@ -1148,7 +1157,7 @@ static inline void sid_to_portid(const uint8_t *s_id, port_id_t *p)
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
-extern void qlt_abort_cmd(struct qla_tgt_cmd *);
+extern int qlt_abort_cmd(struct qla_tgt_cmd *);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index ddbe2e7ac14d..c3e622524604 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -395,6 +395,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
        if (ent->t263.queue_type == T263_QUEUE_TYPE_REQ) {
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
                        if (req || !buf) {
                                length = req ?
                                    req->length : REQUEST_ENTRY_CNT_24XX;
@@ -408,6 +412,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
        } else if (ent->t263.queue_type == T263_QUEUE_TYPE_RSP) {
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
                        if (rsp || !buf) {
                                length = rsp ?
                                    rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -634,6 +642,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
        if (ent->t274.queue_type == T274_QUEUE_TYPE_REQ_SHAD) {
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
                        if (req || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
@@ -645,6 +657,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
        } else if (ent->t274.queue_type == T274_QUEUE_TYPE_RSP_SHAD) {
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
                        if (rsp || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index faf0a126627f..1808a01cfb7e 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -298,6 +298,10 @@ static void tcm_qla2xxx_free_cmd(struct qla_tgt_cmd *cmd)
 {
        cmd->vha->tgt_counters.core_qla_free_cmd++;
        cmd->cmd_in_wq = 1;
+        BUG_ON(cmd->cmd_flags & BIT_20);
+        cmd->cmd_flags |= BIT_20;
        INIT_WORK(&cmd->work, tcm_qla2xxx_complete_free);
        queue_work_on(smp_processor_id(), tcm_qla2xxx_free_wq, &cmd->work);
 }
@@ -374,6 +378,20 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("write_pending aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
        cmd->cmd_flags |= BIT_3;
        cmd->bufflen = se_cmd->data_length;
        cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -405,7 +423,7 @@ static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd)
            se_cmd->t_state == TRANSPORT_COMPLETE_QF_WP) {
                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
                wait_for_completion_timeout(&se_cmd->t_transport_stop_comp,
-                                            3 * HZ);
+                                                50);
                return 0;
        }
        spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -444,6 +462,9 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
        if (bidi)
                flags |= TARGET_SCF_BIDI_OP;
+        if (se_cmd->cpuid != WORK_CPU_UNBOUND)
+                flags |= TARGET_SCF_USE_CPUID;
        sess = cmd->sess;
        if (!sess) {
                pr_err("Unable to locate struct qla_tgt_sess from qla_tgt_cmd\n");
@@ -465,13 +486,25 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
+        unsigned long flags;
        /*
         * Ensure that the complete FCP WRITE payload has been received.
         * Otherwise return an exception via CHECK_CONDITION status.
         */
        cmd->cmd_in_wq = 0;
-        cmd->cmd_flags |= BIT_11;
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        cmd->cmd_flags |= CMD_FLAG_DATA_WORK;
+        if (cmd->aborted) {
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
        cmd->vha->tgt_counters.qla_core_ret_ctio++;
        if (!cmd->write_data_transferred) {
                /*
@@ -546,6 +579,20 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("queue_data_in aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
        cmd->cmd_flags |= BIT_4;
        cmd->bufflen = se_cmd->data_length;
        cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -637,11 +684,34 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
        qlt_xmit_tm_rsp(mcmd);
 }
+#define DATA_WORK_NOT_FREE(_flags) \
+        (( _flags & (CMD_FLAG_DATA_WORK|CMD_FLAG_DATA_WORK_FREE)) == \
+         CMD_FLAG_DATA_WORK)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
-        qlt_abort_cmd(cmd);
+        unsigned long flags;
+        if (qlt_abort_cmd(cmd))
+                return;
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if ((cmd->state == QLA_TGT_STATE_NEW)||
+                ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
+                 DATA_WORK_NOT_FREE(cmd->cmd_flags)) ) {
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /* Cmd have not reached firmware.
+                 * Use this trigger to free it. */
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+        return;
 }
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 47b9d13f97b8..da2e068ee47d 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -205,6 +205,7 @@ static struct {
        {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
        {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
        {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+        {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
        {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
        {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
        {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bb669d32ccd0..d749da765df1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -761,7 +761,7 @@ static int sd_setup_discard_cmnd(struct scsi_cmnd *cmd)
                break;
        default:
-                ret = BLKPREP_KILL;
+                ret = BLKPREP_INVALID;
                goto out;
        }
@@ -839,7 +839,7 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
        int ret;
        if (sdkp->device->no_write_same)
-                return BLKPREP_KILL;
+                return BLKPREP_INVALID;
        BUG_ON(bio_offset(bio) || bio_iovec(bio).bv_len != sdp->sector_size);
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 55627d097873..292c04eec9ad 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -42,6 +42,7 @@
 #include <scsi/scsi_devinfo.h>
 #include <scsi/scsi_dbg.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/scsi_transport.h>
 /*
 * All wire protocol details (storage protocol between the guest and the host)
@@ -477,19 +478,18 @@ struct hv_host_device {
 struct storvsc_scan_work {
        struct work_struct work;
        struct Scsi_Host *host;
-        uint lun;
+        u8 lun;
+        u8 tgt_id;
 };
 static void storvsc_device_scan(struct work_struct *work)
 {
        struct storvsc_scan_work *wrk;
-        uint lun;
        struct scsi_device *sdev;
        wrk = container_of(work, struct storvsc_scan_work, work);
-        lun = wrk->lun;
-        sdev = scsi_device_lookup(wrk->host, 0, 0, lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
        if (!sdev)
                goto done;
        scsi_rescan_device(&sdev->sdev_gendev);
@@ -540,7 +540,7 @@ static void storvsc_remove_lun(struct work_struct *work)
        if (!scsi_host_get(wrk->host))
                goto done;
-        sdev = scsi_device_lookup(wrk->host, 0, 0, wrk->lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
        if (sdev) {
                scsi_remove_device(sdev);
@@ -940,6 +940,7 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
        wrk->host = host;
        wrk->lun = vm_srb->lun;
+        wrk->tgt_id = vm_srb->target_id;
        INIT_WORK(&wrk->work, process_err_fn);
        schedule_work(&wrk->work);
 }
@@ -1770,6 +1771,11 @@ static int __init storvsc_drv_init(void)
        fc_transport_template = fc_attach_transport(&fc_transport_functions);
        if (!fc_transport_template)
                return -ENODEV;
+        /*
+         * Install Hyper-V specific timeout handler.
+         */
+        fc_transport_template->eh_timed_out = storvsc_eh_timed_out;
 #endif
        ret = vmbus_driver_register(&storvsc_drv);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 3327c49674d3..713c63d9681b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -898,7 +898,7 @@ static ssize_t unmap_zeroes_data_store(struct config_item *item,
        da->unmap_zeroes_data = flag;
        pr_debug("dev[%p]: SE Device Thin Provisioning LBPRZ bit: %d\n",
                 da->da_dev, flag);
-        return 0;
+        return count;
 }
 /*
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index cacd97a8cbd0..da457e25717a 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -828,6 +828,50 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
        return dev;
 }
+/*
+ * Check if the underlying struct block_device request_queue supports
+ * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
+ * in ATA and we need to set TPE=1
+ */
+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
+                                       struct request_queue *q, int block_size)
+{
+        if (!blk_queue_discard(q))
+                return false;
+        attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
+                                                                block_size;
+        /*
+         * Currently hardcoded to 1 in Linux/SCSI code..
+         */
+        attrib->max_unmap_block_desc_count = 1;
+        attrib->unmap_granularity = q->limits.discard_granularity / block_size;
+        attrib->unmap_granularity_alignment = q->limits.discard_alignment /
+                                                                block_size;
+        attrib->unmap_zeroes_data = q->limits.discard_zeroes_data;
+        return true;
+}
+EXPORT_SYMBOL(target_configure_unmap_from_queue);
+/*
+ * Convert from blocksize advertised to the initiator to the 512 byte
+ * units unconditionally used by the Linux block layer.
+ */
+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb)
+{
+        switch (dev->dev_attrib.block_size) {
+        case 4096:
+                return lb << 3;
+        case 2048:
+                return lb << 2;
+        case 1024:
+                return lb << 1;
+        default:
+                return lb;
+        }
+}
+EXPORT_SYMBOL(target_to_linux_sector);
 int target_configure_device(struct se_device *dev)
 {
        struct se_hba *hba = dev->se_hba;
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index e3195700211a..75f0f08b2a34 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -160,25 +160,11 @@ static int fd_configure_device(struct se_device *dev)
                        " block_device blocks: %llu logical_block_size: %d\n",
                        dev_size, div_u64(dev_size, fd_dev->fd_block_size),
                        fd_dev->fd_block_size);
-                /*
-                 * Check if the underlying struct block_device request_queue supports
+                if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-                 * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
+                                                      fd_dev->fd_block_size))
-                 * in ATA and we need to set TPE=1
-                 */
-                if (blk_queue_discard(q)) {
-                        dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-                        /*
-                         * Currently hardcoded to 1 in Linux/SCSI code..
-                         */
-                        dev->dev_attrib.max_unmap_block_desc_count = 1;
-                        dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                        dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
                        pr_debug("IFILE: BLOCK Discard support available,"
-                                        " disabled by default\n");
+                                 " disabled by default\n");
-                }
                /*
                 * Enable write same emulation for IBLOCK and use 0xFFFF as
                 * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -490,9 +476,12 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
        if (S_ISBLK(inode->i_mode)) {
                /* The backend is block device, use discard */
                struct block_device *bdev = inode->i_bdev;
+                struct se_device *dev = cmd->se_dev;
-                ret = blkdev_issue_discard(bdev, lba,
+                ret = blkdev_issue_discard(bdev,
-                                nolb, GFP_KERNEL, 0);
+                                           target_to_linux_sector(dev, lba),
+                                           target_to_linux_sector(dev,  nolb),
+                                           GFP_KERNEL, 0);
                if (ret < 0) {
                        pr_warn("FILEIO: blkdev_issue_discard() failed: %d\n",
                                ret);
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 5a2899f9f50b..abe4eb997a84 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -121,29 +121,11 @@ static int iblock_configure_device(struct se_device *dev)
        dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
        dev->dev_attrib.hw_queue_depth = q->nr_requests;
-        /*
+        if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-         * Check if the underlying struct block_device request_queue supports
+                                              dev->dev_attrib.hw_block_size))
-         * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
-         * in ATA and we need to set TPE=1
-         */
-        if (blk_queue_discard(q)) {
-                dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-                /*
-                 * Currently hardcoded to 1 in Linux/SCSI code..
-                 */
-                dev->dev_attrib.max_unmap_block_desc_count = 1;
-                dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
-                dev->dev_attrib.unmap_zeroes_data =
-                                q->limits.discard_zeroes_data;
                pr_debug("IBLOCK: BLOCK Discard support available,"
-                                " disabled by default\n");
+                         " disabled by default\n");
-        }
        /*
         * Enable write same emulation for IBLOCK and use 0xFFFF as
         * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -415,9 +397,13 @@ static sense_reason_t
 iblock_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
 {
        struct block_device *bdev = IBLOCK_DEV(cmd->se_dev)->ibd_bd;
+        struct se_device *dev = cmd->se_dev;
        int ret;
-        ret = blkdev_issue_discard(bdev, lba, nolb, GFP_KERNEL, 0);
+        ret = blkdev_issue_discard(bdev,
+                                   target_to_linux_sector(dev, lba),
+                                   target_to_linux_sector(dev,  nolb),
+                                   GFP_KERNEL, 0);
        if (ret < 0) {
                pr_err("blkdev_issue_discard() failed: %d\n", ret);
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -433,8 +419,10 @@ iblock_execute_write_same(struct se_cmd *cmd)
        struct scatterlist *sg;
        struct bio *bio;
        struct bio_list list;
-        sector_t block_lba = cmd->t_task_lba;
+        struct se_device *dev = cmd->se_dev;
-        sector_t sectors = sbc_get_write_same_sectors(cmd);
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
+        sector_t sectors = target_to_linux_sector(dev,
+                                        sbc_get_write_same_sectors(cmd));
        if (cmd->prot_op) {
                pr_err("WRITE_SAME: Protection information with IBLOCK"
@@ -648,12 +636,12 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                  enum dma_data_direction data_direction)
 {
        struct se_device *dev = cmd->se_dev;
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
        struct iblock_req *ibr;
        struct bio *bio, *bio_start;
        struct bio_list list;
        struct scatterlist *sg;
        u32 sg_num = sgl_nents;
-        sector_t block_lba;
        unsigned bio_cnt;
        int rw = 0;
        int i;
@@ -679,24 +667,6 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                rw = READ;
        }
-        /*
-         * Convert the blocksize advertised to the initiator to the 512 byte
-         * units unconditionally used by the Linux block layer.
-         */
-        if (dev->dev_attrib.block_size == 4096)
-                block_lba = (cmd->t_task_lba << 3);
-        else if (dev->dev_attrib.block_size == 2048)
-                block_lba = (cmd->t_task_lba << 2);
-        else if (dev->dev_attrib.block_size == 1024)
-                block_lba = (cmd->t_task_lba << 1);
-        else if (dev->dev_attrib.block_size == 512)
-                block_lba = cmd->t_task_lba;
-        else {
-                pr_err("Unsupported SCSI -> BLOCK LBA conversion:"
-                                " %u\n", dev->dev_attrib.block_size);
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        }
        ibr = kzalloc(sizeof(struct iblock_req), GFP_KERNEL);
        if (!ibr)
                goto fail;
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index dae0750c2032..db4412fe6b8a 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -141,7 +141,6 @@ void	transport_dump_vpd_proto_id(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_assoc(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident_type(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int);
-bool    target_stop_cmd(struct se_cmd *cmd, unsigned long *flags);
 void    transport_clear_lun_ref(struct se_lun *);
 void    transport_send_task_abort(struct se_cmd *);
 sense_reason_t  target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index fcdcb117c60d..82a663ba9800 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -68,23 +68,25 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
        if (dev) {
                spin_lock_irqsave(&dev->se_tmr_lock, flags);
-                list_del(&tmr->tmr_list);
+                list_del_init(&tmr->tmr_list);
                spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
        }
        kfree(tmr);
 }
-static void core_tmr_handle_tas_abort(
+static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
-        struct se_node_acl *tmr_nacl,
-        struct se_cmd *cmd,
-        int tas)
 {
-        bool remove = true;
+        unsigned long flags;
+        bool remove = true, send_tas;
        /*
         * TASK ABORTED status (TAS) bit support
         */
-        if ((tmr_nacl && (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        send_tas = (cmd->transport_state & CMD_T_TAS);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        if (send_tas) {
                remove = false;
                transport_send_task_abort(cmd);
        }
@@ -107,6 +109,46 @@ static int target_check_cdb_and_preempt(struct list_head *list,
        return 1;
 }
+static bool __target_check_io_state(struct se_cmd *se_cmd,
+                                    struct se_session *tmr_sess, int tas)
+{
+        struct se_session *sess = se_cmd->se_sess;
+        assert_spin_locked(&sess->sess_cmd_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+        /*
+         * If command already reached CMD_T_COMPLETE state within
+         * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+         * this se_cmd has been passed to fabric driver and will
+         * not be aborted.
+         *
+         * Otherwise, obtain a local se_cmd->cmd_kref now for TMR
+         * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as
+         * long as se_cmd->cmd_kref is still active unless zero.
+         */
+        spin_lock(&se_cmd->t_state_lock);
+        if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) {
+                pr_debug("Attempted to abort io tag: %llu already complete or"
+                        " fabric stop, skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
+                pr_debug("Attempted to abort io tag: %llu already shutdown,"
+                        " skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        se_cmd->transport_state |= CMD_T_ABORTED;
+        if ((tmr_sess != se_cmd->se_sess) && tas)
+                se_cmd->transport_state |= CMD_T_TAS;
+        spin_unlock(&se_cmd->t_state_lock);
+        return kref_get_unless_zero(&se_cmd->cmd_kref);
+}
 void core_tmr_abort_task(
        struct se_device *dev,
        struct se_tmr_req *tmr,
@@ -130,34 +172,22 @@ void core_tmr_abort_task(
                if (tmr->ref_task_tag != ref_tag)
                        continue;
-                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
-                        continue;
                printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
                        se_cmd->se_tfo->get_fabric_name(), ref_tag);
-                spin_lock(&se_cmd->t_state_lock);
+                if (!__target_check_io_state(se_cmd, se_sess, 0)) {
-                if (se_cmd->transport_state & CMD_T_COMPLETE) {
-                        printk("ABORT_TASK: ref_tag: %llu already complete,"
-                               " skipping\n", ref_tag);
-                        spin_unlock(&se_cmd->t_state_lock);
                        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                        target_put_sess_cmd(se_cmd);
                        goto out;
                }
-                se_cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock(&se_cmd->t_state_lock);
                list_del_init(&se_cmd->se_cmd_list);
                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
                cancel_work_sync(&se_cmd->work);
                transport_wait_for_tasks(se_cmd);
-                target_put_sess_cmd(se_cmd);
                transport_cmd_finish_abort(se_cmd, true);
+                target_put_sess_cmd(se_cmd);
                printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
                                " ref_tag: %llu\n", ref_tag);
@@ -178,9 +208,11 @@ static void core_tmr_drain_tmr_list(
        struct list_head *preempt_and_abort_list)
 {
        LIST_HEAD(drain_tmr_list);
+        struct se_session *sess;
        struct se_tmr_req *tmr_p, *tmr_pp;
        struct se_cmd *cmd;
        unsigned long flags;
+        bool rc;
        /*
         * Release all pending and outgoing TMRs aside from the received
         * LUN_RESET tmr..
@@ -206,17 +238,39 @@ static void core_tmr_drain_tmr_list(
                if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
                        continue;
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+                spin_lock(&sess->sess_cmd_lock);
                spin_lock(&cmd->t_state_lock);
-                if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+                if (!(cmd->transport_state & CMD_T_ACTIVE) ||
+                     (cmd->transport_state & CMD_T_FABRIC_STOP)) {
                        spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                        continue;
                }
                if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) {
                        spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                        continue;
                }
+                if (sess->sess_tearing_down || cmd->cmd_wait_set) {
+                        spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                cmd->transport_state |= CMD_T_ABORTED;
                spin_unlock(&cmd->t_state_lock);
+                rc = kref_get_unless_zero(&cmd->cmd_kref);
+                if (!rc) {
+                        printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                spin_unlock(&sess->sess_cmd_lock);
                list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
        }
        spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
@@ -230,20 +284,26 @@ static void core_tmr_drain_tmr_list(
                        (preempt_and_abort_list) ? "Preempt" : "", tmr_p,
                        tmr_p->function, tmr_p->response, cmd->t_state);
+                cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
                transport_cmd_finish_abort(cmd, 1);
+                target_put_sess_cmd(cmd);
        }
 }
 static void core_tmr_drain_state_list(
        struct se_device *dev,
        struct se_cmd *prout_cmd,
-        struct se_node_acl *tmr_nacl,
+        struct se_session *tmr_sess,
        int tas,
        struct list_head *preempt_and_abort_list)
 {
        LIST_HEAD(drain_task_list);
+        struct se_session *sess;
        struct se_cmd *cmd, *next;
        unsigned long flags;
+        int rc;
        /*
         * Complete outstanding commands with TASK_ABORTED SAM status.
@@ -282,6 +342,16 @@ static void core_tmr_drain_state_list(
                if (prout_cmd == cmd)
                        continue;
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+                spin_lock(&sess->sess_cmd_lock);
+                rc = __target_check_io_state(cmd, tmr_sess, tas);
+                spin_unlock(&sess->sess_cmd_lock);
+                if (!rc)
+                        continue;
                list_move_tail(&cmd->state_list, &drain_task_list);
                cmd->state_active = false;
        }
@@ -289,7 +359,7 @@ static void core_tmr_drain_state_list(
        while (!list_empty(&drain_task_list)) {
                cmd = list_entry(drain_task_list.next, struct se_cmd, state_list);
-                list_del(&cmd->state_list);
+                list_del_init(&cmd->state_list);
                pr_debug("LUN_RESET: %s cmd: %p"
                        " ITT/CmdSN: 0x%08llx/0x%08x, i_state: %d, t_state: %d"
@@ -313,16 +383,11 @@ static void core_tmr_drain_state_list(
                 * loop above, but we do it down here given that
                 * cancel_work_sync may block.
                 */
-                if (cmd->t_state == TRANSPORT_COMPLETE)
+                cancel_work_sync(&cmd->work);
-                        cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
-                spin_lock_irqsave(&cmd->t_state_lock, flags);
-                target_stop_cmd(cmd, &flags);
-                cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                core_tmr_handle_tas_abort(tmr_nacl, cmd, tas);
+                core_tmr_handle_tas_abort(cmd, tas);
+                target_put_sess_cmd(cmd);
        }
 }
@@ -334,6 +399,7 @@ int core_tmr_lun_reset(
 {
        struct se_node_acl *tmr_nacl = NULL;
        struct se_portal_group *tmr_tpg = NULL;
+        struct se_session *tmr_sess = NULL;
        int tas;
        /*
         * TASK_ABORTED status bit, this is configurable via ConfigFS
@@ -352,8 +418,9 @@ int core_tmr_lun_reset(
         * or struct se_device passthrough..
         */
        if (tmr && tmr->task_cmd && tmr->task_cmd->se_sess) {
-                tmr_nacl = tmr->task_cmd->se_sess->se_node_acl;
+                tmr_sess = tmr->task_cmd->se_sess;
-                tmr_tpg = tmr->task_cmd->se_sess->se_tpg;
+                tmr_nacl = tmr_sess->se_node_acl;
+                tmr_tpg = tmr_sess->se_tpg;
                if (tmr_nacl && tmr_tpg) {
                        pr_debug("LUN_RESET: TMR caller fabric: %s"
                                " initiator port %s\n",
@@ -366,7 +433,7 @@ int core_tmr_lun_reset(
                dev->transport->name, tas);
        core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
-        core_tmr_drain_state_list(dev, prout_cmd, tmr_nacl, tas,
+        core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
                                preempt_and_abort_list);
        /*
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9f3608e10f25..867bc6d0a68a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -534,9 +534,6 @@ void transport_deregister_session(struct se_session *se_sess)
 }
 EXPORT_SYMBOL(transport_deregister_session);
-/*
- * Called with cmd->t_state_lock held.
- */
 static void target_remove_from_state_list(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
@@ -561,10 +558,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
 {
        unsigned long flags;
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (write_pending)
-                cmd->t_state = TRANSPORT_WRITE_PENDING;
        if (remove_from_lists) {
                target_remove_from_state_list(cmd);
@@ -574,6 +567,10 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
                cmd->se_lun = NULL;
        }
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (write_pending)
+                cmd->t_state = TRANSPORT_WRITE_PENDING;
        /*
         * Determine if frontend context caller is requesting the stopping of
         * this command for frontend exceptions.
@@ -627,6 +624,8 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
+        bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
        if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
                transport_lun_remove_cmd(cmd);
        /*
@@ -638,7 +637,7 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
        if (transport_cmd_check_stop_to_fabric(cmd))
                return;
-        if (remove)
+        if (remove && ack_kref)
                transport_put_cmd(cmd);
 }
@@ -694,19 +693,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
        }
        /*
-         * See if we are waiting to complete for an exception condition.
-         */
-        if (cmd->transport_state & CMD_T_REQUEST_STOP) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                complete(&cmd->task_stop_comp);
-                return;
-        }
-        /*
         * Check for case where an explicit ABORT_TASK has been received
         * and transport_wait_for_tasks() will be waiting for completion..
         */
-        if (cmd->transport_state & CMD_T_ABORTED &&
+        if (cmd->transport_state & CMD_T_ABORTED ||
            cmd->transport_state & CMD_T_STOP) {
                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                complete_all(&cmd->t_transport_stop_comp);
@@ -721,10 +711,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
        cmd->transport_state |= (CMD_T_COMPLETE | CMD_T_ACTIVE);
        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-        if (cmd->cpuid == -1)
+        if (cmd->se_cmd_flags & SCF_USE_CPUID)
-                queue_work(target_completion_wq, &cmd->work);
-        else
                queue_work_on(cmd->cpuid, target_completion_wq, &cmd->work);
+        else
+                queue_work(target_completion_wq, &cmd->work);
 }
 EXPORT_SYMBOL(target_complete_cmd);
@@ -1203,7 +1193,6 @@ void transport_init_se_cmd(
        INIT_LIST_HEAD(&cmd->state_list);
        init_completion(&cmd->t_transport_stop_comp);
        init_completion(&cmd->cmd_wait_comp);
-        init_completion(&cmd->task_stop_comp);
        spin_lock_init(&cmd->t_state_lock);
        kref_init(&cmd->cmd_kref);
        cmd->transport_state = CMD_T_DEV_ACTIVE;
@@ -1437,6 +1426,12 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
         */
        transport_init_se_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess,
                                data_length, data_dir, task_attr, sense);
+        if (flags & TARGET_SCF_USE_CPUID)
+                se_cmd->se_cmd_flags |= SCF_USE_CPUID;
+        else
+                se_cmd->cpuid = WORK_CPU_UNBOUND;
        if (flags & TARGET_SCF_UNKNOWN_SIZE)
                se_cmd->unknown_data_length = 1;
        /*
@@ -1635,33 +1630,6 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
 EXPORT_SYMBOL(target_submit_tmr);
 /*
- * If the cmd is active, request it to be stopped and sleep until it
- * has completed.
- */
-bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
-        __releases(&cmd->t_state_lock)
-        __acquires(&cmd->t_state_lock)
-{
-        bool was_active = false;
-        if (cmd->transport_state & CMD_T_BUSY) {
-                cmd->transport_state |= CMD_T_REQUEST_STOP;
-                spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
-                pr_debug("cmd %p waiting to complete\n", cmd);
-                wait_for_completion(&cmd->task_stop_comp);
-                pr_debug("cmd %p stopped successfully\n", cmd);
-                spin_lock_irqsave(&cmd->t_state_lock, *flags);
-                cmd->transport_state &= ~CMD_T_REQUEST_STOP;
-                cmd->transport_state &= ~CMD_T_BUSY;
-                was_active = true;
-        }
-        return was_active;
-}
-/*
 * Handle SAM-esque emulation for generic transport request failures.
 */
 void transport_generic_request_failure(struct se_cmd *cmd,
@@ -1859,19 +1827,21 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
        return true;
 }
+static int __transport_check_aborted_status(struct se_cmd *, int);
 void target_execute_cmd(struct se_cmd *cmd)
 {
        /*
-         * If the received CDB has aleady been aborted stop processing it here.
-         */
-        if (transport_check_aborted_status(cmd, 1))
-                return;
-        /*
         * Determine if frontend context caller is requesting the stopping of
         * this command for frontend exceptions.
+         *
+         * If the received CDB has aleady been aborted stop processing it here.
         */
        spin_lock_irq(&cmd->t_state_lock);
+        if (__transport_check_aborted_status(cmd, 1)) {
+                spin_unlock_irq(&cmd->t_state_lock);
+                return;
+        }
        if (cmd->transport_state & CMD_T_STOP) {
                pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08llx\n",
                        __func__, __LINE__, cmd->tag);
@@ -2222,20 +2192,14 @@ static inline void transport_free_pages(struct se_cmd *cmd)
 }
 /**
- * transport_release_cmd - free a command
+ * transport_put_cmd - release a reference to a command
- * @cmd:       command to free
+ * @cmd:       command to release
 *
- * This routine unconditionally frees a command, and reference counting
+ * This routine releases our reference to the command and frees it if possible.
- * or list removal must be done in the caller.
 */
-static int transport_release_cmd(struct se_cmd *cmd)
+static int transport_put_cmd(struct se_cmd *cmd)
 {
        BUG_ON(!cmd->se_tfo);
-        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
-                core_tmr_release_req(cmd->se_tmr_req);
-        if (cmd->t_task_cdb != cmd->__t_task_cdb)
-                kfree(cmd->t_task_cdb);
        /*
         * If this cmd has been setup with target_get_sess_cmd(), drop
         * the kref and call ->release_cmd() in kref callback.
@@ -2243,18 +2207,6 @@ static int transport_release_cmd(struct se_cmd *cmd)
        return target_put_sess_cmd(cmd);
 }
-/**
- * transport_put_cmd - release a reference to a command
- * @cmd:       command to release
- *
- * This routine releases our reference to the command and frees it if possible.
- */
-static int transport_put_cmd(struct se_cmd *cmd)
-{
-        transport_free_pages(cmd);
-        return transport_release_cmd(cmd);
-}
 void *transport_kmap_data_sg(struct se_cmd *cmd)
 {
        struct scatterlist *sg = cmd->t_data_sg;
@@ -2450,34 +2402,58 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
        }
 }
-int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+static bool
+__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *,
+                           unsigned long *flags);
+static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas)
 {
        unsigned long flags;
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        __transport_wait_for_tasks(cmd, true, aborted, tas, &flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+}
+int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+{
        int ret = 0;
+        bool aborted = false, tas = false;
        if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
                if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                         transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
-                ret = transport_release_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
        } else {
                if (wait_for_tasks)
-                        transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
                /*
                 * Handle WRITE failure case where transport_generic_new_cmd()
                 * has already added se_cmd to state_list, but fabric has
                 * failed command before I/O submission.
                 */
-                if (cmd->state_active) {
+                if (cmd->state_active)
-                        spin_lock_irqsave(&cmd->t_state_lock, flags);
                        target_remove_from_state_list(cmd);
-                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                }
                if (cmd->se_lun)
                        transport_lun_remove_cmd(cmd);
-                ret = transport_put_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
+        }
+        /*
+         * If the task has been internally aborted due to TMR ABORT_TASK
+         * or LUN_RESET, target_core_tmr.c is responsible for performing
+         * the remaining calls to target_put_sess_cmd(), and not the
+         * callers of this function.
+         */
+        if (aborted) {
+                pr_debug("Detected CMD_T_ABORTED for ITT: %llu\n", cmd->tag);
+                wait_for_completion(&cmd->cmd_wait_comp);
+                cmd->se_tfo->release_cmd(cmd);
+                ret = 1;
        }
        return ret;
 }
@@ -2517,26 +2493,46 @@ out:
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
+static void target_free_cmd_mem(struct se_cmd *cmd)
+{
+        transport_free_pages(cmd);
+        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
+                core_tmr_release_req(cmd->se_tmr_req);
+        if (cmd->t_task_cdb != cmd->__t_task_cdb)
+                kfree(cmd->t_task_cdb);
+}
 static void target_release_cmd_kref(struct kref *kref)
 {
        struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
        struct se_session *se_sess = se_cmd->se_sess;
        unsigned long flags;
+        bool fabric_stop;
        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
        if (list_empty(&se_cmd->se_cmd_list)) {
                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                se_cmd->se_tfo->release_cmd(se_cmd);
                return;
        }
-        if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
+        spin_lock(&se_cmd->t_state_lock);
+        fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
+        spin_unlock(&se_cmd->t_state_lock);
+        if (se_cmd->cmd_wait_set || fabric_stop) {
+                list_del_init(&se_cmd->se_cmd_list);
                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                complete(&se_cmd->cmd_wait_comp);
                return;
        }
-        list_del(&se_cmd->se_cmd_list);
+        list_del_init(&se_cmd->se_cmd_list);
        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+        target_free_cmd_mem(se_cmd);
        se_cmd->se_tfo->release_cmd(se_cmd);
 }
@@ -2548,6 +2544,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
        struct se_session *se_sess = se_cmd->se_sess;
        if (!se_sess) {
+                target_free_cmd_mem(se_cmd);
                se_cmd->se_tfo->release_cmd(se_cmd);
                return 1;
        }
@@ -2564,6 +2561,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 {
        struct se_cmd *se_cmd;
        unsigned long flags;
+        int rc;
        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
        if (se_sess->sess_tearing_down) {
@@ -2573,8 +2571,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
        se_sess->sess_tearing_down = 1;
        list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
-        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
+        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
-                se_cmd->cmd_wait_set = 1;
+                rc = kref_get_unless_zero(&se_cmd->cmd_kref);
+                if (rc) {
+                        se_cmd->cmd_wait_set = 1;
+                        spin_lock(&se_cmd->t_state_lock);
+                        se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+                        spin_unlock(&se_cmd->t_state_lock);
+                }
+        }
        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 }
@@ -2587,15 +2592,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 {
        struct se_cmd *se_cmd, *tmp_cmd;
        unsigned long flags;
+        bool tas;
        list_for_each_entry_safe(se_cmd, tmp_cmd,
                                &se_sess->sess_wait_list, se_cmd_list) {
-                list_del(&se_cmd->se_cmd_list);
+                list_del_init(&se_cmd->se_cmd_list);
                pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
                        " %d\n", se_cmd, se_cmd->t_state,
                        se_cmd->se_tfo->get_cmd_state(se_cmd));
+                spin_lock_irqsave(&se_cmd->t_state_lock, flags);
+                tas = (se_cmd->transport_state & CMD_T_TAS);
+                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
+                if (!target_put_sess_cmd(se_cmd)) {
+                        if (tas)
+                                target_put_sess_cmd(se_cmd);
+                }
                wait_for_completion(&se_cmd->cmd_wait_comp);
                pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
                        " fabric state: %d\n", se_cmd, se_cmd->t_state,
@@ -2617,53 +2632,75 @@ void transport_clear_lun_ref(struct se_lun *lun)
        wait_for_completion(&lun->lun_ref_comp);
 }
-/**
+static bool
- * transport_wait_for_tasks - wait for completion to occur
+__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
- * @cmd:        command to wait
+                           bool *aborted, bool *tas, unsigned long *flags)
- *
+        __releases(&cmd->t_state_lock)
- * Called from frontend fabric context to wait for storage engine
+        __acquires(&cmd->t_state_lock)
- * to pause and/or release frontend generated struct se_cmd.
- */
-bool transport_wait_for_tasks(struct se_cmd *cmd)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+        if (fabric_stop)
+                cmd->transport_state |= CMD_T_FABRIC_STOP;
+        if (cmd->transport_state & CMD_T_ABORTED)
+                *aborted = true;
+        if (cmd->transport_state & CMD_T_TAS)
+                *tas = true;
        if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                return false;
-        }
        if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                return false;
-        }
-        if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+        if (!(cmd->transport_state & CMD_T_ACTIVE))
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                return false;
+        if (fabric_stop && *aborted)
                return false;
-        }
        cmd->transport_state |= CMD_T_STOP;
-        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d, t_state: %d, CMD_T_STOP\n",
+        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d,"
-                cmd, cmd->tag, cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
+                 " t_state: %d, CMD_T_STOP\n", cmd, cmd->tag,
+                 cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
        wait_for_completion(&cmd->t_transport_stop_comp);
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        spin_lock_irqsave(&cmd->t_state_lock, *flags);
        cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP);
-        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->t_transport_stop_comp) for ITT: 0x%08llx\n",
+        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->"
-                cmd->tag);
+                 "t_transport_stop_comp) for ITT: 0x%08llx\n", cmd->tag);
+        return true;
+}
+/**
+ * transport_wait_for_tasks - wait for completion to occur
+ * @cmd:        command to wait
+ *
+ * Called from frontend fabric context to wait for storage engine
+ * to pause and/or release frontend generated struct se_cmd.
+ */
+bool transport_wait_for_tasks(struct se_cmd *cmd)
+{
+        unsigned long flags;
+        bool ret, aborted = false, tas = false;
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags);
        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-        return true;
+        return ret;
 }
 EXPORT_SYMBOL(transport_wait_for_tasks);
@@ -2845,28 +2882,49 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
 }
 EXPORT_SYMBOL(transport_send_check_condition_and_sense);
-int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+        __releases(&cmd->t_state_lock)
+        __acquires(&cmd->t_state_lock)
 {
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
        if (!(cmd->transport_state & CMD_T_ABORTED))
                return 0;
        /*
         * If cmd has been aborted but either no status is to be sent or it has
         * already been sent, just return
         */
-        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS))
+        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS)) {
+                if (send_status)
+                        cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
                return 1;
+        }
-        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB: 0x%02x ITT: 0x%08llx\n",
+        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB:"
-                 cmd->t_task_cdb[0], cmd->tag);
+                " 0x%02x ITT: 0x%08llx\n", cmd->t_task_cdb[0], cmd->tag);
        cmd->se_cmd_flags &= ~SCF_SEND_DELAYED_TAS;
        cmd->scsi_status = SAM_STAT_TASK_ABORTED;
        trace_target_cmd_complete(cmd);
+        spin_unlock_irq(&cmd->t_state_lock);
        cmd->se_tfo->queue_status(cmd);
+        spin_lock_irq(&cmd->t_state_lock);
        return 1;
 }
+int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+{
+        int ret;
+        spin_lock_irq(&cmd->t_state_lock);
+        ret = __transport_check_aborted_status(cmd, send_status);
+        spin_unlock_irq(&cmd->t_state_lock);
+        return ret;
+}
 EXPORT_SYMBOL(transport_check_aborted_status);
 void transport_send_task_abort(struct se_cmd *cmd)
@@ -2888,11 +2946,17 @@ void transport_send_task_abort(struct se_cmd *cmd)
         */
        if (cmd->data_direction == DMA_TO_DEVICE) {
                if (cmd->se_tfo->write_pending_status(cmd) != 0) {
-                        cmd->transport_state |= CMD_T_ABORTED;
+                        spin_lock_irqsave(&cmd->t_state_lock, flags);
+                        if (cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS) {
+                                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                                goto send_abort;
+                        }
                        cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
+                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                        return;
                }
        }
+send_abort:
        cmd->scsi_status = SAM_STAT_TASK_ABORTED;
        transport_lun_remove_cmd(cmd);
@@ -2909,8 +2973,17 @@ static void target_tmr_work(struct work_struct *work)
        struct se_cmd *cmd = container_of(work, struct se_cmd, work);
        struct se_device *dev = cmd->se_dev;
        struct se_tmr_req *tmr = cmd->se_tmr_req;
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                tmr->response = TMR_FUNCTION_REJECTED;
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
        switch (tmr->function) {
        case TMR_ABORT_TASK:
                core_tmr_abort_task(dev, tmr, cmd->se_sess);
@@ -2943,9 +3016,17 @@ static void target_tmr_work(struct work_struct *work)
                break;
        }
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
        cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
        cmd->se_tfo->queue_tm_rsp(cmd);
+check_stop:
        transport_cmd_check_stop_to_fabric(cmd);
 }
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index dd600e5ead71..94f5154ac788 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -903,7 +903,7 @@ static int tcmu_configure_device(struct se_device *dev)
        info->version = __stringify(TCMU_MAILBOX_VERSION);
        info->mem[0].name = "tcm-user command & data buffer";
-        info->mem[0].addr = (phys_addr_t) udev->mb_addr;
+        info->mem[0].addr = (phys_addr_t)(uintptr_t)udev->mb_addr;
        info->mem[0].size = TCMU_RING_SIZE;
        info->mem[0].memtype = UIO_MEM_VIRTUAL;
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 8cc4ac64a91c..7c92c09be213 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -195,7 +195,7 @@ config IMX_THERMAL
          passive trip is crossed.
 config SPEAR_THERMAL
-        bool "SPEAr thermal sensor driver"
+        tristate "SPEAr thermal sensor driver"
        depends on PLAT_SPEAR || COMPILE_TEST
        depends on OF
        help
@@ -237,8 +237,8 @@ config DOVE_THERMAL
          framework.
 config DB8500_THERMAL
-        bool "DB8500 thermal management"
+        tristate "DB8500 thermal management"
-        depends on ARCH_U8500
+        depends on MFD_DB8500_PRCMU
        default y
        help
          Adds DB8500 thermal management implementation according to the thermal
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index e3fbc5a5d88f..6ceac4f2d4b2 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -377,26 +377,28 @@ static u32 cpu_power_to_freq(struct cpufreq_cooling_device *cpufreq_device,
 * get_load() - get load for a cpu since last updated
 * @cpufreq_device:     &struct cpufreq_cooling_device for this cpu
 * @cpu:        cpu number
+ * @cpu_idx:    index of the cpu in cpufreq_device->allowed_cpus
 *
 * Return: The average load of cpu @cpu in percentage since this
 * function was last called.
 */
-static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu)
+static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu,
+                    int cpu_idx)
 {
        u32 load;
        u64 now, now_idle, delta_time, delta_idle;
        now_idle = get_cpu_idle_time(cpu, &now, 0);
-        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu];
+        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu_idx];
-        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu];
+        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu_idx];
        if (delta_time <= delta_idle)
                load = 0;
        else
                load = div64_u64(100 * (delta_time - delta_idle), delta_time);
-        cpufreq_device->time_in_idle[cpu] = now_idle;
+        cpufreq_device->time_in_idle[cpu_idx] = now_idle;
-        cpufreq_device->time_in_idle_timestamp[cpu] = now;
+        cpufreq_device->time_in_idle_timestamp[cpu_idx] = now;
        return load;
 }
@@ -598,7 +600,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
                u32 load;
                if (cpu_online(cpu))
-                        load = get_load(cpufreq_device, cpu);
+                        load = get_load(cpufreq_device, cpu, i);
                else
                        load = 0;
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index be4eedcb839a..9043f8f91852 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -475,14 +475,10 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id, void *data,
        sensor_np = of_node_get(dev->of_node);
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                struct of_phandle_args sensor_specs;
                int ret, id;
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
                /* For now, thermal framework supports only 1 sensor per zone */
                ret = of_parse_phandle_with_args(child, "thermal-sensors",
                                                 "#thermal-sensor-cells",
@@ -881,16 +877,12 @@ int __init of_parse_thermal_zones(void)
                return 0; /* Run successfully on systems without thermal DT */
        }
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                struct thermal_zone_device *zone;
                struct thermal_zone_params *tzp;
                int i, mask = 0;
                u32 prop;
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
                tz = thermal_of_build_thermal_zone(child);
                if (IS_ERR(tz)) {
                        pr_err("failed to build thermal zone %s: %ld\n",
@@ -968,13 +960,9 @@ void of_thermal_destroy_zones(void)
                return;
        }
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                struct thermal_zone_device *zone;
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
                zone = thermal_zone_get_zone_by_name(child->name);
                if (IS_ERR(zone))
                        continue;
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 44b9c485157d..0e735acea33a 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/module.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/reboot.h>
@@ -75,8 +76,10 @@ struct rcar_thermal_priv {
 #define rcar_has_irq_support(priv)      ((priv)->common->base)
 #define rcar_id_to_shift(priv)          ((priv)->id * 8)
+#define USE_OF_THERMAL  1
 static const struct of_device_id rcar_thermal_dt_ids[] = {
        { .compatible = "renesas,rcar-thermal", },
+        { .compatible = "renesas,rcar-gen2-thermal", .data = (void *)USE_OF_THERMAL },
        {},
 };
 MODULE_DEVICE_TABLE(of, rcar_thermal_dt_ids);
@@ -200,9 +203,9 @@ err_out_unlock:
        return ret;
 }
-static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+static int rcar_thermal_get_current_temp(struct rcar_thermal_priv *priv,
+                                         int *temp)
 {
-        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
        int tmp;
        int ret;
@@ -226,6 +229,20 @@ static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
        return 0;
 }
+static int rcar_thermal_of_get_temp(void *data, int *temp)
+{
+        struct rcar_thermal_priv *priv = data;
+        return rcar_thermal_get_current_temp(priv, temp);
+}
+static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+{
+        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
+        return rcar_thermal_get_current_temp(priv, temp);
+}
 static int rcar_thermal_get_trip_type(struct thermal_zone_device *zone,
                                      int trip, enum thermal_trip_type *type)
 {
@@ -282,6 +299,10 @@ static int rcar_thermal_notify(struct thermal_zone_device *zone,
        return 0;
 }
+static const struct thermal_zone_of_device_ops rcar_thermal_zone_of_ops = {
+        .get_temp       = rcar_thermal_of_get_temp,
+};
 static struct thermal_zone_device_ops rcar_thermal_zone_ops = {
        .get_temp       = rcar_thermal_get_temp,
        .get_trip_type  = rcar_thermal_get_trip_type,
@@ -318,14 +339,20 @@ static void rcar_thermal_work(struct work_struct *work)
        priv = container_of(work, struct rcar_thermal_priv, work.work);
-        rcar_thermal_get_temp(priv->zone, &cctemp);
+        ret = rcar_thermal_get_current_temp(priv, &cctemp);
+        if (ret < 0)
+                return;
        ret = rcar_thermal_update_temp(priv);
        if (ret < 0)
                return;
        rcar_thermal_irq_enable(priv);
-        rcar_thermal_get_temp(priv->zone, &nctemp);
+        ret = rcar_thermal_get_current_temp(priv, &nctemp);
+        if (ret < 0)
+                return;
        if (nctemp != cctemp)
                thermal_zone_device_update(priv->zone);
 }
@@ -403,6 +430,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)
        struct rcar_thermal_priv *priv;
        struct device *dev = &pdev->dev;
        struct resource *res, *irq;
+        const struct of_device_id *of_id = of_match_device(rcar_thermal_dt_ids, dev);
+        unsigned long of_data = (unsigned long)of_id->data;
        int mres = 0;
        int i;
        int ret = -ENODEV;
@@ -463,7 +492,13 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                if (ret < 0)
                        goto error_unregister;
-                priv->zone = thermal_zone_device_register("rcar_thermal",
+                if (of_data == USE_OF_THERMAL)
+                        priv->zone = thermal_zone_of_sensor_register(
+                                                dev, i, priv,
+                                                &rcar_thermal_zone_of_ops);
+                else
+                        priv->zone = thermal_zone_device_register(
+                                                "rcar_thermal",
                                                1, 0, priv,
                                                &rcar_thermal_zone_ops, NULL, 0,
                                                idle);
diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c
index 534dd9136662..81b35aace9de 100644
--- a/drivers/thermal/spear_thermal.c
+++ b/drivers/thermal/spear_thermal.c
@@ -54,8 +54,7 @@ static struct thermal_zone_device_ops ops = {
        .get_temp = thermal_get_temp,
 };
-#ifdef CONFIG_PM
+static int __maybe_unused spear_thermal_suspend(struct device *dev)
-static int spear_thermal_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -72,7 +71,7 @@ static int spear_thermal_suspend(struct device *dev)
        return 0;
 }
-static int spear_thermal_resume(struct device *dev)
+static int __maybe_unused spear_thermal_resume(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -94,7 +93,6 @@ static int spear_thermal_resume(struct device *dev)
        return 0;
 }
-#endif
 static SIMPLE_DEV_PM_OPS(spear_thermal_pm_ops, spear_thermal_suspend,
                spear_thermal_resume);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index b3110040164a..2348fa613707 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -681,7 +681,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 /* this is called once with whichever end is closed last */
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
-        devpts_kill_index(tty->driver_data, tty->index);
+        struct inode *ptmx_inode;
+        if (tty->driver->subtype == PTY_TYPE_MASTER)
+                ptmx_inode = tty->driver_data;
+        else
+                ptmx_inode = tty->link->driver_data;
+        devpts_kill_index(ptmx_inode, tty->index);
+        devpts_del_ref(ptmx_inode);
 }
 static const struct tty_operations ptm_unix98_ops = {
@@ -773,6 +780,18 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
        tty->driver_data = inode;
+        /*
+         * In the case where all references to ptmx inode are dropped and we
+         * still have /dev/tty opened pointing to the master/slave pair (ptmx
+         * is closed/released before /dev/tty), we must make sure that the inode
+         * is still valid when we call the final pty_unix98_shutdown, thus we
+         * hold an additional reference to the ptmx inode. For the same /dev/tty
+         * last close case, we also need to make sure the super_block isn't
+         * destroyed (devpts instance unmounted), before /dev/tty is closed and
+         * on its release devpts_kill_index is called.
+         */
+        devpts_add_ref(inode);
        tty_add_file(tty, filp);
        slave_inode = devpts_pty_new(inode,
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index e71ec78fc11e..7cd6f9a90542 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1941,6 +1941,7 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCIE_VENDOR_ID_WCH              0x1c00
 #define PCIE_DEVICE_ID_WCH_CH382_2S1P   0x3250
 #define PCIE_DEVICE_ID_WCH_CH384_4S     0x3470
+#define PCIE_DEVICE_ID_WCH_CH382_2S     0x3253
 #define PCI_VENDOR_ID_PERICOM                   0x12D8
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7951        0x7951
@@ -2637,6 +2638,14 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                .subdevice      = PCI_ANY_ID,
                .setup          = pci_wch_ch353_setup,
        },
+        /* WCH CH382 2S card (16850 clone) */
+        {
+                .vendor         = PCIE_VENDOR_ID_WCH,
+                .device         = PCIE_DEVICE_ID_WCH_CH382_2S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch38x_setup,
+        },
        /* WCH CH382 2S1P card (16850 clone) */
        {
                .vendor         = PCIE_VENDOR_ID_WCH,
@@ -2955,6 +2964,7 @@ enum pci_board_num_t {
        pbn_fintek_4,
        pbn_fintek_8,
        pbn_fintek_12,
+        pbn_wch382_2,
        pbn_wch384_4,
        pbn_pericom_PI7C9X7951,
        pbn_pericom_PI7C9X7952,
@@ -3775,6 +3785,13 @@ static struct pciserial_board pci_boards[] = {
                .base_baud      = 115200,
                .first_offset   = 0x40,
        },
+        [pbn_wch382_2] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+                .first_offset   = 0xC0,
+        },
        [pbn_wch384_4] = {
                .flags          = FL_BASE0,
                .num_ports      = 4,
@@ -5574,6 +5591,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                PCI_ANY_ID, PCI_ANY_ID,
                0, 0, pbn_b0_bt_2_115200 },
+        {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_wch382_2 },
        {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
                PCI_ANY_ID, PCI_ANY_ID,
                0, 0, pbn_wch384_4 },
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index b645f9228ed7..fa49eb1e2fa2 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1165,7 +1165,7 @@ serial_omap_type(struct uart_port *port)
 #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
-static void wait_for_xmitr(struct uart_omap_port *up)
+static void __maybe_unused wait_for_xmitr(struct uart_omap_port *up)
 {
        unsigned int status, tmout = 10000;
@@ -1343,7 +1343,7 @@ static inline void serial_omap_add_console_port(struct uart_omap_port *up)
 /* Enable or disable the rs485 support */
 static int
-serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485)
 {
        struct uart_omap_port *up = to_uart_omap_port(port);
        unsigned int mode;
@@ -1356,8 +1356,12 @@ serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
        up->ier = 0;
        serial_out(up, UART_IER, 0);
+        /* Clamp the delays to [0, 100ms] */
+        rs485->delay_rts_before_send = min(rs485->delay_rts_before_send, 100U);
+        rs485->delay_rts_after_send  = min(rs485->delay_rts_after_send, 100U);
        /* store new config */
-        port->rs485 = *rs485conf;
+        port->rs485 = *rs485;
        /*
         * Just as a precaution, only allow rs485
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 5cec01c75691..a7eacef1bd22 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2066,13 +2066,12 @@ retry_open:
                if (tty) {
                        mutex_unlock(&tty_mutex);
                        retval = tty_lock_interruptible(tty);
+                        tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
                        if (retval) {
                                if (retval == -EINTR)
                                        retval = -ERESTARTSYS;
                                goto err_unref;
                        }
-                        /* safe to drop the kref from tty_driver_lookup_tty() */
-                        tty_kref_put(tty);
                        retval = tty_reopen(tty);
                        if (retval < 0) {
                                tty_unlock(tty);
diff --git a/drivers/tty/tty_mutex.c b/drivers/tty/tty_mutex.c
index d2f3c4cd697f..dfa9ec03fa8e 100644
--- a/drivers/tty/tty_mutex.c
+++ b/drivers/tty/tty_mutex.c
@@ -21,10 +21,15 @@ EXPORT_SYMBOL(tty_lock);
 int tty_lock_interruptible(struct tty_struct *tty)
 {
+        int ret;
        if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty))
                return -EIO;
        tty_kref_get(tty);
-        return mutex_lock_interruptible(&tty->legacy_mutex);
+        ret = mutex_lock_interruptible(&tty->legacy_mutex);
+        if (ret)
+                tty_kref_put(tty);
+        return ret;
 }
 void __lockfunc tty_unlock(struct tty_struct *tty)
diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 0081725c6b5b..6b2a06d09f2b 100644
--- a/drivers/video/fbdev/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -152,7 +152,7 @@ static void lcdc_write(unsigned int val, unsigned int addr)
 struct da8xx_fb_par {
        struct device           *dev;
-        resource_size_t p_palette_base;
+        dma_addr_t              p_palette_base;
        unsigned char *v_palette_base;
        dma_addr_t              vram_phys;
        unsigned long           vram_size;
@@ -1428,7 +1428,7 @@ static int fb_probe(struct platform_device *device)
        par->vram_virt = dma_alloc_coherent(NULL,
                                            par->vram_size,
-                                            (resource_size_t *) &par->vram_phys,
+                                            &par->vram_phys,
                                            GFP_KERNEL | GFP_DMA);
        if (!par->vram_virt) {
                dev_err(&device->dev,
@@ -1448,7 +1448,7 @@ static int fb_probe(struct platform_device *device)
        /* allocate palette buffer */
        par->v_palette_base = dma_zalloc_coherent(NULL, PALETTE_SIZE,
-                                                  (resource_size_t *)&par->p_palette_base,
+                                                  &par->p_palette_base,
                                                  GFP_KERNEL | GFP_DMA);
        if (!par->v_palette_base) {
                dev_err(&device->dev,
diff --git a/drivers/video/fbdev/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c
index 95873f26e39c..de2f3e793786 100644
--- a/drivers/video/fbdev/exynos/s6e8ax0.c
+++ b/drivers/video/fbdev/exynos/s6e8ax0.c
@@ -829,8 +829,7 @@ static int s6e8ax0_probe(struct mipi_dsim_lcd_device *dsim_dev)
        return 0;
 }
-#ifdef CONFIG_PM
+static int __maybe_unused s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
-static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
 {
        struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
@@ -843,7 +842,7 @@ static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
        return 0;
 }
-static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
+static int __maybe_unused s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
 {
        struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
@@ -855,10 +854,6 @@ static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
        return 0;
 }
-#else
-#define s6e8ax0_suspend         NULL
-#define s6e8ax0_resume          NULL
-#endif
 static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
        .name = "s6e8ax0",
@@ -867,8 +862,8 @@ static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
        .power_on = s6e8ax0_power_on,
        .set_sequence = s6e8ax0_set_sequence,
        .probe = s6e8ax0_probe,
-        .suspend = s6e8ax0_suspend,
+        .suspend = IS_ENABLED(CONFIG_PM) ? s6e8ax0_suspend : NULL,
-        .resume = s6e8ax0_resume,
+        .resume = IS_ENABLED(CONFIG_PM) ? s6e8ax0_resume : NULL,
 };
 static int s6e8ax0_init(void)
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index cee88603efc9..bb2f1e866020 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -902,6 +902,21 @@ static int imxfb_probe(struct platform_device *pdev)
                goto failed_getclock;
        }
+        /*
+         * The LCDC controller does not have an enable bit. The
+         * controller starts directly when the clocks are enabled.
+         * If the clocks are enabled when the controller is not yet
+         * programmed with proper register values (enabled at the
+         * bootloader, for example) then it just goes into some undefined
+         * state.
+         * To avoid this issue, let's enable and disable LCDC IPG clock
+         * so that we force some kind of 'reset' to the LCDC block.
+         */
+        ret = clk_prepare_enable(fbi->clk_ipg);
+        if (ret)
+                goto failed_getclock;
+        clk_disable_unprepare(fbi->clk_ipg);
        fbi->clk_ahb = devm_clk_get(&pdev->dev, "ahb");
        if (IS_ERR(fbi->clk_ahb)) {
                ret = PTR_ERR(fbi->clk_ahb);
diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
index de54a4748065..b6f83d5df9fd 100644
--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
@@ -503,8 +503,7 @@ static int mmphw_probe(struct platform_device *pdev)
        ctrl->reg_base = devm_ioremap_nocache(ctrl->dev,
                        res->start, resource_size(res));
        if (ctrl->reg_base == NULL) {
-                dev_err(ctrl->dev, "%s: res %x - %x map failed\n", __func__,
+                dev_err(ctrl->dev, "%s: res %pR map failed\n", __func__, res);
-                        res->start, res->end);
                ret = -ENOMEM;
                goto failed;
        }
diff --git a/drivers/video/fbdev/ocfb.c b/drivers/video/fbdev/ocfb.c
index c9293aea8ec3..a970edc2a6f8 100644
--- a/drivers/video/fbdev/ocfb.c
+++ b/drivers/video/fbdev/ocfb.c
@@ -123,11 +123,11 @@ static int ocfb_setupfb(struct ocfb_dev *fbdev)
        /* Horizontal timings */
        ocfb_writereg(fbdev, OCFB_HTIM, (var->hsync_len - 1) << 24 |
-                      (var->right_margin - 1) << 16 | (var->xres - 1));
+                      (var->left_margin - 1) << 16 | (var->xres - 1));
        /* Vertical timings */
        ocfb_writereg(fbdev, OCFB_VTIM, (var->vsync_len - 1) << 24 |
-                      (var->lower_margin - 1) << 16 | (var->yres - 1));
+                      (var->upper_margin - 1) << 16 | (var->yres - 1));
        /* Total length of frame */
        hlen = var->left_margin + var->right_margin + var->hsync_len +
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index b90cd3776f8e..f6dac40f87ff 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1406,7 +1406,8 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                        read_extent_buffer(eb, dest + bytes_left,
                                           name_off, name_len);
                if (eb != eb_in) {
-                        btrfs_tree_read_unlock_blocking(eb);
+                        if (!path->skip_locking)
+                                btrfs_tree_read_unlock_blocking(eb);
                        free_extent_buffer(eb);
                }
                ret = btrfs_find_item(fs_root, path, parent, 0,
@@ -1426,9 +1427,10 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                eb = path->nodes[0];
                /* make sure we can use eb after releasing the path */
                if (eb != eb_in) {
-                        atomic_inc(&eb->refs);
+                        if (!path->skip_locking)
-                        btrfs_tree_read_lock(eb);
+                                btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
-                        btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+                        path->nodes[0] = NULL;
+                        path->locks[0] = 0;
                }
                btrfs_release_path(path);
                iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index c473c42d7d6c..3346cd8f9910 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -637,11 +637,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
        faili = nr_pages - 1;
        cb->nr_pages = nr_pages;
-        /* In the parent-locked case, we only locked the range we are
+        add_ra_bio_pages(inode, em_start + em_len, cb);
-         * interested in.  In all other cases, we can opportunistically
-         * cache decompressed data that goes beyond the requested range. */
-        if (!(bio_flags & EXTENT_BIO_PARENT_LOCKED))
-                add_ra_bio_pages(inode, em_start + em_len, cb);
        /* include any pages we added in add_ra-bio_pages */
        uncompressed_len = bio->bi_vcnt * PAGE_CACHE_SIZE;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 0be47e4b8136..b57daa895cea 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1689,7 +1689,7 @@ int btrfs_should_delete_dir_index(struct list_head *del_list,
 *
 */
 int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
-                                    struct list_head *ins_list)
+                                    struct list_head *ins_list, bool *emitted)
 {
        struct btrfs_dir_item *di;
        struct btrfs_delayed_item *curr, *next;
@@ -1733,6 +1733,7 @@ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
                if (over)
                        return 1;
+                *emitted = true;
        }
        return 0;
 }
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index f70119f25421..0167853c84ae 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -144,7 +144,7 @@ void btrfs_put_delayed_items(struct list_head *ins_list,
 int btrfs_should_delete_dir_index(struct list_head *del_list,
                                  u64 index);
 int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
-                                    struct list_head *ins_list);
+                                    struct list_head *ins_list, bool *emitted);
 /* for init */
 int __init btrfs_delayed_inode_init(void);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2e7c97a3f344..392592dc7010 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2897,12 +2897,11 @@ static int __do_readpage(struct extent_io_tree *tree,
        struct block_device *bdev;
        int ret;
        int nr = 0;
-        int parent_locked = *bio_flags & EXTENT_BIO_PARENT_LOCKED;
        size_t pg_offset = 0;
        size_t iosize;
        size_t disk_io_size;
        size_t blocksize = inode->i_sb->s_blocksize;
-        unsigned long this_bio_flag = *bio_flags & EXTENT_BIO_PARENT_LOCKED;
+        unsigned long this_bio_flag = 0;
        set_page_extent_mapped(page);
@@ -2942,18 +2941,16 @@ static int __do_readpage(struct extent_io_tree *tree,
                        kunmap_atomic(userpage);
                        set_extent_uptodate(tree, cur, cur + iosize - 1,
                                            &cached, GFP_NOFS);
-                        if (!parent_locked)
+                        unlock_extent_cached(tree, cur,
-                                unlock_extent_cached(tree, cur,
+                                             cur + iosize - 1,
-                                                     cur + iosize - 1,
+                                             &cached, GFP_NOFS);
-                                                     &cached, GFP_NOFS);
                        break;
                }
                em = __get_extent_map(inode, page, pg_offset, cur,
                                      end - cur + 1, get_extent, em_cached);
                if (IS_ERR_OR_NULL(em)) {
                        SetPageError(page);
-                        if (!parent_locked)
+                        unlock_extent(tree, cur, end);
-                                unlock_extent(tree, cur, end);
                        break;
                }
                extent_offset = cur - em->start;
@@ -3038,12 +3035,9 @@ static int __do_readpage(struct extent_io_tree *tree,
                        set_extent_uptodate(tree, cur, cur + iosize - 1,
                                            &cached, GFP_NOFS);
-                        if (parent_locked)
+                        unlock_extent_cached(tree, cur,
-                                free_extent_state(cached);
+                                             cur + iosize - 1,
-                        else
+                                             &cached, GFP_NOFS);
-                                unlock_extent_cached(tree, cur,
-                                                     cur + iosize - 1,
-                                                     &cached, GFP_NOFS);
                        cur = cur + iosize;
                        pg_offset += iosize;
                        continue;
@@ -3052,8 +3046,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                if (test_range_bit(tree, cur, cur_end,
                                   EXTENT_UPTODATE, 1, NULL)) {
                        check_page_uptodate(tree, page);
-                        if (!parent_locked)
+                        unlock_extent(tree, cur, cur + iosize - 1);
-                                unlock_extent(tree, cur, cur + iosize - 1);
                        cur = cur + iosize;
                        pg_offset += iosize;
                        continue;
@@ -3063,8 +3056,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                 */
                if (block_start == EXTENT_MAP_INLINE) {
                        SetPageError(page);
-                        if (!parent_locked)
+                        unlock_extent(tree, cur, cur + iosize - 1);
-                                unlock_extent(tree, cur, cur + iosize - 1);
                        cur = cur + iosize;
                        pg_offset += iosize;
                        continue;
@@ -3083,8 +3075,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                        *bio_flags = this_bio_flag;
                } else {
                        SetPageError(page);
-                        if (!parent_locked)
+                        unlock_extent(tree, cur, cur + iosize - 1);
-                                unlock_extent(tree, cur, cur + iosize - 1);
                }
                cur = cur + iosize;
                pg_offset += iosize;
@@ -3213,20 +3204,6 @@ int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
        return ret;
 }
-int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
-                                 get_extent_t *get_extent, int mirror_num)
-{
-        struct bio *bio = NULL;
-        unsigned long bio_flags = EXTENT_BIO_PARENT_LOCKED;
-        int ret;
-        ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
-                            &bio_flags, READ, NULL);
-        if (bio)
-                ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
-        return ret;
-}
 static noinline void update_nr_written(struct page *page,
                                      struct writeback_control *wbc,
                                      unsigned long nr_written)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 0377413bd4b9..880d5292e972 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -29,7 +29,6 @@
 */
 #define EXTENT_BIO_COMPRESSED 1
 #define EXTENT_BIO_TREE_LOG 2
-#define EXTENT_BIO_PARENT_LOCKED 4
 #define EXTENT_BIO_FLAG_SHIFT 16
 /* these are bit numbers for test/set bit */
@@ -210,8 +209,6 @@ static inline int lock_extent(struct extent_io_tree *tree, u64 start, u64 end)
 int try_lock_extent(struct extent_io_tree *tree, u64 start, u64 end);
 int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
                          get_extent_t *get_extent, int mirror_num);
-int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
-                                 get_extent_t *get_extent, int mirror_num);
 int __init extent_io_init(void);
 void extent_io_exit(void);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5f06eb1f4384..151b7c71b868 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5717,6 +5717,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
        char *name_ptr;
        int name_len;
        int is_curr = 0;        /* ctx->pos points to the current index? */
+        bool emitted;
        /* FIXME, use a real flag for deciding about the key type */
        if (root->fs_info->tree_root == root)
@@ -5745,6 +5746,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
        if (ret < 0)
                goto err;
+        emitted = false;
        while (1) {
                leaf = path->nodes[0];
                slot = path->slots[0];
@@ -5824,6 +5826,7 @@ skip:
                        if (over)
                                goto nopos;
+                        emitted = true;
                        di_len = btrfs_dir_name_len(leaf, di) +
                                 btrfs_dir_data_len(leaf, di) + sizeof(*di);
                        di_cur += di_len;
@@ -5836,11 +5839,20 @@ next:
        if (key_type == BTRFS_DIR_INDEX_KEY) {
                if (is_curr)
                        ctx->pos++;
-                ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list);
+                ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list, &emitted);
                if (ret)
                        goto nopos;
        }
+        /*
+         * If we haven't emitted any dir entry, we must not touch ctx->pos as
+         * it was was set to the termination value in previous call. We assume
+         * that "." and ".." were emitted if we reach this point and set the
+         * termination value as well for an empty directory.
+         */
+        if (ctx->pos > 2 && !emitted)
+                goto nopos;
        /* Reached end of directory/root. Bump pos past the last item. */
        ctx->pos++;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 952172ca7e45..48aee9846329 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2794,24 +2794,29 @@ out:
 static struct page *extent_same_get_page(struct inode *inode, pgoff_t index)
 {
        struct page *page;
-        struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
        page = grab_cache_page(inode->i_mapping, index);
        if (!page)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        if (!PageUptodate(page)) {
-                if (extent_read_full_page_nolock(tree, page, btrfs_get_extent,
+                int ret;
-                                                 0))
-                        return NULL;
+                ret = btrfs_readpage(NULL, page);
+                if (ret)
+                        return ERR_PTR(ret);
                lock_page(page);
                if (!PageUptodate(page)) {
                        unlock_page(page);
                        page_cache_release(page);
-                        return NULL;
+                        return ERR_PTR(-EIO);
+                }
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        return ERR_PTR(-EAGAIN);
                }
        }
-        unlock_page(page);
        return page;
 }
@@ -2823,17 +2828,31 @@ static int gather_extent_pages(struct inode *inode, struct page **pages,
        pgoff_t index = off >> PAGE_CACHE_SHIFT;
        for (i = 0; i < num_pages; i++) {
+again:
                pages[i] = extent_same_get_page(inode, index + i);
-                if (!pages[i])
+                if (IS_ERR(pages[i])) {
-                        return -ENOMEM;
+                        int err = PTR_ERR(pages[i]);
+                        if (err == -EAGAIN)
+                                goto again;
+                        pages[i] = NULL;
+                        return err;
+                }
        }
        return 0;
 }
-static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
+static int lock_extent_range(struct inode *inode, u64 off, u64 len,
+                             bool retry_range_locking)
 {
-        /* do any pending delalloc/csum calc on src, one way or
+        /*
-           another, and lock file content */
+         * Do any pending delalloc/csum calculations on inode, one way or
+         * another, and lock file content.
+         * The locking order is:
+         *
+         *   1) pages
+         *   2) range in the inode's io tree
+         */
        while (1) {
                struct btrfs_ordered_extent *ordered;
                lock_extent(&BTRFS_I(inode)->io_tree, off, off + len - 1);
@@ -2851,8 +2870,11 @@ static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
                unlock_extent(&BTRFS_I(inode)->io_tree, off, off + len - 1);
                if (ordered)
                        btrfs_put_ordered_extent(ordered);
+                if (!retry_range_locking)
+                        return -EAGAIN;
                btrfs_wait_ordered_range(inode, off, len);
        }
+        return 0;
 }
 static void btrfs_double_inode_unlock(struct inode *inode1, struct inode *inode2)
@@ -2877,15 +2899,24 @@ static void btrfs_double_extent_unlock(struct inode *inode1, u64 loff1,
        unlock_extent(&BTRFS_I(inode2)->io_tree, loff2, loff2 + len - 1);
 }
-static void btrfs_double_extent_lock(struct inode *inode1, u64 loff1,
+static int btrfs_double_extent_lock(struct inode *inode1, u64 loff1,
-                                     struct inode *inode2, u64 loff2, u64 len)
+                                    struct inode *inode2, u64 loff2, u64 len,
+                                    bool retry_range_locking)
 {
+        int ret;
        if (inode1 < inode2) {
                swap(inode1, inode2);
                swap(loff1, loff2);
        }
-        lock_extent_range(inode1, loff1, len);
+        ret = lock_extent_range(inode1, loff1, len, retry_range_locking);
-        lock_extent_range(inode2, loff2, len);
+        if (ret)
+                return ret;
+        ret = lock_extent_range(inode2, loff2, len, retry_range_locking);
+        if (ret)
+                unlock_extent(&BTRFS_I(inode1)->io_tree, loff1,
+                              loff1 + len - 1);
+        return ret;
 }
 struct cmp_pages {
@@ -2901,11 +2932,15 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp)
        for (i = 0; i < cmp->num_pages; i++) {
                pg = cmp->src_pages[i];
-                if (pg)
+                if (pg) {
+                        unlock_page(pg);
                        page_cache_release(pg);
+                }
                pg = cmp->dst_pages[i];
-                if (pg)
+                if (pg) {
+                        unlock_page(pg);
                        page_cache_release(pg);
+                }
        }
        kfree(cmp->src_pages);
        kfree(cmp->dst_pages);
@@ -2966,6 +3001,8 @@ static int btrfs_cmp_data(struct inode *src, u64 loff, struct inode *dst,
                src_page = cmp->src_pages[i];
                dst_page = cmp->dst_pages[i];
+                ASSERT(PageLocked(src_page));
+                ASSERT(PageLocked(dst_page));
                addr = kmap_atomic(src_page);
                dst_addr = kmap_atomic(dst_page);
@@ -3078,14 +3115,46 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                goto out_unlock;
        }
+again:
        ret = btrfs_cmp_data_prepare(src, loff, dst, dst_loff, olen, &cmp);
        if (ret)
                goto out_unlock;
        if (same_inode)
-                lock_extent_range(src, same_lock_start, same_lock_len);
+                ret = lock_extent_range(src, same_lock_start, same_lock_len,
+                                        false);
        else
-                btrfs_double_extent_lock(src, loff, dst, dst_loff, len);
+                ret = btrfs_double_extent_lock(src, loff, dst, dst_loff, len,
+                                               false);
+        /*
+         * If one of the inodes has dirty pages in the respective range or
+         * ordered extents, we need to flush dellaloc and wait for all ordered
+         * extents in the range. We must unlock the pages and the ranges in the
+         * io trees to avoid deadlocks when flushing delalloc (requires locking
+         * pages) and when waiting for ordered extents to complete (they require
+         * range locking).
+         */
+        if (ret == -EAGAIN) {
+                /*
+                 * Ranges in the io trees already unlocked. Now unlock all
+                 * pages before waiting for all IO to complete.
+                 */
+                btrfs_cmp_data_free(&cmp);
+                if (same_inode) {
+                        btrfs_wait_ordered_range(src, same_lock_start,
+                                                 same_lock_len);
+                } else {
+                        btrfs_wait_ordered_range(src, loff, len);
+                        btrfs_wait_ordered_range(dst, dst_loff, len);
+                }
+                goto again;
+        }
+        ASSERT(ret == 0);
+        if (WARN_ON(ret)) {
+                /* ranges in the io trees already unlocked */
+                btrfs_cmp_data_free(&cmp);
+                return ret;
+        }
        /* pass original length for comparison so we stay within i_size */
        ret = btrfs_cmp_data(src, loff, dst, dst_loff, olen, &cmp);
@@ -3795,9 +3864,15 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
                u64 lock_start = min_t(u64, off, destoff);
                u64 lock_len = max_t(u64, off, destoff) + len - lock_start;
-                lock_extent_range(src, lock_start, lock_len);
+                ret = lock_extent_range(src, lock_start, lock_len, true);
        } else {
-                btrfs_double_extent_lock(src, off, inode, destoff, len);
+                ret = btrfs_double_extent_lock(src, off, inode, destoff, len,
+                                               true);
+        }
+        ASSERT(ret == 0);
+        if (WARN_ON(ret)) {
+                /* ranges in the io trees already unlocked */
+                goto out_unlock;
        }
        ret = btrfs_clone(src, inode, off, olen, len, destoff, 0);
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 1f107fd51328..655f21f99160 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -575,6 +575,26 @@ void devpts_kill_index(struct inode *ptmx_inode, int idx)
        mutex_unlock(&allocated_ptys_lock);
 }
+/*
+ * pty code needs to hold extra references in case of last /dev/tty close
+ */
+void devpts_add_ref(struct inode *ptmx_inode)
+{
+        struct super_block *sb = pts_sb_from_inode(ptmx_inode);
+        atomic_inc(&sb->s_active);
+        ihold(ptmx_inode);
+}
+void devpts_del_ref(struct inode *ptmx_inode)
+{
+        struct super_block *sb = pts_sb_from_inode(ptmx_inode);
+        iput(ptmx_inode);
+        deactivate_super(sb);
+}
 /**
 * devpts_pty_new -- create a new inode in /dev/pts/
 * @ptmx_inode: inode of the master
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index da37beb76f6e..594f7e63b432 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -4491,7 +4491,7 @@ xlog_recover_process(
         * know precisely what failed.
         */
        if (pass == XLOG_RECOVER_CRCPASS) {
-                if (rhead->h_crc && crc != le32_to_cpu(rhead->h_crc))
+                if (rhead->h_crc && crc != rhead->h_crc)
                        return -EFSBADCRC;
                return 0;
        }
@@ -4502,7 +4502,7 @@ xlog_recover_process(
         * zero CRC check prevents warnings from being emitted when upgrading
         * the kernel from one that does not add CRCs by default.
         */
-        if (crc != le32_to_cpu(rhead->h_crc)) {
+        if (crc != rhead->h_crc) {
                if (rhead->h_crc || xfs_sb_version_hascrc(&log->l_mp->m_sb)) {
                        xfs_alert(log->l_mp,
                "log record CRC mismatch: found 0x%x, expected 0x%x.",
diff --git a/include/asm-generic/cputime_nsecs.h b/include/asm-generic/cputime_nsecs.h
index 0419485891f2..0f1c6f315cdc 100644
--- a/include/asm-generic/cputime_nsecs.h
+++ b/include/asm-generic/cputime_nsecs.h
@@ -75,7 +75,7 @@ typedef u64 __nocast cputime64_t;
 */
 static inline cputime_t timespec_to_cputime(const struct timespec *val)
 {
-        u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
+        u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
        return (__force cputime_t) ret;
 }
 static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val)
@@ -91,7 +91,8 @@ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val)
 */
 static inline cputime_t timeval_to_cputime(const struct timeval *val)
 {
-        u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC;
+        u64 ret = (u64)val->tv_sec * NSEC_PER_SEC +
+                        val->tv_usec * NSEC_PER_USEC;
        return (__force cputime_t) ret;
 }
 static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 29189aeace19..4571ef1a12a9 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -682,9 +682,12 @@ static inline bool blk_write_same_mergeable(struct bio *a, struct bio *b)
 /*
 * q->prep_rq_fn return values
 */
-#define BLKPREP_OK              0       /* serve it */
+enum {
-#define BLKPREP_KILL            1       /* fatal error, kill */
+        BLKPREP_OK,             /* serve it */
-#define BLKPREP_DEFER           2       /* leave on queue */
+        BLKPREP_KILL,           /* fatal error, kill, return -EIO */
+        BLKPREP_DEFER,          /* leave on queue */
+        BLKPREP_INVALID,        /* invalid command, kill, return -EREMOTEIO */
+};
 extern unsigned long blk_max_low_pfn, blk_max_pfn;
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 7f540f7f588d..789471dba6fb 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -127,6 +127,12 @@ struct cgroup_subsys_state {
         */
        u64 serial_nr;
+        /*
+         * Incremented by online self and children.  Used to guarantee that
+         * parents are not offlined before their children.
+         */
+        atomic_t online_cnt;
        /* percpu_ref killing and RCU release */
        struct rcu_head rcu_head;
        struct work_struct destroy_work;
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index 85a868ccb493..fea160ee5803 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -137,6 +137,8 @@ static inline void set_mems_allowed(nodemask_t nodemask)
        task_unlock(current);
 }
+extern void cpuset_post_attach_flush(void);
 #else /* !CONFIG_CPUSETS */
 static inline bool cpusets_enabled(void) { return false; }
@@ -243,6 +245,10 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
        return false;
 }
+static inline void cpuset_post_attach_flush(void)
+{
+}
 #endif /* !CONFIG_CPUSETS */
 #endif /* _LINUX_CPUSET_H */
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 251a2090a554..e0ee0b3000b2 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -19,6 +19,8 @@
 int devpts_new_index(struct inode *ptmx_inode);
 void devpts_kill_index(struct inode *ptmx_inode, int idx);
+void devpts_add_ref(struct inode *ptmx_inode);
+void devpts_del_ref(struct inode *ptmx_inode);
 /* mknod in devpts */
 struct inode *devpts_pty_new(struct inode *ptmx_inode, dev_t device, int index,
                void *priv);
@@ -32,6 +34,8 @@ void devpts_pty_kill(struct inode *inode);
 /* Dummy stubs in the no-pty case */
 static inline int devpts_new_index(struct inode *ptmx_inode) { return -EINVAL; }
 static inline void devpts_kill_index(struct inode *ptmx_inode, int idx) { }
+static inline void devpts_add_ref(struct inode *ptmx_inode) { }
+static inline void devpts_del_ref(struct inode *ptmx_inode) { }
 static inline struct inode *devpts_pty_new(struct inode *ptmx_inode,
                dev_t device, int index, void *priv)
 {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 851821bfd553..bec2abbd7ab2 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -526,6 +526,7 @@ enum ata_lpm_policy {
 enum ata_lpm_hints {
        ATA_LPM_EMPTY           = (1 << 0), /* port empty/probing */
        ATA_LPM_HIPM            = (1 << 1), /* may use HIPM */
+        ATA_LPM_WAKE_ONLY       = (1 << 2), /* only wake up link */
 };
 /* forward declarations */
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index c57e424d914b..4dca42fd32f5 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -66,7 +66,7 @@ struct lock_class {
        /*
         * class-hash:
         */
-        struct list_head                hash_entry;
+        struct hlist_node               hash_entry;
        /*
         * global list of all lock-classes:
@@ -199,7 +199,7 @@ struct lock_chain {
        u8                              irq_context;
        u8                              depth;
        u16                             base;
-        struct list_head                entry;
+        struct hlist_node               entry;
        u64                             chain_key;
 };
diff --git a/include/linux/module.h b/include/linux/module.h
index 4560d8f1545d..2bb0c3085706 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -324,6 +324,12 @@ struct module_layout {
 #define __module_layout_align
 #endif
+struct mod_kallsyms {
+        Elf_Sym *symtab;
+        unsigned int num_symtab;
+        char *strtab;
+};
 struct module {
        enum module_state state;
@@ -405,15 +411,10 @@ struct module {
 #endif
 #ifdef CONFIG_KALLSYMS
-        /*
+        /* Protected by RCU and/or module_mutex: use rcu_dereference() */
-         * We keep the symbol and string tables for kallsyms.
+        struct mod_kallsyms *kallsyms;
-         * The core_* fields below are temporary, loader-only (they
+        struct mod_kallsyms core_kallsyms;
-         * could really be discarded after module init).
+        
-         */
-        Elf_Sym *symtab, *core_symtab;
-        unsigned int num_symtab, core_num_syms;
-        char *strtab, *core_strtab;
        /* Section attributes */
        struct module_sect_attrs *sect_attrs;
diff --git a/include/linux/pfn.h b/include/linux/pfn.h
index 2d8e49711b63..1132953235c0 100644
--- a/include/linux/pfn.h
+++ b/include/linux/pfn.h
@@ -10,7 +10,7 @@
 * backing is indicated by flags in the high bits of the value.
 */
 typedef struct {
-        unsigned long val;
+        u64 val;
 } pfn_t;
 #endif
diff --git a/include/linux/pfn_t.h b/include/linux/pfn_t.h
index 37448ab5fb5c..94994810c7c0 100644
--- a/include/linux/pfn_t.h
+++ b/include/linux/pfn_t.h
@@ -9,14 +9,13 @@
 * PFN_DEV - pfn is not covered by system memmap by default
 * PFN_MAP - pfn has a dynamic page mapping established by a device driver
 */
-#define PFN_FLAGS_MASK (((unsigned long) ~PAGE_MASK) \
+#define PFN_FLAGS_MASK (((u64) ~PAGE_MASK) << (BITS_PER_LONG_LONG - PAGE_SHIFT))
-                << (BITS_PER_LONG - PAGE_SHIFT))
+#define PFN_SG_CHAIN (1ULL << (BITS_PER_LONG_LONG - 1))
-#define PFN_SG_CHAIN (1UL << (BITS_PER_LONG - 1))
+#define PFN_SG_LAST (1ULL << (BITS_PER_LONG_LONG - 2))
-#define PFN_SG_LAST (1UL << (BITS_PER_LONG - 2))
+#define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3))
-#define PFN_DEV (1UL << (BITS_PER_LONG - 3))
+#define PFN_MAP (1ULL << (BITS_PER_LONG_LONG - 4))
-#define PFN_MAP (1UL << (BITS_PER_LONG - 4))
+static inline pfn_t __pfn_to_pfn_t(unsigned long pfn, u64 flags)
-static inline pfn_t __pfn_to_pfn_t(unsigned long pfn, unsigned long flags)
 {
        pfn_t pfn_t = { .val = pfn | (flags & PFN_FLAGS_MASK), };
@@ -29,7 +28,7 @@ static inline pfn_t pfn_to_pfn_t(unsigned long pfn)
        return __pfn_to_pfn_t(pfn, 0);
 }
-extern pfn_t phys_to_pfn_t(phys_addr_t addr, unsigned long flags);
+extern pfn_t phys_to_pfn_t(phys_addr_t addr, u64 flags);
 static inline bool pfn_t_has_page(pfn_t pfn)
 {
@@ -87,7 +86,7 @@ static inline pmd_t pfn_t_pmd(pfn_t pfn, pgprot_t pgprot)
 #ifdef __HAVE_ARCH_PTE_DEVMAP
 static inline bool pfn_t_devmap(pfn_t pfn)
 {
-        const unsigned long flags = PFN_DEV|PFN_MAP;
+        const u64 flags = PFN_DEV|PFN_MAP;
        return (pfn.val & flags) == flags;
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 11f935c1a090..4ce9ff7086f4 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -299,6 +299,7 @@ struct sk_buff;
 #else
 #define MAX_SKB_FRAGS (65536/PAGE_SIZE + 1)
 #endif
+extern int sysctl_max_skb_frags;
 typedef struct skb_frag_struct skb_frag_t;
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 0e32bc71245e..ca73c503b92a 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -311,6 +311,7 @@ enum {
        __WQ_DRAINING           = 1 << 16, /* internal: workqueue is draining */
        __WQ_ORDERED            = 1 << 17, /* internal: workqueue is ordered */
+        __WQ_LEGACY             = 1 << 18, /* internal: create*_workqueue() */
        WQ_MAX_ACTIVE           = 512,    /* I like 512, better ideas? */
        WQ_MAX_UNBOUND_PER_CPU  = 4,      /* 4 * #cpus for unbound wq */
@@ -411,12 +412,12 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
        alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
 #define create_workqueue(name)                                          \
-        alloc_workqueue("%s", WQ_MEM_RECLAIM, 1, (name))
+        alloc_workqueue("%s", __WQ_LEGACY | WQ_MEM_RECLAIM, 1, (name))
 #define create_freezable_workqueue(name)                                \
-        alloc_workqueue("%s", WQ_FREEZABLE | WQ_UNBOUND | WQ_MEM_RECLAIM, \
+        alloc_workqueue("%s", __WQ_LEGACY | WQ_FREEZABLE | WQ_UNBOUND | \
-                        1, (name))
+                        WQ_MEM_RECLAIM, 1, (name))
 #define create_singlethread_workqueue(name)                             \
-        alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name)
+        alloc_ordered_workqueue("%s", __WQ_LEGACY | WQ_MEM_RECLAIM, name)
 extern void destroy_workqueue(struct workqueue_struct *wq);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2a91a0561a47..9b4c418bebd8 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -6,8 +6,8 @@
 #include <linux/mutex.h>
 #include <net/sock.h>
-void unix_inflight(struct file *fp);
+void unix_inflight(struct user_struct *user, struct file *fp);
-void unix_notinflight(struct file *fp);
+void unix_notinflight(struct user_struct *user, struct file *fp);
 void unix_gc(void);
 void wait_for_unix_gc(void);
 struct sock *unix_get_socket(struct file *filp);
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 6db96ea0144f..dda9abf6b89c 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -230,6 +230,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd);
 int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
                    u8 *protocol, struct flowi4 *fl4);
+int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict);
 int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu);
 struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
diff --git a/include/net/scm.h b/include/net/scm.h
index 262532d111f5..59fa93c01d2a 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -21,6 +21,7 @@ struct scm_creds {
 struct scm_fp_list {
        short                   count;
        short                   max;
+        struct user_struct      *user;
        struct file             *fp[SCM_MAX_FD];
 };
diff --git a/include/net/tcp.h b/include/net/tcp.h
index f6f8f032c73e..ae6468f5c9f3 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -447,7 +447,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb);
 void tcp_v4_mtu_reduced(struct sock *sk);
-void tcp_req_err(struct sock *sk, u32 seq);
+void tcp_req_err(struct sock *sk, u32 seq, bool abort);
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(const struct sock *sk,
                                      struct request_sock *req,
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index 56cf8e485ef2..28ee5c2e6bcd 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -94,5 +94,8 @@ sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd,
        sense_reason_t (*exec_cmd)(struct se_cmd *cmd));
 bool target_sense_desc_format(struct se_device *dev);
+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb);
+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
+                                       struct request_queue *q, int block_size);
 #endif /* TARGET_CORE_BACKEND_H */
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 5d82816cc4e3..e8c8c08bf575 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -140,6 +140,8 @@ enum se_cmd_flags_table {
        SCF_COMPARE_AND_WRITE           = 0x00080000,
        SCF_COMPARE_AND_WRITE_POST      = 0x00100000,
        SCF_PASSTHROUGH_PROT_SG_TO_MEM_NOALLOC = 0x00200000,
+        SCF_ACK_KREF                    = 0x00400000,
+        SCF_USE_CPUID                   = 0x00800000,
 };
 /* struct se_dev_entry->lun_flags and struct se_lun->lun_access */
@@ -187,6 +189,7 @@ enum target_sc_flags_table {
        TARGET_SCF_BIDI_OP              = 0x01,
        TARGET_SCF_ACK_KREF             = 0x02,
        TARGET_SCF_UNKNOWN_SIZE         = 0x04,
+        TARGET_SCF_USE_CPUID    = 0x08,
 };
 /* fabric independent task management function values */
@@ -490,8 +493,9 @@ struct se_cmd {
 #define CMD_T_SENT              (1 << 4)
 #define CMD_T_STOP              (1 << 5)
 #define CMD_T_DEV_ACTIVE        (1 << 7)
-#define CMD_T_REQUEST_STOP      (1 << 8)
 #define CMD_T_BUSY              (1 << 9)
+#define CMD_T_TAS               (1 << 10)
+#define CMD_T_FABRIC_STOP       (1 << 11)
        spinlock_t              t_state_lock;
        struct kref             cmd_kref;
        struct completion       t_transport_stop_comp;
@@ -511,9 +515,6 @@ struct se_cmd {
        struct list_head        state_list;
-        /* old task stop completion, consider merging with some of the above */
-        struct completion       task_stop_comp;
        /* backend private data */
        void                    *priv;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d1d3e8f57de9..2e7f7ab739e4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2082,7 +2082,7 @@ static void adjust_branches(struct bpf_prog *prog, int pos, int delta)
                /* adjust offset of jmps if necessary */
                if (i < pos && i + insn->off + 1 > pos)
                        insn->off += delta;
-                else if (i > pos && i + insn->off + 1 < pos)
+                else if (i > pos + delta && i + insn->off + 1 <= pos + delta)
                        insn->off -= delta;
        }
 }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index c03a640ef6da..d27904c193da 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -58,6 +58,7 @@
 #include <linux/kthread.h>
 #include <linux/delay.h>
 #include <linux/atomic.h>
+#include <linux/cpuset.h>
 #include <net/sock.h>
 /*
@@ -2739,6 +2740,7 @@ out_unlock_rcu:
 out_unlock_threadgroup:
        percpu_up_write(&cgroup_threadgroup_rwsem);
        cgroup_kn_unlock(of->kn);
+        cpuset_post_attach_flush();
        return ret ?: nbytes;
 }
@@ -4655,14 +4657,15 @@ static void css_free_work_fn(struct work_struct *work)
        if (ss) {
                /* css free path */
+                struct cgroup_subsys_state *parent = css->parent;
                int id = css->id;
-                if (css->parent)
-                        css_put(css->parent);
                ss->css_free(css);
                cgroup_idr_remove(&ss->css_idr, id);
                cgroup_put(cgrp);
+                if (parent)
+                        css_put(parent);
        } else {
                /* cgroup free path */
                atomic_dec(&cgrp->root->nr_cgrps);
@@ -4758,6 +4761,7 @@ static void init_and_link_css(struct cgroup_subsys_state *css,
        INIT_LIST_HEAD(&css->sibling);
        INIT_LIST_HEAD(&css->children);
        css->serial_nr = css_serial_nr_next++;
+        atomic_set(&css->online_cnt, 0);
        if (cgroup_parent(cgrp)) {
                css->parent = cgroup_css(cgroup_parent(cgrp), ss);
@@ -4780,6 +4784,10 @@ static int online_css(struct cgroup_subsys_state *css)
        if (!ret) {
                css->flags |= CSS_ONLINE;
                rcu_assign_pointer(css->cgroup->subsys[ss->id], css);
+                atomic_inc(&css->online_cnt);
+                if (css->parent)
+                        atomic_inc(&css->parent->online_cnt);
        }
        return ret;
 }
@@ -5017,10 +5025,15 @@ static void css_killed_work_fn(struct work_struct *work)
                container_of(work, struct cgroup_subsys_state, destroy_work);
        mutex_lock(&cgroup_mutex);
-        offline_css(css);
-        mutex_unlock(&cgroup_mutex);
-        css_put(css);
+        do {
+                offline_css(css);
+                css_put(css);
+                /* @css can't go away while we're holding cgroup_mutex */
+                css = css->parent;
+        } while (css && atomic_dec_and_test(&css->online_cnt));
+        mutex_unlock(&cgroup_mutex);
 }
 /* css kill confirmation processing requires process context, bounce */
@@ -5029,8 +5042,10 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
        struct cgroup_subsys_state *css =
                container_of(ref, struct cgroup_subsys_state, refcnt);
-        INIT_WORK(&css->destroy_work, css_killed_work_fn);
+        if (atomic_dec_and_test(&css->online_cnt)) {
-        queue_work(cgroup_destroy_wq, &css->destroy_work);
+                INIT_WORK(&css->destroy_work, css_killed_work_fn);
+                queue_work(cgroup_destroy_wq, &css->destroy_work);
+        }
 }
 /**
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 3e945fcd8179..41989ab4db57 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -287,6 +287,8 @@ static struct cpuset top_cpuset = {
 static DEFINE_MUTEX(cpuset_mutex);
 static DEFINE_SPINLOCK(callback_lock);
+static struct workqueue_struct *cpuset_migrate_mm_wq;
 /*
 * CPU / memory hotplug is handled asynchronously.
 */
@@ -972,31 +974,51 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
 }
 /*
- * cpuset_migrate_mm
+ * Migrate memory region from one set of nodes to another.  This is
- *
+ * performed asynchronously as it can be called from process migration path
- *    Migrate memory region from one set of nodes to another.
+ * holding locks involved in process management.  All mm migrations are
- *
+ * performed in the queued order and can be waited for by flushing
- *    Temporarilly set tasks mems_allowed to target nodes of migration,
+ * cpuset_migrate_mm_wq.
- *    so that the migration code can allocate pages on these nodes.
- *
- *    While the mm_struct we are migrating is typically from some
- *    other task, the task_struct mems_allowed that we are hacking
- *    is for our current task, which must allocate new pages for that
- *    migrating memory region.
 */
+struct cpuset_migrate_mm_work {
+        struct work_struct      work;
+        struct mm_struct        *mm;
+        nodemask_t              from;
+        nodemask_t              to;
+};
+static void cpuset_migrate_mm_workfn(struct work_struct *work)
+{
+        struct cpuset_migrate_mm_work *mwork =
+                container_of(work, struct cpuset_migrate_mm_work, work);
+        /* on a wq worker, no need to worry about %current's mems_allowed */
+        do_migrate_pages(mwork->mm, &mwork->from, &mwork->to, MPOL_MF_MOVE_ALL);
+        mmput(mwork->mm);
+        kfree(mwork);
+}
 static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
                                                        const nodemask_t *to)
 {
-        struct task_struct *tsk = current;
+        struct cpuset_migrate_mm_work *mwork;
-        tsk->mems_allowed = *to;
-        do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
+        mwork = kzalloc(sizeof(*mwork), GFP_KERNEL);
+        if (mwork) {
+                mwork->mm = mm;
+                mwork->from = *from;
+                mwork->to = *to;
+                INIT_WORK(&mwork->work, cpuset_migrate_mm_workfn);
+                queue_work(cpuset_migrate_mm_wq, &mwork->work);
+        } else {
+                mmput(mm);
+        }
+}
-        rcu_read_lock();
+void cpuset_post_attach_flush(void)
-        guarantee_online_mems(task_cs(tsk), &tsk->mems_allowed);
+{
-        rcu_read_unlock();
+        flush_workqueue(cpuset_migrate_mm_wq);
 }
 /*
@@ -1097,7 +1119,8 @@ static void update_tasks_nodemask(struct cpuset *cs)
                mpol_rebind_mm(mm, &cs->mems_allowed);
                if (migrate)
                        cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
-                mmput(mm);
+                else
+                        mmput(mm);
        }
        css_task_iter_end(&it);
@@ -1545,11 +1568,11 @@ static void cpuset_attach(struct cgroup_taskset *tset)
                         * @old_mems_allowed is the right nodesets that we
                         * migrate mm from.
                         */
-                        if (is_memory_migrate(cs)) {
+                        if (is_memory_migrate(cs))
                                cpuset_migrate_mm(mm, &oldcs->old_mems_allowed,
                                                  &cpuset_attach_nodemask_to);
-                        }
+                        else
-                        mmput(mm);
+                                mmput(mm);
                }
        }
@@ -1714,6 +1737,7 @@ out_unlock:
        mutex_unlock(&cpuset_mutex);
        kernfs_unbreak_active_protection(of->kn);
        css_put(&cs->css);
+        flush_workqueue(cpuset_migrate_mm_wq);
        return retval ?: nbytes;
 }
@@ -2359,6 +2383,9 @@ void __init cpuset_init_smp(void)
        top_cpuset.effective_mems = node_states[N_MEMORY];
        register_hotmemory_notifier(&cpuset_track_online_nodes_nb);
+        cpuset_migrate_mm_wq = alloc_ordered_workqueue("cpuset_migrate_mm", 0);
+        BUG_ON(!cpuset_migrate_mm_wq);
 }
 /**
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 60ace56618f6..716547fdb873 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -292,7 +292,7 @@ LIST_HEAD(all_lock_classes);
 #define __classhashfn(key)      hash_long((unsigned long)key, CLASSHASH_BITS)
 #define classhashentry(key)     (classhash_table + __classhashfn((key)))
-static struct list_head classhash_table[CLASSHASH_SIZE];
+static struct hlist_head classhash_table[CLASSHASH_SIZE];
 /*
 * We put the lock dependency chains into a hash-table as well, to cache
@@ -303,7 +303,7 @@ static struct list_head classhash_table[CLASSHASH_SIZE];
 #define __chainhashfn(chain)    hash_long(chain, CHAINHASH_BITS)
 #define chainhashentry(chain)   (chainhash_table + __chainhashfn((chain)))
-static struct list_head chainhash_table[CHAINHASH_SIZE];
+static struct hlist_head chainhash_table[CHAINHASH_SIZE];
 /*
 * The hash key of the lock dependency chains is a hash itself too:
@@ -666,7 +666,7 @@ static inline struct lock_class *
 look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
 {
        struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
+        struct hlist_head *hash_head;
        struct lock_class *class;
 #ifdef CONFIG_DEBUG_LOCKDEP
@@ -719,7 +719,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
        if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
                return NULL;
-        list_for_each_entry_rcu(class, hash_head, hash_entry) {
+        hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
                if (class->key == key) {
                        /*
                         * Huh! same key, different name? Did someone trample
@@ -742,7 +742,7 @@ static inline struct lock_class *
 register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 {
        struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
+        struct hlist_head *hash_head;
        struct lock_class *class;
        DEBUG_LOCKS_WARN_ON(!irqs_disabled());
@@ -774,7 +774,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
         * We have to do the hash-walk again, to avoid races
         * with another CPU:
         */
-        list_for_each_entry_rcu(class, hash_head, hash_entry) {
+        hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
                if (class->key == key)
                        goto out_unlock_set;
        }
@@ -805,7 +805,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
         * We use RCU's safe list-add method to make
         * parallel walking of the hash-list safe:
         */
-        list_add_tail_rcu(&class->hash_entry, hash_head);
+        hlist_add_head_rcu(&class->hash_entry, hash_head);
        /*
         * Add it to the global list of classes:
         */
@@ -1822,7 +1822,7 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
 */
 static int
 check_prev_add(struct task_struct *curr, struct held_lock *prev,
-               struct held_lock *next, int distance, int trylock_loop)
+               struct held_lock *next, int distance, int *stack_saved)
 {
        struct lock_list *entry;
        int ret;
@@ -1883,8 +1883,11 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                }
        }
-        if (!trylock_loop && !save_trace(&trace))
+        if (!*stack_saved) {
-                return 0;
+                if (!save_trace(&trace))
+                        return 0;
+                *stack_saved = 1;
+        }
        /*
         * Ok, all validations passed, add the new lock
@@ -1907,6 +1910,8 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
         * Debugging printouts:
         */
        if (verbose(hlock_class(prev)) || verbose(hlock_class(next))) {
+                /* We drop graph lock, so another thread can overwrite trace. */
+                *stack_saved = 0;
                graph_unlock();
                printk("\n new dependency: ");
                print_lock_name(hlock_class(prev));
@@ -1929,7 +1934,7 @@ static int
 check_prevs_add(struct task_struct *curr, struct held_lock *next)
 {
        int depth = curr->lockdep_depth;
-        int trylock_loop = 0;
+        int stack_saved = 0;
        struct held_lock *hlock;
        /*
@@ -1956,7 +1961,7 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                 */
                if (hlock->read != 2 && hlock->check) {
                        if (!check_prev_add(curr, hlock, next,
-                                                distance, trylock_loop))
+                                                distance, &stack_saved))
                                return 0;
                        /*
                         * Stop after the first non-trylock entry,
@@ -1979,7 +1984,6 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                if (curr->held_locks[depth].irq_context !=
                                curr->held_locks[depth-1].irq_context)
                        break;
-                trylock_loop = 1;
        }
        return 1;
 out_bug:
@@ -2017,7 +2021,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
                                     u64 chain_key)
 {
        struct lock_class *class = hlock_class(hlock);
-        struct list_head *hash_head = chainhashentry(chain_key);
+        struct hlist_head *hash_head = chainhashentry(chain_key);
        struct lock_chain *chain;
        struct held_lock *hlock_curr;
        int i, j;
@@ -2033,7 +2037,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
         * We can walk it lock-free, because entries only get added
         * to the hash:
         */
-        list_for_each_entry_rcu(chain, hash_head, entry) {
+        hlist_for_each_entry_rcu(chain, hash_head, entry) {
                if (chain->chain_key == chain_key) {
 cache_hit:
                        debug_atomic_inc(chain_lookup_hits);
@@ -2057,7 +2061,7 @@ cache_hit:
        /*
         * We have to walk the chain again locked - to avoid duplicates:
         */
-        list_for_each_entry(chain, hash_head, entry) {
+        hlist_for_each_entry(chain, hash_head, entry) {
                if (chain->chain_key == chain_key) {
                        graph_unlock();
                        goto cache_hit;
@@ -2091,7 +2095,7 @@ cache_hit:
                }
                chain_hlocks[chain->base + j] = class - lock_classes;
        }
-        list_add_tail_rcu(&chain->entry, hash_head);
+        hlist_add_head_rcu(&chain->entry, hash_head);
        debug_atomic_inc(chain_lookup_misses);
        inc_chains();
@@ -3875,7 +3879,7 @@ void lockdep_reset(void)
        nr_process_chains = 0;
        debug_locks = 1;
        for (i = 0; i < CHAINHASH_SIZE; i++)
-                INIT_LIST_HEAD(chainhash_table + i);
+                INIT_HLIST_HEAD(chainhash_table + i);
        raw_local_irq_restore(flags);
 }
@@ -3894,7 +3898,7 @@ static void zap_class(struct lock_class *class)
        /*
         * Unhash the class and remove it from the all_lock_classes list:
         */
-        list_del_rcu(&class->hash_entry);
+        hlist_del_rcu(&class->hash_entry);
        list_del_rcu(&class->lock_entry);
        RCU_INIT_POINTER(class->key, NULL);
@@ -3917,7 +3921,7 @@ static inline int within(const void *addr, void *start, unsigned long size)
 void lockdep_free_key_range(void *start, unsigned long size)
 {
        struct lock_class *class;
-        struct list_head *head;
+        struct hlist_head *head;
        unsigned long flags;
        int i;
        int locked;
@@ -3930,9 +3934,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
         */
        for (i = 0; i < CLASSHASH_SIZE; i++) {
                head = classhash_table + i;
-                if (list_empty(head))
+                hlist_for_each_entry_rcu(class, head, hash_entry) {
-                        continue;
-                list_for_each_entry_rcu(class, head, hash_entry) {
                        if (within(class->key, start, size))
                                zap_class(class);
                        else if (within(class->name, start, size))
@@ -3962,7 +3964,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
 void lockdep_reset_lock(struct lockdep_map *lock)
 {
        struct lock_class *class;
-        struct list_head *head;
+        struct hlist_head *head;
        unsigned long flags;
        int i, j;
        int locked;
@@ -3987,9 +3989,7 @@ void lockdep_reset_lock(struct lockdep_map *lock)
        locked = graph_lock();
        for (i = 0; i < CLASSHASH_SIZE; i++) {
                head = classhash_table + i;
-                if (list_empty(head))
+                hlist_for_each_entry_rcu(class, head, hash_entry) {
-                        continue;
-                list_for_each_entry_rcu(class, head, hash_entry) {
                        int match = 0;
                        for (j = 0; j < NR_LOCKDEP_CACHING_CLASSES; j++)
@@ -4027,10 +4027,10 @@ void lockdep_init(void)
                return;
        for (i = 0; i < CLASSHASH_SIZE; i++)
-                INIT_LIST_HEAD(classhash_table + i);
+                INIT_HLIST_HEAD(classhash_table + i);
        for (i = 0; i < CHAINHASH_SIZE; i++)
-                INIT_LIST_HEAD(chainhash_table + i);
+                INIT_HLIST_HEAD(chainhash_table + i);
        lockdep_initialized = 1;
 }
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 70ee3775de24..2c468dea60bc 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -150,7 +150,7 @@ void devm_memunmap(struct device *dev, void *addr)
 }
 EXPORT_SYMBOL(devm_memunmap);
-pfn_t phys_to_pfn_t(phys_addr_t addr, unsigned long flags)
+pfn_t phys_to_pfn_t(phys_addr_t addr, u64 flags)
 {
        return __pfn_to_pfn_t(addr >> PAGE_SHIFT, flags);
 }
diff --git a/kernel/module.c b/kernel/module.c
index 8358f4697c0c..9537da37ce87 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -303,6 +303,9 @@ struct load_info {
        struct _ddebug *debug;
        unsigned int num_debug;
        bool sig_ok;
+#ifdef CONFIG_KALLSYMS
+        unsigned long mod_kallsyms_init_off;
+#endif
        struct {
                unsigned int sym, str, mod, vers, info, pcpu;
        } index;
@@ -2480,10 +2483,21 @@ static void layout_symtab(struct module *mod, struct load_info *info)
        strsect->sh_flags |= SHF_ALLOC;
        strsect->sh_entsize = get_offset(mod, &mod->init_layout.size, strsect,
                                         info->index.str) | INIT_OFFSET_MASK;
-        mod->init_layout.size = debug_align(mod->init_layout.size);
        pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
+        /* We'll tack temporary mod_kallsyms on the end. */
+        mod->init_layout.size = ALIGN(mod->init_layout.size,
+                                      __alignof__(struct mod_kallsyms));
+        info->mod_kallsyms_init_off = mod->init_layout.size;
+        mod->init_layout.size += sizeof(struct mod_kallsyms);
+        mod->init_layout.size = debug_align(mod->init_layout.size);
 }
+/*
+ * We use the full symtab and strtab which layout_symtab arranged to
+ * be appended to the init section.  Later we switch to the cut-down
+ * core-only ones.
+ */
 static void add_kallsyms(struct module *mod, const struct load_info *info)
 {
        unsigned int i, ndst;
@@ -2492,29 +2506,34 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
        char *s;
        Elf_Shdr *symsec = &info->sechdrs[info->index.sym];
-        mod->symtab = (void *)symsec->sh_addr;
+        /* Set up to point into init section. */
-        mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
+        mod->kallsyms = mod->init_layout.base + info->mod_kallsyms_init_off;
+        mod->kallsyms->symtab = (void *)symsec->sh_addr;
+        mod->kallsyms->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
        /* Make sure we get permanent strtab: don't use info->strtab. */
-        mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
+        mod->kallsyms->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
        /* Set types up while we still have access to sections. */
-        for (i = 0; i < mod->num_symtab; i++)
+        for (i = 0; i < mod->kallsyms->num_symtab; i++)
-                mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
+                mod->kallsyms->symtab[i].st_info
+                        = elf_type(&mod->kallsyms->symtab[i], info);
-        mod->core_symtab = dst = mod->core_layout.base + info->symoffs;
-        mod->core_strtab = s = mod->core_layout.base + info->stroffs;
+        /* Now populate the cut down core kallsyms for after init. */
-        src = mod->symtab;
+        mod->core_kallsyms.symtab = dst = mod->core_layout.base + info->symoffs;
-        for (ndst = i = 0; i < mod->num_symtab; i++) {
+        mod->core_kallsyms.strtab = s = mod->core_layout.base + info->stroffs;
+        src = mod->kallsyms->symtab;
+        for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) {
                if (i == 0 ||
                    is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum,
                                   info->index.pcpu)) {
                        dst[ndst] = src[i];
-                        dst[ndst++].st_name = s - mod->core_strtab;
+                        dst[ndst++].st_name = s - mod->core_kallsyms.strtab;
-                        s += strlcpy(s, &mod->strtab[src[i].st_name],
+                        s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name],
                                     KSYM_NAME_LEN) + 1;
                }
        }
-        mod->core_num_syms = ndst;
+        mod->core_kallsyms.num_symtab = ndst;
 }
 #else
 static inline void layout_symtab(struct module *mod, struct load_info *info)
@@ -3263,9 +3282,8 @@ static noinline int do_init_module(struct module *mod)
        module_put(mod);
        trim_init_extable(mod);
 #ifdef CONFIG_KALLSYMS
-        mod->num_symtab = mod->core_num_syms;
+        /* Switch to core kallsyms now init is done: kallsyms may be walking! */
-        mod->symtab = mod->core_symtab;
+        rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
-        mod->strtab = mod->core_strtab;
 #endif
        mod_tree_remove_init(mod);
        disable_ro_nx(&mod->init_layout);
@@ -3496,7 +3514,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
        /* Module is ready to execute: parsing args may do that. */
        after_dashes = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
-                                  -32768, 32767, NULL,
+                                  -32768, 32767, mod,
                                  unknown_module_param_cb);
        if (IS_ERR(after_dashes)) {
                err = PTR_ERR(after_dashes);
@@ -3627,6 +3645,11 @@ static inline int is_arm_mapping_symbol(const char *str)
               && (str[2] == '\0' || str[2] == '.');
 }
+static const char *symname(struct mod_kallsyms *kallsyms, unsigned int symnum)
+{
+        return kallsyms->strtab + kallsyms->symtab[symnum].st_name;
+}
 static const char *get_ksymbol(struct module *mod,
                               unsigned long addr,
                               unsigned long *size,
@@ -3634,6 +3657,7 @@ static const char *get_ksymbol(struct module *mod,
 {
        unsigned int i, best = 0;
        unsigned long nextval;
+        struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
        /* At worse, next value is at end of module */
        if (within_module_init(addr, mod))
@@ -3643,32 +3667,32 @@ static const char *get_ksymbol(struct module *mod,
        /* Scan for closest preceding symbol, and next symbol. (ELF
           starts real symbols at 1). */
-        for (i = 1; i < mod->num_symtab; i++) {
+        for (i = 1; i < kallsyms->num_symtab; i++) {
-                if (mod->symtab[i].st_shndx == SHN_UNDEF)
+                if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
                        continue;
                /* We ignore unnamed symbols: they're uninformative
                 * and inserted at a whim. */
-                if (mod->symtab[i].st_value <= addr
+                if (*symname(kallsyms, i) == '\0'
-                    && mod->symtab[i].st_value > mod->symtab[best].st_value
+                    || is_arm_mapping_symbol(symname(kallsyms, i)))
-                    && *(mod->strtab + mod->symtab[i].st_name) != '\0'
+                        continue;
-                    && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
+                if (kallsyms->symtab[i].st_value <= addr
+                    && kallsyms->symtab[i].st_value > kallsyms->symtab[best].st_value)
                        best = i;
-                if (mod->symtab[i].st_value > addr
+                if (kallsyms->symtab[i].st_value > addr
-                    && mod->symtab[i].st_value < nextval
+                    && kallsyms->symtab[i].st_value < nextval)
-                    && *(mod->strtab + mod->symtab[i].st_name) != '\0'
+                        nextval = kallsyms->symtab[i].st_value;
-                    && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
-                        nextval = mod->symtab[i].st_value;
        }
        if (!best)
                return NULL;
        if (size)
-                *size = nextval - mod->symtab[best].st_value;
+                *size = nextval - kallsyms->symtab[best].st_value;
        if (offset)
-                *offset = addr - mod->symtab[best].st_value;
+                *offset = addr - kallsyms->symtab[best].st_value;
-        return mod->strtab + mod->symtab[best].st_name;
+        return symname(kallsyms, best);
 }
 /* For kallsyms to ask for address resolution.  NULL means not found.  Careful
@@ -3758,19 +3782,21 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
        preempt_disable();
        list_for_each_entry_rcu(mod, &modules, list) {
+                struct mod_kallsyms *kallsyms;
                if (mod->state == MODULE_STATE_UNFORMED)
                        continue;
-                if (symnum < mod->num_symtab) {
+                kallsyms = rcu_dereference_sched(mod->kallsyms);
-                        *value = mod->symtab[symnum].st_value;
+                if (symnum < kallsyms->num_symtab) {
-                        *type = mod->symtab[symnum].st_info;
+                        *value = kallsyms->symtab[symnum].st_value;
-                        strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
+                        *type = kallsyms->symtab[symnum].st_info;
-                                KSYM_NAME_LEN);
+                        strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN);
                        strlcpy(module_name, mod->name, MODULE_NAME_LEN);
                        *exported = is_exported(name, *value, mod);
                        preempt_enable();
                        return 0;
                }
-                symnum -= mod->num_symtab;
+                symnum -= kallsyms->num_symtab;
        }
        preempt_enable();
        return -ERANGE;
@@ -3779,11 +3805,12 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
 static unsigned long mod_find_symname(struct module *mod, const char *name)
 {
        unsigned int i;
+        struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
-        for (i = 0; i < mod->num_symtab; i++)
+        for (i = 0; i < kallsyms->num_symtab; i++)
-                if (strcmp(name, mod->strtab+mod->symtab[i].st_name) == 0 &&
+                if (strcmp(name, symname(kallsyms, i)) == 0 &&
-                    mod->symtab[i].st_info != 'U')
+                    kallsyms->symtab[i].st_info != 'U')
-                        return mod->symtab[i].st_value;
+                        return kallsyms->symtab[i].st_value;
        return 0;
 }
@@ -3822,11 +3849,14 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
        module_assert_mutex();
        list_for_each_entry(mod, &modules, list) {
+                /* We hold module_mutex: no need for rcu_dereference_sched */
+                struct mod_kallsyms *kallsyms = mod->kallsyms;
                if (mod->state == MODULE_STATE_UNFORMED)
                        continue;
-                for (i = 0; i < mod->num_symtab; i++) {
+                for (i = 0; i < kallsyms->num_symtab; i++) {
-                        ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+                        ret = fn(data, symname(kallsyms, i),
-                                 mod, mod->symtab[i].st_value);
+                                 mod, kallsyms->symtab[i].st_value);
                        if (ret != 0)
                                return ret;
                }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 61a0264e28f9..7ff5dc7d2ac5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -301,7 +301,23 @@ static DEFINE_SPINLOCK(wq_mayday_lock);	/* protects wq->maydays list */
 static LIST_HEAD(workqueues);           /* PR: list of all workqueues */
 static bool workqueue_freezing;         /* PL: have wqs started freezing? */
-static cpumask_var_t wq_unbound_cpumask; /* PL: low level cpumask for all unbound wqs */
+/* PL: allowable cpus for unbound wqs and work items */
+static cpumask_var_t wq_unbound_cpumask;
+/* CPU where unbound work was last round robin scheduled from this CPU */
+static DEFINE_PER_CPU(int, wq_rr_cpu_last);
+/*
+ * Local execution of unbound work items is no longer guaranteed.  The
+ * following always forces round-robin CPU selection on unbound work items
+ * to uncover usages which depend on it.
+ */
+#ifdef CONFIG_DEBUG_WQ_FORCE_RR_CPU
+static bool wq_debug_force_rr_cpu = true;
+#else
+static bool wq_debug_force_rr_cpu = false;
+#endif
+module_param_named(debug_force_rr_cpu, wq_debug_force_rr_cpu, bool, 0644);
 /* the per-cpu worker pools */
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct worker_pool [NR_STD_WORKER_POOLS],
@@ -570,6 +586,16 @@ static struct pool_workqueue *unbound_pwq_by_node(struct workqueue_struct *wq,
                                                  int node)
 {
        assert_rcu_or_wq_mutex_or_pool_mutex(wq);
+        /*
+         * XXX: @node can be NUMA_NO_NODE if CPU goes offline while a
+         * delayed item is pending.  The plan is to keep CPU -> NODE
+         * mapping valid and stable across CPU on/offlines.  Once that
+         * happens, this workaround can be removed.
+         */
+        if (unlikely(node == NUMA_NO_NODE))
+                return wq->dfl_pwq;
        return rcu_dereference_raw(wq->numa_pwq_tbl[node]);
 }
@@ -1298,6 +1324,39 @@ static bool is_chained_work(struct workqueue_struct *wq)
        return worker && worker->current_pwq->wq == wq;
 }
+/*
+ * When queueing an unbound work item to a wq, prefer local CPU if allowed
+ * by wq_unbound_cpumask.  Otherwise, round robin among the allowed ones to
+ * avoid perturbing sensitive tasks.
+ */
+static int wq_select_unbound_cpu(int cpu)
+{
+        static bool printed_dbg_warning;
+        int new_cpu;
+        if (likely(!wq_debug_force_rr_cpu)) {
+                if (cpumask_test_cpu(cpu, wq_unbound_cpumask))
+                        return cpu;
+        } else if (!printed_dbg_warning) {
+                pr_warn("workqueue: round-robin CPU selection forced, expect performance impact\n");
+                printed_dbg_warning = true;
+        }
+        if (cpumask_empty(wq_unbound_cpumask))
+                return cpu;
+        new_cpu = __this_cpu_read(wq_rr_cpu_last);
+        new_cpu = cpumask_next_and(new_cpu, wq_unbound_cpumask, cpu_online_mask);
+        if (unlikely(new_cpu >= nr_cpu_ids)) {
+                new_cpu = cpumask_first_and(wq_unbound_cpumask, cpu_online_mask);
+                if (unlikely(new_cpu >= nr_cpu_ids))
+                        return cpu;
+        }
+        __this_cpu_write(wq_rr_cpu_last, new_cpu);
+        return new_cpu;
+}
 static void __queue_work(int cpu, struct workqueue_struct *wq,
                         struct work_struct *work)
 {
@@ -1323,7 +1382,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
                return;
 retry:
        if (req_cpu == WORK_CPU_UNBOUND)
-                cpu = raw_smp_processor_id();
+                cpu = wq_select_unbound_cpu(raw_smp_processor_id());
        /* pwq which will be used unless @work is executing elsewhere */
        if (!(wq->flags & WQ_UNBOUND))
@@ -1464,13 +1523,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
        timer_stats_timer_set_start_info(&dwork->timer);
        dwork->wq = wq;
-        /* timer isn't guaranteed to run in this cpu, record earlier */
-        if (cpu == WORK_CPU_UNBOUND)
-                cpu = raw_smp_processor_id();
        dwork->cpu = cpu;
        timer->expires = jiffies + delay;
-        add_timer_on(timer, cpu);
+        if (unlikely(cpu != WORK_CPU_UNBOUND))
+                add_timer_on(timer, cpu);
+        else
+                add_timer(timer);
 }
 /**
@@ -2355,7 +2414,8 @@ static void check_flush_dependency(struct workqueue_struct *target_wq,
        WARN_ONCE(current->flags & PF_MEMALLOC,
                  "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%pf",
                  current->pid, current->comm, target_wq->name, target_func);
-        WARN_ONCE(worker && (worker->current_pwq->wq->flags & WQ_MEM_RECLAIM),
+        WARN_ONCE(worker && ((worker->current_pwq->wq->flags &
+                              (WQ_MEM_RECLAIM | __WQ_LEGACY)) == WQ_MEM_RECLAIM),
                  "workqueue: WQ_MEM_RECLAIM %s:%pf is flushing !WQ_MEM_RECLAIM %s:%pf",
                  worker->current_pwq->wq->name, worker->current_func,
                  target_wq->name, target_func);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index ecb9e75614bf..8bfd1aca7a3d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1400,6 +1400,21 @@ config RCU_EQS_DEBUG
 endmenu # "RCU Debugging"
+config DEBUG_WQ_FORCE_RR_CPU
+        bool "Force round-robin CPU selection for unbound work items"
+        depends on DEBUG_KERNEL
+        default n
+        help
+          Workqueue used to implicitly guarantee that work items queued
+          without explicit CPU specified are put on the local CPU.  This
+          guarantee is no longer true and while local CPU is still
+          preferred work items may be put on foreign CPUs.  Kernel
+          parameter "workqueue.debug_force_rr_cpu" is added to force
+          round-robin CPU selection to flush out usages which depend on the
+          now broken guarantee.  This config option enables the debug
+          feature by default.  When enabled, memory and cache locality will
+          be impacted.
 config DEBUG_BLOCK_EXT_DEVT
        bool "Force extended block device numbers and spread them"
        depends on DEBUG_KERNEL
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index 49518fb48cab..e07c1ba9ba13 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -18,6 +18,8 @@ config UBSAN_SANITIZE_ALL
          This option activates instrumentation for the entire kernel.
          If you don't enable this option, you have to explicitly specify
          UBSAN_SANITIZE := y for the files/directories you want to check for UB.
+          Enabling this option will get kernel image size increased
+          significantly.
 config UBSAN_ALIGNMENT
        bool "Enable checking of pointers alignment"
@@ -25,5 +27,5 @@ config UBSAN_ALIGNMENT
        default y if !HAVE_EFFICIENT_UNALIGNED_ACCESS
        help
          This option enables detection of unaligned memory accesses.
-          Enabling this option on architectures that support unalligned
+          Enabling this option on architectures that support unaligned
          accesses may produce a lot of false positives.
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index bafa9933fa76..004fc70fc56a 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -598,9 +598,9 @@ EXPORT_SYMBOL(sg_miter_next);
 *
 * Description:
 *   Stops mapping iterator @miter.  @miter should have been started
- *   started using sg_miter_start().  A stopped iteration can be
+ *   using sg_miter_start().  A stopped iteration can be resumed by
- *   resumed by calling sg_miter_next() on it.  This is useful when
+ *   calling sg_miter_next() on it.  This is useful when resources (kmap)
- *   resources (kmap) need to be released during iteration.
+ *   need to be released during iteration.
 *
 * Context:
 *   Preemption disabled if the SG_MITER_ATOMIC is set.  Don't care
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 48ff9c36644d..f44e178e6ede 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1590,22 +1590,23 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                        return buf;
                }
        case 'K':
-                /*
-                 * %pK cannot be used in IRQ context because its test
-                 * for CAP_SYSLOG would be meaningless.
-                 */
-                if (kptr_restrict && (in_irq() || in_serving_softirq() ||
-                                      in_nmi())) {
-                        if (spec.field_width == -1)
-                                spec.field_width = default_width;
-                        return string(buf, end, "pK-error", spec);
-                }
                switch (kptr_restrict) {
                case 0:
                        /* Always print %pK values */
                        break;
                case 1: {
+                        const struct cred *cred;
+                        /*
+                         * kptr_restrict==1 cannot be used in IRQ context
+                         * because its test for CAP_SYSLOG would be meaningless.
+                         */
+                        if (in_irq() || in_serving_softirq() || in_nmi()) {
+                                if (spec.field_width == -1)
+                                        spec.field_width = default_width;
+                                return string(buf, end, "pK-error", spec);
+                        }
                        /*
                         * Only print the real pointer value if the current
                         * process has CAP_SYSLOG and is running with the
@@ -1615,8 +1616,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                         * leak pointer values if a binary opens a file using
                         * %pK and then elevates privileges before reading it.
                         */
-                        const struct cred *cred = current_cred();
+                        cred = current_cred();
                        if (!has_capability_noaudit(current, CAP_SYSLOG) ||
                            !uid_eq(cred->euid, cred->uid) ||
                            !gid_eq(cred->egid, cred->gid))
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 926c76d56388..c554d173a65f 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -328,7 +328,7 @@ static int wb_init(struct bdi_writeback *wb, struct backing_dev_info *bdi,
        return 0;
 out_destroy_stat:
-        while (--i)
+        while (i--)
                percpu_counter_destroy(&wb->stat[i]);
        fprop_local_destroy_percpu(&wb->completions);
 out_put_cong:
diff --git a/mm/filemap.c b/mm/filemap.c
index bc943867d68c..23edccecadb0 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1890,6 +1890,7 @@ EXPORT_SYMBOL(generic_file_read_iter);
 * page_cache_read - adds requested page to the page cache if not already there
 * @file:       file to read
 * @offset:     page index
+ * @gfp_mask:   memory allocation flags
 *
 * This adds the requested page to the page cache if it isn't already there,
 * and schedules an I/O to read in its contents from disk.
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 8eb7bb40dc40..f7cb3d4d9c2e 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -160,9 +160,11 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                }
                if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
-                        if (next - addr != HPAGE_PMD_SIZE)
+                        if (next - addr != HPAGE_PMD_SIZE) {
                                split_huge_pmd(vma, pmd, addr);
-                        else {
+                                if (pmd_none(*pmd))
+                                        continue;
+                        } else {
                                int nr_ptes = change_huge_pmd(vma, pmd, addr,
                                                newprot, prot_numa);
diff --git a/mm/mremap.c b/mm/mremap.c
index d77946a997f7..8eeba02fc991 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -210,6 +210,8 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                                }
                        }
                        split_huge_pmd(vma, old_pmd, old_addr);
+                        if (pmd_none(*old_pmd))
+                                continue;
                        VM_BUG_ON(pmd_trans_huge(*old_pmd));
                }
                if (pmd_none(*new_pmd) && __pte_alloc(new_vma->vm_mm, new_vma,
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 9d4767698a1c..06a005b979a7 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -90,9 +90,9 @@ pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long address,
 * ARCHes with special requirements for evicting THP backing TLB entries can
 * implement this. Otherwise also, it can help optimize normal TLB flush in
 * THP regime. stock flush_tlb_range() typically has optimization to nuke the
- * entire TLB TLB if flush span is greater than a threshhold, which will
+ * entire TLB if flush span is greater than a threshold, which will
 * likely be true for a single huge page. Thus a single thp flush will
- * invalidate the entire TLB which is not desitable.
+ * invalidate the entire TLB which is not desirable.
 * e.g. see arch/arc: flush_pmd_tlb_range
 */
 #define flush_pmd_tlb_range(vma, addr, end)     flush_tlb_range(vma, addr, end)
@@ -195,7 +195,9 @@ pmd_t pmdp_collapse_flush(struct vm_area_struct *vma, unsigned long address,
        VM_BUG_ON(address & ~HPAGE_PMD_MASK);
        VM_BUG_ON(pmd_trans_huge(*pmdp));
        pmd = pmdp_huge_get_and_clear(vma->vm_mm, address, pmdp);
-        flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
+        /* collapse entails shooting down ptes not pmd */
+        flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
        return pmd;
 }
 #endif
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index d79699c9d1b9..eab81bc80e5c 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -208,7 +208,6 @@ ip:
        case htons(ETH_P_IPV6): {
                const struct ipv6hdr *iph;
                struct ipv6hdr _iph;
-                __be32 flow_label;
 ipv6:
                iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
@@ -230,8 +229,12 @@ ipv6:
                        key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
                }
-                flow_label = ip6_flowlabel(iph);
+                if ((dissector_uses_key(flow_dissector,
-                if (flow_label) {
+                                        FLOW_DISSECTOR_KEY_FLOW_LABEL) ||
+                     (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)) &&
+                    ip6_flowlabel(iph)) {
+                        __be32 flow_label = ip6_flowlabel(iph);
                        if (dissector_uses_key(flow_dissector,
                                               FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
                                key_tags = skb_flow_dissector_target(flow_dissector,
diff --git a/net/core/scm.c b/net/core/scm.c
index 14596fb37172..2696aefdc148 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                *fplp = fpl;
                fpl->count = 0;
                fpl->max = SCM_MAX_FD;
+                fpl->user = NULL;
        }
        fpp = &fpl->fp[fpl->count];
@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                *fpp++ = file;
                fpl->count++;
        }
+        if (!fpl->user)
+                fpl->user = get_uid(current_user());
        return num;
 }
@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm)
                scm->fp = NULL;
                for (i=fpl->count-1; i>=0; i--)
                        fput(fpl->fp[i]);
+                free_uid(fpl->user);
                kfree(fpl);
        }
 }
@@ -336,6 +342,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
                for (i = 0; i < fpl->count; i++)
                        get_file(fpl->fp[i]);
                new_fpl->max = new_fpl->count;
+                new_fpl->user = get_uid(fpl->user);
        }
        return new_fpl;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b2df375ec9c2..5bf88f58bee7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -79,6 +79,8 @@
 struct kmem_cache *skbuff_head_cache __read_mostly;
 static struct kmem_cache *skbuff_fclone_cache __read_mostly;
+int sysctl_max_skb_frags __read_mostly = MAX_SKB_FRAGS;
+EXPORT_SYMBOL(sysctl_max_skb_frags);
 /**
 *      skb_panic - private function for out-of-line support
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 95b6139d710c..a6beb7b6ae55 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -26,6 +26,7 @@ static int zero = 0;
 static int one = 1;
 static int min_sndbuf = SOCK_MIN_SNDBUF;
 static int min_rcvbuf = SOCK_MIN_RCVBUF;
+static int max_skb_frags = MAX_SKB_FRAGS;
 static int net_msg_warn;        /* Unused, but still a sysctl */
@@ -392,6 +393,15 @@ static struct ctl_table net_core_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
+        {
+                .procname       = "max_skb_frags",
+                .data           = &sysctl_max_skb_frags,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &max_skb_frags,
+        },
        { }
 };
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 7c51c4e1661f..56fdf4e0dce4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1240,6 +1240,14 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
        err = ipgre_newlink(net, dev, tb, NULL);
        if (err < 0)
                goto out;
+        /* openvswitch users expect packet sizes to be unrestricted,
+         * so set the largest MTU we can.
+         */
+        err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false);
+        if (err)
+                goto out;
        return dev;
 out:
        free_netdev(dev);
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index c7bd72e9b544..89e8861e05fc 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -943,17 +943,31 @@ done:
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_ioctl);
-int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+        int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
-        if (new_mtu < 68 ||
+        if (new_mtu < 68)
-            new_mtu > 0xFFF8 - dev->hard_header_len - t_hlen)
                return -EINVAL;
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+                new_mtu = max_mtu;
+        }
        dev->mtu = new_mtu;
        return 0;
 }
+EXPORT_SYMBOL_GPL(__ip_tunnel_change_mtu);
+int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+{
+        return __ip_tunnel_change_mtu(dev, new_mtu, true);
+}
 EXPORT_SYMBOL_GPL(ip_tunnel_change_mtu);
 static void ip_tunnel_dev_free(struct net_device *dev)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 19746b3fcbbe..0c36ef4a3f86 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -940,7 +940,7 @@ new_segment:
                i = skb_shinfo(skb)->nr_frags;
                can_coalesce = skb_can_coalesce(skb, i, page, offset);
-                if (!can_coalesce && i >= MAX_SKB_FRAGS) {
+                if (!can_coalesce && i >= sysctl_max_skb_frags) {
                        tcp_mark_push(tp, skb);
                        goto new_segment;
                }
@@ -1213,7 +1213,7 @@ new_segment:
                        if (!skb_can_coalesce(skb, i, pfrag->page,
                                              pfrag->offset)) {
-                                if (i == MAX_SKB_FRAGS || !sg) {
+                                if (i == sysctl_max_skb_frags || !sg) {
                                        tcp_mark_push(tp, skb);
                                        goto new_segment;
                                }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a4d523709ab3..7f6ff037adaf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -311,7 +311,7 @@ static void do_redirect(struct sk_buff *skb, struct sock *sk)
 /* handle ICMP messages on TCP_NEW_SYN_RECV request sockets */
-void tcp_req_err(struct sock *sk, u32 seq)
+void tcp_req_err(struct sock *sk, u32 seq, bool abort)
 {
        struct request_sock *req = inet_reqsk(sk);
        struct net *net = sock_net(sk);
@@ -323,7 +323,7 @@ void tcp_req_err(struct sock *sk, u32 seq)
        if (seq != tcp_rsk(req)->snt_isn) {
                NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
-        } else {
+        } else if (abort) {
                /*
                 * Still in SYN_RECV, just remove it silently.
                 * There is no good way to pass the error to the newly
@@ -383,7 +383,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
        }
        seq = ntohl(th->seq);
        if (sk->sk_state == TCP_NEW_SYN_RECV)
-                return tcp_req_err(sk, seq);
+                return tcp_req_err(sk, seq,
+                                  type == ICMP_PARAMETERPROB ||
+                                  type == ICMP_TIME_EXCEEDED ||
+                                  (type == ICMP_DEST_UNREACH &&
+                                   (code == ICMP_NET_UNREACH ||
+                                    code == ICMP_HOST_UNREACH)));
        bh_lock_sock(sk);
        /* If too many ICMPs get dropped on busy
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 38eeddedfc21..9efd9ffdc34c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3538,6 +3538,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
        struct inet6_dev *idev = ifp->idev;
        struct net_device *dev = idev->dev;
+        bool notify = false;
        addrconf_join_solict(dev, &ifp->addr);
@@ -3583,7 +3584,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
                        /* Because optimistic nodes can use this address,
                         * notify listeners. If DAD fails, RTM_DELADDR is sent.
                         */
-                        ipv6_ifa_notify(RTM_NEWADDR, ifp);
+                        notify = true;
                }
        }
@@ -3591,6 +3592,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 out:
        spin_unlock(&ifp->lock);
        read_unlock_bh(&idev->lock);
+        if (notify)
+                ipv6_ifa_notify(RTM_NEWADDR, ifp);
 }
 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1f9ebe3cbb4a..dc2db4f7b182 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -540,12 +540,13 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                }
                spin_lock_bh(&ip6_sk_fl_lock);
                for (sflp = &np->ipv6_fl_list;
-                     (sfl = rcu_dereference(*sflp)) != NULL;
+                     (sfl = rcu_dereference_protected(*sflp,
+                                                      lockdep_is_held(&ip6_sk_fl_lock))) != NULL;
                     sflp = &sfl->next) {
                        if (sfl->fl->label == freq.flr_label) {
                                if (freq.flr_label == (np->flow_label&IPV6_FLOWLABEL_MASK))
                                        np->flow_label &= ~IPV6_FLOWLABEL_MASK;
-                                *sflp = rcu_dereference(sfl->next);
+                                *sflp = sfl->next;
                                spin_unlock_bh(&ip6_sk_fl_lock);
                                fl_release(sfl->fl);
                                kfree_rcu(sfl, rcu);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 006396e31cb0..1a5a70fb8551 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -327,6 +327,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct tcp_sock *tp;
        __u32 seq, snd_una;
        struct sock *sk;
+        bool fatal;
        int err;
        sk = __inet6_lookup_established(net, &tcp_hashinfo,
@@ -345,8 +346,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                return;
        }
        seq = ntohl(th->seq);
+        fatal = icmpv6_err_convert(type, code, &err);
        if (sk->sk_state == TCP_NEW_SYN_RECV)
-                return tcp_req_err(sk, seq);
+                return tcp_req_err(sk, seq, fatal);
        bh_lock_sock(sk);
        if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
@@ -400,7 +402,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                goto out;
        }
-        icmpv6_err_convert(type, code, &err);
        /* Might be for an request_sock */
        switch (sk->sk_state) {
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 1605691d9414..de9cb19efb6a 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -91,6 +91,8 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
        struct vxlan_config conf = {
                .no_share = true,
                .flags = VXLAN_F_COLLECT_METADATA,
+                /* Don't restrict the packets that can be sent by MTU */
+                .mtu = IP_MAX_MTU,
        };
        if (!options) {
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5ca2ebfe0be8..e878da0949db 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5538,6 +5538,7 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
        struct sctp_hmac_algo_param *hmacs;
        __u16 data_len = 0;
        u32 num_idents;
+        int i;
        if (!ep->auth_enable)
                return -EACCES;
@@ -5555,8 +5556,12 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
                return -EFAULT;
        if (put_user(num_idents, &p->shmac_num_idents))
                return -EFAULT;
-        if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
+        for (i = 0; i < num_idents; i++) {
-                return -EFAULT;
+                __u16 hmacid = ntohs(hmacs->hmac_ids[i]);
+                if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
+                        return -EFAULT;
+        }
        return 0;
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 49d5093eb055..29be035f9c65 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1496,7 +1496,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
        UNIXCB(skb).fp = NULL;
        for (i = scm->fp->count-1; i >= 0; i--)
-                unix_notinflight(scm->fp->fp[i]);
+                unix_notinflight(scm->fp->user, scm->fp->fp[i]);
 }
 static void unix_destruct_scm(struct sk_buff *skb)
@@ -1561,7 +1561,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
                return -ENOMEM;
        for (i = scm->fp->count - 1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
+                unix_inflight(scm->fp->user, scm->fp->fp[i]);
        return max_level;
 }
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 8fcdc2283af5..6a0d48525fcf 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -116,7 +116,7 @@ struct sock *unix_get_socket(struct file *filp)
 * descriptor if it is for an AF_UNIX socket.
 */
-void unix_inflight(struct file *fp)
+void unix_inflight(struct user_struct *user, struct file *fp)
 {
        struct sock *s = unix_get_socket(fp);
@@ -133,11 +133,11 @@ void unix_inflight(struct file *fp)
                }
                unix_tot_inflight++;
        }
-        fp->f_cred->user->unix_inflight++;
+        user->unix_inflight++;
        spin_unlock(&unix_gc_lock);
 }
-void unix_notinflight(struct file *fp)
+void unix_notinflight(struct user_struct *user, struct file *fp)
 {
        struct sock *s = unix_get_socket(fp);
@@ -152,7 +152,7 @@ void unix_notinflight(struct file *fp)
                        list_del_init(&u->link);
                unix_tot_inflight--;
        }
-        fp->f_cred->user->unix_inflight--;
+        user->unix_inflight--;
        spin_unlock(&unix_gc_lock);
 }
diff --git a/scripts/prune-kernel b/scripts/prune-kernel
new file mode 100755
index 000000000000..ab5034e1d081
--- /dev/null
+++ b/scripts/prune-kernel
@@ -0,0 +1,20 @@
+#!/bin/bash
+# because I use CONFIG_LOCALVERSION_AUTO, not the same version again and
+# again, /boot and /lib/modules/ eventually fill up.
+# Dumb script to purge that stuff:
+for f in "$@"
+do
+        if rpm -qf "/lib/modules/$f" >/dev/null; then
+                echo "keeping $f (installed from rpm)"
+        elif [ $(uname -r) = "$f" ]; then
+                echo "keeping $f (running kernel) "
+        else
+                echo "removing $f"
+                rm -f "/boot/initramfs-$f.img" "/boot/System.map-$f"
+                rm -f "/boot/vmlinuz-$f"   "/boot/config-$f"
+                rm -rf "/lib/modules/$f"
+                new-kernel-pkg --remove $f
+        fi
+done
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index f7160253f17f..e6ea9d4b1de9 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -23,6 +23,7 @@
 #include <linux/integrity.h>
 #include <linux/evm.h>
 #include <crypto/hash.h>
+#include <crypto/algapi.h>
 #include "evm.h"
 int evm_initialized;
@@ -148,7 +149,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
                                   xattr_value_len, calc.digest);
                if (rc)
                        break;
-                rc = memcmp(xattr_data->digest, calc.digest,
+                rc = crypto_memneq(xattr_data->digest, calc.digest,
                            sizeof(calc.digest));
                if (rc)
                        rc = -EINVAL;
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 2bbb41822d8e..8495b9368190 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -83,6 +83,7 @@ static struct nlmsg_perm nlmsg_tcpdiag_perms[] =
        { TCPDIAG_GETSOCK,      NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
        { DCCPDIAG_GETSOCK,     NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
        { SOCK_DIAG_BY_FAMILY,  NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
+        { SOCK_DESTROY,         NETLINK_TCPDIAG_SOCKET__NLMSG_WRITE },
 };
 static struct nlmsg_perm nlmsg_xfrm_perms[] =
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 9b513a05765a..dca817fc7894 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -422,7 +422,7 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
        spin_lock_irqsave(&timer->lock, flags);
        list_for_each_entry(ts, &ti->slave_active_head, active_list)
                if (ts->ccallback)
-                        ts->ccallback(ti, event + 100, &tstamp, resolution);
+                        ts->ccallback(ts, event + 100, &tstamp, resolution);
        spin_unlock_irqrestore(&timer->lock, flags);
 }
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
                        spin_unlock_irqrestore(&slave_active_lock, flags);
                        return -EBUSY;
                }
+                if (timeri->timer)
+                        spin_lock(&timeri->timer->lock);
                timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
                list_del_init(&timeri->ack_list);
                list_del_init(&timeri->active_list);
+                if (timeri->timer)
+                        spin_unlock(&timeri->timer->lock);
                spin_unlock_irqrestore(&slave_active_lock, flags);
                goto __end;
        }
@@ -1929,6 +1933,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 {
        struct snd_timer_user *tu;
        long result = 0, unit;
+        int qhead;
        int err = 0;
        tu = file->private_data;
@@ -1940,7 +1945,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                        if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
                                err = -EAGAIN;
-                                break;
+                                goto _error;
                        }
                        set_current_state(TASK_INTERRUPTIBLE);
@@ -1955,42 +1960,37 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                        if (tu->disconnected) {
                                err = -ENODEV;
-                                break;
+                                goto _error;
                        }
                        if (signal_pending(current)) {
                                err = -ERESTARTSYS;
-                                break;
+                                goto _error;
                        }
                }
+                qhead = tu->qhead++;
+                tu->qhead %= tu->queue_size;
                spin_unlock_irq(&tu->qlock);
-                if (err < 0)
-                        goto _error;
                if (tu->tread) {
-                        if (copy_to_user(buffer, &tu->tqueue[tu->qhead++],
+                        if (copy_to_user(buffer, &tu->tqueue[qhead],
-                                         sizeof(struct snd_timer_tread))) {
+                                         sizeof(struct snd_timer_tread)))
                                err = -EFAULT;
-                                goto _error;
-                        }
                } else {
-                        if (copy_to_user(buffer, &tu->queue[tu->qhead++],
+                        if (copy_to_user(buffer, &tu->queue[qhead],
-                                         sizeof(struct snd_timer_read))) {
+                                         sizeof(struct snd_timer_read)))
                                err = -EFAULT;
-                                goto _error;
-                        }
                }
-                tu->qhead %= tu->queue_size;
-                result += unit;
-                buffer += unit;
                spin_lock_irq(&tu->qlock);
                tu->qused--;
+                if (err < 0)
+                        goto _error;
+                result += unit;
+                buffer += unit;
        }
-        spin_unlock_irq(&tu->qlock);
 _error:
+        spin_unlock_irq(&tu->qlock);
        return result > 0 ? result : err;
 }
diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
index bde33308f0d6..c0f8f613f1f1 100644
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM substreams # (1-128) for dummy driver.");
 module_param(fake_buffer, bool, 0444);
 MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
 #ifdef CONFIG_HIGH_RES_TIMERS
-module_param(hrtimer, bool, 0444);
+module_param(hrtimer, bool, 0644);
 MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
 #endif
@@ -109,6 +109,9 @@ struct dummy_timer_ops {
        snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *);
 };
+#define get_dummy_ops(substream) \
+        (*(const struct dummy_timer_ops **)(substream)->runtime->private_data)
 struct dummy_model {
        const char *name;
        int (*playback_constraints)(struct snd_pcm_runtime *runtime);
@@ -137,7 +140,6 @@ struct snd_dummy {
        int iobox;
        struct snd_kcontrol *cd_volume_ctl;
        struct snd_kcontrol *cd_switch_ctl;
-        const struct dummy_timer_ops *timer_ops;
 };
 /*
@@ -231,6 +233,8 @@ static struct dummy_model *dummy_models[] = {
 */
 struct dummy_systimer_pcm {
+        /* ops must be the first item */
+        const struct dummy_timer_ops *timer_ops;
        spinlock_t lock;
        struct timer_list timer;
        unsigned long base_time;
@@ -366,6 +370,8 @@ static const struct dummy_timer_ops dummy_systimer_ops = {
 */
 struct dummy_hrtimer_pcm {
+        /* ops must be the first item */
+        const struct dummy_timer_ops *timer_ops;
        ktime_t base_time;
        ktime_t period_time;
        atomic_t running;
@@ -492,31 +498,25 @@ static const struct dummy_timer_ops dummy_hrtimer_ops = {
 static int dummy_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
-        struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
        switch (cmd) {
        case SNDRV_PCM_TRIGGER_START:
        case SNDRV_PCM_TRIGGER_RESUME:
-                return dummy->timer_ops->start(substream);
+                return get_dummy_ops(substream)->start(substream);
        case SNDRV_PCM_TRIGGER_STOP:
        case SNDRV_PCM_TRIGGER_SUSPEND:
-                return dummy->timer_ops->stop(substream);
+                return get_dummy_ops(substream)->stop(substream);
        }
        return -EINVAL;
 }
 static int dummy_pcm_prepare(struct snd_pcm_substream *substream)
 {
-        struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+        return get_dummy_ops(substream)->prepare(substream);
-        return dummy->timer_ops->prepare(substream);
 }
 static snd_pcm_uframes_t dummy_pcm_pointer(struct snd_pcm_substream *substream)
 {
-        struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+        return get_dummy_ops(substream)->pointer(substream);
-        return dummy->timer_ops->pointer(substream);
 }
 static struct snd_pcm_hardware dummy_pcm_hardware = {
@@ -562,17 +562,19 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
        struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
        struct dummy_model *model = dummy->model;
        struct snd_pcm_runtime *runtime = substream->runtime;
+        const struct dummy_timer_ops *ops;
        int err;
-        dummy->timer_ops = &dummy_systimer_ops;
+        ops = &dummy_systimer_ops;
 #ifdef CONFIG_HIGH_RES_TIMERS
        if (hrtimer)
-                dummy->timer_ops = &dummy_hrtimer_ops;
+                ops = &dummy_hrtimer_ops;
 #endif
-        err = dummy->timer_ops->create(substream);
+        err = ops->create(substream);
        if (err < 0)
                return err;
+        get_dummy_ops(substream) = ops;
        runtime->hw = dummy->pcm_hw;
        if (substream->pcm->device & 1) {
@@ -594,7 +596,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
                        err = model->capture_constraints(substream->runtime);
        }
        if (err < 0) {
-                dummy->timer_ops->free(substream);
+                get_dummy_ops(substream)->free(substream);
                return err;
        }
        return 0;
@@ -602,8 +604,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
 static int dummy_pcm_close(struct snd_pcm_substream *substream)
 {
-        struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
+        get_dummy_ops(substream)->free(substream);
-        dummy->timer_ops->free(substream);
        return 0;
 }
diff --git a/sound/firewire/digi00x/amdtp-dot.c b/sound/firewire/digi00x/amdtp-dot.c
index b02a5e8cad44..0ac92aba5bc1 100644
--- a/sound/firewire/digi00x/amdtp-dot.c
+++ b/sound/firewire/digi00x/amdtp-dot.c
@@ -63,7 +63,7 @@ struct amdtp_dot {
 #define BYTE_PER_SAMPLE (4)
 #define MAGIC_DOT_BYTE (2)
 #define MAGIC_BYTE_OFF(x) (((x) * BYTE_PER_SAMPLE) + MAGIC_DOT_BYTE)
-static const u8 dot_scrt(const u8 idx, const unsigned int off)
+static u8 dot_scrt(const u8 idx, const unsigned int off)
 {
        /*
         * the length of the added pattern only depends on the lower nibble
diff --git a/sound/firewire/tascam/tascam-transaction.c b/sound/firewire/tascam/tascam-transaction.c
index 904ce0329fa1..040a96d1ba8e 100644
--- a/sound/firewire/tascam/tascam-transaction.c
+++ b/sound/firewire/tascam/tascam-transaction.c
@@ -230,6 +230,7 @@ int snd_tscm_transaction_register(struct snd_tscm *tscm)
        return err;
 error:
        fw_core_remove_address_handler(&tscm->async_handler);
+        tscm->async_handler.callback_data = NULL;
        return err;
 }
@@ -276,6 +277,9 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm)
        __be32 reg;
        unsigned int i;
+        if (tscm->async_handler.callback_data == NULL)
+                return;
        /* Turn off FireWire LED. */
        reg = cpu_to_be32(0x0000008e);
        snd_fw_transaction(tscm->unit, TCODE_WRITE_QUADLET_REQUEST,
@@ -297,6 +301,8 @@ void snd_tscm_transaction_unregister(struct snd_tscm *tscm)
                           &reg, sizeof(reg), 0);
        fw_core_remove_address_handler(&tscm->async_handler);
+        tscm->async_handler.callback_data = NULL;
        for (i = 0; i < TSCM_MIDI_OUT_PORT_MAX; i++)
                snd_fw_async_midi_port_destroy(&tscm->out_ports[i]);
 }
diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
index ee0bc1839508..e281c338e562 100644
--- a/sound/firewire/tascam/tascam.c
+++ b/sound/firewire/tascam/tascam.c
@@ -21,7 +21,6 @@ static struct snd_tscm_spec model_specs[] = {
                .pcm_playback_analog_channels = 8,
                .midi_capture_ports = 4,
                .midi_playback_ports = 4,
-                .is_controller = true,
        },
        {
                .name = "FW-1082",
@@ -31,9 +30,16 @@ static struct snd_tscm_spec model_specs[] = {
                .pcm_playback_analog_channels = 2,
                .midi_capture_ports = 2,
                .midi_playback_ports = 2,
-                .is_controller = true,
        },
-        /* FW-1804 may be supported. */
+        {
+                .name = "FW-1804",
+                .has_adat = true,
+                .has_spdif = true,
+                .pcm_capture_analog_channels = 8,
+                .pcm_playback_analog_channels = 2,
+                .midi_capture_ports = 2,
+                .midi_playback_ports = 4,
+        },
 };
 static int identify_model(struct snd_tscm *tscm)
diff --git a/sound/firewire/tascam/tascam.h b/sound/firewire/tascam/tascam.h
index 2d028d2bd3bd..30ab77e924f7 100644
--- a/sound/firewire/tascam/tascam.h
+++ b/sound/firewire/tascam/tascam.h
@@ -39,7 +39,6 @@ struct snd_tscm_spec {
        unsigned int pcm_playback_analog_channels;
        unsigned int midi_capture_ports;
        unsigned int midi_playback_ports;
-        bool is_controller;
 };
 #define TSCM_MIDI_IN_PORT_MAX   4
@@ -72,9 +71,6 @@ struct snd_tscm {
        struct snd_fw_async_midi_port out_ports[TSCM_MIDI_OUT_PORT_MAX];
        u8 running_status[TSCM_MIDI_OUT_PORT_MAX];
        bool on_sysex[TSCM_MIDI_OUT_PORT_MAX];
-        /* For control messages. */
-        struct snd_firewire_tascam_status *status;
 };
 #define TSCM_ADDR_BASE                  0xffff00000000ull
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 30c8efe0f80a..7ca5b89f088a 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4028,9 +4028,9 @@ static void pin_power_callback(struct hda_codec *codec,
                               struct hda_jack_callback *jack,
                               bool on)
 {
-        if (jack && jack->tbl->nid)
+        if (jack && jack->nid)
                sync_power_state_change(codec,
-                                        set_pin_power_jack(codec, jack->tbl->nid, on));
+                                        set_pin_power_jack(codec, jack->nid, on));
 }
 /* callback only doing power up -- called at first */
diff --git a/sound/pci/hda/hda_jack.c b/sound/pci/hda/hda_jack.c
index c945e257d368..a33234e04d4f 100644
--- a/sound/pci/hda/hda_jack.c
+++ b/sound/pci/hda/hda_jack.c
@@ -259,7 +259,7 @@ snd_hda_jack_detect_enable_callback(struct hda_codec *codec, hda_nid_t nid,
                if (!callback)
                        return ERR_PTR(-ENOMEM);
                callback->func = func;
-                callback->tbl = jack;
+                callback->nid = jack->nid;
                callback->next = jack->callback;
                jack->callback = callback;
        }
diff --git a/sound/pci/hda/hda_jack.h b/sound/pci/hda/hda_jack.h
index 858708a044f5..e9814c0168ea 100644
--- a/sound/pci/hda/hda_jack.h
+++ b/sound/pci/hda/hda_jack.h
@@ -21,7 +21,7 @@ struct hda_jack_callback;
 typedef void (*hda_jack_callback_fn) (struct hda_codec *, struct hda_jack_callback *);
 struct hda_jack_callback {
-        struct hda_jack_tbl *tbl;
+        hda_nid_t nid;
        hda_jack_callback_fn func;
        unsigned int private_data;      /* arbitrary data */
        struct hda_jack_callback *next;
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 4ef2259f88ca..9ceb2bc36e68 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -4427,13 +4427,16 @@ static void ca0132_process_dsp_response(struct hda_codec *codec,
 static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
 {
        struct ca0132_spec *spec = codec->spec;
+        struct hda_jack_tbl *tbl;
        /* Delay enabling the HP amp, to let the mic-detection
         * state machine run.
         */
        cancel_delayed_work_sync(&spec->unsol_hp_work);
        schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
-        cb->tbl->block_report = 1;
+        tbl = snd_hda_jack_tbl_get(codec, cb->nid);
+        if (tbl)
+                tbl->block_report = 1;
 }
 static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 1f52b55d77c9..8ee78dbd4c60 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -448,7 +448,8 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
        eld = &per_pin->sink_eld;
        mutex_lock(&per_pin->lock);
-        if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) {
+        if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) ||
+            eld->eld_size > ELD_MAX_SIZE) {
                mutex_unlock(&per_pin->lock);
                snd_BUG();
                return -EINVAL;
@@ -1193,7 +1194,7 @@ static void check_presence_and_report(struct hda_codec *codec, hda_nid_t nid)
 static void jack_callback(struct hda_codec *codec,
                          struct hda_jack_callback *jack)
 {
-        check_presence_and_report(codec, jack->tbl->nid);
+        check_presence_and_report(codec, jack->nid);
 }
 static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 21992fb7035d..efd4980cffb8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -282,7 +282,7 @@ static void alc_update_knob_master(struct hda_codec *codec,
        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
        if (!uctl)
                return;
-        val = snd_hda_codec_read(codec, jack->tbl->nid, 0,
+        val = snd_hda_codec_read(codec, jack->nid, 0,
                                 AC_VERB_GET_VOLUME_KNOB_CONTROL, 0);
        val &= HDA_AMP_VOLMASK;
        uctl->value.integer.value[0] = val;
@@ -1787,7 +1787,6 @@ enum {
        ALC882_FIXUP_NO_PRIMARY_HP,
        ALC887_FIXUP_ASUS_BASS,
        ALC887_FIXUP_BASS_CHMAP,
-        ALC882_FIXUP_DISABLE_AAMIX,
 };
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1949,8 +1948,6 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
 static void alc_fixup_bass_chmap(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action);
-static void alc_fixup_disable_aamix(struct hda_codec *codec,
-                                    const struct hda_fixup *fix, int action);
 static const struct hda_fixup alc882_fixups[] = {
        [ALC882_FIXUP_ABIT_AW9D_MAX] = {
@@ -2188,10 +2185,6 @@ static const struct hda_fixup alc882_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_bass_chmap,
        },
-        [ALC882_FIXUP_DISABLE_AAMIX] = {
-                .type = HDA_FIXUP_FUNC,
-                .v.func = alc_fixup_disable_aamix,
-        },
 };
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2230,6 +2223,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
        SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
        SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
        SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+        SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
        /* All Apple entries are in codec SSIDs */
        SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
@@ -2259,7 +2253,6 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
        SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1458, 0xa182, "Gigabyte Z170X-UD3", ALC882_FIXUP_DISABLE_AAMIX),
        SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
        SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
        SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 2c7c5eb8b1e9..37b70f8e878f 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -493,9 +493,9 @@ static void jack_update_power(struct hda_codec *codec,
        if (!spec->num_pwrs)
                return;
-        if (jack && jack->tbl->nid) {
+        if (jack && jack->nid) {
-                stac_toggle_power_map(codec, jack->tbl->nid,
+                stac_toggle_power_map(codec, jack->nid,
-                                      snd_hda_jack_detect(codec, jack->tbl->nid),
+                                      snd_hda_jack_detect(codec, jack->nid),
                                      true);
                return;
        }
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index 3191e0a7d273..d1fb035f44db 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -635,6 +635,7 @@ static int acp_dma_open(struct snd_pcm_substream *substream)
                                            SNDRV_PCM_HW_PARAM_PERIODS);
        if (ret < 0) {
                dev_err(prtd->platform->dev, "set integer constraint failed\n");
+                kfree(adata);
                return ret;
        }
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index 33143fe1de0b..91785318b283 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -1929,6 +1929,25 @@ static struct {
        { 1000000, 13500000, 0,  1 },
 };
+static const unsigned int pseudo_fref_max[ARIZONA_FLL_MAX_FRATIO] = {
+        13500000,
+         6144000,
+         6144000,
+         3072000,
+         3072000,
+         2822400,
+         2822400,
+         1536000,
+         1536000,
+         1536000,
+         1536000,
+         1536000,
+         1536000,
+         1536000,
+         1536000,
+          768000,
+};
 static struct {
        unsigned int min;
        unsigned int max;
@@ -2042,16 +2061,32 @@ static int arizona_calc_fratio(struct arizona_fll *fll,
        /* Adjust FRATIO/refdiv to avoid integer mode if possible */
        refdiv = cfg->refdiv;
+        arizona_fll_dbg(fll, "pseudo: initial ratio=%u fref=%u refdiv=%u\n",
+                        init_ratio, Fref, refdiv);
        while (div <= ARIZONA_FLL_MAX_REFDIV) {
                for (ratio = init_ratio; ratio <= ARIZONA_FLL_MAX_FRATIO;
                     ratio++) {
                        if ((ARIZONA_FLL_VCO_CORNER / 2) /
-                            (fll->vco_mult * ratio) < Fref)
+                            (fll->vco_mult * ratio) < Fref) {
+                                arizona_fll_dbg(fll, "pseudo: hit VCO corner\n");
                                break;
+                        }
+                        if (Fref > pseudo_fref_max[ratio - 1]) {
+                                arizona_fll_dbg(fll,
+                                        "pseudo: exceeded max fref(%u) for ratio=%u\n",
+                                        pseudo_fref_max[ratio - 1],
+                                        ratio);
+                                break;
+                        }
                        if (target % (ratio * Fref)) {
                                cfg->refdiv = refdiv;
                                cfg->fratio = ratio - 1;
+                                arizona_fll_dbg(fll,
+                                        "pseudo: found fref=%u refdiv=%d(%d) ratio=%d\n",
+                                        Fref, refdiv, div, ratio);
                                return ratio;
                        }
                }
@@ -2060,6 +2095,9 @@ static int arizona_calc_fratio(struct arizona_fll *fll,
                        if (target % (ratio * Fref)) {
                                cfg->refdiv = refdiv;
                                cfg->fratio = ratio - 1;
+                                arizona_fll_dbg(fll,
+                                        "pseudo: found fref=%u refdiv=%d(%d) ratio=%d\n",
+                                        Fref, refdiv, div, ratio);
                                return ratio;
                        }
                }
@@ -2068,6 +2106,9 @@ static int arizona_calc_fratio(struct arizona_fll *fll,
                Fref /= 2;
                refdiv++;
                init_ratio = arizona_find_fratio(Fref, NULL);
+                arizona_fll_dbg(fll,
+                                "pseudo: change fref=%u refdiv=%d(%d) ratio=%u\n",
+                                Fref, refdiv, div, init_ratio);
        }
        arizona_fll_warn(fll, "Falling back to integer mode operation\n");
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index bc08f0c5a5f6..1bd31644a782 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -266,6 +266,8 @@ static int rt286_jack_detect(struct rt286_priv *rt286, bool *hp, bool *mic)
                } else {
                        *mic = false;
                        regmap_write(rt286->regmap, RT286_SET_MIC1, 0x20);
+                        regmap_update_bits(rt286->regmap,
+                                RT286_CBJ_CTRL1, 0x0400, 0x0000);
                }
        } else {
                regmap_read(rt286->regmap, RT286_GET_HP_SENSE, &buf);
@@ -470,24 +472,6 @@ static int rt286_set_dmic1_event(struct snd_soc_dapm_widget *w,
        return 0;
 }
-static int rt286_vref_event(struct snd_soc_dapm_widget *w,
-                             struct snd_kcontrol *kcontrol, int event)
-{
-        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
-        switch (event) {
-        case SND_SOC_DAPM_PRE_PMU:
-                snd_soc_update_bits(codec,
-                        RT286_CBJ_CTRL1, 0x0400, 0x0000);
-                mdelay(50);
-                break;
-        default:
-                return 0;
-        }
-        return 0;
-}
 static int rt286_ldo2_event(struct snd_soc_dapm_widget *w,
                             struct snd_kcontrol *kcontrol, int event)
 {
@@ -536,7 +520,7 @@ static const struct snd_soc_dapm_widget rt286_dapm_widgets[] = {
        SND_SOC_DAPM_SUPPLY_S("HV", 1, RT286_POWER_CTRL1,
                12, 1, NULL, 0),
        SND_SOC_DAPM_SUPPLY("VREF", RT286_POWER_CTRL1,
-                0, 1, rt286_vref_event, SND_SOC_DAPM_PRE_PMU),
+                0, 1, NULL, 0),
        SND_SOC_DAPM_SUPPLY_S("LDO1", 1, RT286_POWER_CTRL2,
                2, 0, NULL, 0),
        SND_SOC_DAPM_SUPPLY_S("LDO2", 2, RT286_POWER_CTRL1,
@@ -911,8 +895,6 @@ static int rt286_set_bias_level(struct snd_soc_codec *codec,
        case SND_SOC_BIAS_ON:
                mdelay(10);
                snd_soc_update_bits(codec,
-                        RT286_CBJ_CTRL1, 0x0400, 0x0400);
-                snd_soc_update_bits(codec,
                        RT286_DC_GAIN, 0x200, 0x0);
                break;
@@ -920,8 +902,6 @@ static int rt286_set_bias_level(struct snd_soc_codec *codec,
        case SND_SOC_BIAS_STANDBY:
                snd_soc_write(codec,
                        RT286_SET_AUDIO_POWER, AC_PWRST_D3);
-                snd_soc_update_bits(codec,
-                        RT286_CBJ_CTRL1, 0x0400, 0x0000);
                break;
        default:
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index c61d38b585fb..93e8c9017633 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -776,7 +776,7 @@ static const struct snd_kcontrol_new rt5645_snd_controls[] = {
        /* IN1/IN2 Control */
        SOC_SINGLE_TLV("IN1 Boost", RT5645_IN1_CTRL1,
-                RT5645_BST_SFT1, 8, 0, bst_tlv),
+                RT5645_BST_SFT1, 12, 0, bst_tlv),
        SOC_SINGLE_TLV("IN2 Boost", RT5645_IN2_CTRL,
                RT5645_BST_SFT2, 8, 0, bst_tlv),
diff --git a/sound/soc/codecs/rt5659.c b/sound/soc/codecs/rt5659.c
index 820d8fa62b5e..fb8ea05c0de1 100644
--- a/sound/soc/codecs/rt5659.c
+++ b/sound/soc/codecs/rt5659.c
@@ -3985,7 +3985,6 @@ static int rt5659_i2c_probe(struct i2c_client *i2c,
        if (rt5659 == NULL)
                return -ENOMEM;
-        rt5659->i2c = i2c;
        i2c_set_clientdata(i2c, rt5659);
        if (pdata)
@@ -4157,24 +4156,17 @@ static int rt5659_i2c_probe(struct i2c_client *i2c,
        INIT_DELAYED_WORK(&rt5659->jack_detect_work, rt5659_jack_detect_work);
-        if (rt5659->i2c->irq) {
+        if (i2c->irq) {
-                ret = request_threaded_irq(rt5659->i2c->irq, NULL, rt5659_irq,
+                ret = devm_request_threaded_irq(&i2c->dev, i2c->irq, NULL,
-                        IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
+                        rt5659_irq, IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
                        | IRQF_ONESHOT, "rt5659", rt5659);
                if (ret)
                        dev_err(&i2c->dev, "Failed to reguest IRQ: %d\n", ret);
        }
-        ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5659,
+        return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5659,
                        rt5659_dai, ARRAY_SIZE(rt5659_dai));
-        if (ret) {
-                if (rt5659->i2c->irq)
-                        free_irq(rt5659->i2c->irq, rt5659);
-        }
-        return 0;
 }
 static int rt5659_i2c_remove(struct i2c_client *i2c)
@@ -4191,24 +4183,29 @@ void rt5659_i2c_shutdown(struct i2c_client *client)
        regmap_write(rt5659->regmap, RT5659_RESET, 0);
 }
+#ifdef CONFIG_OF
 static const struct of_device_id rt5659_of_match[] = {
        { .compatible = "realtek,rt5658", },
        { .compatible = "realtek,rt5659", },
-        {},
+        { },
 };
+MODULE_DEVICE_TABLE(of, rt5659_of_match);
+#endif
+#ifdef CONFIG_ACPI
 static struct acpi_device_id rt5659_acpi_match[] = {
-                { "10EC5658", 0},
+        { "10EC5658", 0, },
-                { "10EC5659", 0},
+        { "10EC5659", 0, },
-                { },
+        { },
 };
 MODULE_DEVICE_TABLE(acpi, rt5659_acpi_match);
+#endif
 struct i2c_driver rt5659_i2c_driver = {
        .driver = {
                .name = "rt5659",
                .owner = THIS_MODULE,
-                .of_match_table = rt5659_of_match,
+                .of_match_table = of_match_ptr(rt5659_of_match),
                .acpi_match_table = ACPI_PTR(rt5659_acpi_match),
        },
        .probe = rt5659_i2c_probe,
diff --git a/sound/soc/codecs/rt5659.h b/sound/soc/codecs/rt5659.h
index 8f07ee903eaa..d31c9e5bcec8 100644
--- a/sound/soc/codecs/rt5659.h
+++ b/sound/soc/codecs/rt5659.h
@@ -1792,7 +1792,6 @@ struct rt5659_priv {
        struct snd_soc_codec *codec;
        struct rt5659_platform_data pdata;
        struct regmap *regmap;
-        struct i2c_client *i2c;
        struct gpio_desc *gpiod_ldo1_en;
        struct gpio_desc *gpiod_reset;
        struct snd_soc_jack *hs_jack;
diff --git a/sound/soc/codecs/sigmadsp-i2c.c b/sound/soc/codecs/sigmadsp-i2c.c
index 21ca3a5e9f66..d374c18d4db7 100644
--- a/sound/soc/codecs/sigmadsp-i2c.c
+++ b/sound/soc/codecs/sigmadsp-i2c.c
@@ -31,7 +31,10 @@ static int sigmadsp_write_i2c(void *control_data,
        kfree(buf);
-        return ret;
+        if (ret < 0)
+                return ret;
+        return 0;
 }
 static int sigmadsp_read_i2c(void *control_data,
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index 6088d30962a9..97c0f1e23886 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -2382,6 +2382,7 @@ error:
 static int wm5110_remove(struct platform_device *pdev)
 {
+        snd_soc_unregister_platform(&pdev->dev);
        snd_soc_unregister_codec(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index ff237726775a..d7f444f87460 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -240,13 +240,13 @@ SOC_DOUBLE_R("Capture Volume ZC Switch", WM8960_LINVOL, WM8960_RINVOL,
 SOC_DOUBLE_R("Capture Switch", WM8960_LINVOL, WM8960_RINVOL,
        7, 1, 1),
-SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT3 Volume",
+SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT3 Volume",
               WM8960_INBMIX1, 4, 7, 0, lineinboost_tlv),
-SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT2 Volume",
+SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT2 Volume",
               WM8960_INBMIX1, 1, 7, 0, lineinboost_tlv),
-SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT3 Volume",
+SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT3 Volume",
               WM8960_INBMIX2, 4, 7, 0, lineinboost_tlv),
-SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT2 Volume",
+SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT2 Volume",
               WM8960_INBMIX2, 1, 7, 0, lineinboost_tlv),
 SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT1 Volume",
                WM8960_RINPATH, 4, 3, 0, micboost_tlv),
@@ -643,29 +643,31 @@ static int wm8960_configure_clocking(struct snd_soc_codec *codec)
                return -EINVAL;
        }
-        /* check if the sysclk frequency is available. */
+        if (wm8960->clk_id != WM8960_SYSCLK_PLL) {
-        for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
+                /* check if the sysclk frequency is available. */
-                if (sysclk_divs[i] == -1)
+                for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
-                        continue;
+                        if (sysclk_divs[i] == -1)
-                sysclk = freq_out / sysclk_divs[i];
+                                continue;
-                for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+                        sysclk = freq_out / sysclk_divs[i];
-                        if (sysclk == dac_divs[j] * lrclk) {
+                        for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+                                if (sysclk != dac_divs[j] * lrclk)
+                                        continue;
                                for (k = 0; k < ARRAY_SIZE(bclk_divs); ++k)
                                        if (sysclk == bclk * bclk_divs[k] / 10)
                                                break;
                                if (k != ARRAY_SIZE(bclk_divs))
                                        break;
                        }
+                        if (j != ARRAY_SIZE(dac_divs))
+                                break;
                }
-                if (j != ARRAY_SIZE(dac_divs))
-                        break;
-        }
-        if (i != ARRAY_SIZE(sysclk_divs)) {
+                if (i != ARRAY_SIZE(sysclk_divs)) {
-                goto configure_clock;
+                        goto configure_clock;
-        } else if (wm8960->clk_id != WM8960_SYSCLK_AUTO) {
+                } else if (wm8960->clk_id != WM8960_SYSCLK_AUTO) {
-                dev_err(codec->dev, "failed to configure clock\n");
+                        dev_err(codec->dev, "failed to configure clock\n");
-                return -EINVAL;
+                        return -EINVAL;
+                }
        }
        /* get a available pll out frequency and set pll */
        for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
index ce664c239be3..bff258d7bcea 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -645,6 +645,8 @@ static int dw_i2s_probe(struct platform_device *pdev)
        dev->dev = &pdev->dev;
+        dev->i2s_reg_comp1 = I2S_COMP_PARAM_1;
+        dev->i2s_reg_comp2 = I2S_COMP_PARAM_2;
        if (pdata) {
                dev->capability = pdata->cap;
                clk_id = NULL;
@@ -652,9 +654,6 @@ static int dw_i2s_probe(struct platform_device *pdev)
                if (dev->quirks & DW_I2S_QUIRK_COMP_REG_OFFSET) {
                        dev->i2s_reg_comp1 = pdata->i2s_reg_comp1;
                        dev->i2s_reg_comp2 = pdata->i2s_reg_comp2;
-                } else {
-                        dev->i2s_reg_comp1 = I2S_COMP_PARAM_1;
-                        dev->i2s_reg_comp2 = I2S_COMP_PARAM_2;
                }
                ret = dw_configure_dai_by_pd(dev, dw_i2s_dai, res, pdata);
        } else {
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 40dfd8a36484..ed8de1035cda 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -112,20 +112,6 @@ struct fsl_ssi_rxtx_reg_val {
        struct fsl_ssi_reg_val tx;
 };
-static const struct reg_default fsl_ssi_reg_defaults[] = {
-        {CCSR_SSI_SCR,     0x00000000},
-        {CCSR_SSI_SIER,    0x00003003},
-        {CCSR_SSI_STCR,    0x00000200},
-        {CCSR_SSI_SRCR,    0x00000200},
-        {CCSR_SSI_STCCR,   0x00040000},
-        {CCSR_SSI_SRCCR,   0x00040000},
-        {CCSR_SSI_SACNT,   0x00000000},
-        {CCSR_SSI_STMSK,   0x00000000},
-        {CCSR_SSI_SRMSK,   0x00000000},
-        {CCSR_SSI_SACCEN,  0x00000000},
-        {CCSR_SSI_SACCDIS, 0x00000000},
-};
 static bool fsl_ssi_readable_reg(struct device *dev, unsigned int reg)
 {
        switch (reg) {
@@ -190,8 +176,7 @@ static const struct regmap_config fsl_ssi_regconfig = {
        .val_bits = 32,
        .reg_stride = 4,
        .val_format_endian = REGMAP_ENDIAN_NATIVE,
-        .reg_defaults = fsl_ssi_reg_defaults,
+        .num_reg_defaults_raw = CCSR_SSI_SACCDIS / sizeof(uint32_t) + 1,
-        .num_reg_defaults = ARRAY_SIZE(fsl_ssi_reg_defaults),
        .readable_reg = fsl_ssi_readable_reg,
        .volatile_reg = fsl_ssi_volatile_reg,
        .precious_reg = fsl_ssi_precious_reg,
@@ -201,6 +186,7 @@ static const struct regmap_config fsl_ssi_regconfig = {
 struct fsl_ssi_soc_data {
        bool imx;
+        bool imx21regs; /* imx21-class SSI - no SACC{ST,EN,DIS} regs */
        bool offline_config;
        u32 sisr_write_mask;
 };
@@ -303,6 +289,7 @@ static struct fsl_ssi_soc_data fsl_ssi_mpc8610 = {
 static struct fsl_ssi_soc_data fsl_ssi_imx21 = {
        .imx = true,
+        .imx21regs = true,
        .offline_config = true,
        .sisr_write_mask = 0,
 };
@@ -586,8 +573,12 @@ static void fsl_ssi_setup_ac97(struct fsl_ssi_private *ssi_private)
         */
        regmap_write(regs, CCSR_SSI_SACNT,
                        CCSR_SSI_SACNT_AC97EN | CCSR_SSI_SACNT_FV);
-        regmap_write(regs, CCSR_SSI_SACCDIS, 0xff);
-        regmap_write(regs, CCSR_SSI_SACCEN, 0x300);
+        /* no SACC{ST,EN,DIS} regs on imx21-class SSI */
+        if (!ssi_private->soc->imx21regs) {
+                regmap_write(regs, CCSR_SSI_SACCDIS, 0xff);
+                regmap_write(regs, CCSR_SSI_SACCEN, 0x300);
+        }
        /*
         * Enable SSI, Transmit and Receive. AC97 has to communicate with the
@@ -1397,6 +1388,7 @@ static int fsl_ssi_probe(struct platform_device *pdev)
        struct resource *res;
        void __iomem *iomem;
        char name[64];
+        struct regmap_config regconfig = fsl_ssi_regconfig;
        of_id = of_match_device(fsl_ssi_ids, &pdev->dev);
        if (!of_id || !of_id->data)
@@ -1444,15 +1436,25 @@ static int fsl_ssi_probe(struct platform_device *pdev)
                return PTR_ERR(iomem);
        ssi_private->ssi_phys = res->start;
+        if (ssi_private->soc->imx21regs) {
+                /*
+                 * According to datasheet imx21-class SSI
+                 * don't have SACC{ST,EN,DIS} regs.
+                 */
+                regconfig.max_register = CCSR_SSI_SRMSK;
+                regconfig.num_reg_defaults_raw =
+                        CCSR_SSI_SRMSK / sizeof(uint32_t) + 1;
+        }
        ret = of_property_match_string(np, "clock-names", "ipg");
        if (ret < 0) {
                ssi_private->has_ipg_clk_name = false;
                ssi_private->regs = devm_regmap_init_mmio(&pdev->dev, iomem,
-                        &fsl_ssi_regconfig);
+                        &regconfig);
        } else {
                ssi_private->has_ipg_clk_name = true;
                ssi_private->regs = devm_regmap_init_mmio_clk(&pdev->dev,
-                        "ipg", iomem, &fsl_ssi_regconfig);
+                        "ipg", iomem, &regconfig);
        }
        if (IS_ERR(ssi_private->regs)) {
                dev_err(&pdev->dev, "Failed to init register map\n");
diff --git a/sound/soc/fsl/imx-spdif.c b/sound/soc/fsl/imx-spdif.c
index a407e833c612..fb896b2c9ba3 100644
--- a/sound/soc/fsl/imx-spdif.c
+++ b/sound/soc/fsl/imx-spdif.c
@@ -72,8 +72,6 @@ static int imx_spdif_audio_probe(struct platform_device *pdev)
                goto end;
        }
-        platform_set_drvdata(pdev, data);
 end:
        of_node_put(spdif_np);
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 1ded8811598e..2389ab47e25f 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -99,7 +99,7 @@ static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream,
                if (ret && ret != -ENOTSUPP)
                        goto err;
        }
+        return 0;
 err:
        return ret;
 }
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 803f95e40679..7d7c872c280d 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -30,11 +30,15 @@ config SND_SST_IPC_ACPI
 config SND_SOC_INTEL_SST
        tristate
        select SND_SOC_INTEL_SST_ACPI if ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        depends on (X86 || COMPILE_TEST)
 config SND_SOC_INTEL_SST_ACPI
        tristate
+config SND_SOC_INTEL_SST_MATCH
+        tristate
 config SND_SOC_INTEL_HASWELL
        tristate
@@ -57,7 +61,7 @@ config SND_SOC_INTEL_HASWELL_MACH
 config SND_SOC_INTEL_BYT_RT5640_MACH
        tristate "ASoC Audio driver for Intel Baytrail with RT5640 codec"
        depends on X86_INTEL_LPSS && I2C
-        depends on DW_DMAC_CORE=y && (SND_SOC_INTEL_BYTCR_RT5640_MACH = n)
+        depends on DW_DMAC_CORE=y && (SND_SST_IPC_ACPI = n)
        select SND_SOC_INTEL_SST
        select SND_SOC_INTEL_BAYTRAIL
        select SND_SOC_RT5640
@@ -69,7 +73,7 @@ config SND_SOC_INTEL_BYT_RT5640_MACH
 config SND_SOC_INTEL_BYT_MAX98090_MACH
        tristate "ASoC Audio driver for Intel Baytrail with MAX98090 codec"
        depends on X86_INTEL_LPSS && I2C
-        depends on DW_DMAC_CORE=y
+        depends on DW_DMAC_CORE=y && (SND_SST_IPC_ACPI = n)
        select SND_SOC_INTEL_SST
        select SND_SOC_INTEL_BAYTRAIL
        select SND_SOC_MAX98090
@@ -97,6 +101,7 @@ config SND_SOC_INTEL_BYTCR_RT5640_MACH
        select SND_SOC_RT5640
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        help
          This adds support for ASoC machine driver for Intel(R) Baytrail and Baytrail-CR
          platforms with RT5640 audio codec.
@@ -109,6 +114,7 @@ config SND_SOC_INTEL_BYTCR_RT5651_MACH
        select SND_SOC_RT5651
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        help
          This adds support for ASoC machine driver for Intel(R) Baytrail and Baytrail-CR
          platforms with RT5651 audio codec.
@@ -121,6 +127,7 @@ config SND_SOC_INTEL_CHT_BSW_RT5672_MACH
        select SND_SOC_RT5670
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        help
          This adds support for ASoC machine driver for Intel(R) Cherrytrail & Braswell
          platforms with RT5672 audio codec.
@@ -133,6 +140,7 @@ config SND_SOC_INTEL_CHT_BSW_RT5645_MACH
        select SND_SOC_RT5645
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        help
          This adds support for ASoC machine driver for Intel(R) Cherrytrail & Braswell
          platforms with RT5645/5650 audio codec.
@@ -145,6 +153,7 @@ config SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH
        select SND_SOC_TS3A227E
        select SND_SST_MFLD_PLATFORM
        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
        help
      This adds support for ASoC machine driver for Intel(R) Cherrytrail & Braswell
      platforms with MAX98090 audio codec it also can support TI jack chip as aux device.
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 55c33dc76ce4..52ed434cbca6 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -528,6 +528,7 @@ static struct snd_soc_dai_driver sst_platform_dai[] = {
        .ops = &sst_compr_dai_ops,
        .playback = {
                .stream_name = "Compress Playback",
+                .channels_min = 1,
        },
 },
 /* BE CPU  Dais */
diff --git a/sound/soc/intel/boards/skl_rt286.c b/sound/soc/intel/boards/skl_rt286.c
index 7396ddb427d8..2cbcbe412661 100644
--- a/sound/soc/intel/boards/skl_rt286.c
+++ b/sound/soc/intel/boards/skl_rt286.c
@@ -212,7 +212,10 @@ static int skylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
 {
        struct snd_interval *channels = hw_param_interval(params,
                                                SNDRV_PCM_HW_PARAM_CHANNELS);
-        channels->min = channels->max = 4;
+        if (params_channels(params) == 2)
+                channels->min = channels->max = 2;
+        else
+                channels->min = channels->max = 4;
        return 0;
 }
diff --git a/sound/soc/intel/common/Makefile b/sound/soc/intel/common/Makefile
index 668fdeee195e..fbbb25c2ceed 100644
--- a/sound/soc/intel/common/Makefile
+++ b/sound/soc/intel/common/Makefile
@@ -1,13 +1,10 @@
 snd-soc-sst-dsp-objs := sst-dsp.o
-ifneq ($(CONFIG_SND_SST_IPC_ACPI),)
+snd-soc-sst-acpi-objs := sst-acpi.o
-snd-soc-sst-acpi-objs := sst-match-acpi.o
+snd-soc-sst-match-objs := sst-match-acpi.o
-else
-snd-soc-sst-acpi-objs := sst-acpi.o sst-match-acpi.o
-endif
 snd-soc-sst-ipc-objs := sst-ipc.o
 snd-soc-sst-dsp-$(CONFIG_DW_DMAC_CORE) += sst-firmware.o
 obj-$(CONFIG_SND_SOC_INTEL_SST) += snd-soc-sst-dsp.o snd-soc-sst-ipc.o
 obj-$(CONFIG_SND_SOC_INTEL_SST_ACPI) += snd-soc-sst-acpi.o
+obj-$(CONFIG_SND_SOC_INTEL_SST_MATCH) += snd-soc-sst-match.o
diff --git a/sound/soc/intel/common/sst-acpi.c b/sound/soc/intel/common/sst-acpi.c
index 7a85c576dad3..2c5eda14d510 100644
--- a/sound/soc/intel/common/sst-acpi.c
+++ b/sound/soc/intel/common/sst-acpi.c
@@ -215,6 +215,7 @@ static struct sst_acpi_desc sst_acpi_broadwell_desc = {
        .dma_size = SST_LPT_DSP_DMA_SIZE,
 };
+#if !IS_ENABLED(CONFIG_SND_SST_IPC_ACPI)
 static struct sst_acpi_mach baytrail_machines[] = {
        { "10EC5640", "byt-rt5640", "intel/fw_sst_0f28.bin-48kHz_i2s_master", NULL, NULL, NULL },
        { "193C9890", "byt-max98090", "intel/fw_sst_0f28.bin-48kHz_i2s_master", NULL, NULL, NULL },
@@ -231,11 +232,14 @@ static struct sst_acpi_desc sst_acpi_baytrail_desc = {
        .sst_id = SST_DEV_ID_BYT,
        .resindex_dma_base = -1,
 };
+#endif
 static const struct acpi_device_id sst_acpi_match[] = {
        { "INT33C8", (unsigned long)&sst_acpi_haswell_desc },
        { "INT3438", (unsigned long)&sst_acpi_broadwell_desc },
+#if !IS_ENABLED(CONFIG_SND_SST_IPC_ACPI)
        { "80860F28", (unsigned long)&sst_acpi_baytrail_desc },
+#endif
        { }
 };
 MODULE_DEVICE_TABLE(acpi, sst_acpi_match);
diff --git a/sound/soc/intel/common/sst-match-acpi.c b/sound/soc/intel/common/sst-match-acpi.c
index dd077e116d25..3b4539d21492 100644
--- a/sound/soc/intel/common/sst-match-acpi.c
+++ b/sound/soc/intel/common/sst-match-acpi.c
@@ -41,3 +41,6 @@ struct sst_acpi_mach *sst_acpi_find_machine(struct sst_acpi_mach *machines)
        return NULL;
 }
 EXPORT_SYMBOL_GPL(sst_acpi_find_machine);
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Intel Common ACPI Match module");
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index de6dac496a0d..4629372d7c8e 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -688,14 +688,14 @@ int skl_unbind_modules(struct skl_sst *ctx,
        /* get src queue index */
        src_index = skl_get_queue_index(src_mcfg->m_out_pin, dst_id, out_max);
        if (src_index < 0)
-                return -EINVAL;
+                return 0;
        msg.src_queue = src_index;
        /* get dst queue index */
        dst_index  = skl_get_queue_index(dst_mcfg->m_in_pin, src_id, in_max);
        if (dst_index < 0)
-                return -EINVAL;
+                return 0;
        msg.dst_queue = dst_index;
@@ -747,7 +747,7 @@ int skl_bind_modules(struct skl_sst *ctx,
        skl_dump_bind_info(ctx, src_mcfg, dst_mcfg);
-        if (src_mcfg->m_state < SKL_MODULE_INIT_DONE &&
+        if (src_mcfg->m_state < SKL_MODULE_INIT_DONE ||
                dst_mcfg->m_state < SKL_MODULE_INIT_DONE)
                return 0;
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index f3553258091a..b6e6b61d10ec 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -863,6 +863,7 @@ static int skl_get_delay_from_lpib(struct hdac_ext_bus *ebus,
                else
                        delay += hstream->bufsize;
        }
+        delay = (hstream->bufsize == delay) ? 0 : delay;
        if (delay >= hstream->period_bytes) {
                dev_info(bus->dev,
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 4624556f486d..a294fee431f0 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -54,12 +54,9 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w)
 /*
 * Each pipelines needs memory to be allocated. Check if we have free memory
- * from available pool. Then only add this to pool
+ * from available pool.
- * This is freed when pipe is deleted
- * Note: DSP does actual memory management we only keep track for complete
- * pool
 */
-static bool skl_tplg_alloc_pipe_mem(struct skl *skl,
+static bool skl_is_pipe_mem_avail(struct skl *skl,
                                struct skl_module_cfg *mconfig)
 {
        struct skl_sst *ctx = skl->skl_sst;
@@ -74,10 +71,20 @@ static bool skl_tplg_alloc_pipe_mem(struct skl *skl,
                                "exceeds ppl memory available %d mem %d\n",
                                skl->resource.max_mem, skl->resource.mem);
                return false;
+        } else {
+                return true;
        }
+}
+/*
+ * Add the mem to the mem pool. This is freed when pipe is deleted.
+ * Note: DSP does actual memory management we only keep track for complete
+ * pool
+ */
+static void skl_tplg_alloc_pipe_mem(struct skl *skl,
+                                struct skl_module_cfg *mconfig)
+{
        skl->resource.mem += mconfig->pipe->memory_pages;
-        return true;
 }
 /*
@@ -85,10 +92,10 @@ static bool skl_tplg_alloc_pipe_mem(struct skl *skl,
 * quantified in MCPS (Million Clocks Per Second) required for module/pipe
 *
 * Each pipelines needs mcps to be allocated. Check if we have mcps for this
- * pipe. This adds the mcps to driver counter
+ * pipe.
- * This is removed on pipeline delete
 */
-static bool skl_tplg_alloc_pipe_mcps(struct skl *skl,
+static bool skl_is_pipe_mcps_avail(struct skl *skl,
                                struct skl_module_cfg *mconfig)
 {
        struct skl_sst *ctx = skl->skl_sst;
@@ -98,13 +105,18 @@ static bool skl_tplg_alloc_pipe_mcps(struct skl *skl,
                        "%s: module_id %d instance %d\n", __func__,
                        mconfig->id.module_id, mconfig->id.instance_id);
                dev_err(ctx->dev,
-                        "exceeds ppl memory available %d > mem %d\n",
+                        "exceeds ppl mcps available %d > mem %d\n",
                        skl->resource.max_mcps, skl->resource.mcps);
                return false;
+        } else {
+                return true;
        }
+}
+static void skl_tplg_alloc_pipe_mcps(struct skl *skl,
+                                struct skl_module_cfg *mconfig)
+{
        skl->resource.mcps += mconfig->mcps;
-        return true;
 }
 /*
@@ -411,7 +423,7 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                mconfig = w->priv;
                /* check resource available */
-                if (!skl_tplg_alloc_pipe_mcps(skl, mconfig))
+                if (!skl_is_pipe_mcps_avail(skl, mconfig))
                        return -ENOMEM;
                if (mconfig->is_loadable && ctx->dsp->fw_ops.load_mod) {
@@ -435,6 +447,7 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                ret = skl_tplg_set_module_params(w, ctx);
                if (ret < 0)
                        return ret;
+                skl_tplg_alloc_pipe_mcps(skl, mconfig);
        }
        return 0;
@@ -477,10 +490,10 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
        struct skl_sst *ctx = skl->skl_sst;
        /* check resource available */
-        if (!skl_tplg_alloc_pipe_mcps(skl, mconfig))
+        if (!skl_is_pipe_mcps_avail(skl, mconfig))
                return -EBUSY;
-        if (!skl_tplg_alloc_pipe_mem(skl, mconfig))
+        if (!skl_is_pipe_mem_avail(skl, mconfig))
                return -ENOMEM;
        /*
@@ -526,11 +539,15 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
                src_module = dst_module;
        }
+        skl_tplg_alloc_pipe_mem(skl, mconfig);
+        skl_tplg_alloc_pipe_mcps(skl, mconfig);
        return 0;
 }
 static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                                struct skl *skl,
+                                struct snd_soc_dapm_widget *src_w,
                                struct skl_module_cfg *src_mconfig)
 {
        struct snd_soc_dapm_path *p;
@@ -547,6 +564,10 @@ static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                dev_dbg(ctx->dev, "%s: sink widget=%s\n", __func__, p->sink->name);
                next_sink = p->sink;
+                if (!is_skl_dsp_widget_type(p->sink))
+                        return skl_tplg_bind_sinks(p->sink, skl, src_w, src_mconfig);
                /*
                 * here we will check widgets in sink pipelines, so that
                 * can be any widgets type and we are only interested if
@@ -576,7 +597,7 @@ static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
        }
        if (!sink)
-                return skl_tplg_bind_sinks(next_sink, skl, src_mconfig);
+                return skl_tplg_bind_sinks(next_sink, skl, src_w, src_mconfig);
        return 0;
 }
@@ -605,7 +626,7 @@ static int skl_tplg_pga_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
         * if sink is not started, start sink pipe first, then start
         * this pipe
         */
-        ret = skl_tplg_bind_sinks(w, skl, src_mconfig);
+        ret = skl_tplg_bind_sinks(w, skl, w, src_mconfig);
        if (ret)
                return ret;
@@ -773,10 +794,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
                        continue;
                }
-                ret = skl_unbind_modules(ctx, src_module, dst_module);
+                skl_unbind_modules(ctx, src_module, dst_module);
-                if (ret < 0)
-                        return ret;
                src_module = dst_module;
        }
@@ -814,9 +832,6 @@ static int skl_tplg_pga_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
                         * This is a connecter and if path is found that means
                         * unbind between source and sink has not happened yet
                         */
-                        ret = skl_stop_pipe(ctx, sink_mconfig->pipe);
-                        if (ret < 0)
-                                return ret;
                        ret = skl_unbind_modules(ctx, src_mconfig,
                                                        sink_mconfig);
                }
@@ -842,6 +857,12 @@ static int skl_tplg_vmixer_event(struct snd_soc_dapm_widget *w,
        case SND_SOC_DAPM_PRE_PMU:
                return skl_tplg_mixer_dapm_pre_pmu_event(w, skl);
+        case SND_SOC_DAPM_POST_PMU:
+                return skl_tplg_mixer_dapm_post_pmu_event(w, skl);
+        case SND_SOC_DAPM_PRE_PMD:
+                return skl_tplg_mixer_dapm_pre_pmd_event(w, skl);
        case SND_SOC_DAPM_POST_PMD:
                return skl_tplg_mixer_dapm_post_pmd_event(w, skl);
        }
@@ -916,6 +937,13 @@ static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol,
                skl_get_module_params(skl->skl_sst, (u32 *)bc->params,
                                      bc->max, bc->param_id, mconfig);
+        /* decrement size for TLV header */
+        size -= 2 * sizeof(u32);
+        /* check size as we don't want to send kernel data */
+        if (size > bc->max)
+                size = bc->max;
        if (bc->params) {
                if (copy_to_user(data, &bc->param_id, sizeof(u32)))
                        return -EFAULT;
@@ -1510,6 +1538,7 @@ int skl_tplg_init(struct snd_soc_platform *platform, struct hdac_ext_bus *ebus)
                                        &skl_tplg_ops, fw, 0);
        if (ret < 0) {
                dev_err(bus->dev, "tplg component load failed%d\n", ret);
+                release_firmware(fw);
                return -EINVAL;
        }
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 443a15de94b5..092705e73db4 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -614,8 +614,6 @@ static int skl_probe(struct pci_dev *pci,
                goto out_unregister;
        /*configure PM */
-        pm_runtime_set_autosuspend_delay(bus->dev, SKL_SUSPEND_DELAY);
-        pm_runtime_use_autosuspend(bus->dev);
        pm_runtime_put_noidle(bus->dev);
        pm_runtime_allow(bus->dev);
diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index 15c04e2eae34..976967675387 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -9,7 +9,7 @@ config SND_SOC_MEDIATEK
 config SND_SOC_MT8173_MAX98090
        tristate "ASoC Audio driver for MT8173 with MAX98090 codec"
-        depends on SND_SOC_MEDIATEK
+        depends on SND_SOC_MEDIATEK && I2C
        select SND_SOC_MAX98090
        help
          This adds ASoC driver for Mediatek MT8173 boards
@@ -19,7 +19,7 @@ config SND_SOC_MT8173_MAX98090
 config SND_SOC_MT8173_RT5650_RT5676
        tristate "ASoC Audio driver for MT8173 with RT5650 RT5676 codecs"
-        depends on SND_SOC_MEDIATEK
+        depends on SND_SOC_MEDIATEK && I2C
        select SND_SOC_RT5645
        select SND_SOC_RT5677
        help
diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
index c866ade28ad0..a6c7b8d87cd2 100644
--- a/sound/soc/mxs/mxs-saif.c
+++ b/sound/soc/mxs/mxs-saif.c
@@ -381,9 +381,19 @@ static int mxs_saif_startup(struct snd_pcm_substream *substream,
        __raw_writel(BM_SAIF_CTRL_CLKGATE,
                saif->base + SAIF_CTRL + MXS_CLR_ADDR);
+        clk_prepare(saif->clk);
        return 0;
 }
+static void mxs_saif_shutdown(struct snd_pcm_substream *substream,
+                              struct snd_soc_dai *cpu_dai)
+{
+        struct mxs_saif *saif = snd_soc_dai_get_drvdata(cpu_dai);
+        clk_unprepare(saif->clk);
+}
 /*
 * Should only be called when port is inactive.
 * although can be called multiple times by upper layers.
@@ -424,8 +434,6 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream,
                return ret;
        }
-        /* prepare clk in hw_param, enable in trigger */
-        clk_prepare(saif->clk);
        if (saif != master_saif) {
                /*
                * Set an initial clock rate for the saif internal logic to work
@@ -611,6 +619,7 @@ static int mxs_saif_trigger(struct snd_pcm_substream *substream, int cmd,
 static const struct snd_soc_dai_ops mxs_saif_dai_ops = {
        .startup = mxs_saif_startup,
+        .shutdown = mxs_saif_shutdown,
        .trigger = mxs_saif_trigger,
        .prepare = mxs_saif_prepare,
        .hw_params = mxs_saif_hw_params,
diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index 79688aa1941a..4aeb8e1a7160 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -440,18 +440,18 @@ static irqreturn_t lpass_platform_lpaif_irq(int irq, void *data)
 }
 static int lpass_platform_alloc_buffer(struct snd_pcm_substream *substream,
-                struct snd_soc_pcm_runtime *soc_runtime)
+                struct snd_soc_pcm_runtime *rt)
 {
        struct snd_dma_buffer *buf = &substream->dma_buffer;
        size_t size = lpass_platform_pcm_hardware.buffer_bytes_max;
        buf->dev.type = SNDRV_DMA_TYPE_DEV;
-        buf->dev.dev = soc_runtime->dev;
+        buf->dev.dev = rt->platform->dev;
        buf->private_data = NULL;
-        buf->area = dma_alloc_coherent(soc_runtime->dev, size, &buf->addr,
+        buf->area = dma_alloc_coherent(rt->platform->dev, size, &buf->addr,
                        GFP_KERNEL);
        if (!buf->area) {
-                dev_err(soc_runtime->dev, "%s: Could not allocate DMA buffer\n",
+                dev_err(rt->platform->dev, "%s: Could not allocate DMA buffer\n",
                                __func__);
                return -ENOMEM;
        }
@@ -461,12 +461,12 @@ static int lpass_platform_alloc_buffer(struct snd_pcm_substream *substream,
 }
 static void lpass_platform_free_buffer(struct snd_pcm_substream *substream,
-                struct snd_soc_pcm_runtime *soc_runtime)
+                struct snd_soc_pcm_runtime *rt)
 {
        struct snd_dma_buffer *buf = &substream->dma_buffer;
        if (buf->area) {
-                dma_free_coherent(soc_runtime->dev, buf->bytes, buf->area,
+                dma_free_coherent(rt->dev, buf->bytes, buf->area,
                                buf->addr);
        }
        buf->area = NULL;
@@ -499,9 +499,6 @@ static int lpass_platform_pcm_new(struct snd_soc_pcm_runtime *soc_runtime)
        snd_soc_pcm_set_drvdata(soc_runtime, data);
-        soc_runtime->dev->coherent_dma_mask = DMA_BIT_MASK(32);
-        soc_runtime->dev->dma_mask = &soc_runtime->dev->coherent_dma_mask;
        ret = lpass_platform_alloc_buffer(substream, soc_runtime);
        if (ret)
                return ret;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 5a2812fa8946..0d3707987900 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -310,7 +310,7 @@ struct dapm_kcontrol_data {
 };
 static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
-        struct snd_kcontrol *kcontrol)
+        struct snd_kcontrol *kcontrol, const char *ctrl_name)
 {
        struct dapm_kcontrol_data *data;
        struct soc_mixer_control *mc;
@@ -333,7 +333,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
                if (mc->autodisable) {
                        struct snd_soc_dapm_widget template;
-                        name = kasprintf(GFP_KERNEL, "%s %s", kcontrol->id.name,
+                        name = kasprintf(GFP_KERNEL, "%s %s", ctrl_name,
                                         "Autodisable");
                        if (!name) {
                                ret = -ENOMEM;
@@ -371,7 +371,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
                if (e->autodisable) {
                        struct snd_soc_dapm_widget template;
-                        name = kasprintf(GFP_KERNEL, "%s %s", kcontrol->id.name,
+                        name = kasprintf(GFP_KERNEL, "%s %s", ctrl_name,
                                         "Autodisable");
                        if (!name) {
                                ret = -ENOMEM;
@@ -871,7 +871,7 @@ static int dapm_create_or_share_kcontrol(struct snd_soc_dapm_widget *w,
                kcontrol->private_free = dapm_kcontrol_free;
-                ret = dapm_kcontrol_data_alloc(w, kcontrol);
+                ret = dapm_kcontrol_data_alloc(w, kcontrol, name);
                if (ret) {
                        snd_ctl_free_one(kcontrol);
                        goto exit_free;
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index e898b427be7e..1af4f23697a7 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1810,7 +1810,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) &&
-                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
+                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
                        continue;
                dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index cc39f63299ef..007cf5831121 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -2455,7 +2455,6 @@ int snd_usbmidi_create(struct snd_card *card,
        else
                err = snd_usbmidi_create_endpoints(umidi, endpoints);
        if (err < 0) {
-                snd_usbmidi_free(umidi);
                return err;
        }
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 81a2eb77ba7f..05d815851be1 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -2068,6 +2068,15 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
                err = -ENOMEM;
                goto err_free_queues;
        }
+        /*
+         * Since this thread will not be kept in any rbtree not in a
+         * list, initialize its list node so that at thread__put() the
+         * current thread lifetime assuption is kept and we don't segfault
+         * at list_del_init().
+         */
+        INIT_LIST_HEAD(&pt->unknown_thread->node);
        err = thread__set_comm(pt->unknown_thread, "unknown", 0);
        if (err)
                goto err_delete_thread;
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4f7b0efdde2f..813d9b272c81 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -399,6 +399,9 @@ static void tracepoint_error(struct parse_events_error *e, int err,
 {
        char help[BUFSIZ];
+        if (!e)
+                return;
        /*
         * We get error directly from syscall errno ( > 0),
         * or from encoded pointer's error ( < 0).
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 2be10fb27172..4ce5c5e18f48 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -686,8 +686,9 @@ static int call_probe_finder(Dwarf_Die *sc_die, struct probe_finder *pf)
                pf->fb_ops = NULL;
 #if _ELFUTILS_PREREQ(0, 142)
        } else if (nops == 1 && pf->fb_ops[0].atom == DW_OP_call_frame_cfa &&
-                   pf->cfi != NULL) {
+                   (pf->cfi_eh != NULL || pf->cfi_dbg != NULL)) {
-                if (dwarf_cfi_addrframe(pf->cfi, pf->addr, &frame) != 0 ||
+                if ((dwarf_cfi_addrframe(pf->cfi_eh, pf->addr, &frame) != 0 &&
+                     (dwarf_cfi_addrframe(pf->cfi_dbg, pf->addr, &frame) != 0)) ||
                    dwarf_frame_cfa(frame, &pf->fb_ops, &nops) != 0) {
                        pr_warning("Failed to get call frame on 0x%jx\n",
                                   (uintmax_t)pf->addr);
@@ -1015,8 +1016,7 @@ static int pubname_search_cb(Dwarf *dbg, Dwarf_Global *gl, void *data)
        return DWARF_CB_OK;
 }
-/* Find probe points from debuginfo */
+static int debuginfo__find_probe_location(struct debuginfo *dbg,
-static int debuginfo__find_probes(struct debuginfo *dbg,
                                  struct probe_finder *pf)
 {
        struct perf_probe_point *pp = &pf->pev->point;
@@ -1025,27 +1025,6 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
        Dwarf_Die *diep;
        int ret = 0;
-#if _ELFUTILS_PREREQ(0, 142)
-        Elf *elf;
-        GElf_Ehdr ehdr;
-        GElf_Shdr shdr;
-        /* Get the call frame information from this dwarf */
-        elf = dwarf_getelf(dbg->dbg);
-        if (elf == NULL)
-                return -EINVAL;
-        if (gelf_getehdr(elf, &ehdr) == NULL)
-                return -EINVAL;
-        if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
-            shdr.sh_type == SHT_PROGBITS) {
-                pf->cfi = dwarf_getcfi_elf(elf);
-        } else {
-                pf->cfi = dwarf_getcfi(dbg->dbg);
-        }
-#endif
        off = 0;
        pf->lcache = intlist__new(NULL);
        if (!pf->lcache)
@@ -1108,6 +1087,39 @@ found:
        return ret;
 }
+/* Find probe points from debuginfo */
+static int debuginfo__find_probes(struct debuginfo *dbg,
+                                  struct probe_finder *pf)
+{
+        int ret = 0;
+#if _ELFUTILS_PREREQ(0, 142)
+        Elf *elf;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
+        if (pf->cfi_eh || pf->cfi_dbg)
+                return debuginfo__find_probe_location(dbg, pf);
+        /* Get the call frame information from this dwarf */
+        elf = dwarf_getelf(dbg->dbg);
+        if (elf == NULL)
+                return -EINVAL;
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                return -EINVAL;
+        if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
+            shdr.sh_type == SHT_PROGBITS)
+                pf->cfi_eh = dwarf_getcfi_elf(elf);
+        pf->cfi_dbg = dwarf_getcfi(dbg->dbg);
+#endif
+        ret = debuginfo__find_probe_location(dbg, pf);
+        return ret;
+}
 struct local_vars_finder {
        struct probe_finder *pf;
        struct perf_probe_arg *args;
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index bed82716e1b4..0aec7704e395 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -76,7 +76,10 @@ struct probe_finder {
        /* For variable searching */
 #if _ELFUTILS_PREREQ(0, 142)
-        Dwarf_CFI               *cfi;           /* Call Frame Information */
+        /* Call Frame Information from .eh_frame */
+        Dwarf_CFI               *cfi_eh;
+        /* Call Frame Information from .debug_frame */
+        Dwarf_CFI               *cfi_dbg;
 #endif
        Dwarf_Op                *fb_ops;        /* Frame base attribute */
        struct perf_probe_arg   *pvar;          /* Current target variable */
diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 2b58edccd56f..afb0c45eba34 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -311,6 +311,16 @@ int perf_stat_process_counter(struct perf_stat_config *config,
        aggr->val = aggr->ena = aggr->run = 0;
+        /*
+         * We calculate counter's data every interval,
+         * and the display code shows ps->res_stats
+         * avg value. We need to zero the stats for
+         * interval mode, otherwise overall avg running
+         * averages will be shown for each interval.
+         */
+        if (config->interval)
+                init_stats(ps->res_stats);
        if (counter->per_pkg)
                zero_per_pkg(counter);