852 files changed, 8242 insertions, 5179 deletions
diff --git a/.mailmap b/.mailmap
index 977f958eedbe..b4091b7a78fe 100644
--- a/.mailmap
+++ b/.mailmap
@@ -116,6 +116,7 @@ Shiraz Hashim <shiraz.linux.kernel@gmail.com> <shiraz.hashim@st.com>
 Simon Kelley <simon@thekelleys.org.uk>
 Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
 Stephen Hemminger <shemminger@osdl.org>
+Sudeep Holla <sudeep.holla@arm.com> Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com>
 Sumit Semwal <sumit.semwal@ti.com>
 Tejun Heo <htejun@gmail.com>
 Thomas Graf <tgraf@suug.ch>
@@ -125,7 +126,9 @@ Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
 Uwe Kleine-König <ukl@pengutronix.de>
 Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
-Viresh Kumar <viresh.linux@gmail.com> <viresh.kumar@st.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.kumar@st.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.linux@gmail.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.kumar2@arm.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
index bbed111c31b4..70c9b1ac66db 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -1234,10 +1234,8 @@ Description:
                object is near the sensor, usually be observing
                reflectivity of infrared or ultrasound emitted.
                Often these sensors are unit less and as such conversion
-                to SI units is not possible.  Where it is, the units should
+                to SI units is not possible. Higher proximity measurements
-                be meters.  If such a conversion is not possible, the reported
+                indicate closer objects, and vice versa.
-                values should behave in the same way as a distance, i.e. lower
-                values indicate something is closer to the sensor.
 What:           /sys/.../iio:deviceX/in_illuminance_input
 What:           /sys/.../iio:deviceX/in_illuminance_raw
diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index c0312cbd023d..2fb9a5457522 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -3383,7 +3383,7 @@ void intel_crt_init(struct drm_device *dev)
        <td valign="top" >TBD</td>
        </tr>
        <tr>
-        <td rowspan="2" valign="top" >omap</td>
+        <td valign="top" >omap</td>
        <td valign="top" >Generic</td>
        <td valign="top" >“zorder”</td>
        <td valign="top" >RANGE</td>
diff --git a/Documentation/arm/SPEAr/overview.txt b/Documentation/arm/SPEAr/overview.txt
index 65610bf52ebf..1b049be6c84f 100644
--- a/Documentation/arm/SPEAr/overview.txt
+++ b/Documentation/arm/SPEAr/overview.txt
@@ -60,4 +60,4 @@ Introduction
  Document Author
  ---------------
-  Viresh Kumar <viresh.linux@gmail.com>, (c) 2010-2012 ST Microelectronics
+  Viresh Kumar <vireshk@kernel.org>, (c) 2010-2012 ST Microelectronics
diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index 82960cffbad3..785eab87aa71 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -258,6 +258,12 @@ cache metadata mode      : ro if read-only, rw if read-write
        no further I/O will be permitted and the status will just
        contain the string 'Fail'.  The userspace recovery tools
        should then be used.
+needs_check              : 'needs_check' if set, '-' if not set
+        A metadata operation has failed, resulting in the needs_check
+        flag being set in the metadata's superblock.  The metadata
+        device must be deactivated and checked/repaired before the
+        cache can be made fully operational again.  '-' indicates
+        needs_check is not set.
 Messages
 --------
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 4f67578b2954..1699a55b7b70 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -296,7 +296,7 @@ ii) Status
        underlying device.  When this is enabled when loading the table,
        it can get disabled if the underlying device doesn't support it.
-    ro|rw
+    ro|rw|out_of_data_space
        If the pool encounters certain types of device failures it will
        drop into a read-only metadata mode in which no changes to
        the pool metadata (like allocating new blocks) are permitted.
@@ -314,6 +314,13 @@ ii) Status
        module parameter can be used to change this timeout -- it
        defaults to 60 seconds but may be disabled using a value of 0.
+    needs_check
+        A metadata operation has failed, resulting in the needs_check
+        flag being set in the metadata's superblock.  The metadata
+        device must be deactivated and checked/repaired before the
+        thin-pool can be made fully operational again.  '-' indicates
+        needs_check is not set.
 iii) Messages
    create_thin <dev id>
diff --git a/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt b/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
index e75f0e549fff..971c3eedb1c7 100644
--- a/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
+++ b/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
@@ -65,8 +65,10 @@ Optional properties:
 - edid: verbatim EDID data block describing attached display.
 - ddc: phandle describing the i2c bus handling the display data
  channel
- port: A port node with endpoint definitions as defined in
+- port@[0-1]: Port nodes with endpoint definitions as defined in
  Documentation/devicetree/bindings/media/video-interfaces.txt.
+  Port 0 is the input port connected to the IPU display interface,
+  port 1 is the output port connected to a panel.
 example:
@@ -75,9 +77,29 @@ display@di0 {
        edid = [edid-data];
        interface-pix-fmt = "rgb24";
-        port {
+        port@0 {
+                reg = <0>;
                display_in: endpoint {
                        remote-endpoint = <&ipu_di0_disp0>;
                };
        };
+        port@1 {
+                reg = <1>;
+                display_out: endpoint {
+                        remote-endpoint = <&panel_in>;
+                };
+        };
+};
+panel {
+        ...
+        port {
+                panel_in: endpoint {
+                        remote-endpoint = <&display_out>;
+                };
+        };
 };
diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt b/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
index c03eec116872..3443e0f838df 100644
--- a/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
+++ b/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
@@ -35,3 +35,6 @@ the PCIe specification.
                      NOTE: this only applies to the SMMU itself, not
                      masters connected upstream of the SMMU.
+- hisilicon,broken-prefetch-cmd
+                    : Avoid sending CMD_PREFETCH_* commands to the SMMU.
diff --git a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
index 5d0376b8f202..211e7785f4d2 100644
--- a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
+++ b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
@@ -17,7 +17,6 @@ Required properties:
               "fsl,imx6sx-usdhc"
 Optional properties:
- fsl,cd-controller : Indicate to use controller internal card detection
 - fsl,wp-controller : Indicate to use controller internal write protection
 - fsl,delay-line : Specify the number of delay cells for override mode.
  This is used to set the clock delay for DLL(Delay Line) on override mode
@@ -35,7 +34,6 @@ esdhc@70004000 {
        compatible = "fsl,imx51-esdhc";
        reg = <0x70004000 0x4000>;
        interrupts = <1>;
-        fsl,cd-controller;
        fsl,wp-controller;
 };
diff --git a/Documentation/devicetree/bindings/spi/spi-ath79.txt b/Documentation/devicetree/bindings/spi/spi-ath79.txt
index f1ad9c367532..9c696fa66f81 100644
--- a/Documentation/devicetree/bindings/spi/spi-ath79.txt
+++ b/Documentation/devicetree/bindings/spi/spi-ath79.txt
@@ -3,7 +3,7 @@ Binding for Qualcomm Atheros AR7xxx/AR9xxx SPI controller
 Required properties:
 - compatible: has to be "qca,<soc-type>-spi", "qca,ar7100-spi" as fallback.
 - reg: Base address and size of the controllers memory area
- clocks: phandle to the AHB clock.
+- clocks: phandle of the AHB clock.
 - clock-names: has to be "ahb".
 - #address-cells: <1>, as required by generic SPI binding.
 - #size-cells: <0>, also as required by generic SPI binding.
@@ -12,9 +12,9 @@ Child nodes as per the generic SPI binding.
 Example:
-        spi@1F000000 {
+        spi@1f000000 {
                compatible = "qca,ar9132-spi", "qca,ar7100-spi";
-                reg = <0x1F000000 0x10>;
+                reg = <0x1f000000 0x10>;
                clocks = <&pll 2>;
                clock-names = "ahb";
diff --git a/Documentation/hwmon/nct7904 b/Documentation/hwmon/nct7904
index 014f112e2a14..57fffe33ebfc 100644
--- a/Documentation/hwmon/nct7904
+++ b/Documentation/hwmon/nct7904
@@ -35,11 +35,11 @@ temp1_input		Local temperature (1/1000 degree,
 temp[2-9]_input         CPU temperatures (1/1000 degree,
                        0.125 degree resolution)
-fan[1-4]_mode           R/W, 0/1 for manual or SmartFan mode
+pwm[1-4]_enable         R/W, 1/2 for manual or SmartFan mode
                        Setting SmartFan mode is supported only if it has been
                        previously configured by BIOS (or configuration EEPROM)
-fan[1-4]_pwm            R/O in SmartFan mode, R/W in manual control mode
+pwm[1-4]                R/O in SmartFan mode, R/W in manual control mode
 The driver checks sensor control registers and does not export the sensors
 that are not enabled. Anyway, a sensor that is enabled may actually be not
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index e63b446d973c..13f888a02a3d 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -952,6 +952,14 @@ When kbuild executes, the following steps are followed (roughly):
        $(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
        mode) if this option is supported by $(AR).
+    ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS   Overrides the kbuild defaults
+        These variables are appended to the KBUILD_CPPFLAGS,
+        KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
+        top-level Makefile has set any other flags. This provides a
+        means for an architecture to override the defaults.
 --- 6.2 Add prerequisites to archheaders:
        The archheaders: rule is used to generate header files that
diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py
index 949de191fcdc..cda56df9b8a7 100755
--- a/Documentation/target/tcm_mod_builder.py
+++ b/Documentation/target/tcm_mod_builder.py
@@ -199,7 +199,8 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "#include <linux/string.h>\n"
        buf += "#include <linux/configfs.h>\n"
        buf += "#include <linux/ctype.h>\n"
-        buf += "#include <asm/unaligned.h>\n\n"
+        buf += "#include <asm/unaligned.h>\n"
+        buf += "#include <scsi/scsi_proto.h>\n\n"
        buf += "#include <target/target_core_base.h>\n"
        buf += "#include <target/target_core_fabric.h>\n"
        buf += "#include <target/target_core_fabric_configfs.h>\n"
@@ -230,8 +231,14 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "        }\n"
        buf += "        tpg->" + fabric_mod_port + " = " + fabric_mod_port + ";\n"
        buf += "        tpg->" + fabric_mod_port + "_tpgt = tpgt;\n\n"
-        buf += "        ret = core_tpg_register(&" + fabric_mod_name + "_ops, wwn,\n"
-        buf += "                                &tpg->se_tpg, SCSI_PROTOCOL_SAS);\n"
+        if proto_ident == "FC":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_FCP);\n"
+        elif proto_ident == "SAS":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);\n"
+        elif proto_ident == "iSCSI":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_ISCSI);\n"
        buf += "        if (ret < 0) {\n"
        buf += "                kfree(tpg);\n"
        buf += "                return NULL;\n"
@@ -292,7 +299,7 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "static const struct target_core_fabric_ops " + fabric_mod_name + "_ops = {\n"
        buf += "        .module                         = THIS_MODULE,\n"
-        buf += "        .name                           = " + fabric_mod_name + ",\n"
+        buf += "        .name                           = \"" + fabric_mod_name + "\",\n"
        buf += "        .get_fabric_name                = " + fabric_mod_name + "_get_fabric_name,\n"
        buf += "        .tpg_get_wwn                    = " + fabric_mod_name + "_get_fabric_wwn,\n"
        buf += "        .tpg_get_tag                    = " + fabric_mod_name + "_get_tag,\n"
@@ -322,17 +329,17 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
        buf += "        .fabric_make_tpg                = " + fabric_mod_name + "_make_tpg,\n"
        buf += "        .fabric_drop_tpg                = " + fabric_mod_name + "_drop_tpg,\n"
        buf += "\n"
-        buf += "        .tfc_wwn_attrs                  = " + fabric_mod_name + "_wwn_attrs;\n"
+        buf += "        .tfc_wwn_attrs                  = " + fabric_mod_name + "_wwn_attrs,\n"
        buf += "};\n\n"
        buf += "static int __init " + fabric_mod_name + "_init(void)\n"
        buf += "{\n"
-        buf += "        return target_register_template(" + fabric_mod_name + "_ops);\n"
+        buf += "        return target_register_template(&" + fabric_mod_name + "_ops);\n"
        buf += "};\n\n"
        buf += "static void __exit " + fabric_mod_name + "_exit(void)\n"
        buf += "{\n"
-        buf += "        target_unregister_template(" + fabric_mod_name + "_ops);\n"
+        buf += "        target_unregister_template(&" + fabric_mod_name + "_ops);\n"
        buf += "};\n\n"
        buf += "MODULE_DESCRIPTION(\"" + fabric_mod_name.upper() + " series fabric driver\");\n"
diff --git a/MAINTAINERS b/MAINTAINERS
index fd6078443083..9289ecb57b68 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -361,11 +361,11 @@ S:	Supported
 F:      drivers/input/touchscreen/ad7879.c
 ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR)
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Maintained
 ADM1025 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/adm1025
@@ -430,7 +430,7 @@ S:	Maintained
 F:      drivers/macintosh/therm_adt746x.c
 ADT7475 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/adt7475
@@ -445,7 +445,7 @@ F:	drivers/input/misc/adxl34x.c
 ADVANSYS SCSI DRIVER
 M:      Matthew Wilcox <matthew@wil.cx>
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      Documentation/scsi/advansys.txt
@@ -506,7 +506,7 @@ F:	drivers/scsi/aha152x*
 F:      drivers/scsi/pcmcia/aha152x*
 AIC7XXX / AIC79XX SCSI DRIVER
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/aic7xxx/
@@ -746,7 +746,7 @@ S:	Maintained
 F:      sound/aoa/
 APM DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Odd fixes
 F:      arch/x86/kernel/apm_32.c
 F:      include/linux/apm_bios.h
@@ -1001,6 +1001,7 @@ ARM/CONEXANT DIGICOLOR MACHINE SUPPORT
 M:      Baruch Siach <baruch@tkos.co.il>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+F:      arch/arm/boot/dts/cx92755*
 N:      digicolor
 ARM/EBSA110 MACHINE SUPPORT
@@ -1324,7 +1325,7 @@ F:	arch/arm/mach-pxa/include/mach/palmtc.h
 F:      arch/arm/mach-pxa/palmtc.c
 ARM/PALM TREO SUPPORT
-M:      Tomas Cech <sleep_walker@suse.cz>
+M:      Tomas Cech <sleep_walker@suse.com>
 L:      linux-arm-kernel@lists.infradead.org
 W:      http://hackndev.com
 S:      Maintained
@@ -2405,7 +2406,7 @@ F:	drivers/gpio/gpio-bt8xx.c
 BTRFS FILE SYSTEM
 M:      Chris Mason <clm@fb.com>
 M:      Josef Bacik <jbacik@fb.com>
-M:      David Sterba <dsterba@suse.cz>
+M:      David Sterba <dsterba@suse.com>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -2748,7 +2749,7 @@ COCCINELLE/Semantic Patches (SmPL)
 M:      Julia Lawall <Julia.Lawall@lip6.fr>
 M:      Gilles Muller <Gilles.Muller@lip6.fr>
 M:      Nicolas Palix <nicolas.palix@imag.fr>
-M:      Michal Marek <mmarek@suse.cz>
+M:      Michal Marek <mmarek@suse.com>
 L:      cocci@systeme.lip6.fr (moderated for non-subscribers)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git misc
 W:      http://coccinelle.lip6.fr/
@@ -2864,7 +2865,7 @@ F:	kernel/cpuset.c
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
-M:      Michal Hocko <mhocko@suse.cz>
+M:      Michal Hocko <mhocko@kernel.org>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -2945,7 +2946,7 @@ F:	arch/x86/kernel/cpuid.c
 F:      arch/x86/kernel/msr.c
 CPU POWER MONITORING SUBSYSTEM
-M:      Thomas Renninger <trenn@suse.de>
+M:      Thomas Renninger <trenn@suse.com>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
 F:      tools/power/cpupower/
@@ -3175,7 +3176,7 @@ F:	Documentation/networking/dmfe.txt
 F:      drivers/net/ethernet/dec/tulip/dmfe.c
 DC390/AM53C974 SCSI driver
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/am53c974.c
@@ -3379,7 +3380,7 @@ W:	http://www.win.tue.nl/~aeb/partitions/partition_types-1.html
 S:      Maintained
 DISKQUOTA
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 S:      Maintained
 F:      Documentation/filesystems/quota.txt
 F:      fs/quota/
@@ -3435,7 +3436,7 @@ F:	Documentation/hwmon/dme1737
 F:      drivers/hwmon/dme1737.c
 DMI/SMBIOS SUPPORT
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 S:      Maintained
 T:      quilt http://jdelvare.nerim.net/devel/linux/jdelvare-dmi/
 F:      Documentation/ABI/testing/sysfs-firmware-dmi-tables
@@ -4051,7 +4052,7 @@ F:	drivers/of/of_mdio.c
 F:      drivers/of/of_net.c
 EXT2 FILE SYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 L:      linux-ext4@vger.kernel.org
 S:      Maintained
 F:      Documentation/filesystems/ext2.txt
@@ -4059,7 +4060,7 @@ F:	fs/ext2/
 F:      include/linux/ext2*
 EXT3 FILE SYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 M:      Andrew Morton <akpm@linux-foundation.org>
 M:      Andreas Dilger <adilger.kernel@dilger.ca>
 L:      linux-ext4@vger.kernel.org
@@ -4109,7 +4110,7 @@ F:	drivers/video/fbdev/exynos/exynos_mipi*
 F:      include/video/exynos_mipi*
 F71805F HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/f71805f
@@ -4244,7 +4245,7 @@ S:	Maintained
 F:      drivers/block/rsxx/
 FLOPPY DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/floppy.git
 S:      Odd fixes
 F:      drivers/block/floppy.c
@@ -4665,7 +4666,7 @@ F:	drivers/media/usb/stk1160/
 H8/300 ARCHITECTURE
 M:      Yoshinori Sato <ysato@users.sourceforge.jp>
-L:      uclinux-h8-devel@lists.sourceforge.jp
+L:      uclinux-h8-devel@lists.sourceforge.jp (moderated for non-subscribers)
 W:      http://uclinux-h8.sourceforge.jp
 T:      git git://git.sourceforge.jp/gitroot/uclinux-h8/linux.git
 S:      Maintained
@@ -4712,7 +4713,7 @@ S:	Maintained
 F:      drivers/media/usb/hackrf/
 HARDWARE MONITORING
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
@@ -4815,7 +4816,7 @@ F:	include/linux/pm.h
 F:      arch/*/include/asm/suspend*.h
 HID CORE LAYER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 L:      linux-input@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
@@ -4824,7 +4825,7 @@ F:	include/linux/hid*
 F:      include/uapi/linux/hid*
 HID SENSOR HUB DRIVERS
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 M:      Jonathan Cameron <jic23@kernel.org>
 M:      Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
 L:      linux-input@vger.kernel.org
@@ -4958,7 +4959,7 @@ F:	include/linux/hyperv.h
 F:      tools/hv/
 I2C OVER PARALLEL PORT
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-parport
@@ -4967,7 +4968,7 @@ F:	drivers/i2c/busses/i2c-parport.c
 F:      drivers/i2c/busses/i2c-parport-light.c
 I2C/SMBUS CONTROLLER DRIVERS FOR PC
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-ali1535
@@ -5008,7 +5009,7 @@ F:	drivers/i2c/busses/i2c-ismt.c
 F:      Documentation/i2c/busses/i2c-ismt
 I2C/SMBUS STUB DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-stub.c
@@ -5035,7 +5036,7 @@ L:	linux-acpi@vger.kernel.org
 S:      Maintained
 I2C-TAOS-EVM DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-taos-evm
@@ -5564,8 +5565,8 @@ F:	include/uapi/linux/ip_vs.h
 F:      net/netfilter/ipvs/
 IPWIRELESS DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
-M:      David Sterba <dsterba@suse.cz>
+M:      David Sterba <dsterba@suse.com>
 S:      Odd Fixes
 F:      drivers/tty/ipwireless/
@@ -5685,7 +5686,7 @@ S:	Maintained
 F:      drivers/isdn/hardware/eicon/
 IT87 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/it87
@@ -5752,7 +5753,7 @@ F:	include/uapi/linux/jffs2.h
 JOURNALLING LAYER FOR BLOCK DEVICES (JBD)
 M:      Andrew Morton <akpm@linux-foundation.org>
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 L:      linux-ext4@vger.kernel.org
 S:      Maintained
 F:      fs/jbd/
@@ -5816,7 +5817,7 @@ S:	Maintained
 F:      fs/autofs4/
 KERNEL BUILD + files below scripts/ (unless maintained elsewhere)
-M:      Michal Marek <mmarek@suse.cz>
+M:      Michal Marek <mmarek@suse.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git for-next
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git rc-fixes
 L:      linux-kbuild@vger.kernel.org
@@ -5880,7 +5881,7 @@ F:	arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
 KERNEL VIRTUAL MACHINE (KVM) FOR POWERPC
-M:      Alexander Graf <agraf@suse.de>
+M:      Alexander Graf <agraf@suse.com>
 L:      kvm-ppc@vger.kernel.org
 W:      http://kvm.qumranet.com
 T:      git git://github.com/agraf/linux-2.6.git
@@ -5898,7 +5899,6 @@ S:	Supported
 F:      Documentation/s390/kvm.txt
 F:      arch/s390/include/asm/kvm*
 F:      arch/s390/kvm/
-F:      drivers/s390/kvm/
 KERNEL VIRTUAL MACHINE (KVM) FOR ARM
 M:      Christoffer Dall <christoffer.dall@linaro.org>
@@ -6037,7 +6037,7 @@ F:	drivers/leds/
 F:      include/linux/leds.h
 LEGACY EEPROM DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 S:      Maintained
 F:      Documentation/misc-devices/eeprom
 F:      drivers/misc/eeprom/eeprom.c
@@ -6090,7 +6090,7 @@ F:	include/linux/ata.h
 F:      include/linux/libata.h
 LIBATA PATA ARASAN COMPACT FLASH CONTROLLER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      linux-ide@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
 S:      Maintained
@@ -6251,8 +6251,8 @@ F:	drivers/platform/x86/hp_accel.c
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
 M:      Seth Jennings <sjenning@redhat.com>
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
-M:      Vojtech Pavlik <vojtech@suse.cz>
+M:      Vojtech Pavlik <vojtech@suse.com>
 S:      Maintained
 F:      kernel/livepatch/
 F:      include/linux/livepatch.h
@@ -6278,21 +6278,21 @@ S:	Maintained
 F:      drivers/hwmon/lm73.c
 LM78 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm78
 F:      drivers/hwmon/lm78.c
 LM83 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm83
 F:      drivers/hwmon/lm83.c
 LM90 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm90
@@ -6838,6 +6838,12 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/usb/msi2500/
+MSYSTEMS DISKONCHIP G3 MTD DRIVER
+M:      Robert Jarzmik <robert.jarzmik@free.fr>
+L:      linux-mtd@lists.infradead.org
+S:      Maintained
+F:      drivers/mtd/devices/docg3*
 MT9M032 APTINA SENSOR DRIVER
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      linux-media@vger.kernel.org
@@ -7019,6 +7025,7 @@ F:	include/uapi/linux/netfilter/
 F:      net/*/netfilter.c
 F:      net/*/netfilter/
 F:      net/netfilter/
+F:      net/bridge/br_netfilter*.c
 NETLABEL
 M:      Paul Moore <paul@paul-moore.com>
@@ -7718,7 +7725,7 @@ S:	Maintained
 F:      drivers/char/pc8736x_gpio.c
 PC87427 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/pc87427
@@ -7995,7 +8002,7 @@ S:	Maintained
 F:      drivers/pinctrl/samsung/
 PIN CONTROLLER - ST SPEAR
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
@@ -8003,7 +8010,7 @@ S:	Maintained
 F:      drivers/pinctrl/spear/
 PKTCDVD DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Maintained
 F:      drivers/block/pktcdvd.c
 F:      include/linux/pktcdvd.h
@@ -8894,7 +8901,7 @@ S:	Maintained
 F:      drivers/tty/serial/
 SYNOPSYS DESIGNWARE DMAC DRIVER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
 F:      include/linux/dma/dw.h
@@ -9061,7 +9068,7 @@ S:	Maintained
 F:      drivers/mmc/host/sdhci-s3c*
 SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) ST SPEAR DRIVER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-mmc@vger.kernel.org
 S:      Maintained
@@ -9423,7 +9430,7 @@ F:	Documentation/hwmon/sch5627
 F:      drivers/hwmon/sch5627.c
 SMSC47B397 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/smsc47b397
@@ -9472,7 +9479,7 @@ S:	Supported
 F:      drivers/media/pci/solo6x10/
 SOFTWARE RAID (Multiple Disks) SUPPORT
-M:      Neil Brown <neilb@suse.de>
+M:      Neil Brown <neilb@suse.com>
 L:      linux-raid@vger.kernel.org
 S:      Supported
 F:      drivers/md/
@@ -9515,7 +9522,7 @@ F:	drivers/memstick/core/ms_block.*
 SOUND
 M:      Jaroslav Kysela <perex@perex.cz>
-M:      Takashi Iwai <tiwai@suse.de>
+M:      Takashi Iwai <tiwai@suse.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 W:      http://www.alsa-project.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
@@ -9599,7 +9606,7 @@ S:	Maintained
 F:      include/linux/compiler.h
 SPEAR PLATFORM SUPPORT
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 M:      Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -9608,7 +9615,7 @@ S:	Maintained
 F:      arch/arm/mach-spear/
 SPEAR CLOCK FRAMEWORK SUPPORT
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
@@ -10398,7 +10405,7 @@ K:	^Subject:.*(?i)trivial
 TTY LAYER
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-M:      Jiri Slaby <jslaby@suse.cz>
+M:      Jiri Slaby <jslaby@suse.com>
 S:      Supported
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
 F:      Documentation/serial/
@@ -10472,7 +10479,7 @@ F:	arch/m68k/*/*_no.*
 F:      arch/m68k/include/asm/*_no.*
 UDF FILESYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 S:      Maintained
 F:      Documentation/filesystems/udf.txt
 F:      fs/udf/
@@ -10615,7 +10622,7 @@ F:	drivers/usb/gadget/
 F:      include/linux/usb/gadget*
 USB HID/HIDBP DRIVERS (USB KEYBOARDS, MICE, REMOTE CONTROLS, ...)
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 L:      linux-usb@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
@@ -10740,7 +10747,7 @@ S:	Maintained
 F:      drivers/usb/host/uhci*
 USB "USBNET" DRIVER FRAMEWORK
-M:      Oliver Neukum <oneukum@suse.de>
+M:      Oliver Neukum <oneukum@suse.com>
 L:      netdev@vger.kernel.org
 W:      http://www.linux-usb.org/usbnet
 S:      Maintained
@@ -10894,6 +10901,15 @@ F:	drivers/block/virtio_blk.c
 F:      include/linux/virtio_*.h
 F:      include/uapi/linux/virtio_*.h
+VIRTIO DRIVERS FOR S390
+M:      Christian Borntraeger <borntraeger@de.ibm.com>
+M:      Cornelia Huck <cornelia.huck@de.ibm.com>
+L:      linux-s390@vger.kernel.org
+L:      virtualization@lists.linux-foundation.org
+L:      kvm@vger.kernel.org
+S:      Supported
+F:      drivers/s390/virtio/
 VIRTIO GPU DRIVER
 M:      David Airlie <airlied@linux.ie>
 M:      Gerd Hoffmann <kraxel@redhat.com>
@@ -11067,7 +11083,7 @@ F:	Documentation/hwmon/w83793
 F:      drivers/hwmon/w83793.c
 W83795 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      drivers/hwmon/w83795.c
diff --git a/Makefile b/Makefile
index 257ef5892ab7..afabc44a349b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Hurr durr I'ma sheep
 # *DOCUMENTATION*
@@ -780,10 +780,11 @@ endif
 include scripts/Makefile.kasan
 include scripts/Makefile.extrawarn
-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
-KBUILD_CPPFLAGS += $(KCPPFLAGS)
+# last assignments
-KBUILD_AFLAGS += $(KAFLAGS)
+KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
-KBUILD_CFLAGS += $(KCFLAGS)
+KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
+KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
 # Use --build-id when available.
 LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\
diff --git a/arch/Kconfig b/arch/Kconfig
index bec6666a3cc4..8a8ea7110de8 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -221,6 +221,10 @@ config ARCH_TASK_STRUCT_ALLOCATOR
 config ARCH_THREAD_INFO_ALLOCATOR
        bool
+# Select if arch wants to size task_struct dynamically via arch_task_struct_size:
+config ARCH_WANTS_DYNAMIC_TASK_STRUCT
+        bool
 config HAVE_REGS_AND_STACK_ACCESS_API
        bool
        help
diff --git a/arch/alpha/include/asm/Kbuild b/arch/alpha/include/asm/Kbuild
index cde23cd03609..ffd9cf5ec8c4 100644
--- a/arch/alpha/include/asm/Kbuild
+++ b/arch/alpha/include/asm/Kbuild
@@ -5,6 +5,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/alpha/include/asm/mm-arch-hooks.h b/arch/alpha/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b07fd862fec3..000000000000
--- a/arch/alpha/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_ALPHA_MM_ARCH_HOOKS_H
-#define _ASM_ALPHA_MM_ARCH_HOOKS_H
-#endif /* _ASM_ALPHA_MM_ARCH_HOOKS_H */
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index e7cee0a5c56d..91cf4055acab 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -115,6 +115,7 @@ if ISA_ARCOMPACT
 config ARC_CPU_750D
        bool "ARC750D"
+        select ARC_CANT_LLSC
        help
          Support for ARC750 core
@@ -362,7 +363,7 @@ config ARC_CANT_LLSC
 config ARC_HAS_LLSC
        bool "Insn: LLOCK/SCOND (efficient atomic ops)"
        default y
-        depends on !ARC_CPU_750D && !ARC_CANT_LLSC
+        depends on !ARC_CANT_LLSC
 config ARC_HAS_SWAPE
        bool "Insn: SWAPE (endian-swap)"
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 6107062c0111..46d87310220d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -49,7 +49,8 @@ endif
 ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
 # Generic build system uses -O2, we want -O3
-cflags-y  += -O3
+# Note: No need to add to cflags-y as that happens anyways
+ARCH_CFLAGS += -O3
 endif
 # small data is default for elf32 tool-chain. If not usable, disable it
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 15c8d6226c9d..1cd5e82f5dc2 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -12,7 +12,7 @@
 / {
        compatible = "snps,arc";
-        clock-frequency = <75000000>;
+        clock-frequency = <90000000>;
        #address-cells = <1>;
        #size-cells = <1>;
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 199d42820eca..2f0b33257db2 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -12,7 +12,7 @@
 / {
        compatible = "snps,arc";
-        clock-frequency = <75000000>;
+        clock-frequency = <90000000>;
        #address-cells = <1>;
        #size-cells = <1>;
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index 1a80cc91a03b..7611b10a2d23 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -22,6 +22,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index 99fe118d3730..57c1f33844d4 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -50,8 +50,7 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
         * done for const @nr, but no code is generated due to gcc      \
         * const prop.                                                  \
         */                                                             \
-        if (__builtin_constant_p(nr))                                   \
+        nr &= 0x1f;                                                     \
-                nr &= 0x1f;                                             \
                                                                        \
        __asm__ __volatile__(                                           \
        "1:     llock       %0, [%1]            \n"                     \
@@ -82,8 +81,7 @@ static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *
                                                                        \
        m += nr >> 5;                                                   \
                                                                        \
-        if (__builtin_constant_p(nr))                                   \
+        nr &= 0x1f;                                                     \
-                nr &= 0x1f;                                             \
                                                                        \
        /*                                                              \
         * Explicit full memory barrier needed before/after as          \
@@ -129,16 +127,13 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
        unsigned long temp, flags;                                      \
        m += nr >> 5;                                                   \
                                                                        \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
        /*                                                              \
         * spin lock/unlock provide the needed smp_mb() before/after    \
         */                                                             \
        bitops_lock(flags);                                             \
                                                                        \
        temp = *m;                                                      \
-        *m = temp c_op (1UL << nr);                                     \
+        *m = temp c_op (1UL << (nr & 0x1f));                                    \
                                                                        \
        bitops_unlock(flags);                                           \
 }
@@ -149,17 +144,14 @@ static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *
        unsigned long old, flags;                                       \
        m += nr >> 5;                                                   \
                                                                        \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
        bitops_lock(flags);                                             \
                                                                        \
        old = *m;                                                       \
-        *m = old c_op (1 << nr);                                        \
+        *m = old c_op (1UL << (nr & 0x1f));                             \
                                                                        \
        bitops_unlock(flags);                                           \
                                                                        \
-        return (old & (1 << nr)) != 0;                                  \
+        return (old & (1UL << (nr & 0x1f))) != 0;                       \
 }
 #endif /* CONFIG_ARC_HAS_LLSC */
@@ -174,11 +166,8 @@ static inline void __##op##_bit(unsigned long nr, volatile unsigned long *m)	\
        unsigned long temp;                                             \
        m += nr >> 5;                                                   \
                                                                        \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
        temp = *m;                                                      \
-        *m = temp c_op (1UL << nr);                                     \
+        *m = temp c_op (1UL << (nr & 0x1f));                            \
 }
 #define __TEST_N_BIT_OP(op, c_op, asm_op)                               \
@@ -187,13 +176,10 @@ static inline int __test_and_##op##_bit(unsigned long nr, volatile unsigned long
        unsigned long old;                                              \
        m += nr >> 5;                                                   \
                                                                        \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
        old = *m;                                                       \
-        *m = old c_op (1 << nr);                                        \
+        *m = old c_op (1UL << (nr & 0x1f));                             \
                                                                        \
-        return (old & (1 << nr)) != 0;                                  \
+        return (old & (1UL << (nr & 0x1f))) != 0;                       \
 }
 #define BIT_OPS(op, c_op, asm_op)                                       \
@@ -224,10 +210,7 @@ test_bit(unsigned int nr, const volatile unsigned long *addr)
        addr += nr >> 5;
-        if (__builtin_constant_p(nr))
+        mask = 1UL << (nr & 0x1f);
-                nr &= 0x1f;
-        mask = 1 << nr;
        return ((mask & *addr) != 0);
 }
diff --git a/arch/arc/include/asm/futex.h b/arch/arc/include/asm/futex.h
index 05b5aaf5b0f9..70cfe16b742d 100644
--- a/arch/arc/include/asm/futex.h
+++ b/arch/arc/include/asm/futex.h
@@ -16,12 +16,40 @@
 #include <linux/uaccess.h>
 #include <asm/errno.h>
+#ifdef CONFIG_ARC_HAS_LLSC
+#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)\
+                                                        \
+        __asm__ __volatile__(                           \
+        "1:     llock   %1, [%2]                \n"     \
+                insn                            "\n"    \
+        "2:     scond   %0, [%2]                \n"     \
+        "       bnz     1b                      \n"     \
+        "       mov %0, 0                       \n"     \
+        "3:                                     \n"     \
+        "       .section .fixup,\"ax\"          \n"     \
+        "       .align  4                       \n"     \
+        "4:     mov %0, %4                      \n"     \
+        "       b   3b                          \n"     \
+        "       .previous                       \n"     \
+        "       .section __ex_table,\"a\"       \n"     \
+        "       .align  4                       \n"     \
+        "       .word   1b, 4b                  \n"     \
+        "       .word   2b, 4b                  \n"     \
+        "       .previous                       \n"     \
+                                                        \
+        : "=&r" (ret), "=&r" (oldval)                   \
+        : "r" (uaddr), "r" (oparg), "ir" (-EFAULT)      \
+        : "cc", "memory")
+#else   /* !CONFIG_ARC_HAS_LLSC */
 #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)\
                                                        \
        __asm__ __volatile__(                           \
-        "1:     ld  %1, [%2]                    \n"     \
+        "1:     ld      %1, [%2]                \n"     \
                insn                            "\n"    \
-        "2:     st  %0, [%2]                    \n"     \
+        "2:     st      %0, [%2]                \n"     \
        "       mov %0, 0                       \n"     \
        "3:                                     \n"     \
        "       .section .fixup,\"ax\"          \n"     \
@@ -39,6 +67,8 @@
        : "r" (uaddr), "r" (oparg), "ir" (-EFAULT)      \
        : "cc", "memory")
+#endif
 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 {
        int op = (encoded_op >> 28) & 7;
@@ -123,11 +153,17 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval,
        pagefault_disable();
-        /* TBD : can use llock/scond */
        __asm__ __volatile__(
-        "1:     ld    %0, [%3]  \n"
+#ifdef CONFIG_ARC_HAS_LLSC
-        "       brne  %0, %1, 3f        \n"
+        "1:     llock   %0, [%3]                \n"
-        "2:     st    %2, [%3]  \n"
+        "       brne    %0, %1, 3f              \n"
+        "2:     scond   %2, [%3]                \n"
+        "       bnz     1b                      \n"
+#else
+        "1:     ld      %0, [%3]                \n"
+        "       brne    %0, %1, 3f              \n"
+        "2:     st      %2, [%3]                \n"
+#endif
        "3:     \n"
        "       .section .fixup,\"ax\"  \n"
        "4:     mov %0, %4      \n"
diff --git a/arch/arc/include/asm/mm-arch-hooks.h b/arch/arc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index c37541c5f8ba..000000000000
--- a/arch/arc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_ARC_MM_ARCH_HOOKS_H
-#define _ASM_ARC_MM_ARCH_HOOKS_H
-#endif /* _ASM_ARC_MM_ARCH_HOOKS_H */
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 91755972b9a2..91694ec1ce95 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -106,7 +106,7 @@ struct callee_regs {
        long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
 };
-#define instruction_pointer(regs)       ((regs)->ret)
+#define instruction_pointer(regs)       (unsigned long)((regs)->ret)
 #define profile_pc(regs)                instruction_pointer(regs)
 /* return 1 if user mode or 0 if kernel mode */
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 6208c630abed..26c156827479 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -12,7 +12,6 @@
 #include <linux/of.h>
 #include <linux/irqdomain.h>
 #include <linux/irqchip.h>
-#include "../../drivers/irqchip/irqchip.h"
 #include <asm/irq.h>
 /*
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index fcdddb631766..039fac30b5c1 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -12,7 +12,6 @@
 #include <linux/of.h>
 #include <linux/irqdomain.h>
 #include <linux/irqchip.h>
-#include "../../drivers/irqchip/irqchip.h"
 #include <asm/irq.h>
 /*
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 30284e8de6ff..2fb86589054d 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -175,7 +175,6 @@ void mcip_init_early_smp(void)
 #include <linux/irqchip.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
-#include "../../drivers/irqchip/irqchip.h"
 /*
 * Set the DEST for @cmn_irq to @cpu_mask (1 bit per core)
@@ -218,11 +217,28 @@ static void idu_irq_unmask(struct irq_data *data)
        raw_spin_unlock_irqrestore(&mcip_lock, flags);
 }
+#ifdef CONFIG_SMP
 static int
-idu_irq_set_affinity(struct irq_data *d, const struct cpumask *cpumask, bool f)
+idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
+                     bool force)
 {
+        unsigned long flags;
+        cpumask_t online;
+        /* errout if no online cpu per @cpumask */
+        if (!cpumask_and(&online, cpumask, cpu_online_mask))
+                return -EINVAL;
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+        idu_set_dest(data->hwirq, cpumask_bits(&online)[0]);
+        idu_set_mode(data->hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_RR);
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
        return IRQ_SET_MASK_OK;
 }
+#endif
 static struct irq_chip idu_irq_chip = {
        .name                   = "MCIP IDU Intc",
@@ -330,8 +346,7 @@ idu_of_init(struct device_node *intc, struct device_node *parent)
                if (!i)
                        idu_first_irq = irq;
-                irq_set_handler_data(irq, domain);
+                irq_set_chained_handler_and_data(irq, idu_cascade_isr, domain);
-                irq_set_chained_handler(irq, idu_cascade_isr);
        }
        __mcip_cmd(CMD_IDU_ENABLE, 0);
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index a3d186211ed3..18cc01591c96 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -142,17 +142,22 @@ static void read_arc_build_cfg_regs(void)
 }
 static const struct cpuinfo_data arc_cpu_tbl[] = {
+#ifdef CONFIG_ISA_ARCOMPACT
        { {0x20, "ARC 600"      }, 0x2F},
        { {0x30, "ARC 700"      }, 0x33},
        { {0x34, "ARC 700 R4.10"}, 0x34},
        { {0x35, "ARC 700 R4.11"}, 0x35},
-        { {0x50, "ARC HS38"     }, 0x51},
+#else
+        { {0x50, "ARC HS38 R2.0"}, 0x51},
+        { {0x52, "ARC HS38 R2.1"}, 0x52},
+#endif
        { {0x00, NULL           } }
 };
-#define IS_AVAIL1(v, str)       ((v) ? str : "")
+#define IS_AVAIL1(v, s)         ((v) ? s : "")
-#define IS_USED(cfg)            (IS_ENABLED(cfg) ? "" : "(not used) ")
+#define IS_USED_RUN(v)          ((v) ? "" : "(not used) ")
-#define IS_AVAIL2(v, str, cfg)  IS_AVAIL1(v, str), IS_AVAIL1(v, IS_USED(cfg))
+#define IS_USED_CFG(cfg)        IS_USED_RUN(IS_ENABLED(cfg))
+#define IS_AVAIL2(v, s, cfg)    IS_AVAIL1(v, s), IS_AVAIL1(v, IS_USED_CFG(cfg))
 static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
@@ -226,7 +231,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        n += scnprintf(buf + n, len - n, "mpy[opt %d] ", opt);
                }
                n += scnprintf(buf + n, len - n, "%s",
-                               IS_USED(CONFIG_ARC_HAS_HW_MPY));
+                               IS_USED_CFG(CONFIG_ARC_HAS_HW_MPY));
        }
        n += scnprintf(buf + n, len - n, "%s%s%s%s%s%s%s%s\n",
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 807f7d61d7a7..a6f91e88ce36 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -58,7 +58,6 @@ static void show_callee_regs(struct callee_regs *cregs)
 static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
 {
-        struct path path;
        char *path_nm = NULL;
        struct mm_struct *mm;
        struct file *exe_file;
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index b29d62ed4f7e..1cd6695b6ab5 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -468,10 +468,18 @@ static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
 noinline void slc_op(unsigned long paddr, unsigned long sz, const int op)
 {
 #ifdef CONFIG_ISA_ARCV2
+        /*
+         * SLC is shared between all cores and concurrent aux operations from
+         * multiple cores need to be serialized using a spinlock
+         * A concurrent operation can be silently ignored and/or the old/new
+         * operation can remain incomplete forever (lockup in SLC_CTRL_BUSY loop
+         * below)
+         */
+        static DEFINE_SPINLOCK(lock);
        unsigned long flags;
        unsigned int ctrl;
-        local_irq_save(flags);
+        spin_lock_irqsave(&lock, flags);
        /*
         * The Region Flush operation is specified by CTRL.RGN_OP[11..9]
@@ -504,7 +512,7 @@ noinline void slc_op(unsigned long paddr, unsigned long sz, const int op)
        while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
-        local_irq_restore(flags);
+        spin_unlock_irqrestore(&lock, flags);
 #endif
 }
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 74a637a1cfc4..57706a9c6948 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -60,8 +60,8 @@ void *dma_alloc_coherent(struct device *dev, size_t size,
        /* This is kernel Virtual address (0x7000_0000 based) */
        kvaddr = ioremap_nocache((unsigned long)paddr, size);
-        if (kvaddr != NULL)
+        if (kvaddr == NULL)
-                memset(kvaddr, 0, size);
+                return NULL;
        /* This is bus address, platform dependent */
        *dma_handle = (dma_addr_t)paddr;
diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts
index 0d35ab64641c..7106114c7464 100644
--- a/arch/arm/boot/dts/am335x-pepper.dts
+++ b/arch/arm/boot/dts/am335x-pepper.dts
@@ -74,6 +74,7 @@
        audio_codec: tlv320aic3106@1b {
                compatible = "ti,tlv320aic3106";
                reg = <0x1b>;
+                ai3x-micbias-vg = <0x2>;
        };
        accel: lis331dlh@1d {
@@ -153,7 +154,7 @@
        ti,audio-routing =
                "Headphone Jack",       "HPLOUT",
                "Headphone Jack",       "HPROUT",
-                "LINE1L",               "Line In";
+                "MIC3L",                "Mic3L Switch";
 };
 &mcasp0 {
@@ -438,41 +439,50 @@
        regulators {
                dcdc1_reg: regulator@0 {
                        /* VDD_1V8 system supply */
+                        regulator-always-on;
                };
                dcdc2_reg: regulator@1 {
                        /* VDD_CORE voltage limits 0.95V - 1.26V with +/-4% tolerance */
                        regulator-name = "vdd_core";
                        regulator-min-microvolt = <925000>;
-                        regulator-max-microvolt = <1325000>;
+                        regulator-max-microvolt = <1150000>;
                        regulator-boot-on;
+                        regulator-always-on;
                };
                dcdc3_reg: regulator@2 {
                        /* VDD_MPU voltage limits 0.95V - 1.1V with +/-4% tolerance */
                        regulator-name = "vdd_mpu";
                        regulator-min-microvolt = <925000>;
-                        regulator-max-microvolt = <1150000>;
+                        regulator-max-microvolt = <1325000>;
                        regulator-boot-on;
+                        regulator-always-on;
                };
                ldo1_reg: regulator@3 {
                        /* VRTC 1.8V always-on supply */
+                        regulator-name = "vrtc,vdds";
                        regulator-always-on;
                };
                ldo2_reg: regulator@4 {
                        /* 3.3V rail */
+                        regulator-name = "vdd_3v3aux";
+                        regulator-always-on;
                };
                ldo3_reg: regulator@5 {
                        /* VDD_3V3A 3.3V rail */
+                        regulator-name = "vdd_3v3a";
                        regulator-min-microvolt = <3300000>;
                        regulator-max-microvolt = <3300000>;
                };
                ldo4_reg: regulator@6 {
                        /* VDD_3V3B 3.3V rail */
+                        regulator-name = "vdd_3v3b";
+                        regulator-always-on;
                };
        };
 };
diff --git a/arch/arm/boot/dts/cros-ec-keyboard.dtsi b/arch/arm/boot/dts/cros-ec-keyboard.dtsi
index 9c7fb0acae79..4e42f30cb318 100644
--- a/arch/arm/boot/dts/cros-ec-keyboard.dtsi
+++ b/arch/arm/boot/dts/cros-ec-keyboard.dtsi
@@ -22,6 +22,7 @@
                        MATRIX_KEY(0x00, 0x02, KEY_F1)
                        MATRIX_KEY(0x00, 0x03, KEY_B)
                        MATRIX_KEY(0x00, 0x04, KEY_F10)
+                        MATRIX_KEY(0x00, 0x05, KEY_RO)
                        MATRIX_KEY(0x00, 0x06, KEY_N)
                        MATRIX_KEY(0x00, 0x08, KEY_EQUAL)
                        MATRIX_KEY(0x00, 0x0a, KEY_RIGHTALT)
@@ -34,6 +35,7 @@
                        MATRIX_KEY(0x01, 0x08, KEY_APOSTROPHE)
                        MATRIX_KEY(0x01, 0x09, KEY_F9)
                        MATRIX_KEY(0x01, 0x0b, KEY_BACKSPACE)
+                        MATRIX_KEY(0x01, 0x0c, KEY_HENKAN)
                        MATRIX_KEY(0x02, 0x00, KEY_LEFTCTRL)
                        MATRIX_KEY(0x02, 0x01, KEY_TAB)
@@ -45,6 +47,7 @@
                        MATRIX_KEY(0x02, 0x07, KEY_102ND)
                        MATRIX_KEY(0x02, 0x08, KEY_LEFTBRACE)
                        MATRIX_KEY(0x02, 0x09, KEY_F8)
+                        MATRIX_KEY(0x02, 0x0a, KEY_YEN)
                        MATRIX_KEY(0x03, 0x01, KEY_GRAVE)
                        MATRIX_KEY(0x03, 0x02, KEY_F2)
@@ -53,6 +56,7 @@
                        MATRIX_KEY(0x03, 0x06, KEY_6)
                        MATRIX_KEY(0x03, 0x08, KEY_MINUS)
                        MATRIX_KEY(0x03, 0x0b, KEY_BACKSLASH)
+                        MATRIX_KEY(0x03, 0x0c, KEY_MUHENKAN)
                        MATRIX_KEY(0x04, 0x00, KEY_RIGHTCTRL)
                        MATRIX_KEY(0x04, 0x01, KEY_A)
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index aa465904f6cc..096f68be99e2 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -686,7 +686,8 @@
 &dcan1 {
        status = "ok";
-        pinctrl-names = "default", "sleep";
+        pinctrl-names = "default", "sleep", "active";
-        pinctrl-0 = <&dcan1_pins_default>;
+        pinctrl-0 = <&dcan1_pins_sleep>;
        pinctrl-1 = <&dcan1_pins_sleep>;
+        pinctrl-2 = <&dcan1_pins_default>;
 };
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index 4e1b60581782..803738414086 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -587,9 +587,10 @@
 &dcan1 {
        status = "ok";
-        pinctrl-names = "default", "sleep";
+        pinctrl-names = "default", "sleep", "active";
-        pinctrl-0 = <&dcan1_pins_default>;
+        pinctrl-0 = <&dcan1_pins_sleep>;
        pinctrl-1 = <&dcan1_pins_sleep>;
+        pinctrl-2 = <&dcan1_pins_default>;
 };
 &qspi {
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index c892d58e8dad..b995333ea22b 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -468,6 +468,7 @@
                                interrupts = <36 37 38 39 40 41 42 43 44>;
                                status = "disabled";
                                clocks = <&clks 26>;
+                                #io-channel-cells = <1>;
                        };
                        spdif@80054000 {
diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
index dd45e6971bc3..9351296356dc 100644
--- a/arch/arm/boot/dts/imx25-pdk.dts
+++ b/arch/arm/boot/dts/imx25-pdk.dts
@@ -10,6 +10,7 @@
 */
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include "imx25.dtsi"
@@ -114,8 +115,8 @@
 &esdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio2 1 0>;
+        cd-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 0 0>;
+        wp-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index bc215e4b75fd..b69be5c499cf 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -108,7 +108,7 @@
                        };
                        gpt1: timer@10003000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x10003000 0x1000>;
                                interrupts = <26>;
                                clocks = <&clks IMX27_CLK_GPT1_IPG_GATE>,
@@ -117,7 +117,7 @@
                        };
                        gpt2: timer@10004000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x10004000 0x1000>;
                                interrupts = <25>;
                                clocks = <&clks IMX27_CLK_GPT2_IPG_GATE>,
@@ -126,7 +126,7 @@
                        };
                        gpt3: timer@10005000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x10005000 0x1000>;
                                interrupts = <24>;
                                clocks = <&clks IMX27_CLK_GPT3_IPG_GATE>,
@@ -376,7 +376,7 @@
                        };
                        gpt4: timer@10019000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x10019000 0x1000>;
                                interrupts = <4>;
                                clocks = <&clks IMX27_CLK_GPT4_IPG_GATE>,
@@ -385,7 +385,7 @@
                        };
                        gpt5: timer@1001a000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x1001a000 0x1000>;
                                interrupts = <3>;
                                clocks = <&clks IMX27_CLK_GPT5_IPG_GATE>,
@@ -436,7 +436,7 @@
                        };
                        gpt6: timer@1001f000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                reg = <0x1001f000 0x1000>;
                                interrupts = <2>;
                                clocks = <&clks IMX27_CLK_GPT6_IPG_GATE>,
diff --git a/arch/arm/boot/dts/imx51-apf51dev.dts b/arch/arm/boot/dts/imx51-apf51dev.dts
index 93d3ea12328c..0f3fe29b816e 100644
--- a/arch/arm/boot/dts/imx51-apf51dev.dts
+++ b/arch/arm/boot/dts/imx51-apf51dev.dts
@@ -98,7 +98,7 @@
 &esdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio2 29 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
        bus-width = <4>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
index e9337ad52f59..3bc18835fb4b 100644
--- a/arch/arm/boot/dts/imx53-ard.dts
+++ b/arch/arm/boot/dts/imx53-ard.dts
@@ -103,8 +103,8 @@
 &esdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio1 1 0>;
+        cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 9 0>;
+        wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index d0e0f57eb432..53f40885c530 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -124,8 +124,8 @@
 &esdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio1 1 0>;
+        cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 9 0>;
+        wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 181ae5ebf23f..b0d5542ac829 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -147,8 +147,8 @@
 &esdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc3>;
-        cd-gpios = <&gpio3 11 0>;
+        cd-gpios = <&gpio3 11 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio3 12 0>;
+        wp-gpios = <&gpio3 12 GPIO_ACTIVE_HIGH>;
        bus-width = <8>;
        status = "okay";
 };
@@ -295,9 +295,10 @@
 &tve {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_vga_sync>;
+        ddc-i2c-bus = <&i2c2>;
        fsl,tve-mode = "vga";
-        fsl,hsync-pin = <4>;
+        fsl,hsync-pin = <7>;    /* IPU DI1 PIN7 via EIM_OE */
-        fsl,vsync-pin = <6>;
+        fsl,vsync-pin = <8>;    /* IPU DI1 PIN8 via EIM_RW */
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
index 1d325576bcc0..fc89ce1e5763 100644
--- a/arch/arm/boot/dts/imx53-smd.dts
+++ b/arch/arm/boot/dts/imx53-smd.dts
@@ -41,8 +41,8 @@
 &esdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio3 13 0>;
+        cd-gpios = <&gpio3 13 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio4 11 0>;
+        wp-gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
index 4f1f0e2868bf..e03373a58760 100644
--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
+++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
@@ -41,8 +41,8 @@
        pinctrl-0 = <&pinctrl_esdhc2>,
                    <&pinctrl_esdhc2_cdwp>;
        vmmc-supply = <&reg_3p3v>;
-        wp-gpios = <&gpio1 2 0>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
        status = "disabled";
 };
diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
index 704bd72cbfec..d3e50b22064f 100644
--- a/arch/arm/boot/dts/imx53-tx53.dtsi
+++ b/arch/arm/boot/dts/imx53-tx53.dtsi
@@ -183,7 +183,7 @@
 };
 &esdhc1 {
-        cd-gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>;
        fsl,wp-controller;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc1>;
@@ -191,7 +191,7 @@
 };
 &esdhc2 {
-        cd-gpios = <&gpio3 25 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
        fsl,wp-controller;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc2>;
diff --git a/arch/arm/boot/dts/imx53-voipac-bsb.dts b/arch/arm/boot/dts/imx53-voipac-bsb.dts
index c17d3ad6dba5..fc51b87ad208 100644
--- a/arch/arm/boot/dts/imx53-voipac-bsb.dts
+++ b/arch/arm/boot/dts/imx53-voipac-bsb.dts
@@ -119,8 +119,8 @@
 &esdhc2 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_esdhc2>;
-        cd-gpios = <&gpio3 25 0>;
+        cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 19 0>;
+        wp-gpios = <&gpio2 19 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts
index 43cb3fd76be7..5111f5170d53 100644
--- a/arch/arm/boot/dts/imx6dl-riotboard.dts
+++ b/arch/arm/boot/dts/imx6dl-riotboard.dts
@@ -305,8 +305,8 @@
 &usdhc2 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 2 0>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
@@ -314,8 +314,8 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio7 1 0>;
+        wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-arm2.dts b/arch/arm/boot/dts/imx6q-arm2.dts
index 78df05e9d1ce..d6515f7a56c4 100644
--- a/arch/arm/boot/dts/imx6q-arm2.dts
+++ b/arch/arm/boot/dts/imx6q-arm2.dts
@@ -11,6 +11,7 @@
 */
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include "imx6q.dtsi"
 / {
@@ -196,8 +197,8 @@
 };
 &usdhc3 {
-        cd-gpios = <&gpio6 11 0>;
+        cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio6 14 0>;
+        wp-gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3
diff --git a/arch/arm/boot/dts/imx6q-gk802.dts b/arch/arm/boot/dts/imx6q-gk802.dts
index 703539cf36d3..00bd63e63d0c 100644
--- a/arch/arm/boot/dts/imx6q-gk802.dts
+++ b/arch/arm/boot/dts/imx6q-gk802.dts
@@ -7,6 +7,7 @@
 */
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include "imx6q.dtsi"
 / {
@@ -161,7 +162,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
        bus-width = <4>;
-        cd-gpios = <&gpio6 11 0>;
+        cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
index a43abfa21e33..5645d52850a7 100644
--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
+++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
@@ -251,7 +251,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
        bus-width = <4>;
-        cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
@@ -260,7 +260,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
        bus-width = <4>;
-        cd-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
index e6d9195a1da7..f4d6ae564ead 100644
--- a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
@@ -173,7 +173,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc1>;
        vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
@@ -181,7 +181,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
        vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio4 8 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 8 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
index 1d85de2befb3..a47a0399a172 100644
--- a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
@@ -392,7 +392,7 @@
 &usdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
        no-1-8-v;
        status = "okay";
 };
@@ -400,7 +400,7 @@
 &usdhc2 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 5 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
        no-1-8-v;
        status = "okay";
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 59e5d15e3ec4..ff41f83551de 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -258,6 +258,6 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_cubox_i_usdhc2_aux &pinctrl_cubox_i_usdhc2>;
        vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
index 2c253d6d20bd..45e7c39e80d5 100644
--- a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
@@ -1,3 +1,5 @@
+#include <dt-bindings/gpio/gpio.h>
 / {
        regulators {
                compatible = "simple-bus";
@@ -181,7 +183,7 @@
 &usdhc2 { /* module slot */
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio2 2 0>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index b5756c21ea1d..4493f6e99330 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -318,7 +318,7 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index 86f03c1b147c..a857d1294609 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -324,7 +324,7 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index 4a8d97f47759..1afe3385e2d2 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -417,7 +417,7 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
index 62a82f3eba88..6dd0b764e036 100644
--- a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
@@ -299,6 +299,6 @@
                &pinctrl_hummingboard_usdhc2
        >;
        vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
index 3af16dfe417b..d7fe6672d00c 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
@@ -453,7 +453,7 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
@@ -461,7 +461,7 @@
 &usdhc4 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio2 6 0>;
+        cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index 1ce6133b67f5..9e6ecd99b472 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -409,8 +409,8 @@
 &usdhc2 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 2 0>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
        status = "disabled";
 };
@@ -418,7 +418,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3
                     &pinctrl_usdhc3_cdwp>;
-        cd-gpios = <&gpio1 27 0>;
+        cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 29 0>;
+        wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
        status = "disabled";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
index 488a640796ac..3373fd958e95 100644
--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
@@ -342,7 +342,7 @@
        pinctrl-0 = <&pinctrl_usdhc2>;
        bus-width = <4>;
        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 3 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
@@ -351,6 +351,6 @@
        pinctrl-0 = <&pinctrl_usdhc3>;
        bus-width = <4>;
        cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index 3b24b12651b2..e329ca5c3322 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -467,8 +467,8 @@
        pinctrl-0 = <&pinctrl_usdhc3>;
        pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-        cd-gpios = <&gpio6 15 0>;
+        cd-gpios = <&gpio6 15 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio1 13 0>;
+        wp-gpios = <&gpio1 13 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
index e00c44f6a0df..782379320517 100644
--- a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
@@ -448,8 +448,8 @@
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio7 1 0>;
+        wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
@@ -457,7 +457,7 @@
 &usdhc4 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio2 6 0>;
+        cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
        vmmc-supply = <&reg_3p3v>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index a626e6dd8022..944eb81cb2b8 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -562,8 +562,8 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc2>;
        bus-width = <8>;
-        cd-gpios = <&gpio2 2 0>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 3 0>;
+        wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
@@ -571,8 +571,8 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
        bus-width = <8>;
-        cd-gpios = <&gpio2 0 0>;
+        cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 1 0>;
+        wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
index f02b80b41d4f..da08de324e9e 100644
--- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
@@ -680,7 +680,7 @@
        pinctrl-0 = <&pinctrl_usdhc1>;
        bus-width = <4>;
        no-1-8-v;
-        cd-gpios = <&gpio7 2 0>;
+        cd-gpios = <&gpio7 2 GPIO_ACTIVE_LOW>;
        fsl,wp-controller;
        status = "okay";
 };
@@ -690,7 +690,7 @@
        pinctrl-0 = <&pinctrl_usdhc2>;
        bus-width = <4>;
        no-1-8-v;
-        cd-gpios = <&gpio7 3 0>;
+        cd-gpios = <&gpio7 3 GPIO_ACTIVE_LOW>;
        fsl,wp-controller;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
index 5fb091675582..9e096d811bed 100644
--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
@@ -9,6 +9,8 @@
 *
 */
+#include <dt-bindings/gpio/gpio.h>
 / {
        regulators {
                compatible = "simple-bus";
@@ -250,13 +252,13 @@
 &usdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio1 2 0>;
+        cd-gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
 &usdhc3 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio3 9 0>;
+        cd-gpios = <&gpio3 9 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index 945887d3fdb3..b84dff2e94ea 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -617,8 +617,8 @@
        pinctrl-1 = <&pinctrl_usdhc1_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc1_200mhz>;
        bus-width = <8>;
-        cd-gpios = <&gpio4 7 0>;
+        cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio4 6 0>;
+        wp-gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
@@ -627,8 +627,8 @@
        pinctrl-0 = <&pinctrl_usdhc2>;
        pinctrl-1 = <&pinctrl_usdhc2_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc2_200mhz>;
-        cd-gpios = <&gpio5 0 0>;
+        cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio4 29 0>;
+        wp-gpios = <&gpio4 29 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
@@ -637,6 +637,6 @@
        pinctrl-0 = <&pinctrl_usdhc3>;
        pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-        cd-gpios = <&gpio3 22 0>;
+        cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index e3c0b63c2205..115f3fd78971 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -49,7 +49,7 @@
        pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
        bus-width = <8>;
-        cd-gpios = <&gpio7 10 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 10 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
        keep-power-in-suspend;
        enable-sdio-wakeup;
@@ -61,7 +61,7 @@
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc4>;
        bus-width = <8>;
-        cd-gpios = <&gpio7 11 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
        no-1-8-v;
        keep-power-in-suspend;
        enable-sdio-wakup;
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
index cef04cef3a80..ac88c3467078 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
+++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
@@ -293,7 +293,7 @@
        pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
        pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
        bus-width = <8>;
-        cd-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>;
        keep-power-in-suspend;
        enable-sdio-wakeup;
@@ -304,7 +304,7 @@
 &usdhc4 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio6 21 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio6 21 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio6 20 GPIO_ACTIVE_HIGH>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 4d1a4b977d84..fdd1d7c9a5cc 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -234,8 +234,8 @@
 &usdhc1 {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio5 0 0>;
+        cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio5 1 0>;
+        wp-gpios = <&gpio5 1 GPIO_ACTIVE_HIGH>;
        enable-sdio-wakeup;
        keep-power-in-suspend;
        status = "okay";
diff --git a/arch/arm/boot/dts/k2e.dtsi b/arch/arm/boot/dts/k2e.dtsi
index 50e555eab50d..1b6494fbdb91 100644
--- a/arch/arm/boot/dts/k2e.dtsi
+++ b/arch/arm/boot/dts/k2e.dtsi
@@ -86,7 +86,7 @@
                        gpio,syscon-dev = <&devctrl 0x240>;
                };
-                pcie@21020000 {
+                pcie1: pcie@21020000 {
                        compatible = "ti,keystone-pcie","snps,dw-pcie";
                        clocks = <&clkpcie1>;
                        clock-names = "pcie";
@@ -96,6 +96,7 @@
                        ranges = <0x81000000 0 0 0x23260000 0x4000 0x4000
                                0x82000000 0 0x60000000 0x60000000 0 0x10000000>;
+                        status = "disabled";
                        device_type = "pci";
                        num-lanes = <2>;
diff --git a/arch/arm/boot/dts/keystone.dtsi b/arch/arm/boot/dts/keystone.dtsi
index c06542b2c954..e7a6f6deabb6 100644
--- a/arch/arm/boot/dts/keystone.dtsi
+++ b/arch/arm/boot/dts/keystone.dtsi
@@ -286,7 +286,7 @@
                        ti,syscon-dev = <&devctrl 0x2a0>;
                };
-                pcie@21800000 {
+                pcie0: pcie@21800000 {
                        compatible = "ti,keystone-pcie", "snps,dw-pcie";
                        clocks = <&clkpcie>;
                        clock-names = "pcie";
@@ -296,6 +296,7 @@
                        ranges = <0x81000000 0 0 0x23250000 0 0x4000
                                0x82000000 0 0x50000000 0x50000000 0 0x10000000>;
+                        status = "disabled";
                        device_type = "pci";
                        num-lanes = <2>;
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
index 233c69e50ae3..df8908adb0cb 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
@@ -120,7 +120,7 @@
        lcd0: display@0 {
                compatible = "lgphilips,lb035q02";
-                label = "lcd";
+                label = "lcd35";
                reg = <1>;                                      /* CS1 */
                spi-max-frequency = <10000000>;
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
index f5395b7da912..048fd216970a 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
@@ -98,7 +98,7 @@
        lcd0: display@0 {
                compatible = "samsung,lte430wq-f0c", "panel-dpi";
-                label = "lcd";
+                label = "lcd43";
                pinctrl-names = "default";
                pinctrl-0 = <&lte430_pins>;
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index f884d6adb71e..7d31c6ff246f 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -551,6 +551,7 @@
                        reg = <0x4a066000 0x100>;
                        interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
                        ti,hwmods = "mmu_dsp";
+                        #iommu-cells = <0>;
                };
                mmu_ipu: mmu@55082000 {
@@ -558,6 +559,7 @@
                        reg = <0x55082000 0x100>;
                        interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
                        ti,hwmods = "mmu_ipu";
+                        #iommu-cells = <0>;
                        ti,iommu-bus-err-back;
                };
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 7d24ae0306b5..c8fd648a7108 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -612,6 +612,7 @@
                        reg = <0x4a066000 0x100>;
                        interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
                        ti,hwmods = "mmu_dsp";
+                        #iommu-cells = <0>;
                };
                mmu_ipu: mmu@55082000 {
@@ -619,6 +620,7 @@
                        reg = <0x55082000 0x100>;
                        interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
                        ti,hwmods = "mmu_ipu";
+                        #iommu-cells = <0>;
                        ti,iommu-bus-err-back;
                };
diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
index 71468a7eb28f..5e17fd147728 100644
--- a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+++ b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
@@ -60,27 +60,27 @@
        rxc-skew-ps = <2000>;
 };
-&mmc0 {
-        vmmc-supply = <&regulator_3_3v>;
-        vqmmc-supply = <&regulator_3_3v>;
-};
-&usb1 {
-        status = "okay";
-};
 &gpio2 {
        status = "okay";
 };
-&i2c1{
+&i2c1 {
        status = "okay";
-        accel1: accel1@53{
+        accel1: accelerometer@53 {
-                compatible = "adxl34x";
+                compatible = "adi,adxl345";
                reg = <0x53>;
-                interrupt-parent = < &portc >;
+                interrupt-parent = <&portc>;
                interrupts = <3 2>;
        };
 };
+&mmc0 {
+        vmmc-supply = <&regulator_3_3v>;
+        vqmmc-supply = <&regulator_3_3v>;
+};
+&usb1 {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts
index d42c84b1df8d..e48857249ce7 100644
--- a/arch/arm/boot/dts/spear1310-evb.dts
+++ b/arch/arm/boot/dts/spear1310-evb.dts
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr1310 Evaluation Baord
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1310.dtsi b/arch/arm/boot/dts/spear1310.dtsi
index 9d342920695a..54bc6d3cf290 100644
--- a/arch/arm/boot/dts/spear1310.dtsi
+++ b/arch/arm/boot/dts/spear1310.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for all SPEAr1310 SoCs
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1340-evb.dts b/arch/arm/boot/dts/spear1340-evb.dts
index b23e05ed1d60..c611f5606dfe 100644
--- a/arch/arm/boot/dts/spear1340-evb.dts
+++ b/arch/arm/boot/dts/spear1340-evb.dts
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr1340 Evaluation Baord
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi
index 13e1aa33daa2..df2232d767ed 100644
--- a/arch/arm/boot/dts/spear1340.dtsi
+++ b/arch/arm/boot/dts/spear1340.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for all SPEAr1340 SoCs
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
index 40accc87e3a2..14594ce8c18a 100644
--- a/arch/arm/boot/dts/spear13xx.dtsi
+++ b/arch/arm/boot/dts/spear13xx.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for all SPEAr13xx SoCs
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear300-evb.dts b/arch/arm/boot/dts/spear300-evb.dts
index 5de1431653e4..e859e8288bcd 100644
--- a/arch/arm/boot/dts/spear300-evb.dts
+++ b/arch/arm/boot/dts/spear300-evb.dts
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr300 Evaluation Baord
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear300.dtsi b/arch/arm/boot/dts/spear300.dtsi
index f79b3dfaabe6..f4e92e599729 100644
--- a/arch/arm/boot/dts/spear300.dtsi
+++ b/arch/arm/boot/dts/spear300.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr300 SoC
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear310-evb.dts b/arch/arm/boot/dts/spear310-evb.dts
index b09632963d15..070f2c1b7851 100644
--- a/arch/arm/boot/dts/spear310-evb.dts
+++ b/arch/arm/boot/dts/spear310-evb.dts
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr310 Evaluation Baord
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear310.dtsi b/arch/arm/boot/dts/spear310.dtsi
index 95372080eea6..da210b454753 100644
--- a/arch/arm/boot/dts/spear310.dtsi
+++ b/arch/arm/boot/dts/spear310.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr310 SoC
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear320-evb.dts b/arch/arm/boot/dts/spear320-evb.dts
index fdedbb514102..1b1034477923 100644
--- a/arch/arm/boot/dts/spear320-evb.dts
+++ b/arch/arm/boot/dts/spear320-evb.dts
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr320 Evaluation Baord
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear320.dtsi b/arch/arm/boot/dts/spear320.dtsi
index ffea342aeec9..22be6e5edaac 100644
--- a/arch/arm/boot/dts/spear320.dtsi
+++ b/arch/arm/boot/dts/spear320.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for SPEAr320 SoC
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear3xx.dtsi b/arch/arm/boot/dts/spear3xx.dtsi
index f0e3fcf8e323..118135d75899 100644
--- a/arch/arm/boot/dts/spear3xx.dtsi
+++ b/arch/arm/boot/dts/spear3xx.dtsi
@@ -1,7 +1,7 @@
 /*
 * DTS file for all SPEAr3xx SoCs
 *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
 *
 * The code contained herein is licensed under the GNU General Public
 * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/ste-ccu8540.dts b/arch/arm/boot/dts/ste-ccu8540.dts
index 32dd55e5f4e6..6eaaf638e52e 100644
--- a/arch/arm/boot/dts/ste-ccu8540.dts
+++ b/arch/arm/boot/dts/ste-ccu8540.dts
@@ -17,6 +17,13 @@
        model = "ST-Ericsson U8540 platform with Device Tree";
        compatible = "st-ericsson,ccu8540", "st-ericsson,u8540";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
        memory@0 {
                device_type = "memory";
                reg = <0x20000000 0x1f000000>, <0xc0000000 0x3f000000>;
diff --git a/arch/arm/boot/dts/ste-ccu9540.dts b/arch/arm/boot/dts/ste-ccu9540.dts
index 651c56d400a4..c8b815819cfe 100644
--- a/arch/arm/boot/dts/ste-ccu9540.dts
+++ b/arch/arm/boot/dts/ste-ccu9540.dts
@@ -16,6 +16,13 @@
        model = "ST-Ericsson CCU9540 platform with Device Tree";
        compatible = "st-ericsson,ccu9540", "st-ericsson,u9540";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
        memory {
                reg = <0x00000000 0x20000000>;
        };
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 853684ad7773..a75f3289e653 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -971,7 +971,7 @@
                        power-domains = <&pm_domains DOMAIN_VAPE>;
                };
-                uart@80120000 {
+                ux500_serial0: uart@80120000 {
                        compatible = "arm,pl011", "arm,primecell";
                        reg = <0x80120000 0x1000>;
                        interrupts = <0 11 IRQ_TYPE_LEVEL_HIGH>;
@@ -986,7 +986,7 @@
                        status = "disabled";
                };
-                uart@80121000 {
+                ux500_serial1: uart@80121000 {
                        compatible = "arm,pl011", "arm,primecell";
                        reg = <0x80121000 0x1000>;
                        interrupts = <0 19 IRQ_TYPE_LEVEL_HIGH>;
@@ -1001,7 +1001,7 @@
                        status = "disabled";
                };
-                uart@80007000 {
+                ux500_serial2: uart@80007000 {
                        compatible = "arm,pl011", "arm,primecell";
                        reg = <0x80007000 0x1000>;
                        interrupts = <0 26 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index 744c1e3a744d..6d8ce154347e 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -32,11 +32,11 @@
                        status = "okay";
                };
+                /* This UART is unused and thus left disabled */
                uart@80121000 {
                        pinctrl-names = "default", "sleep";
                        pinctrl-0 = <&uart1_default_mode>;
                        pinctrl-1 = <&uart1_sleep_mode>;
-                        status = "okay";
                };
                uart@80007000 {
diff --git a/arch/arm/boot/dts/ste-hrefprev60-stuib.dts b/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
index 2b1cb5b584b6..18e9795a94f9 100644
--- a/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
+++ b/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
@@ -17,6 +17,13 @@
        model = "ST-Ericsson HREF (pre-v60) and ST UIB";
        compatible = "st-ericsson,mop500", "st-ericsson,u8500";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
        soc {
                /* Reset line for the BU21013 touchscreen */
                i2c@80110000 {
diff --git a/arch/arm/boot/dts/ste-hrefprev60-tvk.dts b/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
index 59523f866812..24739914e689 100644
--- a/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
+++ b/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
@@ -16,4 +16,11 @@
 / {
        model = "ST-Ericsson HREF (pre-v60) and TVK1281618 UIB";
        compatible = "st-ericsson,mop500", "st-ericsson,u8500";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
 };
diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
index 7f3975b58d16..b0278f4c486c 100644
--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
+++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
@@ -23,6 +23,11 @@
        };
        soc {
+                /* Enable UART1 on this board */
+                uart@80121000 {
+                        status = "okay";
+                };
                i2c@80004000 {
                        tps61052@33 {
                                compatible = "tps61052";
diff --git a/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts b/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
index 8c6a2de56cf1..c2e1ba019a2f 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
+++ b/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
@@ -19,6 +19,13 @@
        model = "ST-Ericsson HREF (v60+) and ST UIB";
        compatible = "st-ericsson,hrefv60+", "st-ericsson,u8500";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
        soc {
                /* Reset line for the BU21013 touchscreen */
                i2c@80110000 {
diff --git a/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts b/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
index d53cccdce776..ebd8547e98f1 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
+++ b/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
@@ -18,4 +18,11 @@
 / {
        model = "ST-Ericsson HREF (v60+) and TVK1281618 UIB";
        compatible = "st-ericsson,hrefv60+", "st-ericsson,u8500";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
 };
diff --git a/arch/arm/boot/dts/ste-hrefv60plus.dtsi b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
index a4bc9e77d640..810cda743b6d 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus.dtsi
+++ b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
@@ -43,15 +43,26 @@
                                  <&vaudio_hf_hrefv60_mode>,
                                  <&gbf_hrefv60_mode>,
                                  <&hdtv_hrefv60_mode>,
-                                  <&touch_hrefv60_mode>;
+                                  <&touch_hrefv60_mode>,
+                                  <&gpios_hrefv60_mode>;
                        sdi0 {
-                                /* SD card detect GPIO pin, extend default state */
                                sdi0_default_mode: sdi0_default {
+                                        /* SD card detect GPIO pin, extend default state */
                                        default_hrefv60_cfg1 {
                                                pins = "GPIO95_E8";
                                                ste,config = <&gpio_in_pu>;
                                        };
+                                        /* VMMCI level-shifter enable */
+                                        default_hrefv60_cfg2 {
+                                                pins = "GPIO169_D22";
+                                                ste,config = <&gpio_out_lo>;
+                                        };
+                                        /* VMMCI level-shifter voltage select */
+                                        default_hrefv60_cfg3 {
+                                                pins = "GPIO5_AG6";
+                                                ste,config = <&gpio_out_hi>;
+                                        };
                                };
                        };
                        ipgpio {
@@ -213,6 +224,16 @@
                                        };
                                };
                        };
+                        gpios {
+                                /* Dangling GPIO pins */
+                                gpios_hrefv60_mode: gpios_hrefv60 {
+                                        default_cfg1 {
+                                                /* Normally UART1 RXD, now dangling */
+                                                pins = "GPIO4_AH6";
+                                                ste,config = <&in_pu>;
+                                        };
+                                };
+                        };
                };
        };
 };
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index 9edadc37719f..32a5ccb14e7e 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -18,6 +18,13 @@
        model = "Calao Systems Snowball platform with device tree";
        compatible = "calaosystems,snowball-a9500", "st-ericsson,u9500";
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
        memory {
                reg = <0x00000000 0x20000000>;
        };
@@ -223,11 +230,11 @@
                        status = "okay";
                };
+                /* This UART is unused and thus left disabled */
                uart@80121000 {
                        pinctrl-names = "default", "sleep";
                        pinctrl-0 = <&uart1_default_mode>;
                        pinctrl-1 = <&uart1_sleep_mode>;
-                        status = "okay";
                };
                uart@80007000 {
@@ -452,7 +459,21 @@
                                                pins = "GPIO21_AB3"; /* DAT31DIR */
                                                ste,config = <&out_hi>;
                                        };
+                                        /* SD card detect GPIO pin, extend default state */
+                                        snowball_cfg2 {
+                                                pins = "GPIO218_AH11";
+                                                ste,config = <&gpio_in_pu>;
+                                        };
+                                        /* VMMCI level-shifter enable */
+                                        snowball_cfg3 {
+                                                pins = "GPIO217_AH12";
+                                                ste,config = <&gpio_out_lo>;
+                                        };
+                                        /* VMMCI level-shifter voltage select */
+                                        snowball_cfg4 {
+                                                pins = "GPIO228_AJ6";
+                                                ste,config = <&gpio_out_hi>;
+                                        };
                                };
                        };
                        ssp0 {
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 83c50193626c..30b3bc1666d2 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += kdebug.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += param.h
 generic-y += parport.h
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 6f225acc07c5..b7f6fb462ea0 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -286,7 +286,7 @@ extern phys_addr_t (*arch_virt_to_idmap)(unsigned long x);
 */
 static inline phys_addr_t __virt_to_idmap(unsigned long x)
 {
-        if (arch_virt_to_idmap)
+        if (IS_ENABLED(CONFIG_MMU) && arch_virt_to_idmap)
                return arch_virt_to_idmap(x);
        else
                return __virt_to_phys(x);
diff --git a/arch/arm/include/asm/mm-arch-hooks.h b/arch/arm/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 7056660c7cc4..000000000000
--- a/arch/arm/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_ARM_MM_ARCH_HOOKS_H
-#define _ASM_ARM_MM_ARCH_HOOKS_H
-#endif /* _ASM_ARM_MM_ARCH_HOOKS_H */
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 357f57ea83f4..54272e0be713 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -818,12 +818,13 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                        if (arch_find_n_match_cpu_physical_id(dn, cpu, NULL))
                                break;
-                of_node_put(dn);
                if (cpu >= nr_cpu_ids) {
                        pr_warn("Failed to find logical CPU for %s\n",
                                dn->name);
+                        of_node_put(dn);
                        break;
                }
+                of_node_put(dn);
                irqs[i] = cpu;
                cpumask_set_cpu(cpu, &pmu->supported_cpus);
diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
index 1a4d232796be..38269358fd25 100644
--- a/arch/arm/kernel/reboot.c
+++ b/arch/arm/kernel/reboot.c
@@ -50,7 +50,7 @@ static void __soft_restart(void *addr)
        flush_cache_all();
        /* Switch to the identity mapping. */
-        phys_reset = (phys_reset_t)(unsigned long)virt_to_phys(cpu_reset);
+        phys_reset = (phys_reset_t)(unsigned long)virt_to_idmap(cpu_reset);
        phys_reset((unsigned long)addr);
        /* Should never get here. */
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index 80bad29d609a..8c4467fad837 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
        }
 }
-#ifdef CONFIG_PM_GENERIC_DOMAINS
 static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
 {
        int iso, iso2sw;
@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc_onecell_data = {
 static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
 {
        struct clk *clk;
-        bool is_off;
        int i;
        imx6q_pu_domain.reg = pu_reg;
@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
        }
        imx6q_pu_domain.num_clks = i;
-        is_off = IS_ENABLED(CONFIG_PM);
+        /* Enable power always in case bootloader disabled it. */
-        if (is_off) {
+        imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
-                _imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
-        } else {
+        if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
-                /*
+                return 0;
-                 * Enable power if compiled without CONFIG_PM in case the
-                 * bootloader disabled it.
-                 */
-                imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
-        }
-        pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
+        pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
        return of_genpd_add_provider_onecell(dev->of_node,
                                             &imx_gpc_onecell_data);
@@ -437,13 +429,6 @@ clk_err:
        return -EINVAL;
 }
-#else
-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
-{
-        return 0;
-}
-#endif /* CONFIG_PM_GENERIC_DOMAINS */
 static int imx_gpc_probe(struct platform_device *pdev)
 {
        struct regulator *pu_reg;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index ecc04ff13e95..4a023e8d1bdb 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -60,6 +60,7 @@ config SOC_AM43XX
        select ARM_GIC
        select MACH_OMAP_GENERIC
        select MIGHT_HAVE_CACHE_L2X0
+        select HAVE_ARM_SCU
 config SOC_DRA7XX
        bool "TI DRA7XX"
diff --git a/arch/arm/mach-pxa/capc7117.c b/arch/arm/mach-pxa/capc7117.c
index c092730749b9..bf366b39fa61 100644
--- a/arch/arm/mach-pxa/capc7117.c
+++ b/arch/arm/mach-pxa/capc7117.c
@@ -24,6 +24,7 @@
 #include <linux/ata_platform.h>
 #include <linux/serial_8250.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
        capc7117_uarts_init();
        capc7117_ide_init();
+        regulator_has_full_constraints();
 }
 MACHINE_START(CAPC7117,
diff --git a/arch/arm/mach-pxa/cm-x2xx.c b/arch/arm/mach-pxa/cm-x2xx.c
index bb99f59a36d8..a17a91eb8e9a 100644
--- a/arch/arm/mach-pxa/cm-x2xx.c
+++ b/arch/arm/mach-pxa/cm-x2xx.c
@@ -13,6 +13,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 #include <linux/dm9000.h>
 #include <linux/leds.h>
@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
        cmx2xx_init_ac97();
        cmx2xx_init_touchscreen();
        cmx2xx_init_leds();
+        regulator_has_full_constraints();
 }
 static void __init cmx2xx_init_irq(void)
diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
index 4d3588d26c2a..5851f4c254c1 100644
--- a/arch/arm/mach-pxa/cm-x300.c
+++ b/arch/arm/mach-pxa/cm-x300.c
@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
        cm_x300_init_ac97();
        cm_x300_init_wi2wi();
        cm_x300_init_bl();
+        regulator_has_full_constraints();
 }
 static void __init cm_x300_fixup(struct tag *tags, char **cmdline)
diff --git a/arch/arm/mach-pxa/colibri-pxa270.c b/arch/arm/mach-pxa/colibri-pxa270.c
index 5f9d9303b346..3503826333c7 100644
--- a/arch/arm/mach-pxa/colibri-pxa270.c
+++ b/arch/arm/mach-pxa/colibri-pxa270.c
@@ -18,6 +18,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <linux/regulator/machine.h>
 #include <linux/ucb1400.h>
 #include <asm/mach/arch.h>
@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(void)
                printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
                                colibri_pxa270_baseboard);
        }
+        regulator_has_full_constraints();
 }
 /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either
diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
index 51531ecffca8..9d7072b04045 100644
--- a/arch/arm/mach-pxa/em-x270.c
+++ b/arch/arm/mach-pxa/em-x270.c
@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
        em_x270_init_i2c();
        em_x270_init_camera();
        em_x270_userspace_consumers_init();
+        regulator_has_full_constraints();
 }
 MACHINE_START(EM_X270, "Compulab EM-X270")
diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
index c98511c5abd1..9b0eb0252af6 100644
--- a/arch/arm/mach-pxa/icontrol.c
+++ b/arch/arm/mach-pxa/icontrol.c
@@ -26,6 +26,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/pxa2xx_spi.h>
 #include <linux/can/platform/mcp251x.h>
+#include <linux/regulator/machine.h>
 #include "generic.h"
@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
        mxm_8x10_mmc_init();
        icontrol_can_init();
+        regulator_has_full_constraints();
 }
 MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")
diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c
index 872dcb20e757..066e3a250ee0 100644
--- a/arch/arm/mach-pxa/trizeps4.c
+++ b/arch/arm/mach-pxa/trizeps4.c
@@ -26,6 +26,7 @@
 #include <linux/dm9000.h>
 #include <linux/mtd/physmap.h>
 #include <linux/mtd/partitions.h>
+#include <linux/regulator/machine.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <asm/types.h>
@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
        BCR_writew(trizeps_conxs_bcr);
        board_backlight_power(1);
+        regulator_has_full_constraints();
 }
 static void __init trizeps4_map_io(void)
diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
index aa89488f961e..54122a983ae3 100644
--- a/arch/arm/mach-pxa/vpac270.c
+++ b/arch/arm/mach-pxa/vpac270.c
@@ -24,6 +24,7 @@
 #include <linux/dm9000.h>
 #include <linux/ucb1400.h>
 #include <linux/ata_platform.h>
+#include <linux/regulator/machine.h>
 #include <linux/regulator/max1586.h>
 #include <linux/i2c/pxa-i2c.h>
@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
        vpac270_ts_init();
        vpac270_rtc_init();
        vpac270_ide_init();
+        regulator_has_full_constraints();
 }
 MACHINE_START(VPAC270, "Voipac PXA270")
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index ac2ae5c71ab4..6158566fa0f7 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -868,6 +868,8 @@ static void __init zeus_init(void)
        i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
        pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
        spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
+        regulator_has_full_constraints();
 }
 static struct map_desc zeus_io_desc[] __initdata = {
diff --git a/arch/arm/mach-spear/generic.h b/arch/arm/mach-spear/generic.h
index a99d90a4d09c..06640914d9a0 100644
--- a/arch/arm/mach-spear/generic.h
+++ b/arch/arm/mach-spear/generic.h
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2009-2012 ST Microelectronics
 * Rajeev Kumar <rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/irqs.h b/arch/arm/mach-spear/include/mach/irqs.h
index 92da0a8c6bce..7058720c5278 100644
--- a/arch/arm/mach-spear/include/mach/irqs.h
+++ b/arch/arm/mach-spear/include/mach/irqs.h
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2009-2012 ST Microelectronics
 * Rajeev Kumar <rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/misc_regs.h b/arch/arm/mach-spear/include/mach/misc_regs.h
index 935639ce59ba..cfaf7c665b58 100644
--- a/arch/arm/mach-spear/include/mach/misc_regs.h
+++ b/arch/arm/mach-spear/include/mach/misc_regs.h
@@ -4,7 +4,7 @@
 * Miscellaneous registers definitions for SPEAr3xx machine family
 *
 * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/spear.h b/arch/arm/mach-spear/include/mach/spear.h
index f2d6a0176575..5ed841ccf8a3 100644
--- a/arch/arm/mach-spear/include/mach/spear.h
+++ b/arch/arm/mach-spear/include/mach/spear.h
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2009,2012 ST Microelectronics
 * Rajeev Kumar<rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/uncompress.h b/arch/arm/mach-spear/include/mach/uncompress.h
index 51b2dc93e4da..8439b9c12edb 100644
--- a/arch/arm/mach-spear/include/mach/uncompress.h
+++ b/arch/arm/mach-spear/include/mach/uncompress.h
@@ -4,7 +4,7 @@
 * Serial port stubs for kernel decompress status messages
 *
 * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/pl080.c b/arch/arm/mach-spear/pl080.c
index cfa1199d0f4a..b4529f3e0ee9 100644
--- a/arch/arm/mach-spear/pl080.c
+++ b/arch/arm/mach-spear/pl080.c
@@ -4,7 +4,7 @@
 * DMAC pl080 definitions for SPEAr platform
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/pl080.h b/arch/arm/mach-spear/pl080.h
index eb6590ded40d..608dec6725ae 100644
--- a/arch/arm/mach-spear/pl080.h
+++ b/arch/arm/mach-spear/pl080.h
@@ -4,7 +4,7 @@
 * DMAC pl080 definitions for SPEAr platform
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/restart.c b/arch/arm/mach-spear/restart.c
index ce5e098c4888..b4342155a783 100644
--- a/arch/arm/mach-spear/restart.c
+++ b/arch/arm/mach-spear/restart.c
@@ -4,7 +4,7 @@
 * SPEAr platform specific restart functions
 *
 * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear1310.c b/arch/arm/mach-spear/spear1310.c
index d9ce4d8000f0..cd5d375d91f0 100644
--- a/arch/arm/mach-spear/spear1310.c
+++ b/arch/arm/mach-spear/spear1310.c
@@ -4,7 +4,7 @@
 * SPEAr1310 machine source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear1340.c b/arch/arm/mach-spear/spear1340.c
index 3f3c0f124bd3..94594d5a446c 100644
--- a/arch/arm/mach-spear/spear1340.c
+++ b/arch/arm/mach-spear/spear1340.c
@@ -4,7 +4,7 @@
 * SPEAr1340 machine source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear13xx.c b/arch/arm/mach-spear/spear13xx.c
index 2e463a93468d..b7afce6795f4 100644
--- a/arch/arm/mach-spear/spear13xx.c
+++ b/arch/arm/mach-spear/spear13xx.c
@@ -4,7 +4,7 @@
 * SPEAr13XX machines common source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear300.c b/arch/arm/mach-spear/spear300.c
index b52e48f342f4..5b32edda2276 100644
--- a/arch/arm/mach-spear/spear300.c
+++ b/arch/arm/mach-spear/spear300.c
@@ -4,7 +4,7 @@
 * SPEAr300 machine source file
 *
 * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear310.c b/arch/arm/mach-spear/spear310.c
index ed2029db391f..86a44ac7ff67 100644
--- a/arch/arm/mach-spear/spear310.c
+++ b/arch/arm/mach-spear/spear310.c
@@ -4,7 +4,7 @@
 * SPEAr310 machine source file
 *
 * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear320.c b/arch/arm/mach-spear/spear320.c
index bf634b32a930..d45d751926c5 100644
--- a/arch/arm/mach-spear/spear320.c
+++ b/arch/arm/mach-spear/spear320.c
@@ -4,7 +4,7 @@
 * SPEAr320 machine source file
 *
 * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear3xx.c b/arch/arm/mach-spear/spear3xx.c
index bf3b1fd8cb23..23394ac76cf2 100644
--- a/arch/arm/mach-spear/spear3xx.c
+++ b/arch/arm/mach-spear/spear3xx.c
@@ -4,7 +4,7 @@
 * SPEAr3XX machines common source file
 *
 * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 1ced8a0f7a52..cba12f34ff77 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1971,7 +1971,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
 {
        int next_bitmap;
-        if (mapping->nr_bitmaps > mapping->extensions)
+        if (mapping->nr_bitmaps >= mapping->extensions)
                return -EINVAL;
        next_bitmap = mapping->nr_bitmaps;
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0716bbe19872..de2b246fed38 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -274,7 +274,10 @@ __v7_ca15mp_setup:
 __v7_b15mp_setup:
 __v7_ca17mp_setup:
        mov     r10, #0
-1:
+1:      adr     r12, __v7_setup_stack           @ the local stack
+        stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
+        bl      v7_invalidate_l1
+        ldmia   r12, {r0-r5, lr}
 #ifdef CONFIG_SMP
        ALT_SMP(mrc     p15, 0, r0, c1, c0, 1)
        ALT_UP(mov      r0, #(1 << 6))          @ fake it for UP
@@ -283,7 +286,7 @@ __v7_ca17mp_setup:
        orreq   r0, r0, r10                     @ Enable CPU-specific SMP bits
        mcreq   p15, 0, r0, c1, c0, 1
 #endif
-        b       __v7_setup
+        b       __v7_setup_cont
 /*
 * Errata:
@@ -413,10 +416,11 @@ __v7_pj4b_setup:
 __v7_setup:
        adr     r12, __v7_setup_stack           @ the local stack
-        stmia   r12, {r0-r5, r7, r9, r11, lr}
+        stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
        bl      v7_invalidate_l1
-        ldmia   r12, {r0-r5, r7, r9, r11, lr}
+        ldmia   r12, {r0-r5, lr}
+__v7_setup_cont:
        and     r0, r9, #0xff000000             @ ARM?
        teq     r0, #0x41000000
        bne     __errata_finish
@@ -480,7 +484,7 @@ ENDPROC(__v7_setup)
        .align  2
 __v7_setup_stack:
-        .space  4 * 11                          @ 11 registers
+        .space  4 * 7                           @ 12 registers
        __INITDATA
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 4550d247e308..c011e2296cb1 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -74,32 +74,52 @@ struct jit_ctx {
 int bpf_jit_enable __read_mostly;
-static u64 jit_get_skb_b(struct sk_buff *skb, unsigned offset)
+static inline int call_neg_helper(struct sk_buff *skb, int offset, void *ret,
+                      unsigned int size)
+{
+        void *ptr = bpf_internal_load_pointer_neg_helper(skb, offset, size);
+        if (!ptr)
+                return -EFAULT;
+        memcpy(ret, ptr, size);
+        return 0;
+}
+static u64 jit_get_skb_b(struct sk_buff *skb, int offset)
 {
        u8 ret;
        int err;
-        err = skb_copy_bits(skb, offset, &ret, 1);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 1);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 1);
        return (u64)err << 32 | ret;
 }
-static u64 jit_get_skb_h(struct sk_buff *skb, unsigned offset)
+static u64 jit_get_skb_h(struct sk_buff *skb, int offset)
 {
        u16 ret;
        int err;
-        err = skb_copy_bits(skb, offset, &ret, 2);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 2);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 2);
        return (u64)err << 32 | ntohs(ret);
 }
-static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
+static u64 jit_get_skb_w(struct sk_buff *skb, int offset)
 {
        u32 ret;
        int err;
-        err = skb_copy_bits(skb, offset, &ret, 4);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 4);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 4);
        return (u64)err << 32 | ntohl(ret);
 }
@@ -536,9 +556,6 @@ static int build_body(struct jit_ctx *ctx)
                case BPF_LD | BPF_B | BPF_ABS:
                        load_order = 0;
 load:
-                        /* the interpreter will deal with the negative K */
-                        if ((int)k < 0)
-                                return -ENOTSUPP;
                        emit_mov_i(r_off, k, ctx);
 load_common:
                        ctx->seen |= SEEN_DATA | SEEN_CALL;
@@ -547,12 +564,24 @@ load_common:
                                emit(ARM_SUB_I(r_scratch, r_skb_hl,
                                               1 << load_order), ctx);
                                emit(ARM_CMP_R(r_scratch, r_off), ctx);
-                                condt = ARM_COND_HS;
+                                condt = ARM_COND_GE;
                        } else {
                                emit(ARM_CMP_R(r_skb_hl, r_off), ctx);
                                condt = ARM_COND_HI;
                        }
+                        /*
+                         * test for negative offset, only if we are
+                         * currently scheduled to take the fast
+                         * path. this will update the flags so that
+                         * the slowpath instruction are ignored if the
+                         * offset is negative.
+                         *
+                         * for loard_order == 0 the HI condition will
+                         * make loads at offset 0 take the slow path too.
+                         */
+                        _emit(condt, ARM_CMP_I(r_off, 0), ctx);
                        _emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
                              ctx);
@@ -860,9 +889,11 @@ b_epilogue:
                        off = offsetof(struct sk_buff, vlan_tci);
                        emit(ARM_LDRH_I(r_A, r_skb, off), ctx);
                        if (code == (BPF_ANC | SKF_AD_VLAN_TAG))
-                                OP_IMM3(ARM_AND, r_A, r_A, VLAN_VID_MASK, ctx);
+                                OP_IMM3(ARM_AND, r_A, r_A, ~VLAN_TAG_PRESENT, ctx);
-                        else
+                        else {
-                                OP_IMM3(ARM_AND, r_A, r_A, VLAN_TAG_PRESENT, ctx);
+                                OP_IMM3(ARM_LSR, r_A, r_A, 12, ctx);
+                                OP_IMM3(ARM_AND, r_A, r_A, 0x1, ctx);
+                        }
                        break;
                case BPF_ANC | SKF_AD_QUEUE:
                        ctx->seen |= SEEN_SKB;
diff --git a/arch/arm64/include/asm/Kbuild b/arch/arm64/include/asm/Kbuild
index b112a39834d0..70fd9ffb58cf 100644
--- a/arch/arm64/include/asm/Kbuild
+++ b/arch/arm64/include/asm/Kbuild
@@ -25,6 +25,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += msi.h
diff --git a/arch/arm64/include/asm/mm-arch-hooks.h b/arch/arm64/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 562b655f5ba9..000000000000
--- a/arch/arm64/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_ARM64_MM_ARCH_HOOKS_H
-#define _ASM_ARM64_MM_ARCH_HOOKS_H
-#endif /* _ASM_ARM64_MM_ARCH_HOOKS_H */
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 9d4aa18f2a82..e8ca6eaedd02 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -122,12 +122,12 @@ static int __init uefi_init(void)
        /* Show what we know for posterity */
        c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
-                             sizeof(vendor));
+                             sizeof(vendor) * sizeof(efi_char16_t));
        if (c16) {
                for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
                        vendor[i] = c16[i];
                vendor[i] = '\0';
-                early_memunmap(c16, sizeof(vendor));
+                early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
        }
        pr_info("EFI v%u.%.02u by %s\n",
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index f860bfda454a..e16351819fed 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -585,7 +585,8 @@ ENDPROC(el0_irq)
 *
 */
 ENTRY(cpu_switch_to)
-        add     x8, x0, #THREAD_CPU_CONTEXT
+        mov     x10, #THREAD_CPU_CONTEXT
+        add     x8, x0, x10
        mov     x9, sp
        stp     x19, x20, [x8], #16             // store callee-saved registers
        stp     x21, x22, [x8], #16
@@ -594,7 +595,7 @@ ENTRY(cpu_switch_to)
        stp     x27, x28, [x8], #16
        stp     x29, x9, [x8], #16
        str     lr, [x8]
-        add     x8, x1, #THREAD_CPU_CONTEXT
+        add     x8, x1, x10
        ldp     x19, x20, [x8], #16             // restore callee-saved registers
        ldp     x21, x22, [x8], #16
        ldp     x23, x24, [x8], #16
diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
index 240b75c0e94f..463fa2e7e34c 100644
--- a/arch/arm64/kernel/irq.c
+++ b/arch/arm64/kernel/irq.c
@@ -61,7 +61,7 @@ void __init init_IRQ(void)
 static bool migrate_one_irq(struct irq_desc *desc)
 {
        struct irq_data *d = irq_desc_get_irq_data(desc);
-        const struct cpumask *affinity = d->affinity;
+        const struct cpumask *affinity = irq_data_get_affinity_mask(d);
        struct irq_chip *c;
        bool ret = false;
@@ -81,7 +81,7 @@ static bool migrate_one_irq(struct irq_desc *desc)
        if (!c->irq_set_affinity)
                pr_debug("IRQ%u: unable to set affinity\n", d->irq);
        else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
-                cpumask_copy(d->affinity, affinity);
+                cpumask_copy(irq_data_get_affinity_mask(d), affinity);
        return ret;
 }
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index 1d66afdfac07..f61f2dd67464 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -12,6 +12,7 @@ generic-y += irq_work.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += param.h
 generic-y += percpu.h
 generic-y += preempt.h
diff --git a/arch/avr32/include/asm/mm-arch-hooks.h b/arch/avr32/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 145452ffbdad..000000000000
--- a/arch/avr32/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_AVR32_MM_ARCH_HOOKS_H
-#define _ASM_AVR32_MM_ARCH_HOOKS_H
-#endif /* _ASM_AVR32_MM_ARCH_HOOKS_H */
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index d0f771be9e96..a124c55733db 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -18,6 +18,7 @@
 #include <mach/pm.h>
+static bool disable_cpu_idle_poll;
 static cycle_t read_cycle_count(struct clocksource *cs)
 {
@@ -80,45 +81,45 @@ static int comparator_next_event(unsigned long delta,
        return 0;
 }
-static void comparator_mode(enum clock_event_mode mode,
+static int comparator_shutdown(struct clock_event_device *evdev)
-                struct clock_event_device *evdev)
 {
-        switch (mode) {
+        pr_debug("%s: %s\n", __func__, evdev->name);
-        case CLOCK_EVT_MODE_ONESHOT:
+        sysreg_write(COMPARE, 0);
-                pr_debug("%s: start\n", evdev->name);
-                /* FALLTHROUGH */
+        if (disable_cpu_idle_poll) {
-        case CLOCK_EVT_MODE_RESUME:
+                disable_cpu_idle_poll = false;
                /*
-                 * If we're using the COUNT and COMPARE registers we
+                 * Only disable idle poll if we have forced that
-                 * need to force idle poll.
+                 * in a previous call.
                 */
-                cpu_idle_poll_ctrl(true);
+                cpu_idle_poll_ctrl(false);
-                break;
-        case CLOCK_EVT_MODE_UNUSED:
-        case CLOCK_EVT_MODE_SHUTDOWN:
-                sysreg_write(COMPARE, 0);
-                pr_debug("%s: stop\n", evdev->name);
-                if (evdev->mode == CLOCK_EVT_MODE_ONESHOT ||
-                    evdev->mode == CLOCK_EVT_MODE_RESUME) {
-                        /*
-                         * Only disable idle poll if we have forced that
-                         * in a previous call.
-                         */
-                        cpu_idle_poll_ctrl(false);
-                }
-                break;
-        default:
-                BUG();
        }
+        return 0;
+}
+static int comparator_set_oneshot(struct clock_event_device *evdev)
+{
+        pr_debug("%s: %s\n", __func__, evdev->name);
+        disable_cpu_idle_poll = true;
+        /*
+         * If we're using the COUNT and COMPARE registers we
+         * need to force idle poll.
+         */
+        cpu_idle_poll_ctrl(true);
+        return 0;
 }
 static struct clock_event_device comparator = {
-        .name           = "avr32_comparator",
+        .name                   = "avr32_comparator",
-        .features       = CLOCK_EVT_FEAT_ONESHOT,
+        .features               = CLOCK_EVT_FEAT_ONESHOT,
-        .shift          = 16,
+        .shift                  = 16,
-        .rating         = 50,
+        .rating                 = 50,
-        .set_next_event = comparator_next_event,
+        .set_next_event         = comparator_next_event,
-        .set_mode       = comparator_mode,
+        .set_state_shutdown     = comparator_shutdown,
+        .set_state_oneshot      = comparator_set_oneshot,
+        .tick_resume            = comparator_set_oneshot,
 };
 void read_persistent_clock(struct timespec *ts)
diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
index 23b1a97fae7a..52c179bec0cc 100644
--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
 {
        unsigned long flags;
+        if (!clk)
+                return 0;
        spin_lock_irqsave(&clk_lock, flags);
        __clk_enable(clk);
        spin_unlock_irqrestore(&clk_lock, flags);
@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
 {
        unsigned long flags;
+        if (IS_ERR_OR_NULL(clk))
+                return;
        spin_lock_irqsave(&clk_lock, flags);
        __clk_disable(clk);
        spin_unlock_irqrestore(&clk_lock, flags);
@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
        unsigned long flags;
        unsigned long rate;
+        if (!clk)
+                return 0;
        spin_lock_irqsave(&clk_lock, flags);
        rate = clk->get_rate(clk);
        spin_unlock_irqrestore(&clk_lock, flags);
@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
 {
        unsigned long flags, actual_rate;
+        if (!clk)
+                return 0;
        if (!clk->set_rate)
                return -ENOSYS;
@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
        unsigned long flags;
        long ret;
+        if (!clk)
+                return 0;
        if (!clk->set_rate)
                return -ENOSYS;
@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
        unsigned long flags;
        int ret;
+        if (!clk)
+                return 0;
        if (!clk->set_parent)
                return -ENOSYS;
@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
 struct clk *clk_get_parent(struct clk *clk)
 {
-        return clk->parent;
+        return !clk ? NULL : clk->parent;
 }
 EXPORT_SYMBOL(clk_get_parent);
diff --git a/arch/blackfin/include/asm/Kbuild b/arch/blackfin/include/asm/Kbuild
index 07051a63415d..61cd1e786a14 100644
--- a/arch/blackfin/include/asm/Kbuild
+++ b/arch/blackfin/include/asm/Kbuild
@@ -21,6 +21,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += mutex.h
diff --git a/arch/blackfin/include/asm/mm-arch-hooks.h b/arch/blackfin/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 1c5211ec338f..000000000000
--- a/arch/blackfin/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_BLACKFIN_MM_ARCH_HOOKS_H
-#define _ASM_BLACKFIN_MM_ARCH_HOOKS_H
-#endif /* _ASM_BLACKFIN_MM_ARCH_HOOKS_H */
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 7aeb32272975..f17c4dc6050c 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mmu.h
 generic-y += mmu_context.h
diff --git a/arch/c6x/include/asm/mm-arch-hooks.h b/arch/c6x/include/asm/mm-arch-hooks.h
deleted file mode 100644
index bb3c4a6ce8e9..000000000000
--- a/arch/c6x/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_C6X_MM_ARCH_HOOKS_H
-#define _ASM_C6X_MM_ARCH_HOOKS_H
-#endif /* _ASM_C6X_MM_ARCH_HOOKS_H */
diff --git a/arch/cris/include/asm/Kbuild b/arch/cris/include/asm/Kbuild
index d294f6aaff1d..ad2244f35bca 100644
--- a/arch/cris/include/asm/Kbuild
+++ b/arch/cris/include/asm/Kbuild
@@ -18,6 +18,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += percpu.h
 generic-y += preempt.h
diff --git a/arch/cris/include/asm/mm-arch-hooks.h b/arch/cris/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 314f774db2b0..000000000000
--- a/arch/cris/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_CRIS_MM_ARCH_HOOKS_H
-#define _ASM_CRIS_MM_ARCH_HOOKS_H
-#endif /* _ASM_CRIS_MM_ARCH_HOOKS_H */
diff --git a/arch/frv/include/asm/Kbuild b/arch/frv/include/asm/Kbuild
index 30edce31e5c2..8e47b832cc76 100644
--- a/arch/frv/include/asm/Kbuild
+++ b/arch/frv/include/asm/Kbuild
@@ -4,5 +4,6 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
diff --git a/arch/frv/include/asm/mm-arch-hooks.h b/arch/frv/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 51d13a870404..000000000000
--- a/arch/frv/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_FRV_MM_ARCH_HOOKS_H
-#define _ASM_FRV_MM_ARCH_HOOKS_H
-#endif /* _ASM_FRV_MM_ARCH_HOOKS_H */
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index 00379d64f707..70e6ae1e7006 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -33,6 +33,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mmu.h
 generic-y += mmu_context.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 5ade4a163558..daee37bd0999 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -28,6 +28,7 @@ generic-y += kmap_types.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += pci.h
diff --git a/arch/hexagon/include/asm/mm-arch-hooks.h b/arch/hexagon/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 05e8b939e416..000000000000
--- a/arch/hexagon/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_HEXAGON_MM_ARCH_HOOKS_H
-#define _ASM_HEXAGON_MM_ARCH_HOOKS_H
-#endif /* _ASM_HEXAGON_MM_ARCH_HOOKS_H */
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index ccff13d33fa2..9de3ba12f6b9 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -4,6 +4,7 @@ generic-y += exec.h
 generic-y += irq_work.h
 generic-y += kvm_para.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
 generic-y += vtime.h
diff --git a/arch/ia64/include/asm/mm-arch-hooks.h b/arch/ia64/include/asm/mm-arch-hooks.h
deleted file mode 100644
index ab4b5c698322..000000000000
--- a/arch/ia64/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_IA64_MM_ARCH_HOOKS_H
-#define _ASM_IA64_MM_ARCH_HOOKS_H
-#endif /* _ASM_IA64_MM_ARCH_HOOKS_H */
diff --git a/arch/m32r/include/asm/Kbuild b/arch/m32r/include/asm/Kbuild
index ba1cdc018731..e0eb704ca1fa 100644
--- a/arch/m32r/include/asm/Kbuild
+++ b/arch/m32r/include/asm/Kbuild
@@ -4,6 +4,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += preempt.h
 generic-y += sections.h
diff --git a/arch/m32r/include/asm/io.h b/arch/m32r/include/asm/io.h
index 0c3f25ee3381..f8de767ce2bc 100644
--- a/arch/m32r/include/asm/io.h
+++ b/arch/m32r/include/asm/io.h
@@ -174,6 +174,11 @@ static inline void _writel(unsigned long l, unsigned long addr)
 #define iowrite16 writew
 #define iowrite32 writel
+#define ioread16be(addr)        be16_to_cpu(readw(addr))
+#define ioread32be(addr)        be32_to_cpu(readl(addr))
+#define iowrite16be(v, addr)    writew(cpu_to_be16(v), (addr))
+#define iowrite32be(v, addr)    writel(cpu_to_be32(v), (addr))
 #define mmiowb()
 #define flush_write_buffers() do { } while (0)  /* M32R_FIXME */
diff --git a/arch/m32r/include/asm/mm-arch-hooks.h b/arch/m32r/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 6d60b4750f41..000000000000
--- a/arch/m32r/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_M32R_MM_ARCH_HOOKS_H
-#define _ASM_M32R_MM_ARCH_HOOKS_H
-#endif /* _ASM_M32R_MM_ARCH_HOOKS_H */
diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
index 33013dfcd3e1..c496d48a8c8d 100644
--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -125,6 +125,13 @@ endif # M68KCLASSIC
 if COLDFIRE
+choice
+        prompt "ColdFire SoC type"
+        default M520x
+        help
+          Select the type of ColdFire System-on-Chip (SoC) that you want
+          to build for.
 config M5206
        bool "MCF5206"
        depends on !MMU
@@ -174,9 +181,6 @@ config M525x
        help
          Freescale (Motorola) Coldfire 5251/5253 processor support.
-config M527x
-        bool
 config M5271
        bool "MCF5271"
        depends on !MMU
@@ -223,9 +227,6 @@ config M5307
        help
          Motorola ColdFire 5307 processor support.
-config M53xx
-        bool
 config M532x
        bool "MCF532x"
        depends on !MMU
@@ -251,9 +252,6 @@ config M5407
        help
          Motorola ColdFire 5407 processor support.
-config M54xx
-        bool
 config M547x
        bool "MCF547x"
        select M54xx
@@ -280,6 +278,17 @@ config M5441x
        help
          Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
+endchoice
+config M527x
+        bool
+config M53xx
+        bool
+config M54xx
+        bool
 endif # COLDFIRE
@@ -416,22 +425,18 @@ config HAVE_MBAR
 config HAVE_IPSBAR
        bool
-config CLOCK_SET
-        bool "Enable setting the CPU clock frequency"
-        depends on COLDFIRE
-        default n
-        help
-          On some CPU's you do not need to know what the core CPU clock
-          frequency is. On these you can disable clock setting. On some
-          traditional 68K parts, and on all ColdFire parts you need to set
-          the appropriate CPU clock frequency. On these devices many of the
-          onboard peripherals derive their timing from the master CPU clock
-          frequency.
 config CLOCK_FREQ
        int "Set the core clock frequency"
+        default "25000000" if M5206
+        default "54000000" if M5206e
+        default "166666666" if M520x
+        default "140000000" if M5249
+        default "150000000" if M527x || M523x
+        default "90000000" if M5307
+        default "50000000" if M5407
+        default "266000000" if M54xx
        default "66666666"
-        depends on CLOCK_SET
+        depends on COLDFIRE
        help
          Define the CPU clock frequency in use. This is the core clock
          frequency, it may or may not be the same as the external clock
diff --git a/arch/m68k/configs/m5208evb_defconfig b/arch/m68k/configs/m5208evb_defconfig
index e7292f460af4..4c7b7938d53a 100644
--- a/arch/m68k/configs/m5208evb_defconfig
+++ b/arch/m68k/configs/m5208evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,17 +12,12 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_M520x=y
+# CONFIG_MMU is not set
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=166666666
-CONFIG_CLOCK_DIV=2
-CONFIG_M5208EVB=y
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x40000000
 CONFIG_RAMSIZE=0x2000000
 CONFIG_VECTORBASE=0x40000000
 CONFIG_KERNELBASE=0x40020000
-CONFIG_RAM16BIT=y
 CONFIG_BINFMT_FLAT=y
 CONFIG_NET=y
 CONFIG_PACKET=y
@@ -40,24 +31,19 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_BAUDRATE=115200
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
@@ -68,8 +54,6 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_FULLDEBUG=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
+CONFIG_FULLDEBUG=y
diff --git a/arch/m68k/configs/m5249evb_defconfig b/arch/m68k/configs/m5249evb_defconfig
index 0cd4b39f325b..a782f368650f 100644
--- a/arch/m68k/configs/m5249evb_defconfig
+++ b/arch/m68k/configs/m5249evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,10 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5249=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=140000000
-CONFIG_CLOCK_DIV=2
 CONFIG_M5249C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -38,23 +32,18 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -62,7 +51,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5272c3_defconfig b/arch/m68k/configs/m5272c3_defconfig
index a60cb3509135..6f5fb92f5cbf 100644
--- a/arch/m68k/configs/m5272c3_defconfig
+++ b/arch/m68k/configs/m5272c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,8 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5272=y
-CONFIG_CLOCK_SET=y
 CONFIG_M5272C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -36,23 +32,18 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -61,6 +52,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
diff --git a/arch/m68k/configs/m5275evb_defconfig b/arch/m68k/configs/m5275evb_defconfig
index e6502ab7cb2f..b5d7cd1ce856 100644
--- a/arch/m68k/configs/m5275evb_defconfig
+++ b/arch/m68k/configs/m5275evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,11 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5275=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=150000000
-CONFIG_CLOCK_DIV=2
-CONFIG_M5275EVB=y
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00000000
@@ -39,24 +32,19 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -65,8 +53,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5307c3_defconfig b/arch/m68k/configs/m5307c3_defconfig
index 023812abd2e6..1b4c09461c40 100644
--- a/arch/m68k/configs/m5307c3_defconfig
+++ b/arch/m68k/configs/m5307c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,10 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5307=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=90000000
-CONFIG_CLOCK_DIV=2
 CONFIG_M5307C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -38,16 +32,11 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 CONFIG_SLIP=y
 CONFIG_SLIP_COMPRESSED=y
@@ -56,21 +45,17 @@ CONFIG_SLIP_COMPRESSED=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
-# CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
 # CONFIG_DNOTIFY is not set
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_FULLDEBUG=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
+CONFIG_FULLDEBUG=y
diff --git a/arch/m68k/configs/m5407c3_defconfig b/arch/m68k/configs/m5407c3_defconfig
index 557b39f3be90..275ad543d4bc 100644
--- a/arch/m68k/configs/m5407c3_defconfig
+++ b/arch/m68k/configs/m5407c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -17,9 +13,8 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5407=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=50000000
 CONFIG_M5407C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00000000
@@ -38,22 +33,17 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
@@ -63,8 +53,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5475evb_defconfig b/arch/m68k/configs/m5475evb_defconfig
index c5018a68819b..4f4ccd13c11b 100644
--- a/arch/m68k/configs/m5475evb_defconfig
+++ b/arch/m68k/configs/m5475evb_defconfig
@@ -1,11 +1,7 @@
-CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_SYSCTL_SYSCALL=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -20,19 +16,16 @@ CONFIG_MODULES=y
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_COLDFIRE=y
-CONFIG_M547x=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=266000000
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x0
 CONFIG_RAMSIZE=0x2000000
 CONFIG_VECTORBASE=0x0
 CONFIG_MBAR=0xff000000
 CONFIG_KERNELBASE=0x20000
+CONFIG_PCI=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_JEDECPROBE=y
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 1555bc189c7d..eb85bd9c6180 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -18,6 +18,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mutex.h
 generic-y += percpu.h
diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
index c94557b91448..50aa4dac9ca2 100644
--- a/arch/m68k/include/asm/coldfire.h
+++ b/arch/m68k/include/asm/coldfire.h
@@ -19,7 +19,7 @@
 *      in any case new boards come along from time to time that have yet
 *      another different clocking frequency.
 */
-#ifdef CONFIG_CLOCK_SET
+#ifdef CONFIG_CLOCK_FREQ
 #define MCF_CLK         CONFIG_CLOCK_FREQ
 #else
 #error "Don't know what your ColdFire CPU clock frequency is??"
diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h
index 618c85d3c786..f55cad529400 100644
--- a/arch/m68k/include/asm/io_mm.h
+++ b/arch/m68k/include/asm/io_mm.h
@@ -413,7 +413,8 @@ static inline void isa_delay(void)
 #define writew(val, addr)       out_le16((addr), (val))
 #endif /* CONFIG_ATARI_ROM_ISA */
-#if !defined(CONFIG_ISA) && !defined(CONFIG_ATARI_ROM_ISA)
+#if !defined(CONFIG_ISA) && !defined(CONFIG_ATARI_ROM_ISA) && \
+    !(defined(CONFIG_PCI) && defined(CONFIG_COLDFIRE))
 /*
 * We need to define dummy functions for GENERIC_IOMAP support.
 */
diff --git a/arch/m68k/include/asm/mm-arch-hooks.h b/arch/m68k/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 7e8709bc90ae..000000000000
--- a/arch/m68k/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_M68K_MM_ARCH_HOOKS_H
-#define _ASM_M68K_MM_ARCH_HOOKS_H
-#endif /* _ASM_M68K_MM_ARCH_HOOKS_H */
diff --git a/arch/metag/include/asm/Kbuild b/arch/metag/include/asm/Kbuild
index 199320f3c345..df31353fd200 100644
--- a/arch/metag/include/asm/Kbuild
+++ b/arch/metag/include/asm/Kbuild
@@ -25,6 +25,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += param.h
diff --git a/arch/metag/include/asm/mm-arch-hooks.h b/arch/metag/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b0072b2eb0de..000000000000
--- a/arch/metag/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_METAG_MM_ARCH_HOOKS_H
-#define _ASM_METAG_MM_ARCH_HOOKS_H
-#endif /* _ASM_METAG_MM_ARCH_HOOKS_H */
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 9989ddb169ca..2f222f355c4b 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -6,6 +6,7 @@ generic-y += device.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += syscalls.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/asm/mm-arch-hooks.h b/arch/microblaze/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 5c4065911bda..000000000000
--- a/arch/microblaze/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_MICROBLAZE_MM_ARCH_HOOKS_H
-#define _ASM_MICROBLAZE_MM_ARCH_HOOKS_H
-#endif /* _ASM_MICROBLAZE_MM_ARCH_HOOKS_H */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index aab7e46cadd5..cee5f93e5712 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1427,6 +1427,7 @@ config CPU_MIPS64_R6
        select CPU_SUPPORTS_HIGHMEM
        select CPU_SUPPORTS_MSA
        select GENERIC_CSUM
+        select MIPS_O32_FP64_SUPPORT if MIPS32_O32
        help
          Choose this option to build a kernel for release 6 or later of the
          MIPS64 architecture.  New MIPS processors, starting with the Warrior
@@ -2262,11 +2263,6 @@ config MIPS_CM
 config MIPS_CPC
        bool
-config SB1_PASS_1_WORKAROUNDS
-        bool
-        depends on CPU_SB1_PASS_1
-        default y
 config SB1_PASS_2_WORKAROUNDS
        bool
        depends on CPU_SB1 && (CPU_SB1_PASS_2_2 || CPU_SB1_PASS_2)
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index ae2dd59050f7..252e347958f3 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -181,13 +181,6 @@ cflags-$(CONFIG_CPU_R4000_WORKAROUNDS)	+= $(call cc-option,-mfix-r4000,)
 cflags-$(CONFIG_CPU_R4400_WORKAROUNDS)  += $(call cc-option,-mfix-r4400,)
 cflags-$(CONFIG_CPU_DADDI_WORKAROUNDS)  += $(call cc-option,-mno-daddi,)
-ifdef CONFIG_CPU_SB1
-ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
-KBUILD_AFLAGS_MODULE += -msb1-pass1-workarounds
-KBUILD_CFLAGS_MODULE += -msb1-pass1-workarounds
-endif
-endif
 # For smartmips configurations, there are hundreds of warnings due to ISA overrides
 # in assembly and header files. smartmips is only supported for MIPS32r1 onwards
 # and there is no support for 64-bit. Various '.set mips2' or '.set mips3' or
diff --git a/arch/mips/include/asm/Kbuild b/arch/mips/include/asm/Kbuild
index 7fe5c61a3cb8..1f8546081d20 100644
--- a/arch/mips/include/asm/Kbuild
+++ b/arch/mips/include/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += emergency-restart.h
 generic-y += irq_work.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += parport.h
 generic-y += percpu.h
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 084780b355aa..1b0625189835 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                goto fr_common;
        case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
+#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
      || defined(CONFIG_64BIT))
                /* we only have a 32-bit FPU */
                return SIGFPE;
diff --git a/arch/mips/include/asm/mach-sibyte/war.h b/arch/mips/include/asm/mach-sibyte/war.h
index 0a227d426b9c..520f8fc2c806 100644
--- a/arch/mips/include/asm/mach-sibyte/war.h
+++ b/arch/mips/include/asm/mach-sibyte/war.h
@@ -13,8 +13,7 @@
 #define R4600_V2_HIT_CACHEOP_WAR        0
 #define R5432_CP0_INTERRUPT_WAR         0
-#if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
+#if defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
-    defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
 #ifndef __ASSEMBLY__
 extern int sb1250_m3_workaround_needed(void);
diff --git a/arch/mips/include/asm/mm-arch-hooks.h b/arch/mips/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b5609fe8e475..000000000000
--- a/arch/mips/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_MIPS_MM_ARCH_HOOKS_H
-#define _ASM_MIPS_MM_ARCH_HOOKS_H
-#endif /* _ASM_MIPS_MM_ARCH_HOOKS_H */
diff --git a/arch/mips/include/uapi/asm/sigcontext.h b/arch/mips/include/uapi/asm/sigcontext.h
index 6c9906f59c6e..9081d88ae44f 100644
--- a/arch/mips/include/uapi/asm/sigcontext.h
+++ b/arch/mips/include/uapi/asm/sigcontext.h
@@ -16,7 +16,7 @@
 /*
 * Keep this struct definition in sync with the sigcontext fragment
- * in arch/mips/tools/offset.c
+ * in arch/mips/kernel/asm-offsets.c
 */
 struct sigcontext {
        unsigned int            sc_regmask;     /* Unused */
@@ -46,7 +46,7 @@ struct sigcontext {
 #include <linux/posix_types.h>
 /*
 * Keep this struct definition in sync with the sigcontext fragment
- * in arch/mips/tools/offset.c
+ * in arch/mips/kernel/asm-offsets.c
 *
 * Warning: this structure illdefined with sc_badvaddr being just an unsigned
 * int so it was changed to unsigned long in 2.6.0-test1.  This may break
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index beabe19ff8e5..072fab13645d 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -1,5 +1,5 @@
 /*
- * offset.c: Calculate pt_regs and task_struct offsets.
+ * asm-offsets.c: Calculate pt_regs and task_struct offsets.
 *
 * Copyright (C) 1996 David S. Miller
 * Copyright (C) 1997, 1998, 1999, 2000, 2001, 2002, 2003 Ralf Baechle
diff --git a/arch/mips/sibyte/Kconfig b/arch/mips/sibyte/Kconfig
index a8bb972fd9fd..cb9a095f5c5e 100644
--- a/arch/mips/sibyte/Kconfig
+++ b/arch/mips/sibyte/Kconfig
@@ -81,11 +81,6 @@ choice
        prompt "SiByte SOC Stepping"
        depends on SIBYTE_SB1xxx_SOC
-config CPU_SB1_PASS_1
-        bool "1250 Pass1"
-        depends on SIBYTE_SB1250
-        select CPU_HAS_PREFETCH
 config CPU_SB1_PASS_2_1250
        bool "1250 An"
        depends on SIBYTE_SB1250
diff --git a/arch/mips/sibyte/common/bus_watcher.c b/arch/mips/sibyte/common/bus_watcher.c
index 5581844c9194..41a1d2242211 100644
--- a/arch/mips/sibyte/common/bus_watcher.c
+++ b/arch/mips/sibyte/common/bus_watcher.c
@@ -81,10 +81,7 @@ void check_bus_watcher(void)
 {
        u32 status, l2_err, memio_err;
-#ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
+#if defined(CONFIG_SIBYTE_BCM112X) || defined(CONFIG_SIBYTE_SB1250)
-        /* Destructive read, clears register and interrupt */
-        status = csr_in32(IOADDR(A_SCD_BUS_ERR_STATUS));
-#elif defined(CONFIG_SIBYTE_BCM112X) || defined(CONFIG_SIBYTE_SB1250)
        /* Use non-destructive register */
        status = csr_in32(IOADDR(A_SCD_BUS_ERR_STATUS_DEBUG));
 #elif defined(CONFIG_SIBYTE_BCM1x55) || defined(CONFIG_SIBYTE_BCM1x80)
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 3c02b2a77ae9..9d3c24efdf4a 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -202,12 +202,10 @@ void __init sb1250_setup(void)
        switch (war_pass) {
        case K_SYS_REVISION_BCM1250_PASS1:
-#ifndef CONFIG_SB1_PASS_1_WORKAROUNDS
                printk("@@@@ This is a BCM1250 A0-A2 (Pass 1) board, "
                            "and the kernel doesn't have the proper "
                            "workarounds compiled in. @@@@\n");
                bad_config = 1;
-#endif
                break;
        case K_SYS_REVISION_BCM1250_PASS2:
                /* Pass 2 - easiest as default for now - so many numbers */
diff --git a/arch/mn10300/include/asm/Kbuild b/arch/mn10300/include/asm/Kbuild
index de30b0c88796..6edb9ee6128e 100644
--- a/arch/mn10300/include/asm/Kbuild
+++ b/arch/mn10300/include/asm/Kbuild
@@ -5,6 +5,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/mn10300/include/asm/mm-arch-hooks.h b/arch/mn10300/include/asm/mm-arch-hooks.h
deleted file mode 100644
index e2029a652f4c..000000000000
--- a/arch/mn10300/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_MN10300_MM_ARCH_HOOKS_H
-#define _ASM_MN10300_MM_ARCH_HOOKS_H
-#endif /* _ASM_MN10300_MM_ARCH_HOOKS_H */
diff --git a/arch/nios2/include/asm/Kbuild b/arch/nios2/include/asm/Kbuild
index 434639d510b3..914864eb5a25 100644
--- a/arch/nios2/include/asm/Kbuild
+++ b/arch/nios2/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += kmap_types.h
 generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/nios2/include/asm/mm-arch-hooks.h b/arch/nios2/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d7290dc68558..000000000000
--- a/arch/nios2/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_NIOS2_MM_ARCH_HOOKS_H
-#define _ASM_NIOS2_MM_ARCH_HOOKS_H
-#endif /* _ASM_NIOS2_MM_ARCH_HOOKS_H */
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index e5a693b16da2..443f44de1020 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -17,6 +17,7 @@ config OPENRISC
        select GENERIC_IRQ_SHOW
        select GENERIC_IOMAP
        select GENERIC_CPU_DEVICES
+        select HAVE_UID16
        select GENERIC_ATOMIC64
        select GENERIC_CLOCKEVENTS
        select GENERIC_STRNCPY_FROM_USER
@@ -31,9 +32,6 @@ config MMU
 config HAVE_DMA_ATTRS
        def_bool y
-config UID16
-        def_bool y
 config RWSEM_GENERIC_SPINLOCK
        def_bool y
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index 2a2e39b8109a..2832f031fb11 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -36,6 +36,7 @@ generic-y += kmap_types.h
 generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/openrisc/include/asm/mm-arch-hooks.h b/arch/openrisc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 6d33cb555fe1..000000000000
--- a/arch/openrisc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_OPENRISC_MM_ARCH_HOOKS_H
-#define _ASM_OPENRISC_MM_ARCH_HOOKS_H
-#endif /* _ASM_OPENRISC_MM_ARCH_HOOKS_H */
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 12b341d04f88..f9b3a81aefcd 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -15,6 +15,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += param.h
 generic-y += percpu.h
diff --git a/arch/parisc/include/asm/mm-arch-hooks.h b/arch/parisc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 654ec63b0ee9..000000000000
--- a/arch/parisc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_PARISC_MM_ARCH_HOOKS_H
-#define _ASM_PARISC_MM_ARCH_HOOKS_H
-#endif /* _ASM_PARISC_MM_ARCH_HOOKS_H */
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index 3a08eae3318f..3edbb9fc91b4 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-        if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
+        if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
                /*
                 * This is the permanent pmd attached to the pgd;
                 * cannot free it.
@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
                 */
                mm_inc_nr_pmds(mm);
                return;
+        }
        free_pages((unsigned long)pmd, PMD_ORDER);
 }
diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index dc5385ebb071..5ad26dd94d77 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -3,5 +3,6 @@
 generic-y += clkdev.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index cfad7fca01d6..d7697ab802f6 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -57,7 +57,10 @@ union ctlreg0 {
                unsigned long lap  : 1; /* Low-address-protection control */
                unsigned long      : 4;
                unsigned long edat : 1; /* Enhanced-DAT-enablement control */
-                unsigned long      : 23;
+                unsigned long      : 4;
+                unsigned long afp  : 1; /* AFP-register control */
+                unsigned long vx   : 1; /* Vector enablement control */
+                unsigned long      : 17;
        };
 };
diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
index 0130d0379edd..d9be7c0c1291 100644
--- a/arch/s390/include/asm/hugetlb.h
+++ b/arch/s390/include/asm/hugetlb.h
@@ -14,6 +14,7 @@
 #define is_hugepage_only_range(mm, addr, len)   0
 #define hugetlb_free_pgd_range                  free_pgd_range
+#define hugepages_supported()                   (MACHINE_HAS_HPAGE)
 void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
                     pte_t *ptep, pte_t pte);
diff --git a/arch/s390/include/asm/mm-arch-hooks.h b/arch/s390/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 07680b2f3c59..000000000000
--- a/arch/s390/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_S390_MM_ARCH_HOOKS_H
-#define _ASM_S390_MM_ARCH_HOOKS_H
-#endif /* _ASM_S390_MM_ARCH_HOOKS_H */
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index dd345238d9a7..53eacbd4f09b 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -17,10 +17,7 @@
 #define PAGE_DEFAULT_ACC        0
 #define PAGE_DEFAULT_KEY        (PAGE_DEFAULT_ACC << 4)
-#include <asm/setup.h>
+#define HPAGE_SHIFT     20
-#ifndef __ASSEMBLY__
-extern int HPAGE_SHIFT;
 #define HPAGE_SIZE      (1UL << HPAGE_SHIFT)
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
@@ -30,6 +27,9 @@ extern int HPAGE_SHIFT;
 #define ARCH_HAS_PREPARE_HUGEPAGE
 #define ARCH_HAS_HUGEPAGE_CLEAR_FLUSH
+#include <asm/setup.h>
+#ifndef __ASSEMBLY__
 static inline void storage_key_init_range(unsigned long start, unsigned long end)
 {
 #if PAGE_DEFAULT_KEY
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index 4cb19fe76dd9..f897ec73dc8c 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -87,7 +87,15 @@ struct sf_raw_sample {
 } __packed;
 /* Perf hardware reserve and release functions */
+#ifdef CONFIG_PERF_EVENTS
 int perf_reserve_sampling(void);
 void perf_release_sampling(void);
+#else /* CONFIG_PERF_EVENTS */
+static inline int perf_reserve_sampling(void)
+{
+        return 0;
+}
+static inline void perf_release_sampling(void) {}
+#endif /* CONFIG_PERF_EVENTS */
 #endif /* _ASM_S390_PERF_EVENT_H */
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index c7d1b9d09011..a2da259d9327 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -23,15 +23,15 @@
 int main(void)
 {
-        DEFINE(__THREAD_info, offsetof(struct task_struct, stack));
+        DEFINE(__TASK_thread_info, offsetof(struct task_struct, stack));
-        DEFINE(__THREAD_ksp, offsetof(struct task_struct, thread.ksp));
+        DEFINE(__TASK_thread, offsetof(struct task_struct, thread));
-        DEFINE(__THREAD_mm_segment, offsetof(struct task_struct, thread.mm_segment));
-        BLANK();
        DEFINE(__TASK_pid, offsetof(struct task_struct, pid));
        BLANK();
-        DEFINE(__THREAD_per_cause, offsetof(struct task_struct, thread.per_event.cause));
+        DEFINE(__THREAD_ksp, offsetof(struct thread_struct, ksp));
-        DEFINE(__THREAD_per_address, offsetof(struct task_struct, thread.per_event.address));
+        DEFINE(__THREAD_per_cause, offsetof(struct thread_struct, per_event.cause));
-        DEFINE(__THREAD_per_paid, offsetof(struct task_struct, thread.per_event.paid));
+        DEFINE(__THREAD_per_address, offsetof(struct thread_struct, per_event.address));
+        DEFINE(__THREAD_per_paid, offsetof(struct thread_struct, per_event.paid));
+        DEFINE(__THREAD_trap_tdb, offsetof(struct thread_struct, trap_tdb));
        BLANK();
        DEFINE(__TI_task, offsetof(struct thread_info, task));
        DEFINE(__TI_flags, offsetof(struct thread_info, flags));
@@ -176,7 +176,6 @@ int main(void)
        DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
        DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
        DEFINE(__LC_PGM_TDB, offsetof(struct _lowcore, pgm_tdb));
-        DEFINE(__THREAD_trap_tdb, offsetof(struct task_struct, thread.trap_tdb));
        DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
        DEFINE(__SIE_PROG0C, offsetof(struct kvm_s390_sie_block, prog0c));
        DEFINE(__SIE_PROG20, offsetof(struct kvm_s390_sie_block, prog20));
diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
index bff5e3b6d822..8ba32436effe 100644
--- a/arch/s390/kernel/cache.c
+++ b/arch/s390/kernel/cache.c
@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
        union cache_topology ct;
        enum cache_type ctype;
+        if (!test_facility(34))
+                return -EOPNOTSUPP;
        if (!this_cpu_ci)
                return -EINVAL;
        ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 3238893c9d4f..84062e7a77da 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -178,17 +178,21 @@ _PIF_WORK	= (_PIF_PER_TRAP)
 */
 ENTRY(__switch_to)
        stmg    %r6,%r15,__SF_GPRS(%r15)        # store gprs of prev task
-        stg     %r15,__THREAD_ksp(%r2)          # store kernel stack of prev
+        lgr     %r1,%r2
-        lg      %r4,__THREAD_info(%r2)          # get thread_info of prev
+        aghi    %r1,__TASK_thread               # thread_struct of prev task
-        lg      %r5,__THREAD_info(%r3)          # get thread_info of next
+        lg      %r4,__TASK_thread_info(%r2)     # get thread_info of prev
+        lg      %r5,__TASK_thread_info(%r3)     # get thread_info of next
+        stg     %r15,__THREAD_ksp(%r1)          # store kernel stack of prev
+        lgr     %r1,%r3
+        aghi    %r1,__TASK_thread               # thread_struct of next task
        lgr     %r15,%r5
        aghi    %r15,STACK_INIT                 # end of kernel stack of next
        stg     %r3,__LC_CURRENT                # store task struct of next
        stg     %r5,__LC_THREAD_INFO            # store thread info of next
        stg     %r15,__LC_KERNEL_STACK          # store end of kernel stack
+        lg      %r15,__THREAD_ksp(%r1)          # load kernel stack of next
        lctl    %c4,%c4,__TASK_pid(%r3)         # load pid to control reg. 4
        mvc     __LC_CURRENT_PID+4(4,%r0),__TASK_pid(%r3) # store pid of next
-        lg      %r15,__THREAD_ksp(%r3)          # load kernel stack of next
        lmg     %r6,%r15,__SF_GPRS(%r15)        # load gprs of next task
        br      %r14
@@ -417,6 +421,7 @@ ENTRY(pgm_check_handler)
        LAST_BREAK %r14
        lg      %r15,__LC_KERNEL_STACK
        lg      %r14,__TI_task(%r12)
+        aghi    %r14,__TASK_thread      # pointer to thread_struct
        lghi    %r13,__LC_PGM_TDB
        tm      __LC_PGM_ILC+2,0x02     # check for transaction abort
        jz      2f
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index 505c17c0ae1a..56b550893593 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -21,6 +21,7 @@
 #include <asm/nmi.h>
 #include <asm/crw.h>
 #include <asm/switch_to.h>
+#include <asm/ctl_reg.h>
 struct mcck_struct {
        int kill_task;
@@ -129,26 +130,30 @@ static int notrace s390_revalidate_registers(struct mci *mci)
        } else
                asm volatile("lfpc 0(%0)" : : "a" (fpt_creg_save_area));
-        asm volatile(
+        if (!MACHINE_HAS_VX) {
-                "       ld      0,0(%0)\n"
+                /* Revalidate floating point registers */
-                "       ld      1,8(%0)\n"
+                asm volatile(
-                "       ld      2,16(%0)\n"
+                        "       ld      0,0(%0)\n"
-                "       ld      3,24(%0)\n"
+                        "       ld      1,8(%0)\n"
-                "       ld      4,32(%0)\n"
+                        "       ld      2,16(%0)\n"
-                "       ld      5,40(%0)\n"
+                        "       ld      3,24(%0)\n"
-                "       ld      6,48(%0)\n"
+                        "       ld      4,32(%0)\n"
-                "       ld      7,56(%0)\n"
+                        "       ld      5,40(%0)\n"
-                "       ld      8,64(%0)\n"
+                        "       ld      6,48(%0)\n"
-                "       ld      9,72(%0)\n"
+                        "       ld      7,56(%0)\n"
-                "       ld      10,80(%0)\n"
+                        "       ld      8,64(%0)\n"
-                "       ld      11,88(%0)\n"
+                        "       ld      9,72(%0)\n"
-                "       ld      12,96(%0)\n"
+                        "       ld      10,80(%0)\n"
-                "       ld      13,104(%0)\n"
+                        "       ld      11,88(%0)\n"
-                "       ld      14,112(%0)\n"
+                        "       ld      12,96(%0)\n"
-                "       ld      15,120(%0)\n"
+                        "       ld      13,104(%0)\n"
-                : : "a" (fpt_save_area));
+                        "       ld      14,112(%0)\n"
-        /* Revalidate vector registers */
+                        "       ld      15,120(%0)\n"
-        if (MACHINE_HAS_VX && current->thread.vxrs) {
+                        : : "a" (fpt_save_area));
+        } else {
+                /* Revalidate vector registers */
+                union ctlreg0 cr0;
                if (!mci->vr) {
                        /*
                         * Vector registers can't be restored and therefore
@@ -156,8 +161,12 @@ static int notrace s390_revalidate_registers(struct mci *mci)
                         */
                        kill_task = 1;
                }
+                cr0.val = S390_lowcore.cregs_save_area[0];
+                cr0.afp = cr0.vx = 1;
+                __ctl_load(cr0.val, 0, 0);
                restore_vx_regs((__vector128 *)
-                                S390_lowcore.vector_save_area_addr);
+                                &S390_lowcore.vector_save_area);
+                __ctl_load(S390_lowcore.cregs_save_area[0], 0, 0);
        }
        /* Revalidate access registers */
        asm volatile(
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index dc5edc29b73a..8f587d871b9f 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
 asmlinkage void execve_tail(void)
 {
        current->thread.fp_regs.fpc = 0;
-        asm volatile("sfpc %0,%0" : : "d" (0));
+        asm volatile("sfpc %0" : : "d" (0));
 }
 /*
diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
index 43c3169ea49c..ada0c07fe1a8 100644
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
        jno     .Lesa2
        ahi     %r15,-80
        stmh    %r6,%r15,96(%r15)               # store upper register halves
+        basr    %r13,0
+        lmh     %r0,%r15,.Lzeroes-.(%r13)       # clear upper register halves
 .Lesa2:
        lr      %r10,%r2                        # save string pointer
        lhi     %r2,0
@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
 .Lesa3:
        lm      %r6,%r15,120(%r15)              # restore registers
        br      %r14
+.Lzeroes:
+        .fill   64,4,0
 .LwritedataS4:
        .long   0x00760005                      # SCLP command for write data
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index f7f027caaaaa..ca070d260af2 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -885,8 +885,6 @@ void __init setup_arch(char **cmdline_p)
         */
        setup_hwcaps();
-        HPAGE_SHIFT = MACHINE_HAS_HPAGE ? 20 : 0;
        /*
         * Create kernel page tables and switch to virtual addressing.
         */
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 4d96c9f53455..7bea81d8a363 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -259,7 +259,7 @@ void vector_exception(struct pt_regs *regs)
        }
        /* get vector interrupt code from fpc */
-        asm volatile("stfpc %0" : "=m" (current->thread.fp_regs.fpc));
+        asm volatile("stfpc %0" : "=Q" (current->thread.fp_regs.fpc));
        vic = (current->thread.fp_regs.fpc & 0xf00) >> 8;
        switch (vic) {
        case 1: /* invalid vector operation */
@@ -297,7 +297,7 @@ void data_exception(struct pt_regs *regs)
        location = get_trap_ip(regs);
-        asm volatile("stfpc %0" : "=m" (current->thread.fp_regs.fpc));
+        asm volatile("stfpc %0" : "=Q" (current->thread.fp_regs.fpc));
        /* Check for vector register enablement */
        if (MACHINE_HAS_VX && !current->thread.vxrs &&
            (current->thread.fp_regs.fpc & FPC_DXC_MASK) == 0xfe00) {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 33082d0d101b..b33f66110ca9 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -31,8 +31,6 @@
 #define ALLOC_ORDER     2
 #define FRAG_MASK       0x03
-int HPAGE_SHIFT;
 unsigned long *crst_table_alloc(struct mm_struct *mm)
 {
        struct page *page = alloc_pages(GFP_KERNEL, ALLOC_ORDER);
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index fee782acc2ee..8d2e5165865f 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -448,13 +448,13 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
                EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
                              BPF_REG_1, offsetof(struct sk_buff, data));
        }
-        /* BPF compatibility: clear A (%b7) and X (%b8) registers */
+        /* BPF compatibility: clear A (%b0) and X (%b7) registers */
-        if (REG_SEEN(BPF_REG_7))
+        if (REG_SEEN(BPF_REG_A))
-                /* lghi %b7,0 */
+                /* lghi %ba,0 */
-                EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
+                EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
-        if (REG_SEEN(BPF_REG_8))
+        if (REG_SEEN(BPF_REG_X))
-                /* lghi %b8,0 */
+                /* lghi %bx,0 */
-                EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
+                EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
 }
 /*
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index bc927a09a172..9cfa2ffaa9d6 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -16,6 +16,7 @@
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <asm/processor.h>
+#include <asm/perf_event.h>
 #include "../../../drivers/oprofile/oprof.h"
diff --git a/arch/score/include/asm/Kbuild b/arch/score/include/asm/Kbuild
index 138fb3db45ba..92ffe397b893 100644
--- a/arch/score/include/asm/Kbuild
+++ b/arch/score/include/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += clkdev.h
 generic-y += cputime.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/score/include/asm/mm-arch-hooks.h b/arch/score/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 5e38689f189a..000000000000
--- a/arch/score/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_SCORE_MM_ARCH_HOOKS_H
-#define _ASM_SCORE_MM_ARCH_HOOKS_H
-#endif /* _ASM_SCORE_MM_ARCH_HOOKS_H */
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 9ac4626e7284..aac452b26aa8 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -16,6 +16,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/sh/include/asm/mm-arch-hooks.h b/arch/sh/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 18087298b728..000000000000
--- a/arch/sh/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_SH_MM_ARCH_HOOKS_H
-#define _ASM_SH_MM_ARCH_HOOKS_H
-#endif /* _ASM_SH_MM_ARCH_HOOKS_H */
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index 2b2a69dcc467..e928618838bc 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -12,6 +12,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += mutex.h
 generic-y += preempt.h
diff --git a/arch/sparc/include/asm/mm-arch-hooks.h b/arch/sparc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b89ba44c16f1..000000000000
--- a/arch/sparc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_SPARC_MM_ARCH_HOOKS_H
-#define _ASM_SPARC_MM_ARCH_HOOKS_H
-#endif /* _ASM_SPARC_MM_ARCH_HOOKS_H */
diff --git a/arch/tile/include/asm/Kbuild b/arch/tile/include/asm/Kbuild
index d53654488c2c..d8a843163471 100644
--- a/arch/tile/include/asm/Kbuild
+++ b/arch/tile/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += irq_regs.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += param.h
diff --git a/arch/tile/include/asm/mm-arch-hooks.h b/arch/tile/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d1709ea774f7..000000000000
--- a/arch/tile/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_TILE_MM_ARCH_HOOKS_H
-#define _ASM_TILE_MM_ARCH_HOOKS_H
-#endif /* _ASM_TILE_MM_ARCH_HOOKS_H */
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 99c9ff87e018..6b755d125783 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
 void __init free_initrd_mem(unsigned long begin, unsigned long end)
 {
-        free_bootmem(__pa(begin), end - begin);
+        free_bootmem_late(__pa(begin), end - begin);
 }
 static int __init setup_initrd(char *str)
diff --git a/arch/um/include/asm/Kbuild b/arch/um/include/asm/Kbuild
index 3d63ff6f583f..149ec55f9c46 100644
--- a/arch/um/include/asm/Kbuild
+++ b/arch/um/include/asm/Kbuild
@@ -16,6 +16,7 @@ generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += param.h
 generic-y += pci.h
diff --git a/arch/um/include/asm/mm-arch-hooks.h b/arch/um/include/asm/mm-arch-hooks.h
deleted file mode 100644
index a7c8b0dfdd4e..000000000000
--- a/arch/um/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_UM_MM_ARCH_HOOKS_H
-#define _ASM_UM_MM_ARCH_HOOKS_H
-#endif /* _ASM_UM_MM_ARCH_HOOKS_H */
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index d12b377b5a8b..1fc7a286dc6f 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/unicore32/include/asm/mm-arch-hooks.h b/arch/unicore32/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 4d79a850c509..000000000000
--- a/arch/unicore32/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_UNICORE32_MM_ARCH_HOOKS_H
-#define _ASM_UNICORE32_MM_ARCH_HOOKS_H
-#endif /* _ASM_UNICORE32_MM_ARCH_HOOKS_H */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 3dbb7e7909ca..b3a1a5d77d92 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -41,6 +41,7 @@ config X86
        select ARCH_USE_CMPXCHG_LOCKREF         if X86_64
        select ARCH_USE_QUEUED_RWLOCKS
        select ARCH_USE_QUEUED_SPINLOCKS
+        select ARCH_WANTS_DYNAMIC_TASK_STRUCT
        select ARCH_WANT_FRAME_POINTERS
        select ARCH_WANT_IPC_PARSE_VERSION      if X86_32
        select ARCH_WANT_OPTIONAL_GPIOLIB
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index a15893d17c55..d8c0d3266173 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -297,6 +297,18 @@ config OPTIMIZE_INLINING
          If unsure, say N.
+config DEBUG_ENTRY
+        bool "Debug low-level entry code"
+        depends on DEBUG_KERNEL
+        ---help---
+          This option enables sanity checks in x86's low-level entry code.
+          Some of these sanity checks may slow down kernel entries and
+          exits or otherwise impact performance.
+          This is currently used to help test NMI code.
+          If unsure, say N.
 config DEBUG_NMI_SELFTEST
        bool "NMI Selftest"
        depends on DEBUG_KERNEL && X86_LOCAL_APIC
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 3bb2c4302df1..8cb3e438f21e 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1237,11 +1237,12 @@ ENTRY(nmi)
         *  If the variable is not set and the stack is not the NMI
         *  stack then:
         *    o Set the special variable on the stack
-         *    o Copy the interrupt frame into a "saved" location on the stack
+         *    o Copy the interrupt frame into an "outermost" location on the
-         *    o Copy the interrupt frame into a "copy" location on the stack
+         *      stack
+         *    o Copy the interrupt frame into an "iret" location on the stack
         *    o Continue processing the NMI
         *  If the variable is set or the previous stack is the NMI stack:
-         *    o Modify the "copy" location to jump to the repeate_nmi
+         *    o Modify the "iret" location to jump to the repeat_nmi
         *    o return back to the first NMI
         *
         * Now on exit of the first NMI, we first clear the stack variable
@@ -1250,31 +1251,151 @@ ENTRY(nmi)
         * a nested NMI that updated the copy interrupt stack frame, a
         * jump will be made to the repeat_nmi code that will handle the second
         * NMI.
+         *
+         * However, espfix prevents us from directly returning to userspace
+         * with a single IRET instruction.  Similarly, IRET to user mode
+         * can fault.  We therefore handle NMIs from user space like
+         * other IST entries.
         */
        /* Use %rdx as our temp variable throughout */
        pushq   %rdx
+        testb   $3, CS-RIP+8(%rsp)
+        jz      .Lnmi_from_kernel
+        /*
+         * NMI from user mode.  We need to run on the thread stack, but we
+         * can't go through the normal entry paths: NMIs are masked, and
+         * we don't want to enable interrupts, because then we'll end
+         * up in an awkward situation in which IRQs are on but NMIs
+         * are off.
+         */
+        SWAPGS
+        cld
+        movq    %rsp, %rdx
+        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+        pushq   5*8(%rdx)       /* pt_regs->ss */
+        pushq   4*8(%rdx)       /* pt_regs->rsp */
+        pushq   3*8(%rdx)       /* pt_regs->flags */
+        pushq   2*8(%rdx)       /* pt_regs->cs */
+        pushq   1*8(%rdx)       /* pt_regs->rip */
+        pushq   $-1             /* pt_regs->orig_ax */
+        pushq   %rdi            /* pt_regs->di */
+        pushq   %rsi            /* pt_regs->si */
+        pushq   (%rdx)          /* pt_regs->dx */
+        pushq   %rcx            /* pt_regs->cx */
+        pushq   %rax            /* pt_regs->ax */
+        pushq   %r8             /* pt_regs->r8 */
+        pushq   %r9             /* pt_regs->r9 */
+        pushq   %r10            /* pt_regs->r10 */
+        pushq   %r11            /* pt_regs->r11 */
+        pushq   %rbx            /* pt_regs->rbx */
+        pushq   %rbp            /* pt_regs->rbp */
+        pushq   %r12            /* pt_regs->r12 */
+        pushq   %r13            /* pt_regs->r13 */
+        pushq   %r14            /* pt_regs->r14 */
+        pushq   %r15            /* pt_regs->r15 */
+        /*
+         * At this point we no longer need to worry about stack damage
+         * due to nesting -- we're on the normal thread stack and we're
+         * done with the NMI stack.
+         */
+        movq    %rsp, %rdi
+        movq    $-1, %rsi
+        call    do_nmi
+        /*
+         * Return back to user mode.  We must *not* do the normal exit
+         * work, because we don't want to enable interrupts.  Fortunately,
+         * do_nmi doesn't modify pt_regs.
+         */
+        SWAPGS
+        jmp     restore_c_regs_and_iret
+.Lnmi_from_kernel:
+        /*
+         * Here's what our stack frame will look like:
+         * +---------------------------------------------------------+
+         * | original SS                                             |
+         * | original Return RSP                                     |
+         * | original RFLAGS                                         |
+         * | original CS                                             |
+         * | original RIP                                            |
+         * +---------------------------------------------------------+
+         * | temp storage for rdx                                    |
+         * +---------------------------------------------------------+
+         * | "NMI executing" variable                                |
+         * +---------------------------------------------------------+
+         * | iret SS          } Copied from "outermost" frame        |
+         * | iret Return RSP  } on each loop iteration; overwritten  |
+         * | iret RFLAGS      } by a nested NMI to force another     |
+         * | iret CS          } iteration if needed.                 |
+         * | iret RIP         }                                      |
+         * +---------------------------------------------------------+
+         * | outermost SS          } initialized in first_nmi;       |
+         * | outermost Return RSP  } will not be changed before      |
+         * | outermost RFLAGS      } NMI processing is done.         |
+         * | outermost CS          } Copied to "iret" frame on each  |
+         * | outermost RIP         } iteration.                      |
+         * +---------------------------------------------------------+
+         * | pt_regs                                                 |
+         * +---------------------------------------------------------+
+         *
+         * The "original" frame is used by hardware.  Before re-enabling
+         * NMIs, we need to be done with it, and we need to leave enough
+         * space for the asm code here.
+         *
+         * We return by executing IRET while RSP points to the "iret" frame.
+         * That will either return for real or it will loop back into NMI
+         * processing.
+         *
+         * The "outermost" frame is copied to the "iret" frame on each
+         * iteration of the loop, so each iteration starts with the "iret"
+         * frame pointing to the final return target.
+         */
        /*
-         * If %cs was not the kernel segment, then the NMI triggered in user
+         * Determine whether we're a nested NMI.
-         * space, which means it is definitely not nested.
+         *
+         * If we interrupted kernel code between repeat_nmi and
+         * end_repeat_nmi, then we are a nested NMI.  We must not
+         * modify the "iret" frame because it's being written by
+         * the outer NMI.  That's okay; the outer NMI handler is
+         * about to about to call do_nmi anyway, so we can just
+         * resume the outer NMI.
         */
-        cmpl    $__KERNEL_CS, 16(%rsp)
-        jne     first_nmi
+        movq    $repeat_nmi, %rdx
+        cmpq    8(%rsp), %rdx
+        ja      1f
+        movq    $end_repeat_nmi, %rdx
+        cmpq    8(%rsp), %rdx
+        ja      nested_nmi_out
+1:
        /*
-         * Check the special variable on the stack to see if NMIs are
+         * Now check "NMI executing".  If it's set, then we're nested.
-         * executing.
+         * This will not detect if we interrupted an outer NMI just
+         * before IRET.
         */
        cmpl    $1, -8(%rsp)
        je      nested_nmi
        /*
-         * Now test if the previous stack was an NMI stack.
+         * Now test if the previous stack was an NMI stack.  This covers
-         * We need the double check. We check the NMI stack to satisfy the
+         * the case where we interrupt an outer NMI after it clears
-         * race when the first NMI clears the variable before returning.
+         * "NMI executing" but before IRET.  We need to be careful, though:
-         * We check the variable because the first NMI could be in a
+         * there is one case in which RSP could point to the NMI stack
-         * breakpoint routine using a breakpoint stack.
+         * despite there being no NMI active: naughty userspace controls
+         * RSP at the very beginning of the SYSCALL targets.  We can
+         * pull a fast one on naughty userspace, though: we program
+         * SYSCALL to mask DF, so userspace cannot cause DF to be set
+         * if it controls the kernel's RSP.  We set DF before we clear
+         * "NMI executing".
         */
        lea     6*8(%rsp), %rdx
        /* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
@@ -1286,25 +1407,20 @@ ENTRY(nmi)
        cmpq    %rdx, 4*8(%rsp)
        /* If it is below the NMI stack, it is a normal NMI */
        jb      first_nmi
-        /* Ah, it is within the NMI stack, treat it as nested */
+        /* Ah, it is within the NMI stack. */
+        testb   $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
+        jz      first_nmi       /* RSP was user controlled. */
+        /* This is a nested NMI. */
 nested_nmi:
        /*
-         * Do nothing if we interrupted the fixup in repeat_nmi.
+         * Modify the "iret" frame to point to repeat_nmi, forcing another
-         * It's about to repeat the NMI handler, so we are fine
+         * iteration of NMI handling.
-         * with ignoring this one.
         */
-        movq    $repeat_nmi, %rdx
+        subq    $8, %rsp
-        cmpq    8(%rsp), %rdx
-        ja      1f
-        movq    $end_repeat_nmi, %rdx
-        cmpq    8(%rsp), %rdx
-        ja      nested_nmi_out
-1:
-        /* Set up the interrupted NMIs stack to jump to repeat_nmi */
-        leaq    -1*8(%rsp), %rdx
-        movq    %rdx, %rsp
        leaq    -10*8(%rsp), %rdx
        pushq   $__KERNEL_DS
        pushq   %rdx
@@ -1318,61 +1434,42 @@ nested_nmi:
 nested_nmi_out:
        popq    %rdx
-        /* No need to check faults here */
+        /* We are returning to kernel mode, so this cannot result in a fault. */
        INTERRUPT_RETURN
 first_nmi:
-        /*
+        /* Restore rdx. */
-         * Because nested NMIs will use the pushed location that we
-         * stored in rdx, we must keep that space available.
-         * Here's what our stack frame will look like:
-         * +-------------------------+
-         * | original SS             |
-         * | original Return RSP     |
-         * | original RFLAGS         |
-         * | original CS             |
-         * | original RIP            |
-         * +-------------------------+
-         * | temp storage for rdx    |
-         * +-------------------------+
-         * | NMI executing variable  |
-         * +-------------------------+
-         * | copied SS               |
-         * | copied Return RSP       |
-         * | copied RFLAGS           |
-         * | copied CS               |
-         * | copied RIP              |
-         * +-------------------------+
-         * | Saved SS                |
-         * | Saved Return RSP        |
-         * | Saved RFLAGS            |
-         * | Saved CS                |
-         * | Saved RIP               |
-         * +-------------------------+
-         * | pt_regs                 |
-         * +-------------------------+
-         *
-         * The saved stack frame is used to fix up the copied stack frame
-         * that a nested NMI may change to make the interrupted NMI iret jump
-         * to the repeat_nmi. The original stack frame and the temp storage
-         * is also used by nested NMIs and can not be trusted on exit.
-         */
-        /* Do not pop rdx, nested NMIs will corrupt that part of the stack */
        movq    (%rsp), %rdx
-        /* Set the NMI executing variable on the stack. */
+        /* Make room for "NMI executing". */
-        pushq   $1
+        pushq   $0
-        /* Leave room for the "copied" frame */
+        /* Leave room for the "iret" frame */
        subq    $(5*8), %rsp
-        /* Copy the stack frame to the Saved frame */
+        /* Copy the "original" frame to the "outermost" frame */
        .rept 5
        pushq   11*8(%rsp)
        .endr
        /* Everything up to here is safe from nested NMIs */
+#ifdef CONFIG_DEBUG_ENTRY
+        /*
+         * For ease of testing, unmask NMIs right away.  Disabled by
+         * default because IRET is very expensive.
+         */
+        pushq   $0              /* SS */
+        pushq   %rsp            /* RSP (minus 8 because of the previous push) */
+        addq    $8, (%rsp)      /* Fix up RSP */
+        pushfq                  /* RFLAGS */
+        pushq   $__KERNEL_CS    /* CS */
+        pushq   $1f             /* RIP */
+        INTERRUPT_RETURN        /* continues at repeat_nmi below */
+1:
+#endif
+repeat_nmi:
        /*
         * If there was a nested NMI, the first NMI's iret will return
         * here. But NMIs are still enabled and we can take another
@@ -1381,16 +1478,20 @@ first_nmi:
         * it will just return, as we are about to repeat an NMI anyway.
         * This makes it safe to copy to the stack frame that a nested
         * NMI will update.
+         *
+         * RSP is pointing to "outermost RIP".  gsbase is unknown, but, if
+         * we're repeating an NMI, gsbase has the same value that it had on
+         * the first iteration.  paranoid_entry will load the kernel
+         * gsbase if needed before we call do_nmi.  "NMI executing"
+         * is zero.
         */
-repeat_nmi:
+        movq    $1, 10*8(%rsp)          /* Set "NMI executing". */
        /*
-         * Update the stack variable to say we are still in NMI (the update
+         * Copy the "outermost" frame to the "iret" frame.  NMIs that nest
-         * is benign for the non-repeat case, where 1 was pushed just above
+         * here must not modify the "iret" frame while we're writing to
-         * to this very stack slot).
+         * it or it will end up containing garbage.
         */
-        movq    $1, 10*8(%rsp)
-        /* Make another copy, this one may be modified by nested NMIs */
        addq    $(10*8), %rsp
        .rept 5
        pushq   -6*8(%rsp)
@@ -1399,9 +1500,9 @@ repeat_nmi:
 end_repeat_nmi:
        /*
-         * Everything below this point can be preempted by a nested
+         * Everything below this point can be preempted by a nested NMI.
-         * NMI if the first NMI took an exception and reset our iret stack
+         * If this happens, then the inner NMI will change the "iret"
-         * so that we repeat another NMI.
+         * frame to point back to repeat_nmi.
         */
        pushq   $-1                             /* ORIG_RAX: no syscall to restart */
        ALLOC_PT_GPREGS_ON_STACK
@@ -1415,28 +1516,11 @@ end_repeat_nmi:
         */
        call    paranoid_entry
-        /*
-         * Save off the CR2 register. If we take a page fault in the NMI then
-         * it could corrupt the CR2 value. If the NMI preempts a page fault
-         * handler before it was able to read the CR2 register, and then the
-         * NMI itself takes a page fault, the page fault that was preempted
-         * will read the information from the NMI page fault and not the
-         * origin fault. Save it off and restore it if it changes.
-         * Use the r12 callee-saved register.
-         */
-        movq    %cr2, %r12
        /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
        movq    %rsp, %rdi
        movq    $-1, %rsi
        call    do_nmi
-        /* Did the NMI take a page fault? Restore cr2 if it did */
-        movq    %cr2, %rcx
-        cmpq    %rcx, %r12
-        je      1f
-        movq    %r12, %cr2
-1:
        testl   %ebx, %ebx                      /* swapgs needed? */
        jnz     nmi_restore
 nmi_swapgs:
@@ -1444,11 +1528,26 @@ nmi_swapgs:
 nmi_restore:
        RESTORE_EXTRA_REGS
        RESTORE_C_REGS
-        /* Pop the extra iret frame at once */
+        /* Point RSP at the "iret" frame. */
        REMOVE_PT_GPREGS_FROM_STACK 6*8
-        /* Clear the NMI executing stack variable */
+        /*
-        movq    $0, 5*8(%rsp)
+         * Clear "NMI executing".  Set DF first so that we can easily
+         * distinguish the remaining code between here and IRET from
+         * the SYSCALL entry and exit paths.  On a native kernel, we
+         * could just inspect RIP, but, on paravirt kernels,
+         * INTERRUPT_RETURN can translate into a jump into a
+         * hypercall page.
+         */
+        std
+        movq    $0, 5*8(%rsp)           /* clear "NMI executing" */
+        /*
+         * INTERRUPT_RETURN reads the "iret" frame and exits the NMI
+         * stack in a single instruction.  We are returning to kernel
+         * mode, so this cannot result in a fault.
+         */
        INTERRUPT_RETURN
 END(nmi)
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index bb187a6a877c..5a1844765a7a 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -205,7 +205,6 @@ sysexit_from_sys_call:
        movl    RDX(%rsp), %edx         /* arg3 */
        movl    RSI(%rsp), %ecx         /* arg4 */
        movl    RDI(%rsp), %r8d         /* arg5 */
-        movl    %ebp, %r9d              /* arg6 */
        .endm
        .macro auditsys_exit exit
@@ -236,6 +235,7 @@ sysexit_from_sys_call:
 sysenter_auditsys:
        auditsys_entry_common
+        movl    %ebp, %r9d              /* reload 6th syscall arg */
        jmp     sysenter_dispatch
 sysexit_audit:
@@ -336,7 +336,7 @@ ENTRY(entry_SYSCALL_compat)
         * 32-bit zero extended:
         */
        ASM_STAC
-1:      movl    (%r8), %ebp
+1:      movl    (%r8), %r9d
        _ASM_EXTABLE(1b, ia32_badarg)
        ASM_CLAC
        orl     $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
@@ -346,7 +346,7 @@ ENTRY(entry_SYSCALL_compat)
 cstar_do_call:
        /* 32-bit syscall -> 64-bit C ABI argument conversion */
        movl    %edi, %r8d              /* arg5 */
-        movl    %ebp, %r9d              /* arg6 */
+        /* r9 already loaded */         /* arg6 */
        xchg    %ecx, %esi              /* rsi:arg2, rcx:arg4 */
        movl    %ebx, %edi              /* arg1 */
        movl    %edx, %edx              /* arg3 (zero extension) */
@@ -358,7 +358,6 @@ cstar_dispatch:
        call    *ia32_sys_call_table(, %rax, 8)
        movq    %rax, RAX(%rsp)
 1:
-        movl    RCX(%rsp), %ebp
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
        testl   $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
@@ -392,7 +391,9 @@ sysretl_from_sys_call:
 #ifdef CONFIG_AUDITSYSCALL
 cstar_auditsys:
+        movl    %r9d, R9(%rsp)          /* register to be clobbered by call */
        auditsys_entry_common
+        movl    R9(%rsp), %r9d          /* reload 6th syscall arg */
        jmp     cstar_dispatch
 sysretl_audit:
@@ -404,14 +405,16 @@ cstar_tracesys:
        testl   $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT), ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
        jz      cstar_auditsys
 #endif
+        xchgl   %r9d, %ebp
        SAVE_EXTRA_REGS
        xorl    %eax, %eax              /* Do not leak kernel information */
        movq    %rax, R11(%rsp)
        movq    %rax, R10(%rsp)
-        movq    %rax, R9(%rsp)
+        movq    %r9, R9(%rsp)
        movq    %rax, R8(%rsp)
        movq    %rsp, %rdi              /* &pt_regs -> arg1 */
        call    syscall_trace_enter
+        movl    R9(%rsp), %r9d
        /* Reload arg registers from stack. (see sysenter_tracesys) */
        movl    RCX(%rsp), %ecx
@@ -421,6 +424,7 @@ cstar_tracesys:
        movl    %eax, %eax              /* zero extension */
        RESTORE_EXTRA_REGS
+        xchgl   %ebp, %r9d
        jmp     cstar_do_call
 END(entry_SYSCALL_compat)
diff --git a/arch/x86/include/asm/Kbuild b/arch/x86/include/asm/Kbuild
index 4dd1f2d770af..aeac434c9feb 100644
--- a/arch/x86/include/asm/Kbuild
+++ b/arch/x86/include/asm/Kbuild
@@ -9,3 +9,4 @@ generic-y += cputime.h
 generic-y += dma-contiguous.h
 generic-y += early_ioremap.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h
index 0637826292de..c49c5173158e 100644
--- a/arch/x86/include/asm/fpu/types.h
+++ b/arch/x86/include/asm/fpu/types.h
@@ -189,6 +189,7 @@ union fpregs_state {
        struct fxregs_state             fxsave;
        struct swregs_state             soft;
        struct xregs_state              xsave;
+        u8 __padding[PAGE_SIZE];
 };
 /*
@@ -198,40 +199,6 @@ union fpregs_state {
 */
 struct fpu {
        /*
-         * @state:
-         *
-         * In-memory copy of all FPU registers that we save/restore
-         * over context switches. If the task is using the FPU then
-         * the registers in the FPU are more recent than this state
-         * copy. If the task context-switches away then they get
-         * saved here and represent the FPU state.
-         *
-         * After context switches there may be a (short) time period
-         * during which the in-FPU hardware registers are unchanged
-         * and still perfectly match this state, if the tasks
-         * scheduled afterwards are not using the FPU.
-         *
-         * This is the 'lazy restore' window of optimization, which
-         * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'.
-         *
-         * We detect whether a subsequent task uses the FPU via setting
-         * CR0::TS to 1, which causes any FPU use to raise a #NM fault.
-         *
-         * During this window, if the task gets scheduled again, we
-         * might be able to skip having to do a restore from this
-         * memory buffer to the hardware registers - at the cost of
-         * incurring the overhead of #NM fault traps.
-         *
-         * Note that on modern CPUs that support the XSAVEOPT (or other
-         * optimized XSAVE instructions), we don't use #NM traps anymore,
-         * as the hardware can track whether FPU registers need saving
-         * or not. On such CPUs we activate the non-lazy ('eagerfpu')
-         * logic, which unconditionally saves/restores all FPU state
-         * across context switches. (if FPU state exists.)
-         */
-        union fpregs_state              state;
-        /*
         * @last_cpu:
         *
         * Records the last CPU on which this context was loaded into
@@ -288,6 +255,43 @@ struct fpu {
         * deal with bursty apps that only use the FPU for a short time:
         */
        unsigned char                   counter;
+        /*
+         * @state:
+         *
+         * In-memory copy of all FPU registers that we save/restore
+         * over context switches. If the task is using the FPU then
+         * the registers in the FPU are more recent than this state
+         * copy. If the task context-switches away then they get
+         * saved here and represent the FPU state.
+         *
+         * After context switches there may be a (short) time period
+         * during which the in-FPU hardware registers are unchanged
+         * and still perfectly match this state, if the tasks
+         * scheduled afterwards are not using the FPU.
+         *
+         * This is the 'lazy restore' window of optimization, which
+         * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'.
+         *
+         * We detect whether a subsequent task uses the FPU via setting
+         * CR0::TS to 1, which causes any FPU use to raise a #NM fault.
+         *
+         * During this window, if the task gets scheduled again, we
+         * might be able to skip having to do a restore from this
+         * memory buffer to the hardware registers - at the cost of
+         * incurring the overhead of #NM fault traps.
+         *
+         * Note that on modern CPUs that support the XSAVEOPT (or other
+         * optimized XSAVE instructions), we don't use #NM traps anymore,
+         * as the hardware can track whether FPU registers need saving
+         * or not. On such CPUs we activate the non-lazy ('eagerfpu')
+         * logic, which unconditionally saves/restores all FPU state
+         * across context switches. (if FPU state exists.)
+         */
+        union fpregs_state              state;
+        /*
+         * WARNING: 'state' is dynamically-sized.  Do not put
+         * anything after it here.
+         */
 };
 #endif /* _ASM_X86_FPU_H */
diff --git a/arch/x86/include/asm/intel_pmc_ipc.h b/arch/x86/include/asm/intel_pmc_ipc.h
index 200ec2e7821d..cd0310e186f4 100644
--- a/arch/x86/include/asm/intel_pmc_ipc.h
+++ b/arch/x86/include/asm/intel_pmc_ipc.h
@@ -25,36 +25,9 @@
 #if IS_ENABLED(CONFIG_INTEL_PMC_IPC)
-/*
- * intel_pmc_ipc_simple_command
- * @cmd: command
- * @sub: sub type
- */
 int intel_pmc_ipc_simple_command(int cmd, int sub);
-/*
- * intel_pmc_ipc_raw_cmd
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
- * @sptr: data writing to SPTR register
- * @dptr: data writing to DPTR register
- */
 int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen,
                u32 *out, u32 outlen, u32 dptr, u32 sptr);
-/*
- * intel_pmc_ipc_command
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
- */
 int intel_pmc_ipc_command(u32 cmd, u32 sub, u8 *in, u32 inlen,
                u32 *out, u32 outlen);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 2a7f5d782c33..49ec9038ec14 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -604,6 +604,8 @@ struct kvm_arch {
        bool iommu_noncoherent;
 #define __KVM_HAVE_ARCH_NONCOHERENT_DMA
        atomic_t noncoherent_dma_count;
+#define __KVM_HAVE_ARCH_ASSIGNED_DEVICE
+        atomic_t assigned_device_count;
        struct kvm_pic *vpic;
        struct kvm_ioapic *vioapic;
        struct kvm_pit *vpit;
diff --git a/arch/x86/include/asm/mm-arch-hooks.h b/arch/x86/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 4e881a342236..000000000000
--- a/arch/x86/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_X86_MM_ARCH_HOOKS_H
-#define _ASM_X86_MM_ARCH_HOOKS_H
-#endif /* _ASM_X86_MM_ARCH_HOOKS_H */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 5e8daee7c5c9..804a3a6030ca 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_available;
 static inline void load_mm_cr4(struct mm_struct *mm)
 {
-        if (static_key_true(&rdpmc_always_available) ||
+        if (static_key_false(&rdpmc_always_available) ||
            atomic_read(&mm->context.perf_rdpmc_allowed))
                cr4_set_bits(X86_CR4_PCE);
        else
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 43e6519df0d5..944f1785ed0d 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -390,9 +390,6 @@ struct thread_struct {
 #endif
        unsigned long           gs;
-        /* Floating point and extended processor state */
-        struct fpu              fpu;
        /* Save middle states of ptrace breakpoints */
        struct perf_event       *ptrace_bps[HBP_NUM];
        /* Debug status used for traps, single steps, etc... */
@@ -418,6 +415,13 @@ struct thread_struct {
        unsigned long           iopl;
        /* Max allowed port in the bitmap, in bytes: */
        unsigned                io_bitmap_max;
+        /* Floating point and extended processor state */
+        struct fpu              fpu;
+        /*
+         * WARNING: 'fpu' is dynamically-sized.  It *MUST* be at
+         * the end.
+         */
 };
 /*
diff --git a/arch/x86/include/uapi/asm/hyperv.h b/arch/x86/include/uapi/asm/hyperv.h
index 8fba544e9cc4..f36d56bd7632 100644
--- a/arch/x86/include/uapi/asm/hyperv.h
+++ b/arch/x86/include/uapi/asm/hyperv.h
@@ -108,6 +108,8 @@
 #define HV_X64_HYPERCALL_PARAMS_XMM_AVAILABLE           (1 << 4)
 /* Support for a virtual guest idle state is available */
 #define HV_X64_GUEST_IDLE_STATE_AVAILABLE               (1 << 5)
+/* Guest crash data handler available */
+#define HV_X64_GUEST_CRASH_MSR_AVAILABLE                (1 << 10)
 /*
 * Implementation recommendations. Indicates which behaviors the hypervisor
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index a4ae82eb82aa..cd54147cb365 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -354,7 +354,7 @@ struct kvm_xcrs {
 struct kvm_sync_regs {
 };
-#define KVM_QUIRK_LINT0_REENABLED       (1 << 0)
+#define KVM_X86_QUIRK_LINT0_REENABLED   (1 << 0)
-#define KVM_QUIRK_CD_NW_CLEARED         (1 << 1)
+#define KVM_X86_QUIRK_CD_NW_CLEARED     (1 << 1)
 #endif /* _ASM_X86_KVM_H */
diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
index 188076161c1b..63eb68b73589 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
@@ -952,6 +952,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
                return 0;
        /*
+         * Getting up-to-date values requires an SMP IPI which is not
+         * possible if we're being called in interrupt context. Return
+         * the cached values instead.
+         */
+        if (unlikely(in_interrupt()))
+                goto out;
+        /*
         * Notice that we don't perform the reading of an RMID
         * atomically, because we can't hold a spin lock across the
         * IPIs.
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index 32826791e675..1e173f6285c7 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -4,6 +4,8 @@
 #include <asm/fpu/internal.h>
 #include <asm/tlbflush.h>
+#include <linux/sched.h>
 /*
 * Initialize the TS bit in CR0 according to the style of context-switches
 * we are using:
@@ -136,6 +138,43 @@ static void __init fpu__init_system_generic(void)
 unsigned int xstate_size;
 EXPORT_SYMBOL_GPL(xstate_size);
+/* Enforce that 'MEMBER' is the last field of 'TYPE': */
+#define CHECK_MEMBER_AT_END_OF(TYPE, MEMBER) \
+        BUILD_BUG_ON(sizeof(TYPE) != offsetofend(TYPE, MEMBER))
+/*
+ * We append the 'struct fpu' to the task_struct:
+ */
+static void __init fpu__init_task_struct_size(void)
+{
+        int task_size = sizeof(struct task_struct);
+        /*
+         * Subtract off the static size of the register state.
+         * It potentially has a bunch of padding.
+         */
+        task_size -= sizeof(((struct task_struct *)0)->thread.fpu.state);
+        /*
+         * Add back the dynamically-calculated register state
+         * size.
+         */
+        task_size += xstate_size;
+        /*
+         * We dynamically size 'struct fpu', so we require that
+         * it be at the end of 'thread_struct' and that
+         * 'thread_struct' be at the end of 'task_struct'.  If
+         * you hit a compile error here, check the structure to
+         * see if something got added to the end.
+         */
+        CHECK_MEMBER_AT_END_OF(struct fpu, state);
+        CHECK_MEMBER_AT_END_OF(struct thread_struct, fpu);
+        CHECK_MEMBER_AT_END_OF(struct task_struct, thread);
+        arch_task_struct_size = task_size;
+}
 /*
 * Set up the xstate_size based on the legacy FPU context size.
 *
@@ -287,6 +326,7 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
        fpu__init_system_generic();
        fpu__init_system_xstate_size_legacy();
        fpu__init_system_xstate();
+        fpu__init_task_struct_size();
        fpu__init_system_ctx_switch();
 }
@@ -311,9 +351,15 @@ static int __init x86_noxsave_setup(char *s)
        setup_clear_cpu_cap(X86_FEATURE_XSAVE);
        setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
+        setup_clear_cpu_cap(X86_FEATURE_XSAVEC);
        setup_clear_cpu_cap(X86_FEATURE_XSAVES);
        setup_clear_cpu_cap(X86_FEATURE_AVX);
        setup_clear_cpu_cap(X86_FEATURE_AVX2);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512F);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512PF);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512ER);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512CD);
+        setup_clear_cpu_cap(X86_FEATURE_MPX);
        return 1;
 }
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index c3e985d1751c..d05bd2e2ee91 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -408,15 +408,15 @@ static void default_do_nmi(struct pt_regs *regs)
 NOKPROBE_SYMBOL(default_do_nmi);
 /*
- * NMIs can hit breakpoints which will cause it to lose its
+ * NMIs can page fault or hit breakpoints which will cause it to lose
- * NMI context with the CPU when the breakpoint does an iret.
+ * its NMI context with the CPU when the breakpoint or page fault does an IRET.
- */
+ *
-#ifdef CONFIG_X86_32
+ * As a result, NMIs can nest if NMIs get unmasked due an IRET during
-/*
+ * NMI processing.  On x86_64, the asm glue protects us from nested NMIs
- * For i386, NMIs use the same stack as the kernel, and we can
+ * if the outer NMI came from kernel mode, but we can still nest if the
- * add a workaround to the iret problem in C (preventing nested
+ * outer NMI came from user mode.
- * NMIs if an NMI takes a trap). Simply have 3 states the NMI
+ *
- * can be in:
+ * To handle these nested NMIs, we have three states:
 *
 *  1) not running
 *  2) executing
@@ -430,15 +430,14 @@ NOKPROBE_SYMBOL(default_do_nmi);
 * (Note, the latch is binary, thus multiple NMIs triggering,
 *  when one is running, are ignored. Only one NMI is restarted.)
 *
- * If an NMI hits a breakpoint that executes an iret, another
+ * If an NMI executes an iret, another NMI can preempt it. We do not
- * NMI can preempt it. We do not want to allow this new NMI
+ * want to allow this new NMI to run, but we want to execute it when the
- * to run, but we want to execute it when the first one finishes.
+ * first one finishes.  We set the state to "latched", and the exit of
- * We set the state to "latched", and the exit of the first NMI will
+ * the first NMI will perform a dec_return, if the result is zero
- * perform a dec_return, if the result is zero (NOT_RUNNING), then
+ * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the
- * it will simply exit the NMI handler. If not, the dec_return
+ * dec_return would have set the state to NMI_EXECUTING (what we want it
- * would have set the state to NMI_EXECUTING (what we want it to
+ * to be when we are running). In this case, we simply jump back to
- * be when we are running). In this case, we simply jump back
+ * rerun the NMI handler again, and restart the 'latched' NMI.
- * to rerun the NMI handler again, and restart the 'latched' NMI.
 *
 * No trap (breakpoint or page fault) should be hit before nmi_restart,
 * thus there is no race between the first check of state for NOT_RUNNING
@@ -461,49 +460,36 @@ enum nmi_states {
 static DEFINE_PER_CPU(enum nmi_states, nmi_state);
 static DEFINE_PER_CPU(unsigned long, nmi_cr2);
-#define nmi_nesting_preprocess(regs)                                    \
+#ifdef CONFIG_X86_64
-        do {                                                            \
-                if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {      \
-                        this_cpu_write(nmi_state, NMI_LATCHED);         \
-                        return;                                         \
-                }                                                       \
-                this_cpu_write(nmi_state, NMI_EXECUTING);               \
-                this_cpu_write(nmi_cr2, read_cr2());                    \
-        } while (0);                                                    \
-        nmi_restart:
-#define nmi_nesting_postprocess()                                       \
-        do {                                                            \
-                if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))     \
-                        write_cr2(this_cpu_read(nmi_cr2));              \
-                if (this_cpu_dec_return(nmi_state))                     \
-                        goto nmi_restart;                               \
-        } while (0)
-#else /* x86_64 */
 /*
- * In x86_64 things are a bit more difficult. This has the same problem
+ * In x86_64, we need to handle breakpoint -> NMI -> breakpoint.  Without
- * where an NMI hitting a breakpoint that calls iret will remove the
+ * some care, the inner breakpoint will clobber the outer breakpoint's
- * NMI context, allowing a nested NMI to enter. What makes this more
+ * stack.
- * difficult is that both NMIs and breakpoints have their own stack.
- * When a new NMI or breakpoint is executed, the stack is set to a fixed
- * point. If an NMI is nested, it will have its stack set at that same
- * fixed address that the first NMI had, and will start corrupting the
- * stack. This is handled in entry_64.S, but the same problem exists with
- * the breakpoint stack.
 *
- * If a breakpoint is being processed, and the debug stack is being used,
+ * If a breakpoint is being processed, and the debug stack is being
- * if an NMI comes in and also hits a breakpoint, the stack pointer
+ * used, if an NMI comes in and also hits a breakpoint, the stack
- * will be set to the same fixed address as the breakpoint that was
+ * pointer will be set to the same fixed address as the breakpoint that
- * interrupted, causing that stack to be corrupted. To handle this case,
+ * was interrupted, causing that stack to be corrupted. To handle this
- * check if the stack that was interrupted is the debug stack, and if
+ * case, check if the stack that was interrupted is the debug stack, and
- * so, change the IDT so that new breakpoints will use the current stack
+ * if so, change the IDT so that new breakpoints will use the current
- * and not switch to the fixed address. On return of the NMI, switch back
+ * stack and not switch to the fixed address. On return of the NMI,
- * to the original IDT.
+ * switch back to the original IDT.
 */
 static DEFINE_PER_CPU(int, update_debug_stack);
+#endif
-static inline void nmi_nesting_preprocess(struct pt_regs *regs)
+dotraplinkage notrace void
+do_nmi(struct pt_regs *regs, long error_code)
 {
+        if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
+                this_cpu_write(nmi_state, NMI_LATCHED);
+                return;
+        }
+        this_cpu_write(nmi_state, NMI_EXECUTING);
+        this_cpu_write(nmi_cr2, read_cr2());
+nmi_restart:
+#ifdef CONFIG_X86_64
        /*
         * If we interrupted a breakpoint, it is possible that
         * the nmi handler will have breakpoints too. We need to
@@ -514,22 +500,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs)
                debug_stack_set_zero();
                this_cpu_write(update_debug_stack, 1);
        }
-}
-static inline void nmi_nesting_postprocess(void)
-{
-        if (unlikely(this_cpu_read(update_debug_stack))) {
-                debug_stack_reset();
-                this_cpu_write(update_debug_stack, 0);
-        }
-}
 #endif
-dotraplinkage notrace void
-do_nmi(struct pt_regs *regs, long error_code)
-{
-        nmi_nesting_preprocess(regs);
        nmi_enter();
        inc_irq_stat(__nmi_count);
@@ -539,8 +511,17 @@ do_nmi(struct pt_regs *regs, long error_code)
        nmi_exit();
-        /* On i386, may loop back to preprocess */
+#ifdef CONFIG_X86_64
-        nmi_nesting_postprocess();
+        if (unlikely(this_cpu_read(update_debug_stack))) {
+                debug_stack_reset();
+                this_cpu_write(update_debug_stack, 0);
+        }
+#endif
+        if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))
+                write_cr2(this_cpu_read(nmi_cr2));
+        if (this_cpu_dec_return(nmi_state))
+                goto nmi_restart;
 }
 NOKPROBE_SYMBOL(do_nmi);
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 9cad694ed7c4..397688beed4b 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -81,7 +81,7 @@ EXPORT_SYMBOL_GPL(idle_notifier_unregister);
 */
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 {
-        *dst = *src;
+        memcpy(dst, src, arch_task_struct_size);
        return fpu__copy(&dst->thread.fpu, &src->thread.fpu);
 }
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index d3010aa79daf..b1f3ed9c7a9e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -992,8 +992,17 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
        common_cpu_up(cpu, tidle);
+        /*
+         * We have to walk the irq descriptors to setup the vector
+         * space for the cpu which comes online.  Prevent irq
+         * alloc/free across the bringup.
+         */
+        irq_lock_sparse();
        err = do_boot_cpu(apicid, cpu, tidle);
        if (err) {
+                irq_unlock_sparse();
                pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
                return -EIO;
        }
@@ -1011,6 +1020,8 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                touch_nmi_watchdog();
        }
+        irq_unlock_sparse();
        return 0;
 }
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 64dd46793099..2fbea2544f24 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -98,6 +98,8 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu)
                best->ebx = xstate_required_size(vcpu->arch.xcr0, true);
        vcpu->arch.eager_fpu = use_eager_fpu() || guest_cpuid_has_mpx(vcpu);
+        if (vcpu->arch.eager_fpu)
+                kvm_x86_ops->fpu_activate(vcpu);
        /*
         * The existing code assumes virtual address is 48-bit in the canonical
diff --git a/arch/x86/kvm/iommu.c b/arch/x86/kvm/iommu.c
index 7dbced309ddb..5c520ebf6343 100644
--- a/arch/x86/kvm/iommu.c
+++ b/arch/x86/kvm/iommu.c
@@ -200,6 +200,7 @@ int kvm_assign_device(struct kvm *kvm, struct pci_dev *pdev)
                        goto out_unmap;
        }
+        kvm_arch_start_assignment(kvm);
        pci_set_dev_assigned(pdev);
        dev_info(&pdev->dev, "kvm assign device\n");
@@ -224,6 +225,7 @@ int kvm_deassign_device(struct kvm *kvm, struct pci_dev *pdev)
        iommu_detach_device(domain, &pdev->dev);
        pci_clear_dev_assigned(pdev);
+        kvm_arch_end_assignment(kvm);
        dev_info(&pdev->dev, "kvm deassign device\n");
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 954e98a8c2e3..2a5ca97c263b 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1595,7 +1595,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
        for (i = 0; i < APIC_LVT_NUM; i++)
                apic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
        apic_update_lvtt(apic);
-        if (!(vcpu->kvm->arch.disabled_quirks & KVM_QUIRK_LINT0_REENABLED))
+        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
                apic_set_reg(apic, APIC_LVT0,
                             SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
        apic_manage_nmi_watchdog(apic, kvm_apic_get_reg(apic, APIC_LVT0));
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f807496b62c2..44171462bd2a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2479,6 +2479,14 @@ static int mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
        return 0;
 }
+static bool kvm_is_mmio_pfn(pfn_t pfn)
+{
+        if (pfn_valid(pfn))
+                return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));
+        return true;
+}
 static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                    unsigned pte_access, int level,
                    gfn_t gfn, pfn_t pfn, bool speculative,
@@ -2506,7 +2514,7 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                spte |= PT_PAGE_SIZE_MASK;
        if (tdp_enabled)
                spte |= kvm_x86_ops->get_mt_mask(vcpu, gfn,
-                        kvm_is_reserved_pfn(pfn));
+                        kvm_is_mmio_pfn(pfn));
        if (host_writable)
                spte |= SPTE_HOST_WRITEABLE;
diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
index de1d2d8062e2..dc0a84a6f309 100644
--- a/arch/x86/kvm/mtrr.c
+++ b/arch/x86/kvm/mtrr.c
@@ -120,6 +120,16 @@ static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state)
        return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK;
 }
+static u8 mtrr_disabled_type(void)
+{
+        /*
+         * Intel SDM 11.11.2.2: all MTRRs are disabled when
+         * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
+         * memory type is applied to all of physical memory.
+         */
+        return MTRR_TYPE_UNCACHABLE;
+}
 /*
 * Three terms are used in the following code:
 * - segment, it indicates the address segments covered by fixed MTRRs.
@@ -434,6 +444,8 @@ struct mtrr_iter {
        /* output fields. */
        int mem_type;
+        /* mtrr is completely disabled? */
+        bool mtrr_disabled;
        /* [start, end) is not fully covered in MTRRs? */
        bool partial_map;
@@ -549,7 +561,7 @@ static void mtrr_lookup_var_next(struct mtrr_iter *iter)
 static void mtrr_lookup_start(struct mtrr_iter *iter)
 {
        if (!mtrr_is_enabled(iter->mtrr_state)) {
-                iter->partial_map = true;
+                iter->mtrr_disabled = true;
                return;
        }
@@ -563,6 +575,7 @@ static void mtrr_lookup_init(struct mtrr_iter *iter,
        iter->mtrr_state = mtrr_state;
        iter->start = start;
        iter->end = end;
+        iter->mtrr_disabled = false;
        iter->partial_map = false;
        iter->fixed = false;
        iter->range = NULL;
@@ -656,15 +669,19 @@ u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
                return MTRR_TYPE_WRBACK;
        }
-        /* It is not covered by MTRRs. */
+        if (iter.mtrr_disabled)
-        if (iter.partial_map) {
+                return mtrr_disabled_type();
-                /*
-                 * We just check one page, partially covered by MTRRs is
+        /*
-                 * impossible.
+         * We just check one page, partially covered by MTRRs is
-                 */
+         * impossible.
-                WARN_ON(type != -1);
+         */
-                type = mtrr_default_type(mtrr_state);
+        WARN_ON(iter.partial_map);
-        }
+        /* not contained in any MTRRs. */
+        if (type == -1)
+                return mtrr_default_type(mtrr_state);
        return type;
 }
 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);
@@ -689,6 +706,9 @@ bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
                        return false;
        }
+        if (iter.mtrr_disabled)
+                return true;
        if (!iter.partial_map)
                return true;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 602b974a60a6..8e0c0844c6b9 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -865,6 +865,64 @@ static void svm_disable_lbrv(struct vcpu_svm *svm)
        set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
 }
+#define MTRR_TYPE_UC_MINUS      7
+#define MTRR2PROTVAL_INVALID 0xff
+static u8 mtrr2protval[8];
+static u8 fallback_mtrr_type(int mtrr)
+{
+        /*
+         * WT and WP aren't always available in the host PAT.  Treat
+         * them as UC and UC- respectively.  Everything else should be
+         * there.
+         */
+        switch (mtrr)
+        {
+        case MTRR_TYPE_WRTHROUGH:
+                return MTRR_TYPE_UNCACHABLE;
+        case MTRR_TYPE_WRPROT:
+                return MTRR_TYPE_UC_MINUS;
+        default:
+                BUG();
+        }
+}
+static void build_mtrr2protval(void)
+{
+        int i;
+        u64 pat;
+        for (i = 0; i < 8; i++)
+                mtrr2protval[i] = MTRR2PROTVAL_INVALID;
+        /* Ignore the invalid MTRR types.  */
+        mtrr2protval[2] = 0;
+        mtrr2protval[3] = 0;
+        /*
+         * Use host PAT value to figure out the mapping from guest MTRR
+         * values to nested page table PAT/PCD/PWT values.  We do not
+         * want to change the host PAT value every time we enter the
+         * guest.
+         */
+        rdmsrl(MSR_IA32_CR_PAT, pat);
+        for (i = 0; i < 8; i++) {
+                u8 mtrr = pat >> (8 * i);
+                if (mtrr2protval[mtrr] == MTRR2PROTVAL_INVALID)
+                        mtrr2protval[mtrr] = __cm_idx2pte(i);
+        }
+        for (i = 0; i < 8; i++) {
+                if (mtrr2protval[i] == MTRR2PROTVAL_INVALID) {
+                        u8 fallback = fallback_mtrr_type(i);
+                        mtrr2protval[i] = mtrr2protval[fallback];
+                        BUG_ON(mtrr2protval[i] == MTRR2PROTVAL_INVALID);
+                }
+        }
+}
 static __init int svm_hardware_setup(void)
 {
        int cpu;
@@ -931,6 +989,7 @@ static __init int svm_hardware_setup(void)
        } else
                kvm_disable_tdp();
+        build_mtrr2protval();
        return 0;
 err:
@@ -1085,6 +1144,39 @@ static u64 svm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
        return target_tsc - tsc;
 }
+static void svm_set_guest_pat(struct vcpu_svm *svm, u64 *g_pat)
+{
+        struct kvm_vcpu *vcpu = &svm->vcpu;
+        /* Unlike Intel, AMD takes the guest's CR0.CD into account.
+         *
+         * AMD does not have IPAT.  To emulate it for the case of guests
+         * with no assigned devices, just set everything to WB.  If guests
+         * have assigned devices, however, we cannot force WB for RAM
+         * pages only, so use the guest PAT directly.
+         */
+        if (!kvm_arch_has_assigned_device(vcpu->kvm))
+                *g_pat = 0x0606060606060606;
+        else
+                *g_pat = vcpu->arch.pat;
+}
+static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
+{
+        u8 mtrr;
+        /*
+         * 1. MMIO: trust guest MTRR, so same as item 3.
+         * 2. No passthrough: always map as WB, and force guest PAT to WB as well
+         * 3. Passthrough: can't guarantee the result, try to trust guest.
+         */
+        if (!is_mmio && !kvm_arch_has_assigned_device(vcpu->kvm))
+                return 0;
+        mtrr = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
+        return mtrr2protval[mtrr];
+}
 static void init_vmcb(struct vcpu_svm *svm, bool init_event)
 {
        struct vmcb_control_area *control = &svm->vmcb->control;
@@ -1180,6 +1272,7 @@ static void init_vmcb(struct vcpu_svm *svm, bool init_event)
                clr_cr_intercept(svm, INTERCEPT_CR3_READ);
                clr_cr_intercept(svm, INTERCEPT_CR3_WRITE);
                save->g_pat = svm->vcpu.arch.pat;
+                svm_set_guest_pat(svm, &save->g_pat);
                save->cr3 = 0;
                save->cr4 = 0;
        }
@@ -1579,7 +1672,7 @@ static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
         * does not do it - this results in some delay at
         * reboot
         */
-        if (!(vcpu->kvm->arch.disabled_quirks & KVM_QUIRK_CD_NW_CLEARED))
+        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
                cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
        svm->vmcb->save.cr0 = cr0;
        mark_dirty(svm->vmcb, VMCB_CR);
@@ -3254,6 +3347,16 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
        case MSR_VM_IGNNE:
                vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
                break;
+        case MSR_IA32_CR_PAT:
+                if (npt_enabled) {
+                        if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+                                return 1;
+                        vcpu->arch.pat = data;
+                        svm_set_guest_pat(svm, &svm->vmcb->save.g_pat);
+                        mark_dirty(svm->vmcb, VMCB_NPT);
+                        break;
+                }
+                /* fall through */
        default:
                return kvm_set_msr_common(vcpu, msr);
        }
@@ -4088,11 +4191,6 @@ static bool svm_has_high_real_mode_segbase(void)
        return true;
 }
-static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
-{
-        return 0;
-}
 static void svm_cpuid_update(struct kvm_vcpu *vcpu)
 {
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index e856dd566f4c..83b7b5cd75d5 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8632,22 +8632,17 @@ static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
        u64 ipat = 0;
        /* For VT-d and EPT combination
-         * 1. MMIO: always map as UC
+         * 1. MMIO: guest may want to apply WC, trust it.
         * 2. EPT with VT-d:
         *   a. VT-d without snooping control feature: can't guarantee the
-         *      result, try to trust guest.
+         *      result, try to trust guest.  So the same as item 1.
         *   b. VT-d with snooping control feature: snooping control feature of
         *      VT-d engine can guarantee the cache correctness. Just set it
         *      to WB to keep consistent with host. So the same as item 3.
         * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
         *    consistent with host MTRR
         */
-        if (is_mmio) {
+        if (!is_mmio && !kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
-                cache = MTRR_TYPE_UNCACHABLE;
-                goto exit;
-        }
-        if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
                ipat = VMX_EPT_IPAT_BIT;
                cache = MTRR_TYPE_WRBACK;
                goto exit;
@@ -8655,7 +8650,10 @@ static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
        if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
                ipat = VMX_EPT_IPAT_BIT;
-                cache = MTRR_TYPE_UNCACHABLE;
+                if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
+                        cache = MTRR_TYPE_WRBACK;
+                else
+                        cache = MTRR_TYPE_UNCACHABLE;
                goto exit;
        }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bbaf44e8f0d3..5ef2560075bf 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3157,8 +3157,7 @@ static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
                        cpuid_count(XSTATE_CPUID, index,
                                    &size, &offset, &ecx, &edx);
                        memcpy(dest, src + offset, size);
-                } else
+                }
-                        WARN_ON_ONCE(1);
                valid -= feature;
        }
@@ -7315,11 +7314,6 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
        vcpu = kvm_x86_ops->vcpu_create(kvm, id);
-        /*
-         * Activate fpu unconditionally in case the guest needs eager FPU.  It will be
-         * deactivated soon if it doesn't.
-         */
-        kvm_x86_ops->fpu_activate(vcpu);
        return vcpu;
 }
@@ -8218,6 +8212,24 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
                        kvm_x86_ops->interrupt_allowed(vcpu);
 }
+void kvm_arch_start_assignment(struct kvm *kvm)
+{
+        atomic_inc(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_start_assignment);
+void kvm_arch_end_assignment(struct kvm *kvm)
+{
+        atomic_dec(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_end_assignment);
+bool kvm_arch_has_assigned_device(struct kvm *kvm)
+{
+        return atomic_read(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_has_assigned_device);
 void kvm_arch_register_noncoherent_dma(struct kvm *kvm)
 {
        atomic_inc(&kvm->arch.noncoherent_dma_count);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index edc8cdcd786b..0ca2f3e4803c 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -147,6 +147,11 @@ static inline void kvm_register_writel(struct kvm_vcpu *vcpu,
        return kvm_register_write(vcpu, reg, val);
 }
+static inline bool kvm_check_has_quirk(struct kvm *kvm, u64 quirk)
+{
+        return !(kvm->arch.disabled_quirks & quirk);
+}
 void kvm_before_handle_nmi(struct kvm_vcpu *vcpu);
 void kvm_after_handle_nmi(struct kvm_vcpu *vcpu);
 void kvm_set_pending_timer(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index cc5ccc415cc0..b9c78f3bcd67 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -63,8 +63,6 @@ static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages,
                    !PageReserved(pfn_to_page(start_pfn + i)))
                        return 1;
-        WARN_ONCE(1, "ioremap on RAM pfn 0x%lx\n", start_pfn);
        return 0;
 }
@@ -94,7 +92,6 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
        pgprot_t prot;
        int retval;
        void __iomem *ret_addr;
-        int ram_region;
        /* Don't allow wraparound or zero size */
        last_addr = phys_addr + size - 1;
@@ -117,23 +114,15 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
        /*
         * Don't allow anybody to remap normal RAM that we're using..
         */
-        /* First check if whole region can be identified as RAM or not */
+        pfn      = phys_addr >> PAGE_SHIFT;
-        ram_region = region_is_ram(phys_addr, size);
+        last_pfn = last_addr >> PAGE_SHIFT;
-        if (ram_region > 0) {
+        if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
-                WARN_ONCE(1, "ioremap on RAM at 0x%lx - 0x%lx\n",
+                                          __ioremap_check_ram) == 1) {
-                                (unsigned long int)phys_addr,
+                WARN_ONCE(1, "ioremap on RAM at %pa - %pa\n",
-                                (unsigned long int)last_addr);
+                          &phys_addr, &last_addr);
                return NULL;
        }
-        /* If could not be identified(-1), check page by page */
-        if (ram_region < 0) {
-                pfn      = phys_addr >> PAGE_SHIFT;
-                last_pfn = last_addr >> PAGE_SHIFT;
-                if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
-                                          __ioremap_check_ram) == 1)
-                        return NULL;
-        }
        /*
         * Mappings have to be page-aligned
         */
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 9d518d693b4b..844b06d67df4 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
                mm->get_unmapped_area = arch_get_unmapped_area_topdown;
        }
 }
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_flags & VM_MPX)
+                return "[mpx]";
+        return NULL;
+}
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 7a657f58bbea..db1b0bc5017c 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -20,20 +20,6 @@
 #define CREATE_TRACE_POINTS
 #include <asm/trace/mpx.h>
-static const char *mpx_mapping_name(struct vm_area_struct *vma)
-{
-        return "[mpx]";
-}
-static struct vm_operations_struct mpx_vma_ops = {
-        .name = mpx_mapping_name,
-};
-static int is_mpx_vma(struct vm_area_struct *vma)
-{
-        return (vma->vm_ops == &mpx_vma_ops);
-}
 static inline unsigned long mpx_bd_size_bytes(struct mm_struct *mm)
 {
        if (is_64bit_mm(mm))
@@ -53,9 +39,6 @@ static inline unsigned long mpx_bt_size_bytes(struct mm_struct *mm)
 /*
 * This is really a simplified "vm_mmap". it only handles MPX
 * bounds tables (the bounds directory is user-allocated).
- *
- * Later on, we use the vma->vm_ops to uniquely identify these
- * VMAs.
 */
 static unsigned long mpx_mmap(unsigned long len)
 {
@@ -101,7 +84,6 @@ static unsigned long mpx_mmap(unsigned long len)
                ret = -ENOMEM;
                goto out;
        }
-        vma->vm_ops = &mpx_vma_ops;
        if (vm_flags & VM_LOCKED) {
                up_write(&mm->mmap_sem);
@@ -812,7 +794,7 @@ static noinline int zap_bt_entries_mapping(struct mm_struct *mm,
                 * so stop immediately and return an error.  This
                 * probably results in a SIGSEGV.
                 */
-                if (!is_mpx_vma(vma))
+                if (!(vma->vm_flags & VM_MPX))
                        return -EINVAL;
                len = min(vma->vm_end, end) - addr;
@@ -945,9 +927,9 @@ static int try_unmap_single_bt(struct mm_struct *mm,
         * lots of tables even though we have no actual table
         * entries in use.
         */
-        while (next && is_mpx_vma(next))
+        while (next && (next->vm_flags & VM_MPX))
                next = next->vm_next;
-        while (prev && is_mpx_vma(prev))
+        while (prev && (prev->vm_flags & VM_MPX))
                prev = prev->vm_prev;
        /*
         * We know 'start' and 'end' lie within an area controlled
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 3250f2371aea..90b924acd982 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
                } else {
                        unsigned long addr;
                        unsigned long nr_pages =
-                                f->flush_end - f->flush_start / PAGE_SIZE;
+                                (f->flush_end - f->flush_start) / PAGE_SIZE;
                        addr = f->flush_start;
                        while (addr < f->flush_end) {
                                __flush_tlb_single(addr);
diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild
index 14d15bf1a95b..5b478accd5fc 100644
--- a/arch/xtensa/include/asm/Kbuild
+++ b/arch/xtensa/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += resource.h
diff --git a/arch/xtensa/include/asm/mm-arch-hooks.h b/arch/xtensa/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d2e5cfd3dd02..000000000000
--- a/arch/xtensa/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef _ASM_XTENSA_MM_ARCH_HOOKS_H
-#define _ASM_XTENSA_MM_ARCH_HOOKS_H
-#endif /* _ASM_XTENSA_MM_ARCH_HOOKS_H */
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 0436c21db7f2..719b7152aed1 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
        unsigned long idx = BIO_POOL_NONE;
        unsigned inline_vecs;
-        if (!bs) {
+        if (!bs || !bs->bio_integrity_pool) {
                bip = kmalloc(sizeof(struct bio_integrity_payload) +
                              sizeof(struct bio_vec) * nr_vecs, gfp_mask);
                inline_vecs = nr_vecs;
@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
                kfree(page_address(bip->bip_vec->bv_page) +
                      bip->bip_vec->bv_offset);
-        if (bs) {
+        if (bs && bs->bio_integrity_pool) {
                if (bip->bip_slab != BIO_POOL_NONE)
                        bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
                                  bip->bip_slab);
diff --git a/block/bio.c b/block/bio.c
index 2a00d349cd68..d6e5ba3399f0 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1831,8 +1831,9 @@ EXPORT_SYMBOL(bio_endio);
 * Allocates and returns a new bio which represents @sectors from the start of
 * @bio, and updates @bio to represent the remaining sectors.
 *
- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
+ * Unless this is a discard request the newly allocated bio will point
- * responsibility to ensure that @bio is not freed before the split.
+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
+ * @bio is not freed before the split.
 */
 struct bio *bio_split(struct bio *bio, int sectors,
                      gfp_t gfp, struct bio_set *bs)
@@ -1842,7 +1843,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
        BUG_ON(sectors <= 0);
        BUG_ON(sectors >= bio_sectors(bio));
-        split = bio_clone_fast(bio, gfp, bs);
+        /*
+         * Discards need a mutable bio_vec to accommodate the payload
+         * required by the DSM TRIM and UNMAP commands.
+         */
+        if (bio->bi_rw & REQ_DISCARD)
+                split = bio_clone_bioset(bio, gfp, bs);
+        else
+                split = bio_clone_fast(bio, gfp, bs);
        if (!split)
                return NULL;
@@ -2009,6 +2018,7 @@ int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css)
        bio->bi_css = blkcg_css;
        return 0;
 }
+EXPORT_SYMBOL_GPL(bio_associate_blkcg);
 /**
 * bio_associate_current - associate a bio with %current
@@ -2039,6 +2049,7 @@ int bio_associate_current(struct bio *bio)
        bio->bi_css = task_get_css(current, blkio_cgrp_id);
        return 0;
 }
+EXPORT_SYMBOL_GPL(bio_associate_current);
 /**
 * bio_disassociate_task - undo bio_associate_current()
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 9f97da52d006..d6283b3f5db5 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -29,6 +29,14 @@
 #define MAX_KEY_LEN 100
+/*
+ * blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation.
+ * blkcg_pol_register_mutex nests outside of it and synchronizes entire
+ * policy [un]register operations including cgroup file additions /
+ * removals.  Putting cgroup file registration outside blkcg_pol_mutex
+ * allows grabbing it from cgroup callbacks.
+ */
+static DEFINE_MUTEX(blkcg_pol_register_mutex);
 static DEFINE_MUTEX(blkcg_pol_mutex);
 struct blkcg blkcg_root;
@@ -38,6 +46,8 @@ struct cgroup_subsys_state * const blkcg_root_css = &blkcg_root.css;
 static struct blkcg_policy *blkcg_policy[BLKCG_MAX_POLS];
+static LIST_HEAD(all_blkcgs);           /* protected by blkcg_pol_mutex */
 static bool blkcg_policy_enabled(struct request_queue *q,
                                 const struct blkcg_policy *pol)
 {
@@ -453,20 +463,7 @@ static int blkcg_reset_stats(struct cgroup_subsys_state *css,
        struct blkcg_gq *blkg;
        int i;
-        /*
+        mutex_lock(&blkcg_pol_mutex);
-         * XXX: We invoke cgroup_add/rm_cftypes() under blkcg_pol_mutex
-         * which ends up putting cgroup's internal cgroup_tree_mutex under
-         * it; however, cgroup_tree_mutex is nested above cgroup file
-         * active protection and grabbing blkcg_pol_mutex from a cgroup
-         * file operation creates a possible circular dependency.  cgroup
-         * internal locking is planned to go through further simplification
-         * and this issue should go away soon.  For now, let's trylock
-         * blkcg_pol_mutex and restart the write on failure.
-         *
-         * http://lkml.kernel.org/g/5363C04B.4010400@oracle.com
-         */
-        if (!mutex_trylock(&blkcg_pol_mutex))
-                return restart_syscall();
        spin_lock_irq(&blkcg->lock);
        /*
@@ -721,8 +718,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
                return -EINVAL;
        disk = get_gendisk(MKDEV(major, minor), &part);
-        if (!disk || part)
+        if (!disk)
+                return -EINVAL;
+        if (part) {
+                put_disk(disk);
                return -EINVAL;
+        }
        rcu_read_lock();
        spin_lock_irq(disk->queue->queue_lock);
@@ -822,8 +823,17 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
 {
        struct blkcg *blkcg = css_to_blkcg(css);
-        if (blkcg != &blkcg_root)
+        mutex_lock(&blkcg_pol_mutex);
+        list_del(&blkcg->all_blkcgs_node);
+        mutex_unlock(&blkcg_pol_mutex);
+        if (blkcg != &blkcg_root) {
+                int i;
+                for (i = 0; i < BLKCG_MAX_POLS; i++)
+                        kfree(blkcg->pd[i]);
                kfree(blkcg);
+        }
 }
 static struct cgroup_subsys_state *
@@ -833,6 +843,8 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
        struct cgroup_subsys_state *ret;
        int i;
+        mutex_lock(&blkcg_pol_mutex);
        if (!parent_css) {
                blkcg = &blkcg_root;
                goto done;
@@ -875,14 +887,17 @@ done:
 #ifdef CONFIG_CGROUP_WRITEBACK
        INIT_LIST_HEAD(&blkcg->cgwb_list);
 #endif
+        list_add_tail(&blkcg->all_blkcgs_node, &all_blkcgs);
+        mutex_unlock(&blkcg_pol_mutex);
        return &blkcg->css;
 free_pd_blkcg:
        for (i--; i >= 0; i--)
                kfree(blkcg->pd[i]);
 free_blkcg:
        kfree(blkcg);
+        mutex_unlock(&blkcg_pol_mutex);
        return ret;
 }
@@ -1037,10 +1052,8 @@ int blkcg_activate_policy(struct request_queue *q,
                          const struct blkcg_policy *pol)
 {
        LIST_HEAD(pds);
-        LIST_HEAD(cpds);
        struct blkcg_gq *blkg;
        struct blkg_policy_data *pd, *nd;
-        struct blkcg_policy_data *cpd, *cnd;
        int cnt = 0, ret;
        if (blkcg_policy_enabled(q, pol))
@@ -1053,10 +1066,7 @@ int blkcg_activate_policy(struct request_queue *q,
                cnt++;
        spin_unlock_irq(q->queue_lock);
-        /*
+        /* allocate per-blkg policy data for all existing blkgs */
-         * Allocate per-blkg and per-blkcg policy data
-         * for all existing blkgs.
-         */
        while (cnt--) {
                pd = kzalloc_node(pol->pd_size, GFP_KERNEL, q->node);
                if (!pd) {
@@ -1064,15 +1074,6 @@ int blkcg_activate_policy(struct request_queue *q,
                        goto out_free;
                }
                list_add_tail(&pd->alloc_node, &pds);
-                if (!pol->cpd_size)
-                        continue;
-                cpd = kzalloc_node(pol->cpd_size, GFP_KERNEL, q->node);
-                if (!cpd) {
-                        ret = -ENOMEM;
-                        goto out_free;
-                }
-                list_add_tail(&cpd->alloc_node, &cpds);
        }
        /*
@@ -1082,32 +1083,17 @@ int blkcg_activate_policy(struct request_queue *q,
        spin_lock_irq(q->queue_lock);
        list_for_each_entry(blkg, &q->blkg_list, q_node) {
-                if (WARN_ON(list_empty(&pds)) ||
+                if (WARN_ON(list_empty(&pds))) {
-                    WARN_ON(pol->cpd_size && list_empty(&cpds))) {
                        /* umm... this shouldn't happen, just abort */
                        ret = -ENOMEM;
                        goto out_unlock;
                }
-                cpd = list_first_entry(&cpds, struct blkcg_policy_data,
-                                       alloc_node);
-                list_del_init(&cpd->alloc_node);
                pd = list_first_entry(&pds, struct blkg_policy_data, alloc_node);
                list_del_init(&pd->alloc_node);
                /* grab blkcg lock too while installing @pd on @blkg */
                spin_lock(&blkg->blkcg->lock);
-                if (!pol->cpd_size)
-                        goto no_cpd;
-                if (!blkg->blkcg->pd[pol->plid]) {
-                        /* Per-policy per-blkcg data */
-                        blkg->blkcg->pd[pol->plid] = cpd;
-                        cpd->plid = pol->plid;
-                        pol->cpd_init_fn(blkg->blkcg);
-                } else { /* must free it as it has already been extracted */
-                        kfree(cpd);
-                }
-no_cpd:
                blkg->pd[pol->plid] = pd;
                pd->blkg = blkg;
                pd->plid = pol->plid;
@@ -1124,8 +1110,6 @@ out_free:
        blk_queue_bypass_end(q);
        list_for_each_entry_safe(pd, nd, &pds, alloc_node)
                kfree(pd);
-        list_for_each_entry_safe(cpd, cnd, &cpds, alloc_node)
-                kfree(cpd);
        return ret;
 }
 EXPORT_SYMBOL_GPL(blkcg_activate_policy);
@@ -1162,8 +1146,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
                kfree(blkg->pd[pol->plid]);
                blkg->pd[pol->plid] = NULL;
-                kfree(blkg->blkcg->pd[pol->plid]);
-                blkg->blkcg->pd[pol->plid] = NULL;
                spin_unlock(&blkg->blkcg->lock);
        }
@@ -1182,11 +1164,13 @@ EXPORT_SYMBOL_GPL(blkcg_deactivate_policy);
 */
 int blkcg_policy_register(struct blkcg_policy *pol)
 {
+        struct blkcg *blkcg;
        int i, ret;
        if (WARN_ON(pol->pd_size < sizeof(struct blkg_policy_data)))
                return -EINVAL;
+        mutex_lock(&blkcg_pol_register_mutex);
        mutex_lock(&blkcg_pol_mutex);
        /* find an empty slot */
@@ -1195,19 +1179,49 @@ int blkcg_policy_register(struct blkcg_policy *pol)
                if (!blkcg_policy[i])
                        break;
        if (i >= BLKCG_MAX_POLS)
-                goto out_unlock;
+                goto err_unlock;
-        /* register and update blkgs */
+        /* register @pol */
        pol->plid = i;
-        blkcg_policy[i] = pol;
+        blkcg_policy[pol->plid] = pol;
+        /* allocate and install cpd's */
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        struct blkcg_policy_data *cpd;
+                        cpd = kzalloc(pol->cpd_size, GFP_KERNEL);
+                        if (!cpd) {
+                                mutex_unlock(&blkcg_pol_mutex);
+                                goto err_free_cpds;
+                        }
+                        blkcg->pd[pol->plid] = cpd;
+                        cpd->plid = pol->plid;
+                        pol->cpd_init_fn(blkcg);
+                }
+        }
+        mutex_unlock(&blkcg_pol_mutex);
        /* everything is in place, add intf files for the new policy */
        if (pol->cftypes)
                WARN_ON(cgroup_add_legacy_cftypes(&blkio_cgrp_subsys,
                                                  pol->cftypes));
-        ret = 0;
+        mutex_unlock(&blkcg_pol_register_mutex);
-out_unlock:
+        return 0;
+err_free_cpds:
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        kfree(blkcg->pd[pol->plid]);
+                        blkcg->pd[pol->plid] = NULL;
+                }
+        }
+        blkcg_policy[pol->plid] = NULL;
+err_unlock:
        mutex_unlock(&blkcg_pol_mutex);
+        mutex_unlock(&blkcg_pol_register_mutex);
        return ret;
 }
 EXPORT_SYMBOL_GPL(blkcg_policy_register);
@@ -1220,7 +1234,9 @@ EXPORT_SYMBOL_GPL(blkcg_policy_register);
 */
 void blkcg_policy_unregister(struct blkcg_policy *pol)
 {
-        mutex_lock(&blkcg_pol_mutex);
+        struct blkcg *blkcg;
+        mutex_lock(&blkcg_pol_register_mutex);
        if (WARN_ON(blkcg_policy[pol->plid] != pol))
                goto out_unlock;
@@ -1229,9 +1245,19 @@ void blkcg_policy_unregister(struct blkcg_policy *pol)
        if (pol->cftypes)
                cgroup_rm_cftypes(pol->cftypes);
-        /* unregister and update blkgs */
+        /* remove cpds and unregister */
+        mutex_lock(&blkcg_pol_mutex);
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        kfree(blkcg->pd[pol->plid]);
+                        blkcg->pd[pol->plid] = NULL;
+                }
+        }
        blkcg_policy[pol->plid] = NULL;
-out_unlock:
        mutex_unlock(&blkcg_pol_mutex);
+out_unlock:
+        mutex_unlock(&blkcg_pol_register_mutex);
 }
 EXPORT_SYMBOL_GPL(blkcg_policy_unregister);
diff --git a/block/blk-core.c b/block/blk-core.c
index 82819e68f58b..627ed0c593fb 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -3370,7 +3370,7 @@ EXPORT_SYMBOL(blk_post_runtime_resume);
 int __init blk_dev_init(void)
 {
        BUILD_BUG_ON(__REQ_NR_BITS > 8 *
-                        sizeof(((struct request *)0)->cmd_flags));
+                        FIELD_SIZEOF(struct request, cmd_flags));
        /* used for unplugging and affects IO latency/throughput - HIGHPRI */
        kblockd_workqueue = alloc_workqueue("kblockd",
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f53779692c77..7d842db59699 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1998,7 +1998,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
                goto err_hctxs;
        setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
-        blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
+        blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
        q->nr_queues = nr_cpu_ids;
        q->nr_hw_queues = set->nr_hw_queues;
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 717afcdb5f4a..88dbbb115285 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -231,7 +231,7 @@ int acpi_device_set_power(struct acpi_device *device, int state)
                dev_warn(&device->dev, "Failed to change power state to %s\n",
                         acpi_power_state_string(state));
        } else {
-                device->power.state = state;
+                device->power.state = target_state;
                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                  "Device [%s] transitioned to %s\n",
                                  device->pnp.bus_id,
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 8244f013f210..f1c966e05078 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -193,6 +193,7 @@ static bool acpi_decode_space(struct resource_win *win,
        u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16;
        bool wp = addr->info.mem.write_protect;
        u64 len = attr->address_length;
+        u64 start, end, offset = 0;
        struct resource *res = &win->res;
        /*
@@ -204,9 +205,6 @@ static bool acpi_decode_space(struct resource_win *win,
                pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n",
                         addr->min_address_fixed, addr->max_address_fixed, len);
-        res->start = attr->minimum;
-        res->end = attr->maximum;
        /*
         * For bridges that translate addresses across the bridge,
         * translation_offset is the offset that must be added to the
@@ -214,12 +212,22 @@ static bool acpi_decode_space(struct resource_win *win,
         * primary side. Non-bridge devices must list 0 for all Address
         * Translation offset bits.
         */
-        if (addr->producer_consumer == ACPI_PRODUCER) {
+        if (addr->producer_consumer == ACPI_PRODUCER)
-                res->start += attr->translation_offset;
+                offset = attr->translation_offset;
-                res->end += attr->translation_offset;
+        else if (attr->translation_offset)
-        } else if (attr->translation_offset) {
                pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n",
                         attr->translation_offset);
+        start = attr->minimum + offset;
+        end = attr->maximum + offset;
+        win->offset = offset;
+        res->start = start;
+        res->end = end;
+        if (sizeof(resource_size_t) < sizeof(u64) &&
+            (offset != win->offset || start != res->start || end != res->end)) {
+                pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n",
+                        attr->minimum, attr->maximum);
+                return false;
        }
        switch (addr->resource_type) {
@@ -236,8 +244,6 @@ static bool acpi_decode_space(struct resource_win *win,
                return false;
        }
-        win->offset = attr->translation_offset;
        if (addr->producer_consumer == ACPI_PRODUCER)
                res->flags |= IORESOURCE_WINDOW;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e83fc3d0da9c..db5d9f79a247 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device *dev)
                dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
                                         dev->max_sectors);
+        if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
+                dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
+                                         dev->max_sectors);
        if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
                dev->max_sectors = ATA_MAX_SECTORS_LBA48;
@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "Slimtype DVD A  DS8A8SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
        { "Slimtype DVD A  DS8A9SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
+        /*
+         * Causes silent data corruption with higher max sects.
+         * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
+         */
+        { "ST380013AS",         "3.20",         ATA_HORKAGE_MAX_SEC_1024 },
        /* Devices we expect to fail diagnostics */
        /* Devices where NCQ should be avoided */
@@ -4174,9 +4184,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                ATA_HORKAGE_FIRMWARE_WARN },
-        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
        { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+        { "VB0250EAVER",        "HPG7",         ATA_HORKAGE_BROKEN_FPDMA_AA },
        /* Blacklist entries taken from Silicon Image 3124/3132
           Windows driver .inf file - also several Linux problem reports */
@@ -4229,7 +4240,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "Crucial_CT*M500*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Micron_M5[15]0*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Micron_M5[15]0_*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "Crucial_CT*M550*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4238,6 +4249,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "Samsung SSD 8*",             NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        /* devices that don't properly handle TRIM commands */
+        { "SuperSSpeed S238*",          NULL,   ATA_HORKAGE_NOTRIM, },
        /*
         * As defined, the DRAT (Deterministic Read After Trim) and RZAT
         * (Return Zero After Trim) flags in the ATA Command Set are
@@ -4501,7 +4515,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
        else /* In the ancient relic department - skip all of this */
                return 0;
-        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+        /* On some disks, this command causes spin-up, so we need longer timeout */
+        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
        DPRINTK("EXIT, err_mask=%x\n", err_mask);
        return err_mask;
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 7ccc084bf1df..85aa76116a30 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
                                       ATA_LFLAG_NO_SRST |
                                       ATA_LFLAG_ASSUME_ATA;
                }
+        } else if (vendor == 0x11ab && devid == 0x4140) {
+                /* Marvell 4140 quirks */
+                ata_for_each_link(link, ap, EDGE) {
+                        /* port 4 is for SEMB device and it doesn't like SRST */
+                        if (link->pmp == 4)
+                                link->flags |= ATA_LFLAG_DISABLED;
+                }
        }
 }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 3131adcc1f87..641a61a59e89 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                rbuf[14] = (lowest_aligned >> 8) & 0x3f;
                rbuf[15] = lowest_aligned;
-                if (ata_id_has_trim(args->id)) {
+                if (ata_id_has_trim(args->id) &&
+                    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
                        rbuf[14] |= 0x80; /* LBPME */
                        if (ata_id_has_zero_after_trim(args->id) &&
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index d6c37bcd416d..e2d94972962d 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -569,6 +569,8 @@ show_ata_dev_trim(struct device *dev,
        if (!ata_id_has_trim(ata_dev->id))
                mode = "unsupported";
+        else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
+                mode = "forced_unsupported";
        else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
                        mode = "forced_unqueued";
        else if (ata_fpdma_dsm_supported(ata_dev))
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index a9b0c820f2eb..5d9ee99c2148 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -4,7 +4,7 @@
 * Arasan Compact Flash host controller source file
 *
 * Copyright (C) 2011 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -968,7 +968,7 @@ static struct platform_driver arasan_cf_driver = {
 module_platform_driver(arasan_cf_driver);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("Arasan ATA Compact Flash driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 69de41a87b74..3177b245d2bd 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -240,19 +240,19 @@ static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
        while ((entry = llist_del_all(&cq->list)) != NULL) {
                entry = llist_reverse_order(entry);
                do {
+                        struct request_queue *q = NULL;
                        cmd = container_of(entry, struct nullb_cmd, ll_list);
                        entry = entry->next;
+                        if (cmd->rq)
+                                q = cmd->rq->q;
                        end_cmd(cmd);
-                        if (cmd->rq) {
+                        if (q && !q->mq_ops && blk_queue_stopped(q)) {
-                                struct request_queue *q = cmd->rq->q;
+                                spin_lock(q->queue_lock);
+                                if (blk_queue_stopped(q))
-                                if (!q->mq_ops && blk_queue_stopped(q)) {
+                                        blk_start_queue(q);
-                                        spin_lock(q->queue_lock);
+                                spin_unlock(q->queue_lock);
-                                        if (blk_queue_stopped(q))
-                                                blk_start_queue(q);
-                                        spin_unlock(q->queue_lock);
-                                }
                        }
                } while (entry);
        }
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index d1d6141920d3..7920c2741b47 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -2108,8 +2108,17 @@ static void nvme_alloc_ns(struct nvme_dev *dev, unsigned nsid)
                goto out_free_disk;
        add_disk(ns->disk);
-        if (ns->ms)
+        if (ns->ms) {
-                revalidate_disk(ns->disk);
+                struct block_device *bd = bdget_disk(ns->disk, 0);
+                if (!bd)
+                        return;
+                if (blkdev_get(bd, FMODE_READ, NULL)) {
+                        bdput(bd);
+                        return;
+                }
+                blkdev_reread_part(bd);
+                blkdev_put(bd, FMODE_READ);
+        }
        return;
 out_free_disk:
        kfree(disk);
diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index 1e1a4323a71f..9ceb8ac68fdc 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -472,12 +472,11 @@ int btbcm_setup_apple(struct hci_dev *hdev)
        /* Read Verbose Config Version Info */
        skb = btbcm_read_verbose_config(hdev);
-        if (IS_ERR(skb))
+        if (!IS_ERR(skb)) {
-                return PTR_ERR(skb);
+                BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
+                        get_unaligned_le16(skb->data + 5));
-        BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
+                kfree_skb(skb);
-                get_unaligned_le16(skb->data + 5));
+        }
-        kfree_skb(skb);
        set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 283f00a7f036..1082d4bb016a 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
        device_initialize(&chip->dev);
-        chip->cdev.owner = chip->pdev->driver->owner;
        cdev_init(&chip->cdev, &tpm_fops);
+        chip->cdev.owner = chip->pdev->driver->owner;
+        chip->cdev.kobj.parent = &chip->dev.kobj;
        return chip;
 }
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 44f9d20c19ac..1267322595da 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_device *device)
                return -ENODEV;
        }
+        /* At least some versions of AMI BIOS have a bug that TPM2 table has
+         * zero address for the control area and therefore we must fail.
+        */
+        if (!buf->control_area_pa) {
+                dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
+                return -EINVAL;
+        }
        if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
                dev_err(dev, "TPM2 ACPI table has wrong size");
                return -EINVAL;
diff --git a/drivers/clk/spear/clk-aux-synth.c b/drivers/clk/spear/clk-aux-synth.c
index bdfb4421c643..f271c350ef94 100644
--- a/drivers/clk/spear/clk-aux-synth.c
+++ b/drivers/clk/spear/clk-aux-synth.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-frac-synth.c b/drivers/clk/spear/clk-frac-synth.c
index dffd4ce6c8b5..58d678b5b40a 100644
--- a/drivers/clk/spear/clk-frac-synth.c
+++ b/drivers/clk/spear/clk-frac-synth.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-gpt-synth.c b/drivers/clk/spear/clk-gpt-synth.c
index 1afc18c4effc..1a722e99e76e 100644
--- a/drivers/clk/spear/clk-gpt-synth.c
+++ b/drivers/clk/spear/clk-gpt-synth.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-vco-pll.c b/drivers/clk/spear/clk-vco-pll.c
index 1b9b65bca51e..5ebddc528145 100644
--- a/drivers/clk/spear/clk-vco-pll.c
+++ b/drivers/clk/spear/clk-vco-pll.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk.c b/drivers/clk/spear/clk.c
index 628b6d5ed3d9..157fe099ea6a 100644
--- a/drivers/clk/spear/clk.c
+++ b/drivers/clk/spear/clk.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk.h b/drivers/clk/spear/clk.h
index 931737677dfa..9834944f08b1 100644
--- a/drivers/clk/spear/clk.h
+++ b/drivers/clk/spear/clk.h
@@ -2,7 +2,7 @@
 * Clock framework definitions for SPEAr platform
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear1310_clock.c b/drivers/clk/spear/spear1310_clock.c
index 4daa5977793a..222ce108b41a 100644
--- a/drivers/clk/spear/spear1310_clock.c
+++ b/drivers/clk/spear/spear1310_clock.c
@@ -4,7 +4,7 @@
 * SPEAr1310 machine clock framework source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear1340_clock.c b/drivers/clk/spear/spear1340_clock.c
index 5a5c6648308d..973c9d3fbcf8 100644
--- a/drivers/clk/spear/spear1340_clock.c
+++ b/drivers/clk/spear/spear1340_clock.c
@@ -4,7 +4,7 @@
 * SPEAr1340 machine clock framework source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index bb5f387774e2..404a55edd613 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -2,7 +2,7 @@
 * SPEAr3xx machines clock framework source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear6xx_clock.c b/drivers/clk/spear/spear6xx_clock.c
index 4f649c9cb094..231061fa73a4 100644
--- a/drivers/clk/spear/spear6xx_clock.c
+++ b/drivers/clk/spear/spear6xx_clock.c
@@ -2,7 +2,7 @@
 * SPEAr6xx machines clock framework source file
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b612411655f9..7a3c30c4336f 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -169,6 +169,15 @@ struct kobject *get_governor_parent_kobj(struct cpufreq_policy *policy)
 }
 EXPORT_SYMBOL_GPL(get_governor_parent_kobj);
+struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu)
+{
+        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+        return policy && !policy_is_inactive(policy) ?
+                policy->freq_table : NULL;
+}
+EXPORT_SYMBOL_GPL(cpufreq_frequency_get_table);
 static inline u64 get_cpu_idle_time_jiffy(unsigned int cpu, u64 *wall)
 {
        u64 idle_time;
@@ -993,7 +1002,7 @@ static int cpufreq_add_dev_symlink(struct cpufreq_policy *policy)
        int ret = 0;
        /* Some related CPUs might not be present (physically hotplugged) */
-        for_each_cpu_and(j, policy->related_cpus, cpu_present_mask) {
+        for_each_cpu(j, policy->real_cpus) {
                if (j == policy->kobj_cpu)
                        continue;
@@ -1010,7 +1019,7 @@ static void cpufreq_remove_dev_symlink(struct cpufreq_policy *policy)
        unsigned int j;
        /* Some related CPUs might not be present (physically hotplugged) */
-        for_each_cpu_and(j, policy->related_cpus, cpu_present_mask) {
+        for_each_cpu(j, policy->real_cpus) {
                if (j == policy->kobj_cpu)
                        continue;
@@ -1132,6 +1141,7 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
                down_write(&policy->rwsem);
                policy->cpu = cpu;
+                policy->governor = NULL;
                up_write(&policy->rwsem);
        }
@@ -1153,11 +1163,14 @@ static struct cpufreq_policy *cpufreq_policy_alloc(struct device *dev)
        if (!zalloc_cpumask_var(&policy->related_cpus, GFP_KERNEL))
                goto err_free_cpumask;
+        if (!zalloc_cpumask_var(&policy->real_cpus, GFP_KERNEL))
+                goto err_free_rcpumask;
        ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &dev->kobj,
                                   "cpufreq");
        if (ret) {
                pr_err("%s: failed to init policy->kobj: %d\n", __func__, ret);
-                goto err_free_rcpumask;
+                goto err_free_real_cpus;
        }
        INIT_LIST_HEAD(&policy->policy_list);
@@ -1174,6 +1187,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(struct device *dev)
        return policy;
+err_free_real_cpus:
+        free_cpumask_var(policy->real_cpus);
 err_free_rcpumask:
        free_cpumask_var(policy->related_cpus);
 err_free_cpumask:
@@ -1224,6 +1239,7 @@ static void cpufreq_policy_free(struct cpufreq_policy *policy, bool notify)
        write_unlock_irqrestore(&cpufreq_driver_lock, flags);
        cpufreq_policy_put_kobj(policy, notify);
+        free_cpumask_var(policy->real_cpus);
        free_cpumask_var(policy->related_cpus);
        free_cpumask_var(policy->cpus);
        kfree(policy);
@@ -1248,14 +1264,17 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
        pr_debug("adding CPU %u\n", cpu);
-        /*
+        if (cpu_is_offline(cpu)) {
-         * Only possible if 'cpu' wasn't physically present earlier and we are
+                /*
-         * here from subsys_interface add callback. A hotplug notifier will
+                 * Only possible if we are here from the subsys_interface add
-         * follow and we will handle it like logical CPU hotplug then. For now,
+                 * callback.  A hotplug notifier will follow and we will handle
-         * just create the sysfs link.
+                 * it as CPU online then.  For now, just create the sysfs link,
-         */
+                 * unless there is no policy or the link is already present.
-        if (cpu_is_offline(cpu))
+                 */
-                return add_cpu_dev_symlink(per_cpu(cpufreq_cpu_data, cpu), cpu);
+                policy = per_cpu(cpufreq_cpu_data, cpu);
+                return policy && !cpumask_test_and_set_cpu(cpu, policy->real_cpus)
+                        ? add_cpu_dev_symlink(policy, cpu) : 0;
+        }
        if (!down_read_trylock(&cpufreq_rwsem))
                return 0;
@@ -1297,6 +1316,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
        /* related cpus should atleast have policy->cpus */
        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
+        /* Remember which CPUs have been present at the policy creation time. */
+        if (!recover_policy)
+                cpumask_and(policy->real_cpus, policy->cpus, cpu_present_mask);
        /*
         * affected cpus must always be the one, which are online. We aren't
         * managing offline cpus here.
@@ -1410,8 +1433,7 @@ nomem_out:
        return ret;
 }
-static int __cpufreq_remove_dev_prepare(struct device *dev,
+static int __cpufreq_remove_dev_prepare(struct device *dev)
-                                        struct subsys_interface *sif)
 {
        unsigned int cpu = dev->id;
        int ret = 0;
@@ -1427,10 +1449,8 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
        if (has_target()) {
                ret = __cpufreq_governor(policy, CPUFREQ_GOV_STOP);
-                if (ret) {
+                if (ret)
                        pr_err("%s: Failed to stop governor\n", __func__);
-                        return ret;
-                }
        }
        down_write(&policy->rwsem);
@@ -1463,8 +1483,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
        return ret;
 }
-static int __cpufreq_remove_dev_finish(struct device *dev,
+static int __cpufreq_remove_dev_finish(struct device *dev)
-                                       struct subsys_interface *sif)
 {
        unsigned int cpu = dev->id;
        int ret;
@@ -1482,10 +1501,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
        /* If cpu is last user of policy, free policy */
        if (has_target()) {
                ret = __cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
-                if (ret) {
+                if (ret)
                        pr_err("%s: Failed to exit governor\n", __func__);
-                        return ret;
-                }
        }
        /*
@@ -1496,10 +1513,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
        if (cpufreq_driver->exit)
                cpufreq_driver->exit(policy);
-        /* Free the policy only if the driver is getting removed. */
-        if (sif)
-                cpufreq_policy_free(policy, true);
        return 0;
 }
@@ -1511,42 +1524,41 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
 static int cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)
 {
        unsigned int cpu = dev->id;
-        int ret;
+        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
-        /*
-         * Only possible if 'cpu' is getting physically removed now. A hotplug
-         * notifier should have already been called and we just need to remove
-         * link or free policy here.
-         */
-        if (cpu_is_offline(cpu)) {
-                struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
-                struct cpumask mask;
-                if (!policy)
+        if (!policy)
-                        return 0;
+                return 0;
-                cpumask_copy(&mask, policy->related_cpus);
+        if (cpu_online(cpu)) {
-                cpumask_clear_cpu(cpu, &mask);
+                __cpufreq_remove_dev_prepare(dev);
+                __cpufreq_remove_dev_finish(dev);
+        }
-                /*
+        cpumask_clear_cpu(cpu, policy->real_cpus);
-                 * Free policy only if all policy->related_cpus are removed
-                 * physically.
-                 */
-                if (cpumask_intersects(&mask, cpu_present_mask)) {
-                        remove_cpu_dev_symlink(policy, cpu);
-                        return 0;
-                }
+        if (cpumask_empty(policy->real_cpus)) {
                cpufreq_policy_free(policy, true);
                return 0;
        }
-        ret = __cpufreq_remove_dev_prepare(dev, sif);
+        if (cpu != policy->kobj_cpu) {
+                remove_cpu_dev_symlink(policy, cpu);
+        } else {
+                /*
+                 * The CPU owning the policy object is going away.  Move it to
+                 * another suitable CPU.
+                 */
+                unsigned int new_cpu = cpumask_first(policy->real_cpus);
+                struct device *new_dev = get_cpu_device(new_cpu);
-        if (!ret)
+                dev_dbg(dev, "%s: Moving policy object to CPU%u\n", __func__, new_cpu);
-                ret = __cpufreq_remove_dev_finish(dev, sif);
-        return ret;
+                sysfs_remove_link(&new_dev->kobj, "cpufreq");
+                policy->kobj_cpu = new_cpu;
+                WARN_ON(kobject_move(&policy->kobj, &new_dev->kobj));
+        }
+        return 0;
 }
 static void handle_update(struct work_struct *work)
@@ -2385,11 +2397,11 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
                        break;
                case CPU_DOWN_PREPARE:
-                        __cpufreq_remove_dev_prepare(dev, NULL);
+                        __cpufreq_remove_dev_prepare(dev);
                        break;
                case CPU_POST_DEAD:
-                        __cpufreq_remove_dev_finish(dev, NULL);
+                        __cpufreq_remove_dev_finish(dev);
                        break;
                case CPU_DOWN_FAILED:
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index df14766a8e06..dfbbf981ed56 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -297,15 +297,6 @@ int cpufreq_table_validate_and_show(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_table_validate_and_show);
-struct cpufreq_policy *cpufreq_cpu_get_raw(unsigned int cpu);
-struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu)
-{
-        struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu);
-        return policy ? policy->freq_table : NULL;
-}
-EXPORT_SYMBOL_GPL(cpufreq_frequency_get_table);
 MODULE_AUTHOR("Dominik Brodowski <linux@brodo.de>");
 MODULE_DESCRIPTION("CPUfreq frequency table helpers");
 MODULE_LICENSE("GPL");
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 15ada47bb720..fcb929ec5304 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -681,6 +681,7 @@ static struct cpu_defaults knl_params = {
                .get_max = core_get_max_pstate,
                .get_min = core_get_min_pstate,
                .get_turbo = knl_get_turbo_pstate,
+                .get_scaling = core_get_scaling,
                .set = core_set_pstate,
        },
 };
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index e8e2775c3821..48b7228563ad 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -112,7 +112,12 @@ int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
 static void enter_freeze_proper(struct cpuidle_driver *drv,
                                struct cpuidle_device *dev, int index)
 {
-        tick_freeze();
+        /*
+         * trace_suspend_resume() called by tick_freeze() for the last CPU
+         * executing it contains RCU usage regarded as invalid in the idle
+         * context, so tell RCU about that.
+         */
+        RCU_NONIDLE(tick_freeze());
        /*
         * The state used here cannot be a "coupled" one, because the "coupled"
         * cpuidle mechanism enables interrupts and doing that with timekeeping
@@ -122,7 +127,7 @@ static void enter_freeze_proper(struct cpuidle_driver *drv,
        WARN_ON(!irqs_disabled());
        /*
         * timekeeping_resume() that will be called by tick_unfreeze() for the
-         * last CPU executing it calls functions containing RCU read-side
+         * first CPU executing it calls functions containing RCU read-side
         * critical sections, so tell RCU about that.
         */
        RCU_NONIDLE(tick_unfreeze());
diff --git a/drivers/crypto/nx/nx-aes-ccm.c b/drivers/crypto/nx/nx-aes-ccm.c
index 67f80813a06f..e4311ce0cd78 100644
--- a/drivers/crypto/nx/nx-aes-ccm.c
+++ b/drivers/crypto/nx/nx-aes-ccm.c
@@ -494,8 +494,9 @@ out:
 static int ccm4309_aes_nx_encrypt(struct aead_request *req)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
        struct blkcipher_desc desc;
-        u8 *iv = nx_ctx->priv.ccm.iv;
+        u8 *iv = rctx->iv;
        iv[0] = 3;
        memcpy(iv + 1, nx_ctx->priv.ccm.nonce, 3);
@@ -525,8 +526,9 @@ static int ccm_aes_nx_encrypt(struct aead_request *req)
 static int ccm4309_aes_nx_decrypt(struct aead_request *req)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
        struct blkcipher_desc desc;
-        u8 *iv = nx_ctx->priv.ccm.iv;
+        u8 *iv = rctx->iv;
        iv[0] = 3;
        memcpy(iv + 1, nx_ctx->priv.ccm.nonce, 3);
diff --git a/drivers/crypto/nx/nx-aes-ctr.c b/drivers/crypto/nx/nx-aes-ctr.c
index 2617cd4d54dd..dd7e9f3f5b6b 100644
--- a/drivers/crypto/nx/nx-aes-ctr.c
+++ b/drivers/crypto/nx/nx-aes-ctr.c
@@ -72,7 +72,7 @@ static int ctr3686_aes_nx_set_key(struct crypto_tfm *tfm,
        if (key_len < CTR_RFC3686_NONCE_SIZE)
                return -EINVAL;
-        memcpy(nx_ctx->priv.ctr.iv,
+        memcpy(nx_ctx->priv.ctr.nonce,
               in_key + key_len - CTR_RFC3686_NONCE_SIZE,
               CTR_RFC3686_NONCE_SIZE);
@@ -131,14 +131,15 @@ static int ctr3686_aes_nx_crypt(struct blkcipher_desc *desc,
                                unsigned int           nbytes)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_blkcipher_ctx(desc->tfm);
-        u8 *iv = nx_ctx->priv.ctr.iv;
+        u8 iv[16];
+        memcpy(iv, nx_ctx->priv.ctr.nonce, CTR_RFC3686_IV_SIZE);
        memcpy(iv + CTR_RFC3686_NONCE_SIZE,
               desc->info, CTR_RFC3686_IV_SIZE);
        iv[12] = iv[13] = iv[14] = 0;
        iv[15] = 1;
-        desc->info = nx_ctx->priv.ctr.iv;
+        desc->info = iv;
        return ctr_aes_nx_crypt(desc, dst, src, nbytes);
 }
diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
index 08ac6d48688c..92c993f08213 100644
--- a/drivers/crypto/nx/nx-aes-gcm.c
+++ b/drivers/crypto/nx/nx-aes-gcm.c
@@ -317,6 +317,7 @@ out:
 static int gcm_aes_nx_crypt(struct aead_request *req, int enc)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
        struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
        struct blkcipher_desc desc;
        unsigned int nbytes = req->cryptlen;
@@ -326,7 +327,7 @@ static int gcm_aes_nx_crypt(struct aead_request *req, int enc)
        spin_lock_irqsave(&nx_ctx->lock, irq_flags);
-        desc.info = nx_ctx->priv.gcm.iv;
+        desc.info = rctx->iv;
        /* initialize the counter */
        *(u32 *)(desc.info + NX_GCM_CTR_OFFSET) = 1;
@@ -424,8 +425,8 @@ out:
 static int gcm_aes_nx_encrypt(struct aead_request *req)
 {
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
-        char *iv = nx_ctx->priv.gcm.iv;
+        char *iv = rctx->iv;
        memcpy(iv, req->iv, 12);
@@ -434,8 +435,8 @@ static int gcm_aes_nx_encrypt(struct aead_request *req)
 static int gcm_aes_nx_decrypt(struct aead_request *req)
 {
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
-        char *iv = nx_ctx->priv.gcm.iv;
+        char *iv = rctx->iv;
        memcpy(iv, req->iv, 12);
@@ -445,7 +446,8 @@ static int gcm_aes_nx_decrypt(struct aead_request *req)
 static int gcm4106_aes_nx_encrypt(struct aead_request *req)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
        char *nonce = nx_ctx->priv.gcm.nonce;
        memcpy(iv, nonce, NX_GCM4106_NONCE_LEN);
@@ -457,7 +459,8 @@ static int gcm4106_aes_nx_encrypt(struct aead_request *req)
 static int gcm4106_aes_nx_decrypt(struct aead_request *req)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
        char *nonce = nx_ctx->priv.gcm.nonce;
        memcpy(iv, nonce, NX_GCM4106_NONCE_LEN);
diff --git a/drivers/crypto/nx/nx-aes-xcbc.c b/drivers/crypto/nx/nx-aes-xcbc.c
index 8c2faffab4a3..c2f7d4befb55 100644
--- a/drivers/crypto/nx/nx-aes-xcbc.c
+++ b/drivers/crypto/nx/nx-aes-xcbc.c
@@ -42,6 +42,7 @@ static int nx_xcbc_set_key(struct crypto_shash *desc,
                           unsigned int         key_len)
 {
        struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc);
+        struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
        switch (key_len) {
        case AES_KEYSIZE_128:
@@ -51,7 +52,7 @@ static int nx_xcbc_set_key(struct crypto_shash *desc,
                return -EINVAL;
        }
-        memcpy(nx_ctx->priv.xcbc.key, in_key, key_len);
+        memcpy(csbcpb->cpb.aes_xcbc.key, in_key, key_len);
        return 0;
 }
@@ -148,32 +149,29 @@ out:
        return rc;
 }
-static int nx_xcbc_init(struct shash_desc *desc)
+static int nx_crypto_ctx_aes_xcbc_init2(struct crypto_tfm *tfm)
 {
-        struct xcbc_state *sctx = shash_desc_ctx(desc);
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
        struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
-        struct nx_sg *out_sg;
+        int err;
-        int len;
-        nx_ctx_init(nx_ctx, HCOP_FC_AES);
+        err = nx_crypto_ctx_aes_xcbc_init(tfm);
+        if (err)
+                return err;
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_AES);
        NX_CPB_SET_KEY_SIZE(csbcpb, NX_KS_AES_128);
        csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC;
-        memcpy(csbcpb->cpb.aes_xcbc.key, nx_ctx->priv.xcbc.key, AES_BLOCK_SIZE);
+        return 0;
-        memset(nx_ctx->priv.xcbc.key, 0, sizeof *nx_ctx->priv.xcbc.key);
+}
-        len = AES_BLOCK_SIZE;
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
-                                  &len, nx_ctx->ap->sglen);
-        if (len != AES_BLOCK_SIZE)
+static int nx_xcbc_init(struct shash_desc *desc)
-                return -EINVAL;
+{
+        struct xcbc_state *sctx = shash_desc_ctx(desc);
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+        memset(sctx, 0, sizeof *sctx);
        return 0;
 }
@@ -186,6 +184,7 @@ static int nx_xcbc_update(struct shash_desc *desc,
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
        struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
        struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
        u32 to_process = 0, leftover, total;
        unsigned int max_sg_len;
        unsigned long irq_flags;
@@ -213,6 +212,17 @@ static int nx_xcbc_update(struct shash_desc *desc,
        max_sg_len = min_t(u64, max_sg_len,
                                nx_ctx->ap->databytelen/NX_PAGE_SIZE);
+        data_len = AES_BLOCK_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &len, nx_ctx->ap->sglen);
+        if (data_len != AES_BLOCK_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
        do {
                to_process = total - to_process;
                to_process = to_process & ~(AES_BLOCK_SIZE - 1);
@@ -235,8 +245,10 @@ static int nx_xcbc_update(struct shash_desc *desc,
                                                (u8 *) sctx->buffer,
                                                &data_len,
                                                max_sg_len);
-                        if (data_len != sctx->count)
+                        if (data_len != sctx->count) {
-                                return -EINVAL;
+                                rc = -EINVAL;
+                                goto out;
+                        }
                }
                data_len = to_process - sctx->count;
@@ -245,8 +257,10 @@ static int nx_xcbc_update(struct shash_desc *desc,
                                        &data_len,
                                        max_sg_len);
-                if (data_len != to_process - sctx->count)
+                if (data_len != to_process - sctx->count) {
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
+                }
                nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) *
                                        sizeof(struct nx_sg);
@@ -325,15 +339,19 @@ static int nx_xcbc_final(struct shash_desc *desc, u8 *out)
        in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *)sctx->buffer,
                                 &len, nx_ctx->ap->sglen);
-        if (len != sctx->count)
+        if (len != sctx->count) {
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
+        }
        len = AES_BLOCK_SIZE;
        out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len,
                                  nx_ctx->ap->sglen);
-        if (len != AES_BLOCK_SIZE)
+        if (len != AES_BLOCK_SIZE) {
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
+        }
        nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
@@ -372,7 +390,7 @@ struct shash_alg nx_shash_aes_xcbc_alg = {
                .cra_blocksize   = AES_BLOCK_SIZE,
                .cra_module      = THIS_MODULE,
                .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_aes_xcbc_init,
+                .cra_init        = nx_crypto_ctx_aes_xcbc_init2,
                .cra_exit        = nx_crypto_ctx_exit,
        }
 };
diff --git a/drivers/crypto/nx/nx-sha256.c b/drivers/crypto/nx/nx-sha256.c
index 4e91bdb83c59..08f8d5cd6334 100644
--- a/drivers/crypto/nx/nx-sha256.c
+++ b/drivers/crypto/nx/nx-sha256.c
@@ -29,34 +29,28 @@
 #include "nx.h"
-static int nx_sha256_init(struct shash_desc *desc)
+static int nx_crypto_ctx_sha256_init(struct crypto_tfm *tfm)
 {
-        struct sha256_state *sctx = shash_desc_ctx(desc);
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
+        int err;
-        struct nx_sg *out_sg;
-        int len;
-        u32 max_sg_len;
-        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
+        err = nx_crypto_ctx_sha_init(tfm);
+        if (err)
+                return err;
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
        nx_ctx->ap = &nx_ctx->props[NX_PROPS_SHA256];
        NX_CPB_SET_DIGEST_SIZE(nx_ctx->csbcpb, NX_DS_SHA256);
-        max_sg_len = min_t(u64, nx_ctx->ap->sglen,
+        return 0;
-                        nx_driver.of.max_sg_len/sizeof(struct nx_sg));
+}
-        max_sg_len = min_t(u64, max_sg_len,
-                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
-        len = SHA256_DIGEST_SIZE;
+static int nx_sha256_init(struct shash_desc *desc) {
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+        struct sha256_state *sctx = shash_desc_ctx(desc);
-                                  &len, max_sg_len);
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
-        if (len != SHA256_DIGEST_SIZE)
+        memset(sctx, 0, sizeof *sctx);
-                return -EINVAL;
        sctx->state[0] = __cpu_to_be32(SHA256_H0);
        sctx->state[1] = __cpu_to_be32(SHA256_H1);
@@ -78,6 +72,7 @@ static int nx_sha256_update(struct shash_desc *desc, const u8 *data,
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
        struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
        struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
        u64 to_process = 0, leftover, total;
        unsigned long irq_flags;
        int rc = 0;
@@ -108,6 +103,16 @@ static int nx_sha256_update(struct shash_desc *desc, const u8 *data,
        max_sg_len = min_t(u64, max_sg_len,
                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
+        data_len = SHA256_DIGEST_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &data_len, max_sg_len);
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+        if (data_len != SHA256_DIGEST_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
        do {
                /*
                 * to_process: the SHA256_BLOCK_SIZE data chunk to process in
@@ -282,7 +287,7 @@ struct shash_alg nx_shash_sha256_alg = {
                .cra_blocksize   = SHA256_BLOCK_SIZE,
                .cra_module      = THIS_MODULE,
                .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_sha_init,
+                .cra_init        = nx_crypto_ctx_sha256_init,
                .cra_exit        = nx_crypto_ctx_exit,
        }
 };
diff --git a/drivers/crypto/nx/nx-sha512.c b/drivers/crypto/nx/nx-sha512.c
index e6a58d2ee628..aff0fe58eac0 100644
--- a/drivers/crypto/nx/nx-sha512.c
+++ b/drivers/crypto/nx/nx-sha512.c
@@ -28,34 +28,29 @@
 #include "nx.h"
-static int nx_sha512_init(struct shash_desc *desc)
+static int nx_crypto_ctx_sha512_init(struct crypto_tfm *tfm)
 {
-        struct sha512_state *sctx = shash_desc_ctx(desc);
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
+        int err;
-        struct nx_sg *out_sg;
-        int len;
-        u32 max_sg_len;
-        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
+        err = nx_crypto_ctx_sha_init(tfm);
+        if (err)
+                return err;
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
        nx_ctx->ap = &nx_ctx->props[NX_PROPS_SHA512];
        NX_CPB_SET_DIGEST_SIZE(nx_ctx->csbcpb, NX_DS_SHA512);
-        max_sg_len = min_t(u64, nx_ctx->ap->sglen,
+        return 0;
-                        nx_driver.of.max_sg_len/sizeof(struct nx_sg));
+}
-        max_sg_len = min_t(u64, max_sg_len,
-                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
-        len = SHA512_DIGEST_SIZE;
+static int nx_sha512_init(struct shash_desc *desc)
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+{
-                                  &len, max_sg_len);
+        struct sha512_state *sctx = shash_desc_ctx(desc);
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
-        if (len != SHA512_DIGEST_SIZE)
+        memset(sctx, 0, sizeof *sctx);
-                return -EINVAL;
        sctx->state[0] = __cpu_to_be64(SHA512_H0);
        sctx->state[1] = __cpu_to_be64(SHA512_H1);
@@ -77,6 +72,7 @@ static int nx_sha512_update(struct shash_desc *desc, const u8 *data,
        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
        struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
        struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
        u64 to_process, leftover = 0, total;
        unsigned long irq_flags;
        int rc = 0;
@@ -107,6 +103,16 @@ static int nx_sha512_update(struct shash_desc *desc, const u8 *data,
        max_sg_len = min_t(u64, max_sg_len,
                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
+        data_len = SHA512_DIGEST_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &data_len, max_sg_len);
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+        if (data_len != SHA512_DIGEST_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
        do {
                /*
                 * to_process: the SHA512_BLOCK_SIZE data chunk to process in
@@ -288,7 +294,7 @@ struct shash_alg nx_shash_sha512_alg = {
                .cra_blocksize   = SHA512_BLOCK_SIZE,
                .cra_module      = THIS_MODULE,
                .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_sha_init,
+                .cra_init        = nx_crypto_ctx_sha512_init,
                .cra_exit        = nx_crypto_ctx_exit,
        }
 };
diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
index f6198f29a4a8..436971343ff7 100644
--- a/drivers/crypto/nx/nx.c
+++ b/drivers/crypto/nx/nx.c
@@ -713,12 +713,15 @@ static int nx_crypto_ctx_init(struct nx_crypto_ctx *nx_ctx, u32 fc, u32 mode)
 /* entry points from the crypto tfm initializers */
 int nx_crypto_ctx_aes_ccm_init(struct crypto_tfm *tfm)
 {
+        crypto_aead_set_reqsize(__crypto_aead_cast(tfm),
+                                sizeof(struct nx_ccm_rctx));
        return nx_crypto_ctx_init(crypto_tfm_ctx(tfm), NX_FC_AES,
                                  NX_MODE_AES_CCM);
 }
 int nx_crypto_ctx_aes_gcm_init(struct crypto_aead *tfm)
 {
+        crypto_aead_set_reqsize(tfm, sizeof(struct nx_gcm_rctx));
        return nx_crypto_ctx_init(crypto_aead_ctx(tfm), NX_FC_AES,
                                  NX_MODE_AES_GCM);
 }
diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h
index de3ea8738146..cdff03a42ae7 100644
--- a/drivers/crypto/nx/nx.h
+++ b/drivers/crypto/nx/nx.h
@@ -2,6 +2,8 @@
 #ifndef __NX_H__
 #define __NX_H__
+#include <crypto/ctr.h>
 #define NX_NAME         "nx-crypto"
 #define NX_STRING       "IBM Power7+ Nest Accelerator Crypto Driver"
 #define NX_VERSION      "1.0"
@@ -91,8 +93,11 @@ struct nx_crypto_driver {
 #define NX_GCM4106_NONCE_LEN            (4)
 #define NX_GCM_CTR_OFFSET               (12)
-struct nx_gcm_priv {
+struct nx_gcm_rctx {
        u8 iv[16];
+};
+struct nx_gcm_priv {
        u8 iauth_tag[16];
        u8 nonce[NX_GCM4106_NONCE_LEN];
 };
@@ -100,8 +105,11 @@ struct nx_gcm_priv {
 #define NX_CCM_AES_KEY_LEN              (16)
 #define NX_CCM4309_AES_KEY_LEN          (19)
 #define NX_CCM4309_NONCE_LEN            (3)
-struct nx_ccm_priv {
+struct nx_ccm_rctx {
        u8 iv[16];
+};
+struct nx_ccm_priv {
        u8 b0[16];
        u8 iauth_tag[16];
        u8 oauth_tag[16];
@@ -113,7 +121,7 @@ struct nx_xcbc_priv {
 };
 struct nx_ctr_priv {
-        u8 iv[16];
+        u8 nonce[CTR_RFC3686_NONCE_SIZE];
 };
 struct nx_crypto_ctx {
diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 46307098f8ba..0a70e46d5416 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
        dmaengine_terminate_all(dd->dma_lch_in);
        dmaengine_terminate_all(dd->dma_lch_out);
-        dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
-        dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
        return err;
 }
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 1022c2e1a2b0..cf1c87fa1edd 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1746,4 +1746,4 @@ EXPORT_SYMBOL_GPL(dw_dma_enable);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller core driver");
 MODULE_AUTHOR("Haavard Skinnemoen (Atmel)");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index 4fd9961d552e..d42537425438 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
        return ret;
 }
-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
+static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
+        int len)
 {
        struct cper_mem_err_compact cmem;
+        /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
+        if (len == sizeof(struct cper_sec_mem_err_old) &&
+            (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
+                pr_err(FW_WARN "valid bits set for fields beyond structure\n");
+                return;
+        }
        if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
                printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
        if (mem->validation_bits & CPER_MEM_VALID_PA)
@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
        } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
                struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
                printk("%s""section_type: memory error\n", newpfx);
-                if (gdata->error_data_length >= sizeof(*mem_err))
+                if (gdata->error_data_length >=
-                        cper_print_mem(newpfx, mem_err);
+                    sizeof(struct cper_sec_mem_err_old))
+                        cper_print_mem(newpfx, mem_err,
+                                       gdata->error_data_length);
                else
                        goto err_section_too_small;
        } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 7a3cb1fa0a76..4630a8133ea6 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -87,6 +87,15 @@ static int brcmstb_gpio_remove(struct platform_device *pdev)
        struct brcmstb_gpio_bank *bank;
        int ret = 0;
+        if (!priv) {
+                dev_err(&pdev->dev, "called %s without drvdata!\n", __func__);
+                return -EFAULT;
+        }
+        /*
+         * You can lose return values below, but we report all errors, and it's
+         * more important to actually perform all of the steps.
+         */
        list_for_each(pos, &priv->bank_list) {
                bank = list_entry(pos, struct brcmstb_gpio_bank, node);
                ret = bgpio_remove(&bank->bgc);
@@ -143,6 +152,8 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
        if (!priv)
                return -ENOMEM;
+        platform_set_drvdata(pdev, priv);
+        INIT_LIST_HEAD(&priv->bank_list);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        reg_base = devm_ioremap_resource(dev, res);
@@ -153,7 +164,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
        priv->reg_base = reg_base;
        priv->pdev = pdev;
-        INIT_LIST_HEAD(&priv->bank_list);
        if (brcmstb_gpio_sanity_check_banks(dev, np, res))
                return -EINVAL;
@@ -221,8 +231,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
        dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
                        priv->num_banks, priv->gpio_base, gpio_base - 1);
-        platform_set_drvdata(pdev, priv);
        return 0;
 fail:
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index c5e05c82d67c..c246ac3dda7c 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -578,15 +578,13 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                writel_relaxed(~0, &g->clr_falling);
                writel_relaxed(~0, &g->clr_rising);
-                /* set up all irqs in this bank */
-                irq_set_chained_handler(bank_irq, gpio_irq_handler);
                /*
                 * Each chip handles 32 gpios, and each irq bank consists of 16
                 * gpio irqs. Pass the irq bank's corresponding controller to
                 * the chained irq handler.
                 */
-                irq_set_handler_data(bank_irq, &chips[gpio / 32]);
+                irq_set_chained_handler_and_data(bank_irq, gpio_irq_handler,
+                                                 &chips[gpio / 32]);
                binten |= BIT(bank);
        }
diff --git a/drivers/gpio/gpio-max732x.c b/drivers/gpio/gpio-max732x.c
index aed4ca9338bc..7d3c90e9da71 100644
--- a/drivers/gpio/gpio-max732x.c
+++ b/drivers/gpio/gpio-max732x.c
@@ -603,6 +603,7 @@ static int max732x_setup_gpio(struct max732x_chip *chip,
        gc->base = gpio_start;
        gc->ngpio = port;
        gc->label = chip->client->name;
+        gc->dev = &chip->client->dev;
        gc->owner = THIS_MODULE;
        return port;
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index b0c57d505be7..61a731ff9a07 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -500,8 +500,10 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
        spin_lock_irqsave(&bank->lock, flags);
        retval = omap_set_gpio_triggering(bank, offset, type);
-        if (retval)
+        if (retval) {
+                spin_unlock_irqrestore(&bank->lock, flags);
                goto error;
+        }
        omap_gpio_init_irq(bank, offset);
        if (!omap_gpio_is_input(bank, offset)) {
                spin_unlock_irqrestore(&bank->lock, flags);
@@ -1185,6 +1187,7 @@ static int omap_gpio_probe(struct platform_device *pdev)
        bank->irq = res->start;
        bank->dev = dev;
        bank->chip.dev = dev;
+        bank->chip.owner = THIS_MODULE;
        bank->dbck_flag = pdata->dbck_flag;
        bank->stride = pdata->bank_stride;
        bank->width = pdata->bank_width;
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index d233eb3b8132..50caeb1ee350 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -570,6 +570,10 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
                                "could not connect irqchip to gpiochip\n");
                        return ret;
                }
+                gpiochip_set_chained_irqchip(&chip->gpio_chip,
+                                             &pca953x_irq_chip,
+                                             client->irq, NULL);
        }
        return 0;
diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c
index 77fe5d3cb105..d5284dfe01fe 100644
--- a/drivers/gpio/gpio-xilinx.c
+++ b/drivers/gpio/gpio-xilinx.c
@@ -220,9 +220,9 @@ static void xgpio_save_regs(struct of_mm_gpio_chip *mm_gc)
        if (!chip->gpio_width[1])
                return;
-        xgpio_writereg(mm_gc->regs + XGPIO_DATA_OFFSET + XGPIO_TRI_OFFSET,
+        xgpio_writereg(mm_gc->regs + XGPIO_DATA_OFFSET + XGPIO_CHANNEL_OFFSET,
                       chip->gpio_state[1]);
-        xgpio_writereg(mm_gc->regs + XGPIO_TRI_OFFSET + XGPIO_TRI_OFFSET,
+        xgpio_writereg(mm_gc->regs + XGPIO_TRI_OFFSET + XGPIO_CHANNEL_OFFSET,
                       chip->gpio_dir[1]);
 }
diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 2e87c4b8da26..a78882389836 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -757,6 +757,7 @@ static int zynq_gpio_remove(struct platform_device *pdev)
        gpiochip_remove(&gpio->chip);
        clk_disable_unprepare(gpio->clk);
        device_set_wakeup_capable(&pdev->dev, 0);
+        pm_runtime_disable(&pdev->dev);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 01657830b470..e9fde72cf038 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1614,6 +1614,9 @@ struct amdgpu_uvd {
 #define AMDGPU_MAX_VCE_HANDLES  16
 #define AMDGPU_VCE_FIRMWARE_OFFSET 256
+#define AMDGPU_VCE_HARVEST_VCE0 (1 << 0)
+#define AMDGPU_VCE_HARVEST_VCE1 (1 << 1)
 struct amdgpu_vce {
        struct amdgpu_bo        *vcpu_bo;
        uint64_t                gpu_addr;
@@ -1626,6 +1629,7 @@ struct amdgpu_vce {
        const struct firmware   *fw;    /* VCE firmware */
        struct amdgpu_ring      ring[AMDGPU_MAX_VCE_RINGS];
        struct amdgpu_irq_src   irq;
+        unsigned                harvest_config;
 };
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index d63135bf29c0..1f040d85ac47 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -669,6 +669,7 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
 static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                                  struct amdgpu_cs_parser *p)
 {
+        struct amdgpu_fpriv *fpriv = p->filp->driver_priv;
        struct amdgpu_ib *ib;
        int i, j, r;
@@ -694,6 +695,7 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                for (j = 0; j < num_deps; ++j) {
                        struct amdgpu_fence *fence;
                        struct amdgpu_ring *ring;
+                        struct amdgpu_ctx *ctx;
                        r = amdgpu_cs_get_ring(adev, deps[j].ip_type,
                                               deps[j].ip_instance,
@@ -701,14 +703,21 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                        if (r)
                                return r;
+                        ctx = amdgpu_ctx_get(fpriv, deps[j].ctx_id);
+                        if (ctx == NULL)
+                                return -EINVAL;
                        r = amdgpu_fence_recreate(ring, p->filp,
                                                  deps[j].handle,
                                                  &fence);
-                        if (r)
+                        if (r) {
+                                amdgpu_ctx_put(ctx);
                                return r;
+                        }
                        amdgpu_sync_fence(&ib->sync, fence);
                        amdgpu_fence_unref(&fence);
+                        amdgpu_ctx_put(ctx);
                }
        }
@@ -808,12 +817,16 @@ int amdgpu_cs_wait_ioctl(struct drm_device *dev, void *data,
        r = amdgpu_cs_get_ring(adev, wait->in.ip_type, wait->in.ip_instance,
                               wait->in.ring, &ring);
-        if (r)
+        if (r) {
+                amdgpu_ctx_put(ctx);
                return r;
+        }
        r = amdgpu_fence_recreate(ring, filp, wait->in.handle, &fence);
-        if (r)
+        if (r) {
+                amdgpu_ctx_put(ctx);
                return r;
+        }
        r = fence_wait_timeout(&fence->base, true, timeout);
        amdgpu_fence_unref(&fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ba46be361c9b..d79009b65867 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1207,10 +1207,15 @@ static int amdgpu_early_init(struct amdgpu_device *adev)
                } else {
                        if (adev->ip_blocks[i].funcs->early_init) {
                                r = adev->ip_blocks[i].funcs->early_init((void *)adev);
-                                if (r)
+                                if (r == -ENOENT)
+                                        adev->ip_block_enabled[i] = false;
+                                else if (r)
                                        return r;
+                                else
+                                        adev->ip_block_enabled[i] = true;
+                        } else {
+                                adev->ip_block_enabled[i] = true;
                        }
-                        adev->ip_block_enabled[i] = true;
                }
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 5533434c7a8f..31ad444c6386 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -459,6 +459,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                memcpy(&dev_info.cu_bitmap[0], &cu_info.bitmap[0], sizeof(cu_info.bitmap));
                dev_info.vram_type = adev->mc.vram_type;
                dev_info.vram_bit_width = adev->mc.vram_width;
+                dev_info.vce_harvest_config = adev->vce.harvest_config;
                return copy_to_user(out, &dev_info,
                                    min((size_t)size, sizeof(dev_info))) ? -EFAULT : 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index f75a31df30bd..ace870afc7d4 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -494,29 +494,67 @@ static void cz_dpm_fini(struct amdgpu_device *adev)
        amdgpu_free_extended_power_table(adev);
 }
+#define ixSMUSVI_NB_CURRENTVID 0xD8230044
+#define CURRENT_NB_VID_MASK 0xff000000
+#define CURRENT_NB_VID__SHIFT 24
+#define ixSMUSVI_GFX_CURRENTVID  0xD8230048
+#define CURRENT_GFX_VID_MASK 0xff000000
+#define CURRENT_GFX_VID__SHIFT 24
 static void
 cz_dpm_debugfs_print_current_performance_level(struct amdgpu_device *adev,
                                               struct seq_file *m)
 {
+        struct cz_power_info *pi = cz_get_pi(adev);
        struct amdgpu_clock_voltage_dependency_table *table =
                &adev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
-        u32 current_index =
+        struct amdgpu_uvd_clock_voltage_dependency_table *uvd_table =
-                (RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX) &
+                &adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
-                TARGET_AND_CURRENT_PROFILE_INDEX__CURR_SCLK_INDEX_MASK) >>
+        struct amdgpu_vce_clock_voltage_dependency_table *vce_table =
-                TARGET_AND_CURRENT_PROFILE_INDEX__CURR_SCLK_INDEX__SHIFT;
+                &adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;
-        u32 sclk, tmp;
+        u32 sclk_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX),
-        u16 vddc;
+                                       TARGET_AND_CURRENT_PROFILE_INDEX, CURR_SCLK_INDEX);
+        u32 uvd_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX_2),
-        if (current_index >= NUM_SCLK_LEVELS) {
+                                      TARGET_AND_CURRENT_PROFILE_INDEX_2, CURR_UVD_INDEX);
-                seq_printf(m, "invalid dpm profile %d\n", current_index);
+        u32 vce_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX_2),
+                                      TARGET_AND_CURRENT_PROFILE_INDEX_2, CURR_VCE_INDEX);
+        u32 sclk, vclk, dclk, ecclk, tmp;
+        u16 vddnb, vddgfx;
+        if (sclk_index >= NUM_SCLK_LEVELS) {
+                seq_printf(m, "invalid sclk dpm profile %d\n", sclk_index);
        } else {
-                sclk = table->entries[current_index].clk;
+                sclk = table->entries[sclk_index].clk;
-                tmp = (RREG32_SMC(ixSMU_VOLTAGE_STATUS) &
+                seq_printf(m, "%u sclk: %u\n", sclk_index, sclk);
-                        SMU_VOLTAGE_STATUS__SMU_VOLTAGE_CURRENT_LEVEL_MASK) >>
+        }
-                        SMU_VOLTAGE_STATUS__SMU_VOLTAGE_CURRENT_LEVEL__SHIFT;
-                vddc = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
+        tmp = (RREG32_SMC(ixSMUSVI_NB_CURRENTVID) &
-                seq_printf(m, "power level %d    sclk: %u vddc: %u\n",
+               CURRENT_NB_VID_MASK) >> CURRENT_NB_VID__SHIFT;
-                           current_index, sclk, vddc);
+        vddnb = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
+        tmp = (RREG32_SMC(ixSMUSVI_GFX_CURRENTVID) &
+               CURRENT_GFX_VID_MASK) >> CURRENT_GFX_VID__SHIFT;
+        vddgfx = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
+        seq_printf(m, "vddnb: %u vddgfx: %u\n", vddnb, vddgfx);
+        seq_printf(m, "uvd    %sabled\n", pi->uvd_power_gated ? "dis" : "en");
+        if (!pi->uvd_power_gated) {
+                if (uvd_index >= CZ_MAX_HARDWARE_POWERLEVELS) {
+                        seq_printf(m, "invalid uvd dpm level %d\n", uvd_index);
+                } else {
+                        vclk = uvd_table->entries[uvd_index].vclk;
+                        dclk = uvd_table->entries[uvd_index].dclk;
+                        seq_printf(m, "%u uvd vclk: %u dclk: %u\n", uvd_index, vclk, dclk);
+                }
+        }
+        seq_printf(m, "vce    %sabled\n", pi->vce_power_gated ? "dis" : "en");
+        if (!pi->vce_power_gated) {
+                if (vce_index >= CZ_MAX_HARDWARE_POWERLEVELS) {
+                        seq_printf(m, "invalid vce dpm level %d\n", vce_index);
+                } else {
+                        ecclk = vce_table->entries[vce_index].ecclk;
+                        seq_printf(m, "%u vce ecclk: %u\n", vce_index, ecclk);
+                }
        }
 }
@@ -1679,25 +1717,31 @@ static int cz_dpm_unforce_dpm_levels(struct amdgpu_device *adev)
        if (ret)
                return ret;
-        DRM_INFO("DPM unforce state min=%d, max=%d.\n",
+        DRM_DEBUG("DPM unforce state min=%d, max=%d.\n",
-                        pi->sclk_dpm.soft_min_clk,
+                  pi->sclk_dpm.soft_min_clk,
-                        pi->sclk_dpm.soft_max_clk);
+                  pi->sclk_dpm.soft_max_clk);
        return 0;
 }
 static int cz_dpm_force_dpm_level(struct amdgpu_device *adev,
-                                enum amdgpu_dpm_forced_level level)
+                                  enum amdgpu_dpm_forced_level level)
 {
        int ret = 0;
        switch (level) {
        case AMDGPU_DPM_FORCED_LEVEL_HIGH:
+                ret = cz_dpm_unforce_dpm_levels(adev);
+                if (ret)
+                        return ret;
                ret = cz_dpm_force_highest(adev);
                if (ret)
                        return ret;
                break;
        case AMDGPU_DPM_FORCED_LEVEL_LOW:
+                ret = cz_dpm_unforce_dpm_levels(adev);
+                if (ret)
+                        return ret;
                ret = cz_dpm_force_lowest(adev);
                if (ret)
                        return ret;
@@ -1711,6 +1755,8 @@ static int cz_dpm_force_dpm_level(struct amdgpu_device *adev,
                break;
        }
+        adev->pm.dpm.forced_level = level;
        return ret;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 6e77964f1b64..e70a26f587a0 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2632,6 +2632,7 @@ static void dce_v10_0_crtc_dpms(struct drm_crtc *crtc, int mode)
        struct drm_device *dev = crtc->dev;
        struct amdgpu_device *adev = dev->dev_private;
        struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
        switch (mode) {
        case DRM_MODE_DPMS_ON:
@@ -2640,6 +2641,9 @@ static void dce_v10_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                dce_v10_0_vga_enable(crtc, true);
                amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                dce_v10_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                dce_v10_0_crtc_load_lut(crtc);
                break;
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 7f7abb0e0be5..dcb402ee048a 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -2631,6 +2631,7 @@ static void dce_v11_0_crtc_dpms(struct drm_crtc *crtc, int mode)
        struct drm_device *dev = crtc->dev;
        struct amdgpu_device *adev = dev->dev_private;
        struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
        switch (mode) {
        case DRM_MODE_DPMS_ON:
@@ -2639,6 +2640,9 @@ static void dce_v11_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                dce_v11_0_vga_enable(crtc, true);
                amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                dce_v11_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                dce_v11_0_crtc_load_lut(crtc);
                break;
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 08387dfd98a7..cc050a329c49 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2566,6 +2566,7 @@ static void dce_v8_0_crtc_dpms(struct drm_crtc *crtc, int mode)
        struct drm_device *dev = crtc->dev;
        struct amdgpu_device *adev = dev->dev_private;
        struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
        switch (mode) {
        case DRM_MODE_DPMS_ON:
@@ -2574,6 +2575,9 @@ static void dce_v8_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                dce_v8_0_vga_enable(crtc, true);
                amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                dce_v8_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                dce_v8_0_crtc_load_lut(crtc);
                break;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 7b683fb2173c..1c7c992dea37 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -1813,10 +1813,7 @@ static u32 gfx_v8_0_get_rb_disabled(struct amdgpu_device *adev,
        u32 data, mask;
        data = RREG32(mmCC_RB_BACKEND_DISABLE);
-        if (data & 1)
+        data &= CC_RB_BACKEND_DISABLE__BACKEND_DISABLE_MASK;
-                data &= CC_RB_BACKEND_DISABLE__BACKEND_DISABLE_MASK;
-        else
-                data = 0;
        data |= RREG32(mmGC_USER_RB_BACKEND_DISABLE);
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index d62c4002e39c..d1064ca3670e 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -35,6 +35,8 @@
 #include "oss/oss_2_0_d.h"
 #include "oss/oss_2_0_sh_mask.h"
 #include "gca/gfx_8_0_d.h"
+#include "smu/smu_7_1_2_d.h"
+#include "smu/smu_7_1_2_sh_mask.h"
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
@@ -112,6 +114,10 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
        mutex_lock(&adev->grbm_idx_mutex);
        for (idx = 0; idx < 2; ++idx) {
+                if (adev->vce.harvest_config & (1 << idx))
+                        continue;
                if(idx == 0)
                        WREG32_P(mmGRBM_GFX_INDEX, 0,
                                ~GRBM_GFX_INDEX__VCE_INSTANCE_MASK);
@@ -190,10 +196,52 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
        return 0;
 }
+#define ixVCE_HARVEST_FUSE_MACRO__ADDRESS     0xC0014074
+#define VCE_HARVEST_FUSE_MACRO__SHIFT       27
+#define VCE_HARVEST_FUSE_MACRO__MASK        0x18000000
+static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
+{
+        u32 tmp;
+        unsigned ret;
+        if (adev->flags & AMDGPU_IS_APU)
+                tmp = (RREG32_SMC(ixVCE_HARVEST_FUSE_MACRO__ADDRESS) &
+                       VCE_HARVEST_FUSE_MACRO__MASK) >>
+                        VCE_HARVEST_FUSE_MACRO__SHIFT;
+        else
+                tmp = (RREG32_SMC(ixCC_HARVEST_FUSES) &
+                       CC_HARVEST_FUSES__VCE_DISABLE_MASK) >>
+                        CC_HARVEST_FUSES__VCE_DISABLE__SHIFT;
+        switch (tmp) {
+        case 1:
+                ret = AMDGPU_VCE_HARVEST_VCE0;
+                break;
+        case 2:
+                ret = AMDGPU_VCE_HARVEST_VCE1;
+                break;
+        case 3:
+                ret = AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1;
+                break;
+        default:
+                ret = 0;
+        }
+        return ret;
+}
 static int vce_v3_0_early_init(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        adev->vce.harvest_config = vce_v3_0_get_harvest_config(adev);
+        if ((adev->vce.harvest_config &
+             (AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1)) ==
+            (AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1))
+                return -ENOENT;
        vce_v3_0_set_ring_funcs(adev);
        vce_v3_0_set_irq_funcs(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index fa5a4448531d..68552da40287 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -122,6 +122,32 @@ static void vi_smc_wreg(struct amdgpu_device *adev, u32 reg, u32 v)
        spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
 }
+/* smu_8_0_d.h */
+#define mmMP0PUB_IND_INDEX                                                      0x180
+#define mmMP0PUB_IND_DATA                                                       0x181
+static u32 cz_smc_rreg(struct amdgpu_device *adev, u32 reg)
+{
+        unsigned long flags;
+        u32 r;
+        spin_lock_irqsave(&adev->smc_idx_lock, flags);
+        WREG32(mmMP0PUB_IND_INDEX, (reg));
+        r = RREG32(mmMP0PUB_IND_DATA);
+        spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
+        return r;
+}
+static void cz_smc_wreg(struct amdgpu_device *adev, u32 reg, u32 v)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&adev->smc_idx_lock, flags);
+        WREG32(mmMP0PUB_IND_INDEX, (reg));
+        WREG32(mmMP0PUB_IND_DATA, (v));
+        spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
+}
 static u32 vi_uvd_ctx_rreg(struct amdgpu_device *adev, u32 reg)
 {
        unsigned long flags;
@@ -1222,8 +1248,13 @@ static int vi_common_early_init(void *handle)
        bool smc_enabled = false;
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        adev->smc_rreg = &vi_smc_rreg;
+        if (adev->flags & AMDGPU_IS_APU) {
-        adev->smc_wreg = &vi_smc_wreg;
+                adev->smc_rreg = &cz_smc_rreg;
+                adev->smc_wreg = &cz_smc_wreg;
+        } else {
+                adev->smc_rreg = &vi_smc_rreg;
+                adev->smc_wreg = &vi_smc_wreg;
+        }
        adev->pcie_rreg = &vi_pcie_rreg;
        adev->pcie_wreg = &vi_pcie_wreg;
        adev->uvd_ctx_rreg = &vi_uvd_ctx_rreg;
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 42d2ffa08716..01ffe9bffe38 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -531,8 +531,6 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
        drm_crtc_vblank_off(crtc);
-        crtc->mode = *adj;
        val = dcrtc->dumb_ctrl & ~CFG_DUMB_ENA;
        if (val != dcrtc->dumb_ctrl) {
                dcrtc->dumb_ctrl = val;
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 580e10acaa3a..60a688ef81c7 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -69,8 +69,9 @@ void armada_gem_free_object(struct drm_gem_object *obj)
        if (dobj->obj.import_attach) {
                /* We only ever display imported data */
-                dma_buf_unmap_attachment(dobj->obj.import_attach, dobj->sgt,
+                if (dobj->sgt)
-                                         DMA_TO_DEVICE);
+                        dma_buf_unmap_attachment(dobj->obj.import_attach,
+                                                 dobj->sgt, DMA_TO_DEVICE);
                drm_prime_gem_destroy(&dobj->obj, NULL);
        }
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index c5b06fdb459c..e939faba7fcc 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -7,6 +7,7 @@
 * published by the Free Software Foundation.
 */
 #include <drm/drmP.h>
+#include <drm/drm_plane_helper.h>
 #include "armada_crtc.h"
 #include "armada_drm.h"
 #include "armada_fb.h"
@@ -85,16 +86,8 @@ static void armada_plane_vbl(struct armada_crtc *dcrtc, void *data)
        if (fb)
                armada_drm_queue_unref_work(dcrtc->crtc.dev, fb);
-}
-static unsigned armada_limit(int start, unsigned size, unsigned max)
+        wake_up(&dplane->vbl.wait);
-{
-        int end = start + size;
-        if (end < 0)
-                return 0;
-        if (start < 0)
-                start = 0;
-        return (unsigned)end > max ? max - start : end - start;
 }
 static int
@@ -105,26 +98,39 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
 {
        struct armada_plane *dplane = drm_to_armada_plane(plane);
        struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        struct drm_rect src = {
+                .x1 = src_x,
+                .y1 = src_y,
+                .x2 = src_x + src_w,
+                .y2 = src_y + src_h,
+        };
+        struct drm_rect dest = {
+                .x1 = crtc_x,
+                .y1 = crtc_y,
+                .x2 = crtc_x + crtc_w,
+                .y2 = crtc_y + crtc_h,
+        };
+        const struct drm_rect clip = {
+                .x2 = crtc->mode.hdisplay,
+                .y2 = crtc->mode.vdisplay,
+        };
        uint32_t val, ctrl0;
        unsigned idx = 0;
+        bool visible;
        int ret;
-        crtc_w = armada_limit(crtc_x, crtc_w, dcrtc->crtc.mode.hdisplay);
+        ret = drm_plane_helper_check_update(plane, crtc, fb, &src, &dest, &clip,
-        crtc_h = armada_limit(crtc_y, crtc_h, dcrtc->crtc.mode.vdisplay);
+                                            0, INT_MAX, true, false, &visible);
+        if (ret)
+                return ret;
        ctrl0 = CFG_DMA_FMT(drm_fb_to_armada_fb(fb)->fmt) |
                CFG_DMA_MOD(drm_fb_to_armada_fb(fb)->mod) |
                CFG_CBSH_ENA | CFG_DMA_HSMOOTH | CFG_DMA_ENA;
        /* Does the position/size result in nothing to display? */
-        if (crtc_w == 0 || crtc_h == 0) {
+        if (!visible)
                ctrl0 &= ~CFG_DMA_ENA;
-        }
-        /*
-         * FIXME: if the starting point is off screen, we need to
-         * adjust src_x, src_y, src_w, src_h appropriately, and
-         * according to the scale.
-         */
        if (!dcrtc->plane) {
                dcrtc->plane = plane;
@@ -134,15 +140,19 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
        /* FIXME: overlay on an interlaced display */
        /* Just updating the position/size? */
        if (plane->fb == fb && dplane->ctrl0 == ctrl0) {
-                val = (src_h & 0xffff0000) | src_w >> 16;
+                val = (drm_rect_height(&src) & 0xffff0000) |
+                      drm_rect_width(&src) >> 16;
                dplane->src_hw = val;
                writel_relaxed(val, dcrtc->base + LCD_SPU_DMA_HPXL_VLN);
-                val = crtc_h << 16 | crtc_w;
+                val = drm_rect_height(&dest) << 16 | drm_rect_width(&dest);
                dplane->dst_hw = val;
                writel_relaxed(val, dcrtc->base + LCD_SPU_DZM_HPXL_VLN);
-                val = crtc_y << 16 | crtc_x;
+                val = dest.y1 << 16 | dest.x1;
                dplane->dst_yx = val;
                writel_relaxed(val, dcrtc->base + LCD_SPU_DMA_OVSA_HPXL_VLN);
                return 0;
        } else if (~dplane->ctrl0 & ctrl0 & CFG_DMA_ENA) {
                /* Power up the Y/U/V FIFOs on ENA 0->1 transitions */
@@ -150,15 +160,14 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                               dcrtc->base + LCD_SPU_SRAM_PARA1);
        }
-        ret = wait_event_timeout(dplane->vbl.wait,
+        wait_event_timeout(dplane->vbl.wait,
-                                 list_empty(&dplane->vbl.update.node),
+                           list_empty(&dplane->vbl.update.node),
-                                 HZ/25);
+                           HZ/25);
-        if (ret < 0)
-                return ret;
        if (plane->fb != fb) {
                struct armada_gem_object *obj = drm_fb_obj(fb);
-                uint32_t sy, su, sv;
+                uint32_t addr[3], pixel_format;
+                int i, num_planes, hsub;
                /*
                 * Take a reference on the new framebuffer - we want to
@@ -178,26 +187,39 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                                                            older_fb);
                }
-                src_y >>= 16;
+                src_y = src.y1 >> 16;
-                src_x >>= 16;
+                src_x = src.x1 >> 16;
-                sy = obj->dev_addr + fb->offsets[0] + src_y * fb->pitches[0] +
-                        src_x * fb->bits_per_pixel / 8;
-                su = obj->dev_addr + fb->offsets[1] + src_y * fb->pitches[1] +
-                        src_x;
-                sv = obj->dev_addr + fb->offsets[2] + src_y * fb->pitches[2] +
-                        src_x;
-                armada_reg_queue_set(dplane->vbl.regs, idx, sy,
+                pixel_format = fb->pixel_format;
+                hsub = drm_format_horz_chroma_subsampling(pixel_format);
+                num_planes = drm_format_num_planes(pixel_format);
+                /*
+                 * Annoyingly, shifting a YUYV-format image by one pixel
+                 * causes the U/V planes to toggle.  Toggle the UV swap.
+                 * (Unfortunately, this causes momentary colour flickering.)
+                 */
+                if (src_x & (hsub - 1) && num_planes == 1)
+                        ctrl0 ^= CFG_DMA_MOD(CFG_SWAPUV);
+                for (i = 0; i < num_planes; i++)
+                        addr[i] = obj->dev_addr + fb->offsets[i] +
+                                  src_y * fb->pitches[i] +
+                                  src_x * drm_format_plane_cpp(pixel_format, i);
+                for (; i < ARRAY_SIZE(addr); i++)
+                        addr[i] = 0;
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[0],
                                     LCD_SPU_DMA_START_ADDR_Y0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, su,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[1],
                                     LCD_SPU_DMA_START_ADDR_U0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sv,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[2],
                                     LCD_SPU_DMA_START_ADDR_V0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sy,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[0],
                                     LCD_SPU_DMA_START_ADDR_Y1);
-                armada_reg_queue_set(dplane->vbl.regs, idx, su,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[1],
                                     LCD_SPU_DMA_START_ADDR_U1);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sv,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[2],
                                     LCD_SPU_DMA_START_ADDR_V1);
                val = fb->pitches[0] << 16 | fb->pitches[0];
@@ -208,24 +230,27 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                                     LCD_SPU_DMA_PITCH_UV);
        }
-        val = (src_h & 0xffff0000) | src_w >> 16;
+        val = (drm_rect_height(&src) & 0xffff0000) | drm_rect_width(&src) >> 16;
        if (dplane->src_hw != val) {
                dplane->src_hw = val;
                armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                     LCD_SPU_DMA_HPXL_VLN);
        }
-        val = crtc_h << 16 | crtc_w;
+        val = drm_rect_height(&dest) << 16 | drm_rect_width(&dest);
        if (dplane->dst_hw != val) {
                dplane->dst_hw = val;
                armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                     LCD_SPU_DZM_HPXL_VLN);
        }
-        val = crtc_y << 16 | crtc_x;
+        val = dest.y1 << 16 | dest.x1;
        if (dplane->dst_yx != val) {
                dplane->dst_yx = val;
                armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                     LCD_SPU_DMA_OVSA_HPXL_VLN);
        }
        if (dplane->ctrl0 != ctrl0) {
                dplane->ctrl0 = ctrl0;
                armada_reg_queue_mod(dplane->vbl.regs, idx, ctrl0,
@@ -279,7 +304,11 @@ static int armada_plane_disable(struct drm_plane *plane)
 static void armada_plane_destroy(struct drm_plane *plane)
 {
-        kfree(plane);
+        struct armada_plane *dplane = drm_to_armada_plane(plane);
+        drm_plane_cleanup(plane);
+        kfree(dplane);
 }
 static int armada_plane_set_property(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index f69b92535505..5ae5c6923128 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -355,6 +355,7 @@ int atmel_hlcdc_crtc_create(struct drm_device *dev)
                planes->overlays[i]->base.possible_crtcs = 1 << crtc->id;
        drm_crtc_helper_add(&crtc->base, &lcdc_crtc_helper_funcs);
+        drm_crtc_vblank_reset(&crtc->base);
        dc->crtc = &crtc->base;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
index 60b0c13d7ff5..6fad1f9648f3 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
@@ -313,20 +313,20 @@ static int atmel_hlcdc_dc_load(struct drm_device *dev)
        pm_runtime_enable(dev->dev);
-        ret = atmel_hlcdc_dc_modeset_init(dev);
+        ret = drm_vblank_init(dev, 1);
        if (ret < 0) {
-                dev_err(dev->dev, "failed to initialize mode setting\n");
+                dev_err(dev->dev, "failed to initialize vblank\n");
                goto err_periph_clk_disable;
        }
-        drm_mode_config_reset(dev);
+        ret = atmel_hlcdc_dc_modeset_init(dev);
-        ret = drm_vblank_init(dev, 1);
        if (ret < 0) {
-                dev_err(dev->dev, "failed to initialize vblank\n");
+                dev_err(dev->dev, "failed to initialize mode setting\n");
                goto err_periph_clk_disable;
        }
+        drm_mode_config_reset(dev);
        pm_runtime_get_sync(dev->dev);
        ret = drm_irq_install(dev, dc->hlcdc->irq);
        pm_runtime_put_sync(dev->dev);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index b9ba06176eb1..fed748311b92 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2706,8 +2706,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                return -EINVAL;
-        /* For some reason crtc x/y offsets are signed internally. */
+        /*
-        if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
+         * Universal plane src offsets are only 16.16, prevent havoc for
+         * drivers using universal plane code internally.
+         */
+        if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
                return -ERANGE;
        drm_modeset_lock_all(dev);
@@ -5395,12 +5398,9 @@ void drm_mode_config_reset(struct drm_device *dev)
                if (encoder->funcs->reset)
                        encoder->funcs->reset(encoder);
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
-                connector->status = connector_status_unknown;
                if (connector->funcs->reset)
                        connector->funcs->reset(connector);
-        }
 }
 EXPORT_SYMBOL(drm_mode_config_reset);
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index aa8bbb460c57..9cfcd0aef0df 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -70,6 +70,8 @@
 #define DRM_IOCTL_WAIT_VBLANK32         DRM_IOWR(0x3a, drm_wait_vblank32_t)
+#define DRM_IOCTL_MODE_ADDFB232         DRM_IOWR(0xb8, drm_mode_fb_cmd232_t)
 typedef struct drm_version_32 {
        int version_major;        /**< Major version */
        int version_minor;        /**< Minor version */
@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
        return 0;
 }
+typedef struct drm_mode_fb_cmd232 {
+        u32 fb_id;
+        u32 width;
+        u32 height;
+        u32 pixel_format;
+        u32 flags;
+        u32 handles[4];
+        u32 pitches[4];
+        u32 offsets[4];
+        u64 modifier[4];
+} __attribute__((packed)) drm_mode_fb_cmd232_t;
+static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
+                                  unsigned long arg)
+{
+        struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
+        struct drm_mode_fb_cmd232 req32;
+        struct drm_mode_fb_cmd2 __user *req64;
+        int i;
+        int err;
+        if (copy_from_user(&req32, argp, sizeof(req32)))
+                return -EFAULT;
+        req64 = compat_alloc_user_space(sizeof(*req64));
+        if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
+            || __put_user(req32.width, &req64->width)
+            || __put_user(req32.height, &req64->height)
+            || __put_user(req32.pixel_format, &req64->pixel_format)
+            || __put_user(req32.flags, &req64->flags))
+                return -EFAULT;
+        for (i = 0; i < 4; i++) {
+                if (__put_user(req32.handles[i], &req64->handles[i]))
+                        return -EFAULT;
+                if (__put_user(req32.pitches[i], &req64->pitches[i]))
+                        return -EFAULT;
+                if (__put_user(req32.offsets[i], &req64->offsets[i]))
+                        return -EFAULT;
+                if (__put_user(req32.modifier[i], &req64->modifier[i]))
+                        return -EFAULT;
+        }
+        err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
+        if (err)
+                return err;
+        if (__get_user(req32.fb_id, &req64->fb_id))
+                return -EFAULT;
+        if (copy_to_user(argp, &req32, sizeof(req32)))
+                return -EFAULT;
+        return 0;
+}
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
        [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
        [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
        [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
        [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+        [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
 };
 /**
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 542fac628b28..5f27290201e0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -826,6 +826,7 @@ struct intel_context {
        struct kref ref;
        int user_handle;
        uint8_t remap_slice;
+        struct drm_i915_private *i915;
        struct drm_i915_file_private *file_priv;
        struct i915_ctx_hang_stats hang_stats;
        struct i915_hw_ppgtt *ppgtt;
@@ -2036,8 +2037,6 @@ struct drm_i915_gem_object {
        unsigned int cache_level:3;
        unsigned int cache_dirty:1;
-        unsigned int has_dma_mapping:1;
        unsigned int frontbuffer_bits:INTEL_FRONTBUFFER_BITS;
        unsigned int pin_display;
@@ -3116,7 +3115,8 @@ void i915_debugfs_cleanup(struct drm_minor *minor);
 int i915_debugfs_connector_add(struct drm_connector *connector);
 void intel_display_crc_init(struct drm_device *dev);
 #else
-static inline int i915_debugfs_connector_add(struct drm_connector *connector) {}
+static inline int i915_debugfs_connector_add(struct drm_connector *connector)
+{ return 0; }
 static inline void intel_display_crc_init(struct drm_device *dev) {}
 #endif
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 248fd1ac7b3a..52b446b27b4d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -213,7 +213,6 @@ i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
        sg_dma_len(sg) = obj->base.size;
        obj->pages = st;
-        obj->has_dma_mapping = true;
        return 0;
 }
@@ -265,8 +264,6 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_object *obj)
        sg_free_table(obj->pages);
        kfree(obj->pages);
-        obj->has_dma_mapping = false;
 }
 static void
@@ -2139,6 +2136,8 @@ i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
                obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
        }
+        i915_gem_gtt_finish_object(obj);
        if (i915_gem_object_needs_bit17_swizzle(obj))
                i915_gem_object_save_bit_17_swizzle(obj);
@@ -2199,6 +2198,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
        struct sg_page_iter sg_iter;
        struct page *page;
        unsigned long last_pfn = 0;     /* suppress gcc warning */
+        int ret;
        gfp_t gfp;
        /* Assert that the object is not currently in any GPU domain. As it
@@ -2246,8 +2246,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                         */
                        i915_gem_shrink_all(dev_priv);
                        page = shmem_read_mapping_page(mapping, i);
-                        if (IS_ERR(page))
+                        if (IS_ERR(page)) {
+                                ret = PTR_ERR(page);
                                goto err_pages;
+                        }
                }
 #ifdef CONFIG_SWIOTLB
                if (swiotlb_nr_tbl()) {
@@ -2276,6 +2278,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                sg_mark_end(sg);
        obj->pages = st;
+        ret = i915_gem_gtt_prepare_object(obj);
+        if (ret)
+                goto err_pages;
        if (i915_gem_object_needs_bit17_swizzle(obj))
                i915_gem_object_do_bit_17_swizzle(obj);
@@ -2300,10 +2306,10 @@ err_pages:
         * space and so want to translate the error from shmemfs back to our
         * usual understanding of ENOMEM.
         */
-        if (PTR_ERR(page) == -ENOSPC)
+        if (ret == -ENOSPC)
-                return -ENOMEM;
+                ret = -ENOMEM;
-        else
-                return PTR_ERR(page);
+        return ret;
 }
 /* Ensure that the associated pages are gathered from the backing storage
@@ -2542,6 +2548,7 @@ int __i915_add_request(struct intel_engine_cs *ring,
        }
        request->emitted_jiffies = jiffies;
+        ring->last_submitted_seqno = request->seqno;
        list_add_tail(&request->list, &ring->request_list);
        request->file_priv = NULL;
@@ -3247,10 +3254,8 @@ int i915_vma_unbind(struct i915_vma *vma)
        /* Since the unbound list is global, only move to that list if
         * no more VMAs exist. */
-        if (list_empty(&obj->vma_list)) {
+        if (list_empty(&obj->vma_list))
-                i915_gem_gtt_finish_object(obj);
                list_move_tail(&obj->global_list, &dev_priv->mm.unbound_list);
-        }
        /* And finally now the object is completely decoupled from this vma,
         * we can drop its hold on the backing storage and allow it to be
@@ -3768,22 +3773,16 @@ search_free:
                goto err_remove_node;
        }
-        ret = i915_gem_gtt_prepare_object(obj);
-        if (ret)
-                goto err_remove_node;
        trace_i915_vma_bind(vma, flags);
        ret = i915_vma_bind(vma, obj->cache_level, flags);
        if (ret)
-                goto err_finish_gtt;
+                goto err_remove_node;
        list_move_tail(&obj->global_list, &dev_priv->mm.bound_list);
        list_add_tail(&vma->mm_list, &vm->inactive_list);
        return vma;
-err_finish_gtt:
-        i915_gem_gtt_finish_object(obj);
 err_remove_node:
        drm_mm_remove_node(&vma->node);
 err_free_vma:
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index d65cbe6afb92..48afa777e94a 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -135,8 +135,7 @@ static int get_context_size(struct drm_device *dev)
 void i915_gem_context_free(struct kref *ctx_ref)
 {
-        struct intel_context *ctx = container_of(ctx_ref,
+        struct intel_context *ctx = container_of(ctx_ref, typeof(*ctx), ref);
-                                                 typeof(*ctx), ref);
        trace_i915_context_free(ctx);
@@ -195,6 +194,7 @@ __create_hw_context(struct drm_device *dev,
        kref_init(&ctx->ref);
        list_add_tail(&ctx->link, &dev_priv->context_list);
+        ctx->i915 = dev_priv;
        if (dev_priv->hw_context_size) {
                struct drm_i915_gem_object *obj =
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 7998da27c500..e9c2bfd85b52 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -256,7 +256,6 @@ static int i915_gem_object_get_pages_dmabuf(struct drm_i915_gem_object *obj)
                return PTR_ERR(sg);
        obj->pages = sg;
-        obj->has_dma_mapping = true;
        return 0;
 }
@@ -264,7 +263,6 @@ static void i915_gem_object_put_pages_dmabuf(struct drm_i915_gem_object *obj)
 {
        dma_buf_unmap_attachment(obj->base.import_attach,
                                 obj->pages, DMA_BIDIRECTIONAL);
-        obj->has_dma_mapping = false;
 }
 static const struct drm_i915_gem_object_ops i915_gem_object_dmabuf_ops = {
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index dcc6a88c560e..56b52a4767d4 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1723,9 +1723,6 @@ void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
 int i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj)
 {
-        if (obj->has_dma_mapping)
-                return 0;
        if (!dma_map_sg(&obj->base.dev->pdev->dev,
                        obj->pages->sgl, obj->pages->nents,
                        PCI_DMA_BIDIRECTIONAL))
@@ -1972,10 +1969,8 @@ void i915_gem_gtt_finish_object(struct drm_i915_gem_object *obj)
        interruptible = do_idling(dev_priv);
-        if (!obj->has_dma_mapping)
+        dma_unmap_sg(&dev->pdev->dev, obj->pages->sgl, obj->pages->nents,
-                dma_unmap_sg(&dev->pdev->dev,
+                     PCI_DMA_BIDIRECTIONAL);
-                             obj->pages->sgl, obj->pages->nents,
-                             PCI_DMA_BIDIRECTIONAL);
        undo_idling(dev_priv, interruptible);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 348ed5abcdbf..8b5b784c62fe 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -416,7 +416,6 @@ _i915_gem_object_create_stolen(struct drm_device *dev,
        if (obj->pages == NULL)
                goto cleanup;
-        obj->has_dma_mapping = true;
        i915_gem_object_pin_pages(obj);
        obj->stolen = stolen;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index d61e74a08f82..633bd1fcab69 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -183,18 +183,8 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
                if (IS_GEN4(dev)) {
                        uint32_t ddc2 = I915_READ(DCC2);
-                        if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE)) {
+                        if (!(ddc2 & DCC2_MODIFIED_ENHANCED_DISABLE))
-                                /* Since the swizzling may vary within an
-                                 * object, we have no idea what the swizzling
-                                 * is for any page in particular. Thus we
-                                 * cannot migrate tiled pages using the GPU,
-                                 * nor can we tell userspace what the exact
-                                 * swizzling is for any object.
-                                 */
                                dev_priv->quirks |= QUIRK_PIN_SWIZZLED_PAGES;
-                                swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
-                                swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
-                        }
                }
                if (dcc == 0xffffffff) {
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index 1f4e5a32a16e..8fd431bcdfd3 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -545,6 +545,26 @@ err:
        return ret;
 }
+static int
+__i915_gem_userptr_set_pages(struct drm_i915_gem_object *obj,
+                             struct page **pvec, int num_pages)
+{
+        int ret;
+        ret = st_set_pages(&obj->pages, pvec, num_pages);
+        if (ret)
+                return ret;
+        ret = i915_gem_gtt_prepare_object(obj);
+        if (ret) {
+                sg_free_table(obj->pages);
+                kfree(obj->pages);
+                obj->pages = NULL;
+        }
+        return ret;
+}
 static void
 __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
 {
@@ -584,9 +604,12 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
        if (obj->userptr.work != &work->work) {
                ret = 0;
        } else if (pinned == num_pages) {
-                ret = st_set_pages(&obj->pages, pvec, num_pages);
+                ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages);
                if (ret == 0) {
                        list_add_tail(&obj->global_list, &to_i915(dev)->mm.unbound_list);
+                        obj->get_page.sg = obj->pages->sgl;
+                        obj->get_page.last = 0;
                        pinned = 0;
                }
        }
@@ -693,7 +716,7 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)
                        }
                }
        } else {
-                ret = st_set_pages(&obj->pages, pvec, num_pages);
+                ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages);
                if (ret == 0) {
                        obj->userptr.work = NULL;
                        pinned = 0;
@@ -715,6 +738,8 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj)
        if (obj->madv != I915_MADV_WILLNEED)
                obj->dirty = 0;
+        i915_gem_gtt_finish_object(obj);
        for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) {
                struct page *page = sg_page_iter_page(&sg_iter);
diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
index 176de6322e4d..23aa04cded6b 100644
--- a/drivers/gpu/drm/i915/i915_ioc32.c
+++ b/drivers/gpu/drm/i915/i915_ioc32.c
@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        drm_ioctl_compat_t *fn = NULL;
        int ret;
-        if (nr < DRM_COMMAND_BASE)
+        if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)
                return drm_compat_ioctl(filp, cmd, arg);
        if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e6bb72dca3ff..984e2fe6688c 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2706,18 +2706,11 @@ static void gen8_disable_vblank(struct drm_device *dev, int pipe)
        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
-static struct drm_i915_gem_request *
-ring_last_request(struct intel_engine_cs *ring)
-{
-        return list_entry(ring->request_list.prev,
-                          struct drm_i915_gem_request, list);
-}
 static bool
-ring_idle(struct intel_engine_cs *ring)
+ring_idle(struct intel_engine_cs *ring, u32 seqno)
 {
        return (list_empty(&ring->request_list) ||
-                i915_gem_request_completed(ring_last_request(ring), false));
+                i915_seqno_passed(seqno, ring->last_submitted_seqno));
 }
 static bool
@@ -2939,7 +2932,7 @@ static void i915_hangcheck_elapsed(struct work_struct *work)
                acthd = intel_ring_get_active_head(ring);
                if (ring->hangcheck.seqno == seqno) {
-                        if (ring_idle(ring)) {
+                        if (ring_idle(ring, seqno)) {
                                ring->hangcheck.action = HANGCHECK_IDLE;
                                if (waitqueue_active(&ring->irq_queue)) {
diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
index 497cba5deb1e..849a2590e010 100644
--- a/drivers/gpu/drm/i915/i915_trace.h
+++ b/drivers/gpu/drm/i915/i915_trace.h
@@ -727,7 +727,7 @@ DECLARE_EVENT_CLASS(i915_context,
        TP_fast_assign(
                        __entry->ctx = ctx;
                        __entry->vm = ctx->ppgtt ? &ctx->ppgtt->base : NULL;
-                        __entry->dev = ctx->file_priv->dev_priv->dev->primary->index;
+                        __entry->dev = ctx->i915->dev->primary->index;
        ),
        TP_printk("dev=%u, ctx=%p, ctx_vm=%p",
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 647b1404c441..30e0f54ba19d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6315,9 +6315,6 @@ static void intel_crtc_disable(struct drm_crtc *crtc)
        struct drm_connector *connector;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        /* crtc should still be enabled when we disable it. */
-        WARN_ON(!crtc->state->enable);
        intel_crtc_disable_planes(crtc);
        dev_priv->display.crtc_disable(crtc);
        dev_priv->display.off(crtc);
@@ -12591,7 +12588,8 @@ static int __intel_set_mode(struct drm_crtc *modeset_crtc,
                        continue;
                if (!crtc_state->enable) {
-                        intel_crtc_disable(crtc);
+                        if (crtc->state->enable)
+                                intel_crtc_disable(crtc);
                } else if (crtc->state->enable) {
                        intel_crtc_disable_planes(crtc);
                        dev_priv->display.crtc_disable(crtc);
@@ -13276,7 +13274,7 @@ intel_check_primary_plane(struct drm_plane *plane,
        if (ret)
                return ret;
-        if (intel_crtc->active) {
+        if (crtc_state ? crtc_state->base.active : intel_crtc->active) {
                struct intel_plane_state *old_state =
                        to_intel_plane_state(plane->state);
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index e539314ae87e..4be66f60504d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -275,6 +275,13 @@ struct  intel_engine_cs {
         * Do we have some not yet emitted requests outstanding?
         */
        struct drm_i915_gem_request *outstanding_lazy_request;
+        /**
+         * Seqno of request most recently submitted to request_list.
+         * Used exclusively by hang checker to avoid grabbing lock while
+         * inspecting request list.
+         */
+        u32 last_submitted_seqno;
        bool gpu_caches_dirty;
        wait_queue_head_t irq_queue;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index a6d8a3ee7750..260389acfb77 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1274,10 +1274,12 @@ int i915_reg_read_ioctl(struct drm_device *dev,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_reg_read *reg = data;
        struct register_whitelist const *entry = whitelist;
+        unsigned size;
+        u64 offset;
        int i, ret = 0;
        for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) {
-                if (entry->offset == reg->offset &&
+                if (entry->offset == (reg->offset & -entry->size) &&
                    (1 << INTEL_INFO(dev)->gen & entry->gen_bitmask))
                        break;
        }
@@ -1285,23 +1287,33 @@ int i915_reg_read_ioctl(struct drm_device *dev,
        if (i == ARRAY_SIZE(whitelist))
                return -EINVAL;
+        /* We use the low bits to encode extra flags as the register should
+         * be naturally aligned (and those that are not so aligned merely
+         * limit the available flags for that register).
+         */
+        offset = entry->offset;
+        size = entry->size;
+        size |= reg->offset ^ offset;
        intel_runtime_pm_get(dev_priv);
-        switch (entry->size) {
+        switch (size) {
+        case 8 | 1:
+                reg->val = I915_READ64_2x32(offset, offset+4);
+                break;
        case 8:
-                reg->val = I915_READ64(reg->offset);
+                reg->val = I915_READ64(offset);
                break;
        case 4:
-                reg->val = I915_READ(reg->offset);
+                reg->val = I915_READ(offset);
                break;
        case 2:
-                reg->val = I915_READ16(reg->offset);
+                reg->val = I915_READ16(offset);
                break;
        case 1:
-                reg->val = I915_READ8(reg->offset);
+                reg->val = I915_READ8(offset);
                break;
        default:
-                MISSING_CASE(entry->size);
                ret = -EINVAL;
                goto out;
        }
diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
index 214eceefc981..e671ad369416 100644
--- a/drivers/gpu/drm/imx/imx-tve.c
+++ b/drivers/gpu/drm/imx/imx-tve.c
@@ -301,7 +301,7 @@ static void imx_tve_encoder_prepare(struct drm_encoder *encoder)
        switch (tve->mode) {
        case TVE_MODE_VGA:
-                imx_drm_set_bus_format_pins(encoder, MEDIA_BUS_FMT_YUV8_1X24,
+                imx_drm_set_bus_format_pins(encoder, MEDIA_BUS_FMT_GBR888_1X24,
                                            tve->hsync_pin, tve->vsync_pin);
                break;
        case TVE_MODE_TVOUT:
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 74a9ce40ddc4..b4deb9cf9d71 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -21,6 +21,7 @@
 #include <drm/drm_panel.h>
 #include <linux/videodev2.h>
 #include <video/of_display_timing.h>
+#include <linux/of_graph.h>
 #include "imx-drm.h"
@@ -208,7 +209,7 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
 {
        struct drm_device *drm = data;
        struct device_node *np = dev->of_node;
-        struct device_node *panel_node;
+        struct device_node *port;
        const u8 *edidp;
        struct imx_parallel_display *imxpd;
        int ret;
@@ -234,11 +235,19 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
                        imxpd->bus_format = MEDIA_BUS_FMT_RGB666_1X24_CPADHI;
        }
-        panel_node = of_parse_phandle(np, "fsl,panel", 0);
+        /* port@1 is the output port */
-        if (panel_node) {
+        port = of_graph_get_port_by_id(np, 1);
-                imxpd->panel = of_drm_find_panel(panel_node);
+        if (port) {
-                if (!imxpd->panel)
+                struct device_node *endpoint, *remote;
-                        return -EPROBE_DEFER;
+                endpoint = of_get_child_by_name(port, "endpoint");
+                if (endpoint) {
+                        remote = of_graph_get_remote_port_parent(endpoint);
+                        if (remote)
+                                imxpd->panel = of_drm_find_panel(remote);
+                        if (!imxpd->panel)
+                                return -EPROBE_DEFER;
+                }
        }
        imxpd->dev = dev;
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 8730562323a8..4a09947be244 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rdev)
                        tmp |= DPM_ENABLED;
                        break;
                default:
-                        DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
+                        DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
                        break;
                }
                WREG32_SMC(CNB_PWRMGT_CNTL, tmp);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 5450fa95a47e..c4777c8d0312 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -260,8 +260,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
                        }
                }
        }
-        mb();
+        if (rdev->gart.ptr) {
-        radeon_gart_tlb_flush(rdev);
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
 }
 /**
@@ -306,8 +308,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
                        page_base += RADEON_GPU_PAGE_SIZE;
                }
        }
-        mb();
+        if (rdev->gart.ptr) {
-        radeon_gart_tlb_flush(rdev);
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 013ec7106e55..3dcc5733ff69 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
        if (robj) {
                if (robj->gem_base.import_attach)
                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
+                radeon_mn_unregister(robj);
                radeon_bo_unref(&robj);
        }
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 318165d4855c..676362769b8d 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
        bo = container_of(tbo, struct radeon_bo, tbo);
        radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
-        radeon_mn_unregister(bo);
        mutex_lock(&bo->rdev->gem.mutex);
        list_del_init(&bo->list);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 1dbdf3230dae..787cd8fd897f 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2926,6 +2926,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
        /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
        { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
        { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+        { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
        { 0, 0, 0, 0 },
 };
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
index 01b558fe3695..9a0c2911272a 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
@@ -555,7 +555,6 @@ static struct platform_driver rockchip_drm_platform_driver = {
        .probe = rockchip_drm_platform_probe,
        .remove = rockchip_drm_platform_remove,
        .driver = {
-                .owner = THIS_MODULE,
                .name = "rockchip-drm",
                .of_match_table = rockchip_drm_dt_ids,
                .pm = &rockchip_drm_pm_ops,
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
index 77d52893d40f..002645bb5bbf 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
@@ -162,7 +162,8 @@ static void rockchip_drm_output_poll_changed(struct drm_device *dev)
        struct rockchip_drm_private *private = dev->dev_private;
        struct drm_fb_helper *fb_helper = &private->fbdev_helper;
-        drm_fb_helper_hotplug_event(fb_helper);
+        if (fb_helper)
+                drm_fb_helper_hotplug_event(fb_helper);
 }
 static const struct drm_mode_config_funcs rockchip_drm_mode_config_funcs = {
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index eb2282cc4a56..eba5f8a52fbd 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj)
                       &rk_obj->dma_attrs);
 }
-int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
+static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
-                          struct vm_area_struct *vma)
+                                        struct vm_area_struct *vma)
 {
+        int ret;
        struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
        struct drm_device *drm = obj->dev;
-        unsigned long vm_size;
-        vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+        /*
-        vm_size = vma->vm_end - vma->vm_start;
+         * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear
+         * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
-        if (vm_size > obj->size)
+         */
-                return -EINVAL;
+        vma->vm_flags &= ~VM_PFNMAP;
-        return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
+        ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
                             obj->size, &rk_obj->dma_attrs);
+        if (ret)
+                drm_gem_vm_close(vma);
+        return ret;
 }
-/* drm driver mmap file operations */
+int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+                          struct vm_area_struct *vma)
 {
-        struct drm_file *priv = filp->private_data;
+        struct drm_device *drm = obj->dev;
-        struct drm_device *dev = priv->minor->dev;
-        struct drm_gem_object *obj;
-        struct drm_vma_offset_node *node;
        int ret;
-        if (drm_device_is_unplugged(dev))
+        mutex_lock(&drm->struct_mutex);
-                return -ENODEV;
+        ret = drm_gem_mmap_obj(obj, obj->size, vma);
+        mutex_unlock(&drm->struct_mutex);
+        if (ret)
+                return ret;
-        mutex_lock(&dev->struct_mutex);
+        return rockchip_drm_gem_object_mmap(obj, vma);
+}
-        node = drm_vma_offset_exact_lookup(dev->vma_offset_manager,
+/* drm driver mmap file operations */
-                                           vma->vm_pgoff,
+int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-                                           vma_pages(vma));
+{
-        if (!node) {
+        struct drm_gem_object *obj;
-                mutex_unlock(&dev->struct_mutex);
+        int ret;
-                DRM_ERROR("failed to find vma node.\n");
-                return -EINVAL;
-        } else if (!drm_vma_node_is_allowed(node, filp)) {
-                mutex_unlock(&dev->struct_mutex);
-                return -EACCES;
-        }
-        obj = container_of(node, struct drm_gem_object, vma_node);
+        ret = drm_gem_mmap(filp, vma);
-        ret = rockchip_gem_mmap_buf(obj, vma);
+        if (ret)
+                return ret;
-        mutex_unlock(&dev->struct_mutex);
+        obj = vma->vm_private_data;
-        return ret;
+        return rockchip_drm_gem_object_mmap(obj, vma);
 }
 struct rockchip_gem_object *
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index dc65161d7cad..34b78e736532 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -170,6 +170,7 @@ struct vop_win_phy {
        struct vop_reg enable;
        struct vop_reg format;
+        struct vop_reg rb_swap;
        struct vop_reg act_info;
        struct vop_reg dsp_info;
        struct vop_reg dsp_st;
@@ -199,8 +200,12 @@ struct vop_data {
 static const uint32_t formats_01[] = {
        DRM_FORMAT_XRGB8888,
        DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_XBGR8888,
+        DRM_FORMAT_ABGR8888,
        DRM_FORMAT_RGB888,
+        DRM_FORMAT_BGR888,
        DRM_FORMAT_RGB565,
+        DRM_FORMAT_BGR565,
        DRM_FORMAT_NV12,
        DRM_FORMAT_NV16,
        DRM_FORMAT_NV24,
@@ -209,8 +214,12 @@ static const uint32_t formats_01[] = {
 static const uint32_t formats_234[] = {
        DRM_FORMAT_XRGB8888,
        DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_XBGR8888,
+        DRM_FORMAT_ABGR8888,
        DRM_FORMAT_RGB888,
+        DRM_FORMAT_BGR888,
        DRM_FORMAT_RGB565,
+        DRM_FORMAT_BGR565,
 };
 static const struct vop_win_phy win01_data = {
@@ -218,6 +227,7 @@ static const struct vop_win_phy win01_data = {
        .nformats = ARRAY_SIZE(formats_01),
        .enable = VOP_REG(WIN0_CTRL0, 0x1, 0),
        .format = VOP_REG(WIN0_CTRL0, 0x7, 1),
+        .rb_swap = VOP_REG(WIN0_CTRL0, 0x1, 12),
        .act_info = VOP_REG(WIN0_ACT_INFO, 0x1fff1fff, 0),
        .dsp_info = VOP_REG(WIN0_DSP_INFO, 0x0fff0fff, 0),
        .dsp_st = VOP_REG(WIN0_DSP_ST, 0x1fff1fff, 0),
@@ -234,6 +244,7 @@ static const struct vop_win_phy win23_data = {
        .nformats = ARRAY_SIZE(formats_234),
        .enable = VOP_REG(WIN2_CTRL0, 0x1, 0),
        .format = VOP_REG(WIN2_CTRL0, 0x7, 1),
+        .rb_swap = VOP_REG(WIN2_CTRL0, 0x1, 12),
        .dsp_info = VOP_REG(WIN2_DSP_INFO0, 0x0fff0fff, 0),
        .dsp_st = VOP_REG(WIN2_DSP_ST0, 0x1fff1fff, 0),
        .yrgb_mst = VOP_REG(WIN2_MST0, 0xffffffff, 0),
@@ -242,15 +253,6 @@ static const struct vop_win_phy win23_data = {
        .dst_alpha_ctl = VOP_REG(WIN2_DST_ALPHA_CTRL, 0xff, 0),
 };
-static const struct vop_win_phy cursor_data = {
-        .data_formats = formats_234,
-        .nformats = ARRAY_SIZE(formats_234),
-        .enable = VOP_REG(HWC_CTRL0, 0x1, 0),
-        .format = VOP_REG(HWC_CTRL0, 0x7, 1),
-        .dsp_st = VOP_REG(HWC_DSP_ST, 0x1fff1fff, 0),
-        .yrgb_mst = VOP_REG(HWC_MST, 0xffffffff, 0),
-};
 static const struct vop_ctrl ctrl_data = {
        .standby = VOP_REG(SYS_CTRL, 0x1, 22),
        .gate_en = VOP_REG(SYS_CTRL, 0x1, 23),
@@ -282,14 +284,14 @@ static const struct vop_reg_data vop_init_reg_table[] = {
 /*
 * Note: rk3288 has a dedicated 'cursor' window, however, that window requires
 * special support to get alpha blending working.  For now, just use overlay
- * window 1 for the drm cursor.
+ * window 3 for the drm cursor.
+ *
 */
 static const struct vop_win_data rk3288_vop_win_data[] = {
        { .base = 0x00, .phy = &win01_data, .type = DRM_PLANE_TYPE_PRIMARY },
-        { .base = 0x40, .phy = &win01_data, .type = DRM_PLANE_TYPE_CURSOR },
+        { .base = 0x40, .phy = &win01_data, .type = DRM_PLANE_TYPE_OVERLAY },
        { .base = 0x00, .phy = &win23_data, .type = DRM_PLANE_TYPE_OVERLAY },
-        { .base = 0x50, .phy = &win23_data, .type = DRM_PLANE_TYPE_OVERLAY },
+        { .base = 0x50, .phy = &win23_data, .type = DRM_PLANE_TYPE_CURSOR },
-        { .base = 0x00, .phy = &cursor_data, .type = DRM_PLANE_TYPE_OVERLAY },
 };
 static const struct vop_data rk3288_vop = {
@@ -352,15 +354,32 @@ static inline void vop_mask_write_relaxed(struct vop *vop, uint32_t offset,
        }
 }
+static bool has_rb_swapped(uint32_t format)
+{
+        switch (format) {
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
+        case DRM_FORMAT_BGR888:
+        case DRM_FORMAT_BGR565:
+                return true;
+        default:
+                return false;
+        }
+}
 static enum vop_data_format vop_convert_format(uint32_t format)
 {
        switch (format) {
        case DRM_FORMAT_XRGB8888:
        case DRM_FORMAT_ARGB8888:
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
                return VOP_FMT_ARGB8888;
        case DRM_FORMAT_RGB888:
+        case DRM_FORMAT_BGR888:
                return VOP_FMT_RGB888;
        case DRM_FORMAT_RGB565:
+        case DRM_FORMAT_BGR565:
                return VOP_FMT_RGB565;
        case DRM_FORMAT_NV12:
                return VOP_FMT_YUV420SP;
@@ -378,6 +397,7 @@ static bool is_alpha_support(uint32_t format)
 {
        switch (format) {
        case DRM_FORMAT_ARGB8888:
+        case DRM_FORMAT_ABGR8888:
                return true;
        default:
                return false;
@@ -588,6 +608,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
        enum vop_data_format format;
        uint32_t val;
        bool is_alpha;
+        bool rb_swap;
        bool visible;
        int ret;
        struct drm_rect dest = {
@@ -621,6 +642,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
                return 0;
        is_alpha = is_alpha_support(fb->pixel_format);
+        rb_swap = has_rb_swapped(fb->pixel_format);
        format = vop_convert_format(fb->pixel_format);
        if (format < 0)
                return format;
@@ -689,6 +711,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
        val = (dsp_sty - 1) << 16;
        val |= (dsp_stx - 1) & 0xffff;
        VOP_WIN_SET(vop, win, dsp_st, val);
+        VOP_WIN_SET(vop, win, rb_swap, rb_swap);
        if (is_alpha) {
                VOP_WIN_SET(vop, win, dst_alpha_ctl,
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 882cccdad272..ac6fe40b99f7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -490,7 +490,8 @@ pgprot_t ttm_io_prot(uint32_t caching_flags, pgprot_t tmp)
        else if (boot_cpu_data.x86 > 3)
                tmp = pgprot_noncached(tmp);
 #endif
-#if defined(__ia64__) || defined(__arm__) || defined(__powerpc__)
+#if defined(__ia64__) || defined(__arm__) || defined(__aarch64__) || \
+    defined(__powerpc__)
        if (caching_flags & TTM_PL_FLAG_WC)
                tmp = pgprot_writecombine(tmp);
        else
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 3077f1554099..624d941aaad1 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -963,14 +963,13 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
        } else {
                pool->npages_free += count;
                list_splice(&ttm_dma->pages_list, &pool->free_list);
-                npages = count;
+                /*
-                if (pool->npages_free > _manager->options.max_size) {
+                 * Wait to have at at least NUM_PAGES_TO_ALLOC number of pages
+                 * to free in order to minimize calls to set_memory_wb().
+                 */
+                if (pool->npages_free >= (_manager->options.max_size +
+                                          NUM_PAGES_TO_ALLOC))
                        npages = pool->npages_free - _manager->options.max_size;
-                        /* free at least NUM_PAGES_TO_ALLOC number of pages
-                         * to reduce calls to set_memory_wb */
-                        if (npages < NUM_PAGES_TO_ALLOC)
-                                npages = NUM_PAGES_TO_ALLOC;
-                }
        }
        spin_unlock_irqrestore(&pool->lock, irq_flags);
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 6d2f39d36e44..00f2058944e5 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -1107,6 +1107,9 @@ static int ipu_irq_init(struct ipu_soc *ipu)
                return ret;
        }
+        for (i = 0; i < IPU_NUM_IRQS; i += 32)
+                ipu_cm_write(ipu, 0, IPU_INT_CTRL(i / 32));
        for (i = 0; i < IPU_NUM_IRQS; i += 32) {
                gc = irq_get_domain_generic_chip(ipu->domain, i);
                gc->reg_base = ipu->cm_reg;
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index f822fd2a1ada..884d82f9190e 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -546,6 +546,12 @@ static const struct hid_device_id apple_devices[] = {
                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 157c62775053..e6fce23b121a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1782,6 +1782,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -2463,6 +2466,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
        { }
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 3318de690e00..a2dbbbe0d8d7 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -356,6 +356,8 @@ static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
        struct cp2112_force_read_report report;
        int ret;
+        if (size > sizeof(dev->read_data))
+                size = sizeof(dev->read_data);
        report.report = CP2112_DATA_READ_FORCE_SEND;
        report.length = cpu_to_be16(size);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b04b0820d816..b3b225b75d0a 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -142,6 +142,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI    0x0272
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO             0x0273
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS             0x0274
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY    0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY     0x030b
 #define USB_DEVICE_ID_APPLE_IRCONTROL   0x8240
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 6a9b05b328a9..7c811252c1ce 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -778,9 +778,16 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
        /*
         * some egalax touchscreens have "application == HID_DG_TOUCHSCREEN"
         * for the stylus.
+         * The check for mt_report_id ensures we don't process
+         * HID_DG_CONTACTCOUNT from the pen report as it is outside the physical
+         * collection, but within the report ID.
         */
        if (field->physical == HID_DG_STYLUS)
                return 0;
+        else if ((field->physical == 0) &&
+                 (field->report->id != td->mt_report_id) &&
+                 (td->mt_report_id != -1))
+                return 0;
        if (field->application == HID_DG_TOUCHSCREEN ||
            field->application == HID_DG_TOUCHPAD)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 53e7de7cb9e2..20f9a653444c 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -87,6 +87,9 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 4c0ffca97bef..44958d79d598 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1271,11 +1271,13 @@ fail_leds:
        pad_input_dev = NULL;
        wacom_wac->pad_registered = false;
 fail_register_pad_input:
-        input_unregister_device(touch_input_dev);
+        if (touch_input_dev)
+                input_unregister_device(touch_input_dev);
        wacom_wac->touch_input = NULL;
        wacom_wac->touch_registered = false;
 fail_register_touch_input:
-        input_unregister_device(pen_input_dev);
+        if (pen_input_dev)
+                input_unregister_device(pen_input_dev);
        wacom_wac->pen_input = NULL;
        wacom_wac->pen_registered = false;
 fail_register_pen_input:
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 232da89f4e88..0d244239e55d 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2213,6 +2213,9 @@ void wacom_setup_device_quirks(struct wacom *wacom)
                        features->x_max = 4096;
                        features->y_max = 4096;
                }
+                else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
+                        features->device_type |= WACOM_DEVICETYPE_PAD;
+                }
        }
        /*
diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
index 28fcb2e246d5..fbfc02bb2cfa 100644
--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -195,7 +195,7 @@ abort:
 }
 static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
-                                 unsigned int voltage)
+                                 unsigned long voltage)
 {
        int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
        int err;
diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
index b77b82f24480..6153df735e82 100644
--- a/drivers/hwmon/nct7904.c
+++ b/drivers/hwmon/nct7904.c
@@ -412,8 +412,9 @@ static ssize_t show_pwm(struct device *dev,
        return sprintf(buf, "%d\n", val);
 }
-static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+static ssize_t store_enable(struct device *dev,
-                          const char *buf, size_t count)
+                            struct device_attribute *devattr,
+                            const char *buf, size_t count)
 {
        int index = to_sensor_dev_attr(devattr)->index;
        struct nct7904_data *data = dev_get_drvdata(dev);
@@ -422,18 +423,18 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
        if (kstrtoul(buf, 10, &val) < 0)
                return -EINVAL;
-        if (val > 1 || (val && !data->fan_mode[index]))
+        if (val < 1 || val > 2 || (val == 2 && !data->fan_mode[index]))
                return -EINVAL;
        ret = nct7904_write_reg(data, BANK_3, FANCTL1_FMR_REG + index,
-                                val ? data->fan_mode[index] : 0);
+                                val == 2 ? data->fan_mode[index] : 0);
        return ret ? ret : count;
 }
-/* Return 0 for manual mode or 1 for SmartFan mode */
+/* Return 1 for manual mode or 2 for SmartFan mode */
-static ssize_t show_mode(struct device *dev,
+static ssize_t show_enable(struct device *dev,
-                         struct device_attribute *devattr, char *buf)
+                           struct device_attribute *devattr, char *buf)
 {
        int index = to_sensor_dev_attr(devattr)->index;
        struct nct7904_data *data = dev_get_drvdata(dev);
@@ -443,36 +444,36 @@ static ssize_t show_mode(struct device *dev,
        if (val < 0)
                return val;
-        return sprintf(buf, "%d\n", val ? 1 : 0);
+        return sprintf(buf, "%d\n", val ? 2 : 1);
 }
 /* 2 attributes per channel: pwm and mode */
-static SENSOR_DEVICE_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR,
                        show_pwm, store_pwm, 0);
-static SENSOR_DEVICE_ATTR(fan1_mode, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 0);
+                        show_enable, store_enable, 0);
-static SENSOR_DEVICE_ATTR(fan2_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR,
                        show_pwm, store_pwm, 1);
-static SENSOR_DEVICE_ATTR(fan2_mode, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm2_enable, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 1);
+                        show_enable, store_enable, 1);
-static SENSOR_DEVICE_ATTR(fan3_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm3, S_IRUGO | S_IWUSR,
                        show_pwm, store_pwm, 2);
-static SENSOR_DEVICE_ATTR(fan3_mode, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm3_enable, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 2);
+                        show_enable, store_enable, 2);
-static SENSOR_DEVICE_ATTR(fan4_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm4, S_IRUGO | S_IWUSR,
                        show_pwm, store_pwm, 3);
-static SENSOR_DEVICE_ATTR(fan4_mode, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm4_enable, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 3);
+                        show_enable, store_enable, 3);
 static struct attribute *nct7904_fanctl_attrs[] = {
-        &sensor_dev_attr_fan1_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm1.dev_attr.attr,
-        &sensor_dev_attr_fan1_mode.dev_attr.attr,
+        &sensor_dev_attr_pwm1_enable.dev_attr.attr,
-        &sensor_dev_attr_fan2_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm2.dev_attr.attr,
-        &sensor_dev_attr_fan2_mode.dev_attr.attr,
+        &sensor_dev_attr_pwm2_enable.dev_attr.attr,
-        &sensor_dev_attr_fan3_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm3.dev_attr.attr,
-        &sensor_dev_attr_fan3_mode.dev_attr.attr,
+        &sensor_dev_attr_pwm3_enable.dev_attr.attr,
-        &sensor_dev_attr_fan4_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm4.dev_attr.attr,
-        &sensor_dev_attr_fan4_mode.dev_attr.attr,
+        &sensor_dev_attr_pwm4_enable.dev_attr.attr,
        NULL
 };
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 4e70f51c2370..cc5a35750b50 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -1464,7 +1464,7 @@ static void bmc150_accel_unregister_triggers(struct bmc150_accel_data *data,
 {
        int i;
-        for (i = from; i >= 0; i++) {
+        for (i = from; i >= 0; i--) {
                if (data->triggers[i].indio_trig) {
                        iio_trigger_unregister(data->triggers[i].indio_trig);
                        data->triggers[i].indio_trig = NULL;
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index e8e2077c7244..13ea1ea23328 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -557,21 +557,21 @@ static void mma8452_transient_interrupt(struct iio_dev *indio_dev)
        if (src & MMA8452_TRANSIENT_SRC_XTRANSE)
                iio_push_event(indio_dev,
                               IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_X,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                  IIO_EV_DIR_RISING),
                               ts);
        if (src & MMA8452_TRANSIENT_SRC_YTRANSE)
                iio_push_event(indio_dev,
                               IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_Y,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                  IIO_EV_DIR_RISING),
                               ts);
        if (src & MMA8452_TRANSIENT_SRC_ZTRANSE)
                iio_push_event(indio_dev,
                               IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_Z,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                  IIO_EV_DIR_RISING),
                               ts);
 }
@@ -644,7 +644,7 @@ static int mma8452_reg_access_dbg(struct iio_dev *indio_dev,
 static const struct iio_event_spec mma8452_transient_event[] = {
        {
-                .type = IIO_EV_TYPE_THRESH,
+                .type = IIO_EV_TYPE_MAG,
                .dir = IIO_EV_DIR_RISING,
                .mask_separate = BIT(IIO_EV_INFO_ENABLE),
                .mask_shared_by_type = BIT(IIO_EV_INFO_VALUE) |
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 7c5565891cb8..eb0cd897714a 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -153,8 +153,7 @@ config DA9150_GPADC
 config CC10001_ADC
        tristate "Cosmic Circuits 10001 ADC driver"
-        depends on HAVE_CLK || REGULATOR
+        depends on HAS_IOMEM && HAVE_CLK && REGULATOR
-        depends on HAS_IOMEM
        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 8a0eb4a04fb5..7b40925dd4ff 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -182,7 +182,7 @@ struct at91_adc_caps {
        u8      ts_pen_detect_sensitivity;
        /* startup time calculate function */
-        u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
+        u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
        u8      num_channels;
        struct at91_adc_reg_desc registers;
@@ -201,7 +201,7 @@ struct at91_adc_state {
        u8                      num_channels;
        void __iomem            *reg_base;
        struct at91_adc_reg_desc *registers;
-        u8                      startup_time;
+        u32                     startup_time;
        u8                      sample_hold_time;
        bool                    sleep_mode;
        struct iio_trigger      **trig;
@@ -779,7 +779,7 @@ ret:
        return ret;
 }
-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
 {
        /*
         * Number of ticks needed to cover the startup time of the ADC
@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
        return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
 }
-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
 {
        /*
         * For sama5d3x and at91sam9x5, the formula changes to:
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index 8d9c9b9215dd..d819823f7257 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -299,6 +299,8 @@ static int mcp320x_probe(struct spi_device *spi)
        indio_dev->channels = chip_info->channels;
        indio_dev->num_channels = chip_info->num_channels;
+        adc->chip_info = chip_info;
        adc->transfer[0].tx_buf = &adc->tx_buf;
        adc->transfer[0].len = sizeof(adc->tx_buf);
        adc->transfer[1].rx_buf = adc->rx_buf;
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index 8d4e019ea4ca..9c311c1e1ac7 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -349,3 +349,7 @@ static struct platform_driver rockchip_saradc_driver = {
 };
 module_platform_driver(rockchip_saradc_driver);
+MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
+MODULE_DESCRIPTION("Rockchip SARADC driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 06f4792240f0..ebe415f10640 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -833,7 +833,8 @@ static int twl4030_madc_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                   twl4030_madc_threaded_irq_handler,
-                                   IRQF_TRIGGER_RISING, "twl4030_madc", madc);
+                                   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                   "twl4030_madc", madc);
        if (ret) {
                dev_err(&pdev->dev, "could not request irq\n");
                goto err_i2c;
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 480f335a0f9f..819632bf1fda 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -635,7 +635,7 @@ static int vf610_adc_reg_access(struct iio_dev *indio_dev,
        struct vf610_adc *info = iio_priv(indio_dev);
        if ((readval == NULL) ||
-                (!(reg % 4) || (reg > VF610_REG_ADC_PCTL)))
+                ((reg % 4) || (reg > VF610_REG_ADC_PCTL)))
                return -EINVAL;
        *readval = readl(info->regs + reg);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 610fc98f88ef..595511022795 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
        s32 poll_value = 0;
        if (state) {
+                if (!atomic_read(&st->user_requested_state))
+                        return 0;
                if (sensor_hub_device_open(st->hsdev))
                        return -EIO;
@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                poll_value = hid_sensor_read_poll_value(st);
        } else {
-                if (!atomic_dec_and_test(&st->data_ready))
+                int val;
+                val = atomic_dec_if_positive(&st->data_ready);
+                if (val < 0)
                        return 0;
                sensor_hub_device_close(st->hsdev);
                state_val = hid_sensor_get_usage_index(st->hsdev,
                        st->power_state.report_id,
@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
 int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 {
 #ifdef CONFIG_PM
        int ret;
+        atomic_set(&st->user_requested_state, state);
        if (state)
                ret = pm_runtime_get_sync(&st->pdev->dev);
        else {
@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
        return 0;
 #else
+        atomic_set(&st->user_requested_state, state);
        return _hid_sensor_power_state(st, state);
 #endif
 }
diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
index 61bb9d4239ea..e98428df0d44 100644
--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -22,7 +22,7 @@
 #include "ad5624r.h"
 static int ad5624r_spi_write(struct spi_device *spi,
-                             u8 cmd, u8 addr, u16 val, u8 len)
+                             u8 cmd, u8 addr, u16 val, u8 shift)
 {
        u32 data;
        u8 msg[3];
@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
         * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
         * for the AD5664R, AD5644R, and AD5624R, respectively.
         */
-        data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
+        data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
        msg[0] = data >> 16;
        msg[1] = data >> 8;
        msg[2] = data;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 17d4bb15be4d..65ce86837177 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
        return -EINVAL;
 }
+static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
+                                 struct iio_chan_spec const *chan, long mask)
+{
+        switch (mask) {
+        case IIO_CHAN_INFO_SCALE:
+                switch (chan->type) {
+                case IIO_ANGL_VEL:
+                        return IIO_VAL_INT_PLUS_NANO;
+                default:
+                        return IIO_VAL_INT_PLUS_MICRO;
+                }
+        default:
+                return IIO_VAL_INT_PLUS_MICRO;
+        }
+        return -EINVAL;
+}
 static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
 {
        int result, i;
@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = {
        .driver_module = THIS_MODULE,
        .read_raw = &inv_mpu6050_read_raw,
        .write_raw = &inv_mpu6050_write_raw,
+        .write_raw_get_fmt = &inv_write_raw_get_fmt,
        .attrs = &inv_attribute_group,
        .validate_trigger = inv_mpu6050_validate_trigger,
 };
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index e6198b7c9cbf..a5c59251ec0e 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -188,6 +188,7 @@ config SENSORS_LM3533
 config LTR501
        tristate "LTR-501ALS-01 light sensor"
        depends on I2C
+        select REGMAP_I2C
        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
@@ -201,6 +202,7 @@ config LTR501
 config STK3310
        tristate "STK3310 ALS and proximity sensor"
        depends on I2C
+        select REGMAP_I2C
        help
         Say yes here to get support for the Sensortek STK3310 ambient light
         and proximity sensor. The STK3311 model is also supported by this
diff --git a/drivers/iio/light/cm3323.c b/drivers/iio/light/cm3323.c
index 869033e48a1f..a1d4905cc9d2 100644
--- a/drivers/iio/light/cm3323.c
+++ b/drivers/iio/light/cm3323.c
@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3323_data *data, int val, int val2)
        for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
                if (val == cm3323_int_time[i].val &&
                    val2 == cm3323_int_time[i].val2) {
-                        reg_conf = data->reg_conf;
+                        reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
                        reg_conf |= i << CM3323_CONF_IT_SHIFT;
                        ret = i2c_smbus_write_word_data(data->client,
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index 1ef7d3773ab9..b5a0e66b5f28 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1302,7 +1302,7 @@ static int ltr501_init(struct ltr501_data *data)
        if (ret < 0)
                return ret;
-        data->als_contr = ret | data->chip_info->als_mode_active;
+        data->als_contr = status | data->chip_info->als_mode_active;
        ret = regmap_read(data->regmap, LTR501_PS_CONTR, &status);
        if (ret < 0)
diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c
index fee4297d7c8f..11a027adc204 100644
--- a/drivers/iio/light/stk3310.c
+++ b/drivers/iio/light/stk3310.c
@@ -43,7 +43,6 @@
 #define STK3311_CHIP_ID_VAL                     0x1D
 #define STK3310_PSINT_EN                        0x01
 #define STK3310_PS_MAX_VAL                      0xFFFF
-#define STK3310_THRESH_MAX                      0xFFFF
 #define STK3310_DRIVER_NAME                     "stk3310"
 #define STK3310_REGMAP_NAME                     "stk3310_regmap"
@@ -84,15 +83,13 @@ static const struct reg_field stk3310_reg_field_flag_psint =
                                REG_FIELD(STK3310_REG_FLAG, 4, 4);
 static const struct reg_field stk3310_reg_field_flag_nf =
                                REG_FIELD(STK3310_REG_FLAG, 0, 0);
-/*
- * Maximum PS values with regard to scale. Used to export the 'inverse'
+/* Estimate maximum proximity values with regard to measurement scale. */
- * PS value (high values for far objects, low values for near objects).
- */
 static const int stk3310_ps_max[4] = {
-        STK3310_PS_MAX_VAL / 64,
+        STK3310_PS_MAX_VAL / 640,
-        STK3310_PS_MAX_VAL / 16,
+        STK3310_PS_MAX_VAL / 160,
-        STK3310_PS_MAX_VAL /  4,
+        STK3310_PS_MAX_VAL /  40,
-        STK3310_PS_MAX_VAL,
+        STK3310_PS_MAX_VAL /  10
 };
 static const int stk3310_scale_table[][2] = {
@@ -128,14 +125,14 @@ static const struct iio_event_spec stk3310_events[] = {
        /* Proximity event */
        {
                .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_RISING,
                .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                 BIT(IIO_EV_INFO_ENABLE),
        },
        /* Out-of-proximity event */
        {
                .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_RISING,
+                .dir = IIO_EV_DIR_FALLING,
                .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                 BIT(IIO_EV_INFO_ENABLE),
        },
@@ -203,25 +200,18 @@ static int stk3310_read_event(struct iio_dev *indio_dev,
                              int *val, int *val2)
 {
        u8 reg;
-        u16 buf;
+        __be16 buf;
        int ret;
-        unsigned int index;
        struct stk3310_data *data = iio_priv(indio_dev);
        if (info != IIO_EV_INFO_VALUE)
                return -EINVAL;
-        /*
+        /* Only proximity interrupts are implemented at the moment. */
-         * Only proximity interrupts are implemented at the moment.
-         * Since we're inverting proximity values, the sensor's 'high'
-         * threshold will become our 'low' threshold, associated with
-         * 'near' events. Similarly, the sensor's 'low' threshold will
-         * be our 'high' threshold, associated with 'far' events.
-         */
        if (dir == IIO_EV_DIR_RISING)
-                reg = STK3310_REG_THDL_PS;
-        else if (dir == IIO_EV_DIR_FALLING)
                reg = STK3310_REG_THDH_PS;
+        else if (dir == IIO_EV_DIR_FALLING)
+                reg = STK3310_REG_THDL_PS;
        else
                return -EINVAL;
@@ -232,8 +222,7 @@ static int stk3310_read_event(struct iio_dev *indio_dev,
                dev_err(&data->client->dev, "register read failed\n");
                return ret;
        }
-        regmap_field_read(data->reg_ps_gain, &index);
+        *val = be16_to_cpu(buf);
-        *val = swab16(stk3310_ps_max[index] - buf);
        return IIO_VAL_INT;
 }
@@ -246,7 +235,7 @@ static int stk3310_write_event(struct iio_dev *indio_dev,
                               int val, int val2)
 {
        u8 reg;
-        u16 buf;
+        __be16 buf;
        int ret;
        unsigned int index;
        struct stk3310_data *data = iio_priv(indio_dev);
@@ -257,13 +246,13 @@ static int stk3310_write_event(struct iio_dev *indio_dev,
                return -EINVAL;
        if (dir == IIO_EV_DIR_RISING)
-                reg = STK3310_REG_THDL_PS;
-        else if (dir == IIO_EV_DIR_FALLING)
                reg = STK3310_REG_THDH_PS;
+        else if (dir == IIO_EV_DIR_FALLING)
+                reg = STK3310_REG_THDL_PS;
        else
                return -EINVAL;
-        buf = swab16(stk3310_ps_max[index] - val);
+        buf = cpu_to_be16(val);
        ret = regmap_bulk_write(data->regmap, reg, &buf, 2);
        if (ret < 0)
                dev_err(&client->dev, "failed to set PS threshold!\n");
@@ -312,7 +301,7 @@ static int stk3310_read_raw(struct iio_dev *indio_dev,
                            int *val, int *val2, long mask)
 {
        u8 reg;
-        u16 buf;
+        __be16 buf;
        int ret;
        unsigned int index;
        struct stk3310_data *data = iio_priv(indio_dev);
@@ -333,15 +322,7 @@ static int stk3310_read_raw(struct iio_dev *indio_dev,
                        mutex_unlock(&data->lock);
                        return ret;
                }
-                *val = swab16(buf);
+                *val = be16_to_cpu(buf);
-                if (chan->type == IIO_PROXIMITY) {
-                        /*
-                         * Invert the proximity data so we return low values
-                         * for close objects and high values for far ones.
-                         */
-                        regmap_field_read(data->reg_ps_gain, &index);
-                        *val = stk3310_ps_max[index] - *val;
-                }
                mutex_unlock(&data->lock);
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_INT_TIME:
@@ -581,8 +562,8 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private)
        }
        event = IIO_UNMOD_EVENT_CODE(IIO_PROXIMITY, 1,
                                     IIO_EV_TYPE_THRESH,
-                                     (dir ? IIO_EV_DIR_RISING :
+                                     (dir ? IIO_EV_DIR_FALLING :
-                                            IIO_EV_DIR_FALLING));
+                                            IIO_EV_DIR_RISING));
        iio_push_event(indio_dev, event, data->timestamp);
        /* Reset the interrupt flag */
@@ -627,13 +608,7 @@ static int stk3310_probe(struct i2c_client *client,
        if (ret < 0)
                return ret;
-        ret = iio_device_register(indio_dev);
+        if (client->irq < 0)
-        if (ret < 0) {
-                dev_err(&client->dev, "device_register failed\n");
-                stk3310_set_state(data, STK3310_STATE_STANDBY);
-        }
-        if (client->irq <= 0)
                client->irq = stk3310_gpio_probe(client);
        if (client->irq >= 0) {
@@ -648,6 +623,12 @@ static int stk3310_probe(struct i2c_client *client,
                                        client->irq);
        }
+        ret = iio_device_register(indio_dev);
+        if (ret < 0) {
+                dev_err(&client->dev, "device_register failed\n");
+                stk3310_set_state(data, STK3310_STATE_STANDBY);
+        }
        return ret;
 }
diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c
index 71c2bde275aa..f8b1df018abe 100644
--- a/drivers/iio/light/tcs3414.c
+++ b/drivers/iio/light/tcs3414.c
@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_dev *indio_dev,
                if (val != 0)
                        return -EINVAL;
                for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
-                        if (val == tcs3414_times[i] * 1000) {
+                        if (val2 == tcs3414_times[i] * 1000) {
                                data->timing &= ~TCS3414_INTEG_MASK;
                                data->timing |= i;
                                return i2c_smbus_write_byte_data(
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index dcadfc4f0661..efb9350b0d76 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -90,6 +90,7 @@ config IIO_ST_MAGN_SPI_3AXIS
 config BMC150_MAGN
        tristate "Bosch BMC150 Magnetometer Driver"
        depends on I2C
+        select REGMAP_I2C
        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c
index d4c178869991..1347a1f2e46f 100644
--- a/drivers/iio/magnetometer/bmc150_magn.c
+++ b/drivers/iio/magnetometer/bmc150_magn.c
@@ -706,11 +706,11 @@ static int bmc150_magn_init(struct bmc150_magn_data *data)
                goto err_poweroff;
        }
        if (chip_id != BMC150_MAGN_CHIP_ID_VAL) {
-                dev_err(&data->client->dev, "Invalid chip id 0x%x\n", ret);
+                dev_err(&data->client->dev, "Invalid chip id 0x%x\n", chip_id);
                ret = -ENODEV;
                goto err_poweroff;
        }
-        dev_dbg(&data->client->dev, "Chip id %x\n", ret);
+        dev_dbg(&data->client->dev, "Chip id %x\n", chip_id);
        preset = bmc150_magn_presets_table[BMC150_MAGN_DEFAULT_PRESET];
        ret = bmc150_magn_set_odr(data, preset.odr);
diff --git a/drivers/iio/magnetometer/mmc35240.c b/drivers/iio/magnetometer/mmc35240.c
index 7a2ea71c659a..706ebfd6297f 100644
--- a/drivers/iio/magnetometer/mmc35240.c
+++ b/drivers/iio/magnetometer/mmc35240.c
@@ -84,10 +84,10 @@
 #define MMC35240_OTP_START_ADDR         0x1B
 enum mmc35240_resolution {
-        MMC35240_16_BITS_SLOW = 0, /* 100 Hz */
+        MMC35240_16_BITS_SLOW = 0, /* 7.92 ms */
-        MMC35240_16_BITS_FAST,     /* 200 Hz */
+        MMC35240_16_BITS_FAST,     /* 4.08 ms */
-        MMC35240_14_BITS,          /* 333 Hz */
+        MMC35240_14_BITS,          /* 2.16 ms */
-        MMC35240_12_BITS,          /* 666 Hz */
+        MMC35240_12_BITS,          /* 1.20 ms */
 };
 enum mmc35240_axis {
@@ -100,22 +100,22 @@ static const struct {
        int sens[3]; /* sensitivity per X, Y, Z axis */
        int nfo; /* null field output */
 } mmc35240_props_table[] = {
-        /* 16 bits, 100Hz ODR */
+        /* 16 bits, 125Hz ODR */
        {
                {1024, 1024, 1024},
                32768,
        },
-        /* 16 bits, 200Hz ODR */
+        /* 16 bits, 250Hz ODR */
        {
                {1024, 1024, 770},
                32768,
        },
-        /* 14 bits, 333Hz ODR */
+        /* 14 bits, 450Hz ODR */
        {
                {256, 256, 193},
                8192,
        },
-        /* 12 bits, 666Hz ODR */
+        /* 12 bits, 800Hz ODR */
        {
                {64, 64, 48},
                2048,
@@ -133,9 +133,15 @@ struct mmc35240_data {
        int axis_scale[3];
 };
-static const int mmc35240_samp_freq[] = {100, 200, 333, 666};
+static const struct {
+        int val;
+        int val2;
+} mmc35240_samp_freq[] = { {1, 500000},
+                           {13, 0},
+                           {25, 0},
+                           {50, 0} };
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("100 200 333 666");
+static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1.5 13 25 50");
 #define MMC35240_CHANNEL(_axis) { \
        .type = IIO_MAGN, \
@@ -168,7 +174,8 @@ static int mmc35240_get_samp_freq_index(struct mmc35240_data *data,
        int i;
        for (i = 0; i < ARRAY_SIZE(mmc35240_samp_freq); i++)
-                if (mmc35240_samp_freq[i] == val)
+                if (mmc35240_samp_freq[i].val == val &&
+                    mmc35240_samp_freq[i].val2 == val2)
                        return i;
        return -EINVAL;
 }
@@ -195,8 +202,8 @@ static int mmc35240_hw_set(struct mmc35240_data *data, bool set)
                coil_bit = MMC35240_CTRL0_RESET_BIT;
        return regmap_update_bits(data->regmap, MMC35240_REG_CTRL0,
-                                  MMC35240_CTRL0_REFILL_BIT,
+                                  coil_bit, coil_bit);
-                                  coil_bit);
 }
 static int mmc35240_init(struct mmc35240_data *data)
@@ -215,14 +222,15 @@ static int mmc35240_init(struct mmc35240_data *data)
        /*
         * make sure we restore sensor characteristics, by doing
-         * a RESET/SET sequence
+         * a SET/RESET sequence, the axis polarity being naturally
+         * aligned after RESET
         */
-        ret = mmc35240_hw_set(data, false);
+        ret = mmc35240_hw_set(data, true);
        if (ret < 0)
                return ret;
        usleep_range(MMC53240_WAIT_SET_RESET, MMC53240_WAIT_SET_RESET + 1);
-        ret = mmc35240_hw_set(data, true);
+        ret = mmc35240_hw_set(data, false);
        if (ret < 0)
                return ret;
@@ -378,9 +386,9 @@ static int mmc35240_read_raw(struct iio_dev *indio_dev,
                if (i < 0 || i >= ARRAY_SIZE(mmc35240_samp_freq))
                        return -EINVAL;
-                *val = mmc35240_samp_freq[i];
+                *val = mmc35240_samp_freq[i].val;
-                *val2 = 0;
+                *val2 = mmc35240_samp_freq[i].val2;
-                return IIO_VAL_INT;
+                return IIO_VAL_INT_PLUS_MICRO;
        default:
                return -EINVAL;
        }
@@ -496,6 +504,7 @@ static int mmc35240_probe(struct i2c_client *client,
        }
        data = iio_priv(indio_dev);
+        i2c_set_clientdata(client, indio_dev);
        data->client = client;
        data->regmap = regmap;
        data->res = MMC35240_16_BITS_SLOW;
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 2042e375f835..3d756bd8c703 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -80,6 +80,7 @@
 #define SX9500_COMPSTAT_MASK            GENMASK(3, 0)
 #define SX9500_NUM_CHANNELS             4
+#define SX9500_CHAN_MASK                GENMASK(SX9500_NUM_CHANNELS - 1, 0)
 struct sx9500_data {
        struct mutex mutex;
@@ -281,7 +282,7 @@ static int sx9500_read_prox_data(struct sx9500_data *data,
        if (ret < 0)
                return ret;
-        *val = 32767 - (s16)be16_to_cpu(regval);
+        *val = be16_to_cpu(regval);
        return IIO_VAL_INT;
 }
@@ -329,27 +330,29 @@ static int sx9500_read_proximity(struct sx9500_data *data,
        else
                ret = sx9500_wait_for_sample(data);
-        if (ret < 0)
-                return ret;
        mutex_lock(&data->mutex);
-        ret = sx9500_read_prox_data(data, chan, val);
        if (ret < 0)
-                goto out;
+                goto out_dec_data_rdy;
-        ret = sx9500_dec_chan_users(data, chan->channel);
+        ret = sx9500_read_prox_data(data, chan, val);
        if (ret < 0)
-                goto out;
+                goto out_dec_data_rdy;
        ret = sx9500_dec_data_rdy_users(data);
        if (ret < 0)
+                goto out_dec_chan;
+        ret = sx9500_dec_chan_users(data, chan->channel);
+        if (ret < 0)
                goto out;
        ret = IIO_VAL_INT;
        goto out;
+out_dec_data_rdy:
+        sx9500_dec_data_rdy_users(data);
 out_dec_chan:
        sx9500_dec_chan_users(data, chan->channel);
 out:
@@ -679,7 +682,7 @@ out:
 static int sx9500_buffer_preenable(struct iio_dev *indio_dev)
 {
        struct sx9500_data *data = iio_priv(indio_dev);
-        int ret, i;
+        int ret = 0, i;
        mutex_lock(&data->mutex);
@@ -703,7 +706,7 @@ static int sx9500_buffer_preenable(struct iio_dev *indio_dev)
 static int sx9500_buffer_predisable(struct iio_dev *indio_dev)
 {
        struct sx9500_data *data = iio_priv(indio_dev);
-        int ret, i;
+        int ret = 0, i;
        iio_triggered_buffer_predisable(indio_dev);
@@ -800,8 +803,7 @@ static int sx9500_init_compensation(struct iio_dev *indio_dev)
        unsigned int val;
        ret = regmap_update_bits(data->regmap, SX9500_REG_PROX_CTRL0,
-                                 GENMASK(SX9500_NUM_CHANNELS, 0),
+                                 SX9500_CHAN_MASK, SX9500_CHAN_MASK);
-                                 GENMASK(SX9500_NUM_CHANNELS, 0));
        if (ret < 0)
                return ret;
@@ -821,7 +823,7 @@ static int sx9500_init_compensation(struct iio_dev *indio_dev)
 out:
        regmap_update_bits(data->regmap, SX9500_REG_PROX_CTRL0,
-                           GENMASK(SX9500_NUM_CHANNELS, 0), 0);
+                           SX9500_CHAN_MASK, 0);
        return ret;
 }
diff --git a/drivers/iio/temperature/mlx90614.c b/drivers/iio/temperature/mlx90614.c
index cb2e8ad8bfdc..7a2b639eaa96 100644
--- a/drivers/iio/temperature/mlx90614.c
+++ b/drivers/iio/temperature/mlx90614.c
@@ -204,7 +204,7 @@ static int mlx90614_read_raw(struct iio_dev *indio_dev,
                *val = ret;
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_OFFSET:
-                *val = 13657;
+                *val = -13657;
                *val2 = 500000;
                return IIO_VAL_INT_PLUS_MICRO;
        case IIO_CHAN_INFO_SCALE:
diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index fcc49f89b946..8f21f32f9739 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
        struct tmp006_data *data = iio_priv(indio_dev);
        int i;
+        if (mask != IIO_CHAN_INFO_SAMP_FREQ)
+                return -EINVAL;
        for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
                if ((val == tmp006_freqs[i][0]) &&
                    (val2 == tmp006_freqs[i][1])) {
diff --git a/drivers/infiniband/core/agent.c b/drivers/infiniband/core/agent.c
index c7dcfe4ca5f1..0429040304fd 100644
--- a/drivers/infiniband/core/agent.c
+++ b/drivers/infiniband/core/agent.c
@@ -88,7 +88,7 @@ void agent_send_response(const struct ib_mad_hdr *mad_hdr, const struct ib_grh *
        struct ib_ah *ah;
        struct ib_mad_send_wr_private *mad_send_wr;
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
+        if (rdma_cap_ib_switch(device))
                port_priv = ib_get_agent_port(device, 0);
        else
                port_priv = ib_get_agent_port(device, port_num);
@@ -122,7 +122,7 @@ void agent_send_response(const struct ib_mad_hdr *mad_hdr, const struct ib_grh *
        memcpy(send_buf->mad, mad_hdr, resp_mad_len);
        send_buf->ah = ah;
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (rdma_cap_ib_switch(device)) {
                mad_send_wr = container_of(send_buf,
                                           struct ib_mad_send_wr_private,
                                           send_buf);
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index dbddddd6fb5d..3a972ebf3c0d 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -169,6 +169,7 @@ struct cm_device {
        struct ib_device *ib_device;
        struct device *device;
        u8 ack_delay;
+        int going_down;
        struct cm_port *port[0];
 };
@@ -805,6 +806,11 @@ static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
 {
        int wait_time;
        unsigned long flags;
+        struct cm_device *cm_dev;
+        cm_dev = ib_get_client_data(cm_id_priv->id.device, &cm_client);
+        if (!cm_dev)
+                return;
        spin_lock_irqsave(&cm.lock, flags);
        cm_cleanup_timewait(cm_id_priv->timewait_info);
@@ -818,8 +824,14 @@ static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
         */
        cm_id_priv->id.state = IB_CM_TIMEWAIT;
        wait_time = cm_convert_to_ms(cm_id_priv->av.timeout);
-        queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
-                           msecs_to_jiffies(wait_time));
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!cm_dev->going_down)
+                queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
+                                   msecs_to_jiffies(wait_time));
+        spin_unlock_irq(&cm.lock);
        cm_id_priv->timewait_info = NULL;
 }
@@ -3305,6 +3317,11 @@ static int cm_establish(struct ib_cm_id *cm_id)
        struct cm_work *work;
        unsigned long flags;
        int ret = 0;
+        struct cm_device *cm_dev;
+        cm_dev = ib_get_client_data(cm_id->device, &cm_client);
+        if (!cm_dev)
+                return -ENODEV;
        work = kmalloc(sizeof *work, GFP_ATOMIC);
        if (!work)
@@ -3343,7 +3360,17 @@ static int cm_establish(struct ib_cm_id *cm_id)
        work->remote_id = cm_id->remote_id;
        work->mad_recv_wc = NULL;
        work->cm_event.event = IB_CM_USER_ESTABLISHED;
-        queue_delayed_work(cm.wq, &work->work, 0);
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!cm_dev->going_down) {
+                queue_delayed_work(cm.wq, &work->work, 0);
+        } else {
+                kfree(work);
+                ret = -ENODEV;
+        }
+        spin_unlock_irq(&cm.lock);
 out:
        return ret;
 }
@@ -3394,6 +3421,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
        enum ib_cm_event_type event;
        u16 attr_id;
        int paths = 0;
+        int going_down = 0;
        switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
        case CM_REQ_ATTR_ID:
@@ -3452,7 +3480,19 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
        work->cm_event.event = event;
        work->mad_recv_wc = mad_recv_wc;
        work->port = port;
-        queue_delayed_work(cm.wq, &work->work, 0);
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!port->cm_dev->going_down)
+                queue_delayed_work(cm.wq, &work->work, 0);
+        else
+                going_down = 1;
+        spin_unlock_irq(&cm.lock);
+        if (going_down) {
+                kfree(work);
+                ib_free_recv_mad(mad_recv_wc);
+        }
 }
 static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
@@ -3771,7 +3811,7 @@ static void cm_add_one(struct ib_device *ib_device)
        cm_dev->ib_device = ib_device;
        cm_get_ack_delay(cm_dev);
+        cm_dev->going_down = 0;
        cm_dev->device = device_create(&cm_class, &ib_device->dev,
                                       MKDEV(0, 0), NULL,
                                       "%s", ib_device->name);
@@ -3864,14 +3904,23 @@ static void cm_remove_one(struct ib_device *ib_device)
        list_del(&cm_dev->list);
        write_unlock_irqrestore(&cm.device_lock, flags);
+        spin_lock_irq(&cm.lock);
+        cm_dev->going_down = 1;
+        spin_unlock_irq(&cm.lock);
        for (i = 1; i <= ib_device->phys_port_cnt; i++) {
                if (!rdma_cap_ib_cm(ib_device, i))
                        continue;
                port = cm_dev->port[i-1];
                ib_modify_port(ib_device, port->port_num, 0, &port_modify);
-                ib_unregister_mad_agent(port->mad_agent);
+                /*
+                 * We flush the queue here after the going_down set, this
+                 * verify that no new works will be queued in the recv handler,
+                 * after that we can call the unregister_mad_agent
+                 */
                flush_workqueue(cm.wq);
+                ib_unregister_mad_agent(port->mad_agent);
                cm_remove_port_fs(port);
        }
        device_unregister(cm_dev->device);
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index e6ffa2e66c1a..22a3abee2a54 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -67,7 +67,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
                err_str = "Invalid port mapper client";
                goto pid_query_error;
        }
-        if (iwpm_registered_client(nl_client))
+        if (iwpm_check_registration(nl_client, IWPM_REG_VALID) ||
+                        iwpm_user_pid == IWPM_PID_UNAVAILABLE)
                return 0;
        skb = iwpm_create_nlmsg(RDMA_NL_IWPM_REG_PID, &nlh, nl_client);
        if (!skb) {
@@ -106,7 +107,6 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
        ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_IWPM, GFP_KERNEL);
        if (ret) {
                skb = NULL; /* skb is freed in the netlink send-op handling */
-                iwpm_set_registered(nl_client, 1);
                iwpm_user_pid = IWPM_PID_UNAVAILABLE;
                err_str = "Unable to send a nlmsg";
                goto pid_query_error;
@@ -144,12 +144,12 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                err_str = "Invalid port mapper client";
                goto add_mapping_error;
        }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (!iwpm_check_registration(nl_client, IWPM_REG_VALID)) {
                err_str = "Unregistered port mapper client";
                goto add_mapping_error;
        }
-        if (!iwpm_valid_pid())
-                return 0;
        skb = iwpm_create_nlmsg(RDMA_NL_IWPM_ADD_MAPPING, &nlh, nl_client);
        if (!skb) {
                err_str = "Unable to create a nlmsg";
@@ -214,12 +214,12 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                err_str = "Invalid port mapper client";
                goto query_mapping_error;
        }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (!iwpm_check_registration(nl_client, IWPM_REG_VALID)) {
                err_str = "Unregistered port mapper client";
                goto query_mapping_error;
        }
-        if (!iwpm_valid_pid())
-                return 0;
        ret = -ENOMEM;
        skb = iwpm_create_nlmsg(RDMA_NL_IWPM_QUERY_MAPPING, &nlh, nl_client);
        if (!skb) {
@@ -288,12 +288,12 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
                err_str = "Invalid port mapper client";
                goto remove_mapping_error;
        }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (iwpm_check_registration(nl_client, IWPM_REG_UNDEF)) {
                err_str = "Unregistered port mapper client";
                goto remove_mapping_error;
        }
-        if (!iwpm_valid_pid())
-                return 0;
        skb = iwpm_create_nlmsg(RDMA_NL_IWPM_REMOVE_MAPPING, &nlh, nl_client);
        if (!skb) {
                ret = -ENOMEM;
@@ -388,7 +388,7 @@ int iwpm_register_pid_cb(struct sk_buff *skb, struct netlink_callback *cb)
        pr_debug("%s: iWarp Port Mapper (pid = %d) is available!\n",
                        __func__, iwpm_user_pid);
        if (iwpm_valid_client(nl_client))
-                iwpm_set_registered(nl_client, 1);
+                iwpm_set_registration(nl_client, IWPM_REG_VALID);
 register_pid_response_exit:
        nlmsg_request->request_done = 1;
        /* always for found nlmsg_request */
@@ -644,7 +644,6 @@ int iwpm_mapping_info_cb(struct sk_buff *skb, struct netlink_callback *cb)
 {
        struct nlattr *nltb[IWPM_NLA_MAPINFO_REQ_MAX];
        const char *msg_type = "Mapping Info response";
-        int iwpm_pid;
        u8 nl_client;
        char *iwpm_name;
        u16 iwpm_version;
@@ -669,14 +668,14 @@ int iwpm_mapping_info_cb(struct sk_buff *skb, struct netlink_callback *cb)
                                __func__, nl_client);
                return ret;
        }
-        iwpm_set_registered(nl_client, 0);
+        iwpm_set_registration(nl_client, IWPM_REG_INCOMPL);
        atomic_set(&echo_nlmsg_seq, cb->nlh->nlmsg_seq);
+        iwpm_user_pid = cb->nlh->nlmsg_pid;
        if (!iwpm_mapinfo_available())
                return 0;
-        iwpm_pid = cb->nlh->nlmsg_pid;
        pr_debug("%s: iWarp Port Mapper (pid = %d) is available!\n",
-                 __func__, iwpm_pid);
+                 __func__, iwpm_user_pid);
-        ret = iwpm_send_mapinfo(nl_client, iwpm_pid);
+        ret = iwpm_send_mapinfo(nl_client, iwpm_user_pid);
        return ret;
 }
 EXPORT_SYMBOL(iwpm_mapping_info_cb);
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index a626795bf9c7..5fb089e91353 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -78,6 +78,7 @@ init_exit:
        mutex_unlock(&iwpm_admin_lock);
        if (!ret) {
                iwpm_set_valid(nl_client, 1);
+                iwpm_set_registration(nl_client, IWPM_REG_UNDEF);
                pr_debug("%s: Mapinfo and reminfo tables are created\n",
                                __func__);
        }
@@ -106,6 +107,7 @@ int iwpm_exit(u8 nl_client)
        }
        mutex_unlock(&iwpm_admin_lock);
        iwpm_set_valid(nl_client, 0);
+        iwpm_set_registration(nl_client, IWPM_REG_UNDEF);
        return 0;
 }
 EXPORT_SYMBOL(iwpm_exit);
@@ -397,17 +399,23 @@ void iwpm_set_valid(u8 nl_client, int valid)
 }
 /* valid client */
-int iwpm_registered_client(u8 nl_client)
+u32 iwpm_get_registration(u8 nl_client)
 {
        return iwpm_admin.reg_list[nl_client];
 }
 /* valid client */
-void iwpm_set_registered(u8 nl_client, int reg)
+void iwpm_set_registration(u8 nl_client, u32 reg)
 {
        iwpm_admin.reg_list[nl_client] = reg;
 }
+/* valid client */
+u32 iwpm_check_registration(u8 nl_client, u32 reg)
+{
+        return (iwpm_get_registration(nl_client) & reg);
+}
 int iwpm_compare_sockaddr(struct sockaddr_storage *a_sockaddr,
                                struct sockaddr_storage *b_sockaddr)
 {
diff --git a/drivers/infiniband/core/iwpm_util.h b/drivers/infiniband/core/iwpm_util.h
index ee2d9ff095be..b7b9e194ce81 100644
--- a/drivers/infiniband/core/iwpm_util.h
+++ b/drivers/infiniband/core/iwpm_util.h
@@ -58,6 +58,10 @@
 #define IWPM_PID_UNDEFINED     -1
 #define IWPM_PID_UNAVAILABLE   -2
+#define IWPM_REG_UNDEF          0x01
+#define IWPM_REG_VALID          0x02
+#define IWPM_REG_INCOMPL        0x04
 struct iwpm_nlmsg_request {
        struct list_head    inprocess_list;
        __u32               nlmsg_seq;
@@ -88,7 +92,7 @@ struct iwpm_admin_data {
        atomic_t refcount;
        atomic_t nlmsg_seq;
        int      client_list[RDMA_NL_NUM_CLIENTS];
-        int      reg_list[RDMA_NL_NUM_CLIENTS];
+        u32      reg_list[RDMA_NL_NUM_CLIENTS];
 };
 /**
@@ -159,19 +163,31 @@ int iwpm_valid_client(u8 nl_client);
 void iwpm_set_valid(u8 nl_client, int valid);
 /**
- * iwpm_registered_client - Check if the port mapper client is registered
+ * iwpm_check_registration - Check if the client registration
+ *                            matches the given one
 * @nl_client: The index of the netlink client
+ * @reg: The given registration type to compare with
 *
 * Call iwpm_register_pid() to register a client
+ * Returns true if the client registration matches reg,
+ * otherwise returns false
+ */
+u32 iwpm_check_registration(u8 nl_client, u32 reg);
+/**
+ * iwpm_set_registration - Set the client registration
+ * @nl_client: The index of the netlink client
+ * @reg: Registration type to set
 */
-int iwpm_registered_client(u8 nl_client);
+void iwpm_set_registration(u8 nl_client, u32 reg);
 /**
- * iwpm_set_registered - Set the port mapper client to registered or not
+ * iwpm_get_registration
 * @nl_client: The index of the netlink client
- * @reg: 1 if registered or 0 if not
+ *
+ * Returns the client registration type
 */
-void iwpm_set_registered(u8 nl_client, int reg);
+u32 iwpm_get_registration(u8 nl_client);
 /**
 * iwpm_send_mapinfo - Send local and mapped IPv4/IPv6 address info of
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index a4b1466c1bf6..786fc51bf04b 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -769,7 +769,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
        bool opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
                                    mad_agent_priv->qp_info->port_priv->port_num);
-        if (device->node_type == RDMA_NODE_IB_SWITCH &&
+        if (rdma_cap_ib_switch(device) &&
            smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
                port_num = send_wr->wr.ud.port_num;
        else
@@ -787,14 +787,15 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                if ((opa_get_smp_direction(opa_smp)
                     ? opa_smp->route.dr.dr_dlid : opa_smp->route.dr.dr_slid) ==
                     OPA_LID_PERMISSIVE &&
-                     opa_smi_handle_dr_smp_send(opa_smp, device->node_type,
+                     opa_smi_handle_dr_smp_send(opa_smp,
+                                                rdma_cap_ib_switch(device),
                                                port_num) == IB_SMI_DISCARD) {
                        ret = -EINVAL;
                        dev_err(&device->dev, "OPA Invalid directed route\n");
                        goto out;
                }
                opa_drslid = be32_to_cpu(opa_smp->route.dr.dr_slid);
-                if (opa_drslid != OPA_LID_PERMISSIVE &&
+                if (opa_drslid != be32_to_cpu(OPA_LID_PERMISSIVE) &&
                    opa_drslid & 0xffff0000) {
                        ret = -EINVAL;
                        dev_err(&device->dev, "OPA Invalid dr_slid 0x%x\n",
@@ -810,7 +811,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
        } else {
                if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
                     IB_LID_PERMISSIVE &&
-                     smi_handle_dr_smp_send(smp, device->node_type, port_num) ==
+                     smi_handle_dr_smp_send(smp, rdma_cap_ib_switch(device), port_num) ==
                     IB_SMI_DISCARD) {
                        ret = -EINVAL;
                        dev_err(&device->dev, "Invalid directed route\n");
@@ -2030,7 +2031,7 @@ static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv
        struct ib_smp *smp = (struct ib_smp *)recv->mad;
        if (smi_handle_dr_smp_recv(smp,
-                                   port_priv->device->node_type,
+                                   rdma_cap_ib_switch(port_priv->device),
                                   port_num,
                                   port_priv->device->phys_port_cnt) ==
                                   IB_SMI_DISCARD)
@@ -2042,13 +2043,13 @@ static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv
        if (retsmi == IB_SMI_SEND) { /* don't forward */
                if (smi_handle_dr_smp_send(smp,
-                                           port_priv->device->node_type,
+                                           rdma_cap_ib_switch(port_priv->device),
                                           port_num) == IB_SMI_DISCARD)
                        return IB_SMI_DISCARD;
                if (smi_check_local_smp(smp, port_priv->device) == IB_SMI_DISCARD)
                        return IB_SMI_DISCARD;
-        } else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
+        } else if (rdma_cap_ib_switch(port_priv->device)) {
                /* forward case for switches */
                memcpy(response, recv, mad_priv_size(response));
                response->header.recv_wc.wc = &response->header.wc;
@@ -2115,7 +2116,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
        struct opa_smp *smp = (struct opa_smp *)recv->mad;
        if (opa_smi_handle_dr_smp_recv(smp,
-                                   port_priv->device->node_type,
+                                   rdma_cap_ib_switch(port_priv->device),
                                   port_num,
                                   port_priv->device->phys_port_cnt) ==
                                   IB_SMI_DISCARD)
@@ -2127,7 +2128,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
        if (retsmi == IB_SMI_SEND) { /* don't forward */
                if (opa_smi_handle_dr_smp_send(smp,
-                                           port_priv->device->node_type,
+                                           rdma_cap_ib_switch(port_priv->device),
                                           port_num) == IB_SMI_DISCARD)
                        return IB_SMI_DISCARD;
@@ -2135,7 +2136,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
                    IB_SMI_DISCARD)
                        return IB_SMI_DISCARD;
-        } else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
+        } else if (rdma_cap_ib_switch(port_priv->device)) {
                /* forward case for switches */
                memcpy(response, recv, mad_priv_size(response));
                response->header.recv_wc.wc = &response->header.wc;
@@ -2235,7 +2236,7 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
                goto out;
        }
-        if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
+        if (rdma_cap_ib_switch(port_priv->device))
                port_num = wc->port_num;
        else
                port_num = port_priv->port_num;
@@ -3297,17 +3298,11 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
 static void ib_mad_init_device(struct ib_device *device)
 {
-        int start, end, i;
+        int start, i;
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        start = rdma_start_port(device);
-                start = 0;
-                end   = 0;
-        } else {
-                start = 1;
-                end   = device->phys_port_cnt;
-        }
-        for (i = start; i <= end; i++) {
+        for (i = start; i <= rdma_end_port(device); i++) {
                if (!rdma_cap_ib_mad(device, i))
                        continue;
@@ -3342,17 +3337,9 @@ error:
 static void ib_mad_remove_device(struct ib_device *device)
 {
-        int start, end, i;
+        int i;
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
-                start = 0;
-                end   = 0;
-        } else {
-                start = 1;
-                end   = device->phys_port_cnt;
-        }
-        for (i = start; i <= end; i++) {
+        for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
                if (!rdma_cap_ib_mad(device, i))
                        continue;
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 1244f02a5c6d..2cb865c7ce7a 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -812,12 +812,8 @@ static void mcast_add_one(struct ib_device *device)
        if (!dev)
                return;
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
+        dev->start_port = rdma_start_port(device);
-                dev->start_port = dev->end_port = 0;
+        dev->end_port = rdma_end_port(device);
-        else {
-                dev->start_port = 1;
-                dev->end_port = device->phys_port_cnt;
-        }
        for (i = 0; i <= dev->end_port - dev->start_port; i++) {
                if (!rdma_cap_ib_mcast(device, dev->start_port + i))
diff --git a/drivers/infiniband/core/opa_smi.h b/drivers/infiniband/core/opa_smi.h
index 62d91bfa4cb7..3bfab3505a29 100644
--- a/drivers/infiniband/core/opa_smi.h
+++ b/drivers/infiniband/core/opa_smi.h
@@ -39,12 +39,12 @@
 #include "smi.h"
-enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, u8 node_type,
+enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, bool is_switch,
                                       int port_num, int phys_port_cnt);
 int opa_smi_get_fwd_port(struct opa_smp *smp);
 extern enum smi_forward_action opa_smi_check_forward_dr_smp(struct opa_smp *smp);
 extern enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
-                                              u8 node_type, int port_num);
+                                              bool is_switch, int port_num);
 /*
 * Return IB_SMI_HANDLE if the SMP should be handled by the local SMA/SM
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 0fae85062a65..ca919f429666 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1156,12 +1156,8 @@ static void ib_sa_add_one(struct ib_device *device)
        int s, e, i;
        int count = 0;
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
+        s = rdma_start_port(device);
-                s = e = 0;
+        e = rdma_end_port(device);
-        else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
        sa_dev = kzalloc(sizeof *sa_dev +
                         (e - s + 1) * sizeof (struct ib_sa_port),
diff --git a/drivers/infiniband/core/smi.c b/drivers/infiniband/core/smi.c
index 368a561d1a5d..f19b23817c2b 100644
--- a/drivers/infiniband/core/smi.c
+++ b/drivers/infiniband/core/smi.c
@@ -41,7 +41,7 @@
 #include "smi.h"
 #include "opa_smi.h"
-static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
+static enum smi_action __smi_handle_dr_smp_send(bool is_switch, int port_num,
                                                u8 *hop_ptr, u8 hop_cnt,
                                                const u8 *initial_path,
                                                const u8 *return_path,
@@ -64,7 +64,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                /* C14-9:2 */
                if (*hop_ptr && *hop_ptr < hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                return IB_SMI_DISCARD;
                        /* return_path set when received */
@@ -77,7 +77,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                if (*hop_ptr == hop_cnt) {
                        /* return_path set when received */
                        (*hop_ptr)++;
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                dr_dlid_is_permissive ?
                                IB_SMI_HANDLE : IB_SMI_DISCARD);
                }
@@ -96,7 +96,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                /* C14-13:2 */
                if (2 <= *hop_ptr && *hop_ptr <= hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                return IB_SMI_DISCARD;
                        (*hop_ptr)--;
@@ -108,7 +108,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                if (*hop_ptr == 1) {
                        (*hop_ptr)--;
                        /* C14-13:3 -- SMPs destined for SM shouldn't be here */
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                dr_slid_is_permissive ?
                                IB_SMI_HANDLE : IB_SMI_DISCARD);
                }
@@ -127,9 +127,9 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
 * Return IB_SMI_DISCARD if the SMP should be discarded
 */
 enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
-                                       u8 node_type, int port_num)
+                                       bool is_switch, int port_num)
 {
-        return __smi_handle_dr_smp_send(node_type, port_num,
+        return __smi_handle_dr_smp_send(is_switch, port_num,
                                        &smp->hop_ptr, smp->hop_cnt,
                                        smp->initial_path,
                                        smp->return_path,
@@ -139,9 +139,9 @@ enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
 }
 enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
-                                       u8 node_type, int port_num)
+                                       bool is_switch, int port_num)
 {
-        return __smi_handle_dr_smp_send(node_type, port_num,
+        return __smi_handle_dr_smp_send(is_switch, port_num,
                                        &smp->hop_ptr, smp->hop_cnt,
                                        smp->route.dr.initial_path,
                                        smp->route.dr.return_path,
@@ -152,7 +152,7 @@ enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
                                        OPA_LID_PERMISSIVE);
 }
-static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
+static enum smi_action __smi_handle_dr_smp_recv(bool is_switch, int port_num,
                                                int phys_port_cnt,
                                                u8 *hop_ptr, u8 hop_cnt,
                                                const u8 *initial_path,
@@ -173,7 +173,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                /* C14-9:2 -- intermediate hop */
                if (*hop_ptr && *hop_ptr < hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                return IB_SMI_DISCARD;
                        return_path[*hop_ptr] = port_num;
@@ -188,7 +188,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                                return_path[*hop_ptr] = port_num;
                        /* hop_ptr updated when sending */
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                dr_dlid_is_permissive ?
                                IB_SMI_HANDLE : IB_SMI_DISCARD);
                }
@@ -208,7 +208,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                /* C14-13:2 */
                if (2 <= *hop_ptr && *hop_ptr <= hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                return IB_SMI_DISCARD;
                        /* hop_ptr updated when sending */
@@ -224,8 +224,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                                return IB_SMI_HANDLE;
                        }
                        /* hop_ptr updated when sending */
-                        return (node_type == RDMA_NODE_IB_SWITCH ?
+                        return (is_switch ? IB_SMI_HANDLE : IB_SMI_DISCARD);
-                                IB_SMI_HANDLE : IB_SMI_DISCARD);
                }
                /* C14-13:4 -- hop_ptr = 0 -> give to SM */
@@ -238,10 +237,10 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
 * Adjust information for a received SMP
 * Return IB_SMI_DISCARD if the SMP should be dropped
 */
-enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
+enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, bool is_switch,
                                       int port_num, int phys_port_cnt)
 {
-        return __smi_handle_dr_smp_recv(node_type, port_num, phys_port_cnt,
+        return __smi_handle_dr_smp_recv(is_switch, port_num, phys_port_cnt,
                                        &smp->hop_ptr, smp->hop_cnt,
                                        smp->initial_path,
                                        smp->return_path,
@@ -254,10 +253,10 @@ enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
 * Adjust information for a received SMP
 * Return IB_SMI_DISCARD if the SMP should be dropped
 */
-enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, u8 node_type,
+enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, bool is_switch,
                                           int port_num, int phys_port_cnt)
 {
-        return __smi_handle_dr_smp_recv(node_type, port_num, phys_port_cnt,
+        return __smi_handle_dr_smp_recv(is_switch, port_num, phys_port_cnt,
                                        &smp->hop_ptr, smp->hop_cnt,
                                        smp->route.dr.initial_path,
                                        smp->route.dr.return_path,
diff --git a/drivers/infiniband/core/smi.h b/drivers/infiniband/core/smi.h
index aff96bac49b4..33c91c8a16e9 100644
--- a/drivers/infiniband/core/smi.h
+++ b/drivers/infiniband/core/smi.h
@@ -51,12 +51,12 @@ enum smi_forward_action {
        IB_SMI_FORWARD  /* SMP should be forwarded (for switches only) */
 };
-enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
+enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, bool is_switch,
                                       int port_num, int phys_port_cnt);
 int smi_get_fwd_port(struct ib_smp *smp);
 extern enum smi_forward_action smi_check_forward_dr_smp(struct ib_smp *smp);
 extern enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
-                                              u8 node_type, int port_num);
+                                              bool is_switch, int port_num);
 /*
 * Return IB_SMI_HANDLE if the SMP should be handled by the local SMA/SM
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index ed6b6c85c334..0b84a9cdfe5b 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -870,7 +870,7 @@ int ib_device_register_sysfs(struct ib_device *device,
                goto err_put;
        }
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (rdma_cap_ib_switch(device)) {
                ret = add_port(device, 0, port_callback);
                if (ret)
                        goto err_put;
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 62c24b1452b8..009481073644 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1193,6 +1193,7 @@ static int ib_ucm_close(struct inode *inode, struct file *filp)
        return 0;
 }
+static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
 static void ib_ucm_release_dev(struct device *dev)
 {
        struct ib_ucm_device *ucm_dev;
@@ -1202,7 +1203,7 @@ static void ib_ucm_release_dev(struct device *dev)
        if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
                clear_bit(ucm_dev->devnum, dev_map);
        else
-                clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, dev_map);
+                clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, overflow_map);
        kfree(ucm_dev);
 }
@@ -1226,7 +1227,6 @@ static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
 static dev_t overflow_maj;
-static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
 static int find_overflow_devnum(void)
 {
        int ret;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ad45469f7582..29b21213ea75 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1354,10 +1354,10 @@ static void ucma_lock_files(struct ucma_file *file1, struct ucma_file *file2)
        /* Acquire mutex's based on pointer comparison to prevent deadlock. */
        if (file1 < file2) {
                mutex_lock(&file1->mut);
-                mutex_lock(&file2->mut);
+                mutex_lock_nested(&file2->mut, SINGLE_DEPTH_NESTING);
        } else {
                mutex_lock(&file2->mut);
-                mutex_lock(&file1->mut);
+                mutex_lock_nested(&file1->mut, SINGLE_DEPTH_NESTING);
        }
 }
@@ -1616,6 +1616,7 @@ static void __exit ucma_cleanup(void)
        device_remove_file(ucma_misc.this_device, &dev_attr_abi_version);
        misc_deregister(&ucma_misc);
        idr_destroy(&ctx_idr);
+        idr_destroy(&multicast_idr);
 }
 module_init(ucma_init);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index b1b73232f217..bbbe0184e592 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -736,6 +736,10 @@ static struct ib_mr *iwch_get_dma_mr(struct ib_pd *pd, int acc)
        /*
         * T3 only supports 32 bits of size.
         */
+        if (sizeof(phys_addr_t) > 4) {
+                pr_warn_once(MOD "Cannot support dma_mrs on this platform.\n");
+                return ERR_PTR(-ENOTSUPP);
+        }
        bl.size = 0xffffffff;
        bl.addr = 0;
        kva = 0;
diff --git a/drivers/infiniband/hw/ehca/ehca_sqp.c b/drivers/infiniband/hw/ehca/ehca_sqp.c
index 12b5bc23832b..376b031c2c7f 100644
--- a/drivers/infiniband/hw/ehca/ehca_sqp.c
+++ b/drivers/infiniband/hw/ehca/ehca_sqp.c
@@ -226,8 +226,9 @@ int ehca_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        if (!port_num || port_num > ibdev->phys_port_cnt || !in_wc)
                return IB_MAD_RESULT_FAILURE;
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 2d7e503d13cb..871dbe56216a 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -31,6 +31,8 @@
 * SOFTWARE.
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
@@ -399,8 +401,8 @@ static int ipath_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        u32 bar0 = 0, bar1 = 0;
 #ifdef CONFIG_X86_64
-        if (WARN(pat_enabled(),
+        if (pat_enabled()) {
-                 "ipath needs PAT disabled, boot with nopat kernel parameter\n")) {
+                pr_warn("ipath needs PAT disabled, boot with nopat kernel parameter\n");
                ret = -ENODEV;
                goto bail;
        }
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 948188e37f95..ad3a926ab3c5 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -1499,8 +1499,9 @@ int ipath_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        switch (in_mad->mad_hdr.mgmt_class) {
        case IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE:
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 48253b839a6f..30ba49c4a98c 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -2044,9 +2044,9 @@ int ipath_register_ib_device(struct ipath_devdata *dd)
        spin_lock_init(&idev->qp_table.lock);
        spin_lock_init(&idev->lk_table.lock);
-        idev->sm_lid = __constant_be16_to_cpu(IB_LID_PERMISSIVE);
+        idev->sm_lid = be16_to_cpu(IB_LID_PERMISSIVE);
        /* Set the prefix to the default value (see ch. 4.1.1) */
-        idev->gid_prefix = __constant_cpu_to_be64(0xfe80000000000000ULL);
+        idev->gid_prefix = cpu_to_be64(0xfe80000000000000ULL);
        ret = ipath_init_qp_table(idev, ib_ipath_qp_table_size);
        if (ret)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 85a50df2f203..68b3dfa922bf 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -860,21 +860,31 @@ int mlx4_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
        struct mlx4_ib_dev *dev = to_mdev(ibdev);
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
+        enum rdma_link_layer link = rdma_port_get_link_layer(ibdev, port_num);
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
-        switch (rdma_port_get_link_layer(ibdev, port_num)) {
+        /* iboe_process_mad() which uses the HCA flow-counters to implement IB PMA
-        case IB_LINK_LAYER_INFINIBAND:
+         * queries, should be called only by VFs and for that specific purpose
-                if (!mlx4_is_slave(dev->dev))
+         */
-                        return ib_process_mad(ibdev, mad_flags, port_num, in_wc,
+        if (link == IB_LINK_LAYER_INFINIBAND) {
-                                              in_grh, in_mad, out_mad);
+                if (mlx4_is_slave(dev->dev) &&
-        case IB_LINK_LAYER_ETHERNET:
+                    in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
-                return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
+                    in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS)
-                                          in_grh, in_mad, out_mad);
+                        return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
-        default:
+                                                in_grh, in_mad, out_mad);
-                return -EINVAL;
+                return ib_process_mad(ibdev, mad_flags, port_num, in_wc,
+                                      in_grh, in_mad, out_mad);
        }
+        if (link == IB_LINK_LAYER_ETHERNET)
+                return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
+                                        in_grh, in_mad, out_mad);
+        return -EINVAL;
 }
 static void send_handler(struct ib_mad_agent *agent,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 067a691ecbed..8be6db816460 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -253,14 +253,15 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
        props->hca_core_clock = dev->dev->caps.hca_core_clock * 1000UL;
        props->timestamp_mask = 0xFFFFFFFFFFFFULL;
-        err = mlx4_get_internal_clock_params(dev->dev, &clock_params);
+        if (!mlx4_is_slave(dev->dev))
-        if (err)
+                err = mlx4_get_internal_clock_params(dev->dev, &clock_params);
-                goto out;
        if (uhw->outlen >= resp.response_length + sizeof(resp.hca_core_clock_offset)) {
-                resp.hca_core_clock_offset = clock_params.offset % PAGE_SIZE;
                resp.response_length += sizeof(resp.hca_core_clock_offset);
-                resp.comp_mask |= QUERY_DEVICE_RESP_MASK_TIMESTAMP;
+                if (!err && !mlx4_is_slave(dev->dev)) {
+                        resp.comp_mask |= QUERY_DEVICE_RESP_MASK_TIMESTAMP;
+                        resp.hca_core_clock_offset = clock_params.offset % PAGE_SIZE;
+                }
        }
        if (uhw->outlen) {
@@ -2669,31 +2670,33 @@ static void do_slave_init(struct mlx4_ib_dev *ibdev, int slave, int do_init)
        dm = kcalloc(ports, sizeof(*dm), GFP_ATOMIC);
        if (!dm) {
                pr_err("failed to allocate memory for tunneling qp update\n");
-                goto out;
+                return;
        }
        for (i = 0; i < ports; i++) {
                dm[i] = kmalloc(sizeof (struct mlx4_ib_demux_work), GFP_ATOMIC);
                if (!dm[i]) {
                        pr_err("failed to allocate memory for tunneling qp update work struct\n");
-                        for (i = 0; i < dev->caps.num_ports; i++) {
+                        while (--i >= 0)
-                                if (dm[i])
+                                kfree(dm[i]);
-                                        kfree(dm[i]);
-                        }
                        goto out;
                }
-        }
-        /* initialize or tear down tunnel QPs for the slave */
-        for (i = 0; i < ports; i++) {
                INIT_WORK(&dm[i]->work, mlx4_ib_tunnels_update_work);
                dm[i]->port = first_port + i + 1;
                dm[i]->slave = slave;
                dm[i]->do_init = do_init;
                dm[i]->dev = ibdev;
-                spin_lock_irqsave(&ibdev->sriov.going_down_lock, flags);
+        }
-                if (!ibdev->sriov.is_going_down)
+        /* initialize or tear down tunnel QPs for the slave */
+        spin_lock_irqsave(&ibdev->sriov.going_down_lock, flags);
+        if (!ibdev->sriov.is_going_down) {
+                for (i = 0; i < ports; i++)
                        queue_work(ibdev->sriov.demux[i].ud_wq, &dm[i]->work);
                spin_unlock_irqrestore(&ibdev->sriov.going_down_lock, flags);
+        } else {
+                spin_unlock_irqrestore(&ibdev->sriov.going_down_lock, flags);
+                for (i = 0; i < ports; i++)
+                        kfree(dm[i]);
        }
 out:
        kfree(dm);
diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
index 01fc97db45d6..b84d13a487cc 100644
--- a/drivers/infiniband/hw/mlx5/mad.c
+++ b/drivers/infiniband/hw/mlx5/mad.c
@@ -68,8 +68,9 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        slid = in_wc ? in_wc->slid : be16_to_cpu(IB_LID_PERMISSIVE);
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 6b2418b74c99..7c3f2fb44ba5 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -209,8 +209,9 @@ int mthca_process_mad(struct ib_device *ibdev,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        /* Forward locally generated traps to the SM */
        if (in_mad->mad_hdr.method == IB_MGMT_METHOD_TRAP &&
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 9047af429906..8a3ad170d790 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1520,8 +1520,9 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpi
        int rc = arpindex;
        struct net_device *netdev;
        struct nes_adapter *nesadapter = nesvnic->nesdev->nesadapter;
+        __be32 dst_ipaddr = htonl(dst_ip);
-        rt = ip_route_output(&init_net, htonl(dst_ip), 0, 0, 0);
+        rt = ip_route_output(&init_net, dst_ipaddr, nesvnic->local_ipaddr, 0, 0);
        if (IS_ERR(rt)) {
                printk(KERN_ERR "%s: ip_route_output_key failed for 0x%08X\n",
                       __func__, dst_ip);
@@ -1533,7 +1534,7 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpi
        else
                netdev = nesvnic->netdev;
-        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, netdev);
+        neigh = dst_neigh_lookup(&rt->dst, &dst_ipaddr);
        rcu_read_lock();
        if (neigh) {
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 02120d340d50..4713dd7ed764 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -3861,7 +3861,7 @@ void nes_manage_arp_cache(struct net_device *netdev, unsigned char *mac_addr,
                                (((u32)mac_addr[2]) << 24) | (((u32)mac_addr[3]) << 16) |
                                (((u32)mac_addr[4]) << 8)  | (u32)mac_addr[5]);
                cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_HIGH_IDX] = cpu_to_le32(
-                                (((u32)mac_addr[0]) << 16) | (u32)mac_addr[1]);
+                                (((u32)mac_addr[0]) << 8) | (u32)mac_addr[1]);
        } else {
                cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_ADDR_LOW_IDX] = 0;
                cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_HIGH_IDX] = 0;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index b396344fae16..6a36338593cd 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_H__
 #define __OCRDMA_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
index 1554cca5712a..430b1350fe96 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_ABI_H__
 #define __OCRDMA_ABI_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index 4bafa15708d0..44766fee1f4e 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #include <net/neighbour.h>
 #include <net/netevent.h>
@@ -215,8 +230,9 @@ int ocrdma_process_mad(struct ib_device *ibdev,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        switch (in_mad->mad_hdr.mgmt_class) {
        case IB_MGMT_CLASS_PERF_MGMT:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.h b/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
index cf366fe03cb8..04a30ae67473 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_AH_H__
 #define __OCRDMA_AH_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 47615ff33bc6..aab391a15db4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) CNA Adapters.              *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #include <linux/sched.h>
 #include <linux/interrupt.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
index e905972fceb7..7ed885c1851e 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) CNA Adapters.              *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_HW_H__
 #define __OCRDMA_HW_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 8a1398b253a2..b119a3413a15 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #include <linux/module.h>
 #include <linux/idr.h>
@@ -46,7 +61,7 @@
 MODULE_VERSION(OCRDMA_ROCE_DRV_VERSION);
 MODULE_DESCRIPTION(OCRDMA_ROCE_DRV_DESC " " OCRDMA_ROCE_DRV_VERSION);
 MODULE_AUTHOR("Emulex Corporation");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 static LIST_HEAD(ocrdma_dev_list);
 static DEFINE_SPINLOCK(ocrdma_devlist_lock);
@@ -696,6 +711,7 @@ static void __exit ocrdma_exit_module(void)
        ocrdma_unregister_inet6addr_notifier();
        ocrdma_unregister_inetaddr_notifier();
        ocrdma_rem_debugfs();
+        idr_destroy(&ocrdma_dev_id);
 }
 module_init(ocrdma_init_module);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 02ad0aee99af..80006b24aa11 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_SLI_H__
 #define __OCRDMA_SLI_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index 48d7ef51aa0c..69334e214571 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2014 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #include <rdma/ib_addr.h>
 #include <rdma/ib_pma.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
index 091edd68a8a3..c9e58d04c7b8 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2014 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_STATS_H__
 #define __OCRDMA_STATS_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 5bb61eb58f2c..bc84cd462ecf 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #include <linux/dma-mapping.h>
 #include <rdma/ib_verbs.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
index b15c608efa7b..eaccb2d3cb9f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
@@ -1,21 +1,36 @@
-/*******************************************************************
+/* This file is part of the Emulex RoCE Device Driver for
- * This file is part of the Emulex RoCE Device Driver for          *
+ * RoCE (RDMA over Converged Ethernet) adapters.
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
+ * EMULEX and SLI are trademarks of Emulex.
- * EMULEX and SLI are trademarks of Emulex.                        *
+ * www.emulex.com
- * www.emulex.com                                                  *
+ *
- *                                                                 *
+ * This software is available to you under a choice of one of two licenses.
- * This program is free software; you can redistribute it and/or   *
+ * You may choose to be licensed under the terms of the GNU General Public
- * modify it under the terms of version 2 of the GNU General       *
+ * License (GPL) Version 2, available from the file COPYING in the main
- * Public License as published by the Free Software Foundation.    *
+ * directory of this source tree, or the BSD license below:
- * This program is distributed in the hope that it will be useful. *
+ *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
+ * Redistribution and use in source and binary forms, with or without
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
+ * modification, are permitted provided that the following conditions
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
+ * are met:
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
+ *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
+ * - Redistributions of source code must retain the above copyright notice,
- * more details, a copy of which can be found in the file COPYING  *
+ *   this list of conditions and the following disclaimer.
- * included with this package.                                     *
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Contact Information:
 * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
 * Emulex
 * 3333 Susan Street
 * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 #ifndef __OCRDMA_VERBS_H__
 #define __OCRDMA_VERBS_H__
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 05e3242d8442..9625e7c438e5 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -2412,8 +2412,9 @@ int qib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port,
        const struct ib_mad *in_mad = (const struct ib_mad *)in;
        struct ib_mad *out_mad = (struct ib_mad *)out;
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
        switch (in_mad->mad_hdr.mgmt_class) {
        case IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bd94b0a6e9e5..79859c4d43c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -239,7 +239,7 @@ struct ipoib_cm_tx {
        struct net_device   *dev;
        struct ipoib_neigh  *neigh;
        struct ipoib_path   *path;
-        struct ipoib_cm_tx_buf *tx_ring;
+        struct ipoib_tx_buf *tx_ring;
        unsigned             tx_head;
        unsigned             tx_tail;
        unsigned long        flags;
@@ -504,6 +504,33 @@ int ipoib_mcast_stop_thread(struct net_device *dev);
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
+int ipoib_dma_map_tx(struct ib_device *ca, struct ipoib_tx_buf *tx_req);
+void ipoib_dma_unmap_tx(struct ipoib_dev_priv *priv,
+                        struct ipoib_tx_buf *tx_req);
+static inline void ipoib_build_sge(struct ipoib_dev_priv *priv,
+                                   struct ipoib_tx_buf *tx_req)
+{
+        int i, off;
+        struct sk_buff *skb = tx_req->skb;
+        skb_frag_t *frags = skb_shinfo(skb)->frags;
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+        u64 *mapping = tx_req->mapping;
+        if (skb_headlen(skb)) {
+                priv->tx_sge[0].addr         = mapping[0];
+                priv->tx_sge[0].length       = skb_headlen(skb);
+                off = 1;
+        } else
+                off = 0;
+        for (i = 0; i < nr_frags; ++i) {
+                priv->tx_sge[i + off].addr = mapping[i + off];
+                priv->tx_sge[i + off].length = skb_frag_size(&frags[i]);
+        }
+        priv->tx_wr.num_sge          = nr_frags + off;
+}
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
 struct ipoib_mcast_iter *ipoib_mcast_iter_init(struct net_device *dev);
 int ipoib_mcast_iter_next(struct ipoib_mcast_iter *iter);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index cf32a778e7d0..ee39be6ccfb0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -694,14 +694,12 @@ repost:
 static inline int post_send(struct ipoib_dev_priv *priv,
                            struct ipoib_cm_tx *tx,
                            unsigned int wr_id,
-                            u64 addr, int len)
+                            struct ipoib_tx_buf *tx_req)
 {
        struct ib_send_wr *bad_wr;
-        priv->tx_sge[0].addr          = addr;
+        ipoib_build_sge(priv, tx_req);
-        priv->tx_sge[0].length        = len;
-        priv->tx_wr.num_sge     = 1;
        priv->tx_wr.wr_id       = wr_id | IPOIB_OP_CM;
        return ib_post_send(tx->qp, &priv->tx_wr, &bad_wr);
@@ -710,8 +708,7 @@ static inline int post_send(struct ipoib_dev_priv *priv,
 void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_tx *tx)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
-        struct ipoib_cm_tx_buf *tx_req;
+        struct ipoib_tx_buf *tx_req;
-        u64 addr;
        int rc;
        if (unlikely(skb->len > tx->mtu)) {
@@ -735,24 +732,21 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
         */
        tx_req = &tx->tx_ring[tx->tx_head & (ipoib_sendq_size - 1)];
        tx_req->skb = skb;
-        addr = ib_dma_map_single(priv->ca, skb->data, skb->len, DMA_TO_DEVICE);
-        if (unlikely(ib_dma_mapping_error(priv->ca, addr))) {
+        if (unlikely(ipoib_dma_map_tx(priv->ca, tx_req))) {
                ++dev->stats.tx_errors;
                dev_kfree_skb_any(skb);
                return;
        }
-        tx_req->mapping = addr;
        skb_orphan(skb);
        skb_dst_drop(skb);
-        rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
+        rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1), tx_req);
-                       addr, skb->len);
        if (unlikely(rc)) {
                ipoib_warn(priv, "post_send failed, error %d\n", rc);
                ++dev->stats.tx_errors;
-                ib_dma_unmap_single(priv->ca, addr, skb->len, DMA_TO_DEVICE);
+                ipoib_dma_unmap_tx(priv, tx_req);
                dev_kfree_skb_any(skb);
        } else {
                dev->trans_start = jiffies;
@@ -777,7 +771,7 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_cm_tx *tx = wc->qp->qp_context;
        unsigned int wr_id = wc->wr_id & ~IPOIB_OP_CM;
-        struct ipoib_cm_tx_buf *tx_req;
+        struct ipoib_tx_buf *tx_req;
        unsigned long flags;
        ipoib_dbg_data(priv, "cm send completion: id %d, status: %d\n",
@@ -791,7 +785,7 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
        tx_req = &tx->tx_ring[wr_id];
-        ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len, DMA_TO_DEVICE);
+        ipoib_dma_unmap_tx(priv, tx_req);
        /* FIXME: is this right? Shouldn't we only increment on success? */
        ++dev->stats.tx_packets;
@@ -1036,6 +1030,9 @@ static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ipoib_
        struct ib_qp *tx_qp;
+        if (dev->features & NETIF_F_SG)
+                attr.cap.max_send_sge = MAX_SKB_FRAGS + 1;
        tx_qp = ib_create_qp(priv->pd, &attr);
        if (PTR_ERR(tx_qp) == -EINVAL) {
                ipoib_warn(priv, "can't use GFP_NOIO for QPs on device %s, using GFP_KERNEL\n",
@@ -1170,7 +1167,7 @@ err_tx:
 static void ipoib_cm_tx_destroy(struct ipoib_cm_tx *p)
 {
        struct ipoib_dev_priv *priv = netdev_priv(p->dev);
-        struct ipoib_cm_tx_buf *tx_req;
+        struct ipoib_tx_buf *tx_req;
        unsigned long begin;
        ipoib_dbg(priv, "Destroy active connection 0x%x head 0x%x tail 0x%x\n",
@@ -1197,8 +1194,7 @@ timeout:
        while ((int) p->tx_tail - (int) p->tx_head < 0) {
                tx_req = &p->tx_ring[p->tx_tail & (ipoib_sendq_size - 1)];
-                ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len,
+                ipoib_dma_unmap_tx(priv, tx_req);
-                                    DMA_TO_DEVICE);
                dev_kfree_skb_any(tx_req->skb);
                ++p->tx_tail;
                netif_tx_lock_bh(p->dev);
@@ -1455,7 +1451,6 @@ static void ipoib_cm_stale_task(struct work_struct *work)
        spin_unlock_irq(&priv->lock);
 }
 static ssize_t show_mode(struct device *d, struct device_attribute *attr,
                         char *buf)
 {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 63b92cbb29ad..d266667ca9b8 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -263,8 +263,7 @@ repost:
                           "for buf %d\n", wr_id);
 }
-static int ipoib_dma_map_tx(struct ib_device *ca,
+int ipoib_dma_map_tx(struct ib_device *ca, struct ipoib_tx_buf *tx_req)
-                            struct ipoib_tx_buf *tx_req)
 {
        struct sk_buff *skb = tx_req->skb;
        u64 *mapping = tx_req->mapping;
@@ -305,8 +304,8 @@ partial_error:
        return -EIO;
 }
-static void ipoib_dma_unmap_tx(struct ib_device *ca,
+void ipoib_dma_unmap_tx(struct ipoib_dev_priv *priv,
-                               struct ipoib_tx_buf *tx_req)
+                        struct ipoib_tx_buf *tx_req)
 {
        struct sk_buff *skb = tx_req->skb;
        u64 *mapping = tx_req->mapping;
@@ -314,7 +313,8 @@ static void ipoib_dma_unmap_tx(struct ib_device *ca,
        int off;
        if (skb_headlen(skb)) {
-                ib_dma_unmap_single(ca, mapping[0], skb_headlen(skb), DMA_TO_DEVICE);
+                ib_dma_unmap_single(priv->ca, mapping[0], skb_headlen(skb),
+                                    DMA_TO_DEVICE);
                off = 1;
        } else
                off = 0;
@@ -322,8 +322,8 @@ static void ipoib_dma_unmap_tx(struct ib_device *ca,
        for (i = 0; i < skb_shinfo(skb)->nr_frags; ++i) {
                const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                ib_dma_unmap_page(ca, mapping[i + off], skb_frag_size(frag),
+                ib_dma_unmap_page(priv->ca, mapping[i + off],
-                                  DMA_TO_DEVICE);
+                                  skb_frag_size(frag), DMA_TO_DEVICE);
        }
 }
@@ -389,7 +389,7 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
        tx_req = &priv->tx_ring[wr_id];
-        ipoib_dma_unmap_tx(priv->ca, tx_req);
+        ipoib_dma_unmap_tx(priv, tx_req);
        ++dev->stats.tx_packets;
        dev->stats.tx_bytes += tx_req->skb->len;
@@ -514,24 +514,10 @@ static inline int post_send(struct ipoib_dev_priv *priv,
                            void *head, int hlen)
 {
        struct ib_send_wr *bad_wr;
-        int i, off;
        struct sk_buff *skb = tx_req->skb;
-        skb_frag_t *frags = skb_shinfo(skb)->frags;
-        int nr_frags = skb_shinfo(skb)->nr_frags;
-        u64 *mapping = tx_req->mapping;
-        if (skb_headlen(skb)) {
+        ipoib_build_sge(priv, tx_req);
-                priv->tx_sge[0].addr         = mapping[0];
-                priv->tx_sge[0].length       = skb_headlen(skb);
-                off = 1;
-        } else
-                off = 0;
-        for (i = 0; i < nr_frags; ++i) {
-                priv->tx_sge[i + off].addr = mapping[i + off];
-                priv->tx_sge[i + off].length = skb_frag_size(&frags[i]);
-        }
-        priv->tx_wr.num_sge          = nr_frags + off;
        priv->tx_wr.wr_id            = wr_id;
        priv->tx_wr.wr.ud.remote_qpn = qpn;
        priv->tx_wr.wr.ud.ah         = address;
@@ -617,7 +603,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                ipoib_warn(priv, "post_send failed, error %d\n", rc);
                ++dev->stats.tx_errors;
                --priv->tx_outstanding;
-                ipoib_dma_unmap_tx(priv->ca, tx_req);
+                ipoib_dma_unmap_tx(priv, tx_req);
                dev_kfree_skb_any(skb);
                if (netif_queue_stopped(dev))
                        netif_wake_queue(dev);
@@ -868,7 +854,7 @@ int ipoib_ib_dev_stop(struct net_device *dev)
                        while ((int) priv->tx_tail - (int) priv->tx_head < 0) {
                                tx_req = &priv->tx_ring[priv->tx_tail &
                                                        (ipoib_sendq_size - 1)];
-                                ipoib_dma_unmap_tx(priv->ca, tx_req);
+                                ipoib_dma_unmap_tx(priv, tx_req);
                                dev_kfree_skb_any(tx_req->skb);
                                ++priv->tx_tail;
                                --priv->tx_outstanding;
@@ -985,20 +971,21 @@ static inline int update_child_pkey(struct ipoib_dev_priv *priv)
 }
 static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
-                                enum ipoib_flush_level level)
+                                enum ipoib_flush_level level,
+                                int nesting)
 {
        struct ipoib_dev_priv *cpriv;
        struct net_device *dev = priv->dev;
        int result;
-        down_read(&priv->vlan_rwsem);
+        down_read_nested(&priv->vlan_rwsem, nesting);
        /*
         * Flush any child interfaces too -- they might be up even if
         * the parent is down.
         */
        list_for_each_entry(cpriv, &priv->child_intfs, list)
-                __ipoib_ib_dev_flush(cpriv, level);
+                __ipoib_ib_dev_flush(cpriv, level, nesting + 1);
        up_read(&priv->vlan_rwsem);
@@ -1076,7 +1063,7 @@ void ipoib_ib_dev_flush_light(struct work_struct *work)
        struct ipoib_dev_priv *priv =
                container_of(work, struct ipoib_dev_priv, flush_light);
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_LIGHT);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_LIGHT, 0);
 }
 void ipoib_ib_dev_flush_normal(struct work_struct *work)
@@ -1084,7 +1071,7 @@ void ipoib_ib_dev_flush_normal(struct work_struct *work)
        struct ipoib_dev_priv *priv =
                container_of(work, struct ipoib_dev_priv, flush_normal);
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_NORMAL);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_NORMAL, 0);
 }
 void ipoib_ib_dev_flush_heavy(struct work_struct *work)
@@ -1092,7 +1079,7 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work)
        struct ipoib_dev_priv *priv =
                container_of(work, struct ipoib_dev_priv, flush_heavy);
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY, 0);
 }
 void ipoib_ib_dev_cleanup(struct net_device *dev)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index da149c278cb8..b2943c84a5dd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -190,7 +190,7 @@ static netdev_features_t ipoib_fix_features(struct net_device *dev, netdev_featu
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        if (test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags))
-                features &= ~(NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
+                features &= ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
        return features;
 }
@@ -232,6 +232,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
                ipoib_warn(priv, "enabling connected mode "
                           "will cause multicast packet drops\n");
                netdev_update_features(dev);
+                dev_set_mtu(dev, ipoib_cm_max_mtu(dev));
                rtnl_unlock();
                priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM;
@@ -1577,7 +1578,8 @@ static struct net_device *ipoib_add_port(const char *format,
        SET_NETDEV_DEV(priv->dev, hca->dma_device);
        priv->dev->dev_id = port - 1;
-        if (!ib_query_port(hca, port, &attr))
+        result = ib_query_port(hca, port, &attr);
+        if (!result)
                priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
        else {
                printk(KERN_WARNING "%s: ib_query_port %d failed\n",
@@ -1598,7 +1600,8 @@ static struct net_device *ipoib_add_port(const char *format,
                goto device_init_failed;
        }
-        if (ipoib_set_dev_features(priv, hca))
+        result = ipoib_set_dev_features(priv, hca);
+        if (result)
                goto device_init_failed;
        /*
@@ -1684,7 +1687,7 @@ static void ipoib_add_one(struct ib_device *device)
        struct list_head *dev_list;
        struct net_device *dev;
        struct ipoib_dev_priv *priv;
-        int s, e, p;
+        int p;
        int count = 0;
        dev_list = kmalloc(sizeof *dev_list, GFP_KERNEL);
@@ -1693,15 +1696,7 @@ static void ipoib_add_one(struct ib_device *device)
        INIT_LIST_HEAD(dev_list);
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
-                s = 0;
-                e = 0;
-        } else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
-        for (p = s; p <= e; ++p) {
                if (!rdma_protocol_ib(device, p))
                        continue;
                dev = ipoib_add_port("ib%d", device, p);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 9e6ee82a8fd7..851c8219d501 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -177,7 +177,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
                else
                        size += ipoib_recvq_size * ipoib_max_conn_qp;
        } else
-                goto out_free_wq;
+                if (ret != -ENOSYS)
+                        goto out_free_wq;
        cq_attr.cqe = size;
        priv->recv_cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 771700963127..d851e1828d6f 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -775,6 +775,17 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
        ret = isert_rdma_post_recvl(isert_conn);
        if (ret)
                goto out_conn_dev;
+        /*
+         * Obtain the second reference now before isert_rdma_accept() to
+         * ensure that any initiator generated REJECT CM event that occurs
+         * asynchronously won't drop the last reference until the error path
+         * in iscsi_target_login_sess_out() does it's ->iscsit_free_conn() ->
+         * isert_free_conn() -> isert_put_conn() -> kref_put().
+         */
+        if (!kref_get_unless_zero(&isert_conn->kref)) {
+                isert_warn("conn %p connect_release is running\n", isert_conn);
+                goto out_conn_dev;
+        }
        ret = isert_rdma_accept(isert_conn);
        if (ret)
@@ -836,11 +847,6 @@ isert_connected_handler(struct rdma_cm_id *cma_id)
        isert_info("conn %p\n", isert_conn);
-        if (!kref_get_unless_zero(&isert_conn->kref)) {
-                isert_warn("conn %p connect_release is running\n", isert_conn);
-                return;
-        }
        mutex_lock(&isert_conn->mutex);
        if (isert_conn->state != ISER_CONN_FULL_FEATURE)
                isert_conn->state = ISER_CONN_UP;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 267dc4f75502..31a20b462266 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -161,13 +161,10 @@ static int srp_tmo_set(const char *val, const struct kernel_param *kp)
 {
        int tmo, res;
-        if (strncmp(val, "off", 3) != 0) {
+        res = srp_parse_tmo(&tmo, val);
-                res = kstrtoint(val, 0, &tmo);
+        if (res)
-                if (res)
+                goto out;
-                        goto out;
-        } else {
-                tmo = -1;
-        }
        if (kp->arg == &srp_reconnect_delay)
                res = srp_tmo_valid(tmo, srp_fast_io_fail_tmo,
                                    srp_dev_loss_tmo);
@@ -3379,7 +3376,7 @@ static void srp_add_one(struct ib_device *device)
        struct srp_device *srp_dev;
        struct ib_device_attr *dev_attr;
        struct srp_host *host;
-        int mr_page_shift, s, e, p;
+        int mr_page_shift, p;
        u64 max_pages_per_mr;
        dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
@@ -3443,15 +3440,7 @@ static void srp_add_one(struct ib_device *device)
        if (IS_ERR(srp_dev->mr))
                goto err_pd;
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
-                s = 0;
-                e = 0;
-        } else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
-        for (p = s; p <= e; ++p) {
                host = srp_add_port(srp_dev, p);
                if (host)
                        list_add_tail(&host->list, &srp_dev->dev_list);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 82897ca17f32..60ff0a2390e5 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -302,7 +302,7 @@ static void srpt_get_iou(struct ib_dm_mad *mad)
        int i;
        ioui = (struct ib_dm_iou_info *)mad->data;
-        ioui->change_id = __constant_cpu_to_be16(1);
+        ioui->change_id = cpu_to_be16(1);
        ioui->max_controllers = 16;
        /* set present for slot 1 and empty for the rest */
@@ -330,13 +330,13 @@ static void srpt_get_ioc(struct srpt_port *sport, u32 slot,
        if (!slot || slot > 16) {
                mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
+                        = cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
                return;
        }
        if (slot > 2) {
                mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_NO_IOC);
+                        = cpu_to_be16(DM_MAD_STATUS_NO_IOC);
                return;
        }
@@ -348,10 +348,10 @@ static void srpt_get_ioc(struct srpt_port *sport, u32 slot,
        iocp->device_version = cpu_to_be16(sdev->dev_attr.hw_ver);
        iocp->subsys_vendor_id = cpu_to_be32(sdev->dev_attr.vendor_id);
        iocp->subsys_device_id = 0x0;
-        iocp->io_class = __constant_cpu_to_be16(SRP_REV16A_IB_IO_CLASS);
+        iocp->io_class = cpu_to_be16(SRP_REV16A_IB_IO_CLASS);
-        iocp->io_subclass = __constant_cpu_to_be16(SRP_IO_SUBCLASS);
+        iocp->io_subclass = cpu_to_be16(SRP_IO_SUBCLASS);
-        iocp->protocol = __constant_cpu_to_be16(SRP_PROTOCOL);
+        iocp->protocol = cpu_to_be16(SRP_PROTOCOL);
-        iocp->protocol_version = __constant_cpu_to_be16(SRP_PROTOCOL_VERSION);
+        iocp->protocol_version = cpu_to_be16(SRP_PROTOCOL_VERSION);
        iocp->send_queue_depth = cpu_to_be16(sdev->srq_size);
        iocp->rdma_read_depth = 4;
        iocp->send_size = cpu_to_be32(srp_max_req_size);
@@ -379,13 +379,13 @@ static void srpt_get_svc_entries(u64 ioc_guid,
        if (!slot || slot > 16) {
                mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
+                        = cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
                return;
        }
        if (slot > 2 || lo > hi || hi > 1) {
                mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_NO_IOC);
+                        = cpu_to_be16(DM_MAD_STATUS_NO_IOC);
                return;
        }
@@ -436,7 +436,7 @@ static void srpt_mgmt_method_get(struct srpt_port *sp, struct ib_mad *rq_mad,
                break;
        default:
                rsp_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
                break;
        }
 }
@@ -493,11 +493,11 @@ static void srpt_mad_recv_handler(struct ib_mad_agent *mad_agent,
                break;
        case IB_MGMT_METHOD_SET:
                dm_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
                break;
        default:
                dm_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD);
                break;
        }
@@ -1535,7 +1535,7 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
        memset(srp_rsp, 0, sizeof *srp_rsp);
        srp_rsp->opcode = SRP_RSP;
        srp_rsp->req_lim_delta =
-                __constant_cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
+                cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
        srp_rsp->tag = tag;
        srp_rsp->status = status;
@@ -1585,8 +1585,8 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
        memset(srp_rsp, 0, sizeof *srp_rsp);
        srp_rsp->opcode = SRP_RSP;
-        srp_rsp->req_lim_delta = __constant_cpu_to_be32(1
+        srp_rsp->req_lim_delta =
-                                    + atomic_xchg(&ch->req_lim_delta, 0));
+                cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
        srp_rsp->tag = tag;
        srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
@@ -1630,7 +1630,7 @@ static uint64_t srpt_unpack_lun(const uint8_t *lun, int len)
        switch (len) {
        case 8:
                if ((*((__be64 *)lun) &
-                     __constant_cpu_to_be64(0x0000FFFFFFFFFFFFLL)) != 0)
+                     cpu_to_be64(0x0000FFFFFFFFFFFFLL)) != 0)
                        goto out_err;
                break;
        case 4:
@@ -2449,8 +2449,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        }
        if (it_iu_len > srp_max_req_size || it_iu_len < 64) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE);
+                              SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE);
                ret = -EINVAL;
                pr_err("rejected SRP_LOGIN_REQ because its"
                       " length (%d bytes) is out of range (%d .. %d)\n",
@@ -2459,8 +2459,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        }
        if (!sport->enabled) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                             SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                ret = -EINVAL;
                pr_err("rejected SRP_LOGIN_REQ because the target port"
                       " has not yet been enabled\n");
@@ -2505,8 +2505,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        if (*(__be64 *)req->target_port_id != cpu_to_be64(srpt_service_guid)
            || *(__be64 *)(req->target_port_id + 8) !=
               cpu_to_be64(srpt_service_guid)) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL);
+                              SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL);
                ret = -ENOMEM;
                pr_err("rejected SRP_LOGIN_REQ because it"
                       " has an invalid target port identifier.\n");
@@ -2515,8 +2515,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        ch = kzalloc(sizeof *ch, GFP_KERNEL);
        if (!ch) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                        SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                pr_err("rejected SRP_LOGIN_REQ because no memory.\n");
                ret = -ENOMEM;
                goto reject;
@@ -2552,8 +2552,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        ret = srpt_create_ch_ib(ch);
        if (ret) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                pr_err("rejected SRP_LOGIN_REQ because creating"
                       " a new RDMA channel failed.\n");
                goto free_ring;
@@ -2561,8 +2561,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        ret = srpt_ch_qp_rtr(ch, ch->qp);
        if (ret) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                pr_err("rejected SRP_LOGIN_REQ because enabling"
                       " RTR failed (error code = %d)\n", ret);
                goto destroy_ib;
@@ -2580,15 +2579,15 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        if (!nacl) {
                pr_info("Rejected login because no ACL has been"
                        " configured yet for initiator %s.\n", ch->sess_name);
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
+                              SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
                goto destroy_ib;
        }
        ch->sess = transport_init_session(TARGET_PROT_NORMAL);
        if (IS_ERR(ch->sess)) {
-                rej->reason = __constant_cpu_to_be32(
+                rej->reason = cpu_to_be32(
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                pr_debug("Failed to create session\n");
                goto deregister_session;
        }
@@ -2604,8 +2603,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
        rsp->max_it_iu_len = req->req_it_iu_len;
        rsp->max_ti_iu_len = req->req_it_iu_len;
        ch->max_ti_iu_len = it_iu_len;
-        rsp->buf_fmt = __constant_cpu_to_be16(SRP_BUF_FORMAT_DIRECT
+        rsp->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT
-                                              | SRP_BUF_FORMAT_INDIRECT);
+                                   | SRP_BUF_FORMAT_INDIRECT);
        rsp->req_lim_delta = cpu_to_be32(ch->rq_size);
        atomic_set(&ch->req_lim, ch->rq_size);
        atomic_set(&ch->req_lim_delta, 0);
@@ -2655,8 +2654,8 @@ free_ch:
 reject:
        rej->opcode = SRP_LOGIN_REJ;
        rej->tag = req->tag;
-        rej->buf_fmt = __constant_cpu_to_be16(SRP_BUF_FORMAT_DIRECT
+        rej->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT
-                                              | SRP_BUF_FORMAT_INDIRECT);
+                                   | SRP_BUF_FORMAT_INDIRECT);
        ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED, NULL, 0,
                             (void *)rej, sizeof *rej);
diff --git a/drivers/input/input-leds.c b/drivers/input/input-leds.c
index 074a65ed17bb..766bf2660116 100644
--- a/drivers/input/input-leds.c
+++ b/drivers/input/input-leds.c
@@ -71,6 +71,18 @@ static void input_leds_event(struct input_handle *handle, unsigned int type,
 {
 }
+static int input_leds_get_count(struct input_dev *dev)
+{
+        unsigned int led_code;
+        int count = 0;
+        for_each_set_bit(led_code, dev->ledbit, LED_CNT)
+                if (input_led_info[led_code].name)
+                        count++;
+        return count;
+}
 static int input_leds_connect(struct input_handler *handler,
                              struct input_dev *dev,
                              const struct input_device_id *id)
@@ -81,7 +93,7 @@ static int input_leds_connect(struct input_handler *handler,
        int led_no;
        int error;
-        num_leds = bitmap_weight(dev->ledbit, LED_CNT);
+        num_leds = input_leds_get_count(dev);
        if (!num_leds)
                return -ENXIO;
@@ -112,7 +124,7 @@ static int input_leds_connect(struct input_handler *handler,
                led->handle = &leds->handle;
                led->code = led_code;
-                if (WARN_ON(!input_led_info[led_code].name))
+                if (!input_led_info[led_code].name)
                        continue;
                led->cdev.name = kasprintf(GFP_KERNEL, "%s::%s",
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index b10709f04615..30e3442518f8 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -2,6 +2,7 @@
 * Apple USB BCM5974 (Macbook Air and Penryn Macbook Pro) multitouch driver
 *
 * Copyright (C) 2008      Henrik Rydberg (rydberg@euromail.se)
+ * Copyright (C) 2015      John Horan (knasher@gmail.com)
 *
 * The USB initialization and package decoding was made by
 * Scott Shawcroft as part of the touchd user-space driver project:
@@ -91,6 +92,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
+/* MacbookPro12,1 (2015) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI    0x0272
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO     0x0273
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS     0x0274
 #define BCM5974_DEVICE(prod) {                                  \
        .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -152,6 +157,10 @@ static const struct usb_device_id bcm5974_table[] = {
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
+        /* MacbookPro12,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_JIS),
        /* Terminating entry */
        {}
 };
@@ -180,21 +189,47 @@ struct bt_data {
 enum tp_type {
        TYPE1,                  /* plain trackpad */
        TYPE2,                  /* button integrated in trackpad */
-        TYPE3                   /* additional header fields since June 2013 */
+        TYPE3,                  /* additional header fields since June 2013 */
+        TYPE4                   /* additional header field for pressure data */
 };
 /* trackpad finger data offsets, le16-aligned */
-#define FINGER_TYPE1            (13 * sizeof(__le16))
+#define HEADER_TYPE1            (13 * sizeof(__le16))
-#define FINGER_TYPE2            (15 * sizeof(__le16))
+#define HEADER_TYPE2            (15 * sizeof(__le16))
-#define FINGER_TYPE3            (19 * sizeof(__le16))
+#define HEADER_TYPE3            (19 * sizeof(__le16))
+#define HEADER_TYPE4            (23 * sizeof(__le16))
 /* trackpad button data offsets */
+#define BUTTON_TYPE1            0
 #define BUTTON_TYPE2            15
 #define BUTTON_TYPE3            23
+#define BUTTON_TYPE4            31
 /* list of device capability bits */
 #define HAS_INTEGRATED_BUTTON   1
+/* trackpad finger data block size */
+#define FSIZE_TYPE1             (14 * sizeof(__le16))
+#define FSIZE_TYPE2             (14 * sizeof(__le16))
+#define FSIZE_TYPE3             (14 * sizeof(__le16))
+#define FSIZE_TYPE4             (15 * sizeof(__le16))
+/* offset from header to finger struct */
+#define DELTA_TYPE1             (0 * sizeof(__le16))
+#define DELTA_TYPE2             (0 * sizeof(__le16))
+#define DELTA_TYPE3             (0 * sizeof(__le16))
+#define DELTA_TYPE4             (1 * sizeof(__le16))
+/* usb control message mode switch data */
+#define USBMSG_TYPE1            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE2            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE3            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE4            2, 0x302, 2, 1, 0x1, 0x0
+/* Wellspring initialization constants */
+#define BCM5974_WELLSPRING_MODE_READ_REQUEST_ID         1
+#define BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID        9
 /* trackpad finger structure, le16-aligned */
 struct tp_finger {
        __le16 origin;          /* zero when switching track finger */
@@ -207,14 +242,13 @@ struct tp_finger {
        __le16 orientation;     /* 16384 when point, else 15 bit angle */
        __le16 touch_major;     /* touch area, major axis */
        __le16 touch_minor;     /* touch area, minor axis */
-        __le16 unused[3];       /* zeros */
+        __le16 unused[2];       /* zeros */
+        __le16 pressure;        /* pressure on forcetouch touchpad */
        __le16 multi;           /* one finger: varies, more fingers: constant */
 } __attribute__((packed,aligned(2)));
 /* trackpad finger data size, empirically at least ten fingers */
 #define MAX_FINGERS             16
-#define SIZEOF_FINGER           sizeof(struct tp_finger)
-#define SIZEOF_ALL_FINGERS      (MAX_FINGERS * SIZEOF_FINGER)
 #define MAX_FINGER_ORIENTATION  16384
 /* device-specific parameters */
@@ -232,8 +266,17 @@ struct bcm5974_config {
        int bt_datalen;         /* data length of the button interface */
        int tp_ep;              /* the endpoint of the trackpad interface */
        enum tp_type tp_type;   /* type of trackpad interface */
-        int tp_offset;          /* offset to trackpad finger data */
+        int tp_header;          /* bytes in header block */
        int tp_datalen;         /* data length of the trackpad interface */
+        int tp_button;          /* offset to button data */
+        int tp_fsize;           /* bytes in single finger block */
+        int tp_delta;           /* offset from header to finger struct */
+        int um_size;            /* usb control message length */
+        int um_req_val;         /* usb control message value */
+        int um_req_idx;         /* usb control message index */
+        int um_switch_idx;      /* usb control message mode switch index */
+        int um_switch_on;       /* usb control message mode switch on */
+        int um_switch_off;      /* usb control message mode switch off */
        struct bcm5974_param p; /* finger pressure limits */
        struct bcm5974_param w; /* finger width limits */
        struct bcm5974_param x; /* horizontal limits */
@@ -259,6 +302,24 @@ struct bcm5974 {
        int slots[MAX_FINGERS];                         /* slot assignments */
 };
+/* trackpad finger block data, le16-aligned */
+static const struct tp_finger *get_tp_finger(const struct bcm5974 *dev, int i)
+{
+        const struct bcm5974_config *c = &dev->cfg;
+        u8 *f_base = dev->tp_data + c->tp_header + c->tp_delta;
+        return (const struct tp_finger *)(f_base + i * c->tp_fsize);
+}
+#define DATAFORMAT(type)                                \
+        type,                                           \
+        HEADER_##type,                                  \
+        HEADER_##type + (MAX_FINGERS) * (FSIZE_##type), \
+        BUTTON_##type,                                  \
+        FSIZE_##type,                                   \
+        DELTA_##type,                                   \
+        USBMSG_##type
 /* logical signal quality */
 #define SN_PRESSURE     45              /* pressure signal-to-noise ratio */
 #define SN_WIDTH        25              /* width signal-to-noise ratio */
@@ -273,7 +334,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING_JIS,
                0,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE1),
                { SN_PRESSURE, 0, 256 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4824, 5342 },
@@ -286,7 +347,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING2_JIS,
                0,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE1),
                { SN_PRESSURE, 0, 256 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4824, 4824 },
@@ -299,7 +360,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING3_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4460, 5166 },
@@ -312,7 +373,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING4_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4620, 5140 },
@@ -325,7 +386,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4616, 5112 },
@@ -338,7 +399,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING5_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4415, 5050 },
@@ -351,7 +412,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING6_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4620, 5140 },
@@ -364,7 +425,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4750, 5280 },
@@ -377,7 +438,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4620, 5140 },
@@ -390,7 +451,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING7_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4750, 5280 },
@@ -403,7 +464,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS,
                HAS_INTEGRATED_BUTTON,
                0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4750, 5280 },
@@ -416,13 +477,26 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                USB_DEVICE_ID_APPLE_WELLSPRING8_JIS,
                HAS_INTEGRATED_BUTTON,
                0, sizeof(struct bt_data),
-                0x83, TYPE3, FINGER_TYPE3, FINGER_TYPE3 + SIZEOF_ALL_FINGERS,
+                0x83, DATAFORMAT(TYPE3),
                { SN_PRESSURE, 0, 300 },
                { SN_WIDTH, 0, 2048 },
                { SN_COORD, -4620, 5140 },
                { SN_COORD, -150, 6600 },
                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING9_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING9_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0, sizeof(struct bt_data),
+                0x83, DATAFORMAT(TYPE4),
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4828, 5345 },
+                { SN_COORD, -203, 6803 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
+        },
        {}
 };
@@ -549,19 +623,18 @@ static int report_tp_state(struct bcm5974 *dev, int size)
        struct input_dev *input = dev->input;
        int raw_n, i, n = 0;
-        if (size < c->tp_offset || (size - c->tp_offset) % SIZEOF_FINGER != 0)
+        if (size < c->tp_header || (size - c->tp_header) % c->tp_fsize != 0)
                return -EIO;
-        /* finger data, le16-aligned */
+        raw_n = (size - c->tp_header) / c->tp_fsize;
-        f = (const struct tp_finger *)(dev->tp_data + c->tp_offset);
-        raw_n = (size - c->tp_offset) / SIZEOF_FINGER;
        for (i = 0; i < raw_n; i++) {
-                if (raw2int(f[i].touch_major) == 0)
+                f = get_tp_finger(dev, i);
+                if (raw2int(f->touch_major) == 0)
                        continue;
-                dev->pos[n].x = raw2int(f[i].abs_x);
+                dev->pos[n].x = raw2int(f->abs_x);
-                dev->pos[n].y = c->y.min + c->y.max - raw2int(f[i].abs_y);
+                dev->pos[n].y = c->y.min + c->y.max - raw2int(f->abs_y);
-                dev->index[n++] = &f[i];
+                dev->index[n++] = f;
        }
        input_mt_assign_slots(input, dev->slots, dev->pos, n, 0);
@@ -572,32 +645,22 @@ static int report_tp_state(struct bcm5974 *dev, int size)
        input_mt_sync_frame(input);
-        report_synaptics_data(input, c, f, raw_n);
+        report_synaptics_data(input, c, get_tp_finger(dev, 0), raw_n);
-        /* type 2 reports button events via ibt only */
+        /* later types report button events via integrated button only */
-        if (c->tp_type == TYPE2) {
+        if (c->caps & HAS_INTEGRATED_BUTTON) {
-                int ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
+                int ibt = raw2int(dev->tp_data[c->tp_button]);
                input_report_key(input, BTN_LEFT, ibt);
        }
-        if (c->tp_type == TYPE3)
-                input_report_key(input, BTN_LEFT, dev->tp_data[BUTTON_TYPE3]);
        input_sync(input);
        return 0;
 }
-/* Wellspring initialization constants */
-#define BCM5974_WELLSPRING_MODE_READ_REQUEST_ID         1
-#define BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID        9
-#define BCM5974_WELLSPRING_MODE_REQUEST_VALUE           0x300
-#define BCM5974_WELLSPRING_MODE_REQUEST_INDEX           0
-#define BCM5974_WELLSPRING_MODE_VENDOR_VALUE            0x01
-#define BCM5974_WELLSPRING_MODE_NORMAL_VALUE            0x08
 static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
 {
+        const struct bcm5974_config *c = &dev->cfg;
        int retval = 0, size;
        char *data;
@@ -605,7 +668,7 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
        if (dev->cfg.tp_type == TYPE3)
                return 0;
-        data = kmalloc(8, GFP_KERNEL);
+        data = kmalloc(c->um_size, GFP_KERNEL);
        if (!data) {
                dev_err(&dev->intf->dev, "out of memory\n");
                retval = -ENOMEM;
@@ -616,28 +679,24 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
        size = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                        BCM5974_WELLSPRING_MODE_READ_REQUEST_ID,
                        USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_VALUE,
+                        c->um_req_val, c->um_req_idx, data, c->um_size, 5000);
-                        BCM5974_WELLSPRING_MODE_REQUEST_INDEX, data, 8, 5000);
-        if (size != 8) {
+        if (size != c->um_size) {
                dev_err(&dev->intf->dev, "could not read from device\n");
                retval = -EIO;
                goto out;
        }
        /* apply the mode switch */
-        data[0] = on ?
+        data[c->um_switch_idx] = on ? c->um_switch_on : c->um_switch_off;
-                BCM5974_WELLSPRING_MODE_VENDOR_VALUE :
-                BCM5974_WELLSPRING_MODE_NORMAL_VALUE;
        /* write configuration */
        size = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                        BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID,
                        USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_VALUE,
+                        c->um_req_val, c->um_req_idx, data, c->um_size, 5000);
-                        BCM5974_WELLSPRING_MODE_REQUEST_INDEX, data, 8, 5000);
-        if (size != 8) {
+        if (size != c->um_size) {
                dev_err(&dev->intf->dev, "could not write to device\n");
                retval = -EIO;
                goto out;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index ce3d40004458..22b9ca901f4e 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1167,7 +1167,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
        struct input_dev *dev = psmouse->dev;
        struct elantech_data *etd = psmouse->private;
        unsigned int x_min = 0, y_min = 0, x_max = 0, y_max = 0, width = 0;
-        unsigned int x_res = 0, y_res = 0;
+        unsigned int x_res = 31, y_res = 31;
        if (elantech_set_range(psmouse, &x_min, &y_min, &x_max, &y_max, &width))
                return -1;
@@ -1232,8 +1232,6 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                /* For X to recognize me as touchpad. */
                input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
                input_set_abs_params(dev, ABS_Y, y_min, y_max, 0, 0);
-                input_abs_set_res(dev, ABS_X, x_res);
-                input_abs_set_res(dev, ABS_Y, y_res);
                /*
                 * range of pressure and width is the same as v2,
                 * report ABS_PRESSURE, ABS_TOOL_WIDTH for compatibility.
@@ -1246,8 +1244,6 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                input_mt_init_slots(dev, ETP_MAX_FINGERS, 0);
                input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
-                input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
-                input_abs_set_res(dev, ABS_MT_POSITION_Y, y_res);
                input_set_abs_params(dev, ABS_MT_PRESSURE, ETP_PMIN_V2,
                                     ETP_PMAX_V2, 0, 0);
                /*
@@ -1259,6 +1255,13 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                break;
        }
+        input_abs_set_res(dev, ABS_X, x_res);
+        input_abs_set_res(dev, ABS_Y, y_res);
+        if (etd->hw_version > 1) {
+                input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
+                input_abs_set_res(dev, ABS_MT_POSITION_Y, y_res);
+        }
        etd->y_max = y_max;
        etd->width = width;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 3a32caf06bf1..6025eb430c0a 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1484,12 +1484,12 @@ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
        priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
        psmouse_info(psmouse,
-                     "Touchpad model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx, board id: %lu, fw id: %lu\n",
+                     "Touchpad model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx/%#lx, board id: %lu, fw id: %lu\n",
                     SYN_ID_MODEL(priv->identity),
                     SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
                     priv->model_id,
                     priv->capabilities, priv->ext_cap, priv->ext_cap_0c,
-                     priv->board_id, priv->firmware_id);
+                     priv->ext_cap_10, priv->board_id, priv->firmware_id);
        set_input_params(psmouse, priv);
diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index b4d12e29abff..e36162b28c2a 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -15,6 +15,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/dmi.h>
 #include <linux/i2c.h>
 #include <linux/input.h>
 #include <linux/input/mt.h>
@@ -34,6 +35,7 @@ struct goodix_ts_data {
        int abs_y_max;
        unsigned int max_touch_num;
        unsigned int int_trigger_type;
+        bool rotated_screen;
 };
 #define GOODIX_MAX_HEIGHT               4096
@@ -60,6 +62,30 @@ static const unsigned long goodix_irq_flags[] = {
        IRQ_TYPE_LEVEL_HIGH,
 };
+/*
+ * Those tablets have their coordinates origin at the bottom right
+ * of the tablet, as if rotated 180 degrees
+ */
+static const struct dmi_system_id rotated_screen[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                .ident = "WinBook TW100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "WinBook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TW100")
+                }
+        },
+        {
+                .ident = "WinBook TW700",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "WinBook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TW700")
+                },
+        },
+#endif
+        {}
+};
 /**
 * goodix_i2c_read - read data from a register of the i2c slave device.
 *
@@ -129,6 +155,11 @@ static void goodix_ts_report_touch(struct goodix_ts_data *ts, u8 *coor_data)
        int input_y = get_unaligned_le16(&coor_data[3]);
        int input_w = get_unaligned_le16(&coor_data[5]);
+        if (ts->rotated_screen) {
+                input_x = ts->abs_x_max - input_x;
+                input_y = ts->abs_y_max - input_y;
+        }
        input_mt_slot(ts->input_dev, id);
        input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, true);
        input_report_abs(ts->input_dev, ABS_MT_POSITION_X, input_x);
@@ -223,6 +254,11 @@ static void goodix_read_config(struct goodix_ts_data *ts)
                ts->abs_y_max = GOODIX_MAX_HEIGHT;
                ts->max_touch_num = GOODIX_MAX_CONTACTS;
        }
+        ts->rotated_screen = dmi_check_system(rotated_screen);
+        if (ts->rotated_screen)
+                dev_dbg(&ts->client->dev,
+                         "Applying '180 degrees rotated screen' quirk\n");
 }
 /**
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index f2c6c352c55a..2c41107240de 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
                goto err_out;
        }
+        /* TSC-25 data sheet specifies a delay after the RESET command */
+        msleep(150);
        /* set coordinate output rate */
        buf[0] = buf[1] = 0xFF;
        ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 8e9ec81ce4bb..da902baaa794 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -199,9 +199,10 @@
 * Stream table.
 *
 * Linear: Enough to cover 1 << IDR1.SIDSIZE entries
- * 2lvl: 8k L1 entries, 256 lazy entries per table (each table covers a PCI bus)
+ * 2lvl: 128k L1 entries,
+ *       256 lazy entries per table (each table covers a PCI bus)
 */
-#define STRTAB_L1_SZ_SHIFT              16
+#define STRTAB_L1_SZ_SHIFT              20
 #define STRTAB_SPLIT                    8
 #define STRTAB_L1_DESC_DWORDS           1
@@ -269,10 +270,10 @@
 #define ARM64_TCR_TG0_SHIFT             14
 #define ARM64_TCR_TG0_MASK              0x3UL
 #define CTXDESC_CD_0_TCR_IRGN0_SHIFT    8
-#define ARM64_TCR_IRGN0_SHIFT           24
+#define ARM64_TCR_IRGN0_SHIFT           8
 #define ARM64_TCR_IRGN0_MASK            0x3UL
 #define CTXDESC_CD_0_TCR_ORGN0_SHIFT    10
-#define ARM64_TCR_ORGN0_SHIFT           26
+#define ARM64_TCR_ORGN0_SHIFT           10
 #define ARM64_TCR_ORGN0_MASK            0x3UL
 #define CTXDESC_CD_0_TCR_SH0_SHIFT      12
 #define ARM64_TCR_SH0_SHIFT             12
@@ -542,6 +543,9 @@ struct arm_smmu_device {
 #define ARM_SMMU_FEAT_HYP               (1 << 12)
        u32                             features;
+#define ARM_SMMU_OPT_SKIP_PREFETCH      (1 << 0)
+        u32                             options;
        struct arm_smmu_cmdq            cmdq;
        struct arm_smmu_evtq            evtq;
        struct arm_smmu_priq            priq;
@@ -602,11 +606,35 @@ struct arm_smmu_domain {
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
 static LIST_HEAD(arm_smmu_devices);
+struct arm_smmu_option_prop {
+        u32 opt;
+        const char *prop;
+};
+static struct arm_smmu_option_prop arm_smmu_options[] = {
+        { ARM_SMMU_OPT_SKIP_PREFETCH, "hisilicon,broken-prefetch-cmd" },
+        { 0, NULL},
+};
 static struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom)
 {
        return container_of(dom, struct arm_smmu_domain, domain);
 }
+static void parse_driver_options(struct arm_smmu_device *smmu)
+{
+        int i = 0;
+        do {
+                if (of_property_read_bool(smmu->dev->of_node,
+                                                arm_smmu_options[i].prop)) {
+                        smmu->options |= arm_smmu_options[i].opt;
+                        dev_notice(smmu->dev, "option %s\n",
+                                arm_smmu_options[i].prop);
+                }
+        } while (arm_smmu_options[++i].opt);
+}
 /* Low-level queue manipulation functions */
 static bool queue_full(struct arm_smmu_queue *q)
 {
@@ -1036,7 +1064,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
        arm_smmu_sync_ste_for_sid(smmu, sid);
        /* It's likely that we'll want to use the new STE soon */
-        arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd);
+        if (!(smmu->options & ARM_SMMU_OPT_SKIP_PREFETCH))
+                arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd);
 }
 static void arm_smmu_init_bypass_stes(u64 *strtab, unsigned int nent)
@@ -1064,7 +1093,7 @@ static int arm_smmu_init_l2_strtab(struct arm_smmu_device *smmu, u32 sid)
                return 0;
        size = 1 << (STRTAB_SPLIT + ilog2(STRTAB_STE_DWORDS) + 3);
-        strtab = &cfg->strtab[sid >> STRTAB_SPLIT << STRTAB_L1_DESC_DWORDS];
+        strtab = &cfg->strtab[(sid >> STRTAB_SPLIT) * STRTAB_L1_DESC_DWORDS];
        desc->span = STRTAB_SPLIT + 1;
        desc->l2ptr = dma_zalloc_coherent(smmu->dev, size, &desc->l2ptr_dma,
@@ -2020,21 +2049,23 @@ static int arm_smmu_init_strtab_2lvl(struct arm_smmu_device *smmu)
 {
        void *strtab;
        u64 reg;
-        u32 size;
+        u32 size, l1size;
        int ret;
        struct arm_smmu_strtab_cfg *cfg = &smmu->strtab_cfg;
        /* Calculate the L1 size, capped to the SIDSIZE */
        size = STRTAB_L1_SZ_SHIFT - (ilog2(STRTAB_L1_DESC_DWORDS) + 3);
        size = min(size, smmu->sid_bits - STRTAB_SPLIT);
-        if (size + STRTAB_SPLIT < smmu->sid_bits)
+        cfg->num_l1_ents = 1 << size;
+        size += STRTAB_SPLIT;
+        if (size < smmu->sid_bits)
                dev_warn(smmu->dev,
                         "2-level strtab only covers %u/%u bits of SID\n",
-                         size + STRTAB_SPLIT, smmu->sid_bits);
+                         size, smmu->sid_bits);
-        cfg->num_l1_ents = 1 << size;
+        l1size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3);
-        size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3);
+        strtab = dma_zalloc_coherent(smmu->dev, l1size, &cfg->strtab_dma,
-        strtab = dma_zalloc_coherent(smmu->dev, size, &cfg->strtab_dma,
                                     GFP_KERNEL);
        if (!strtab) {
                dev_err(smmu->dev,
@@ -2055,8 +2086,7 @@ static int arm_smmu_init_strtab_2lvl(struct arm_smmu_device *smmu)
        ret = arm_smmu_init_l1_strtab(smmu);
        if (ret)
                dma_free_coherent(smmu->dev,
-                                  cfg->num_l1_ents *
+                                  l1size,
-                                  (STRTAB_L1_DESC_DWORDS << 3),
                                  strtab,
                                  cfg->strtab_dma);
        return ret;
@@ -2573,6 +2603,8 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
        if (irq > 0)
                smmu->gerr_irq = irq;
+        parse_driver_options(smmu);
        /* Probe the h/w */
        ret = arm_smmu_device_probe(smmu);
        if (ret)
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a98a7b27aca1..0649b94f5958 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1830,8 +1830,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 static void domain_exit(struct dmar_domain *domain)
 {
+        struct dmar_drhd_unit *drhd;
+        struct intel_iommu *iommu;
        struct page *freelist = NULL;
-        int i;
        /* Domain 0 is reserved, so dont process it */
        if (!domain)
@@ -1851,8 +1852,10 @@ static void domain_exit(struct dmar_domain *domain)
        /* clear attached or cached domains */
        rcu_read_lock();
-        for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+        for_each_active_iommu(iommu, drhd)
-                iommu_detach_domain(domain, g_iommus[i]);
+                if (domain_type_is_vm(domain) ||
+                    test_bit(iommu->seq_id, domain->iommu_bmp))
+                        iommu_detach_domain(domain, iommu);
        rcu_read_unlock();
        dma_free_pagelist(freelist);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 1b7e155869f6..c00e2db351ba 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -75,6 +75,13 @@ struct its_node {
 #define ITS_ITT_ALIGN           SZ_256
+struct event_lpi_map {
+        unsigned long           *lpi_map;
+        u16                     *col_map;
+        irq_hw_number_t         lpi_base;
+        int                     nr_lpis;
+};
 /*
 * The ITS view of a device - belongs to an ITS, a collection, owns an
 * interrupt translation table, and a list of interrupts.
@@ -82,11 +89,8 @@ struct its_node {
 struct its_device {
        struct list_head        entry;
        struct its_node         *its;
-        struct its_collection   *collection;
+        struct event_lpi_map    event_map;
        void                    *itt;
-        unsigned long           *lpi_map;
-        irq_hw_number_t         lpi_base;
-        int                     nr_lpis;
        u32                     nr_ites;
        u32                     device_id;
 };
@@ -99,6 +103,14 @@ static struct rdists *gic_rdists;
 #define gic_data_rdist()                (raw_cpu_ptr(gic_rdists->rdist))
 #define gic_data_rdist_rd_base()        (gic_data_rdist()->rd_base)
+static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+                                               u32 event)
+{
+        struct its_node *its = its_dev->its;
+        return its->collections + its_dev->event_map.col_map[event];
+}
 /*
 * ITS command descriptors - parameters to be encoded in a command
 * block.
@@ -134,7 +146,7 @@ struct its_cmd_desc {
                struct {
                        struct its_device *dev;
                        struct its_collection *col;
-                        u32 id;
+                        u32 event_id;
                } its_movi_cmd;
                struct {
@@ -241,7 +253,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_cmd_block *cmd,
        its_fixup_cmd(cmd);
-        return desc->its_mapd_cmd.dev->collection;
+        return NULL;
 }
 static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
@@ -260,52 +272,72 @@ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
 static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
                                                  struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+        col = dev_event_to_col(desc->its_mapvi_cmd.dev,
+                               desc->its_mapvi_cmd.event_id);
        its_encode_cmd(cmd, GITS_CMD_MAPVI);
        its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
        its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
        its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
-        its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
+        its_encode_collection(cmd, col->col_id);
        its_fixup_cmd(cmd);
-        return desc->its_mapvi_cmd.dev->collection;
+        return col;
 }
 static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
                                                 struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+        col = dev_event_to_col(desc->its_movi_cmd.dev,
+                               desc->its_movi_cmd.event_id);
        its_encode_cmd(cmd, GITS_CMD_MOVI);
        its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
-        its_encode_event_id(cmd, desc->its_movi_cmd.id);
+        its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
        its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
        its_fixup_cmd(cmd);
-        return desc->its_movi_cmd.dev->collection;
+        return col;
 }
 static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
                                                    struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+        col = dev_event_to_col(desc->its_discard_cmd.dev,
+                               desc->its_discard_cmd.event_id);
        its_encode_cmd(cmd, GITS_CMD_DISCARD);
        its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
        its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
        its_fixup_cmd(cmd);
-        return desc->its_discard_cmd.dev->collection;
+        return col;
 }
 static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
                                                struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+        col = dev_event_to_col(desc->its_inv_cmd.dev,
+                               desc->its_inv_cmd.event_id);
        its_encode_cmd(cmd, GITS_CMD_INV);
        its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
        its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
        its_fixup_cmd(cmd);
-        return desc->its_inv_cmd.dev->collection;
+        return col;
 }
 static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,
@@ -497,7 +529,7 @@ static void its_send_movi(struct its_device *dev,
        desc.its_movi_cmd.dev = dev;
        desc.its_movi_cmd.col = col;
-        desc.its_movi_cmd.id = id;
+        desc.its_movi_cmd.event_id = id;
        its_send_single_command(dev->its, its_build_movi_cmd, &desc);
 }
@@ -528,7 +560,7 @@ static void its_send_invall(struct its_node *its, struct its_collection *col)
 static inline u32 its_get_event_id(struct irq_data *d)
 {
        struct its_device *its_dev = irq_data_get_irq_chip_data(d);
-        return d->hwirq - its_dev->lpi_base;
+        return d->hwirq - its_dev->event_map.lpi_base;
 }
 static void lpi_set_config(struct irq_data *d, bool enable)
@@ -583,7 +615,7 @@ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
        target_col = &its_dev->its->collections[cpu];
        its_send_movi(its_dev, target_col, id);
-        its_dev->collection = target_col;
+        its_dev->event_map.col_map[id] = cpu;
        return IRQ_SET_MASK_OK_DONE;
 }
@@ -713,8 +745,10 @@ out:
        return bitmap;
 }
-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+static void its_lpi_free(struct event_lpi_map *map)
 {
+        int base = map->lpi_base;
+        int nr_ids = map->nr_lpis;
        int lpi;
        spin_lock(&lpi_lock);
@@ -731,7 +765,8 @@ static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
        spin_unlock(&lpi_lock);
-        kfree(bitmap);
+        kfree(map->lpi_map);
+        kfree(map->col_map);
 }
 /*
@@ -1099,11 +1134,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        struct its_device *dev;
        unsigned long *lpi_map;
        unsigned long flags;
+        u16 *col_map = NULL;
        void *itt;
        int lpi_base;
        int nr_lpis;
        int nr_ites;
-        int cpu;
        int sz;
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -1117,20 +1152,24 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
        itt = kzalloc(sz, GFP_KERNEL);
        lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
+        if (lpi_map)
+                col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
-        if (!dev || !itt || !lpi_map) {
+        if (!dev || !itt || !lpi_map || !col_map) {
                kfree(dev);
                kfree(itt);
                kfree(lpi_map);
+                kfree(col_map);
                return NULL;
        }
        dev->its = its;
        dev->itt = itt;
        dev->nr_ites = nr_ites;
-        dev->lpi_map = lpi_map;
+        dev->event_map.lpi_map = lpi_map;
-        dev->lpi_base = lpi_base;
+        dev->event_map.col_map = col_map;
-        dev->nr_lpis = nr_lpis;
+        dev->event_map.lpi_base = lpi_base;
+        dev->event_map.nr_lpis = nr_lpis;
        dev->device_id = dev_id;
        INIT_LIST_HEAD(&dev->entry);
@@ -1138,10 +1177,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        list_add(&dev->entry, &its->its_device_list);
        raw_spin_unlock_irqrestore(&its->lock, flags);
-        /* Bind the device to the first possible CPU */
-        cpu = cpumask_first(cpu_online_mask);
-        dev->collection = &its->collections[cpu];
        /* Map device to its ITT */
        its_send_mapd(dev, 1);
@@ -1163,12 +1198,13 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
 {
        int idx;
-        idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
+        idx = find_first_zero_bit(dev->event_map.lpi_map,
-        if (idx == dev->nr_lpis)
+                                  dev->event_map.nr_lpis);
+        if (idx == dev->event_map.nr_lpis)
                return -ENOSPC;
-        *hwirq = dev->lpi_base + idx;
+        *hwirq = dev->event_map.lpi_base + idx;
-        set_bit(idx, dev->lpi_map);
+        set_bit(idx, dev->event_map.lpi_map);
        return 0;
 }
@@ -1288,7 +1324,8 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                irq_domain_set_hwirq_and_chip(domain, virq + i,
                                              hwirq, &its_irq_chip, its_dev);
                dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
-                        (int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
+                        (int)(hwirq - its_dev->event_map.lpi_base),
+                        (int)hwirq, virq + i);
        }
        return 0;
@@ -1300,6 +1337,9 @@ static void its_irq_domain_activate(struct irq_domain *domain,
        struct its_device *its_dev = irq_data_get_irq_chip_data(d);
        u32 event = its_get_event_id(d);
+        /* Bind the LPI to the first possible CPU */
+        its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
        /* Map the GIC IRQ and event to the device */
        its_send_mapvi(its_dev, d->hwirq, event);
 }
@@ -1327,17 +1367,16 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                u32 event = its_get_event_id(data);
                /* Mark interrupt index as unused */
-                clear_bit(event, its_dev->lpi_map);
+                clear_bit(event, its_dev->event_map.lpi_map);
                /* Nuke the entry in the domain */
                irq_domain_reset_irq_data(data);
        }
        /* If all interrupts have been freed, start mopping the floor */
-        if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
+        if (bitmap_empty(its_dev->event_map.lpi_map,
-                its_lpi_free(its_dev->lpi_map,
+                         its_dev->event_map.nr_lpis)) {
-                             its_dev->lpi_base,
+                its_lpi_free(&its_dev->event_map);
-                             its_dev->nr_lpis);
                /* Unmap device/itt */
                its_send_mapd(its_dev, 0);
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index a45121546caf..acb721b31bcf 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -2,7 +2,7 @@
 * SPEAr platform shared irq layer source file
 *
 * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * Copyright (C) 2012 ST Microelectronics
 * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 8c91fd5eb6fd..375be509e95f 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty)
        cs->hw.ser->tty = tty;
        atomic_set(&cs->hw.ser->refcnt, 1);
        init_completion(&cs->hw.ser->dead_cmp);
        tty->disc_data = cs;
+        /* Set the amount of data we're willing to receive per call
+         * from the hardware driver to half of the input buffer size
+         * to leave some reserve.
+         * Note: We don't do flow control towards the hardware driver.
+         * If more data is received than will fit into the input buffer,
+         * it will be dropped and an error will be logged. This should
+         * never happen as the device is slow and the buffer size ample.
+         */
+        tty->receive_room = RBUFSIZE/2;
        /* OK.. Initialization of the datastructures and the HW is done.. Now
         * startup system and notify the LL that we are ready to run
         */
@@ -598,28 +607,6 @@ static int gigaset_tty_hangup(struct tty_struct *tty)
 }
 /*
- * Read on the tty.
- * Unused, received data goes only to the Gigaset driver.
- */
-static ssize_t
-gigaset_tty_read(struct tty_struct *tty, struct file *file,
-                 unsigned char __user *buf, size_t count)
-{
-        return -EAGAIN;
-}
-/*
- * Write on the tty.
- * Unused, transmit data comes only from the Gigaset driver.
- */
-static ssize_t
-gigaset_tty_write(struct tty_struct *tty, struct file *file,
-                  const unsigned char *buf, size_t count)
-{
-        return -EAGAIN;
-}
-/*
 * Ioctl on the tty.
 * Called in process context only.
 * May be re-entered by multiple ioctl calling threads.
@@ -752,8 +739,6 @@ static struct tty_ldisc_ops gigaset_ldisc = {
        .open           = gigaset_tty_open,
        .close          = gigaset_tty_close,
        .hangup         = gigaset_tty_hangup,
-        .read           = gigaset_tty_read,
-        .write          = gigaset_tty_write,
        .ioctl          = gigaset_tty_ioctl,
        .receive_buf    = gigaset_tty_receive,
        .write_wakeup   = gigaset_tty_wakeup,
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index b59727309072..bfec3bdfe598 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -259,7 +259,7 @@ config DM_CRYPT
          the ciphers you're going to use in the cryptoapi configuration.
          For further information on dm-crypt and userspace tools see:
-          <http://code.google.com/p/cryptsetup/wiki/DMCrypt>
+          <https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt>
          To compile this code as a module, choose M here: the module will
          be called dm-crypt.
diff --git a/drivers/md/bcache/closure.h b/drivers/md/bcache/closure.h
index a08e3eeac3c5..79a6d63e8ed3 100644
--- a/drivers/md/bcache/closure.h
+++ b/drivers/md/bcache/closure.h
@@ -320,7 +320,6 @@ static inline void closure_wake_up(struct closure_waitlist *list)
 do {                                                                    \
        set_closure_fn(_cl, _fn, _wq);                                  \
        closure_sub(_cl, CLOSURE_RUNNING + 1);                          \
-        return;                                                         \
 } while (0)
 /**
@@ -349,7 +348,6 @@ do {									\
 do {                                                                    \
        set_closure_fn(_cl, _fn, _wq);                                  \
        closure_queue(_cl);                                             \
-        return;                                                         \
 } while (0)
 /**
@@ -365,7 +363,6 @@ do {									\
 do {                                                                    \
        set_closure_fn(_cl, _destructor, NULL);                         \
        closure_sub(_cl, CLOSURE_RUNNING - CLOSURE_DESTRUCTOR + 1);     \
-        return;                                                         \
 } while (0)
 /**
diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index cb64e64a4789..bf6a9ca18403 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -105,6 +105,7 @@ void bch_generic_make_request(struct bio *bio, struct bio_split_pool *p)
        } while (n != bio);
        continue_at(&s->cl, bch_bio_submit_split_done, NULL);
+        return;
 submit:
        generic_make_request(bio);
 }
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index ce64fc851251..418607a6ba33 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -592,12 +592,14 @@ static void journal_write_unlocked(struct closure *cl)
        if (!w->need_write) {
                closure_return_with_destructor(cl, journal_write_unlock);
+                return;
        } else if (journal_full(&c->journal)) {
                journal_reclaim(c);
                spin_unlock(&c->journal.lock);
                btree_flush_write(c);
                continue_at(cl, journal_write, system_wq);
+                return;
        }
        c->journal.blocks_free -= set_blocks(w->data, block_bytes(c));
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 4afb2d26b148..f292790997d7 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -88,8 +88,10 @@ static void bch_data_insert_keys(struct closure *cl)
        if (journal_ref)
                atomic_dec_bug(journal_ref);
-        if (!op->insert_data_done)
+        if (!op->insert_data_done) {
                continue_at(cl, bch_data_insert_start, op->wq);
+                return;
+        }
        bch_keylist_free(&op->insert_keys);
        closure_return(cl);
@@ -216,8 +218,10 @@ static void bch_data_insert_start(struct closure *cl)
                /* 1 for the device pointer and 1 for the chksum */
                if (bch_keylist_realloc(&op->insert_keys,
                                        3 + (op->csum ? 1 : 0),
-                                        op->c))
+                                        op->c)) {
                        continue_at(cl, bch_data_insert_keys, op->wq);
+                        return;
+                }
                k = op->insert_keys.top;
                bkey_init(k);
@@ -255,6 +259,7 @@ static void bch_data_insert_start(struct closure *cl)
        op->insert_data_done = true;
        continue_at(cl, bch_data_insert_keys, op->wq);
+        return;
 err:
        /* bch_alloc_sectors() blocks if s->writeback = true */
        BUG_ON(op->writeback);
@@ -576,8 +581,10 @@ static void cache_lookup(struct closure *cl)
        ret = bch_btree_map_keys(&s->op, s->iop.c,
                                 &KEY(s->iop.inode, bio->bi_iter.bi_sector, 0),
                                 cache_lookup_fn, MAP_END_KEY);
-        if (ret == -EAGAIN)
+        if (ret == -EAGAIN) {
                continue_at(cl, cache_lookup, bcache_wq);
+                return;
+        }
        closure_return(cl);
 }
@@ -1085,6 +1092,7 @@ static void flash_dev_make_request(struct request_queue *q, struct bio *bio)
                continue_at_nobarrier(&s->cl,
                                      flash_dev_nodata,
                                      bcache_wq);
+                return;
        } else if (rw) {
                bch_keybuf_check_overlapping(&s->iop.c->moving_gc_keys,
                                        &KEY(d->id, bio->bi_iter.bi_sector, 0),
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed2346ddf4c9..e51de52eeb94 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
        bitmap_super_t *sb;
        unsigned long chunksize, daemon_sleep, write_behind;
-        bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
+        bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
        if (bitmap->storage.sb_page == NULL)
                return -ENOMEM;
        bitmap->storage.sb_page->index = 0;
@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
        sb->state = cpu_to_le32(bitmap->flags);
        bitmap->events_cleared = bitmap->mddev->events;
        sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
+        bitmap->mddev->bitmap_info.nodes = 0;
        kunmap_atomic(sb);
@@ -558,6 +559,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
        unsigned long sectors_reserved = 0;
        int err = -EINVAL;
        struct page *sb_page;
+        loff_t offset = bitmap->mddev->bitmap_info.offset;
        if (!bitmap->storage.file && !bitmap->mddev->bitmap_info.offset) {
                chunksize = 128 * 1024 * 1024;
@@ -584,9 +586,9 @@ re_read:
                bm_blocks = ((bm_blocks+7) >> 3) + sizeof(bitmap_super_t);
                /* to 4k blocks */
                bm_blocks = DIV_ROUND_UP_SECTOR_T(bm_blocks, 4096);
-                bitmap->mddev->bitmap_info.offset += bitmap->cluster_slot * (bm_blocks << 3);
+                offset = bitmap->mddev->bitmap_info.offset + (bitmap->cluster_slot * (bm_blocks << 3));
                pr_info("%s:%d bm slot: %d offset: %llu\n", __func__, __LINE__,
-                        bitmap->cluster_slot, (unsigned long long)bitmap->mddev->bitmap_info.offset);
+                        bitmap->cluster_slot, offset);
        }
        if (bitmap->storage.file) {
@@ -597,7 +599,7 @@ re_read:
                                bitmap, bytes, sb_page);
        } else {
                err = read_sb_page(bitmap->mddev,
-                                   bitmap->mddev->bitmap_info.offset,
+                                   offset,
                                   sb_page,
                                   0, sizeof(bitmap_super_t));
        }
@@ -611,8 +613,16 @@ re_read:
        daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
        write_behind = le32_to_cpu(sb->write_behind);
        sectors_reserved = le32_to_cpu(sb->sectors_reserved);
-        nodes = le32_to_cpu(sb->nodes);
+        /* XXX: This is a hack to ensure that we don't use clustering
-        strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
+         *  in case:
+         *      - dm-raid is in use and
+         *      - the nodes written in bitmap_sb is erroneous.
+         */
+        if (!bitmap->mddev->sync_super) {
+                nodes = le32_to_cpu(sb->nodes);
+                strlcpy(bitmap->mddev->bitmap_info.cluster_name,
+                                sb->cluster_name, 64);
+        }
        /* verify that the bitmap-specific fields are valid */
        if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
@@ -671,7 +681,7 @@ out:
        kunmap_atomic(sb);
        /* Assiging chunksize is required for "re_read" */
        bitmap->mddev->bitmap_info.chunksize = chunksize;
-        if (nodes && (bitmap->cluster_slot < 0)) {
+        if (err == 0 && nodes && (bitmap->cluster_slot < 0)) {
                err = md_setup_cluster(bitmap->mddev, nodes);
                if (err) {
                        pr_err("%s: Could not setup cluster service (%d)\n",
@@ -1866,10 +1876,6 @@ int bitmap_copy_from_slot(struct mddev *mddev, int slot,
        if (IS_ERR(bitmap))
                return PTR_ERR(bitmap);
-        rv = bitmap_read_sb(bitmap);
-        if (rv)
-                goto err;
        rv = bitmap_init_from_disk(bitmap, 0);
        if (rv)
                goto err;
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index b6f22651dd35..48a4a826ae07 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -1686,7 +1686,7 @@ static struct dm_cache_policy *smq_create(dm_cblock_t cache_size,
        if (from_cblock(cache_size)) {
                mq->cache_hit_bits = alloc_bitset(from_cblock(cache_size));
-                if (!mq->cache_hit_bits && mq->cache_hit_bits) {
+                if (!mq->cache_hit_bits) {
                        DMERR("couldn't allocate cache hit bitset");
                        goto bad_cache_hit_bits;
                }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1b4e1756b169..1fe93cfea7d3 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -1947,6 +1947,7 @@ static int commit_if_needed(struct cache *cache)
 static void process_deferred_bios(struct cache *cache)
 {
+        bool prealloc_used = false;
        unsigned long flags;
        struct bio_list bios;
        struct bio *bio;
@@ -1966,6 +1967,7 @@ static void process_deferred_bios(struct cache *cache)
                 * this bio might require one, we pause until there are some
                 * prepared mappings to process.
                 */
+                prealloc_used = true;
                if (prealloc_data_structs(cache, &structs)) {
                        spin_lock_irqsave(&cache->lock, flags);
                        bio_list_merge(&cache->deferred_bios, &bios);
@@ -1983,11 +1985,13 @@ static void process_deferred_bios(struct cache *cache)
                        process_bio(cache, &structs, bio);
        }
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 static void process_deferred_cells(struct cache *cache)
 {
+        bool prealloc_used = false;
        unsigned long flags;
        struct dm_bio_prison_cell *cell, *tmp;
        struct list_head cells;
@@ -2007,6 +2011,7 @@ static void process_deferred_cells(struct cache *cache)
                 * this bio might require one, we pause until there are some
                 * prepared mappings to process.
                 */
+                prealloc_used = true;
                if (prealloc_data_structs(cache, &structs)) {
                        spin_lock_irqsave(&cache->lock, flags);
                        list_splice(&cells, &cache->deferred_cells);
@@ -2017,7 +2022,8 @@ static void process_deferred_cells(struct cache *cache)
                process_cell(cache, &structs, cell);
        }
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 static void process_deferred_flush_bios(struct cache *cache, bool submit_bios)
@@ -2062,7 +2068,7 @@ static void process_deferred_writethrough_bios(struct cache *cache)
 static void writeback_some_dirty_blocks(struct cache *cache)
 {
-        int r = 0;
+        bool prealloc_used = false;
        dm_oblock_t oblock;
        dm_cblock_t cblock;
        struct prealloc structs;
@@ -2072,15 +2078,12 @@ static void writeback_some_dirty_blocks(struct cache *cache)
        memset(&structs, 0, sizeof(structs));
        while (spare_migration_bandwidth(cache)) {
-                if (prealloc_data_structs(cache, &structs))
+                if (policy_writeback_work(cache->policy, &oblock, &cblock, busy))
-                        break;
+                        break; /* no work to do */
-                r = policy_writeback_work(cache->policy, &oblock, &cblock, busy);
-                if (r)
-                        break;
-                r = get_cell(cache, oblock, &structs, &old_ocell);
+                prealloc_used = true;
-                if (r) {
+                if (prealloc_data_structs(cache, &structs) ||
+                    get_cell(cache, oblock, &structs, &old_ocell)) {
                        policy_set_dirty(cache->policy, oblock);
                        break;
                }
@@ -2088,7 +2091,8 @@ static void writeback_some_dirty_blocks(struct cache *cache)
                writeback(cache, &structs, oblock, cblock, old_ocell);
        }
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 /*----------------------------------------------------------------
@@ -3496,7 +3500,7 @@ static void cache_resume(struct dm_target *ti)
 * <#demotions> <#promotions> <#dirty>
 * <#features> <features>*
 * <#core args> <core args>
- * <policy name> <#policy args> <policy args>* <cache metadata mode>
+ * <policy name> <#policy args> <policy args>* <cache metadata mode> <needs_check>
 */
 static void cache_status(struct dm_target *ti, status_type_t type,
                         unsigned status_flags, char *result, unsigned maxlen)
@@ -3582,6 +3586,11 @@ static void cache_status(struct dm_target *ti, status_type_t type,
                else
                        DMEMIT("rw ");
+                if (dm_cache_metadata_needs_check(cache->cmd))
+                        DMEMIT("needs_check ");
+                else
+                        DMEMIT("- ");
                break;
        case STATUSTYPE_TABLE:
@@ -3820,7 +3829,7 @@ static void cache_io_hints(struct dm_target *ti, struct queue_limits *limits)
 static struct target_type cache_target = {
        .name = "cache",
-        .version = {1, 7, 0},
+        .version = {1, 8, 0},
        .module = THIS_MODULE,
        .ctr = cache_ctr,
        .dtr = cache_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index c33f61a4cc28..d2bbe8cc1e97 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/sort.h>
 #include <linux/rbtree.h>
@@ -268,7 +269,7 @@ struct pool {
        process_mapping_fn process_prepared_mapping;
        process_mapping_fn process_prepared_discard;
-        struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE];
+        struct dm_bio_prison_cell **cell_sort_array;
 };
 static enum pool_mode get_pool_mode(struct pool *pool);
@@ -665,16 +666,21 @@ static void requeue_io(struct thin_c *tc)
        requeue_deferred_cells(tc);
 }
-static void error_retry_list(struct pool *pool)
+static void error_retry_list_with_code(struct pool *pool, int error)
 {
        struct thin_c *tc;
        rcu_read_lock();
        list_for_each_entry_rcu(tc, &pool->active_thins, list)
-                error_thin_bio_list(tc, &tc->retry_on_resume_list, -EIO);
+                error_thin_bio_list(tc, &tc->retry_on_resume_list, error);
        rcu_read_unlock();
 }
+static void error_retry_list(struct pool *pool)
+{
+        return error_retry_list_with_code(pool, -EIO);
+}
 /*
 * This section of code contains the logic for processing a thin device's IO.
 * Much of the code depends on pool object resources (lists, workqueues, etc)
@@ -2281,18 +2287,23 @@ static void do_waker(struct work_struct *ws)
        queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
 }
+static void notify_of_pool_mode_change_to_oods(struct pool *pool);
 /*
 * We're holding onto IO to allow userland time to react.  After the
 * timeout either the pool will have been resized (and thus back in
- * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
+ * PM_WRITE mode), or we degrade to PM_OUT_OF_DATA_SPACE w/ error_if_no_space.
 */
 static void do_no_space_timeout(struct work_struct *ws)
 {
        struct pool *pool = container_of(to_delayed_work(ws), struct pool,
                                         no_space_timeout);
-        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
+        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space) {
-                set_pool_mode(pool, PM_READ_ONLY);
+                pool->pf.error_if_no_space = true;
+                notify_of_pool_mode_change_to_oods(pool);
+                error_retry_list_with_code(pool, -ENOSPC);
+        }
 }
 /*----------------------------------------------------------------*/
@@ -2370,6 +2381,14 @@ static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
               dm_device_name(pool->pool_md), new_mode);
 }
+static void notify_of_pool_mode_change_to_oods(struct pool *pool)
+{
+        if (!pool->pf.error_if_no_space)
+                notify_of_pool_mode_change(pool, "out-of-data-space (queue IO)");
+        else
+                notify_of_pool_mode_change(pool, "out-of-data-space (error IO)");
+}
 static bool passdown_enabled(struct pool_c *pt)
 {
        return pt->adjusted_pf.discard_passdown;
@@ -2454,7 +2473,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                 * frequently seeing this mode.
                 */
                if (old_mode != new_mode)
-                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                        notify_of_pool_mode_change_to_oods(pool);
                pool->process_bio = process_bio_read_only;
                pool->process_discard = process_discard_bio;
                pool->process_cell = process_cell_read_only;
@@ -2777,6 +2796,7 @@ static void __pool_destroy(struct pool *pool)
 {
        __pool_table_remove(pool);
+        vfree(pool->cell_sort_array);
        if (dm_pool_metadata_close(pool->pmd) < 0)
                DMWARN("%s: dm_pool_metadata_close() failed.", __func__);
@@ -2889,6 +2909,13 @@ static struct pool *pool_create(struct mapped_device *pool_md,
                goto bad_mapping_pool;
        }
+        pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
+        if (!pool->cell_sort_array) {
+                *error = "Error allocating cell sort array";
+                err_p = ERR_PTR(-ENOMEM);
+                goto bad_sort_array;
+        }
        pool->ref_count = 1;
        pool->last_commit_jiffies = jiffies;
        pool->pool_md = pool_md;
@@ -2897,6 +2924,8 @@ static struct pool *pool_create(struct mapped_device *pool_md,
        return pool;
+bad_sort_array:
+        mempool_destroy(pool->mapping_pool);
 bad_mapping_pool:
        dm_deferred_set_destroy(pool->all_io_ds);
 bad_all_io_ds:
@@ -3714,6 +3743,7 @@ static void emit_flags(struct pool_features *pf, char *result,
 * Status line is:
 *    <transaction id> <used metadata sectors>/<total metadata sectors>
 *    <used data sectors>/<total data sectors> <held metadata root>
+ *    <pool mode> <discard config> <no space config> <needs_check>
 */
 static void pool_status(struct dm_target *ti, status_type_t type,
                        unsigned status_flags, char *result, unsigned maxlen)
@@ -3815,6 +3845,11 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                else
                        DMEMIT("queue_if_no_space ");
+                if (dm_pool_metadata_needs_check(pool->pmd))
+                        DMEMIT("needs_check ");
+                else
+                        DMEMIT("- ");
                break;
        case STATUSTYPE_TABLE:
@@ -3918,7 +3953,7 @@ static struct target_type pool_target = {
        .name = "thin-pool",
        .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                    DM_TARGET_IMMUTABLE,
-        .version = {1, 15, 0},
+        .version = {1, 16, 0},
        .module = THIS_MODULE,
        .ctr = pool_ctr,
        .dtr = pool_dtr,
@@ -4305,7 +4340,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 static struct target_type thin_target = {
        .name = "thin",
-        .version = {1, 15, 0},
+        .version = {1, 16, 0},
        .module = THIS_MODULE,
        .ctr = thin_ctr,
        .dtr = thin_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f331d888e7f5..ab37ae114e94 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1067,13 +1067,10 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
 */
 static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
 {
-        int nr_requests_pending;
        atomic_dec(&md->pending[rw]);
        /* nudge anyone waiting on suspend queue */
-        nr_requests_pending = md_in_flight(md);
+        if (!md_in_flight(md))
-        if (!nr_requests_pending)
                wake_up(&md->wait);
        /*
@@ -1085,8 +1082,7 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
        if (run_queue) {
                if (md->queue->mq_ops)
                        blk_mq_run_hw_queues(md->queue, true);
-                else if (!nr_requests_pending ||
+                else
-                         (nr_requests_pending >= md->queue->nr_congestion_on))
                        blk_run_queue_async(md->queue);
        }
@@ -2281,8 +2277,6 @@ static void dm_init_old_md_queue(struct mapped_device *md)
 static void cleanup_mapped_device(struct mapped_device *md)
 {
-        cleanup_srcu_struct(&md->io_barrier);
        if (md->wq)
                destroy_workqueue(md->wq);
        if (md->kworker_task)
@@ -2294,6 +2288,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
        if (md->bs)
                bioset_free(md->bs);
+        cleanup_srcu_struct(&md->io_barrier);
        if (md->disk) {
                spin_lock(&_minor_lock);
                md->disk->private_data = NULL;
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index fcfc4b9b2672..0072190515e0 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -44,6 +44,7 @@ struct resync_info {
 /* md_cluster_info flags */
 #define         MD_CLUSTER_WAITING_FOR_NEWDISK          1
+#define         MD_CLUSTER_SUSPEND_READ_BALANCING       2
 struct md_cluster_info {
@@ -275,6 +276,9 @@ clear_bit:
 static void recover_prep(void *arg)
 {
+        struct mddev *mddev = arg;
+        struct md_cluster_info *cinfo = mddev->cluster_info;
+        set_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state);
 }
 static void recover_slot(void *arg, struct dlm_slot *slot)
@@ -307,6 +311,7 @@ static void recover_done(void *arg, struct dlm_slot *slots,
        cinfo->slot_number = our_slot;
        complete(&cinfo->completion);
+        clear_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state);
 }
 static const struct dlm_lockspace_ops md_ls_ops = {
@@ -816,12 +821,17 @@ static void resync_finish(struct mddev *mddev)
        resync_send(mddev, RESYNCING, 0, 0);
 }
-static int area_resyncing(struct mddev *mddev, sector_t lo, sector_t hi)
+static int area_resyncing(struct mddev *mddev, int direction,
+                sector_t lo, sector_t hi)
 {
        struct md_cluster_info *cinfo = mddev->cluster_info;
        int ret = 0;
        struct suspend_info *s;
+        if ((direction == READ) &&
+                test_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state))
+                return 1;
        spin_lock_irq(&cinfo->suspend_lock);
        if (list_empty(&cinfo->suspend_list))
                goto out;
diff --git a/drivers/md/md-cluster.h b/drivers/md/md-cluster.h
index 6817ee00e053..00defe2badbc 100644
--- a/drivers/md/md-cluster.h
+++ b/drivers/md/md-cluster.h
@@ -18,7 +18,7 @@ struct md_cluster_operations {
        int (*metadata_update_start)(struct mddev *mddev);
        int (*metadata_update_finish)(struct mddev *mddev);
        int (*metadata_update_cancel)(struct mddev *mddev);
-        int (*area_resyncing)(struct mddev *mddev, sector_t lo, sector_t hi);
+        int (*area_resyncing)(struct mddev *mddev, int direction, sector_t lo, sector_t hi);
        int (*add_new_disk_start)(struct mddev *mddev, struct md_rdev *rdev);
        int (*add_new_disk_finish)(struct mddev *mddev);
        int (*new_disk_ack)(struct mddev *mddev, bool ack);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d429c30cd514..0c2a4e8b873c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5382,6 +5382,8 @@ static void __md_stop(struct mddev *mddev)
 {
        struct md_personality *pers = mddev->pers;
        mddev_detach(mddev);
+        /* Ensure ->event_work is done */
+        flush_workqueue(md_misc_wq);
        spin_lock(&mddev->lock);
        mddev->ready = 0;
        mddev->pers = NULL;
@@ -7437,7 +7439,7 @@ int md_setup_cluster(struct mddev *mddev, int nodes)
        err = request_module("md-cluster");
        if (err) {
                pr_err("md-cluster module not found.\n");
-                return err;
+                return -ENOENT;
        }
        spin_lock(&pers_lock);
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index e04cfd2d60ef..9836c0ae897c 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
                if (s < 0 && nr_center < -s) {
                        /* not enough in central node */
-                        shift(left, center, nr_center);
+                        shift(left, center, -nr_center);
-                        s = nr_center - target;
+                        s += nr_center;
                        shift(left, right, s);
                        nr_right += s;
                } else
@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
                if (s > 0 && nr_center < s) {
                        /* not enough in central node */
                        shift(center, right, nr_center);
-                        s = target - nr_center;
+                        s -= nr_center;
                        shift(left, right, s);
                        nr_left -= s;
                } else
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 200ac12a1d40..fdd3793e22f9 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
        int r;
        struct del_stack *s;
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        s = kmalloc(sizeof(*s), GFP_NOIO);
        if (!s)
                return -ENOMEM;
        s->info = info;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f80f1af61ce7..94f5b55069e0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
                spin_lock_irqsave(&conf->device_lock, flags);
                if (r1_bio->mddev->degraded == conf->raid_disks ||
                    (r1_bio->mddev->degraded == conf->raid_disks-1 &&
-                     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
+                     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
                        uptodate = 1;
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
@@ -541,7 +541,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
        if ((conf->mddev->recovery_cp < this_sector + sectors) ||
            (mddev_is_clustered(conf->mddev) &&
-            md_cluster_ops->area_resyncing(conf->mddev, this_sector,
+            md_cluster_ops->area_resyncing(conf->mddev, READ, this_sector,
                    this_sector + sectors)))
                choose_first = 1;
        else
@@ -1111,7 +1111,8 @@ static void make_request(struct mddev *mddev, struct bio * bio)
            ((bio_end_sector(bio) > mddev->suspend_lo &&
            bio->bi_iter.bi_sector < mddev->suspend_hi) ||
            (mddev_is_clustered(mddev) &&
-             md_cluster_ops->area_resyncing(mddev, bio->bi_iter.bi_sector, bio_end_sector(bio))))) {
+             md_cluster_ops->area_resyncing(mddev, WRITE,
+                     bio->bi_iter.bi_sector, bio_end_sector(bio))))) {
                /* As the suspend_* range is controlled by
                 * userspace, we want an interruptible
                 * wait.
@@ -1124,7 +1125,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
                        if (bio_end_sector(bio) <= mddev->suspend_lo ||
                            bio->bi_iter.bi_sector >= mddev->suspend_hi ||
                            (mddev_is_clustered(mddev) &&
-                             !md_cluster_ops->area_resyncing(mddev,
+                             !md_cluster_ops->area_resyncing(mddev, WRITE,
                                     bio->bi_iter.bi_sector, bio_end_sector(bio))))
                                break;
                        schedule();
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 940f2f365461..38c58e19cfce 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3556,6 +3556,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
                        /* far_copies must be 1 */
                        conf->prev.stride = conf->dev_sectors;
        }
+        conf->reshape_safe = conf->reshape_progress;
        spin_lock_init(&conf->device_lock);
        INIT_LIST_HEAD(&conf->retry_list);
@@ -3760,7 +3761,6 @@ static int run(struct mddev *mddev)
                }
                conf->offset_diff = min_offset_diff;
-                conf->reshape_safe = conf->reshape_progress;
                clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
                set_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
@@ -4103,6 +4103,7 @@ static int raid10_start_reshape(struct mddev *mddev)
                conf->reshape_progress = size;
        } else
                conf->reshape_progress = 0;
+        conf->reshape_safe = conf->reshape_progress;
        spin_unlock_irq(&conf->device_lock);
        if (mddev->delta_disks && mddev->bitmap) {
@@ -4170,6 +4171,7 @@ abort:
                rdev->new_data_offset = rdev->data_offset;
        smp_wmb();
        conf->reshape_progress = MaxSector;
+        conf->reshape_safe = MaxSector;
        mddev->reshape_position = MaxSector;
        spin_unlock_irq(&conf->device_lock);
        return ret;
@@ -4524,6 +4526,7 @@ static void end_reshape(struct r10conf *conf)
        md_finish_reshape(conf->mddev);
        smp_wmb();
        conf->reshape_progress = MaxSector;
+        conf->reshape_safe = MaxSector;
        spin_unlock_irq(&conf->device_lock);
        /* read-ahead size must cover two whole stripes, which is
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 59e44e99eef3..643d217bfa13 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2162,6 +2162,9 @@ static int resize_stripes(struct r5conf *conf, int newsize)
        if (!sc)
                return -ENOMEM;
+        /* Need to ensure auto-resizing doesn't interfere */
+        mutex_lock(&conf->cache_size_mutex);
        for (i = conf->max_nr_stripes; i; i--) {
                nsh = alloc_stripe(sc, GFP_KERNEL);
                if (!nsh)
@@ -2178,6 +2181,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                        kmem_cache_free(sc, nsh);
                }
                kmem_cache_destroy(sc);
+                mutex_unlock(&conf->cache_size_mutex);
                return -ENOMEM;
        }
        /* Step 2 - Must use GFP_NOIO now.
@@ -2224,6 +2228,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
        } else
                err = -ENOMEM;
+        mutex_unlock(&conf->cache_size_mutex);
        /* Step 4, return new stripes to service */
        while(!list_empty(&newstripes)) {
                nsh = list_entry(newstripes.next, struct stripe_head, lru);
@@ -4061,8 +4066,10 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                                 &first_bad, &bad_sectors))
                        set_bit(R5_ReadRepl, &dev->flags);
                else {
-                        if (rdev)
+                        if (rdev && !test_bit(Faulty, &rdev->flags))
                                set_bit(R5_NeedReplace, &dev->flags);
+                        else
+                                clear_bit(R5_NeedReplace, &dev->flags);
                        rdev = rcu_dereference(conf->disks[i].rdev);
                        clear_bit(R5_ReadRepl, &dev->flags);
                }
@@ -5857,12 +5864,14 @@ static void raid5d(struct md_thread *thread)
        pr_debug("%d stripes handled\n", handled);
        spin_unlock_irq(&conf->device_lock);
-        if (test_and_clear_bit(R5_ALLOC_MORE, &conf->cache_state)) {
+        if (test_and_clear_bit(R5_ALLOC_MORE, &conf->cache_state) &&
+            mutex_trylock(&conf->cache_size_mutex)) {
                grow_one_stripe(conf, __GFP_NOWARN);
                /* Set flag even if allocation failed.  This helps
                 * slow down allocation requests when mem is short
                 */
                set_bit(R5_DID_ALLOC, &conf->cache_state);
+                mutex_unlock(&conf->cache_size_mutex);
        }
        async_tx_issue_pending_all();
@@ -5894,18 +5903,22 @@ raid5_set_cache_size(struct mddev *mddev, int size)
                return -EINVAL;
        conf->min_nr_stripes = size;
+        mutex_lock(&conf->cache_size_mutex);
        while (size < conf->max_nr_stripes &&
               drop_one_stripe(conf))
                ;
+        mutex_unlock(&conf->cache_size_mutex);
        err = md_allow_write(mddev);
        if (err)
                return err;
+        mutex_lock(&conf->cache_size_mutex);
        while (size > conf->max_nr_stripes)
                if (!grow_one_stripe(conf, GFP_KERNEL))
                        break;
+        mutex_unlock(&conf->cache_size_mutex);
        return 0;
 }
@@ -6371,11 +6384,18 @@ static unsigned long raid5_cache_scan(struct shrinker *shrink,
                                      struct shrink_control *sc)
 {
        struct r5conf *conf = container_of(shrink, struct r5conf, shrinker);
-        int ret = 0;
+        unsigned long ret = SHRINK_STOP;
-        while (ret < sc->nr_to_scan) {
-                if (drop_one_stripe(conf) == 0)
+        if (mutex_trylock(&conf->cache_size_mutex)) {
-                        return SHRINK_STOP;
+                ret= 0;
-                ret++;
+                while (ret < sc->nr_to_scan) {
+                        if (drop_one_stripe(conf) == 0) {
+                                ret = SHRINK_STOP;
+                                break;
+                        }
+                        ret++;
+                }
+                mutex_unlock(&conf->cache_size_mutex);
        }
        return ret;
 }
@@ -6444,6 +6464,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                goto abort;
        spin_lock_init(&conf->device_lock);
        seqcount_init(&conf->gen_lock);
+        mutex_init(&conf->cache_size_mutex);
        init_waitqueue_head(&conf->wait_for_quiescent);
        for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) {
                init_waitqueue_head(&conf->wait_for_stripe[i]);
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 02c3bf8fbfe7..d05144278690 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -482,7 +482,8 @@ struct r5conf {
         */
        int                     active_name;
        char                    cache_name[2][32];
-        struct kmem_cache               *slab_cache; /* for allocating stripes */
+        struct kmem_cache       *slab_cache; /* for allocating stripes */
+        struct mutex            cache_size_mutex; /* Protect changes to cache size */
        int                     seq_flush, seq_write;
        int                     quiesce;
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 4cb365d4ffdc..8b95eefb610b 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -38,6 +38,8 @@
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/fb.h>
@@ -1171,6 +1173,13 @@ static int ivtvfb_init_card(struct ivtv *itv)
 {
        int rc;
+#ifdef CONFIG_X86_64
+        if (pat_enabled()) {
+                pr_warn("ivtvfb needs PAT disabled, boot with nopat kernel parameter\n");
+                return -ENODEV;
+        }
+#endif
        if (itv->osd_info) {
                IVTVFB_ERR("Card %d already initialised\n", ivtvfb_card_id);
                return -EBUSY;
@@ -1265,12 +1274,6 @@ static int __init ivtvfb_init(void)
        int registered = 0;
        int err;
-#ifdef CONFIG_X86_64
-        if (WARN(pat_enabled(),
-                 "ivtvfb needs PAT disabled, boot with nopat kernel parameter\n")) {
-                return -ENODEV;
-        }
-#endif
        if (ivtvfb_card_id < -1 || ivtvfb_card_id >= IVTV_MAX_CARDS) {
                printk(KERN_ERR "ivtvfb:  ivtvfb_card_id parameter is out of range (valid range: -1 - %d)\n",
diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
index 5c054031c3f8..e14c8c9d189b 100644
--- a/drivers/mfd/stmpe-i2c.c
+++ b/drivers/mfd/stmpe-i2c.c
@@ -6,7 +6,7 @@
 *
 * License Terms: GNU General Public License, version 2
 * Author: Rabin Vincent <rabin.vincent@stericsson.com> for ST-Ericsson
- * Author: Viresh Kumar <viresh.linux@gmail.com> for ST Microelectronics
+ * Author: Viresh Kumar <vireshk@kernel.org> for ST Microelectronics
 */
 #include <linux/i2c.h>
diff --git a/drivers/mfd/stmpe-spi.c b/drivers/mfd/stmpe-spi.c
index a81badbaa917..6fdb30e84a2b 100644
--- a/drivers/mfd/stmpe-spi.c
+++ b/drivers/mfd/stmpe-spi.c
@@ -4,7 +4,7 @@
 * Copyright (C) ST Microelectronics SA 2011
 *
 * License Terms: GNU General Public License, version 2
- * Author: Viresh Kumar <viresh.linux@gmail.com> for ST Microelectronics
+ * Author: Viresh Kumar <vireshk@kernel.org> for ST Microelectronics
 */
 #include <linux/spi/spi.h>
@@ -146,4 +146,4 @@ module_exit(stmpe_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("STMPE MFD SPI Interface Driver");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 8eb0a9500a90..e9513d651cd3 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -682,7 +682,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
        /* Fill in the data structures */
        devno = MKDEV(MAJOR(mei_devt), dev->minor);
        cdev_init(&dev->cdev, &mei_fops);
-        dev->cdev.owner = mei_fops.owner;
+        dev->cdev.owner = parent->driver->owner;
        /* Add the device */
        ret = cdev_add(&dev->cdev, devno, 1);
diff --git a/drivers/misc/mic/scif/scif_nodeqp.c b/drivers/misc/mic/scif/scif_nodeqp.c
index 41e3bdb10061..6dfdae3452d6 100644
--- a/drivers/misc/mic/scif/scif_nodeqp.c
+++ b/drivers/misc/mic/scif/scif_nodeqp.c
@@ -357,7 +357,7 @@ static void scif_p2p_freesg(struct scatterlist *sg)
 }
 static struct scatterlist *
-scif_p2p_setsg(void __iomem *va, int page_size, int page_cnt)
+scif_p2p_setsg(phys_addr_t pa, int page_size, int page_cnt)
 {
        struct scatterlist *sg;
        struct page *page;
@@ -368,16 +368,11 @@ scif_p2p_setsg(void __iomem *va, int page_size, int page_cnt)
                return NULL;
        sg_init_table(sg, page_cnt);
        for (i = 0; i < page_cnt; i++) {
-                page = vmalloc_to_page((void __force *)va);
+                page = pfn_to_page(pa >> PAGE_SHIFT);
-                if (!page)
-                        goto p2p_sg_err;
                sg_set_page(&sg[i], page, page_size, 0);
-                va += page_size;
+                pa += page_size;
        }
        return sg;
-p2p_sg_err:
-        kfree(sg);
-        return NULL;
 }
 /* Init p2p mappings required to access peerdev from scifdev */
@@ -395,14 +390,14 @@ scif_init_p2p_info(struct scif_dev *scifdev, struct scif_dev *peerdev)
        p2p = kzalloc(sizeof(*p2p), GFP_KERNEL);
        if (!p2p)
                return NULL;
-        p2p->ppi_sg[SCIF_PPI_MMIO] = scif_p2p_setsg(psdev->mmio->va,
+        p2p->ppi_sg[SCIF_PPI_MMIO] = scif_p2p_setsg(psdev->mmio->pa,
                                                    PAGE_SIZE, num_mmio_pages);
        if (!p2p->ppi_sg[SCIF_PPI_MMIO])
                goto free_p2p;
        p2p->sg_nentries[SCIF_PPI_MMIO] = num_mmio_pages;
        sg_page_shift = get_order(min(psdev->aper->len, (u64)(1 << 30)));
        num_aper_chunks = num_aper_pages >> (sg_page_shift - PAGE_SHIFT);
-        p2p->ppi_sg[SCIF_PPI_APER] = scif_p2p_setsg(psdev->aper->va,
+        p2p->ppi_sg[SCIF_PPI_APER] = scif_p2p_setsg(psdev->aper->pa,
                                                    1 << sg_page_shift,
                                                    num_aper_chunks);
        p2p->sg_nentries[SCIF_PPI_APER] = num_aper_chunks;
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index c9c3d20b784b..a1b820fcb2a6 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
        ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
+        mmc_blk_put(md);
        return ret;
 }
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index fd9a58e216a5..6a0f9c79be26 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -779,6 +779,7 @@ config MMC_TOSHIBA_PCI
 config MMC_MTK
        tristate "MediaTek SD/MMC Card Interface support"
+        depends on HAS_DMA
        help
          This selects the MediaTek(R) Secure digital and Multimedia card Interface.
          If you have a machine with a integrated SD/MMC card reader, say Y or M here.
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index b2b411da297b..4d1203236890 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1062,9 +1062,14 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
                if (status & (CTO_EN | CCRC_EN))
                        end_cmd = 1;
+                if (host->data || host->response_busy) {
+                        end_trans = !end_cmd;
+                        host->response_busy = 0;
+                }
                if (status & (CTO_EN | DTO_EN))
                        hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);
-                else if (status & (CCRC_EN | DCRC_EN))
+                else if (status & (CCRC_EN | DCRC_EN | DEB_EN | CEB_EN |
+                                   BADA_EN))
                        hsmmc_command_incomplete(host, -EILSEQ, end_cmd);
                if (status & ACE_EN) {
@@ -1081,10 +1086,6 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
                        }
                        dev_dbg(mmc_dev(host->mmc), "AC12 err: 0x%x\n", ac12);
                }
-                if (host->data || host->response_busy) {
-                        end_trans = !end_cmd;
-                        host->response_busy = 0;
-                }
        }
        OMAP_HSMMC_WRITE(host->base, STAT, status);
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index faf0cb910c96..c6b9f6492e1a 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -581,13 +581,8 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
 static unsigned int esdhc_pltfm_get_max_clock(struct sdhci_host *host)
 {
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct pltfm_imx_data *imx_data = pltfm_host->priv;
-        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
-        if (boarddata->f_max && (boarddata->f_max < pltfm_host->clock))
+        return pltfm_host->clock;
-                return boarddata->f_max;
-        else
-                return pltfm_host->clock;
 }
 static unsigned int esdhc_pltfm_get_min_clock(struct sdhci_host *host)
@@ -878,34 +873,19 @@ static const struct sdhci_pltfm_data sdhci_esdhc_imx_pdata = {
 static int
 sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                         struct sdhci_host *host,
-                         struct esdhc_platform_data *boarddata)
+                         struct pltfm_imx_data *imx_data)
 {
        struct device_node *np = pdev->dev.of_node;
+        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
-        if (!np)
+        int ret;
-                return -ENODEV;
-        if (of_get_property(np, "non-removable", NULL))
-                boarddata->cd_type = ESDHC_CD_PERMANENT;
-        if (of_get_property(np, "fsl,cd-controller", NULL))
-                boarddata->cd_type = ESDHC_CD_CONTROLLER;
        if (of_get_property(np, "fsl,wp-controller", NULL))
                boarddata->wp_type = ESDHC_WP_CONTROLLER;
-        boarddata->cd_gpio = of_get_named_gpio(np, "cd-gpios", 0);
-        if (gpio_is_valid(boarddata->cd_gpio))
-                boarddata->cd_type = ESDHC_CD_GPIO;
        boarddata->wp_gpio = of_get_named_gpio(np, "wp-gpios", 0);
        if (gpio_is_valid(boarddata->wp_gpio))
                boarddata->wp_type = ESDHC_WP_GPIO;
-        of_property_read_u32(np, "bus-width", &boarddata->max_bus_width);
-        of_property_read_u32(np, "max-frequency", &boarddata->f_max);
        if (of_find_property(np, "no-1-8-v", NULL))
                boarddata->support_vsel = false;
        else
@@ -916,29 +896,119 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
        mmc_of_parse_voltage(np, &host->ocr_mask);
+        /* sdr50 and sdr104 needs work on 1.8v signal voltage */
+        if ((boarddata->support_vsel) && esdhc_is_usdhc(imx_data) &&
+            !IS_ERR(imx_data->pins_default)) {
+                imx_data->pins_100mhz = pinctrl_lookup_state(imx_data->pinctrl,
+                                                ESDHC_PINCTRL_STATE_100MHZ);
+                imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
+                                                ESDHC_PINCTRL_STATE_200MHZ);
+                if (IS_ERR(imx_data->pins_100mhz) ||
+                                IS_ERR(imx_data->pins_200mhz)) {
+                        dev_warn(mmc_dev(host->mmc),
+                                "could not get ultra high speed state, work on normal mode\n");
+                        /*
+                         * fall back to not support uhs by specify no 1.8v quirk
+                         */
+                        host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+                }
+        } else {
+                host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+        }
        /* call to generic mmc_of_parse to support additional capabilities */
-        return mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                return ret;
+        if (!IS_ERR_VALUE(mmc_gpio_get_cd(host->mmc)))
+                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+        return 0;
 }
 #else
 static inline int
 sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                         struct sdhci_host *host,
-                         struct esdhc_platform_data *boarddata)
+                         struct pltfm_imx_data *imx_data)
 {
        return -ENODEV;
 }
 #endif
+static int sdhci_esdhc_imx_probe_nondt(struct platform_device *pdev,
+                         struct sdhci_host *host,
+                         struct pltfm_imx_data *imx_data)
+{
+        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
+        int err;
+        if (!host->mmc->parent->platform_data) {
+                dev_err(mmc_dev(host->mmc), "no board data!\n");
+                return -EINVAL;
+        }
+        imx_data->boarddata = *((struct esdhc_platform_data *)
+                                host->mmc->parent->platform_data);
+        /* write_protect */
+        if (boarddata->wp_type == ESDHC_WP_GPIO) {
+                err = mmc_gpio_request_ro(host->mmc, boarddata->wp_gpio);
+                if (err) {
+                        dev_err(mmc_dev(host->mmc),
+                                "failed to request write-protect gpio!\n");
+                        return err;
+                }
+                host->mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
+        }
+        /* card_detect */
+        switch (boarddata->cd_type) {
+        case ESDHC_CD_GPIO:
+                err = mmc_gpio_request_cd(host->mmc, boarddata->cd_gpio, 0);
+                if (err) {
+                        dev_err(mmc_dev(host->mmc),
+                                "failed to request card-detect gpio!\n");
+                        return err;
+                }
+                /* fall through */
+        case ESDHC_CD_CONTROLLER:
+                /* we have a working card_detect back */
+                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+                break;
+        case ESDHC_CD_PERMANENT:
+                host->mmc->caps |= MMC_CAP_NONREMOVABLE;
+                break;
+        case ESDHC_CD_NONE:
+                break;
+        }
+        switch (boarddata->max_bus_width) {
+        case 8:
+                host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA;
+                break;
+        case 4:
+                host->mmc->caps |= MMC_CAP_4_BIT_DATA;
+                break;
+        case 1:
+        default:
+                host->quirks |= SDHCI_QUIRK_FORCE_1_BIT_DATA;
+                break;
+        }
+        return 0;
+}
 static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
 {
        const struct of_device_id *of_id =
                        of_match_device(imx_esdhc_dt_ids, &pdev->dev);
        struct sdhci_pltfm_host *pltfm_host;
        struct sdhci_host *host;
-        struct esdhc_platform_data *boarddata;
        int err;
        struct pltfm_imx_data *imx_data;
-        bool dt = true;
        host = sdhci_pltfm_init(pdev, &sdhci_esdhc_imx_pdata, 0);
        if (IS_ERR(host))
@@ -1030,84 +1100,12 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
        if (imx_data->socdata->flags & ESDHC_FLAG_ERR004536)
                host->quirks |= SDHCI_QUIRK_BROKEN_ADMA;
-        boarddata = &imx_data->boarddata;
+        if (of_id)
-        if (sdhci_esdhc_imx_probe_dt(pdev, host, boarddata) < 0) {
+                err = sdhci_esdhc_imx_probe_dt(pdev, host, imx_data);
-                if (!host->mmc->parent->platform_data) {
+        else
-                        dev_err(mmc_dev(host->mmc), "no board data!\n");
+                err = sdhci_esdhc_imx_probe_nondt(pdev, host, imx_data);
-                        err = -EINVAL;
+        if (err)
-                        goto disable_clk;
+                goto disable_clk;
-                }
-                imx_data->boarddata = *((struct esdhc_platform_data *)
-                                        host->mmc->parent->platform_data);
-                dt = false;
-        }
-        /* write_protect */
-        if (boarddata->wp_type == ESDHC_WP_GPIO && !dt) {
-                err = mmc_gpio_request_ro(host->mmc, boarddata->wp_gpio);
-                if (err) {
-                        dev_err(mmc_dev(host->mmc),
-                                "failed to request write-protect gpio!\n");
-                        goto disable_clk;
-                }
-                host->mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
-        }
-        /* card_detect */
-        switch (boarddata->cd_type) {
-        case ESDHC_CD_GPIO:
-                if (dt)
-                        break;
-                err = mmc_gpio_request_cd(host->mmc, boarddata->cd_gpio, 0);
-                if (err) {
-                        dev_err(mmc_dev(host->mmc),
-                                "failed to request card-detect gpio!\n");
-                        goto disable_clk;
-                }
-                /* fall through */
-        case ESDHC_CD_CONTROLLER:
-                /* we have a working card_detect back */
-                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
-                break;
-        case ESDHC_CD_PERMANENT:
-                host->mmc->caps |= MMC_CAP_NONREMOVABLE;
-                break;
-        case ESDHC_CD_NONE:
-                break;
-        }
-        switch (boarddata->max_bus_width) {
-        case 8:
-                host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA;
-                break;
-        case 4:
-                host->mmc->caps |= MMC_CAP_4_BIT_DATA;
-                break;
-        case 1:
-        default:
-                host->quirks |= SDHCI_QUIRK_FORCE_1_BIT_DATA;
-                break;
-        }
-        /* sdr50 and sdr104 needs work on 1.8v signal voltage */
-        if ((boarddata->support_vsel) && esdhc_is_usdhc(imx_data) &&
-            !IS_ERR(imx_data->pins_default)) {
-                imx_data->pins_100mhz = pinctrl_lookup_state(imx_data->pinctrl,
-                                                ESDHC_PINCTRL_STATE_100MHZ);
-                imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
-                                                ESDHC_PINCTRL_STATE_200MHZ);
-                if (IS_ERR(imx_data->pins_100mhz) ||
-                                IS_ERR(imx_data->pins_200mhz)) {
-                        dev_warn(mmc_dev(host->mmc),
-                                "could not get ultra high speed state, work on normal mode\n");
-                        /* fall back to not support uhs by specify no 1.8v quirk */
-                        host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-                }
-        } else {
-                host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-        }
        err = sdhci_add_host(host);
        if (err)
diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
index 3497cfaf683c..a870c42731d7 100644
--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -45,6 +45,6 @@
 #define ESDHC_DMA_SYSCTL        0x40c
 #define ESDHC_DMA_SNOOP         0x00000040
-#define ESDHC_HOST_CONTROL_RES  0x05
+#define ESDHC_HOST_CONTROL_RES  0x01
 #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 9cd5fc62f130..946d37f94a31 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -411,6 +411,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
                        goto err_of_parse;
                sdhci_get_of_property(pdev);
                pdata = pxav3_get_mmc_pdata(dev);
+                pdev->dev.platform_data = pdata;
        } else if (pdata) {
                /* on-chip device */
                if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
diff --git a/drivers/mmc/host/sdhci-spear.c b/drivers/mmc/host/sdhci-spear.c
index df088343d60f..255a896769b8 100644
--- a/drivers/mmc/host/sdhci-spear.c
+++ b/drivers/mmc/host/sdhci-spear.c
@@ -4,7 +4,7 @@
 * Support of SDHCI platform devices for spear soc family
 *
 * Copyright (C) 2010 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * Inspired by sdhci-pltfm.c
 *
@@ -211,5 +211,5 @@ static struct platform_driver sdhci_driver = {
 module_platform_driver(sdhci_driver);
 MODULE_DESCRIPTION("SPEAr Secure Digital Host Controller Interface driver");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index bc1445238fb3..1dbe93232030 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2866,6 +2866,7 @@ int sdhci_add_host(struct sdhci_host *host)
        u32 max_current_caps;
        unsigned int ocr_avail;
        unsigned int override_timeout_clk;
+        u32 max_clk;
        int ret;
        WARN_ON(host == NULL);
@@ -2978,8 +2979,11 @@ int sdhci_add_host(struct sdhci_host *host)
                                                      GFP_KERNEL);
                host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL);
                if (!host->adma_table || !host->align_buffer) {
-                        dma_free_coherent(mmc_dev(mmc), host->adma_table_sz,
+                        if (host->adma_table)
-                                          host->adma_table, host->adma_addr);
+                                dma_free_coherent(mmc_dev(mmc),
+                                                  host->adma_table_sz,
+                                                  host->adma_table,
+                                                  host->adma_addr);
                        kfree(host->align_buffer);
                        pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n",
                                mmc_hostname(mmc));
@@ -3047,18 +3051,22 @@ int sdhci_add_host(struct sdhci_host *host)
         * Set host parameters.
         */
        mmc->ops = &sdhci_ops;
-        mmc->f_max = host->max_clk;
+        max_clk = host->max_clk;
        if (host->ops->get_min_clock)
                mmc->f_min = host->ops->get_min_clock(host);
        else if (host->version >= SDHCI_SPEC_300) {
                if (host->clk_mul) {
                        mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
-                        mmc->f_max = host->max_clk * host->clk_mul;
+                        max_clk = host->max_clk * host->clk_mul;
                } else
                        mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
        } else
                mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
+        if (!mmc->f_max || (mmc->f_max && (mmc->f_max > max_clk)))
+                mmc->f_max = max_clk;
        if (!(host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
                host->timeout_clk = (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >>
                                        SDHCI_TIMEOUT_CLK_SHIFT;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 19eb990d398c..e1ccefce9a9d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -625,6 +625,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev,
        call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev);
 }
+static struct slave *bond_get_old_active(struct bonding *bond,
+                                         struct slave *new_active)
+{
+        struct slave *slave;
+        struct list_head *iter;
+        bond_for_each_slave(bond, slave, iter) {
+                if (slave == new_active)
+                        continue;
+                if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr))
+                        return slave;
+        }
+        return NULL;
+}
 /* bond_do_fail_over_mac
 *
 * Perform special MAC address swapping for fail_over_mac settings
@@ -652,6 +669,9 @@ static void bond_do_fail_over_mac(struct bonding *bond,
                if (!new_active)
                        return;
+                if (!old_active)
+                        old_active = bond_get_old_active(bond, new_active);
                if (old_active) {
                        ether_addr_copy(tmp_mac, new_active->dev->dev_addr);
                        ether_addr_copy(saddr.sa_data,
@@ -689,40 +709,57 @@ out:
 }
-static bool bond_should_change_active(struct bonding *bond)
+static struct slave *bond_choose_primary_or_current(struct bonding *bond)
 {
        struct slave *prim = rtnl_dereference(bond->primary_slave);
        struct slave *curr = rtnl_dereference(bond->curr_active_slave);
-        if (!prim || !curr || curr->link != BOND_LINK_UP)
+        if (!prim || prim->link != BOND_LINK_UP) {
-                return true;
+                if (!curr || curr->link != BOND_LINK_UP)
+                        return NULL;
+                return curr;
+        }
        if (bond->force_primary) {
                bond->force_primary = false;
-                return true;
+                return prim;
+        }
+        if (!curr || curr->link != BOND_LINK_UP)
+                return prim;
+        /* At this point, prim and curr are both up */
+        switch (bond->params.primary_reselect) {
+        case BOND_PRI_RESELECT_ALWAYS:
+                return prim;
+        case BOND_PRI_RESELECT_BETTER:
+                if (prim->speed < curr->speed)
+                        return curr;
+                if (prim->speed == curr->speed && prim->duplex <= curr->duplex)
+                        return curr;
+                return prim;
+        case BOND_PRI_RESELECT_FAILURE:
+                return curr;
+        default:
+                netdev_err(bond->dev, "impossible primary_reselect %d\n",
+                           bond->params.primary_reselect);
+                return curr;
        }
-        if (bond->params.primary_reselect == BOND_PRI_RESELECT_BETTER &&
-            (prim->speed < curr->speed ||
-             (prim->speed == curr->speed && prim->duplex <= curr->duplex)))
-                return false;
-        if (bond->params.primary_reselect == BOND_PRI_RESELECT_FAILURE)
-                return false;
-        return true;
 }
 /**
- * find_best_interface - select the best available slave to be the active one
+ * bond_find_best_slave - select the best available slave to be the active one
 * @bond: our bonding struct
 */
 static struct slave *bond_find_best_slave(struct bonding *bond)
 {
-        struct slave *slave, *bestslave = NULL, *primary;
+        struct slave *slave, *bestslave = NULL;
        struct list_head *iter;
        int mintime = bond->params.updelay;
-        primary = rtnl_dereference(bond->primary_slave);
+        slave = bond_choose_primary_or_current(bond);
-        if (primary && primary->link == BOND_LINK_UP &&
+        if (slave)
-            bond_should_change_active(bond))
+                return slave;
-                return primary;
        bond_for_each_slave(bond, slave, iter) {
                if (slave->link == BOND_LINK_UP)
@@ -1708,9 +1745,16 @@ err_free:
 err_undo_flags:
        /* Enslave of first slave has failed and we need to fix master's mac */
-        if (!bond_has_slaves(bond) &&
+        if (!bond_has_slaves(bond)) {
-            ether_addr_equal_64bits(bond_dev->dev_addr, slave_dev->dev_addr))
+                if (ether_addr_equal_64bits(bond_dev->dev_addr,
-                eth_hw_addr_random(bond_dev);
+                                            slave_dev->dev_addr))
+                        eth_hw_addr_random(bond_dev);
+                if (bond_dev->type != ARPHRD_ETHER) {
+                        ether_setup(bond_dev);
+                        bond_dev->flags |= IFF_MASTER;
+                        bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+                }
+        }
        return res;
 }
@@ -1899,6 +1943,7 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
                bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
                netdev_info(bond_dev, "Destroying bond %s\n",
                            bond_dev->name);
+                bond_remove_proc_entry(bond);
                unregister_netdevice(bond_dev);
        }
        return ret;
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index f4e40aa4d2a2..945c0955a967 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -577,10 +577,10 @@ static void at91_rx_overflow_err(struct net_device *dev)
        cf->can_id |= CAN_ERR_CRTL;
        cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 }
 /**
@@ -642,10 +642,10 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
        }
        at91_read_mb(dev, mb, cf);
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        can_led_event(dev, CAN_LED_EVENT_RX);
 }
@@ -802,10 +802,10 @@ static int at91_poll_err(struct net_device *dev, int quota, u32 reg_sr)
                return 0;
        at91_poll_err_frame(dev, cf, reg_sr);
-        netif_receive_skb(skb);
        dev->stats.rx_packets++;
        dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
@@ -1067,10 +1067,10 @@ static void at91_irq_err(struct net_device *dev)
                return;
        at91_irq_err_state(dev, cf, new_state);
-        netif_rx(skb);
        dev->stats.rx_packets++;
        dev->stats.rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        priv->can.state = new_state;
 }
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index 27ad312e7abf..57dadd52b428 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -424,10 +424,9 @@ static void bfin_can_rx(struct net_device *dev, u16 isrc)
                cf->data[6 - i] = (6 - i) < cf->can_dlc ? (val >> 8) : 0;
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
@@ -508,10 +507,9 @@ static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
        priv->can.state = state;
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        return 0;
 }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 041525d2595c..5d214d135332 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
        int err;
+        struct pinctrl *p;
        /* basic c_can configuration */
        err = c_can_chip_config(dev);
@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-        /* activate pins */
+        /* Attempt to use "active" if available else use "default" */
-        pinctrl_pm_select_default_state(dev->dev.parent);
+        p = pinctrl_get_select(priv->device, "active");
+        if (!IS_ERR(p))
+                pinctrl_put(p);
+        else
+                pinctrl_pm_select_default_state(priv->device);
        return 0;
 }
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
index c11d44984036..70a8cbb29e75 100644
--- a/drivers/net/can/cc770/cc770.c
+++ b/drivers/net/can/cc770/cc770.c
@@ -504,10 +504,10 @@ static void cc770_rx(struct net_device *dev, unsigned int mo, u8 ctrl1)
                for (i = 0; i < cf->can_dlc; i++)
                        cf->data[i] = cc770_read_reg(priv, msgobj[mo].data[i]);
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 static int cc770_err(struct net_device *dev, u8 status)
@@ -584,10 +584,10 @@ static int cc770_err(struct net_device *dev, u8 status)
                }
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        return 0;
 }
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index e9b1810d319f..aede704605c6 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
                struct can_frame *cf = (struct can_frame *)skb->data;
                u8 dlc = cf->can_dlc;
-                if (!(skb->tstamp.tv64))
-                        __net_timestamp(skb);
                netif_rx(priv->echo_skb[idx]);
                priv->echo_skb[idx] = NULL;
@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
        if (unlikely(!skb))
                return NULL;
-        __net_timestamp(skb);
        skb->protocol = htons(ETH_P_CAN);
        skb->pkt_type = PACKET_BROADCAST;
        skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
        memset(*cf, 0, sizeof(struct can_frame));
@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
        if (unlikely(!skb))
                return NULL;
-        __net_timestamp(skb);
        skb->protocol = htons(ETH_P_CANFD);
        skb->pkt_type = PACKET_BROADCAST;
        skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        *cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
        memset(*cfd, 0, sizeof(struct canfd_frame));
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 6201c5a1a884..b1e8d729851c 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -577,10 +577,10 @@ static int flexcan_poll_bus_err(struct net_device *dev, u32 reg_esr)
                return 0;
        do_bus_err(dev, cf, reg_esr);
-        netif_receive_skb(skb);
        dev->stats.rx_packets++;
        dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
@@ -622,10 +622,9 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
        if (unlikely(new_state == CAN_STATE_BUS_OFF))
                can_bus_off(dev);
-        netif_receive_skb(skb);
        dev->stats.rx_packets++;
        dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
@@ -670,10 +669,10 @@ static int flexcan_read_frame(struct net_device *dev)
        }
        flexcan_read_fifo(dev, cf);
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        can_led_event(dev, CAN_LED_EVENT_RX);
diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
index e3d7e22a4fa0..db9538d4b358 100644
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1216,11 +1216,12 @@ static int grcan_receive(struct net_device *dev, int budget)
                                cf->data[i] = (u8)(slot[j] >> shift);
                        }
                }
-                netif_receive_skb(skb);
                /* Update statistics and read pointer */
                stats->rx_packets++;
                stats->rx_bytes += cf->can_dlc;
+                netif_receive_skb(skb);
                rd = grcan_ring_add(rd, GRCAN_MSG_SIZE, dma->rx.size);
        }
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 7deb80dcbe8c..7bd54191f962 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -508,7 +508,8 @@ static int rcar_can_open(struct net_device *ndev)
        err = clk_prepare_enable(priv->clk);
        if (err) {
-                netdev_err(ndev, "failed to enable periperal clock, error %d\n",
+                netdev_err(ndev,
+                           "failed to enable peripheral clock, error %d\n",
                           err);
                goto out;
        }
@@ -526,7 +527,8 @@ static int rcar_can_open(struct net_device *ndev)
        napi_enable(&priv->napi);
        err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
        if (err) {
-                netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
+                netdev_err(ndev, "request_irq(%d) failed, error %d\n",
+                           ndev->irq, err);
                goto out_close;
        }
        can_led_event(ndev, CAN_LED_EVENT_OPEN);
@@ -758,8 +760,9 @@ static int rcar_can_probe(struct platform_device *pdev)
        }
        irq = platform_get_irq(pdev, 0);
-        if (!irq) {
+        if (irq < 0) {
                dev_err(&pdev->dev, "No IRQ resource\n");
+                err = irq;
                goto fail;
        }
@@ -782,7 +785,8 @@ static int rcar_can_probe(struct platform_device *pdev)
        priv->clk = devm_clk_get(&pdev->dev, "clkp1");
        if (IS_ERR(priv->clk)) {
                err = PTR_ERR(priv->clk);
-                dev_err(&pdev->dev, "cannot get peripheral clock: %d\n", err);
+                dev_err(&pdev->dev, "cannot get peripheral clock, error %d\n",
+                        err);
                goto fail_clk;
        }
@@ -794,7 +798,7 @@ static int rcar_can_probe(struct platform_device *pdev)
        priv->can_clk = devm_clk_get(&pdev->dev, clock_names[clock_select]);
        if (IS_ERR(priv->can_clk)) {
                err = PTR_ERR(priv->can_clk);
-                dev_err(&pdev->dev, "cannot get CAN clock: %d\n", err);
+                dev_err(&pdev->dev, "cannot get CAN clock, error %d\n", err);
                goto fail_clk;
        }
@@ -823,7 +827,7 @@ static int rcar_can_probe(struct platform_device *pdev)
        devm_can_led_init(ndev);
-        dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
+        dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
                 priv->regs, ndev->irq);
        return 0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 32bd7f451aa4..7b92e911a616 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -377,10 +377,9 @@ static void sja1000_rx(struct net_device *dev)
        /* release receive buffer */
        sja1000_write_cmdreg(priv, CMD_RRB);
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        can_led_event(dev, CAN_LED_EVENT_RX);
 }
@@ -484,10 +483,9 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
                        can_bus_off(dev);
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        return 0;
 }
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f64f5290d6f8..9a3f15cb7ef4 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
        if (!skb)
                return;
-        __net_timestamp(skb);
        skb->dev = sl->dev;
        skb->protocol = htons(ETH_P_CAN);
        skb->pkt_type = PACKET_BROADCAST;
@@ -215,13 +214,14 @@ static void slc_bump(struct slcan *sl)
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = sl->dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        memcpy(skb_put(skb, sizeof(struct can_frame)),
               &cf, sizeof(struct can_frame));
-        netif_rx_ni(skb);
        sl->dev->stats.rx_packets++;
        sl->dev->stats.rx_bytes += cf.can_dlc;
+        netif_rx_ni(skb);
 }
 /* parse tty input stream */
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index c1a95a34d62e..b7e83c212023 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -1086,8 +1086,8 @@ static int mcp251x_can_probe(struct spi_device *spi)
        if (ret)
                goto out_clk;
-        priv->power = devm_regulator_get(&spi->dev, "vdd");
+        priv->power = devm_regulator_get_optional(&spi->dev, "vdd");
-        priv->transceiver = devm_regulator_get(&spi->dev, "xceiver");
+        priv->transceiver = devm_regulator_get_optional(&spi->dev, "xceiver");
        if ((PTR_ERR(priv->power) == -EPROBE_DEFER) ||
            (PTR_ERR(priv->transceiver) == -EPROBE_DEFER)) {
                ret = -EPROBE_DEFER;
@@ -1222,17 +1222,16 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
        struct spi_device *spi = to_spi_device(dev);
        struct mcp251x_priv *priv = spi_get_drvdata(spi);
-        if (priv->after_suspend & AFTER_SUSPEND_POWER) {
+        if (priv->after_suspend & AFTER_SUSPEND_POWER)
                mcp251x_power_enable(priv->power, 1);
+        if (priv->after_suspend & AFTER_SUSPEND_UP) {
+                mcp251x_power_enable(priv->transceiver, 1);
                queue_work(priv->wq, &priv->restart_work);
        } else {
-                if (priv->after_suspend & AFTER_SUSPEND_UP) {
+                priv->after_suspend = 0;
-                        mcp251x_power_enable(priv->transceiver, 1);
-                        queue_work(priv->wq, &priv->restart_work);
-                } else {
-                        priv->after_suspend = 0;
-                }
        }
        priv->force_quit = 0;
        enable_irq(spi->irq);
        return 0;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index e95a9e1a889f..cf345cbfe819 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -747,9 +747,9 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
                }
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        return 0;
 }
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 866bac0ae7e9..2d390384ef3b 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -324,10 +324,9 @@ static void ems_usb_rx_can_msg(struct ems_usb *dev, struct ems_cpc_msg *msg)
                        cf->data[i] = msg->msg.can_msg.msg[i];
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
@@ -400,10 +399,9 @@ static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
                stats->rx_errors++;
        }
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 /*
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 411c1af92c62..0e5a4493ba4f 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -301,13 +301,12 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
                        cf->data[7] = rxerr;
                }
-                netif_rx(skb);
                priv->bec.txerr = txerr;
                priv->bec.rxerr = rxerr;
                stats->rx_packets++;
                stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
        }
 }
@@ -347,10 +346,9 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv,
                                cf->data[i] = msg->msg.rx.data[i];
                }
-                netif_rx(skb);
                stats->rx_packets++;
                stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
        }
        return;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 72427f21edff..6b94007ae052 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -526,9 +526,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
                hwts->hwtstamp = timeval_to_ktime(tv);
        }
-        netif_rx(skb);
        mc->netdev->stats.rx_packets++;
        mc->netdev->stats.rx_bytes += cf->can_dlc;
+        netif_rx(skb);
        return 0;
 }
@@ -659,12 +659,11 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
        hwts = skb_hwtstamps(skb);
        hwts->hwtstamp = timeval_to_ktime(tv);
-        /* push the skb */
-        netif_rx(skb);
        /* update statistics */
        mc->netdev->stats.rx_packets++;
        mc->netdev->stats.rx_bytes += cf->can_dlc;
+        /* push the skb */
+        netif_rx(skb);
        return 0;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index dec51717635e..7d61b3279798 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -553,9 +553,9 @@ static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
        hwts = skb_hwtstamps(skb);
        hwts->hwtstamp = timeval_to_ktime(tv);
-        netif_rx(skb);
        netdev->stats.rx_packets++;
        netdev->stats.rx_bytes += can_frame->can_dlc;
+        netif_rx(skb);
        return 0;
 }
@@ -670,9 +670,9 @@ static int pcan_usb_pro_handle_error(struct pcan_usb_pro_interface *usb_if,
        peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(er->ts32), &tv);
        hwts = skb_hwtstamps(skb);
        hwts->hwtstamp = timeval_to_ktime(tv);
-        netif_rx(skb);
        netdev->stats.rx_packets++;
        netdev->stats.rx_bytes += can_frame->can_dlc;
+        netif_rx(skb);
        return 0;
 }
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index dd52c7a4c80d..de95b1ccba3e 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -461,10 +461,9 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv,
        priv->bec.txerr = txerr;
        priv->bec.rxerr = rxerr;
-        netif_rx(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 /* Read data and status frames */
@@ -494,10 +493,9 @@ static void usb_8dev_rx_can_msg(struct usb_8dev_priv *priv,
                else
                        memcpy(cf->data, msg->data, cf->can_dlc);
-                netif_rx(skb);
                stats->rx_packets++;
                stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
                can_led_event(priv->netdev, CAN_LED_EVENT_RX);
        } else {
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index 0ce868de855d..674f367087c5 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
        skb->dev       = dev;
        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        if (!(skb->tstamp.tv64))
-                __net_timestamp(skb);
        netif_rx_ni(skb);
 }
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 972982f8bea7..079897b3a955 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -696,9 +696,20 @@ static int bcm_sf2_sw_setup(struct dsa_switch *ds)
        }
        /* Include the pseudo-PHY address and the broadcast PHY address to
-         * divert reads towards our workaround
+         * divert reads towards our workaround. This is only required for
+         * 7445D0, since 7445E0 disconnects the internal switch pseudo-PHY such
+         * that we can use the regular SWITCH_MDIO master controller instead.
+         *
+         * By default, DSA initializes ds->phys_mii_mask to ds->phys_port_mask
+         * to have a 1:1 mapping between Port address and PHY address in order
+         * to utilize the slave_mii_bus instance to read from Port PHYs. This is
+         * not what we want here, so we initialize phys_mii_mask 0 to always
+         * utilize the "master" MDIO bus backed by the "mdio-unimac" driver.
         */
-        ds->phys_mii_mask |= ((1 << BRCM_PSEUDO_PHY_ADDR) | (1 << 0));
+        if (of_machine_is_compatible("brcm,bcm7445d0"))
+                ds->phys_mii_mask |= ((1 << BRCM_PSEUDO_PHY_ADDR) | (1 << 0));
+        else
+                ds->phys_mii_mask = 0;
        rev = reg_readl(priv, REG_SWITCH_REVISION);
        priv->hw_params.top_rev = (rev >> SWITCH_TOP_REV_SHIFT) &
diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
index fd8547c2b79d..561342466076 100644
--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -1163,7 +1163,7 @@ int mv88e6xxx_leave_bridge(struct dsa_switch *ds, int port, u32 br_port_mask)
        newfid = __ffs(ps->fid_mask);
        ps->fid[port] = newfid;
-        ps->fid_mask &= (1 << newfid);
+        ps->fid_mask &= ~(1 << newfid);
        ps->bridge_mask[fid] &= ~(1 << port);
        ps->bridge_mask[newfid] = 1 << port;
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 41095ebad97f..2d1ce3c5d0dd 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -2382,6 +2382,7 @@ boomerang_interrupt(int irq, void *dev_id)
        void __iomem *ioaddr;
        int status;
        int work_done = max_interrupt_work;
+        int handled = 0;
        ioaddr = vp->ioaddr;
@@ -2400,6 +2401,7 @@ boomerang_interrupt(int irq, void *dev_id)
        if ((status & IntLatch) == 0)
                goto handler_exit;              /* No interrupt: shared IRQs can cause this */
+        handled = 1;
        if (status == 0xffff) {         /* h/w no longer present (hotplug)? */
                if (vortex_debug > 1)
@@ -2501,7 +2503,7 @@ boomerang_interrupt(int irq, void *dev_id)
 handler_exit:
        vp->handling_irq = 0;
        spin_unlock(&vp->lock);
-        return IRQ_HANDLED;
+        return IRQ_RETVAL(handled);
 }
 static int vortex_rx(struct net_device *dev)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index 661cdaa7ea96..b3bc87fe3764 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -303,7 +303,8 @@ static void xgbe_set_buffer_data(struct xgbe_buffer_data *bd,
        get_page(pa->pages);
        bd->pa = *pa;
-        bd->dma = pa->pages_dma + pa->pages_offset;
+        bd->dma_base = pa->pages_dma;
+        bd->dma_off = pa->pages_offset;
        bd->dma_len = len;
        pa->pages_offset += len;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 506e832c9e9a..a4473d8ff4fa 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1110,6 +1110,7 @@ static void xgbe_rx_desc_reset(struct xgbe_prv_data *pdata,
        unsigned int rx_usecs = pdata->rx_usecs;
        unsigned int rx_frames = pdata->rx_frames;
        unsigned int inte;
+        dma_addr_t hdr_dma, buf_dma;
        if (!rx_usecs && !rx_frames) {
                /* No coalescing, interrupt for every descriptor */
@@ -1129,10 +1130,12 @@ static void xgbe_rx_desc_reset(struct xgbe_prv_data *pdata,
         *   Set buffer 2 (hi) address to buffer dma address (hi) and
         *     set control bits OWN and INTE
         */
-        rdesc->desc0 = cpu_to_le32(lower_32_bits(rdata->rx.hdr.dma));
+        hdr_dma = rdata->rx.hdr.dma_base + rdata->rx.hdr.dma_off;
-        rdesc->desc1 = cpu_to_le32(upper_32_bits(rdata->rx.hdr.dma));
+        buf_dma = rdata->rx.buf.dma_base + rdata->rx.buf.dma_off;
-        rdesc->desc2 = cpu_to_le32(lower_32_bits(rdata->rx.buf.dma));
+        rdesc->desc0 = cpu_to_le32(lower_32_bits(hdr_dma));
-        rdesc->desc3 = cpu_to_le32(upper_32_bits(rdata->rx.buf.dma));
+        rdesc->desc1 = cpu_to_le32(upper_32_bits(hdr_dma));
+        rdesc->desc2 = cpu_to_le32(lower_32_bits(buf_dma));
+        rdesc->desc3 = cpu_to_le32(upper_32_bits(buf_dma));
        XGMAC_SET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, INTE, inte);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 1e9c28d19ef8..aae9d5ecd182 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1765,8 +1765,9 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
        /* Start with the header buffer which may contain just the header
         * or the header plus data
         */
-        dma_sync_single_for_cpu(pdata->dev, rdata->rx.hdr.dma,
+        dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
-                                rdata->rx.hdr.dma_len, DMA_FROM_DEVICE);
+                                      rdata->rx.hdr.dma_off,
+                                      rdata->rx.hdr.dma_len, DMA_FROM_DEVICE);
        packet = page_address(rdata->rx.hdr.pa.pages) +
                 rdata->rx.hdr.pa.pages_offset;
@@ -1778,8 +1779,11 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
        len -= copy_len;
        if (len) {
                /* Add the remaining data as a frag */
-                dma_sync_single_for_cpu(pdata->dev, rdata->rx.buf.dma,
+                dma_sync_single_range_for_cpu(pdata->dev,
-                                        rdata->rx.buf.dma_len, DMA_FROM_DEVICE);
+                                              rdata->rx.buf.dma_base,
+                                              rdata->rx.buf.dma_off,
+                                              rdata->rx.buf.dma_len,
+                                              DMA_FROM_DEVICE);
                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                rdata->rx.buf.pa.pages,
@@ -1945,8 +1949,9 @@ read_again:
                                if (!skb)
                                        error = 1;
                        } else if (rdesc_len) {
-                                dma_sync_single_for_cpu(pdata->dev,
+                                dma_sync_single_range_for_cpu(pdata->dev,
-                                                        rdata->rx.buf.dma,
+                                                        rdata->rx.buf.dma_base,
+                                                        rdata->rx.buf.dma_off,
                                                        rdata->rx.buf.dma_len,
                                                        DMA_FROM_DEVICE);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 63d72a140053..717ce21b6077 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -337,7 +337,8 @@ struct xgbe_buffer_data {
        struct xgbe_page_alloc pa;
        struct xgbe_page_alloc pa_unmap;
-        dma_addr_t dma;
+        dma_addr_t dma_base;
+        unsigned long dma_off;
        unsigned int dma_len;
 };
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 909ad7a0d480..4566cdf0bc39 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1793,7 +1793,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
        macaddr = of_get_mac_address(dn);
        if (!macaddr || !is_valid_ether_addr(macaddr)) {
                dev_warn(&pdev->dev, "using random Ethernet MAC\n");
-                random_ether_addr(dev->dev_addr);
+                eth_hw_addr_random(dev);
        } else {
                ether_addr_copy(dev->dev_addr, macaddr);
        }
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index b43b2cb9b830..64c1e9db6b0b 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1230,7 +1230,6 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct net_device *dev,
                new_skb = skb_realloc_headroom(skb, sizeof(*status));
                dev_kfree_skb(skb);
                if (!new_skb) {
-                        dev->stats.tx_errors++;
                        dev->stats.tx_dropped++;
                        return NULL;
                }
@@ -1465,7 +1464,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
                if (unlikely(!skb)) {
                        dev->stats.rx_dropped++;
-                        dev->stats.rx_errors++;
                        goto next;
                }
@@ -1493,7 +1491,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
                if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) {
                        netif_err(priv, rx_status, dev,
                                  "dropping fragmented packet!\n");
-                        dev->stats.rx_dropped++;
                        dev->stats.rx_errors++;
                        dev_kfree_skb_any(skb);
                        goto next;
@@ -1515,7 +1512,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
                                dev->stats.rx_frame_errors++;
                        if (dma_flag & DMA_RX_LG)
                                dev->stats.rx_length_errors++;
-                        dev->stats.rx_dropped++;
                        dev->stats.rx_errors++;
                        dev_kfree_skb_any(skb);
                        goto next;
diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
index ac27e24264a5..f557a2aaec23 100644
--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
@@ -1508,16 +1508,7 @@ static void sbmac_channel_start(struct sbmac_softc *s)
        __raw_writeq(reg, port);
        port = s->sbm_base + R_MAC_ETHERNET_ADDR;
-#ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
-        /*
-         * Pass1 SOCs do not receive packets addressed to the
-         * destination address in the R_MAC_ETHERNET_ADDR register.
-         * Set the value to zero.
-         */
-        __raw_writeq(0, port);
-#else
        __raw_writeq(reg, port);
-#endif
        /*
         * Set the receive filter for no packets, and write values
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 484eb8c37489..a11485fbb33f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -952,16 +952,23 @@ static int devlog_show(struct seq_file *seq, void *v)
                 * eventually have to put a format interpreter in here ...
                 */
                seq_printf(seq, "%10d  %15llu  %8s  %8s  ",
-                           e->seqno, e->timestamp,
+                           be32_to_cpu(e->seqno),
+                           be64_to_cpu(e->timestamp),
                           (e->level < ARRAY_SIZE(devlog_level_strings)
                            ? devlog_level_strings[e->level]
                            : "UNKNOWN"),
                           (e->facility < ARRAY_SIZE(devlog_facility_strings)
                            ? devlog_facility_strings[e->facility]
                            : "UNKNOWN"));
-                seq_printf(seq, e->fmt, e->params[0], e->params[1],
+                seq_printf(seq, e->fmt,
-                           e->params[2], e->params[3], e->params[4],
+                           be32_to_cpu(e->params[0]),
-                           e->params[5], e->params[6], e->params[7]);
+                           be32_to_cpu(e->params[1]),
+                           be32_to_cpu(e->params[2]),
+                           be32_to_cpu(e->params[3]),
+                           be32_to_cpu(e->params[4]),
+                           be32_to_cpu(e->params[5]),
+                           be32_to_cpu(e->params[6]),
+                           be32_to_cpu(e->params[7]));
        }
        return 0;
 }
@@ -1043,23 +1050,17 @@ static int devlog_open(struct inode *inode, struct file *file)
                return ret;
        }
-        /* Translate log multi-byte integral elements into host native format
+        /* Find the earliest (lowest Sequence Number) log entry in the
-         * and determine where the first entry in the log is.
+         * circular Device Log.
         */
        for (fseqno = ~((u32)0), index = 0; index < dinfo->nentries; index++) {
                struct fw_devlog_e *e = &dinfo->log[index];
-                int i;
                __u32 seqno;
                if (e->timestamp == 0)
                        continue;
-                e->timestamp = (__force __be64)be64_to_cpu(e->timestamp);
                seqno = be32_to_cpu(e->seqno);
-                for (i = 0; i < 8; i++)
-                        e->params[i] =
-                                (__force __be32)be32_to_cpu(e->params[i]);
                if (seqno < fseqno) {
                        fseqno = seqno;
                        dinfo->first = index;
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index da2004e2a741..918a8e42139b 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1170,7 +1170,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
                                                 wq_work_done,
                                                 0 /* dont unmask intr */,
                                                 0 /* dont reset intr timer */);
-                return rq_work_done;
+                return budget;
        }
        if (budget > 0)
@@ -1191,6 +1191,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
                        0 /* don't reset intr timer */);
        err = vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf);
+        enic_poll_unlock_napi(&enic->rq[cq_rq], napi);
        /* Buffer allocation failed. Stay in polling
         * mode so we can try to fill the ring again.
@@ -1208,7 +1209,6 @@ static int enic_poll(struct napi_struct *napi, int budget)
                napi_complete(napi);
                vnic_intr_unmask(&enic->intr[intr]);
        }
-        enic_poll_unlock_napi(&enic->rq[cq_rq], napi);
        return rq_work_done;
 }
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 370e20ed224c..62e48bc0cb23 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1462,7 +1462,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                     struct mvneta_rx_queue *rxq)
 {
        struct net_device *dev = pp->dev;
-        int rx_done, rx_filled;
+        int rx_done;
        u32 rcvd_pkts = 0;
        u32 rcvd_bytes = 0;
@@ -1473,7 +1473,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                rx_todo = rx_done;
        rx_done = 0;
-        rx_filled = 0;
        /* Fairness NAPI loop */
        while (rx_done < rx_todo) {
@@ -1484,7 +1483,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                int rx_bytes, err;
                rx_done++;
-                rx_filled++;
                rx_status = rx_desc->status;
                rx_bytes = rx_desc->data_size - (ETH_FCS_LEN + MVNETA_MH_SIZE);
                data = (unsigned char *)rx_desc->buf_cookie;
@@ -1524,6 +1522,14 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                        continue;
                }
+                /* Refill processing */
+                err = mvneta_rx_refill(pp, rx_desc);
+                if (err) {
+                        netdev_err(dev, "Linux processing - Can't refill\n");
+                        rxq->missed++;
+                        goto err_drop_frame;
+                }
                skb = build_skb(data, pp->frag_size > PAGE_SIZE ? 0 : pp->frag_size);
                if (!skb)
                        goto err_drop_frame;
@@ -1543,14 +1549,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                mvneta_rx_csum(pp, rx_status, skb);
                napi_gro_receive(&pp->napi, skb);
-                /* Refill processing */
-                err = mvneta_rx_refill(pp, rx_desc);
-                if (err) {
-                        netdev_err(dev, "Linux processing - Can't refill\n");
-                        rxq->missed++;
-                        rx_filled--;
-                }
        }
        if (rcvd_pkts) {
@@ -1563,7 +1561,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
        }
        /* Update rxq management counters */
-        mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_filled);
+        mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_done);
        return rx_done;
 }
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index fd9745714d90..78849dd4ef8e 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -228,9 +228,7 @@ static void ravb_ring_format(struct net_device *ndev, int q)
        struct ravb_desc *desc = NULL;
        int rx_ring_size = sizeof(*rx_desc) * priv->num_rx_ring[q];
        int tx_ring_size = sizeof(*tx_desc) * priv->num_tx_ring[q];
-        struct sk_buff *skb;
        dma_addr_t dma_addr;
-        void *buffer;
        int i;
        priv->cur_rx[q] = 0;
@@ -241,41 +239,28 @@ static void ravb_ring_format(struct net_device *ndev, int q)
        memset(priv->rx_ring[q], 0, rx_ring_size);
        /* Build RX ring buffer */
        for (i = 0; i < priv->num_rx_ring[q]; i++) {
-                priv->rx_skb[q][i] = NULL;
-                skb = netdev_alloc_skb(ndev, PKT_BUF_SZ + RAVB_ALIGN - 1);
-                if (!skb)
-                        break;
-                ravb_set_buffer_align(skb);
                /* RX descriptor */
                rx_desc = &priv->rx_ring[q][i];
                /* The size of the buffer should be on 16-byte boundary. */
                rx_desc->ds_cc = cpu_to_le16(ALIGN(PKT_BUF_SZ, 16));
-                dma_addr = dma_map_single(&ndev->dev, skb->data,
+                dma_addr = dma_map_single(&ndev->dev, priv->rx_skb[q][i]->data,
                                          ALIGN(PKT_BUF_SZ, 16),
                                          DMA_FROM_DEVICE);
-                if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                /* We just set the data size to 0 for a failed mapping which
-                        dev_kfree_skb(skb);
+                 * should prevent DMA from happening...
-                        break;
+                 */
-                }
+                if (dma_mapping_error(&ndev->dev, dma_addr))
-                priv->rx_skb[q][i] = skb;
+                        rx_desc->ds_cc = cpu_to_le16(0);
                rx_desc->dptr = cpu_to_le32(dma_addr);
                rx_desc->die_dt = DT_FEMPTY;
        }
        rx_desc = &priv->rx_ring[q][i];
        rx_desc->dptr = cpu_to_le32((u32)priv->rx_desc_dma[q]);
        rx_desc->die_dt = DT_LINKFIX; /* type */
-        priv->dirty_rx[q] = (u32)(i - priv->num_rx_ring[q]);
        memset(priv->tx_ring[q], 0, tx_ring_size);
        /* Build TX ring buffer */
        for (i = 0; i < priv->num_tx_ring[q]; i++) {
-                priv->tx_skb[q][i] = NULL;
-                priv->tx_buffers[q][i] = NULL;
-                buffer = kmalloc(PKT_BUF_SZ + RAVB_ALIGN - 1, GFP_KERNEL);
-                if (!buffer)
-                        break;
-                /* Aligned TX buffer */
-                priv->tx_buffers[q][i] = buffer;
                tx_desc = &priv->tx_ring[q][i];
                tx_desc->die_dt = DT_EEMPTY;
        }
@@ -298,7 +283,10 @@ static void ravb_ring_format(struct net_device *ndev, int q)
 static int ravb_ring_init(struct net_device *ndev, int q)
 {
        struct ravb_private *priv = netdev_priv(ndev);
+        struct sk_buff *skb;
        int ring_size;
+        void *buffer;
+        int i;
        /* Allocate RX and TX skb rings */
        priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -308,12 +296,28 @@ static int ravb_ring_init(struct net_device *ndev, int q)
        if (!priv->rx_skb[q] || !priv->tx_skb[q])
                goto error;
+        for (i = 0; i < priv->num_rx_ring[q]; i++) {
+                skb = netdev_alloc_skb(ndev, PKT_BUF_SZ + RAVB_ALIGN - 1);
+                if (!skb)
+                        goto error;
+                ravb_set_buffer_align(skb);
+                priv->rx_skb[q][i] = skb;
+        }
        /* Allocate rings for the aligned buffers */
        priv->tx_buffers[q] = kcalloc(priv->num_tx_ring[q],
                                      sizeof(*priv->tx_buffers[q]), GFP_KERNEL);
        if (!priv->tx_buffers[q])
                goto error;
+        for (i = 0; i < priv->num_tx_ring[q]; i++) {
+                buffer = kmalloc(PKT_BUF_SZ + RAVB_ALIGN - 1, GFP_KERNEL);
+                if (!buffer)
+                        goto error;
+                /* Aligned TX buffer */
+                priv->tx_buffers[q][i] = buffer;
+        }
        /* Allocate all RX descriptors. */
        ring_size = sizeof(struct ravb_ex_rx_desc) * (priv->num_rx_ring[q] + 1);
        priv->rx_ring[q] = dma_alloc_coherent(NULL, ring_size,
@@ -524,6 +528,10 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                if (--boguscnt < 0)
                        break;
+                /* We use 0-byte descriptors to mark the DMA mapping errors */
+                if (!pkt_len)
+                        continue;
                if (desc_status & MSC_MC)
                        stats->multicast++;
@@ -543,10 +551,9 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                        skb = priv->rx_skb[q][entry];
                        priv->rx_skb[q][entry] = NULL;
-                        dma_sync_single_for_cpu(&ndev->dev,
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(desc->dptr),
-                                                le32_to_cpu(desc->dptr),
+                                         ALIGN(PKT_BUF_SZ, 16),
-                                                ALIGN(PKT_BUF_SZ, 16),
+                                         DMA_FROM_DEVICE);
-                                                DMA_FROM_DEVICE);
                        get_ts &= (q == RAVB_NC) ?
                                        RAVB_RXTSTAMP_TYPE_V2_L2_EVENT :
                                        ~RAVB_RXTSTAMP_TYPE_V2_L2_EVENT;
@@ -584,17 +591,15 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                        if (!skb)
                                break;  /* Better luck next round. */
                        ravb_set_buffer_align(skb);
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(desc->dptr),
-                                         ALIGN(PKT_BUF_SZ, 16),
-                                         DMA_FROM_DEVICE);
                        dma_addr = dma_map_single(&ndev->dev, skb->data,
                                                  le16_to_cpu(desc->ds_cc),
                                                  DMA_FROM_DEVICE);
                        skb_checksum_none_assert(skb);
-                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                        /* We just set the data size to 0 for a failed mapping
-                                dev_kfree_skb_any(skb);
+                         * which should prevent DMA  from happening...
-                                break;
+                         */
-                        }
+                        if (dma_mapping_error(&ndev->dev, dma_addr))
+                                desc->ds_cc = cpu_to_le16(0);
                        desc->dptr = cpu_to_le32(dma_addr);
                        priv->rx_skb[q][entry] = skb;
                }
@@ -1279,7 +1284,6 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        u32 dma_addr;
        void *buffer;
        u32 entry;
-        u32 tccr;
        spin_lock_irqsave(&priv->lock, flags);
        if (priv->cur_tx[q] - priv->dirty_tx[q] >= priv->num_tx_ring[q]) {
@@ -1328,9 +1332,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        dma_wmb();
        desc->die_dt = DT_FSINGLE;
-        tccr = ravb_read(ndev, TCCR);
+        ravb_write(ndev, ravb_read(ndev, TCCR) | (TCCR_TSRQ0 << q), TCCR);
-        if (!(tccr & (TCCR_TSRQ0 << q)))
-                ravb_write(ndev, tccr | (TCCR_TSRQ0 << q), TCCR);
        priv->cur_tx[q]++;
        if (priv->cur_tx[q] - priv->dirty_tx[q] >= priv->num_tx_ring[q] &&
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 847643455468..605cc8948594 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -101,6 +101,11 @@ static unsigned int efx_ef10_mem_map_size(struct efx_nic *efx)
        return resource_size(&efx->pci_dev->resource[bar]);
 }
+static bool efx_ef10_is_vf(struct efx_nic *efx)
+{
+        return efx->type->is_vf;
+}
 static int efx_ef10_get_pf_index(struct efx_nic *efx)
 {
        MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_FUNCTION_INFO_OUT_LEN);
@@ -677,6 +682,48 @@ static int efx_ef10_probe_pf(struct efx_nic *efx)
        return efx_ef10_probe(efx);
 }
+int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_ALLOC_IN_LEN);
+        MCDI_SET_DWORD(inbuf, VADAPTOR_ALLOC_IN_UPSTREAM_PORT_ID, port_id);
+        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_ALLOC, inbuf, sizeof(inbuf),
+                            NULL, 0, NULL);
+}
+int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_FREE_IN_LEN);
+        MCDI_SET_DWORD(inbuf, VADAPTOR_FREE_IN_UPSTREAM_PORT_ID, port_id);
+        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_FREE, inbuf, sizeof(inbuf),
+                            NULL, 0, NULL);
+}
+int efx_ef10_vport_add_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_ADD_MAC_ADDRESS_IN_LEN);
+        MCDI_SET_DWORD(inbuf, VPORT_ADD_MAC_ADDRESS_IN_VPORT_ID, port_id);
+        ether_addr_copy(MCDI_PTR(inbuf, VPORT_ADD_MAC_ADDRESS_IN_MACADDR), mac);
+        return efx_mcdi_rpc(efx, MC_CMD_VPORT_ADD_MAC_ADDRESS, inbuf,
+                            sizeof(inbuf), NULL, 0, NULL);
+}
+int efx_ef10_vport_del_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_DEL_MAC_ADDRESS_IN_LEN);
+        MCDI_SET_DWORD(inbuf, VPORT_DEL_MAC_ADDRESS_IN_VPORT_ID, port_id);
+        ether_addr_copy(MCDI_PTR(inbuf, VPORT_DEL_MAC_ADDRESS_IN_MACADDR), mac);
+        return efx_mcdi_rpc(efx, MC_CMD_VPORT_DEL_MAC_ADDRESS, inbuf,
+                            sizeof(inbuf), NULL, 0, NULL);
+}
 #ifdef CONFIG_SFC_SRIOV
 static int efx_ef10_probe_vf(struct efx_nic *efx)
 {
@@ -3804,6 +3851,72 @@ static void efx_ef10_filter_sync_rx_mode(struct efx_nic *efx)
        WARN_ON(remove_failed);
 }
+static int efx_ef10_vport_set_mac_address(struct efx_nic *efx)
+{
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        u8 mac_old[ETH_ALEN];
+        int rc, rc2;
+        /* Only reconfigure a PF-created vport */
+        if (is_zero_ether_addr(nic_data->vport_mac))
+                return 0;
+        efx_device_detach_sync(efx);
+        efx_net_stop(efx->net_dev);
+        down_write(&efx->filter_sem);
+        efx_ef10_filter_table_remove(efx);
+        up_write(&efx->filter_sem);
+        rc = efx_ef10_vadaptor_free(efx, nic_data->vport_id);
+        if (rc)
+                goto restore_filters;
+        ether_addr_copy(mac_old, nic_data->vport_mac);
+        rc = efx_ef10_vport_del_mac(efx, nic_data->vport_id,
+                                    nic_data->vport_mac);
+        if (rc)
+                goto restore_vadaptor;
+        rc = efx_ef10_vport_add_mac(efx, nic_data->vport_id,
+                                    efx->net_dev->dev_addr);
+        if (!rc) {
+                ether_addr_copy(nic_data->vport_mac, efx->net_dev->dev_addr);
+        } else {
+                rc2 = efx_ef10_vport_add_mac(efx, nic_data->vport_id, mac_old);
+                if (rc2) {
+                        /* Failed to add original MAC, so clear vport_mac */
+                        eth_zero_addr(nic_data->vport_mac);
+                        goto reset_nic;
+                }
+        }
+restore_vadaptor:
+        rc2 = efx_ef10_vadaptor_alloc(efx, nic_data->vport_id);
+        if (rc2)
+                goto reset_nic;
+restore_filters:
+        down_write(&efx->filter_sem);
+        rc2 = efx_ef10_filter_table_probe(efx);
+        up_write(&efx->filter_sem);
+        if (rc2)
+                goto reset_nic;
+        rc2 = efx_net_open(efx->net_dev);
+        if (rc2)
+                goto reset_nic;
+        netif_device_attach(efx->net_dev);
+        return rc;
+reset_nic:
+        netif_err(efx, drv, efx->net_dev,
+                  "Failed to restore when changing MAC address - scheduling reset\n");
+        efx_schedule_reset(efx, RESET_TYPE_DATAPATH);
+        return rc ? rc : rc2;
+}
 static int efx_ef10_set_mac_address(struct efx_nic *efx)
 {
        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_SET_MAC_IN_LEN);
@@ -3820,8 +3933,8 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                        efx->net_dev->dev_addr);
        MCDI_SET_DWORD(inbuf, VADAPTOR_SET_MAC_IN_UPSTREAM_PORT_ID,
                       nic_data->vport_id);
-        rc = efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_SET_MAC, inbuf,
+        rc = efx_mcdi_rpc_quiet(efx, MC_CMD_VADAPTOR_SET_MAC, inbuf,
-                          sizeof(inbuf), NULL, 0, NULL);
+                                sizeof(inbuf), NULL, 0, NULL);
        efx_ef10_filter_table_probe(efx);
        up_write(&efx->filter_sem);
@@ -3829,38 +3942,27 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                efx_net_open(efx->net_dev);
        netif_device_attach(efx->net_dev);
-#if !defined(CONFIG_SFC_SRIOV)
+#ifdef CONFIG_SFC_SRIOV
-        if (rc == -EPERM)
+        if (efx->pci_dev->is_virtfn && efx->pci_dev->physfn) {
-                netif_err(efx, drv, efx->net_dev,
-                          "Cannot change MAC address; use sfboot to enable mac-spoofing"
-                          " on this interface\n");
-#else
-        if (rc == -EPERM) {
                struct pci_dev *pci_dev_pf = efx->pci_dev->physfn;
-                /* Switch to PF and change MAC address on vport */
+                if (rc == -EPERM) {
-                if (efx->pci_dev->is_virtfn && pci_dev_pf) {
+                        struct efx_nic *efx_pf;
-                        struct efx_nic *efx_pf = pci_get_drvdata(pci_dev_pf);
-                        if (!efx_ef10_sriov_set_vf_mac(efx_pf,
+                        /* Switch to PF and change MAC address on vport */
-                                                       nic_data->vf_index,
+                        efx_pf = pci_get_drvdata(pci_dev_pf);
-                                                       efx->net_dev->dev_addr))
-                                return 0;
-                }
-                netif_err(efx, drv, efx->net_dev,
-                          "Cannot change MAC address; use sfboot to enable mac-spoofing"
-                          " on this interface\n");
-        } else if (efx->pci_dev->is_virtfn) {
-                /* Successfully changed by VF (with MAC spoofing), so update the
-                 * parent PF if possible.
-                 */
-                struct pci_dev *pci_dev_pf = efx->pci_dev->physfn;
-                if (pci_dev_pf) {
+                        rc = efx_ef10_sriov_set_vf_mac(efx_pf,
+                                                       nic_data->vf_index,
+                                                       efx->net_dev->dev_addr);
+                } else if (!rc) {
                        struct efx_nic *efx_pf = pci_get_drvdata(pci_dev_pf);
                        struct efx_ef10_nic_data *nic_data = efx_pf->nic_data;
                        unsigned int i;
+                        /* MAC address successfully changed by VF (with MAC
+                         * spoofing) so update the parent PF if possible.
+                         */
                        for (i = 0; i < efx_pf->vf_count; ++i) {
                                struct ef10_vf *vf = nic_data->vf + i;
@@ -3871,8 +3973,24 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                                }
                        }
                }
-        }
+        } else
 #endif
+        if (rc == -EPERM) {
+                netif_err(efx, drv, efx->net_dev,
+                          "Cannot change MAC address; use sfboot to enable"
+                          " mac-spoofing on this interface\n");
+        } else if (rc == -ENOSYS && !efx_ef10_is_vf(efx)) {
+                /* If the active MCFW does not support MC_CMD_VADAPTOR_SET_MAC
+                 * fall-back to the method of changing the MAC address on the
+                 * vport.  This only applies to PFs because such versions of
+                 * MCFW do not support VFs.
+                 */
+                rc = efx_ef10_vport_set_mac_address(efx);
+        } else {
+                efx_mcdi_display_error(efx, MC_CMD_VADAPTOR_SET_MAC,
+                                       sizeof(inbuf), NULL, 0, rc);
+        }
        return rc;
 }
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index 6c9b6e45509a..3c17f274e802 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -29,30 +29,6 @@ static int efx_ef10_evb_port_assign(struct efx_nic *efx, unsigned int port_id,
                            NULL, 0, NULL);
 }
-static int efx_ef10_vport_add_mac(struct efx_nic *efx,
-                                  unsigned int port_id, u8 *mac)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_ADD_MAC_ADDRESS_IN_LEN);
-        MCDI_SET_DWORD(inbuf, VPORT_ADD_MAC_ADDRESS_IN_VPORT_ID, port_id);
-        ether_addr_copy(MCDI_PTR(inbuf, VPORT_ADD_MAC_ADDRESS_IN_MACADDR), mac);
-        return efx_mcdi_rpc(efx, MC_CMD_VPORT_ADD_MAC_ADDRESS, inbuf,
-                            sizeof(inbuf), NULL, 0, NULL);
-}
-static int efx_ef10_vport_del_mac(struct efx_nic *efx,
-                                  unsigned int port_id, u8 *mac)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_DEL_MAC_ADDRESS_IN_LEN);
-        MCDI_SET_DWORD(inbuf, VPORT_DEL_MAC_ADDRESS_IN_VPORT_ID, port_id);
-        ether_addr_copy(MCDI_PTR(inbuf, VPORT_DEL_MAC_ADDRESS_IN_MACADDR), mac);
-        return efx_mcdi_rpc(efx, MC_CMD_VPORT_DEL_MAC_ADDRESS, inbuf,
-                            sizeof(inbuf), NULL, 0, NULL);
-}
 static int efx_ef10_vswitch_alloc(struct efx_nic *efx, unsigned int port_id,
                                  unsigned int vswitch_type)
 {
@@ -136,24 +112,6 @@ static int efx_ef10_vport_free(struct efx_nic *efx, unsigned int port_id)
                            NULL, 0, NULL);
 }
-static int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_ALLOC_IN_LEN);
-        MCDI_SET_DWORD(inbuf, VADAPTOR_ALLOC_IN_UPSTREAM_PORT_ID, port_id);
-        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_ALLOC, inbuf, sizeof(inbuf),
-                            NULL, 0, NULL);
-}
-static int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_FREE_IN_LEN);
-        MCDI_SET_DWORD(inbuf, VADAPTOR_FREE_IN_UPSTREAM_PORT_ID, port_id);
-        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_FREE, inbuf, sizeof(inbuf),
-                            NULL, 0, NULL);
-}
 static void efx_ef10_sriov_free_vf_vports(struct efx_nic *efx)
 {
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -640,21 +598,21 @@ int efx_ef10_sriov_set_vf_vlan(struct efx_nic *efx, int vf_i, u16 vlan,
                                  MC_CMD_VPORT_ALLOC_IN_VPORT_TYPE_NORMAL,
                                  vf->vlan, &vf->vport_id);
        if (rc)
-                goto reset_nic;
+                goto reset_nic_up_write;
 restore_mac:
        if (!is_zero_ether_addr(vf->mac)) {
                rc2 = efx_ef10_vport_add_mac(efx, vf->vport_id, vf->mac);
                if (rc2) {
                        eth_zero_addr(vf->mac);
-                        goto reset_nic;
+                        goto reset_nic_up_write;
                }
        }
 restore_evb_port:
        rc2 = efx_ef10_evb_port_assign(efx, vf->vport_id, vf_i);
        if (rc2)
-                goto reset_nic;
+                goto reset_nic_up_write;
        else
                vf->vport_assigned = 1;
@@ -662,14 +620,16 @@ restore_vadaptor:
        if (vf->efx) {
                rc2 = efx_ef10_vadaptor_alloc(vf->efx, EVB_PORT_ID_ASSIGNED);
                if (rc2)
-                        goto reset_nic;
+                        goto reset_nic_up_write;
        }
 restore_filters:
        if (vf->efx) {
                rc2 = vf->efx->type->filter_table_probe(vf->efx);
                if (rc2)
-                        goto reset_nic;
+                        goto reset_nic_up_write;
+                up_write(&vf->efx->filter_sem);
                up_write(&vf->efx->filter_sem);
@@ -681,9 +641,12 @@ restore_filters:
        }
        return rc;
+reset_nic_up_write:
+        if (vf->efx)
+                up_write(&vf->efx->filter_sem);
 reset_nic:
        if (vf->efx) {
-                up_write(&vf->efx->filter_sem);
                netif_err(efx, drv, efx->net_dev,
                          "Failed to restore VF - scheduling reset.\n");
                efx_schedule_reset(vf->efx, RESET_TYPE_DATAPATH);
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.h b/drivers/net/ethernet/sfc/ef10_sriov.h
index db4ef537c610..6d25b92cb45e 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.h
+++ b/drivers/net/ethernet/sfc/ef10_sriov.h
@@ -65,5 +65,11 @@ int efx_ef10_vswitching_restore_pf(struct efx_nic *efx);
 int efx_ef10_vswitching_restore_vf(struct efx_nic *efx);
 void efx_ef10_vswitching_remove_pf(struct efx_nic *efx);
 void efx_ef10_vswitching_remove_vf(struct efx_nic *efx);
+int efx_ef10_vport_add_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac);
+int efx_ef10_vport_del_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac);
+int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id);
+int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id);
 #endif /* EF10_SRIOV_H */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 804b9ad553d3..03bc03b67f08 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -245,11 +245,17 @@ static int efx_check_disabled(struct efx_nic *efx)
 */
 static int efx_process_channel(struct efx_channel *channel, int budget)
 {
+        struct efx_tx_queue *tx_queue;
        int spent;
        if (unlikely(!channel->enabled))
                return 0;
+        efx_for_each_channel_tx_queue(tx_queue, channel) {
+                tx_queue->pkts_compl = 0;
+                tx_queue->bytes_compl = 0;
+        }
        spent = efx_nic_process_eventq(channel, budget);
        if (spent && efx_channel_has_rx_queue(channel)) {
                struct efx_rx_queue *rx_queue =
@@ -259,6 +265,14 @@ static int efx_process_channel(struct efx_channel *channel, int budget)
                efx_fast_push_rx_descriptors(rx_queue, true);
        }
+        /* Update BQL */
+        efx_for_each_channel_tx_queue(tx_queue, channel) {
+                if (tx_queue->bytes_compl) {
+                        netdev_tx_completed_queue(tx_queue->core_txq,
+                                tx_queue->pkts_compl, tx_queue->bytes_compl);
+                }
+        }
        return spent;
 }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index d72f522bf9c3..47d1e3a96522 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -241,6 +241,8 @@ struct efx_tx_queue {
        unsigned int read_count ____cacheline_aligned_in_smp;
        unsigned int old_write_count;
        unsigned int merge_events;
+        unsigned int bytes_compl;
+        unsigned int pkts_compl;
        /* Members used only on the xmit path */
        unsigned int insert_count ____cacheline_aligned_in_smp;
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index aaf2987512b5..1833a0146571 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -617,7 +617,8 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
        EFX_BUG_ON_PARANOID(index > tx_queue->ptr_mask);
        efx_dequeue_buffers(tx_queue, index, &pkts_compl, &bytes_compl);
-        netdev_tx_completed_queue(tx_queue->core_txq, pkts_compl, bytes_compl);
+        tx_queue->pkts_compl += pkts_compl;
+        tx_queue->bytes_compl += bytes_compl;
        if (pkts_compl > 1)
                ++tx_queue->merge_events;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 50f7a7a26821..864b476f7fd5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2843,7 +2843,7 @@ int stmmac_dvr_probe(struct device *device,
        if (res->mac)
                memcpy(priv->dev->dev_addr, res->mac, ETH_ALEN);
-        dev_set_drvdata(device, priv);
+        dev_set_drvdata(device, priv->dev);
        /* Verify driver arguments */
        stmmac_verify_args();
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 462820514fae..d155bf2573cd 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -138,19 +138,6 @@ do {								\
 #define CPSW_CMINTMAX_INTVL     (1000 / CPSW_CMINTMIN_CNT)
 #define CPSW_CMINTMIN_INTVL     ((1000 / CPSW_CMINTMAX_CNT) + 1)
-#define cpsw_enable_irq(priv)   \
-        do {                    \
-                u32 i;          \
-                for (i = 0; i < priv->num_irqs; i++) \
-                        enable_irq(priv->irqs_table[i]); \
-        } while (0)
-#define cpsw_disable_irq(priv)  \
-        do {                    \
-                u32 i;          \
-                for (i = 0; i < priv->num_irqs; i++) \
-                        disable_irq_nosync(priv->irqs_table[i]); \
-        } while (0)
 #define cpsw_slave_index(priv)                          \
                ((priv->data.dual_emac) ? priv->emac_port :     \
                priv->data.active_slave)
@@ -509,9 +496,11 @@ static const struct cpsw_stats cpsw_gstrings_stats[] = {
                                (func)(slave++, ##arg);                 \
        } while (0)
 #define cpsw_get_slave_ndev(priv, __slave_no__)                         \
-        (priv->slaves[__slave_no__].ndev)
+        ((__slave_no__ < priv->data.slaves) ?                           \
+                priv->slaves[__slave_no__].ndev : NULL)
 #define cpsw_get_slave_priv(priv, __slave_no__)                         \
-        ((priv->slaves[__slave_no__].ndev) ?                            \
+        (((__slave_no__ < priv->data.slaves) &&                         \
+                (priv->slaves[__slave_no__].ndev)) ?                    \
                netdev_priv(priv->slaves[__slave_no__].ndev) : NULL)    \
 #define cpsw_dual_emac_src_port_detect(status, priv, ndev, skb)         \
@@ -781,7 +770,7 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id)
        cpsw_intr_disable(priv);
        if (priv->irq_enabled == true) {
-                cpsw_disable_irq(priv);
+                disable_irq_nosync(priv->irqs_table[0]);
                priv->irq_enabled = false;
        }
@@ -804,9 +793,7 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id)
 static int cpsw_poll(struct napi_struct *napi, int budget)
 {
        struct cpsw_priv        *priv = napi_to_priv(napi);
-        int                     num_tx, num_rx;
+        int                     num_rx;
-        num_tx = cpdma_chan_process(priv->txch, 128);
        num_rx = cpdma_chan_process(priv->rxch, budget);
        if (num_rx < budget) {
@@ -817,13 +804,12 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
                prim_cpsw = cpsw_get_slave_priv(priv, 0);
                if (prim_cpsw->irq_enabled == false) {
                        prim_cpsw->irq_enabled = true;
-                        cpsw_enable_irq(priv);
+                        enable_irq(priv->irqs_table[0]);
                }
        }
-        if (num_rx || num_tx)
+        if (num_rx)
-                cpsw_dbg(priv, intr, "poll %d rx, %d tx pkts\n",
+                cpsw_dbg(priv, intr, "poll %d rx pkts\n", num_rx);
-                         num_rx, num_tx);
        return num_rx;
 }
@@ -1333,7 +1319,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
        if (prim_cpsw->irq_enabled == false) {
                if ((priv == prim_cpsw) || !netif_running(prim_cpsw->ndev)) {
                        prim_cpsw->irq_enabled = true;
-                        cpsw_enable_irq(prim_cpsw);
+                        enable_irq(prim_cpsw->irqs_table[0]);
                }
        }
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 5ec4ed3f6c8d..ec8ed30196f3 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1617,11 +1617,11 @@ static int netcp_ndo_open(struct net_device *ndev)
        }
        mutex_unlock(&netcp_modules_lock);
-        netcp_rxpool_refill(netcp);
        napi_enable(&netcp->rx_napi);
        napi_enable(&netcp->tx_napi);
        knav_queue_enable_notify(netcp->tx_compl_q);
        knav_queue_enable_notify(netcp->rx_queue);
+        netcp_rxpool_refill(netcp);
        netif_tx_wake_all_queues(ndev);
        dev_dbg(netcp->ndev_dev, "netcp device %s opened\n", ndev->name);
        return 0;
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 4208dd7ef101..d95f9aae95e7 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1530,9 +1530,9 @@ static int axienet_probe(struct platform_device *pdev)
        /* Map device registers */
        ethres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        lp->regs = devm_ioremap_resource(&pdev->dev, ethres);
-        if (!lp->regs) {
+        if (IS_ERR(lp->regs)) {
                dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(lp->regs);
                goto free_netdev;
        }
@@ -1599,9 +1599,9 @@ static int axienet_probe(struct platform_device *pdev)
                goto free_netdev;
        }
        lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
-        if (!lp->dma_regs) {
+        if (IS_ERR(lp->dma_regs)) {
                dev_err(&pdev->dev, "could not map DMA regs\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(lp->dma_regs);
                goto free_netdev;
        }
        lp->rx_irq = irq_of_parse_and_map(np, 1);
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 7856b6ccf5c5..d95a50ae996d 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -482,6 +482,7 @@ static void bpq_setup(struct net_device *dev)
        memcpy(dev->dev_addr,  &ax25_defaddr, AX25_ADDR_LEN);
        dev->flags      = 0;
+        dev->features   = NETIF_F_LLTX; /* Allow recursion */
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
        dev->header_ops      = &ax25_header_ops;
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 953a97492fab..9542b7bac61a 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -67,8 +67,6 @@ struct ipvl_dev {
        struct ipvl_port        *port;
        struct net_device       *phy_dev;
        struct list_head        addrs;
-        int                     ipv4cnt;
-        int                     ipv6cnt;
        struct ipvl_pcpu_stats  __percpu *pcpu_stats;
        DECLARE_BITMAP(mac_filters, IPVLAN_MAC_FILTER_SIZE);
        netdev_features_t       sfeatures;
@@ -106,6 +104,11 @@ static inline struct ipvl_port *ipvlan_port_get_rcu(const struct net_device *d)
        return rcu_dereference(d->rx_handler_data);
 }
+static inline struct ipvl_port *ipvlan_port_get_rcu_bh(const struct net_device *d)
+{
+        return rcu_dereference_bh(d->rx_handler_data);
+}
 static inline struct ipvl_port *ipvlan_port_get_rtnl(const struct net_device *d)
 {
        return rtnl_dereference(d->rx_handler_data);
@@ -124,5 +127,5 @@ struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
 bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6);
 struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
                                        const void *iaddr, bool is_v6);
-void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync);
+void ipvlan_ht_addr_del(struct ipvl_addr *addr);
 #endif /* __IPVLAN_H */
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 8afbedad620d..207f62e8de9a 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -85,11 +85,9 @@ void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr)
                hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
 }
-void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync)
+void ipvlan_ht_addr_del(struct ipvl_addr *addr)
 {
        hlist_del_init_rcu(&addr->hlnode);
-        if (sync)
-                synchronize_rcu();
 }
 struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
@@ -531,7 +529,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
 int ipvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ipvl_dev *ipvlan = netdev_priv(dev);
-        struct ipvl_port *port = ipvlan_port_get_rcu(ipvlan->phy_dev);
+        struct ipvl_port *port = ipvlan_port_get_rcu_bh(ipvlan->phy_dev);
        if (!port)
                goto out;
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 1acc283160d9..20b58bdecf75 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -153,10 +153,9 @@ static int ipvlan_open(struct net_device *dev)
        else
                dev->flags &= ~IFF_NOARP;
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
+        list_for_each_entry(addr, &ipvlan->addrs, anode)
-                list_for_each_entry(addr, &ipvlan->addrs, anode)
+                ipvlan_ht_addr_add(ipvlan, addr);
-                        ipvlan_ht_addr_add(ipvlan, addr);
-        }
        return dev_uc_add(phy_dev, phy_dev->dev_addr);
 }
@@ -171,10 +170,9 @@ static int ipvlan_stop(struct net_device *dev)
        dev_uc_del(phy_dev, phy_dev->dev_addr);
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
+        list_for_each_entry(addr, &ipvlan->addrs, anode)
-                list_for_each_entry(addr, &ipvlan->addrs, anode)
+                ipvlan_ht_addr_del(addr);
-                        ipvlan_ht_addr_del(addr, !dev->dismantle);
-        }
        return 0;
 }
@@ -471,8 +469,6 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
        ipvlan->port = port;
        ipvlan->sfeatures = IPVLAN_FEATURES;
        INIT_LIST_HEAD(&ipvlan->addrs);
-        ipvlan->ipv4cnt = 0;
-        ipvlan->ipv6cnt = 0;
        /* TODO Probably put random address here to be presented to the
         * world but keep using the physical-dev address for the outgoing
@@ -508,12 +504,12 @@ static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
        struct ipvl_dev *ipvlan = netdev_priv(dev);
        struct ipvl_addr *addr, *next;
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
+        list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
-                list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
+                ipvlan_ht_addr_del(addr);
-                        ipvlan_ht_addr_del(addr, !dev->dismantle);
+                list_del(&addr->anode);
-                        list_del(&addr->anode);
+                kfree_rcu(addr, rcu);
-                }
        }
        list_del_rcu(&ipvlan->pnode);
        unregister_netdevice_queue(dev, head);
        netdev_upper_dev_unlink(ipvlan->phy_dev, dev);
@@ -627,7 +623,7 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
        memcpy(&addr->ip6addr, ip6_addr, sizeof(struct in6_addr));
        addr->atype = IPVL_IPV6;
        list_add_tail(&addr->anode, &ipvlan->addrs);
-        ipvlan->ipv6cnt++;
        /* If the interface is not up, the address will be added to the hash
         * list by ipvlan_open.
         */
@@ -645,10 +641,8 @@ static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
        if (!addr)
                return;
-        ipvlan_ht_addr_del(addr, true);
+        ipvlan_ht_addr_del(addr);
        list_del(&addr->anode);
-        ipvlan->ipv6cnt--;
-        WARN_ON(ipvlan->ipv6cnt < 0);
        kfree_rcu(addr, rcu);
        return;
@@ -661,6 +655,10 @@ static int ipvlan_addr6_event(struct notifier_block *unused,
        struct net_device *dev = (struct net_device *)if6->idev->dev;
        struct ipvl_dev *ipvlan = netdev_priv(dev);
+        /* FIXME IPv6 autoconf calls us from bh without RTNL */
+        if (in_softirq())
+                return NOTIFY_DONE;
        if (!netif_is_ipvlan(dev))
                return NOTIFY_DONE;
@@ -699,7 +697,7 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
        memcpy(&addr->ip4addr, ip4_addr, sizeof(struct in_addr));
        addr->atype = IPVL_IPV4;
        list_add_tail(&addr->anode, &ipvlan->addrs);
-        ipvlan->ipv4cnt++;
        /* If the interface is not up, the address will be added to the hash
         * list by ipvlan_open.
         */
@@ -717,10 +715,8 @@ static void ipvlan_del_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
        if (!addr)
                return;
-        ipvlan_ht_addr_del(addr, true);
+        ipvlan_ht_addr_del(addr);
        list_del(&addr->anode);
-        ipvlan->ipv4cnt--;
-        WARN_ON(ipvlan->ipv4cnt < 0);
        kfree_rcu(addr, rcu);
        return;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index f8370808a018..3b933bb5a8d5 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -1355,6 +1355,7 @@ static void macvtap_exit(void)
        class_unregister(macvtap_class);
        cdev_del(&macvtap_cdev);
        unregister_chrdev_region(macvtap_major, MACVTAP_NUM_DEVS);
+        idr_destroy(&minor_idr);
 }
 module_exit(macvtap_exit);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index cf18940f4e84..cb86d7a01542 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -191,7 +191,7 @@ config MDIO_BUS_MUX_GPIO
 config MDIO_BUS_MUX_MMIOREG
        tristate "Support for MMIO device-controlled MDIO bus multiplexers"
-        depends on OF_MDIO
+        depends on OF_MDIO && HAS_IOMEM
        select MDIO_BUS_MUX
        help
          This module provides a driver for MDIO bus multiplexers that
diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
index c7a12e2e07b7..8a3bf5469892 100644
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -164,7 +164,7 @@ static int dp83867_config_init(struct phy_device *phydev)
                        return ret;
        }
-        if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) ||
+        if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) &&
            (phydev->interface <= PHY_INTERFACE_MODE_RGMII_RXID)) {
                val = phy_read_mmd_indirect(phydev, DP83867_RGMIICTL,
                                            DP83867_DEVADDR, phydev->addr);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 095ef3fe369a..46a14cbb0215 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -421,6 +421,8 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
 {
        struct phy_device *phydev = to_phy_device(dev);
        struct phy_driver *phydrv = to_phy_driver(drv);
+        const int num_ids = ARRAY_SIZE(phydev->c45_ids.device_ids);
+        int i;
        if (of_driver_match_device(dev, drv))
                return 1;
@@ -428,8 +430,21 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
        if (phydrv->match_phy_device)
                return phydrv->match_phy_device(phydev);
-        return (phydrv->phy_id & phydrv->phy_id_mask) ==
+        if (phydev->is_c45) {
-                (phydev->phy_id & phydrv->phy_id_mask);
+                for (i = 1; i < num_ids; i++) {
+                        if (!(phydev->c45_ids.devices_in_package & (1 << i)))
+                                continue;
+                        if ((phydrv->phy_id & phydrv->phy_id_mask) ==
+                            (phydev->c45_ids.device_ids[i] &
+                             phydrv->phy_id_mask))
+                                return 1;
+                }
+                return 0;
+        } else {
+                return (phydrv->phy_id & phydrv->phy_id_mask) ==
+                        (phydev->phy_id & phydrv->phy_id_mask);
+        }
 }
 #ifdef CONFIG_PM
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 4545e78840b0..35a2bffe848a 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -523,6 +523,7 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define NVIDIA_VENDOR_ID        0x0955
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -710,6 +711,13 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* NVIDIA Tegra USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(NVIDIA_VENDOR_ID, 0x09ff, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index e4b7a47a825c..efc18e05af0a 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -158,7 +158,7 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
        if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                goto err;
-        ret = cdc_ncm_bind_common(dev, intf, data_altsetting);
+        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, 0);
        if (ret)
                goto err;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 8067b8fbb0ee..db40175b1a0b 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -6,7 +6,7 @@
 * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
 *
 * USB Host Driver for Network Control Model (NCM)
- * http://www.usb.org/developers/devclass_docs/NCM10.zip
+ * http://www.usb.org/developers/docs/devclass_docs/NCM10_012011.zip
 *
 * The NCM encoding, decoding and initialization logic
 * derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
@@ -684,10 +684,12 @@ static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
                ctx->tx_curr_skb = NULL;
        }
+        kfree(ctx->delayed_ndp16);
        kfree(ctx);
 }
-int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting)
+int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags)
 {
        const struct usb_cdc_union_desc *union_desc = NULL;
        struct cdc_ncm_ctx *ctx;
@@ -855,6 +857,17 @@ advance:
        /* finish setting up the device specific data */
        cdc_ncm_setup(dev);
+        /* Device-specific flags */
+        ctx->drvflags = drvflags;
+        /* Allocate the delayed NDP if needed. */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+                ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
+                if (!ctx->delayed_ndp16)
+                        goto error2;
+                dev_info(&intf->dev, "NDP will be placed at end of frame for this device.");
+        }
        /* override ethtool_ops */
        dev->net->ethtool_ops = &cdc_ncm_ethtool_ops;
@@ -954,8 +967,11 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
        if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
                return -ENODEV;
-        /* The NCM data altsetting is fixed */
+        /* The NCM data altsetting is fixed, so we hard-coded it.
-        ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM);
+         * Additionally, generic NCM devices are assumed to accept arbitrarily
+         * placed NDP.
+         */
+        ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
        /*
         * We should get an event when network connection is "connected" or
@@ -986,6 +1002,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
        struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
        size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex);
+        /* If NDP should be moved to the end of the NCM package, we can't follow the
+        * NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
+        * the wNdpIndex field in the header is actually not consistent with reality. It will be later.
+        */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+                if (ctx->delayed_ndp16->dwSignature == sign)
+                        return ctx->delayed_ndp16;
        /* follow the chain of NDPs, looking for a match */
        while (ndpoffset) {
                ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
@@ -995,7 +1019,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
        }
        /* align new NDP */
-        cdc_ncm_align_tail(skb, ctx->tx_ndp_modulus, 0, ctx->tx_max);
+        if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
+                cdc_ncm_align_tail(skb, ctx->tx_ndp_modulus, 0, ctx->tx_max);
        /* verify that there is room for the NDP and the datagram (reserve) */
        if ((ctx->tx_max - skb->len - reserve) < ctx->max_ndp_size)
@@ -1008,7 +1033,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
                nth16->wNdpIndex = cpu_to_le16(skb->len);
        /* push a new empty NDP */
-        ndp16 = (struct usb_cdc_ncm_ndp16 *)memset(skb_put(skb, ctx->max_ndp_size), 0, ctx->max_ndp_size);
+        if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
+                ndp16 = (struct usb_cdc_ncm_ndp16 *)memset(skb_put(skb, ctx->max_ndp_size), 0, ctx->max_ndp_size);
+        else
+                ndp16 = ctx->delayed_ndp16;
        ndp16->dwSignature = sign;
        ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16));
        return ndp16;
@@ -1023,6 +1052,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
        struct sk_buff *skb_out;
        u16 n = 0, index, ndplen;
        u8 ready2send = 0;
+        u32 delayed_ndp_size;
+        /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated
+         * accordingly. Otherwise, we should check here.
+         */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+                delayed_ndp_size = ctx->max_ndp_size;
+        else
+                delayed_ndp_size = 0;
        /* if there is a remaining skb, it gets priority */
        if (skb != NULL) {
@@ -1077,7 +1115,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
                cdc_ncm_align_tail(skb_out,  ctx->tx_modulus, ctx->tx_remainder, ctx->tx_max);
                /* check if we had enough room left for both NDP and frame */
-                if (!ndp16 || skb_out->len + skb->len > ctx->tx_max) {
+                if (!ndp16 || skb_out->len + skb->len + delayed_ndp_size > ctx->tx_max) {
                        if (n == 0) {
                                /* won't fit, MTU problem? */
                                dev_kfree_skb_any(skb);
@@ -1150,6 +1188,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
                /* variables will be reset at next call */
        }
+        /* If requested, put NDP at end of frame. */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+                nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
+                cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_max);
+                nth16->wNdpIndex = cpu_to_le16(skb_out->len);
+                memcpy(skb_put(skb_out, ctx->max_ndp_size), ctx->delayed_ndp16, ctx->max_ndp_size);
+                /* Zero out delayed NDP - signature checking will naturally fail. */
+                ndp16 = memset(ctx->delayed_ndp16, 0, ctx->max_ndp_size);
+        }
        /* If collected data size is less or equal ctx->min_tx_pkt
         * bytes, we send buffers as it is. If we get more data, it
         * would be more efficient for USB HS mobile device with DMA
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 735f7dadb9a0..2680a65cd5e4 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -73,11 +73,14 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
        struct usb_driver *subdriver = ERR_PTR(-ENODEV);
        int ret = -ENODEV;
        struct huawei_cdc_ncm_state *drvstate = (void *)&usbnet_dev->data;
+        int drvflags = 0;
        /* altsetting should always be 1 for NCM devices - so we hard-coded
-         * it here
+         * it here. Some huawei devices will need the NDP part of the NCM package to
+         * be at the end of the frame.
         */
-        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1);
+        drvflags |= CDC_NCM_FLAG_NDP_TO_END;
+        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
        if (ret)
                goto err;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index f603f362504b..9d43460ce3c7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -757,6 +757,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
        {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
        {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
+        {QMI_FIXED_INTF(0x1199, 0x9041, 10)},   /* Sierra Wireless MC7305/MC7355 */
        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
        {QMI_FIXED_INTF(0x1199, 0x9053, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index aafa1a1898e4..7f6419ebb5e1 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -494,6 +494,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_REALTEK               0x0bda
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_NVIDIA                0x0955
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -4117,6 +4118,7 @@ static struct usb_device_id rtl8152_table[] = {
        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x304f)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
        {}
 };
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 63c7810e1545..7fbca37a1adf 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1828,7 +1828,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        else
                vi->hdr_len = sizeof(struct virtio_net_hdr);
-        if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT))
+        if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT) ||
+            virtio_has_feature(vdev, VIRTIO_F_VERSION_1))
                vi->any_header_sg = true;
        if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ))
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index da11bb5e9c7f..46f4caddccbe 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1216,7 +1216,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
        static const u32 rxprod_reg[2] = {
                VMXNET3_REG_RXPROD, VMXNET3_REG_RXPROD2
        };
-        u32 num_rxd = 0;
+        u32 num_pkts = 0;
        bool skip_page_frags = false;
        struct Vmxnet3_RxCompDesc *rcd;
        struct vmxnet3_rx_ctx *ctx = &rq->rx_ctx;
@@ -1235,13 +1235,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                struct Vmxnet3_RxDesc *rxd;
                u32 idx, ring_idx;
                struct vmxnet3_cmd_ring *ring = NULL;
-                if (num_rxd >= quota) {
+                if (num_pkts >= quota) {
                        /* we may stop even before we see the EOP desc of
                         * the current pkt
                         */
                        break;
                }
-                num_rxd++;
                BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2);
                idx = rcd->rxdIdx;
                ring_idx = rcd->rqID < adapter->num_rx_queues ? 0 : 1;
@@ -1413,6 +1412,7 @@ not_lro:
                                napi_gro_receive(&rq->napi, skb);
                        ctx->skb = NULL;
+                        num_pkts++;
                }
 rcd_done:
@@ -1443,7 +1443,7 @@ rcd_done:
                                  &rq->comp_ring.base[rq->comp_ring.next2proc].rcd, &rxComp);
        }
-        return num_rxd;
+        return num_pkts;
 }
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index feacc3b994b7..2f0bd6955f33 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -1044,7 +1044,7 @@ EXPORT_SYMBOL(z8530_sync_dma_close);
 *      @dev: The network device to attach
 *      @c: The Z8530 channel to configure in sync DMA mode.
 *
- *      Set up a Z85x30 device for synchronous DMA tranmission. One
+ *      Set up a Z85x30 device for synchronous DMA transmission. One
 *      ISA DMA channel must be available for this to work. The receive
 *      side is run in PIO mode, but then it has the bigger FIFO.
 */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 5e15e8e10ed3..a31a6804dc34 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -279,6 +279,7 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                return;
        case AR9300_DEVID_QCA956X:
                ah->hw_version.macVersion = AR_SREV_VERSION_9561;
+                return;
        }
        val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index d56064861a9c..d45dc021cda2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -438,6 +438,12 @@ static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
 #define RX_QUEUE_MASK                         255
 #define RX_QUEUE_SIZE_LOG                     8
+/*
+ * RX related structures and functions
+ */
+#define RX_FREE_BUFFERS 64
+#define RX_LOW_WATERMARK 8
 /**
 * struct iwl_rb_status - reserve buffer status
 *      host memory mapped FH registers
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 80fefe7d7b8c..3b8e85e51002 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
                hw_addr = (const u8 *)(mac_override +
                                 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
-                /* The byte order is little endian 16 bit, meaning 214365 */
+                /*
-                data->hw_addr[0] = hw_addr[1];
+                 * Store the MAC address from MAO section.
-                data->hw_addr[1] = hw_addr[0];
+                 * No byte swapping is required in MAO section
-                data->hw_addr[2] = hw_addr[3];
+                 */
-                data->hw_addr[3] = hw_addr[2];
+                memcpy(data->hw_addr, hw_addr, ETH_ALEN);
-                data->hw_addr[4] = hw_addr[5];
-                data->hw_addr[5] = hw_addr[4];
                /*
                 * Force the use of the OTP MAC address in case of reserved MAC
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 5e4cbdb44c60..737774a01c74 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -660,7 +660,8 @@ struct iwl_scan_config {
 * iwl_umac_scan_flags
 *@IWL_UMAC_SCAN_FLAG_PREEMPTIVE: scan process triggered by this scan request
 *      can be preempted by other scan requests with higher priority.
- *      The low priority scan is aborted.
+ *      The low priority scan will be resumed when the higher proirity scan is
+ *      completed.
 *@IWL_UMAC_SCAN_FLAG_START_NOTIF: notification will be sent to the driver
 *      when scan starts.
 */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 5de144968723..5000bfcded61 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1109,6 +1109,9 @@ static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        cmd->uid = cpu_to_le32(uid);
        cmd->general_flags = cpu_to_le32(iwl_mvm_scan_umac_flags(mvm, params));
+        if (type == IWL_MVM_SCAN_SCHED)
+                cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
        if (iwl_mvm_scan_use_ebs(mvm, vif, n_iterations))
                cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index d68dc697a4a0..26f076e82149 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -1401,6 +1401,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
        bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
        u8 sta_id;
        int ret;
+        static const u8 __maybe_unused zero_addr[ETH_ALEN] = {0};
        lockdep_assert_held(&mvm->mutex);
@@ -1467,7 +1468,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
 end:
        IWL_DEBUG_WEP(mvm, "key: cipher=%x len=%d idx=%d sta=%pM ret=%d\n",
                      keyconf->cipher, keyconf->keylen, keyconf->keyidx,
-                      sta->addr, ret);
+                      sta ? sta->addr : zero_addr, ret);
        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index d24b6a83e68c..e472729e5f14 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -86,7 +86,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
 {
        lockdep_assert_held(&mvm->time_event_lock);
-        if (te_data->id == TE_MAX)
+        if (!te_data->vif)
                return;
        list_del(&te_data->list);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 7ba7a118ff5c..89116864d2a0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -252,7 +252,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
        if (info->band == IEEE80211_BAND_2GHZ &&
            !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
-                rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
+                rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
        else
                rate_flags =
                        BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 2ed1e4d2774d..9f65c1cff1b1 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -368,12 +368,14 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 3165 Series */
        {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4212, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3166, 0x4310, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3166, 0x4210, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x8010, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x8110, iwl3165_2ac_cfg)},
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
@@ -426,9 +428,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F3, 0xD010, iwl8260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x24F4, 0xC030, iwl8260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x24F4, 0xD030, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 31f72a61cc3f..376b84e54ad7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -44,15 +44,6 @@
 #include "iwl-io.h"
 #include "iwl-op-mode.h"
-/*
- * RX related structures and functions
- */
-#define RX_NUM_QUEUES 1
-#define RX_POST_REQ_ALLOC 2
-#define RX_CLAIM_REQ_ALLOC 8
-#define RX_POOL_SIZE ((RX_CLAIM_REQ_ALLOC - RX_POST_REQ_ALLOC) * RX_NUM_QUEUES)
-#define RX_LOW_WATERMARK 8
 struct iwl_host_cmd;
 /*This file includes the declaration that are internal to the
@@ -86,29 +77,29 @@ struct isr_statistics {
 * struct iwl_rxq - Rx queue
 * @bd: driver's pointer to buffer of receive buffer descriptors (rbd)
 * @bd_dma: bus address of buffer of receive buffer descriptors (rbd)
+ * @pool:
+ * @queue:
 * @read: Shared index to newest available Rx buffer
 * @write: Shared index to oldest written Rx packet
 * @free_count: Number of pre-allocated buffers in rx_free
- * @used_count: Number of RBDs handled to allocator to use for allocation
 * @write_actual:
- * @rx_free: list of RBDs with allocated RB ready for use
+ * @rx_free: list of free SKBs for use
- * @rx_used: list of RBDs with no RB attached
+ * @rx_used: List of Rx buffers with no SKB
 * @need_update: flag to indicate we need to update read/write index
 * @rb_stts: driver's pointer to receive buffer status
 * @rb_stts_dma: bus address of receive buffer status
 * @lock:
- * @pool: initial pool of iwl_rx_mem_buffer for the queue
- * @queue: actual rx queue
 *
 * NOTE:  rx_free and rx_used are used as a FIFO for iwl_rx_mem_buffers
 */
 struct iwl_rxq {
        __le32 *bd;
        dma_addr_t bd_dma;
+        struct iwl_rx_mem_buffer pool[RX_QUEUE_SIZE + RX_FREE_BUFFERS];
+        struct iwl_rx_mem_buffer *queue[RX_QUEUE_SIZE];
        u32 read;
        u32 write;
        u32 free_count;
-        u32 used_count;
        u32 write_actual;
        struct list_head rx_free;
        struct list_head rx_used;
@@ -116,32 +107,6 @@ struct iwl_rxq {
        struct iwl_rb_status *rb_stts;
        dma_addr_t rb_stts_dma;
        spinlock_t lock;
-        struct iwl_rx_mem_buffer pool[RX_QUEUE_SIZE];
-        struct iwl_rx_mem_buffer *queue[RX_QUEUE_SIZE];
-};
-/**
- * struct iwl_rb_allocator - Rx allocator
- * @pool: initial pool of allocator
- * @req_pending: number of requests the allcator had not processed yet
- * @req_ready: number of requests honored and ready for claiming
- * @rbd_allocated: RBDs with pages allocated and ready to be handled to
- *      the queue. This is a list of &struct iwl_rx_mem_buffer
- * @rbd_empty: RBDs with no page attached for allocator use. This is a list
- *      of &struct iwl_rx_mem_buffer
- * @lock: protects the rbd_allocated and rbd_empty lists
- * @alloc_wq: work queue for background calls
- * @rx_alloc: work struct for background calls
- */
-struct iwl_rb_allocator {
-        struct iwl_rx_mem_buffer pool[RX_POOL_SIZE];
-        atomic_t req_pending;
-        atomic_t req_ready;
-        struct list_head rbd_allocated;
-        struct list_head rbd_empty;
-        spinlock_t lock;
-        struct workqueue_struct *alloc_wq;
-        struct work_struct rx_alloc;
 };
 struct iwl_dma_ptr {
@@ -285,7 +250,7 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
 /**
 * struct iwl_trans_pcie - PCIe transport specific data
 * @rxq: all the RX queue data
- * @rba: allocator for RX replenishing
+ * @rx_replenish: work that will be called when buffers need to be allocated
 * @drv - pointer to iwl_drv
 * @trans: pointer to the generic transport area
 * @scd_base_addr: scheduler sram base address in SRAM
@@ -308,7 +273,7 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
 */
 struct iwl_trans_pcie {
        struct iwl_rxq rxq;
-        struct iwl_rb_allocator rba;
+        struct work_struct rx_replenish;
        struct iwl_trans *trans;
        struct iwl_drv *drv;
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index a3fbaa0ef5e0..adad8d0fae7f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1,7 +1,7 @@
 /******************************************************************************
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portions of the ieee80211 subsystem header files.
@@ -74,29 +74,16 @@
 * resets the Rx queue buffers with new memory.
 *
 * The management in the driver is as follows:
- * + A list of pre-allocated RBDs is stored in iwl->rxq->rx_free.
+ * + A list of pre-allocated SKBs is stored in iwl->rxq->rx_free.  When
- *   When the interrupt handler is called, the request is processed.
+ *   iwl->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
- *   The page is either stolen - transferred to the upper layer
+ *   to replenish the iwl->rxq->rx_free.
- *   or reused - added immediately to the iwl->rxq->rx_free list.
+ * + In iwl_pcie_rx_replenish (scheduled) if 'processed' != 'read' then the
- * + When the page is stolen - the driver updates the matching queue's used
+ *   iwl->rxq is replenished and the READ INDEX is updated (updating the
- *   count, detaches the RBD and transfers it to the queue used list.
+ *   'processed' and 'read' driver indexes as well)
- *   When there are two used RBDs - they are transferred to the allocator empty
- *   list. Work is then scheduled for the allocator to start allocating
- *   eight buffers.
- *   When there are another 6 used RBDs - they are transferred to the allocator
- *   empty list and the driver tries to claim the pre-allocated buffers and
- *   add them to iwl->rxq->rx_free. If it fails - it continues to claim them
- *   until ready.
- *   When there are 8+ buffers in the free list - either from allocation or from
- *   8 reused unstolen pages - restock is called to update the FW and indexes.
- * + In order to make sure the allocator always has RBDs to use for allocation
- *   the allocator has initial pool in the size of num_queues*(8-2) - the
- *   maximum missing RBDs per allocation request (request posted with 2
- *    empty RBDs, there is no guarantee when the other 6 RBDs are supplied).
- *   The queues supplies the recycle of the rest of the RBDs.
 * + A received packet is processed and handed to the kernel network stack,
 *   detached from the iwl->rxq.  The driver 'processed' index is updated.
- * + If there are no allocated buffers in iwl->rxq->rx_free,
+ * + The Host/Firmware iwl->rxq is replenished at irq thread time from the
+ *   rx_free list. If there are no allocated buffers in iwl->rxq->rx_free,
 *   the READ INDEX is not incremented and iwl->status(RX_STALLED) is set.
 *   If there were enough free buffers and RX_STALLED is set it is cleared.
 *
@@ -105,32 +92,18 @@
 *
 * iwl_rxq_alloc()            Allocates rx_free
 * iwl_pcie_rx_replenish()    Replenishes rx_free list from rx_used, and calls
- *                            iwl_pcie_rxq_restock.
+ *                            iwl_pcie_rxq_restock
- *                            Used only during initialization.
 * iwl_pcie_rxq_restock()     Moves available buffers from rx_free into Rx
 *                            queue, updates firmware pointers, and updates
- *                            the WRITE index.
+ *                            the WRITE index.  If insufficient rx_free buffers
- * iwl_pcie_rx_allocator()     Background work for allocating pages.
+ *                            are available, schedules iwl_pcie_rx_replenish
 *
 * -- enable interrupts --
 * ISR - iwl_rx()             Detach iwl_rx_mem_buffers from pool up to the
 *                            READ INDEX, detaching the SKB from the pool.
 *                            Moves the packet buffer from queue to rx_used.
- *                            Posts and claims requests to the allocator.
 *                            Calls iwl_pcie_rxq_restock to refill any empty
 *                            slots.
- *
- * RBD life-cycle:
- *
- * Init:
- * rxq.pool -> rxq.rx_used -> rxq.rx_free -> rxq.queue
- *
- * Regular Receive interrupt:
- * Page Stolen:
- * rxq.queue -> rxq.rx_used -> allocator.rbd_empty ->
- * allocator.rbd_allocated -> rxq.rx_free -> rxq.queue
- * Page not Stolen:
- * rxq.queue -> rxq.rx_free -> rxq.queue
 * ...
 *
 */
@@ -267,6 +240,10 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
                rxq->free_count--;
        }
        spin_unlock(&rxq->lock);
+        /* If the pre-allocated buffer pool is dropping low, schedule to
+         * refill it */
+        if (rxq->free_count <= RX_LOW_WATERMARK)
+                schedule_work(&trans_pcie->rx_replenish);
        /* If we've added more space for the firmware to place data, tell it.
         * Increment device's write pointer in multiples of 8. */
@@ -278,44 +255,6 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
 }
 /*
- * iwl_pcie_rx_alloc_page - allocates and returns a page.
- *
- */
-static struct page *iwl_pcie_rx_alloc_page(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct page *page;
-        gfp_t gfp_mask = GFP_KERNEL;
-        if (rxq->free_count > RX_LOW_WATERMARK)
-                gfp_mask |= __GFP_NOWARN;
-        if (trans_pcie->rx_page_order > 0)
-                gfp_mask |= __GFP_COMP;
-        /* Alloc a new receive buffer */
-        page = alloc_pages(gfp_mask, trans_pcie->rx_page_order);
-        if (!page) {
-                if (net_ratelimit())
-                        IWL_DEBUG_INFO(trans, "alloc_pages failed, order: %d\n",
-                                       trans_pcie->rx_page_order);
-                /* Issue an error if the hardware has consumed more than half
-                 * of its free buffer list and we don't have enough
-                 * pre-allocated buffers.
-`                */
-                if (rxq->free_count <= RX_LOW_WATERMARK &&
-                    iwl_rxq_space(rxq) > (RX_QUEUE_SIZE / 2) &&
-                    net_ratelimit())
-                        IWL_CRIT(trans,
-                                 "Failed to alloc_pages with GFP_KERNEL. Only %u free buffers remaining.\n",
-                                 rxq->free_count);
-                return NULL;
-        }
-        return page;
-}
-/*
 * iwl_pcie_rxq_alloc_rbs - allocate a page for each used RBD
 *
 * A used RBD is an Rx buffer that has been given to the stack. To use it again
@@ -324,12 +263,13 @@ static struct page *iwl_pcie_rx_alloc_page(struct iwl_trans *trans)
 * iwl_pcie_rxq_restock. The latter function will update the HW to use the newly
 * allocated buffers.
 */
-static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans)
+static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rxq *rxq = &trans_pcie->rxq;
        struct iwl_rx_mem_buffer *rxb;
        struct page *page;
+        gfp_t gfp_mask = priority;
        while (1) {
                spin_lock(&rxq->lock);
@@ -339,10 +279,32 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans)
                }
                spin_unlock(&rxq->lock);
+                if (rxq->free_count > RX_LOW_WATERMARK)
+                        gfp_mask |= __GFP_NOWARN;
+                if (trans_pcie->rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
                /* Alloc a new receive buffer */
-                page = iwl_pcie_rx_alloc_page(trans);
+                page = alloc_pages(gfp_mask, trans_pcie->rx_page_order);
-                if (!page)
+                if (!page) {
+                        if (net_ratelimit())
+                                IWL_DEBUG_INFO(trans, "alloc_pages failed, "
+                                           "order: %d\n",
+                                           trans_pcie->rx_page_order);
+                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+                            net_ratelimit())
+                                IWL_CRIT(trans, "Failed to alloc_pages with %s."
+                                         "Only %u free buffers remaining.\n",
+                                         priority == GFP_ATOMIC ?
+                                         "GFP_ATOMIC" : "GFP_KERNEL",
+                                         rxq->free_count);
+                        /* We don't reschedule replenish work here -- we will
+                         * call the restock method and if it still needs
+                         * more buffers it will schedule replenish */
                        return;
+                }
                spin_lock(&rxq->lock);
@@ -393,7 +355,7 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
        lockdep_assert_held(&rxq->lock);
-        for (i = 0; i < RX_QUEUE_SIZE; i++) {
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                if (!rxq->pool[i].page)
                        continue;
                dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
@@ -410,144 +372,32 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
 * When moving to rx_free an page is allocated for the slot.
 *
 * Also restock the Rx queue via iwl_pcie_rxq_restock.
- * This is called only during initialization
+ * This is called as a scheduled work item (except for during initialization)
 */
-static void iwl_pcie_rx_replenish(struct iwl_trans *trans)
+static void iwl_pcie_rx_replenish(struct iwl_trans *trans, gfp_t gfp)
 {
-        iwl_pcie_rxq_alloc_rbs(trans);
+        iwl_pcie_rxq_alloc_rbs(trans, gfp);
        iwl_pcie_rxq_restock(trans);
 }
-/*
+static void iwl_pcie_rx_replenish_work(struct work_struct *data)
- * iwl_pcie_rx_allocator - Allocates pages in the background for RX queues
- *
- * Allocates for each received request 8 pages
- * Called as a scheduled work item.
- */
-static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        while (atomic_read(&rba->req_pending)) {
-                int i;
-                struct list_head local_empty;
-                struct list_head local_allocated;
-                INIT_LIST_HEAD(&local_allocated);
-                spin_lock(&rba->lock);
-                /* swap out the entire rba->rbd_empty to a local list */
-                list_replace_init(&rba->rbd_empty, &local_empty);
-                spin_unlock(&rba->lock);
-                for (i = 0; i < RX_CLAIM_REQ_ALLOC;) {
-                        struct iwl_rx_mem_buffer *rxb;
-                        struct page *page;
-                        /* List should never be empty - each reused RBD is
-                         * returned to the list, and initial pool covers any
-                         * possible gap between the time the page is allocated
-                         * to the time the RBD is added.
-                         */
-                        BUG_ON(list_empty(&local_empty));
-                        /* Get the first rxb from the rbd list */
-                        rxb = list_first_entry(&local_empty,
-                                               struct iwl_rx_mem_buffer, list);
-                        BUG_ON(rxb->page);
-                        /* Alloc a new receive buffer */
-                        page = iwl_pcie_rx_alloc_page(trans);
-                        if (!page)
-                                continue;
-                        rxb->page = page;
-                        /* Get physical address of the RB */
-                        rxb->page_dma = dma_map_page(trans->dev, page, 0,
-                                        PAGE_SIZE << trans_pcie->rx_page_order,
-                                        DMA_FROM_DEVICE);
-                        if (dma_mapping_error(trans->dev, rxb->page_dma)) {
-                                rxb->page = NULL;
-                                __free_pages(page, trans_pcie->rx_page_order);
-                                continue;
-                        }
-                        /* dma address must be no more than 36 bits */
-                        BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
-                        /* and also 256 byte aligned! */
-                        BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
-                        /* move the allocated entry to the out list */
-                        list_move(&rxb->list, &local_allocated);
-                        i++;
-                }
-                spin_lock(&rba->lock);
-                /* add the allocated rbds to the allocator allocated list */
-                list_splice_tail(&local_allocated, &rba->rbd_allocated);
-                /* add the unused rbds back to the allocator empty list */
-                list_splice_tail(&local_empty, &rba->rbd_empty);
-                spin_unlock(&rba->lock);
-                atomic_dec(&rba->req_pending);
-                atomic_inc(&rba->req_ready);
-        }
-}
-/*
- * iwl_pcie_rx_allocator_get - Returns the pre-allocated pages
-.*
-.* Called by queue when the queue posted allocation request and
- * has freed 8 RBDs in order to restock itself.
- */
-static int iwl_pcie_rx_allocator_get(struct iwl_trans *trans,
-                                     struct iwl_rx_mem_buffer
-                                     *out[RX_CLAIM_REQ_ALLOC])
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        int i;
-        if (atomic_dec_return(&rba->req_ready) < 0) {
-                atomic_inc(&rba->req_ready);
-                IWL_DEBUG_RX(trans,
-                             "Allocation request not ready, pending requests = %d\n",
-                             atomic_read(&rba->req_pending));
-                return -ENOMEM;
-        }
-        spin_lock(&rba->lock);
-        for (i = 0; i < RX_CLAIM_REQ_ALLOC; i++) {
-                /* Get next free Rx buffer, remove it from free list */
-                out[i] = list_first_entry(&rba->rbd_allocated,
-                               struct iwl_rx_mem_buffer, list);
-                list_del(&out[i]->list);
-        }
-        spin_unlock(&rba->lock);
-        return 0;
-}
-static void iwl_pcie_rx_allocator_work(struct work_struct *data)
 {
-        struct iwl_rb_allocator *rba_p =
-                container_of(data, struct iwl_rb_allocator, rx_alloc);
        struct iwl_trans_pcie *trans_pcie =
-                container_of(rba_p, struct iwl_trans_pcie, rba);
+            container_of(data, struct iwl_trans_pcie, rx_replenish);
-        iwl_pcie_rx_allocator(trans_pcie->trans);
+        iwl_pcie_rx_replenish(trans_pcie->trans, GFP_KERNEL);
 }
 static int iwl_pcie_rx_alloc(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        struct device *dev = trans->dev;
        memset(&trans_pcie->rxq, 0, sizeof(trans_pcie->rxq));
        spin_lock_init(&rxq->lock);
-        spin_lock_init(&rba->lock);
        if (WARN_ON(rxq->bd || rxq->rb_stts))
                return -EINVAL;
@@ -637,49 +487,15 @@ static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
        INIT_LIST_HEAD(&rxq->rx_free);
        INIT_LIST_HEAD(&rxq->rx_used);
        rxq->free_count = 0;
-        rxq->used_count = 0;
-        for (i = 0; i < RX_QUEUE_SIZE; i++)
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
                list_add(&rxq->pool[i].list, &rxq->rx_used);
 }
-static void iwl_pcie_rx_init_rba(struct iwl_rb_allocator *rba)
-{
-        int i;
-        lockdep_assert_held(&rba->lock);
-        INIT_LIST_HEAD(&rba->rbd_allocated);
-        INIT_LIST_HEAD(&rba->rbd_empty);
-        for (i = 0; i < RX_POOL_SIZE; i++)
-                list_add(&rba->pool[i].list, &rba->rbd_empty);
-}
-static void iwl_pcie_rx_free_rba(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        int i;
-        lockdep_assert_held(&rba->lock);
-        for (i = 0; i < RX_POOL_SIZE; i++) {
-                if (!rba->pool[i].page)
-                        continue;
-                dma_unmap_page(trans->dev, rba->pool[i].page_dma,
-                               PAGE_SIZE << trans_pcie->rx_page_order,
-                               DMA_FROM_DEVICE);
-                __free_pages(rba->pool[i].page, trans_pcie->rx_page_order);
-                rba->pool[i].page = NULL;
-        }
-}
 int iwl_pcie_rx_init(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        int i, err;
        if (!rxq->bd) {
@@ -687,21 +503,11 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
                if (err)
                        return err;
        }
-        if (!rba->alloc_wq)
-                rba->alloc_wq = alloc_workqueue("rb_allocator",
-                                                WQ_HIGHPRI | WQ_UNBOUND, 1);
-        INIT_WORK(&rba->rx_alloc, iwl_pcie_rx_allocator_work);
-        spin_lock(&rba->lock);
-        atomic_set(&rba->req_pending, 0);
-        atomic_set(&rba->req_ready, 0);
-        /* free all first - we might be reconfigured for a different size */
-        iwl_pcie_rx_free_rba(trans);
-        iwl_pcie_rx_init_rba(rba);
-        spin_unlock(&rba->lock);
        spin_lock(&rxq->lock);
+        INIT_WORK(&trans_pcie->rx_replenish, iwl_pcie_rx_replenish_work);
        /* free all first - we might be reconfigured for a different size */
        iwl_pcie_rxq_free_rbs(trans);
        iwl_pcie_rx_init_rxb_lists(rxq);
@@ -716,7 +522,7 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
        memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
        spin_unlock(&rxq->lock);
-        iwl_pcie_rx_replenish(trans);
+        iwl_pcie_rx_replenish(trans, GFP_KERNEL);
        iwl_pcie_rx_hw_init(trans, rxq);
@@ -731,7 +537,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        /*if rxq->bd is NULL, it means that nothing has been allocated,
         * exit now */
@@ -740,15 +545,7 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
                return;
        }
-        cancel_work_sync(&rba->rx_alloc);
+        cancel_work_sync(&trans_pcie->rx_replenish);
-        if (rba->alloc_wq) {
-                destroy_workqueue(rba->alloc_wq);
-                rba->alloc_wq = NULL;
-        }
-        spin_lock(&rba->lock);
-        iwl_pcie_rx_free_rba(trans);
-        spin_unlock(&rba->lock);
        spin_lock(&rxq->lock);
        iwl_pcie_rxq_free_rbs(trans);
@@ -769,43 +566,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
        rxq->rb_stts = NULL;
 }
-/*
- * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
- *
- * Called when a RBD can be reused. The RBD is transferred to the allocator.
- * When there are 2 empty RBDs - a request for allocation is posted
- */
-static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
-                                  struct iwl_rx_mem_buffer *rxb,
-                                  struct iwl_rxq *rxq)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        /* Count the used RBDs */
-        rxq->used_count++;
-        /* Move the RBD to the used list, will be moved to allocator in batches
-         * before claiming or posting a request*/
-        list_add_tail(&rxb->list, &rxq->rx_used);
-        /* If we have RX_POST_REQ_ALLOC new released rx buffers -
-         * issue a request for allocator. Modulo RX_CLAIM_REQ_ALLOC is
-         * used for the case we failed to claim RX_CLAIM_REQ_ALLOC,
-         * after but we still need to post another request.
-         */
-        if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
-                /* Move the 2 RBDs to the allocator ownership.
-                 Allocator has another 6 from pool for the request completion*/
-                spin_lock(&rba->lock);
-                list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
-                spin_unlock(&rba->lock);
-                atomic_inc(&rba->req_pending);
-                queue_work(rba->alloc_wq, &rba->rx_alloc);
-        }
-}
 static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                                struct iwl_rx_mem_buffer *rxb)
 {
@@ -928,13 +688,13 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                         */
                        __free_pages(rxb->page, trans_pcie->rx_page_order);
                        rxb->page = NULL;
-                        iwl_pcie_rx_reuse_rbd(trans, rxb, rxq);
+                        list_add_tail(&rxb->list, &rxq->rx_used);
                } else {
                        list_add_tail(&rxb->list, &rxq->rx_free);
                        rxq->free_count++;
                }
        } else
-                iwl_pcie_rx_reuse_rbd(trans, rxb, rxq);
+                list_add_tail(&rxb->list, &rxq->rx_used);
 }
 /*
@@ -944,7 +704,10 @@ static void iwl_pcie_rx_handle(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        u32 r, i, j;
+        u32 r, i;
+        u8 fill_rx = 0;
+        u32 count = 8;
+        int total_empty;
 restart:
        spin_lock(&rxq->lock);
@@ -957,6 +720,14 @@ restart:
        if (i == r)
                IWL_DEBUG_RX(trans, "HW = SW = %d\n", r);
+        /* calculate total frames need to be restock after handling RX */
+        total_empty = r - rxq->write_actual;
+        if (total_empty < 0)
+                total_empty += RX_QUEUE_SIZE;
+        if (total_empty > (RX_QUEUE_SIZE / 2))
+                fill_rx = 1;
        while (i != r) {
                struct iwl_rx_mem_buffer *rxb;
@@ -968,48 +739,29 @@ restart:
                iwl_pcie_rx_handle_rb(trans, rxb);
                i = (i + 1) & RX_QUEUE_MASK;
+                /* If there are a lot of unused frames,
-                /* If we have RX_CLAIM_REQ_ALLOC released rx buffers -
+                 * restock the Rx queue so ucode wont assert. */
-                 * try to claim the pre-allocated buffers from the allocator */
+                if (fill_rx) {
-                if (rxq->used_count >= RX_CLAIM_REQ_ALLOC) {
+                        count++;
-                        struct iwl_rb_allocator *rba = &trans_pcie->rba;
+                        if (count >= 8) {
-                        struct iwl_rx_mem_buffer *out[RX_CLAIM_REQ_ALLOC];
+                                rxq->read = i;
+                                spin_unlock(&rxq->lock);
-                        /* Add the remaining 6 empty RBDs for allocator use */
+                                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
-                        spin_lock(&rba->lock);
+                                count = 0;
-                        list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+                                goto restart;
-                        spin_unlock(&rba->lock);
-                        /* If not ready - continue, will try to reclaim later.
-                        * No need to reschedule work - allocator exits only on
-                        * success */
-                        if (!iwl_pcie_rx_allocator_get(trans, out)) {
-                                /* If success - then RX_CLAIM_REQ_ALLOC
-                                 * buffers were retrieved and should be added
-                                 * to free list */
-                                rxq->used_count -= RX_CLAIM_REQ_ALLOC;
-                                for (j = 0; j < RX_CLAIM_REQ_ALLOC; j++) {
-                                        list_add_tail(&out[j]->list,
-                                                      &rxq->rx_free);
-                                        rxq->free_count++;
-                                }
                        }
                }
-                /* handle restock for two cases:
-                * - we just pulled buffers from the allocator
-                * - we have 8+ unstolen pages accumulated */
-                if (rxq->free_count >=  RX_CLAIM_REQ_ALLOC) {
-                        rxq->read = i;
-                        spin_unlock(&rxq->lock);
-                        iwl_pcie_rxq_restock(trans);
-                        goto restart;
-                }
        }
        /* Backtrack one entry */
        rxq->read = i;
        spin_unlock(&rxq->lock);
+        if (fill_rx)
+                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
+        else
+                iwl_pcie_rxq_restock(trans);
        if (trans_pcie->napi.poll)
                napi_gro_flush(&trans_pcie->napi, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 43ae658af6ec..6203c4ad9bba 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -182,7 +182,7 @@ static void iwl_trans_pcie_write_shr(struct iwl_trans *trans, u32 reg, u32 val)
 static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 {
-        if (!trans->cfg->apmg_not_supported)
+        if (trans->cfg->apmg_not_supported)
                return;
        if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
@@ -2459,7 +2459,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        struct iwl_trans_pcie *trans_pcie;
        struct iwl_trans *trans;
        u16 pci_cmd;
-        int err;
+        int ret;
        trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
                                &pdev->dev, cfg, &trans_ops_pcie, 0);
@@ -2474,8 +2474,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->ref_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
-        err = pci_enable_device(pdev);
+        ret = pci_enable_device(pdev);
-        if (err)
+        if (ret)
                goto out_no_pci;
        if (!cfg->base_params->pcie_l1_allowed) {
@@ -2491,23 +2491,23 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        pci_set_master(pdev);
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
+        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
-        if (!err)
+        if (!ret)
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36));
+                ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36));
-        if (err) {
+        if (ret) {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-                if (!err)
+                if (!ret)
-                        err = pci_set_consistent_dma_mask(pdev,
+                        ret = pci_set_consistent_dma_mask(pdev,
                                                          DMA_BIT_MASK(32));
                /* both attempts failed: */
-                if (err) {
+                if (ret) {
                        dev_err(&pdev->dev, "No suitable DMA available\n");
                        goto out_pci_disable_device;
                }
        }
-        err = pci_request_regions(pdev, DRV_NAME);
+        ret = pci_request_regions(pdev, DRV_NAME);
-        if (err) {
+        if (ret) {
                dev_err(&pdev->dev, "pci_request_regions failed\n");
                goto out_pci_disable_device;
        }
@@ -2515,7 +2515,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        trans_pcie->hw_base = pci_ioremap_bar(pdev, 0);
        if (!trans_pcie->hw_base) {
                dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
-                err = -ENODEV;
+                ret = -ENODEV;
                goto out_pci_release_regions;
        }
@@ -2527,9 +2527,9 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        trans_pcie->pci_dev = pdev;
        iwl_disable_interrupts(trans);
-        err = pci_enable_msi(pdev);
+        ret = pci_enable_msi(pdev);
-        if (err) {
+        if (ret) {
-                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
+                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", ret);
                /* enable rfkill interrupt: hw bug w/a */
                pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
                if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
@@ -2547,11 +2547,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         */
        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                unsigned long flags;
-                int ret;
                trans->hw_rev = (trans->hw_rev & 0xfff0) |
                                (CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
+                ret = iwl_pcie_prepare_card_hw(trans);
+                if (ret) {
+                        IWL_WARN(trans, "Exit HW not ready\n");
+                        goto out_pci_disable_msi;
+                }
                /*
                 * in-order to recognize C step driver should read chip version
                 * id located at the AUX bus MISC address space.
@@ -2591,13 +2596,14 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        /* Initialize the wait queue for commands */
        init_waitqueue_head(&trans_pcie->wait_command_queue);
-        if (iwl_pcie_alloc_ict(trans))
+        ret = iwl_pcie_alloc_ict(trans);
+        if (ret)
                goto out_pci_disable_msi;
-        err = request_threaded_irq(pdev->irq, iwl_pcie_isr,
+        ret = request_threaded_irq(pdev->irq, iwl_pcie_isr,
                                   iwl_pcie_irq_handler,
                                   IRQF_SHARED, DRV_NAME, trans);
-        if (err) {
+        if (ret) {
                IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
                goto out_free_ict;
        }
@@ -2617,5 +2623,5 @@ out_pci_disable_device:
        pci_disable_device(pdev);
 out_no_pci:
        iwl_trans_free(trans);
-        return ERR_PTR(err);
+        return ERR_PTR(ret);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 880d0d63e872..7d50711476fe 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1566,13 +1566,13 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
                smp_rmb();
                while (dc != dp) {
-                        BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS);
+                        BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS);
                        pending_idx =
                                queue->dealloc_ring[pending_index(dc++)];
-                        pending_idx_release[gop-queue->tx_unmap_ops] =
+                        pending_idx_release[gop - queue->tx_unmap_ops] =
                                pending_idx;
-                        queue->pages_to_unmap[gop-queue->tx_unmap_ops] =
+                        queue->pages_to_unmap[gop - queue->tx_unmap_ops] =
                                queue->mmap_pages[pending_idx];
                        gnttab_set_unmap_op(gop,
                                            idx_to_kaddr(queue, pending_idx),
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index a5233422f9dc..7384455792bf 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -458,10 +458,15 @@ static void nd_region_notify_driver_action(struct nvdimm_bus *nvdimm_bus,
                nvdimm_bus_unlock(dev);
        }
        if (is_nd_btt(dev) && probe) {
+                struct nd_btt *nd_btt = to_nd_btt(dev);
                nd_region = to_nd_region(dev->parent);
                nvdimm_bus_lock(dev);
                if (nd_region->btt_seed == dev)
                        nd_region_create_btt_seed(nd_region);
+                if (nd_region->ns_seed == &nd_btt->ndns->dev &&
+                                is_nd_blk(dev->parent))
+                        nd_region_create_blk_seed(nd_region);
                nvdimm_bus_unlock(dev);
        }
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 8df1b1777745..59bb8556e43a 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -47,7 +47,7 @@ config OF_DYNAMIC
 config OF_ADDRESS
        def_bool y
-        depends on !SPARC
+        depends on !SPARC && HAS_IOMEM
        select OF_ADDRESS_PCI if PCI
 config OF_ADDRESS_PCI
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 18016341d5a9..9f71770b6226 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -979,7 +979,6 @@ static struct platform_driver unittest_driver = {
        .remove                 = unittest_remove,
        .driver = {
                .name           = "unittest",
-                .owner          = THIS_MODULE,
                .of_match_table = of_match_ptr(unittest_match),
        },
 };
@@ -1666,7 +1665,6 @@ static const struct i2c_device_id unittest_i2c_dev_id[] = {
 static struct i2c_driver unittest_i2c_dev_driver = {
        .driver = {
                .name = "unittest-i2c-dev",
-                .owner = THIS_MODULE,
        },
        .probe = unittest_i2c_dev_probe,
        .remove = unittest_i2c_dev_remove,
@@ -1761,7 +1759,6 @@ static const struct i2c_device_id unittest_i2c_mux_id[] = {
 static struct i2c_driver unittest_i2c_mux_driver = {
        .driver = {
                .name = "unittest-i2c-mux",
-                .owner = THIS_MODULE,
        },
        .probe = unittest_i2c_mux_probe,
        .remove = unittest_i2c_mux_remove,
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 8067f54ce050..5ce5ef211bdb 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -891,8 +891,10 @@ parport_register_dev_model(struct parport *port, const char *name,
        par_dev->dev.release = free_pardevice;
        par_dev->devmodel = true;
        ret = device_register(&par_dev->dev);
-        if (ret)
+        if (ret) {
-                goto err_put_dev;
+                put_device(&par_dev->dev);
+                goto err_put_port;
+        }
        /* Chain this onto the list */
        par_dev->prev = NULL;
@@ -907,7 +909,8 @@ parport_register_dev_model(struct parport *port, const char *name,
                        spin_unlock(&port->physport->pardevice_lock);
                        pr_debug("%s: cannot grant exclusive access for device %s\n",
                                 port->name, name);
-                        goto err_put_dev;
+                        device_unregister(&par_dev->dev);
+                        goto err_put_port;
                }
                port->flags |= PARPORT_FLAG_EXCL;
        }
@@ -938,8 +941,6 @@ parport_register_dev_model(struct parport *port, const char *name,
        return par_dev;
-err_put_dev:
-        put_device(&par_dev->dev);
 err_free_devname:
        kfree(devname);
 err_free_par_dev:
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index c0e6ede3e27d..6b8dd162f644 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -56,6 +56,7 @@ config PHY_EXYNOS_MIPI_VIDEO
 config PHY_PXA_28NM_HSIC
        tristate "Marvell USB HSIC 28nm PHY Driver"
+        depends on HAS_IOMEM
        select GENERIC_PHY
        help
          Enable this to support Marvell USB HSIC PHY driver for Marvell
@@ -66,6 +67,7 @@ config PHY_PXA_28NM_HSIC
 config PHY_PXA_28NM_USB2
        tristate "Marvell USB 2.0 28nm PHY Driver"
+        depends on HAS_IOMEM
        select GENERIC_PHY
        help
          Enable this to support Marvell USB 2.0 PHY driver for Marvell
diff --git a/drivers/phy/phy-berlin-usb.c b/drivers/phy/phy-berlin-usb.c
index c6fc95b53083..335e06d66ed9 100644
--- a/drivers/phy/phy-berlin-usb.c
+++ b/drivers/phy/phy-berlin-usb.c
@@ -105,9 +105,9 @@
 static const u32 phy_berlin_pll_dividers[] = {
        /* Berlin 2 */
-        CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
-        /* Berlin 2CD */
        CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
+        /* Berlin 2CD/Q */
+        CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
 };
 struct phy_berlin_usb_priv {
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 53f295c1bab1..3510b81db3fa 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -28,7 +28,6 @@
 #include <linux/delay.h>
 #include <linux/phy/omap_control_phy.h>
 #include <linux/of_platform.h>
-#include <linux/spinlock.h>
 #define PLL_STATUS              0x00000004
 #define PLL_GO                  0x00000008
@@ -83,10 +82,6 @@ struct ti_pipe3 {
        struct clk              *refclk;
        struct clk              *div_clk;
        struct pipe3_dpll_map   *dpll_map;
-        bool                    enabled;
-        spinlock_t              lock;   /* serialize clock enable/disable */
-        /* the below flag is needed specifically for SATA */
-        bool                    refclk_enabled;
 };
 static struct pipe3_dpll_map dpll_map_usb[] = {
@@ -137,6 +132,9 @@ static struct pipe3_dpll_params *ti_pipe3_get_dpll_params(struct ti_pipe3 *phy)
        return NULL;
 }
+static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy);
+static void ti_pipe3_disable_clocks(struct ti_pipe3 *phy);
 static int ti_pipe3_power_off(struct phy *x)
 {
        struct ti_pipe3 *phy = phy_get_drvdata(x);
@@ -217,6 +215,7 @@ static int ti_pipe3_init(struct phy *x)
        u32 val;
        int ret = 0;
+        ti_pipe3_enable_clocks(phy);
        /*
         * Set pcie_pcs register to 0x96 for proper functioning of phy
         * as recommended in AM572x TRM SPRUHZ6, section 18.5.2.2, table
@@ -250,33 +249,35 @@ static int ti_pipe3_exit(struct phy *x)
        u32 val;
        unsigned long timeout;
-        /* SATA DPLL can't be powered down due to Errata i783 and PCIe
+        /* SATA DPLL can't be powered down due to Errata i783 */
-         * does not have internal DPLL
+        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata"))
-         */
-        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata") ||
-            of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie"))
                return 0;
-        /* Put DPLL in IDLE mode */
+        /* PCIe doesn't have internal DPLL */
-        val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_CONFIGURATION2);
+        if (!of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie")) {
-        val |= PLL_IDLE;
+                /* Put DPLL in IDLE mode */
-        ti_pipe3_writel(phy->pll_ctrl_base, PLL_CONFIGURATION2, val);
+                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_CONFIGURATION2);
+                val |= PLL_IDLE;
-        /* wait for LDO and Oscillator to power down */
+                ti_pipe3_writel(phy->pll_ctrl_base, PLL_CONFIGURATION2, val);
-        timeout = jiffies + msecs_to_jiffies(PLL_IDLE_TIME);
-        do {
-                cpu_relax();
-                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
-                if ((val & PLL_TICOPWDN) && (val & PLL_LDOPWDN))
-                        break;
-        } while (!time_after(jiffies, timeout));
-        if (!(val & PLL_TICOPWDN) || !(val & PLL_LDOPWDN)) {
+                /* wait for LDO and Oscillator to power down */
-                dev_err(phy->dev, "Failed to power down: PLL_STATUS 0x%x\n",
+                timeout = jiffies + msecs_to_jiffies(PLL_IDLE_TIME);
-                        val);
+                do {
-                return -EBUSY;
+                        cpu_relax();
+                        val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
+                        if ((val & PLL_TICOPWDN) && (val & PLL_LDOPWDN))
+                                break;
+                } while (!time_after(jiffies, timeout));
+                if (!(val & PLL_TICOPWDN) || !(val & PLL_LDOPWDN)) {
+                        dev_err(phy->dev, "Failed to power down: PLL_STATUS 0x%x\n",
+                                val);
+                        return -EBUSY;
+                }
        }
+        ti_pipe3_disable_clocks(phy);
        return 0;
 }
 static struct phy_ops ops = {
@@ -306,7 +307,6 @@ static int ti_pipe3_probe(struct platform_device *pdev)
                return -ENOMEM;
        phy->dev                = &pdev->dev;
-        spin_lock_init(&phy->lock);
        if (!of_device_is_compatible(node, "ti,phy-pipe3-pcie")) {
                match = of_match_device(ti_pipe3_id_table, &pdev->dev);
@@ -402,6 +402,10 @@ static int ti_pipe3_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, phy);
        pm_runtime_enable(phy->dev);
+        /* Prevent auto-disable of refclk for SATA PHY due to Errata i783 */
+        if (of_device_is_compatible(node, "ti,phy-pipe3-sata"))
+                if (!IS_ERR(phy->refclk))
+                        clk_prepare_enable(phy->refclk);
        generic_phy = devm_phy_create(phy->dev, NULL, &ops);
        if (IS_ERR(generic_phy))
@@ -413,63 +417,33 @@ static int ti_pipe3_probe(struct platform_device *pdev)
        if (IS_ERR(phy_provider))
                return PTR_ERR(phy_provider);
-        pm_runtime_get(&pdev->dev);
        return 0;
 }
 static int ti_pipe3_remove(struct platform_device *pdev)
 {
-        if (!pm_runtime_suspended(&pdev->dev))
-                pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        return 0;
 }
-#ifdef CONFIG_PM
+static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
-static int ti_pipe3_enable_refclk(struct ti_pipe3 *phy)
 {
-        if (!IS_ERR(phy->refclk) && !phy->refclk_enabled) {
+        int ret = 0;
-                int ret;
+        if (!IS_ERR(phy->refclk)) {
                ret = clk_prepare_enable(phy->refclk);
                if (ret) {
                        dev_err(phy->dev, "Failed to enable refclk %d\n", ret);
                        return ret;
                }
-                phy->refclk_enabled = true;
        }
-        return 0;
-}
-static void ti_pipe3_disable_refclk(struct ti_pipe3 *phy)
-{
-        if (!IS_ERR(phy->refclk))
-                clk_disable_unprepare(phy->refclk);
-        phy->refclk_enabled = false;
-}
-static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
-{
-        int ret = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&phy->lock, flags);
-        if (phy->enabled)
-                goto err1;
-        ret = ti_pipe3_enable_refclk(phy);
-        if (ret)
-                goto err1;
        if (!IS_ERR(phy->wkupclk)) {
                ret = clk_prepare_enable(phy->wkupclk);
                if (ret) {
                        dev_err(phy->dev, "Failed to enable wkupclk %d\n", ret);
-                        goto err2;
+                        goto disable_refclk;
                }
        }
@@ -477,96 +451,33 @@ static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
                ret = clk_prepare_enable(phy->div_clk);
                if (ret) {
                        dev_err(phy->dev, "Failed to enable div_clk %d\n", ret);
-                        goto err3;
+                        goto disable_wkupclk;
                }
        }
-        phy->enabled = true;
-        spin_unlock_irqrestore(&phy->lock, flags);
        return 0;
-err3:
+disable_wkupclk:
        if (!IS_ERR(phy->wkupclk))
                clk_disable_unprepare(phy->wkupclk);
-err2:
+disable_refclk:
        if (!IS_ERR(phy->refclk))
                clk_disable_unprepare(phy->refclk);
-        ti_pipe3_disable_refclk(phy);
-err1:
-        spin_unlock_irqrestore(&phy->lock, flags);
        return ret;
 }
 static void ti_pipe3_disable_clocks(struct ti_pipe3 *phy)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&phy->lock, flags);
-        if (!phy->enabled) {
-                spin_unlock_irqrestore(&phy->lock, flags);
-                return;
-        }
        if (!IS_ERR(phy->wkupclk))
                clk_disable_unprepare(phy->wkupclk);
-        /* Don't disable refclk for SATA PHY due to Errata i783 */
+        if (!IS_ERR(phy->refclk))
-        if (!of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata"))
+                clk_disable_unprepare(phy->refclk);
-                ti_pipe3_disable_refclk(phy);
        if (!IS_ERR(phy->div_clk))
                clk_disable_unprepare(phy->div_clk);
-        phy->enabled = false;
-        spin_unlock_irqrestore(&phy->lock, flags);
-}
-static int ti_pipe3_runtime_suspend(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        ti_pipe3_disable_clocks(phy);
-        return 0;
 }
-static int ti_pipe3_runtime_resume(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        int ret = 0;
-        ret = ti_pipe3_enable_clocks(phy);
-        return ret;
-}
-static int ti_pipe3_suspend(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        ti_pipe3_disable_clocks(phy);
-        return 0;
-}
-static int ti_pipe3_resume(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        int ret;
-        ret = ti_pipe3_enable_clocks(phy);
-        if (ret)
-                return ret;
-        pm_runtime_disable(dev);
-        pm_runtime_set_active(dev);
-        pm_runtime_enable(dev);
-        return 0;
-}
-#endif
-static const struct dev_pm_ops ti_pipe3_pm_ops = {
-        SET_RUNTIME_PM_OPS(ti_pipe3_runtime_suspend,
-                           ti_pipe3_runtime_resume, NULL)
-        SET_SYSTEM_SLEEP_PM_OPS(ti_pipe3_suspend, ti_pipe3_resume)
-};
 static const struct of_device_id ti_pipe3_id_table[] = {
        {
                .compatible = "ti,phy-usb3",
@@ -592,7 +503,6 @@ static struct platform_driver ti_pipe3_driver = {
        .remove         = ti_pipe3_remove,
        .driver         = {
                .name   = "ti-pipe3",
-                .pm     = &ti_pipe3_pm_ops,
                .of_match_table = ti_pipe3_id_table,
        },
 };
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index efcf2a2b3975..6177315ab74e 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -473,6 +473,8 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data)
        spin_lock_irqsave(&pc->irq_lock[bank], flags);
        bcm2835_gpio_irq_config(pc, gpio, false);
+        /* Clear events that were latched prior to clearing event sources */
+        bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
        clear_bit(offset, &pc->enabled_irq_map[bank]);
        spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 5fd4437cee15..88a7fac11bd4 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -403,14 +403,13 @@ static int imx1_pinconf_set(struct pinctrl_dev *pctldev,
                             unsigned num_configs)
 {
        struct imx1_pinctrl *ipctl = pinctrl_dev_get_drvdata(pctldev);
-        const struct imx1_pinctrl_soc_info *info = ipctl->info;
        int i;
        for (i = 0; i != num_configs; ++i) {
                imx1_write_bit(ipctl, pin_id, configs[i] & 0x01, MX1_PUEN);
                dev_dbg(ipctl->dev, "pinconf set pullup pin %s\n",
-                        info->pins[pin_id].name);
+                        pin_desc_get(pctldev, pin_id)->name);
        }
        return 0;
diff --git a/drivers/pinctrl/nomadik/pinctrl-abx500.c b/drivers/pinctrl/nomadik/pinctrl-abx500.c
index 557d0f2a3031..97681fac082e 100644
--- a/drivers/pinctrl/nomadik/pinctrl-abx500.c
+++ b/drivers/pinctrl/nomadik/pinctrl-abx500.c
@@ -787,7 +787,6 @@ static const struct pinmux_ops abx500_pinmux_ops = {
        .set_mux = abx500_pmx_set,
        .gpio_request_enable = abx500_gpio_request_enable,
        .gpio_disable_free = abx500_gpio_disable_free,
-        .strict = true,
 };
 static int abx500_get_groups_cnt(struct pinctrl_dev *pctldev)
diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
index ef0b697639a7..347c763a6a78 100644
--- a/drivers/pinctrl/pinctrl-lpc18xx.c
+++ b/drivers/pinctrl/pinctrl-lpc18xx.c
@@ -823,7 +823,7 @@ static int lpc18xx_pconf_set_i2c0(struct pinctrl_dev *pctldev,
                break;
        case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
-                if (param)
+                if (param_val)
                        *reg &= ~(LPC18XX_SCU_I2C0_ZIF << shift);
                else
                        *reg |= (LPC18XX_SCU_I2C0_ZIF << shift);
@@ -876,7 +876,7 @@ static int lpc18xx_pconf_set_pin(struct pinctrl_dev *pctldev,
                break;
        case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
-                if (param)
+                if (param_val)
                        *reg &= ~LPC18XX_SCU_PIN_ZIF;
                else
                        *reg |= LPC18XX_SCU_PIN_ZIF;
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index b2de09d3b1a0..0b8d480171a3 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1760,7 +1760,8 @@ static int pcs_irq_init_chained_handler(struct pcs_device *pcs,
                int res;
                res = request_irq(pcs_soc->irq, pcs_irq_handler,
-                                  IRQF_SHARED | IRQF_NO_SUSPEND,
+                                  IRQF_SHARED | IRQF_NO_SUSPEND |
+                                  IRQF_NO_THREAD,
                                  name, pcs_soc);
                if (res) {
                        pcs_soc->irq = -1;
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index 3dd5a3b2ac62..c760bf43d116 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -33,11 +33,6 @@
 #include "../core.h"
 #include "pinctrl-samsung.h"
-#define GROUP_SUFFIX            "-grp"
-#define GSUFFIX_LEN             sizeof(GROUP_SUFFIX)
-#define FUNCTION_SUFFIX         "-mux"
-#define FSUFFIX_LEN             sizeof(FUNCTION_SUFFIX)
 /* list of all possible config options supported */
 static struct pin_config {
        const char *property;
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index c7508d5f6886..0874cfee6889 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -224,7 +224,7 @@ struct sh_pfc_soc_info {
 /* PINMUX_GPIO_GP_ALL - Expand to a list of sh_pfc_pin entries */
 #define _GP_GPIO(bank, _pin, _name, sfx)                                \
-        [(bank * 32) + _pin] = {                                        \
+        {                                                               \
                .pin = (bank * 32) + _pin,                              \
                .name = __stringify(_name),                             \
                .enum_id = _name##_DATA,                                \
diff --git a/drivers/pinctrl/spear/pinctrl-spear.c b/drivers/pinctrl/spear/pinctrl-spear.c
index f87a5eaf75da..0afaf79a4e51 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.c
+++ b/drivers/pinctrl/spear/pinctrl-spear.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * Inspired from:
 * - U300 Pinctl drivers
diff --git a/drivers/pinctrl/spear/pinctrl-spear.h b/drivers/pinctrl/spear/pinctrl-spear.h
index dc8bf85ecb2a..27c2cc8d83ad 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.h
+++ b/drivers/pinctrl/spear/pinctrl-spear.h
@@ -2,7 +2,7 @@
 * Driver header file for the ST Microelectronics SPEAr pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/pinctrl/spear/pinctrl-spear1310.c b/drivers/pinctrl/spear/pinctrl-spear1310.c
index a7bdc537efa7..92611bb757ac 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1310.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr1310 pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -2730,7 +2730,7 @@ static void __exit spear1310_pinctrl_exit(void)
 }
 module_exit(spear1310_pinctrl_exit);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr1310 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear1310_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear1340.c b/drivers/pinctrl/spear/pinctrl-spear1340.c
index f43ec85a0328..f842e9dc40d0 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1340.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1340.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr1340 pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -2046,7 +2046,7 @@ static void __exit spear1340_pinctrl_exit(void)
 }
 module_exit(spear1340_pinctrl_exit);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr1340 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear1340_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear300.c b/drivers/pinctrl/spear/pinctrl-spear300.c
index da8990a8eeef..d998a2ccff48 100644
--- a/drivers/pinctrl/spear/pinctrl-spear300.c
+++ b/drivers/pinctrl/spear/pinctrl-spear300.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr300 pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -703,7 +703,7 @@ static void __exit spear300_pinctrl_exit(void)
 }
 module_exit(spear300_pinctrl_exit);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr300 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear300_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear310.c b/drivers/pinctrl/spear/pinctrl-spear310.c
index 31ede51e819b..609b18aceb16 100644
--- a/drivers/pinctrl/spear/pinctrl-spear310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear310.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr310 pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -426,7 +426,7 @@ static void __exit spear310_pinctrl_exit(void)
 }
 module_exit(spear310_pinctrl_exit);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr310 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear310_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear320.c b/drivers/pinctrl/spear/pinctrl-spear320.c
index 506e40b641e0..c07114431bd4 100644
--- a/drivers/pinctrl/spear/pinctrl-spear320.c
+++ b/drivers/pinctrl/spear/pinctrl-spear320.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr320 pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -3467,7 +3467,7 @@ static void __exit spear320_pinctrl_exit(void)
 }
 module_exit(spear320_pinctrl_exit);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr320 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear320_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.c b/drivers/pinctrl/spear/pinctrl-spear3xx.c
index 12ee21af766b..d3119aafe709 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.c
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.c
@@ -2,7 +2,7 @@
 * Driver for the ST Microelectronics SPEAr3xx pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.h b/drivers/pinctrl/spear/pinctrl-spear3xx.h
index 7860b36053c4..ce19dcf8f08b 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.h
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.h
@@ -2,7 +2,7 @@
 * Header file for the ST Microelectronics SPEAr3xx pinmux
 *
 * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index ed317ccac4a2..aaeeae81e3a9 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -309,12 +309,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
 static struct calling_interface_buffer *buffer;
 static DEFINE_MUTEX(buffer_mutex);
-static int hwswitch_state;
+static void clear_buffer(void)
+{
+        memset(buffer, 0, sizeof(struct calling_interface_buffer));
+}
 static void get_buffer(void)
 {
        mutex_lock(&buffer_mutex);
-        memset(buffer, 0, sizeof(struct calling_interface_buffer));
+        clear_buffer();
 }
 static void release_buffer(void)
@@ -548,21 +551,41 @@ static int dell_rfkill_set(void *data, bool blocked)
        int disable = blocked ? 1 : 0;
        unsigned long radio = (unsigned long)data;
        int hwswitch_bit = (unsigned long)data - 1;
+        int hwswitch;
+        int status;
+        int ret;
        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        status = buffer->output[1];
+        if (ret != 0)
+                goto out;
+        clear_buffer();
+        buffer->input[0] = 0x2;
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        hwswitch = buffer->output[1];
        /* If the hardware switch controls this radio, and the hardware
           switch is disabled, always disable the radio */
-        if ((hwswitch_state & BIT(hwswitch_bit)) &&
+        if (ret == 0 && (hwswitch & BIT(hwswitch_bit)) &&
-            !(buffer->output[1] & BIT(16)))
+            (status & BIT(0)) && !(status & BIT(16)))
                disable = 1;
+        clear_buffer();
        buffer->input[0] = (1 | (radio<<8) | (disable << 16));
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+ out:
        release_buffer();
-        return 0;
+        return dell_smi_error(ret);
 }
 /* Must be called with the buffer held */
@@ -572,6 +595,7 @@ static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
        if (status & BIT(0)) {
                /* Has hw-switch, sync sw_state to BIOS */
                int block = rfkill_blocked(rfkill);
+                clear_buffer();
                buffer->input[0] = (1 | (radio << 8) | (block << 16));
                dell_send_request(buffer, 17, 11);
        } else {
@@ -581,23 +605,43 @@ static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
 }
 static void dell_rfkill_update_hw_state(struct rfkill *rfkill, int radio,
-                                        int status)
+                                        int status, int hwswitch)
 {
-        if (hwswitch_state & (BIT(radio - 1)))
+        if (hwswitch & (BIT(radio - 1)))
                rfkill_set_hw_state(rfkill, !(status & BIT(16)));
 }
 static void dell_rfkill_query(struct rfkill *rfkill, void *data)
 {
+        int radio = ((unsigned long)data & 0xF);
+        int hwswitch;
        int status;
+        int ret;
        get_buffer();
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
        status = buffer->output[1];
-        dell_rfkill_update_hw_state(rfkill, (unsigned long)data, status);
+        if (ret != 0 || !(status & BIT(0))) {
+                release_buffer();
+                return;
+        }
+        clear_buffer();
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        hwswitch = buffer->output[1];
        release_buffer();
+        if (ret != 0)
+                return;
+        dell_rfkill_update_hw_state(rfkill, radio, status, hwswitch);
 }
 static const struct rfkill_ops dell_rfkill_ops = {
@@ -609,13 +653,27 @@ static struct dentry *dell_laptop_dir;
 static int dell_debugfs_show(struct seq_file *s, void *data)
 {
+        int hwswitch_state;
+        int hwswitch_ret;
        int status;
+        int ret;
        get_buffer();
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
        status = buffer->output[1];
+        clear_buffer();
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        hwswitch_ret = buffer->output[0];
+        hwswitch_state = buffer->output[1];
        release_buffer();
+        seq_printf(s, "return:\t%d\n", ret);
        seq_printf(s, "status:\t0x%X\n", status);
        seq_printf(s, "Bit 0 : Hardware switch supported:   %lu\n",
                   status & BIT(0));
@@ -657,7 +715,8 @@ static int dell_debugfs_show(struct seq_file *s, void *data)
        seq_printf(s, "Bit 21: WiGig is blocked:            %lu\n",
                  (status & BIT(21)) >> 21);
-        seq_printf(s, "\nhwswitch_state:\t0x%X\n", hwswitch_state);
+        seq_printf(s, "\nhwswitch_return:\t%d\n", hwswitch_ret);
+        seq_printf(s, "hwswitch_state:\t0x%X\n", hwswitch_state);
        seq_printf(s, "Bit 0 : Wifi controlled by switch:      %lu\n",
                   hwswitch_state & BIT(0));
        seq_printf(s, "Bit 1 : Bluetooth controlled by switch: %lu\n",
@@ -693,25 +752,43 @@ static const struct file_operations dell_debugfs_fops = {
 static void dell_update_rfkill(struct work_struct *ignored)
 {
+        int hwswitch = 0;
        int status;
+        int ret;
        get_buffer();
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
        status = buffer->output[1];
+        if (ret != 0)
+                goto out;
+        clear_buffer();
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        if (ret == 0 && (status & BIT(0)))
+                hwswitch = buffer->output[1];
        if (wifi_rfkill) {
-                dell_rfkill_update_hw_state(wifi_rfkill, 1, status);
+                dell_rfkill_update_hw_state(wifi_rfkill, 1, status, hwswitch);
                dell_rfkill_update_sw_state(wifi_rfkill, 1, status);
        }
        if (bluetooth_rfkill) {
-                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status);
+                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status,
+                                            hwswitch);
                dell_rfkill_update_sw_state(bluetooth_rfkill, 2, status);
        }
        if (wwan_rfkill) {
-                dell_rfkill_update_hw_state(wwan_rfkill, 3, status);
+                dell_rfkill_update_hw_state(wwan_rfkill, 3, status, hwswitch);
                dell_rfkill_update_sw_state(wwan_rfkill, 3, status);
        }
+ out:
        release_buffer();
 }
 static DECLARE_DELAYED_WORK(dell_rfkill_work, dell_update_rfkill);
@@ -773,21 +850,17 @@ static int __init dell_setup_rfkill(void)
        get_buffer();
        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
        status = buffer->output[1];
-        buffer->input[0] = 0x2;
-        dell_send_request(buffer, 17, 11);
-        hwswitch_state = buffer->output[1];
        release_buffer();
-        if (!(status & BIT(0))) {
+        /* dell wireless info smbios call is not supported */
-                if (force_rfkill) {
+        if (ret != 0)
-                        /* No hwsitch, clear all hw-controlled bits */
+                return 0;
-                        hwswitch_state &= ~7;
-                } else {
+        /* rfkill is only tested on laptops with a hwswitch */
-                        /* rfkill is only tested on laptops with a hwswitch */
+        if (!(status & BIT(0)) && !force_rfkill)
-                        return 0;
+                return 0;
-                }
-        }
        if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
                wifi_rfkill = rfkill_alloc("dell-wifi", &platform_device->dev,
@@ -932,47 +1005,50 @@ static void dell_cleanup_rfkill(void)
 static int dell_send_intensity(struct backlight_device *bd)
 {
-        int ret = 0;
+        int token;
+        int ret;
+        token = find_token_location(BRIGHTNESS_TOKEN);
+        if (token == -1)
+                return -ENODEV;
        get_buffer();
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
+        buffer->input[0] = token;
        buffer->input[1] = bd->props.brightness;
-        if (buffer->input[0] == -1) {
-                ret = -ENODEV;
-                goto out;
-        }
        if (power_supply_is_system_supplied() > 0)
                dell_send_request(buffer, 1, 2);
        else
                dell_send_request(buffer, 1, 1);
- out:
+        ret = dell_smi_error(buffer->output[0]);
        release_buffer();
        return ret;
 }
 static int dell_get_intensity(struct backlight_device *bd)
 {
-        int ret = 0;
+        int token;
+        int ret;
-        get_buffer();
+        token = find_token_location(BRIGHTNESS_TOKEN);
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
+        if (token == -1)
+                return -ENODEV;
-        if (buffer->input[0] == -1) {
+        get_buffer();
-                ret = -ENODEV;
+        buffer->input[0] = token;
-                goto out;
-        }
        if (power_supply_is_system_supplied() > 0)
                dell_send_request(buffer, 0, 2);
        else
                dell_send_request(buffer, 0, 1);
-        ret = buffer->output[1];
+        if (buffer->output[0])
+                ret = dell_smi_error(buffer->output[0]);
+        else
+                ret = buffer->output[1];
- out:
        release_buffer();
        return ret;
 }
@@ -2036,6 +2112,7 @@ static void kbd_led_exit(void)
 static int __init dell_init(void)
 {
        int max_intensity = 0;
+        int token;
        int ret;
        if (!dmi_check_system(dell_device_table))
@@ -2094,13 +2171,15 @@ static int __init dell_init(void)
        if (acpi_video_get_backlight_type() != acpi_backlight_vendor)
                return 0;
-        get_buffer();
+        token = find_token_location(BRIGHTNESS_TOKEN);
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
+        if (token != -1) {
-        if (buffer->input[0] != -1) {
+                get_buffer();
+                buffer->input[0] = token;
                dell_send_request(buffer, 0, 2);
-                max_intensity = buffer->output[3];
+                if (buffer->output[0] == 0)
+                        max_intensity = buffer->output[3];
+                release_buffer();
        }
-        release_buffer();
        if (max_intensity) {
                struct backlight_properties props;
diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
index d734763dab69..105cfffe82c6 100644
--- a/drivers/platform/x86/intel_pmc_ipc.c
+++ b/drivers/platform/x86/intel_pmc_ipc.c
@@ -96,18 +96,18 @@ static struct intel_pmc_ipc_dev {
        struct completion cmd_complete;
        /* The following PMC BARs share the same ACPI device with the IPC */
-        void *acpi_io_base;
+        resource_size_t acpi_io_base;
        int acpi_io_size;
        struct platform_device *tco_dev;
        /* gcr */
-        void *gcr_base;
+        resource_size_t gcr_base;
        int gcr_size;
        /* punit */
-        void *punit_base;
+        resource_size_t punit_base;
        int punit_size;
-        void *punit_base2;
+        resource_size_t punit_base2;
        int punit_size2;
        struct platform_device *punit_dev;
 } ipcdev;
@@ -210,10 +210,15 @@ static int intel_pmc_ipc_check_status(void)
        return ret;
 }
-/*
+/**
- * intel_pmc_ipc_simple_command
+ * intel_pmc_ipc_simple_command() - Simple IPC command
- * @cmd: command
+ * @cmd:        IPC command code.
- * @sub: sub type
+ * @sub:        IPC command sub type.
+ *
+ * Send a simple IPC command to PMC when don't need to specify
+ * input/output data and source/dest pointers.
+ *
+ * Return:      an IPC error code or 0 on success.
 */
 int intel_pmc_ipc_simple_command(int cmd, int sub)
 {
@@ -232,16 +237,20 @@ int intel_pmc_ipc_simple_command(int cmd, int sub)
 }
 EXPORT_SYMBOL_GPL(intel_pmc_ipc_simple_command);
-/*
+/**
- * intel_pmc_ipc_raw_cmd
+ * intel_pmc_ipc_raw_cmd() - IPC command with data and pointers
- * @cmd: command
+ * @cmd:        IPC command code.
- * @sub: sub type
+ * @sub:        IPC command sub type.
- * @in: input data
+ * @in:         input data of this IPC command.
- * @inlen: input length in bytes
+ * @inlen:      input data length in bytes.
- * @out: output data
+ * @out:        output data of this IPC command.
- * @outlen: output length in dwords
+ * @outlen:     output data length in dwords.
- * @sptr: data writing to SPTR register
+ * @sptr:       data writing to SPTR register.
- * @dptr: data writing to DPTR register
+ * @dptr:       data writing to DPTR register.
+ *
+ * Send an IPC command to PMC with input/output data and source/dest pointers.
+ *
+ * Return:      an IPC error code or 0 on success.
 */
 int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen, u32 *out,
                          u32 outlen, u32 dptr, u32 sptr)
@@ -278,14 +287,18 @@ int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen, u32 *out,
 }
 EXPORT_SYMBOL_GPL(intel_pmc_ipc_raw_cmd);
-/*
+/**
- * intel_pmc_ipc_command
+ * intel_pmc_ipc_command() -  IPC command with input/output data
- * @cmd: command
+ * @cmd:        IPC command code.
- * @sub: sub type
+ * @sub:        IPC command sub type.
- * @in: input data
+ * @in:         input data of this IPC command.
- * @inlen: input length in bytes
+ * @inlen:      input data length in bytes.
- * @out: output data
+ * @out:        output data of this IPC command.
- * @outlen: output length in dwords
+ * @outlen:     output data length in dwords.
+ *
+ * Send an IPC command to PMC with input/output data.
+ *
+ * Return:      an IPC error code or 0 on success.
 */
 int intel_pmc_ipc_command(u32 cmd, u32 sub, u8 *in, u32 inlen,
                          u32 *out, u32 outlen)
@@ -480,11 +493,11 @@ static int ipc_create_punit_device(void)
        pdev->dev.parent = ipcdev.dev;
        res = punit_res;
-        res->start = (resource_size_t)ipcdev.punit_base;
+        res->start = ipcdev.punit_base;
        res->end = res->start + ipcdev.punit_size - 1;
        res = punit_res + PUNIT_RESOURCE_INTER;
-        res->start = (resource_size_t)ipcdev.punit_base2;
+        res->start = ipcdev.punit_base2;
        res->end = res->start + ipcdev.punit_size2 - 1;
        ret = platform_device_add_resources(pdev, punit_res,
@@ -522,15 +535,15 @@ static int ipc_create_tco_device(void)
        pdev->dev.parent = ipcdev.dev;
        res = tco_res + TCO_RESOURCE_ACPI_IO;
-        res->start = (resource_size_t)ipcdev.acpi_io_base + TCO_BASE_OFFSET;
+        res->start = ipcdev.acpi_io_base + TCO_BASE_OFFSET;
        res->end = res->start + TCO_REGS_SIZE - 1;
        res = tco_res + TCO_RESOURCE_SMI_EN_IO;
-        res->start = (resource_size_t)ipcdev.acpi_io_base + SMI_EN_OFFSET;
+        res->start = ipcdev.acpi_io_base + SMI_EN_OFFSET;
        res->end = res->start + SMI_EN_SIZE - 1;
        res = tco_res + TCO_RESOURCE_GCR_MEM;
-        res->start = (resource_size_t)ipcdev.gcr_base;
+        res->start = ipcdev.gcr_base;
        res->end = res->start + ipcdev.gcr_size - 1;
        ret = platform_device_add_resources(pdev, tco_res, ARRAY_SIZE(tco_res));
@@ -589,7 +602,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                return -ENXIO;
        }
        size = resource_size(res);
-        ipcdev.acpi_io_base = (void *)res->start;
+        ipcdev.acpi_io_base = res->start;
        ipcdev.acpi_io_size = size;
        dev_info(&pdev->dev, "io res: %llx %x\n",
                 (long long)res->start, (int)resource_size(res));
@@ -601,7 +614,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                return -ENXIO;
        }
        size = resource_size(res);
-        ipcdev.punit_base = (void *)res->start;
+        ipcdev.punit_base = res->start;
        ipcdev.punit_size = size;
        dev_info(&pdev->dev, "punit data res: %llx %x\n",
                 (long long)res->start, (int)resource_size(res));
@@ -613,7 +626,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                return -ENXIO;
        }
        size = resource_size(res);
-        ipcdev.punit_base2 = (void *)res->start;
+        ipcdev.punit_base2 = res->start;
        ipcdev.punit_size2 = size;
        dev_info(&pdev->dev, "punit interface res: %llx %x\n",
                 (long long)res->start, (int)resource_size(res));
@@ -637,7 +650,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
        }
        ipcdev.ipc_base = addr;
-        ipcdev.gcr_base = (void *)(res->start + size);
+        ipcdev.gcr_base = res->start + size;
        ipcdev.gcr_size = PLAT_RESOURCE_GCR_SIZE;
        dev_info(&pdev->dev, "ipc res: %llx %x\n",
                 (long long)res->start, (int)resource_size(res));
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index 001b199a8c33..187d1086d15c 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -216,13 +216,13 @@ static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
        int nc;
        u32 offset = 0;
        int err;
-        u8 cbuf[IPC_WWBUF_SIZE] = { };
+        u8 cbuf[IPC_WWBUF_SIZE];
        u32 *wbuf = (u32 *)&cbuf;
-        mutex_lock(&ipclock);
        memset(cbuf, 0, sizeof(cbuf));
+        mutex_lock(&ipclock);
        if (ipcdev.pdev == NULL) {
                mutex_unlock(&ipclock);
                return -ENODEV;
diff --git a/drivers/regulator/88pm800.c b/drivers/regulator/88pm800.c
index 832932bdc977..7fd4f511d78f 100644
--- a/drivers/regulator/88pm800.c
+++ b/drivers/regulator/88pm800.c
@@ -130,7 +130,7 @@ struct pm800_regulators {
                .owner  = THIS_MODULE,                                  \
                .n_voltages = ARRAY_SIZE(ldo_volt_table),               \
                .vsel_reg       = PM800_##vreg##_VOUT,                  \
-                .vsel_mask      = 0x1f,                                 \
+                .vsel_mask      = 0xf,                                  \
                .enable_reg     = PM800_##ereg,                         \
                .enable_mask    = 1 << (ebit),                          \
                .volt_table     = ldo_volt_table,                       \
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index c9f72019bd68..78387a6cbae5 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -109,6 +109,7 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
 static struct regulator *create_regulator(struct regulator_dev *rdev,
                                          struct device *dev,
                                          const char *supply_name);
+static void _regulator_put(struct regulator *regulator);
 static const char *rdev_get_name(struct regulator_dev *rdev)
 {
@@ -1105,6 +1106,9 @@ static int set_supply(struct regulator_dev *rdev,
        rdev_info(rdev, "supplied by %s\n", rdev_get_name(supply_rdev));
+        if (!try_module_get(supply_rdev->owner))
+                return -ENODEV;
        rdev->supply = create_regulator(supply_rdev, &rdev->dev, "SUPPLY");
        if (rdev->supply == NULL) {
                err = -ENOMEM;
@@ -1381,9 +1385,13 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
        }
        if (!r) {
-                dev_err(dev, "Failed to resolve %s-supply for %s\n",
+                if (have_full_constraints()) {
-                        rdev->supply_name, rdev->desc->name);
+                        r = dummy_regulator_rdev;
-                return -EPROBE_DEFER;
+                } else {
+                        dev_err(dev, "Failed to resolve %s-supply for %s\n",
+                                rdev->supply_name, rdev->desc->name);
+                        return -EPROBE_DEFER;
+                }
        }
        /* Recursively resolve the supply of the supply */
@@ -1398,8 +1406,11 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
        /* Cascade always-on state to supply */
        if (_regulator_is_enabled(rdev)) {
                ret = regulator_enable(rdev->supply);
-                if (ret < 0)
+                if (ret < 0) {
+                        if (rdev->supply)
+                                _regulator_put(rdev->supply);
                        return ret;
+                }
        }
        return 0;
diff --git a/drivers/regulator/max8973-regulator.c b/drivers/regulator/max8973-regulator.c
index 6f2bdad8b4d8..e94ddcf97722 100644
--- a/drivers/regulator/max8973-regulator.c
+++ b/drivers/regulator/max8973-regulator.c
@@ -450,7 +450,7 @@ static struct max8973_regulator_platform_data *max8973_parse_dt(
                pdata->control_flags  |= MAX8973_CONTROL_FREQ_SHIFT_9PER_ENABLE;
        if (of_property_read_bool(np, "maxim,enable-bias-control"))
-                pdata->control_flags  |= MAX8973_BIAS_ENABLE;
+                pdata->control_flags  |= MAX8973_CONTROL_BIAS_ENABLE;
        return pdata;
 }
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 326ffb553371..72fc3c32db49 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -34,6 +34,8 @@
 #include <linux/mfd/samsung/s2mps14.h>
 #include <linux/mfd/samsung/s2mpu02.h>
+/* The highest number of possible regulators for supported devices. */
+#define S2MPS_REGULATOR_MAX             S2MPS13_REGULATOR_MAX
 struct s2mps11_info {
        unsigned int rdev_num;
        int ramp_delay2;
@@ -49,7 +51,7 @@ struct s2mps11_info {
         * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
         * the suspend mode was enabled.
         */
-        unsigned long long s2mps14_suspend_state:50;
+        DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
        /* Array of size rdev_num with GPIO-s for external sleep control */
        int *ext_control_gpio;
@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
        switch (s2mps11->dev_type) {
        case S2MPS13X:
        case S2MPS14X:
-                if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
+                if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
                        val = S2MPS14_ENABLE_SUSPEND;
                else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
                        val = S2MPS14_ENABLE_EXT_CONTROL;
@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
                        val = rdev->desc->enable_mask;
                break;
        case S2MPU02:
-                if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
+                if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
                        val = S2MPU02_ENABLE_SUSPEND;
                else
                        val = rdev->desc->enable_mask;
@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend_disable(struct regulator_dev *rdev)
        if (ret < 0)
                return ret;
-        s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
+        set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
        /*
         * Don't enable suspend mode if regulator is already disabled because
         * this would effectively for a short time turn on the regulator after
@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
        case S2MPS11X:
                s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
                regulators = s2mps11_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                break;
        case S2MPS13X:
                s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
                regulators = s2mps13_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                break;
        case S2MPS14X:
                s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
                regulators = s2mps14_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                break;
        case S2MPU02:
                s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
                regulators = s2mpu02_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                break;
        default:
                dev_err(&pdev->dev, "Invalid device type: %u\n",
diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
index 4b62d1a875e4..2b08cac62f07 100644
--- a/drivers/rtc/rtc-armada38x.c
+++ b/drivers/rtc/rtc-armada38x.c
@@ -88,7 +88,7 @@ static int armada38x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
        struct armada38x_rtc *rtc = dev_get_drvdata(dev);
        int ret = 0;
-        unsigned long time, flags;
+        unsigned long time;
        ret = rtc_tm_to_time(tm, &time);
diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
index c0090b698ff3..eab230be5a54 100644
--- a/drivers/rtc/rtc-mt6397.c
+++ b/drivers/rtc/rtc-mt6397.c
@@ -343,6 +343,8 @@ static int mtk_rtc_probe(struct platform_device *pdev)
                goto out_dispose_irq;
        }
+        device_init_wakeup(&pdev->dev, 1);
        rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev,
                                           &mtk_rtc_ops, THIS_MODULE);
        if (IS_ERR(rtc->rtc_dev)) {
@@ -351,8 +353,6 @@ static int mtk_rtc_probe(struct platform_device *pdev)
                goto out_free_irq;
        }
-        device_init_wakeup(&pdev->dev, 1);
        return 0;
 out_free_irq:
diff --git a/drivers/s390/Makefile b/drivers/s390/Makefile
index 95bccfd3f169..e5225ad9c5b1 100644
--- a/drivers/s390/Makefile
+++ b/drivers/s390/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the S/390 specific device drivers
 #
-obj-y += cio/ block/ char/ crypto/ net/ scsi/ kvm/
+obj-y += cio/ block/ char/ crypto/ net/ scsi/ virtio/
 drivers-y += drivers/s390/built-in.o
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 1aec8ff0b587..f73d2f579a7e 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1863,6 +1863,33 @@ static void __dasd_device_check_expire(struct dasd_device *device)
 }
 /*
+ * return 1 when device is not eligible for IO
+ */
+static int __dasd_device_is_unusable(struct dasd_device *device,
+                                     struct dasd_ccw_req *cqr)
+{
+        int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM);
+        if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+                /* dasd is being set offline. */
+                return 1;
+        }
+        if (device->stopped) {
+                if (device->stopped & mask) {
+                        /* stopped and CQR will not change that. */
+                        return 1;
+                }
+                if (!test_bit(DASD_CQR_VERIFY_PATH, &cqr->flags)) {
+                        /* CQR is not able to change device to
+                         * operational. */
+                        return 1;
+                }
+                /* CQR required to get device operational. */
+        }
+        return 0;
+}
+/*
 * Take a look at the first request on the ccw queue and check
 * if it needs to be started.
 */
@@ -1876,13 +1903,8 @@ static void __dasd_device_start_head(struct dasd_device *device)
        cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, devlist);
        if (cqr->status != DASD_CQR_QUEUED)
                return;
-        /* when device is stopped, return request to previous layer
+        /* if device is not usable return request to upper layer */
-         * exception: only the disconnect or unresumed bits are set and the
+        if (__dasd_device_is_unusable(device, cqr)) {
-         * cqr is a path verification request
-         */
-        if (device->stopped &&
-            !(!(device->stopped & ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM))
-              && test_bit(DASD_CQR_VERIFY_PATH, &cqr->flags))) {
                cqr->intrc = -EAGAIN;
                cqr->status = DASD_CQR_CLEARED;
                dasd_schedule_device_bh(device);
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index a2597e683e79..ee3a6faae22a 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -699,7 +699,8 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
                                               struct dasd_device, alias_list);
        spin_unlock_irqrestore(&lcu->lock, flags);
        alias_priv = (struct dasd_eckd_private *) alias_device->private;
-        if ((alias_priv->count < private->count) && !alias_device->stopped)
+        if ((alias_priv->count < private->count) && !alias_device->stopped &&
+            !test_bit(DASD_FLAG_OFFLINE, &alias_device->flags))
                return alias_device;
        else
                return NULL;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index aeed7969fd79..7bc6df3100ef 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -7,6 +7,7 @@
 #define KMSG_COMPONENT "sclp_early"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+#include <linux/errno.h>
 #include <asm/ctl_reg.h>
 #include <asm/sclp.h>
 #include <asm/ipl.h>
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 08f1830cbfc4..01bf1f5cf2e9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -54,6 +54,10 @@ MODULE_DESCRIPTION("Cryptographic Coprocessor interface, " \
                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
+static int zcrypt_hwrng_seed = 1;
+module_param_named(hwrng_seed, zcrypt_hwrng_seed, int, S_IRUSR|S_IRGRP);
+MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
 static DEFINE_SPINLOCK(zcrypt_device_lock);
 static LIST_HEAD(zcrypt_device_list);
 static int zcrypt_device_count = 0;
@@ -1373,6 +1377,7 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
 static struct hwrng zcrypt_rng_dev = {
        .name           = "zcrypt",
        .data_read      = zcrypt_rng_data_read,
+        .quality        = 990,
 };
 static int zcrypt_rng_device_add(void)
@@ -1387,6 +1392,8 @@ static int zcrypt_rng_device_add(void)
                        goto out;
                }
                zcrypt_rng_buffer_index = 0;
+                if (!zcrypt_hwrng_seed)
+                        zcrypt_rng_dev.quality = 0;
                rc = hwrng_register(&zcrypt_rng_dev);
                if (rc)
                        goto out_free;
diff --git a/drivers/s390/kvm/Makefile b/drivers/s390/virtio/Makefile
index 241891a57caf..241891a57caf 100644
--- a/drivers/s390/kvm/Makefile
+++ b/drivers/s390/virtio/Makefile
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/virtio/kvm_virtio.c
index 53fb975c404b..53fb975c404b 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/virtio/kvm_virtio.c
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index f8d8fdb26b72..f8d8fdb26b72 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 82b92c414a9c..437254e1c4de 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -738,7 +738,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
                ql_log(ql_log_info, vha, 0x706f,
                    "Issuing MPI reset.\n");
-                if (IS_QLA83XX(ha)) {
+                if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                        uint32_t idc_control;
                        qla83xx_idc_lock(vha, 0);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 0e6ee3ca30e6..8b011aef12bd 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -67,10 +67,10 @@
 * |                              |                    | 0xd031-0xd0ff  |
 * |                              |                    | 0xd101-0xd1fe  |
 * |                              |                    | 0xd214-0xd2fe  |
- * | Target Mode                  |       0xe079       |                |
+ * | Target Mode                  |       0xe080       |                |
- * | Target Mode Management       |       0xf072       | 0xf002         |
+ * | Target Mode Management       |       0xf096       | 0xf002         |
 * |                              |                    | 0xf046-0xf049  |
- * | Target Mode Task Management  |       0x1000b      |                |
+ * | Target Mode Task Management  |       0x1000d      |                |
 * ----------------------------------------------------------------------
 */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index e86201d3b8c6..9ad819edcd67 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -274,6 +274,7 @@
 #define RESPONSE_ENTRY_CNT_FX00         256     /* Number of response entries.*/
 struct req_que;
+struct qla_tgt_sess;
 /*
 * (sd.h is not exported, hence local inclusion)
@@ -2026,6 +2027,7 @@ typedef struct fc_port {
        uint16_t port_id;
        unsigned long retry_delay_timestamp;
+        struct qla_tgt_sess *tgt_session;
 } fc_port_t;
 #include "qla_mr.h"
@@ -3154,13 +3156,13 @@ struct qla_hw_data {
 /* Bit 21 of fw_attributes decides the MCTP capabilities */
 #define IS_MCTP_CAPABLE(ha)     (IS_QLA2031(ha) && \
                                ((ha)->fw_attributes_ext[0] & BIT_0))
-#define IS_PI_UNINIT_CAPABLE(ha)        (IS_QLA83XX(ha))
+#define IS_PI_UNINIT_CAPABLE(ha)        (IS_QLA83XX(ha) || IS_QLA27XX(ha))
-#define IS_PI_IPGUARD_CAPABLE(ha)       (IS_QLA83XX(ha))
+#define IS_PI_IPGUARD_CAPABLE(ha)       (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_PI_DIFB_DIX0_CAPABLE(ha)     (0)
-#define IS_PI_SPLIT_DET_CAPABLE_HBA(ha) (IS_QLA83XX(ha))
+#define IS_PI_SPLIT_DET_CAPABLE_HBA(ha) (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_PI_SPLIT_DET_CAPABLE(ha)     (IS_PI_SPLIT_DET_CAPABLE_HBA(ha) && \
    (((ha)->fw_attributes_h << 16 | (ha)->fw_attributes) & BIT_22))
-#define IS_ATIO_MSIX_CAPABLE(ha) (IS_QLA83XX(ha))
+#define IS_ATIO_MSIX_CAPABLE(ha) (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_TGT_MODE_CAPABLE(ha) (ha->tgt.atio_q_length)
 #define IS_SHADOW_REG_CAPABLE(ha)  (IS_QLA27XX(ha))
 #define IS_DPORT_CAPABLE(ha)  (IS_QLA83XX(ha) || IS_QLA27XX(ha))
@@ -3579,6 +3581,16 @@ typedef struct scsi_qla_host {
        uint16_t        fcoe_fcf_idx;
        uint8_t         fcoe_vn_port_mac[6];
+        /* list of commands waiting on workqueue */
+        struct list_head        qla_cmd_list;
+        struct list_head        qla_sess_op_cmd_list;
+        spinlock_t              cmd_list_lock;
+        /* Counter to detect races between ELS and RSCN events */
+        atomic_t                generation_tick;
+        /* Time when global fcport update has been scheduled */
+        int                     total_fcport_update_gen;
        uint32_t        vp_abort_cnt;
        struct fc_vport *fc_vport;      /* holds fc_vport * for each vport */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 664013115c9d..11f2f3279eab 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data)
                        QLA_LOGIO_LOGIN_RETRIED : 0;
                qla2x00_post_async_login_done_work(fcport->vha, fcport,
                        lio->u.logio.data);
+        } else if (sp->type == SRB_LOGOUT_CMD) {
+                qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
        }
 }
@@ -497,7 +499,10 @@ void
 qla2x00_async_logout_done(struct scsi_qla_host *vha, fc_port_t *fcport,
    uint16_t *data)
 {
-        qla2x00_mark_device_lost(vha, fcport, 1, 0);
+        /* Don't re-login in target mode */
+        if (!fcport->tgt_session)
+                qla2x00_mark_device_lost(vha, fcport, 1, 0);
+        qlt_logo_completion_handler(fcport, data[0]);
        return;
 }
@@ -1538,7 +1543,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                mem_size = (ha->fw_memory_size - 0x11000 + 1) *
                    sizeof(uint16_t);
        } else if (IS_FWI2_CAPABLE(ha)) {
-                if (IS_QLA83XX(ha))
+                if (IS_QLA83XX(ha) || IS_QLA27XX(ha))
                        fixed_size = offsetof(struct qla83xx_fw_dump, ext_mem);
                else if (IS_QLA81XX(ha))
                        fixed_size = offsetof(struct qla81xx_fw_dump, ext_mem);
@@ -1550,7 +1555,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                mem_size = (ha->fw_memory_size - 0x100000 + 1) *
                    sizeof(uint32_t);
                if (ha->mqenable) {
-                        if (!IS_QLA83XX(ha))
+                        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                                mq_size = sizeof(struct qla2xxx_mq_chain);
                        /*
                         * Allocate maximum buffer size for all queues.
@@ -2922,21 +2927,14 @@ qla2x00_rport_del(void *data)
 {
        fc_port_t *fcport = data;
        struct fc_rport *rport;
-        scsi_qla_host_t *vha = fcport->vha;
        unsigned long flags;
        spin_lock_irqsave(fcport->vha->host->host_lock, flags);
        rport = fcport->drport ? fcport->drport: fcport->rport;
        fcport->drport = NULL;
        spin_unlock_irqrestore(fcport->vha->host->host_lock, flags);
-        if (rport) {
+        if (rport)
                fc_remote_port_delete(rport);
-                /*
-                 * Release the target mode FC NEXUS in qla_target.c code
-                 * if target mod is enabled.
-                 */
-                qlt_fc_port_deleted(vha, fcport);
-        }
 }
 /**
@@ -3303,6 +3301,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
         * Create target mode FC NEXUS in qla_target.c if target mode is
         * enabled..
         */
        qlt_fc_port_added(vha, fcport);
        spin_lock_irqsave(fcport->vha->host->host_lock, flags);
@@ -3341,8 +3340,7 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
        if (IS_QLAFX00(vha->hw)) {
                qla2x00_set_fcport_state(fcport, FCS_ONLINE);
-                qla2x00_reg_remote_port(vha, fcport);
+                goto reg_port;
-                return;
        }
        fcport->login_retry = 0;
        fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
@@ -3350,7 +3348,16 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
        qla2x00_set_fcport_state(fcport, FCS_ONLINE);
        qla2x00_iidma_fcport(vha, fcport);
        qla24xx_update_fcport_fcp_prio(vha, fcport);
-        qla2x00_reg_remote_port(vha, fcport);
+reg_port:
+        if (qla_ini_mode_enabled(vha))
+                qla2x00_reg_remote_port(vha, fcport);
+        else {
+                /*
+                 * Create target mode FC NEXUS in qla_target.c
+                 */
+                qlt_fc_port_added(vha, fcport);
+        }
 }
 /*
@@ -3375,6 +3382,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
        LIST_HEAD(new_fcports);
        struct qla_hw_data *ha = vha->hw;
        struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
+        int             discovery_gen;
        /* If FL port exists, then SNS is present */
        if (IS_FWI2_CAPABLE(ha))
@@ -3445,6 +3453,14 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                        fcport->scan_state = QLA_FCPORT_SCAN;
                }
+                /* Mark the time right before querying FW for connected ports.
+                 * This process is long, asynchronous and by the time it's done,
+                 * collected information might not be accurate anymore. E.g.
+                 * disconnected port might have re-connected and a brand new
+                 * session has been created. In this case session's generation
+                 * will be newer than discovery_gen. */
+                qlt_do_generation_tick(vha, &discovery_gen);
                rval = qla2x00_find_all_fabric_devs(vha, &new_fcports);
                if (rval != QLA_SUCCESS)
                        break;
@@ -3460,20 +3476,44 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                        if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
                                continue;
-                        if (fcport->scan_state == QLA_FCPORT_SCAN &&
+                        if (fcport->scan_state == QLA_FCPORT_SCAN) {
-                            atomic_read(&fcport->state) == FCS_ONLINE) {
+                                if (qla_ini_mode_enabled(base_vha) &&
-                                qla2x00_mark_device_lost(vha, fcport,
+                                    atomic_read(&fcport->state) == FCS_ONLINE) {
-                                    ql2xplogiabsentdevice, 0);
+                                        qla2x00_mark_device_lost(vha, fcport,
-                                if (fcport->loop_id != FC_NO_LOOP_ID &&
+                                            ql2xplogiabsentdevice, 0);
-                                    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+                                        if (fcport->loop_id != FC_NO_LOOP_ID &&
-                                    fcport->port_type != FCT_INITIATOR &&
+                                            (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
-                                    fcport->port_type != FCT_BROADCAST) {
+                                            fcport->port_type != FCT_INITIATOR &&
-                                        ha->isp_ops->fabric_logout(vha,
+                                            fcport->port_type != FCT_BROADCAST) {
-                                            fcport->loop_id,
+                                                ha->isp_ops->fabric_logout(vha,
-                                            fcport->d_id.b.domain,
+                                                    fcport->loop_id,
-                                            fcport->d_id.b.area,
+                                                    fcport->d_id.b.domain,
-                                            fcport->d_id.b.al_pa);
+                                                    fcport->d_id.b.area,
-                                        qla2x00_clear_loop_id(fcport);
+                                                    fcport->d_id.b.al_pa);
+                                                qla2x00_clear_loop_id(fcport);
+                                        }
+                                } else if (!qla_ini_mode_enabled(base_vha)) {
+                                        /*
+                                         * In target mode, explicitly kill
+                                         * sessions and log out of devices
+                                         * that are gone, so that we don't
+                                         * end up with an initiator using the
+                                         * wrong ACL (if the fabric recycles
+                                         * an FC address and we have a stale
+                                         * session around) and so that we don't
+                                         * report initiators that are no longer
+                                         * on the fabric.
+                                         */
+                                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
+                                            "port gone, logging out/killing session: "
+                                            "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
+                                            "scan_state %d\n",
+                                            fcport->port_name,
+                                            atomic_read(&fcport->state),
+                                            fcport->flags, fcport->fc4_type,
+                                            fcport->scan_state);
+                                        qlt_fc_port_deleted(vha, fcport,
+                                            discovery_gen);
                                }
                        }
                }
@@ -3494,6 +3534,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                            (fcport->flags & FCF_LOGIN_NEEDED) == 0)
                                continue;
+                        /*
+                         * If we're not an initiator, skip looking for devices
+                         * and logging in.  There's no reason for us to do it,
+                         * and it seems to actively cause problems in target
+                         * mode if we race with the initiator logging into us
+                         * (we might get the "port ID used" status back from
+                         * our login command and log out the initiator, which
+                         * seems to cause havoc).
+                         */
+                        if (!qla_ini_mode_enabled(base_vha)) {
+                                if (fcport->scan_state == QLA_FCPORT_FOUND) {
+                                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
+                                            "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
+                                            "scan_state %d (initiator mode disabled; skipping "
+                                            "login)\n", fcport->port_name,
+                                            atomic_read(&fcport->state),
+                                            fcport->flags, fcport->fc4_type,
+                                            fcport->scan_state);
+                                }
+                                continue;
+                        }
                        if (fcport->loop_id == FC_NO_LOOP_ID) {
                                fcport->loop_id = next_loopid;
                                rval = qla2x00_find_new_loop_id(
@@ -3520,16 +3582,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                            test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
                                break;
-                        /* Find a new loop ID to use. */
+                        /*
-                        fcport->loop_id = next_loopid;
+                         * If we're not an initiator, skip looking for devices
-                        rval = qla2x00_find_new_loop_id(base_vha, fcport);
+                         * and logging in.  There's no reason for us to do it,
-                        if (rval != QLA_SUCCESS) {
+                         * and it seems to actively cause problems in target
-                                /* Ran out of IDs to use */
+                         * mode if we race with the initiator logging into us
-                                break;
+                         * (we might get the "port ID used" status back from
-                        }
+                         * our login command and log out the initiator, which
+                         * seems to cause havoc).
+                         */
+                        if (qla_ini_mode_enabled(base_vha)) {
+                                /* Find a new loop ID to use. */
+                                fcport->loop_id = next_loopid;
+                                rval = qla2x00_find_new_loop_id(base_vha,
+                                    fcport);
+                                if (rval != QLA_SUCCESS) {
+                                        /* Ran out of IDs to use */
+                                        break;
+                                }
-                        /* Login and update database */
+                                /* Login and update database */
-                        qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
+                                qla2x00_fabric_dev_login(vha, fcport,
+                                    &next_loopid);
+                        } else {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
+                                        "new port %8phC state 0x%x flags 0x%x fc4_type "
+                                        "0x%x scan_state %d (initiator mode disabled; "
+                                        "skipping login)\n",
+                                        fcport->port_name,
+                                        atomic_read(&fcport->state),
+                                        fcport->flags, fcport->fc4_type,
+                                        fcport->scan_state);
+                        }
                        list_move_tail(&fcport->list, &vha->vp_fcports);
                }
@@ -3725,11 +3809,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                        fcport->fp_speed = new_fcport->fp_speed;
                        /*
-                         * If address the same and state FCS_ONLINE, nothing
+                         * If address the same and state FCS_ONLINE
-                         * changed.
+                         * (or in target mode), nothing changed.
                         */
                        if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
-                            atomic_read(&fcport->state) == FCS_ONLINE) {
+                            (atomic_read(&fcport->state) == FCS_ONLINE ||
+                             !qla_ini_mode_enabled(base_vha))) {
                                break;
                        }
@@ -3749,6 +3834,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                         * Log it out if still logged in and mark it for
                         * relogin later.
                         */
+                        if (!qla_ini_mode_enabled(base_vha)) {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
+                                         "port changed FC ID, %8phC"
+                                         " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
+                                         fcport->port_name,
+                                         fcport->d_id.b.domain,
+                                         fcport->d_id.b.area,
+                                         fcport->d_id.b.al_pa,
+                                         fcport->loop_id,
+                                         new_fcport->d_id.b.domain,
+                                         new_fcport->d_id.b.area,
+                                         new_fcport->d_id.b.al_pa);
+                                fcport->d_id.b24 = new_fcport->d_id.b24;
+                                break;
+                        }
                        fcport->d_id.b24 = new_fcport->d_id.b24;
                        fcport->flags |= FCF_LOGIN_NEEDED;
                        if (fcport->loop_id != FC_NO_LOOP_ID &&
@@ -3768,6 +3869,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                if (found)
                        continue;
                /* If device was not in our fcports list, then add it. */
+                new_fcport->scan_state = QLA_FCPORT_FOUND;
                list_add_tail(&new_fcport->list, new_fcports);
                /* Allocate a new replacement fcport. */
@@ -4188,6 +4290,14 @@ qla2x00_update_fcports(scsi_qla_host_t *base_vha)
                            atomic_read(&fcport->state) != FCS_UNCONFIGURED) {
                                spin_unlock_irqrestore(&ha->vport_slock, flags);
                                qla2x00_rport_del(fcport);
+                                /*
+                                 * Release the target mode FC NEXUS in
+                                 * qla_target.c, if target mod is enabled.
+                                 */
+                                qlt_fc_port_deleted(vha, fcport,
+                                    base_vha->total_fcport_update_gen);
                                spin_lock_irqsave(&ha->vport_slock, flags);
                        }
                }
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 36fbd4c7af8f..6f02b26a35cf 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1943,6 +1943,9 @@ qla24xx_logout_iocb(srb_t *sp, struct logio_entry_24xx *logio)
        logio->entry_type = LOGINOUT_PORT_IOCB_TYPE;
        logio->control_flags =
            cpu_to_le16(LCF_COMMAND_LOGO|LCF_IMPL_LOGO);
+        if (!sp->fcport->tgt_session ||
+            !sp->fcport->tgt_session->keep_nport_handle)
+                logio->control_flags |= cpu_to_le16(LCF_FREE_NPORT);
        logio->nport_handle = cpu_to_le16(sp->fcport->loop_id);
        logio->port_id[0] = sp->fcport->d_id.b.al_pa;
        logio->port_id[1] = sp->fcport->d_id.b.area;
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 02b1c1c5355b..b2f713ad9034 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2415,7 +2415,8 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
                        *orig_iocb_cnt = mcp->mb[10];
                if (vha->hw->flags.npiv_supported && max_npiv_vports)
                        *max_npiv_vports = mcp->mb[11];
-                if ((IS_QLA81XX(vha->hw) || IS_QLA83XX(vha->hw)) && max_fcfs)
+                if ((IS_QLA81XX(vha->hw) || IS_QLA83XX(vha->hw) ||
+                    IS_QLA27XX(vha->hw)) && max_fcfs)
                        *max_fcfs = mcp->mb[12];
        }
@@ -3898,7 +3899,7 @@ qla25xx_init_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
        spin_lock_irqsave(&ha->hardware_lock, flags);
        if (!(rsp->options & BIT_0)) {
                WRT_REG_DWORD(rsp->rsp_q_out, 0);
-                if (!IS_QLA83XX(ha))
+                if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                        WRT_REG_DWORD(rsp->rsp_q_in, 0);
        }
@@ -5345,7 +5346,7 @@ qla83xx_restart_nic_firmware(scsi_qla_host_t *vha)
        mbx_cmd_t *mcp = &mc;
        struct qla_hw_data *ha = vha->hw;
-        if (!IS_QLA83XX(ha))
+        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                return QLA_FUNCTION_FAILED;
        ql_dbg(ql_dbg_mbx, vha, 0x1143, "Entered %s.\n", __func__);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index a28815b8276f..8a5cac8448c7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2504,6 +2504,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                ha->mbx_count = MAILBOX_REGISTER_COUNT;
                req_length = REQUEST_ENTRY_CNT_24XX;
                rsp_length = RESPONSE_ENTRY_CNT_2300;
+                ha->tgt.atio_q_length = ATIO_ENTRY_CNT_24XX;
                ha->max_loop_id = SNS_LAST_LOOP_ID_2300;
                ha->init_cb_size = sizeof(struct mid_init_cb_81xx);
                ha->gid_list_info_size = 8;
@@ -3229,11 +3230,15 @@ qla2x00_schedule_rport_del(struct scsi_qla_host *vha, fc_port_t *fcport,
                spin_lock_irqsave(vha->host->host_lock, flags);
                fcport->drport = rport;
                spin_unlock_irqrestore(vha->host->host_lock, flags);
+                qlt_do_generation_tick(vha, &base_vha->total_fcport_update_gen);
                set_bit(FCPORT_UPDATE_NEEDED, &base_vha->dpc_flags);
                qla2xxx_wake_dpc(base_vha);
        } else {
-                fc_remote_port_delete(rport);
+                int now;
-                qlt_fc_port_deleted(vha, fcport);
+                if (rport)
+                        fc_remote_port_delete(rport);
+                qlt_do_generation_tick(vha, &now);
+                qlt_fc_port_deleted(vha, fcport, now);
        }
 }
@@ -3763,8 +3768,11 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
        INIT_LIST_HEAD(&vha->vp_fcports);
        INIT_LIST_HEAD(&vha->work_list);
        INIT_LIST_HEAD(&vha->list);
+        INIT_LIST_HEAD(&vha->qla_cmd_list);
+        INIT_LIST_HEAD(&vha->qla_sess_op_cmd_list);
        spin_lock_init(&vha->work_lock);
+        spin_lock_init(&vha->cmd_list_lock);
        sprintf(vha->host_str, "%s_%ld", QLA2XXX_DRIVER_NAME, vha->host_no);
        ql_dbg(ql_dbg_init, vha, 0x0041,
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 028e8c8a7de9..2feb5f38edcd 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -1697,7 +1697,7 @@ qla83xx_select_led_port(struct qla_hw_data *ha)
 {
        uint32_t led_select_value = 0;
-        if (!IS_QLA83XX(ha))
+        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                goto out;
        if (ha->port_no == 0)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index b749026aa592..58651ecbd88c 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -113,6 +113,11 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
 static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
        struct atio_from_isp *atio, uint16_t status, int qfull);
 static void qlt_disable_vha(struct scsi_qla_host *vha);
+static void qlt_clear_tgt_db(struct qla_tgt *tgt);
+static void qlt_send_notify_ack(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *ntfy,
+        uint32_t add_flags, uint16_t resp_code, int resp_code_valid,
+        uint16_t srr_flags, uint16_t srr_reject_code, uint8_t srr_explan);
 /*
 * Global Variables
 */
@@ -122,6 +127,16 @@ static struct workqueue_struct *qla_tgt_wq;
 static DEFINE_MUTEX(qla_tgt_mutex);
 static LIST_HEAD(qla_tgt_glist);
+/* This API intentionally takes dest as a parameter, rather than returning
+ * int value to avoid caller forgetting to issue wmb() after the store */
+void qlt_do_generation_tick(struct scsi_qla_host *vha, int *dest)
+{
+        scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
+        *dest = atomic_inc_return(&base_vha->generation_tick);
+        /* memory barrier */
+        wmb();
+}
 /* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list) */
 static struct qla_tgt_sess *qlt_find_sess_by_port_name(
        struct qla_tgt *tgt,
@@ -381,14 +396,73 @@ static void qlt_free_session_done(struct work_struct *work)
        struct qla_tgt *tgt = sess->tgt;
        struct scsi_qla_host *vha = sess->vha;
        struct qla_hw_data *ha = vha->hw;
+        unsigned long flags;
+        bool logout_started = false;
+        fc_port_t fcport;
+        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf084,
+                "%s: se_sess %p / sess %p from port %8phC loop_id %#04x"
+                " s_id %02x:%02x:%02x logout %d keep %d plogi %d\n",
+                __func__, sess->se_sess, sess, sess->port_name, sess->loop_id,
+                sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
+                sess->logout_on_delete, sess->keep_nport_handle,
+                sess->plogi_ack_needed);
        BUG_ON(!tgt);
+        if (sess->logout_on_delete) {
+                int rc;
+                memset(&fcport, 0, sizeof(fcport));
+                fcport.loop_id = sess->loop_id;
+                fcport.d_id = sess->s_id;
+                memcpy(fcport.port_name, sess->port_name, WWN_SIZE);
+                fcport.vha = vha;
+                fcport.tgt_session = sess;
+                rc = qla2x00_post_async_logout_work(vha, &fcport, NULL);
+                if (rc != QLA_SUCCESS)
+                        ql_log(ql_log_warn, vha, 0xf085,
+                               "Schedule logo failed sess %p rc %d\n",
+                               sess, rc);
+                else
+                        logout_started = true;
+        }
        /*
         * Release the target session for FC Nexus from fabric module code.
         */
        if (sess->se_sess != NULL)
                ha->tgt.tgt_ops->free_session(sess);
+        if (logout_started) {
+                bool traced = false;
+                while (!ACCESS_ONCE(sess->logout_completed)) {
+                        if (!traced) {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf086,
+                                        "%s: waiting for sess %p logout\n",
+                                        __func__, sess);
+                                traced = true;
+                        }
+                        msleep(100);
+                }
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087,
+                        "%s: sess %p logout completed\n",
+                        __func__, sess);
+        }
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (sess->plogi_ack_needed)
+                qlt_send_notify_ack(vha, &sess->tm_iocb,
+                                    0, 0, 0, 0, 0, 0);
+        list_del(&sess->sess_list_entry);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001,
            "Unregistration of sess %p finished\n", sess);
@@ -409,9 +483,9 @@ void qlt_unreg_sess(struct qla_tgt_sess *sess)
        vha->hw->tgt.tgt_ops->clear_nacl_from_fcport_map(sess);
-        list_del(&sess->sess_list_entry);
+        if (!list_empty(&sess->del_list_entry))
-        if (sess->deleted)
+                list_del_init(&sess->del_list_entry);
-                list_del(&sess->del_list_entry);
+        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
        INIT_WORK(&sess->free_work, qlt_free_session_done);
        schedule_work(&sess->free_work);
@@ -431,10 +505,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
        loop_id = le16_to_cpu(n->u.isp24.nport_handle);
        if (loop_id == 0xFFFF) {
-#if 0 /* FIXME: Re-enable Global event handling.. */
                /* Global event */
-                atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
+                atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
-                qlt_clear_tgt_db(ha->tgt.qla_tgt);
+                qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
+#if 0 /* FIXME: do we need to choose a session here? */
                if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
                        sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
                            typeof(*sess), sess_list_entry);
@@ -489,27 +563,38 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
        struct qla_tgt *tgt = sess->tgt;
        uint32_t dev_loss_tmo = tgt->ha->port_down_retry_count + 5;
-        if (sess->deleted)
+        if (sess->deleted) {
-                return;
+                /* Upgrade to unconditional deletion in case it was temporary */
+                if (immediate && sess->deleted == QLA_SESS_DELETION_PENDING)
+                        list_del(&sess->del_list_entry);
+                else
+                        return;
+        }
        ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
            "Scheduling sess %p for deletion\n", sess);
-        list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
-        sess->deleted = 1;
-        if (immediate)
+        if (immediate) {
                dev_loss_tmo = 0;
+                sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+                list_add(&sess->del_list_entry, &tgt->del_sess_list);
+        } else {
+                sess->deleted = QLA_SESS_DELETION_PENDING;
+                list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
+        }
        sess->expires = jiffies + dev_loss_tmo * HZ;
        ql_dbg(ql_dbg_tgt, sess->vha, 0xe048,
-            "qla_target(%d): session for port %8phC (loop ID %d) scheduled for "
+            "qla_target(%d): session for port %8phC (loop ID %d s_id %02x:%02x:%02x)"
-            "deletion in %u secs (expires: %lu) immed: %d\n",
+            " scheduled for deletion in %u secs (expires: %lu) immed: %d, logout: %d, gen: %#x\n",
-            sess->vha->vp_idx, sess->port_name, sess->loop_id, dev_loss_tmo,
+            sess->vha->vp_idx, sess->port_name, sess->loop_id,
-            sess->expires, immediate);
+            sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
+            dev_loss_tmo, sess->expires, immediate, sess->logout_on_delete,
+            sess->generation);
        if (immediate)
-                schedule_delayed_work(&tgt->sess_del_work, 0);
+                mod_delayed_work(system_wq, &tgt->sess_del_work, 0);
        else
                schedule_delayed_work(&tgt->sess_del_work,
                    sess->expires - jiffies);
@@ -578,9 +663,9 @@ out_free_id_list:
 /* ha->hardware_lock supposed to be held on entry */
 static void qlt_undelete_sess(struct qla_tgt_sess *sess)
 {
-        BUG_ON(!sess->deleted);
+        BUG_ON(sess->deleted != QLA_SESS_DELETION_PENDING);
-        list_del(&sess->del_list_entry);
+        list_del_init(&sess->del_list_entry);
        sess->deleted = 0;
 }
@@ -599,7 +684,9 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                    del_list_entry);
                elapsed = jiffies;
                if (time_after_eq(elapsed, sess->expires)) {
-                        qlt_undelete_sess(sess);
+                        /* No turning back */
+                        list_del_init(&sess->del_list_entry);
+                        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
                            "Timeout: sess %p about to be deleted\n",
@@ -643,6 +730,13 @@ static struct qla_tgt_sess *qlt_create_sess(
                            fcport->d_id.b.al_pa, fcport->d_id.b.area,
                            fcport->loop_id);
+                        /* Cannot undelete at this point */
+                        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                                spin_unlock_irqrestore(&ha->hardware_lock,
+                                    flags);
+                                return NULL;
+                        }
                        if (sess->deleted)
                                qlt_undelete_sess(sess);
@@ -652,6 +746,9 @@ static struct qla_tgt_sess *qlt_create_sess(
                        if (sess->local && !local)
                                sess->local = 0;
+                        qlt_do_generation_tick(vha, &sess->generation);
                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
                        return sess;
@@ -673,6 +770,14 @@ static struct qla_tgt_sess *qlt_create_sess(
        sess->s_id = fcport->d_id;
        sess->loop_id = fcport->loop_id;
        sess->local = local;
+        INIT_LIST_HEAD(&sess->del_list_entry);
+        /* Under normal circumstances we want to logout from firmware when
+         * session eventually ends and release corresponding nport handle.
+         * In the exception cases (e.g. when new PLOGI is waiting) corresponding
+         * code will adjust these flags as necessary. */
+        sess->logout_on_delete = 1;
+        sess->keep_nport_handle = 0;
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf006,
            "Adding sess %p to tgt %p via ->check_initiator_node_acl()\n",
@@ -705,6 +810,7 @@ static struct qla_tgt_sess *qlt_create_sess(
        spin_lock_irqsave(&ha->hardware_lock, flags);
        list_add_tail(&sess->sess_list_entry, &vha->vha_tgt.qla_tgt->sess_list);
        vha->vha_tgt.qla_tgt->sess_count++;
+        qlt_do_generation_tick(vha, &sess->generation);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf04b,
@@ -718,7 +824,7 @@ static struct qla_tgt_sess *qlt_create_sess(
 }
 /*
- * Called from drivers/scsi/qla2xxx/qla_init.c:qla2x00_reg_remote_port()
+ * Called from qla2x00_reg_remote_port()
 */
 void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
 {
@@ -750,6 +856,10 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
                mutex_unlock(&vha->vha_tgt.tgt_mutex);
                spin_lock_irqsave(&ha->hardware_lock, flags);
+        } else if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                /* Point of no return */
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return;
        } else {
                kref_get(&sess->se_sess->sess_kref);
@@ -780,27 +890,36 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
-void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+/*
+ * max_gen - specifies maximum session generation
+ * at which this deletion requestion is still valid
+ */
+void
+qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport, int max_gen)
 {
-        struct qla_hw_data *ha = vha->hw;
        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
        struct qla_tgt_sess *sess;
-        unsigned long flags;
        if (!vha->hw->tgt.tgt_ops)
                return;
-        if (!tgt || (fcport->port_type != FCT_INITIATOR))
+        if (!tgt)
                return;
-        spin_lock_irqsave(&ha->hardware_lock, flags);
        if (tgt->tgt_stop) {
-                spin_unlock_irqrestore(&ha->hardware_lock, flags);
                return;
        }
        sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
        if (!sess) {
-                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return;
+        }
+        if (max_gen - sess->generation < 0) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf092,
+                    "Ignoring stale deletion request for se_sess %p / sess %p"
+                    " for port %8phC, req_gen %d, sess_gen %d\n",
+                    sess->se_sess, sess, sess->port_name, max_gen,
+                    sess->generation);
                return;
        }
@@ -808,7 +927,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
        sess->local = 1;
        qlt_schedule_sess_for_deletion(sess, false);
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 static inline int test_tgt_sess_count(struct qla_tgt *tgt)
@@ -1175,6 +1293,70 @@ static void qlt_24xx_retry_term_exchange(struct scsi_qla_host *vha,
            FCP_TMF_CMPL, true);
 }
+static int abort_cmd_for_tag(struct scsi_qla_host *vha, uint32_t tag)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+        spin_lock(&vha->cmd_list_lock);
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                if (tag == op->atio.u.isp24.exchange_addr) {
+                        op->aborted = true;
+                        spin_unlock(&vha->cmd_list_lock);
+                        return 1;
+                }
+        }
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                if (tag == cmd->atio.u.isp24.exchange_addr) {
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+                        spin_unlock(&vha->cmd_list_lock);
+                        return 1;
+                }
+        }
+        spin_unlock(&vha->cmd_list_lock);
+        return 0;
+}
+/* drop cmds for the given lun
+ * XXX only looks for cmds on the port through which lun reset was recieved
+ * XXX does not go through the list of other port (which may have cmds
+ *     for the same lun)
+ */
+static void abort_cmds_for_lun(struct scsi_qla_host *vha,
+                                uint32_t lun, uint8_t *s_id)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+        uint32_t key;
+        key = sid_to_key(s_id);
+        spin_lock(&vha->cmd_list_lock);
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                uint32_t op_key;
+                uint32_t op_lun;
+                op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
+                op_lun = scsilun_to_int(
+                        (struct scsi_lun *)&op->atio.u.isp24.fcp_cmnd.lun);
+                if (op_key == key && op_lun == lun)
+                        op->aborted = true;
+        }
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                uint32_t cmd_key;
+                uint32_t cmd_lun;
+                cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
+                cmd_lun = scsilun_to_int(
+                        (struct scsi_lun *)&cmd->atio.u.isp24.fcp_cmnd.lun);
+                if (cmd_key == key && cmd_lun == lun)
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+        }
+        spin_unlock(&vha->cmd_list_lock);
+}
 /* ha->hardware_lock supposed to be held on entry */
 static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
        struct abts_recv_from_24xx *abts, struct qla_tgt_sess *sess)
@@ -1199,8 +1381,19 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
        }
        spin_unlock(&se_sess->sess_cmd_lock);
-        if (!found_lun)
+        /* cmd not in LIO lists, look in qla list */
-                return -ENOENT;
+        if (!found_lun) {
+                if (abort_cmd_for_tag(vha, abts->exchange_addr_to_abort)) {
+                        /* send TASK_ABORT response immediately */
+                        qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_CMPL, false);
+                        return 0;
+                } else {
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf081,
+                            "unable to find cmd in driver or LIO for tag 0x%x\n",
+                            abts->exchange_addr_to_abort);
+                        return -ENOENT;
+                }
+        }
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00f,
            "qla_target(%d): task abort (tag=%d)\n",
@@ -1284,6 +1477,11 @@ static void qlt_24xx_handle_abts(struct scsi_qla_host *vha,
                return;
        }
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_REJECTED, false);
+                return;
+        }
        rc = __qlt_24xx_handle_abts(vha, abts, sess);
        if (rc != 0) {
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf054,
@@ -1726,20 +1924,6 @@ static int qlt_pre_xmit_response(struct qla_tgt_cmd *cmd,
        struct qla_hw_data *ha = vha->hw;
        struct se_cmd *se_cmd = &cmd->se_cmd;
-        if (unlikely(cmd->aborted)) {
-                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
-                       "qla_target(%d): terminating exchange for aborted cmd=%p (se_cmd=%p, tag=%lld)",
-                       vha->vp_idx, cmd, se_cmd, se_cmd->tag);
-                cmd->state = QLA_TGT_STATE_ABORTED;
-                cmd->cmd_flags |= BIT_6;
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
-                /* !! At this point cmd could be already freed !! */
-                return QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED;
-        }
        prm->cmd = cmd;
        prm->tgt = tgt;
        prm->rq_result = scsi_status;
@@ -2301,6 +2485,19 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
        unsigned long flags = 0;
        int res;
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                cmd->state = QLA_TGT_STATE_PROCESSED;
+                if (cmd->sess->logout_completed)
+                        /* no need to terminate. FW already freed exchange. */
+                        qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
+                else
+                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return 0;
+        }
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        memset(&prm, 0, sizeof(prm));
        qlt_check_srr_debug(cmd, &xmit_type);
@@ -2313,9 +2510,6 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
        res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status,
            &full_req_cnt);
        if (unlikely(res != 0)) {
-                if (res == QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED)
-                        return 0;
                return res;
        }
@@ -2345,9 +2539,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
                res = qlt_build_ctio_crc2_pkt(&prm, vha);
        else
                res = qlt_24xx_build_ctio_pkt(&prm, vha);
-        if (unlikely(res != 0))
+        if (unlikely(res != 0)) {
+                vha->req->cnt += full_req_cnt;
                goto out_unmap_unlock;
+        }
        pkt = (struct ctio7_to_24xx *)prm.pkt;
@@ -2461,7 +2656,8 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
        spin_lock_irqsave(&ha->hardware_lock, flags);
-        if (qla2x00_reset_active(vha) || cmd->reset_count != ha->chip_reset) {
+        if (qla2x00_reset_active(vha) || (cmd->reset_count != ha->chip_reset) ||
+            (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)) {
                /*
                 * Either a chip reset is active or this request was from
                 * previous life, just abort the processing.
@@ -2485,8 +2681,11 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
        else
                res = qlt_24xx_build_ctio_pkt(&prm, vha);
-        if (unlikely(res != 0))
+        if (unlikely(res != 0)) {
+                vha->req->cnt += prm.req_cnt;
                goto out_unlock_free_unmap;
+        }
        pkt = (struct ctio7_to_24xx *)prm.pkt;
        pkt->u.status0.flags |= __constant_cpu_to_le16(CTIO7_FLAGS_DATA_OUT |
            CTIO7_FLAGS_STATUS_MODE_0);
@@ -2651,6 +2850,89 @@ out:
 /* If hardware_lock held on entry, might drop it, then reaquire */
 /* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
+static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *ntfy)
+{
+        struct nack_to_isp *nack;
+        struct qla_hw_data *ha = vha->hw;
+        request_t *pkt;
+        int ret = 0;
+        ql_dbg(ql_dbg_tgt_tmr, vha, 0xe01c,
+            "Sending TERM ELS CTIO (ha=%p)\n", ha);
+        pkt = (request_t *)qla2x00_alloc_iocbs_ready(vha, NULL);
+        if (pkt == NULL) {
+                ql_dbg(ql_dbg_tgt, vha, 0xe080,
+                    "qla_target(%d): %s failed: unable to allocate "
+                    "request packet\n", vha->vp_idx, __func__);
+                return -ENOMEM;
+        }
+        pkt->entry_type = NOTIFY_ACK_TYPE;
+        pkt->entry_count = 1;
+        pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK;
+        nack = (struct nack_to_isp *)pkt;
+        nack->ox_id = ntfy->ox_id;
+        nack->u.isp24.nport_handle = ntfy->u.isp24.nport_handle;
+        if (le16_to_cpu(ntfy->u.isp24.status) == IMM_NTFY_ELS) {
+                nack->u.isp24.flags = ntfy->u.isp24.flags &
+                        __constant_cpu_to_le32(NOTIFY24XX_FLAGS_PUREX_IOCB);
+        }
+        /* terminate */
+        nack->u.isp24.flags |=
+                __constant_cpu_to_le16(NOTIFY_ACK_FLAGS_TERMINATE);
+        nack->u.isp24.srr_rx_id = ntfy->u.isp24.srr_rx_id;
+        nack->u.isp24.status = ntfy->u.isp24.status;
+        nack->u.isp24.status_subcode = ntfy->u.isp24.status_subcode;
+        nack->u.isp24.fw_handle = ntfy->u.isp24.fw_handle;
+        nack->u.isp24.exchange_address = ntfy->u.isp24.exchange_address;
+        nack->u.isp24.srr_rel_offs = ntfy->u.isp24.srr_rel_offs;
+        nack->u.isp24.srr_ui = ntfy->u.isp24.srr_ui;
+        nack->u.isp24.vp_index = ntfy->u.isp24.vp_index;
+        qla2x00_start_iocbs(vha, vha->req);
+        return ret;
+}
+static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *imm, int ha_locked)
+{
+        unsigned long flags = 0;
+        int rc;
+        if (qlt_issue_marker(vha, ha_locked) < 0)
+                return;
+        if (ha_locked) {
+                rc = __qlt_send_term_imm_notif(vha, imm);
+#if 0   /* Todo  */
+                if (rc == -ENOMEM)
+                        qlt_alloc_qfull_cmd(vha, imm, 0, 0);
+#endif
+                goto done;
+        }
+        spin_lock_irqsave(&vha->hw->hardware_lock, flags);
+        rc = __qlt_send_term_imm_notif(vha, imm);
+#if 0   /* Todo */
+        if (rc == -ENOMEM)
+                qlt_alloc_qfull_cmd(vha, imm, 0, 0);
+#endif
+done:
+        if (!ha_locked)
+                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+}
+/* If hardware_lock held on entry, might drop it, then reaquire */
+/* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
 static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
        struct qla_tgt_cmd *cmd,
        struct atio_from_isp *atio)
@@ -2715,7 +2997,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
 static void qlt_send_term_exchange(struct scsi_qla_host *vha,
        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
 {
-        unsigned long flags;
+        unsigned long flags = 0;
        int rc;
        if (qlt_issue_marker(vha, ha_locked) < 0)
@@ -2731,17 +3013,18 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
        rc = __qlt_send_term_exchange(vha, cmd, atio);
        if (rc == -ENOMEM)
                qlt_alloc_qfull_cmd(vha, atio, 0, 0);
-        spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
 done:
        if (cmd && ((cmd->state != QLA_TGT_STATE_ABORTED) ||
            !cmd->cmd_sent_to_fw)) {
-                if (!ha_locked && !in_interrupt())
+                if (cmd->sg_mapped)
-                        msleep(250); /* just in case */
+                        qlt_unmap_sg(vha, cmd);
-                qlt_unmap_sg(vha, cmd);
                vha->hw->tgt.tgt_ops->free_cmd(cmd);
        }
+        if (!ha_locked)
+                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
        return;
 }
@@ -2792,6 +3075,24 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
 }
+void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+{
+        struct qla_tgt *tgt = cmd->tgt;
+        struct scsi_qla_host *vha = tgt->vha;
+        struct se_cmd *se_cmd = &cmd->se_cmd;
+        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
+            "qla_target(%d): terminating exchange for aborted cmd=%p "
+            "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
+            se_cmd->tag);
+        cmd->state = QLA_TGT_STATE_ABORTED;
+        cmd->cmd_flags |= BIT_6;
+        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+}
+EXPORT_SYMBOL(qlt_abort_cmd);
 void qlt_free_cmd(struct qla_tgt_cmd *cmd)
 {
        struct qla_tgt_sess *sess = cmd->sess;
@@ -3015,7 +3316,7 @@ qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                dump_stack();
        }
-        cmd->cmd_flags |= BIT_12;
+        cmd->cmd_flags |= BIT_17;
        ha->tgt.tgt_ops->free_cmd(cmd);
 }
@@ -3177,7 +3478,7 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
 skip_term:
        if (cmd->state == QLA_TGT_STATE_PROCESSED) {
-                ;
+                cmd->cmd_flags |= BIT_12;
        } else if (cmd->state == QLA_TGT_STATE_NEED_DATA) {
                int rx_status = 0;
@@ -3191,9 +3492,11 @@ skip_term:
                ha->tgt.tgt_ops->handle_data(cmd);
                return;
        } else if (cmd->state == QLA_TGT_STATE_ABORTED) {
+                cmd->cmd_flags |= BIT_18;
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf01e,
                  "Aborted command %p (tag %lld) finished\n", cmd, se_cmd->tag);
        } else {
+                cmd->cmd_flags |= BIT_19;
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf05c,
                    "qla_target(%d): A command in state (%d) should "
                    "not return a CTIO complete\n", vha->vp_idx, cmd->state);
@@ -3205,7 +3508,6 @@ skip_term:
                dump_stack();
        }
        ha->tgt.tgt_ops->free_cmd(cmd);
 }
@@ -3263,6 +3565,13 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
        if (tgt->tgt_stop)
                goto out_term;
+        if (cmd->state == QLA_TGT_STATE_ABORTED) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf082,
+                    "cmd with tag %u is aborted\n",
+                    cmd->atio.u.isp24.exchange_addr);
+                goto out_term;
+        }
        cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
        cmd->se_cmd.tag = atio->u.isp24.exchange_addr;
        cmd->unpacked_lun = scsilun_to_int(
@@ -3316,6 +3625,12 @@ out_term:
 static void qlt_do_work(struct work_struct *work)
 {
        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
+        scsi_qla_host_t *vha = cmd->vha;
+        unsigned long flags;
+        spin_lock_irqsave(&vha->cmd_list_lock, flags);
+        list_del(&cmd->cmd_list);
+        spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
        __qlt_do_work(cmd);
 }
@@ -3345,6 +3660,11 @@ static struct qla_tgt_cmd *qlt_get_tag(scsi_qla_host_t *vha,
        cmd->loop_id = sess->loop_id;
        cmd->conf_compl_supported = sess->conf_compl_supported;
+        cmd->cmd_flags = 0;
+        cmd->jiffies_at_alloc = get_jiffies_64();
+        cmd->reset_count = vha->hw->chip_reset;
        return cmd;
 }
@@ -3362,14 +3682,25 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
        unsigned long flags;
        uint8_t *s_id = op->atio.u.isp24.fcp_hdr.s_id;
+        spin_lock_irqsave(&vha->cmd_list_lock, flags);
+        list_del(&op->cmd_list);
+        spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
+        if (op->aborted) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf083,
+                    "sess_op with tag %u is aborted\n",
+                    op->atio.u.isp24.exchange_addr);
+                goto out_term;
+        }
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf022,
-                "qla_target(%d): Unable to find wwn login"
+            "qla_target(%d): Unable to find wwn login"
-                " (s_id %x:%x:%x), trying to create it manually\n",
+            " (s_id %x:%x:%x), trying to create it manually\n",
-                vha->vp_idx, s_id[0], s_id[1], s_id[2]);
+            vha->vp_idx, s_id[0], s_id[1], s_id[2]);
        if (op->atio.u.raw.entry_count > 1) {
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf023,
-                        "Dropping multy entry atio %p\n", &op->atio);
+                    "Dropping multy entry atio %p\n", &op->atio);
                goto out_term;
        }
@@ -3434,10 +3765,25 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
                memcpy(&op->atio, atio, sizeof(*atio));
                op->vha = vha;
+                spin_lock(&vha->cmd_list_lock);
+                list_add_tail(&op->cmd_list, &vha->qla_sess_op_cmd_list);
+                spin_unlock(&vha->cmd_list_lock);
                INIT_WORK(&op->work, qlt_create_sess_from_atio);
                queue_work(qla_tgt_wq, &op->work);
                return 0;
        }
+        /* Another WWN used to have our s_id. Our PLOGI scheduled its
+         * session deletion, but it's still in sess_del_work wq */
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                ql_dbg(ql_dbg_io, vha, 0x3061,
+                    "New command while old session %p is being deleted\n",
+                    sess);
+                return -EFAULT;
+        }
        /*
         * Do kref_get() before returning + dropping qla_hw_data->hardware_lock.
         */
@@ -3451,13 +3797,13 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
                return -ENOMEM;
        }
-        cmd->cmd_flags = 0;
-        cmd->jiffies_at_alloc = get_jiffies_64();
-        cmd->reset_count = vha->hw->chip_reset;
        cmd->cmd_in_wq = 1;
        cmd->cmd_flags |= BIT_0;
+        spin_lock(&vha->cmd_list_lock);
+        list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
+        spin_unlock(&vha->cmd_list_lock);
        INIT_WORK(&cmd->work, qlt_do_work);
        queue_work(qla_tgt_wq, &cmd->work);
        return 0;
@@ -3471,6 +3817,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
        struct scsi_qla_host *vha = sess->vha;
        struct qla_hw_data *ha = vha->hw;
        struct qla_tgt_mgmt_cmd *mcmd;
+        struct atio_from_isp *a = (struct atio_from_isp *)iocb;
        int res;
        uint8_t tmr_func;
@@ -3511,6 +3858,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
                ql_dbg(ql_dbg_tgt_tmr, vha, 0x10002,
                    "qla_target(%d): LUN_RESET received\n", sess->vha->vp_idx);
                tmr_func = TMR_LUN_RESET;
+                abort_cmds_for_lun(vha, lun, a->u.isp24.fcp_hdr.s_id);
                break;
        case QLA_TGT_CLEAR_TS:
@@ -3599,6 +3947,9 @@ static int qlt_handle_task_mgmt(struct scsi_qla_host *vha, void *iocb)
                    sizeof(struct atio_from_isp));
        }
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)
+                return -EFAULT;
        return qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
 }
@@ -3664,22 +4015,280 @@ static int qlt_abort_task(struct scsi_qla_host *vha,
        return __qlt_abort_task(vha, iocb, sess);
 }
+void qlt_logo_completion_handler(fc_port_t *fcport, int rc)
+{
+        if (fcport->tgt_session) {
+                if (rc != MBS_COMMAND_COMPLETE) {
+                        ql_dbg(ql_dbg_tgt_mgt, fcport->vha, 0xf093,
+                                "%s: se_sess %p / sess %p from"
+                                " port %8phC loop_id %#04x s_id %02x:%02x:%02x"
+                                " LOGO failed: %#x\n",
+                                __func__,
+                                fcport->tgt_session->se_sess,
+                                fcport->tgt_session,
+                                fcport->port_name, fcport->loop_id,
+                                fcport->d_id.b.domain, fcport->d_id.b.area,
+                                fcport->d_id.b.al_pa, rc);
+                }
+                fcport->tgt_session->logout_completed = 1;
+        }
+}
+static void qlt_swap_imm_ntfy_iocb(struct imm_ntfy_from_isp *a,
+    struct imm_ntfy_from_isp *b)
+{
+        struct imm_ntfy_from_isp tmp;
+        memcpy(&tmp, a, sizeof(struct imm_ntfy_from_isp));
+        memcpy(a, b, sizeof(struct imm_ntfy_from_isp));
+        memcpy(b, &tmp, sizeof(struct imm_ntfy_from_isp));
+}
+/*
+* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list)
+*
+* Schedules sessions with matching port_id/loop_id but different wwn for
+* deletion. Returns existing session with matching wwn if present.
+* Null otherwise.
+*/
+static struct qla_tgt_sess *
+qlt_find_sess_invalidate_other(struct qla_tgt *tgt, uint64_t wwn,
+    port_id_t port_id, uint16_t loop_id)
+{
+        struct qla_tgt_sess *sess = NULL, *other_sess;
+        uint64_t other_wwn;
+        list_for_each_entry(other_sess, &tgt->sess_list, sess_list_entry) {
+                other_wwn = wwn_to_u64(other_sess->port_name);
+                if (wwn == other_wwn) {
+                        WARN_ON(sess);
+                        sess = other_sess;
+                        continue;
+                }
+                /* find other sess with nport_id collision */
+                if (port_id.b24 == other_sess->s_id.b24) {
+                        if (loop_id != other_sess->loop_id) {
+                                ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000c,
+                                    "Invalidating sess %p loop_id %d wwn %llx.\n",
+                                    other_sess, other_sess->loop_id, other_wwn);
+                                /*
+                                 * logout_on_delete is set by default, but another
+                                 * session that has the same s_id/loop_id combo
+                                 * might have cleared it when requested this session
+                                 * deletion, so don't touch it
+                                 */
+                                qlt_schedule_sess_for_deletion(other_sess, true);
+                        } else {
+                                /*
+                                 * Another wwn used to have our s_id/loop_id
+                                 * combo - kill the session, but don't log out
+                                 */
+                                sess->logout_on_delete = 0;
+                                qlt_schedule_sess_for_deletion(other_sess,
+                                    true);
+                        }
+                        continue;
+                }
+                /* find other sess with nport handle collision */
+                if (loop_id == other_sess->loop_id) {
+                        ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000d,
+                               "Invalidating sess %p loop_id %d wwn %llx.\n",
+                               other_sess, other_sess->loop_id, other_wwn);
+                        /* Same loop_id but different s_id
+                         * Ok to kill and logout */
+                        qlt_schedule_sess_for_deletion(other_sess, true);
+                }
+        }
+        return sess;
+}
+/* Abort any commands for this s_id waiting on qla_tgt_wq workqueue */
+static int abort_cmds_for_s_id(struct scsi_qla_host *vha, port_id_t *s_id)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+        uint32_t key;
+        int count = 0;
+        key = (((u32)s_id->b.domain << 16) |
+               ((u32)s_id->b.area   <<  8) |
+               ((u32)s_id->b.al_pa));
+        spin_lock(&vha->cmd_list_lock);
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                uint32_t op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
+                if (op_key == key) {
+                        op->aborted = true;
+                        count++;
+                }
+        }
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                uint32_t cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
+                if (cmd_key == key) {
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+                        count++;
+                }
+        }
+        spin_unlock(&vha->cmd_list_lock);
+        return count;
+}
 /*
 * ha->hardware_lock supposed to be held on entry. Might drop it, then reaquire
 */
 static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
        struct imm_ntfy_from_isp *iocb)
 {
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+        struct qla_hw_data *ha = vha->hw;
+        struct qla_tgt_sess *sess = NULL;
+        uint64_t wwn;
+        port_id_t port_id;
+        uint16_t loop_id;
+        uint16_t wd3_lo;
        int res = 0;
+        wwn = wwn_to_u64(iocb->u.isp24.port_name);
+        port_id.b.domain = iocb->u.isp24.port_id[2];
+        port_id.b.area   = iocb->u.isp24.port_id[1];
+        port_id.b.al_pa  = iocb->u.isp24.port_id[0];
+        port_id.b.rsvd_1 = 0;
+        loop_id = le16_to_cpu(iocb->u.isp24.nport_handle);
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf026,
            "qla_target(%d): Port ID: 0x%3phC ELS opcode: 0x%02x\n",
            vha->vp_idx, iocb->u.isp24.port_id, iocb->u.isp24.status_subcode);
+        /* res = 1 means ack at the end of thread
+         * res = 0 means ack async/later.
+         */
        switch (iocb->u.isp24.status_subcode) {
        case ELS_PLOGI:
-        case ELS_FLOGI:
+                /* Mark all stale commands in qla_tgt_wq for deletion */
+                abort_cmds_for_s_id(vha, &port_id);
+                if (wwn)
+                        sess = qlt_find_sess_invalidate_other(tgt, wwn,
+                            port_id, loop_id);
+                if (!sess || IS_SW_RESV_ADDR(sess->s_id)) {
+                        res = 1;
+                        break;
+                }
+                if (sess->plogi_ack_needed) {
+                        /*
+                         * Initiator sent another PLOGI before last PLOGI could
+                         * finish. Swap plogi iocbs and terminate old one
+                         * without acking, new one will get acked when session
+                         * deletion completes.
+                         */
+                        ql_log(ql_log_warn, sess->vha, 0xf094,
+                            "sess %p received double plogi.\n", sess);
+                        qlt_swap_imm_ntfy_iocb(iocb, &sess->tm_iocb);
+                        qlt_send_term_imm_notif(vha, iocb, 1);
+                        res = 0;
+                        break;
+                }
+                res = 0;
+                /*
+                 * Save immediate Notif IOCB for Ack when sess is done
+                 * and being deleted.
+                 */
+                memcpy(&sess->tm_iocb, iocb, sizeof(sess->tm_iocb));
+                sess->plogi_ack_needed  = 1;
+                 /*
+                  * Under normal circumstances we want to release nport handle
+                  * during LOGO process to avoid nport handle leaks inside FW.
+                  * The exception is when LOGO is done while another PLOGI with
+                  * the same nport handle is waiting as might be the case here.
+                  * Note: there is always a possibily of a race where session
+                  * deletion has already started for other reasons (e.g. ACL
+                  * removal) and now PLOGI arrives:
+                  * 1. if PLOGI arrived in FW after nport handle has been freed,
+                  *    FW must have assigned this PLOGI a new/same handle and we
+                  *    can proceed ACK'ing it as usual when session deletion
+                  *    completes.
+                  * 2. if PLOGI arrived in FW before LOGO with LCF_FREE_NPORT
+                  *    bit reached it, the handle has now been released. We'll
+                  *    get an error when we ACK this PLOGI. Nothing will be sent
+                  *    back to initiator. Initiator should eventually retry
+                  *    PLOGI and situation will correct itself.
+                  */
+                sess->keep_nport_handle = ((sess->loop_id == loop_id) &&
+                                           (sess->s_id.b24 == port_id.b24));
+                qlt_schedule_sess_for_deletion(sess, true);
+                break;
        case ELS_PRLI:
+                wd3_lo = le16_to_cpu(iocb->u.isp24.u.prli.wd3_lo);
+                if (wwn)
+                        sess = qlt_find_sess_invalidate_other(tgt, wwn, port_id,
+                            loop_id);
+                if (sess != NULL) {
+                        if (sess->deleted) {
+                                /*
+                                 * Impatient initiator sent PRLI before last
+                                 * PLOGI could finish. Will force him to re-try,
+                                 * while last one finishes.
+                                 */
+                                ql_log(ql_log_warn, sess->vha, 0xf095,
+                                    "sess %p PRLI received, before plogi ack.\n",
+                                    sess);
+                                qlt_send_term_imm_notif(vha, iocb, 1);
+                                res = 0;
+                                break;
+                        }
+                        /*
+                         * This shouldn't happen under normal circumstances,
+                         * since we have deleted the old session during PLOGI
+                         */
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf096,
+                            "PRLI (loop_id %#04x) for existing sess %p (loop_id %#04x)\n",
+                            sess->loop_id, sess, iocb->u.isp24.nport_handle);
+                        sess->local = 0;
+                        sess->loop_id = loop_id;
+                        sess->s_id = port_id;
+                        if (wd3_lo & BIT_7)
+                                sess->conf_compl_supported = 1;
+                }
+                res = 1; /* send notify ack */
+                /* Make session global (not used in fabric mode) */
+                if (ha->current_topology != ISP_CFG_F) {
+                        set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+                        set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+                        qla2xxx_wake_dpc(vha);
+                } else {
+                        /* todo: else - create sess here. */
+                        res = 1; /* send notify ack */
+                }
+                break;
        case ELS_LOGO:
        case ELS_PRLO:
                res = qlt_reset(vha, iocb, QLA_TGT_NEXUS_LOSS_SESS);
@@ -3697,6 +4306,7 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                break;
        }
+        case ELS_FLOGI: /* should never happen */
        default:
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf061,
                    "qla_target(%d): Unsupported ELS command %x "
@@ -5012,6 +5622,11 @@ static void qlt_abort_work(struct qla_tgt *tgt,
                if (!sess)
                        goto out_term;
        } else {
+                if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                        sess = NULL;
+                        goto out_term;
+                }
                kref_get(&sess->se_sess->sess_kref);
        }
@@ -5066,6 +5681,11 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
                if (!sess)
                        goto out_term;
        } else {
+                if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                        sess = NULL;
+                        goto out_term;
+                }
                kref_get(&sess->se_sess->sess_kref);
        }
@@ -5552,6 +6172,7 @@ qlt_24xx_process_atio_queue(struct scsi_qla_host *vha)
        /* Adjust ring index */
        WRT_REG_DWORD(ISP_ATIO_Q_OUT(vha), ha->tgt.atio_ring_index);
+        RD_REG_DWORD_RELAXED(ISP_ATIO_Q_OUT(vha));
 }
 void
@@ -5793,7 +6414,7 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
        if (!QLA_TGT_MODE_ENABLED())
                return;
-        if  (ha->mqenable || IS_QLA83XX(ha)) {
+        if  (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in;
                ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out;
        } else {
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 985d76dd706b..bca584ae45b7 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -167,7 +167,24 @@ struct imm_ntfy_from_isp {
                        uint32_t srr_rel_offs;
                        uint16_t srr_ui;
                        uint16_t srr_ox_id;
-                        uint8_t  reserved_4[19];
+                        union {
+                                struct {
+                                        uint8_t node_name[8];
+                                } plogi; /* PLOGI/ADISC/PDISC */
+                                struct {
+                                        /* PRLI word 3 bit 0-15 */
+                                        uint16_t wd3_lo;
+                                        uint8_t resv0[6];
+                                } prli;
+                                struct {
+                                        uint8_t port_id[3];
+                                        uint8_t resv1;
+                                        uint16_t nport_handle;
+                                        uint16_t resv2;
+                                } req_els;
+                        } u;
+                        uint8_t port_name[8];
+                        uint8_t resv3[3];
                        uint8_t  vp_index;
                        uint32_t reserved_5;
                        uint8_t  port_id[3];
@@ -234,6 +251,7 @@ struct nack_to_isp {
        uint8_t  reserved[2];
        uint16_t ox_id;
 } __packed;
+#define NOTIFY_ACK_FLAGS_TERMINATE      BIT_3
 #define NOTIFY_ACK_SRR_FLAGS_ACCEPT     0
 #define NOTIFY_ACK_SRR_FLAGS_REJECT     1
@@ -790,13 +808,6 @@ int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
 #define FC_TM_REJECT                4
 #define FC_TM_FAILED                5
-/*
- * Error code of qlt_pre_xmit_response() meaning that cmd's exchange was
- * terminated, so no more actions is needed and success should be returned
- * to target.
- */
-#define QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED       0x1717
 #if (BITS_PER_LONG > 32) || defined(CONFIG_HIGHMEM64G)
 #define pci_dma_lo32(a) (a & 0xffffffff)
 #define pci_dma_hi32(a) ((((a) >> 16)>>16) & 0xffffffff)
@@ -874,6 +885,15 @@ struct qla_tgt_sess_op {
        struct scsi_qla_host *vha;
        struct atio_from_isp atio;
        struct work_struct work;
+        struct list_head cmd_list;
+        bool aborted;
+};
+enum qla_sess_deletion {
+        QLA_SESS_DELETION_NONE          = 0,
+        QLA_SESS_DELETION_PENDING       = 1, /* hopefully we can get rid of
+                                              * this one */
+        QLA_SESS_DELETION_IN_PROGRESS   = 2,
 };
 /*
@@ -884,8 +904,15 @@ struct qla_tgt_sess {
        port_id_t s_id;
        unsigned int conf_compl_supported:1;
-        unsigned int deleted:1;
+        unsigned int deleted:2;
        unsigned int local:1;
+        unsigned int logout_on_delete:1;
+        unsigned int plogi_ack_needed:1;
+        unsigned int keep_nport_handle:1;
+        unsigned char logout_completed;
+        int generation;
        struct se_session *se_sess;
        struct scsi_qla_host *vha;
@@ -897,6 +924,10 @@ struct qla_tgt_sess {
        uint8_t port_name[WWN_SIZE];
        struct work_struct free_work;
+        union {
+                struct imm_ntfy_from_isp tm_iocb;
+        };
 };
 struct qla_tgt_cmd {
@@ -912,7 +943,6 @@ struct qla_tgt_cmd {
        unsigned int conf_compl_supported:1;
        unsigned int sg_mapped:1;
        unsigned int free_sg:1;
-        unsigned int aborted:1; /* Needed in case of SRR */
        unsigned int write_data_transferred:1;
        unsigned int ctx_dsd_alloced:1;
        unsigned int q_full:1;
@@ -961,6 +991,9 @@ struct qla_tgt_cmd {
         * BIT_14 - Back end data received/sent.
         * BIT_15 - SRR prepare ctio
         * BIT_16 - complete free
+         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
+         * BIT_18 - completion w/abort status
+         * BIT_19 - completion w/unknown status
         */
        uint32_t cmd_flags;
 };
@@ -1026,6 +1059,10 @@ struct qla_tgt_srr_ctio {
        struct qla_tgt_cmd *cmd;
 };
+/* Check for Switch reserved address */
+#define IS_SW_RESV_ADDR(_s_id) \
+        ((_s_id.b.domain == 0xff) && (_s_id.b.area == 0xfc))
 #define QLA_TGT_XMIT_DATA               1
 #define QLA_TGT_XMIT_STATUS             2
 #define QLA_TGT_XMIT_ALL                (QLA_TGT_XMIT_STATUS|QLA_TGT_XMIT_DATA)
@@ -1043,7 +1080,7 @@ extern int qlt_lport_register(void *, u64, u64, u64,
 extern void qlt_lport_deregister(struct scsi_qla_host *);
 extern void qlt_unreg_sess(struct qla_tgt_sess *);
 extern void qlt_fc_port_added(struct scsi_qla_host *, fc_port_t *);
-extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *);
+extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *, int);
 extern int __init qlt_init(void);
 extern void qlt_exit(void);
 extern void qlt_update_vp_map(struct scsi_qla_host *, int);
@@ -1073,12 +1110,23 @@ static inline void qla_reverse_ini_mode(struct scsi_qla_host *ha)
                ha->host->active_mode |= MODE_INITIATOR;
 }
+static inline uint32_t sid_to_key(const uint8_t *s_id)
+{
+        uint32_t key;
+        key = (((unsigned long)s_id[0] << 16) |
+               ((unsigned long)s_id[1] << 8) |
+               (unsigned long)s_id[2]);
+        return key;
+}
 /*
 * Exported symbols from qla_target.c LLD logic used by qla2xxx code..
 */
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
+extern void qlt_abort_cmd(struct qla_tgt_cmd *);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
@@ -1109,5 +1157,7 @@ extern void qlt_stop_phase2(struct qla_tgt *);
 extern irqreturn_t qla83xx_msix_atio_q(int, void *);
 extern void qlt_83xx_iospace_config(struct qla_hw_data *);
 extern int qlt_free_qfull_cmds(struct scsi_qla_host *);
+extern void qlt_logo_completion_handler(fc_port_t *, int);
+extern void qlt_do_generation_tick(struct scsi_qla_host *, int *);
 #endif /* __QLA_TARGET_H */
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index d9a8c6084346..9224a06646e6 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -374,7 +374,7 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
+        cmd->cmd_flags |= BIT_3;
        cmd->bufflen = se_cmd->data_length;
        cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -405,7 +405,7 @@ static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd)
            se_cmd->t_state == TRANSPORT_COMPLETE_QF_WP) {
                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
                wait_for_completion_timeout(&se_cmd->t_transport_stop_comp,
-                                                3000);
+                                            3 * HZ);
                return 0;
        }
        spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -541,12 +541,10 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
        cmd->cmd_flags |= BIT_4;
        cmd->bufflen = se_cmd->data_length;
        cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
-        cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
        cmd->sg_cnt = se_cmd->t_data_nents;
        cmd->sg = se_cmd->t_data_sg;
        cmd->offset = 0;
-        cmd->cmd_flags |= BIT_3;
        cmd->prot_sg_cnt = se_cmd->t_prot_nents;
        cmd->prot_sg = se_cmd->t_prot_sg;
@@ -571,7 +569,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
        cmd->sg_cnt = 0;
        cmd->offset = 0;
        cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
-        cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
        if (cmd->cmd_flags &  BIT_5) {
                pr_crit("Bit_5 already set for cmd = %p.\n", cmd);
                dump_stack();
@@ -636,14 +633,7 @@ static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
-        struct scsi_qla_host *vha = cmd->vha;
+        qlt_abort_cmd(cmd);
-        struct qla_hw_data *ha = vha->hw;
-        if (!cmd->sg_mapped)
-                return;
-        pci_unmap_sg(ha->pdev, cmd->sg, cmd->sg_cnt, cmd->dma_data_direction);
-        cmd->sg_mapped = 0;
 }
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
@@ -1149,9 +1139,7 @@ static struct qla_tgt_sess *tcm_qla2xxx_find_sess_by_s_id(
                return NULL;
        }
-        key = (((unsigned long)s_id[0] << 16) |
+        key = sid_to_key(s_id);
-               ((unsigned long)s_id[1] << 8) |
-               (unsigned long)s_id[2]);
        pr_debug("find_sess_by_s_id: 0x%06x\n", key);
        se_nacl = btree_lookup32(&lport->lport_fcport_map, key);
@@ -1186,9 +1174,7 @@ static void tcm_qla2xxx_set_sess_by_s_id(
        void *slot;
        int rc;
-        key = (((unsigned long)s_id[0] << 16) |
+        key = sid_to_key(s_id);
-               ((unsigned long)s_id[1] << 8) |
-               (unsigned long)s_id[2]);
        pr_debug("set_sess_by_s_id: %06x\n", key);
        slot = btree_lookup32(&lport->lport_fcport_map, key);
@@ -1544,6 +1530,10 @@ static void tcm_qla2xxx_update_sess(struct qla_tgt_sess *sess, port_id_t s_id,
        }
        sess->conf_compl_supported = conf_compl_supported;
+        /* Reset logout parameters to default */
+        sess->logout_on_delete = 1;
+        sess->keep_nport_handle = 0;
 }
 /*
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 1ac38e73df7e..9ad41168d26d 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr,
        depth = simple_strtoul(buf, NULL, 0);
-        if (depth < 1 || depth > sht->can_queue)
+        if (depth < 1 || depth > sdev->host->can_queue)
                return -EINVAL;
        retval = sht->change_queue_depth(sdev, depth);
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index a85292b1d09d..e3cd3ece4412 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -203,7 +203,7 @@ static ssize_t srp_show_tmo(char *buf, int tmo)
        return tmo >= 0 ? sprintf(buf, "%d\n", tmo) : sprintf(buf, "off\n");
 }
-static int srp_parse_tmo(int *tmo, const char *buf)
+int srp_parse_tmo(int *tmo, const char *buf)
 {
        int res = 0;
@@ -214,6 +214,7 @@ static int srp_parse_tmo(int *tmo, const char *buf)
        return res;
 }
+EXPORT_SYMBOL(srp_parse_tmo);
 static ssize_t show_reconnect_delay(struct device *dev,
                                    struct device_attribute *attr, char *buf)
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 3f25b8fa921d..871f3553987d 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -1329,9 +1329,9 @@ static int st_open(struct inode *inode, struct file *filp)
        spin_lock(&st_use_lock);
        STp->in_use = 0;
        spin_unlock(&st_use_lock);
-        scsi_tape_put(STp);
        if (resumed)
                scsi_autopm_put_device(STp->device);
+        scsi_tape_put(STp);
        return retval;
 }
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 285f77544c36..7dbbb29d24c6 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -949,7 +949,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 {
        struct Scsi_Host *shost;
        struct virtio_scsi *vscsi;
-        int err, host_prot;
+        int err;
        u32 sg_elems, num_targets;
        u32 cmd_per_lun;
        u32 num_queues;
@@ -1009,6 +1009,8 @@ static int virtscsi_probe(struct virtio_device *vdev)
 #ifdef CONFIG_BLK_DEV_INTEGRITY
        if (virtio_has_feature(vdev, VIRTIO_SCSI_F_T10_PI)) {
+                int host_prot;
                host_prot = SHOST_DIF_TYPE1_PROTECTION | SHOST_DIF_TYPE2_PROTECTION |
                            SHOST_DIF_TYPE3_PROTECTION | SHOST_DIX_TYPE1_PROTECTION |
                            SHOST_DIX_TYPE2_PROTECTION | SHOST_DIX_TYPE3_PROTECTION;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 0cae1694014d..b0f30fb68914 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -612,7 +612,7 @@ config SPI_XTENSA_XTFPGA
 config SPI_ZYNQMP_GQSPI
        tristate "Xilinx ZynqMP GQSPI controller"
-        depends on SPI_MASTER
+        depends on SPI_MASTER && HAS_DMA
        help
          Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC.
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 788e2b176a4f..acce90ac7371 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -40,6 +40,7 @@
 #define SPFI_CONTROL_SOFT_RESET                 BIT(11)
 #define SPFI_CONTROL_SEND_DMA                   BIT(10)
 #define SPFI_CONTROL_GET_DMA                    BIT(9)
+#define SPFI_CONTROL_SE                 BIT(8)
 #define SPFI_CONTROL_TMODE_SHIFT                5
 #define SPFI_CONTROL_TMODE_MASK                 0x7
 #define SPFI_CONTROL_TMODE_SINGLE               0
@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
        else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
                 xfer->rx_nbits == SPI_NBITS_QUAD)
                val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
+        val |= SPFI_CONTROL_SE;
        spfi_writel(spfi, val, SPFI_CONTROL);
 }
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index eb7d3a6fb14c..f9deb84e4e55 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
 {
        struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
-        if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
+        if (spi_imx->dma_is_inited
-            && (transfer->len > spi_imx->tx_wml))
+            && transfer->len > spi_imx->rx_wml * sizeof(u32)
+            && transfer->len > spi_imx->tx_wml * sizeof(u32))
                return true;
        return false;
 }
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 87b20a511a6b..f23f36ebaf3d 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -214,6 +214,7 @@ static void zynqmp_gqspi_selectslave(struct zynqmp_qspi *instanceptr,
        case GQSPI_SELECT_FLASH_CS_BOTH:
                instanceptr->genfifocs = GQSPI_GENFIFO_CS_LOWER |
                        GQSPI_GENFIFO_CS_UPPER;
+                break;
        case GQSPI_SELECT_FLASH_CS_UPPER:
                instanceptr->genfifocs = GQSPI_GENFIFO_CS_UPPER;
                break;
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index dd616ff0ffc5..c7de64171c45 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -693,6 +693,7 @@ static struct class *spidev_class;
 #ifdef CONFIG_OF
 static const struct of_device_id spidev_dt_ids[] = {
        { .compatible = "rohm,dh2228fv" },
+        { .compatible = "lineartechnology,ltc2488" },
        {},
 };
 MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/drivers/staging/board/Kconfig b/drivers/staging/board/Kconfig
index b8ee81840666..3f287c48e082 100644
--- a/drivers/staging/board/Kconfig
+++ b/drivers/staging/board/Kconfig
@@ -1,6 +1,6 @@
 config STAGING_BOARD
        bool "Staging Board Support"
-        depends on OF_ADDRESS
+        depends on OF_ADDRESS && OF_IRQ && CLKDEV_LOOKUP
        help
          Select to enable per-board staging support code.
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
index 7125eb955ae5..8a9d4a0de129 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
@@ -31,7 +31,6 @@
 #define DEBUG_PORTAL_ALLOC
 #define DEBUG_SUBSYSTEM S_LND
-#include <asm/irq.h>
 #include <linux/crc32.h>
 #include <linux/errno.h>
 #include <linux/if.h>
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index ed040fbb7df8..b0c8e235b982 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1418,7 +1418,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
        priv->current_aid = conf->aid;
-        if (changed & BSS_CHANGED_BSSID) {
+        if (changed & BSS_CHANGED_BSSID && conf->bssid) {
                unsigned long flags;
                spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index f97323f19acf..af572d718135 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
        priv->current_aid = conf->aid;
-        if (changed & BSS_CHANGED_BSSID)
+        if (changed & BSS_CHANGED_BSSID && conf->bssid)
                vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 4e68b62193ed..cd77a064c772 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3998,7 +3998,13 @@ get_immediate:
        }
 transport_err:
-        iscsit_take_action_for_connection_exit(conn);
+        /*
+         * Avoid the normal connection failure code-path if this connection
+         * is still within LOGIN mode, and iscsi_np process context is
+         * responsible for cleaning up the early connection failure.
+         */
+        if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
+                iscsit_take_action_for_connection_exit(conn);
 out:
        return 0;
 }
@@ -4082,7 +4088,7 @@ reject:
 int iscsi_target_rx_thread(void *arg)
 {
-        int ret;
+        int ret, rc;
        u8 buffer[ISCSI_HDR_LEN], opcode;
        u32 checksum = 0, digest = 0;
        struct iscsi_conn *conn = arg;
@@ -4092,10 +4098,16 @@ int iscsi_target_rx_thread(void *arg)
         * connection recovery / failure event can be triggered externally.
         */
        allow_signal(SIGINT);
+        /*
+         * Wait for iscsi_post_login_handler() to complete before allowing
+         * incoming iscsi/tcp socket I/O, and/or failing the connection.
+         */
+        rc = wait_for_completion_interruptible(&conn->rx_login_comp);
+        if (rc < 0)
+                return 0;
        if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
                struct completion comp;
-                int rc;
                init_completion(&comp);
                rc = wait_for_completion_interruptible(&comp);
@@ -4532,7 +4544,18 @@ static void iscsit_logout_post_handler_closesession(
        struct iscsi_conn *conn)
 {
        struct iscsi_session *sess = conn->sess;
-        int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+        int sleep = 1;
+        /*
+         * Traditional iscsi/tcp will invoke this logic from TX thread
+         * context during session logout, so clear tx_thread_active and
+         * sleep if iscsit_close_connection() has not already occured.
+         *
+         * Since iser-target invokes this logic from it's own workqueue,
+         * always sleep waiting for RX/TX thread shutdown to complete
+         * within iscsit_close_connection().
+         */
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                sleep = cmpxchg(&conn->tx_thread_active, true, false);
        atomic_set(&conn->conn_logout_remove, 0);
        complete(&conn->conn_logout_comp);
@@ -4546,7 +4569,10 @@ static void iscsit_logout_post_handler_closesession(
 static void iscsit_logout_post_handler_samecid(
        struct iscsi_conn *conn)
 {
-        int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+        int sleep = 1;
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                sleep = cmpxchg(&conn->tx_thread_active, true, false);
        atomic_set(&conn->conn_logout_remove, 0);
        complete(&conn->conn_logout_comp);
@@ -4765,6 +4791,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
        struct iscsi_session *sess;
        struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
        struct se_session *se_sess, *se_sess_tmp;
+        LIST_HEAD(free_list);
        int session_count = 0;
        spin_lock_bh(&se_tpg->session_lock);
@@ -4786,14 +4813,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
                }
                atomic_set(&sess->session_reinstatement, 1);
                spin_unlock(&sess->conn_lock);
-                spin_unlock_bh(&se_tpg->session_lock);
-                iscsit_free_session(sess);
+                list_move_tail(&se_sess->sess_list, &free_list);
-                spin_lock_bh(&se_tpg->session_lock);
+        }
+        spin_unlock_bh(&se_tpg->session_lock);
+        list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+                sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+                iscsit_free_session(sess);
                session_count++;
        }
-        spin_unlock_bh(&se_tpg->session_lock);
        pr_debug("Released %d iSCSI Session(s) from Target Portal"
                        " Group: %hu\n", session_count, tpg->tpgt);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 3d0fe4ff5590..7e8f65e5448f 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -82,6 +82,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
        init_completion(&conn->conn_logout_comp);
        init_completion(&conn->rx_half_close_comp);
        init_completion(&conn->tx_half_close_comp);
+        init_completion(&conn->rx_login_comp);
        spin_lock_init(&conn->cmd_lock);
        spin_lock_init(&conn->conn_usage_lock);
        spin_lock_init(&conn->immed_queue_lock);
@@ -644,7 +645,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
                iscsit_start_nopin_timer(conn);
 }
-static int iscsit_start_kthreads(struct iscsi_conn *conn)
+int iscsit_start_kthreads(struct iscsi_conn *conn)
 {
        int ret = 0;
@@ -679,6 +680,7 @@ static int iscsit_start_kthreads(struct iscsi_conn *conn)
        return 0;
 out_tx:
+        send_sig(SIGINT, conn->tx_thread, 1);
        kthread_stop(conn->tx_thread);
        conn->tx_thread_active = false;
 out_bitmap:
@@ -689,7 +691,7 @@ out_bitmap:
        return ret;
 }
-int iscsi_post_login_handler(
+void iscsi_post_login_handler(
        struct iscsi_np *np,
        struct iscsi_conn *conn,
        u8 zero_tsih)
@@ -699,7 +701,6 @@ int iscsi_post_login_handler(
        struct se_session *se_sess = sess->se_sess;
        struct iscsi_portal_group *tpg = sess->tpg;
        struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
-        int rc;
        iscsit_inc_conn_usage_count(conn);
@@ -739,10 +740,6 @@ int iscsi_post_login_handler(
                        sess->sess_ops->InitiatorName);
                spin_unlock_bh(&sess->conn_lock);
-                rc = iscsit_start_kthreads(conn);
-                if (rc)
-                        return rc;
                iscsi_post_login_start_timers(conn);
                /*
                 * Determine CPU mask to ensure connection's RX and TX kthreads
@@ -751,15 +748,20 @@ int iscsi_post_login_handler(
                iscsit_thread_get_cpumask(conn);
                conn->conn_rx_reset_cpumask = 1;
                conn->conn_tx_reset_cpumask = 1;
+                /*
+                 * Wakeup the sleeping iscsi_target_rx_thread() now that
+                 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
+                 */
+                complete(&conn->rx_login_comp);
                iscsit_dec_conn_usage_count(conn);
                if (stop_timer) {
                        spin_lock_bh(&se_tpg->session_lock);
                        iscsit_stop_time2retain_timer(sess);
                        spin_unlock_bh(&se_tpg->session_lock);
                }
                iscsit_dec_session_usage_count(sess);
-                return 0;
+                return;
        }
        iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
@@ -800,10 +802,6 @@ int iscsi_post_login_handler(
                " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
        spin_unlock_bh(&se_tpg->session_lock);
-        rc = iscsit_start_kthreads(conn);
-        if (rc)
-                return rc;
        iscsi_post_login_start_timers(conn);
        /*
         * Determine CPU mask to ensure connection's RX and TX kthreads
@@ -812,10 +810,12 @@ int iscsi_post_login_handler(
        iscsit_thread_get_cpumask(conn);
        conn->conn_rx_reset_cpumask = 1;
        conn->conn_tx_reset_cpumask = 1;
+        /*
+         * Wakeup the sleeping iscsi_target_rx_thread() now that
+         * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
+         */
+        complete(&conn->rx_login_comp);
        iscsit_dec_conn_usage_count(conn);
-        return 0;
 }
 static void iscsi_handle_login_thread_timeout(unsigned long data)
@@ -1380,23 +1380,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
        if (ret < 0)
                goto new_sess_out;
-        if (!conn->sess) {
-                pr_err("struct iscsi_conn session pointer is NULL!\n");
-                goto new_sess_out;
-        }
        iscsi_stop_login_thread_timer(np);
-        if (signal_pending(current))
-                goto new_sess_out;
        if (ret == 1) {
                tpg_np = conn->tpg_np;
-                ret = iscsi_post_login_handler(np, conn, zero_tsih);
+                iscsi_post_login_handler(np, conn, zero_tsih);
-                if (ret < 0)
-                        goto new_sess_out;
                iscsit_deaccess_np(np, tpg, tpg_np);
        }
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 1c7358081533..57aa0d0fd820 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
 extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+extern int iscsit_start_kthreads(struct iscsi_conn *);
+extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
 extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
                                bool, bool);
 extern int iscsi_target_login_thread(void *);
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 8c02fa34716f..f9cde9141836 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -17,6 +17,7 @@
 ******************************************************************************/
 #include <linux/ctype.h>
+#include <linux/kthread.h>
 #include <scsi/iscsi_proto.h>
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
                ntohl(login_rsp->statsn), login->rsp_length);
        padding = ((-login->rsp_length) & 3);
+        /*
+         * Before sending the last login response containing the transition
+         * bit for full-feature-phase, go ahead and start up TX/RX threads
+         * now to avoid potential resource allocation failures after the
+         * final login response has been sent.
+         */
+        if (login->login_complete) {
+                int rc = iscsit_start_kthreads(conn);
+                if (rc) {
+                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                            ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                        return -1;
+                }
+        }
        if (conn->conn_transport->iscsit_put_login_tx(conn, login,
                                        login->rsp_length + padding) < 0)
-                return -1;
+                goto err;
        login->rsp_length               = 0;
        mutex_lock(&sess->cmdsn_mutex);
@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
        mutex_unlock(&sess->cmdsn_mutex);
        return 0;
+err:
+        if (login->login_complete) {
+                if (conn->rx_thread && conn->rx_thread_active) {
+                        send_sig(SIGINT, conn->rx_thread, 1);
+                        kthread_stop(conn->rx_thread);
+                }
+                if (conn->tx_thread && conn->tx_thread_active) {
+                        send_sig(SIGINT, conn->tx_thread, 1);
+                        kthread_stop(conn->tx_thread);
+                }
+                spin_lock(&iscsit_global->ts_bitmap_lock);
+                bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
+                                      get_order(1));
+                spin_unlock(&iscsit_global->ts_bitmap_lock);
+        }
+        return -1;
 }
 static void iscsi_target_sk_data_ready(struct sock *sk)
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 0b0de3647478..c2e9fea90b4a 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -747,7 +747,7 @@ static ssize_t store_pi_prot_type(struct se_dev_attrib *da,
        if (!dev->transport->init_prot || !dev->transport->free_prot) {
                /* 0 is only allowed value for non-supporting backends */
                if (flag == 0)
-                        return 0;
+                        return count;
                pr_err("DIF protection not supported by backend: %s\n",
                       dev->transport->name);
@@ -1590,9 +1590,9 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
        u8 type = 0;
        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
-                return 0;
+                return count;
        if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS)
-                return 0;
+                return count;
        if (dev->export_count) {
                pr_debug("Unable to process APTPL metadata while"
@@ -1658,22 +1658,32 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                 * PR APTPL Metadata for Reservation
                 */
                case Opt_res_holder:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        res_holder = arg;
                        break;
                case Opt_res_type:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        type = (u8)arg;
                        break;
                case Opt_res_scope:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        break;
                case Opt_res_all_tg_pt:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        all_tg_pt = (int)arg;
                        break;
                case Opt_mapped_lun:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        mapped_lun = (u64)arg;
                        break;
                /*
@@ -1701,14 +1711,20 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                        }
                        break;
                case Opt_tpgt:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        tpgt = (u16)arg;
                        break;
                case Opt_port_rtpi:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        break;
                case Opt_target_lun:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                        target_lun = (u64)arg;
                        break;
                default:
@@ -1985,7 +2001,7 @@ static ssize_t target_core_store_alua_lu_gp(
        lu_gp_mem = dev->dev_alua_lu_gp_mem;
        if (!lu_gp_mem)
-                return 0;
+                return count;
        if (count > LU_GROUP_NAME_BUF) {
                pr_err("ALUA LU Group Alias too large!\n");
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 0fdbe43b7dad..5ab7100de17e 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1474,7 +1474,7 @@ core_scsi3_decode_spec_i_port(
        LIST_HEAD(tid_dest_list);
        struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp;
        unsigned char *buf, *ptr, proto_ident;
-        const unsigned char *i_str;
+        const unsigned char *i_str = NULL;
        char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN];
        sense_reason_t ret;
        u32 tpdl, tid_len = 0;
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 4703f403f31c..384cf8894411 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -333,6 +333,7 @@ static int rd_configure_device(struct se_device *dev)
        dev->dev_attrib.hw_block_size = RD_BLOCKSIZE;
        dev->dev_attrib.hw_max_sectors = UINT_MAX;
        dev->dev_attrib.hw_queue_depth = RD_MAX_DEVICE_QUEUE_DEPTH;
+        dev->dev_attrib.is_nonrot = 1;
        rd_dev->rd_dev_id = rd_host->rd_host_dev_id_count++;
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index b0744433315a..b5ba1ec3c354 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -454,10 +454,17 @@ spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
                    cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE1_PROT)
                        buf[4] = 0x5;
                else if (dev->dev_attrib.pi_prot_type == TARGET_DIF_TYPE3_PROT ||
-                        cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE3_PROT)
+                         cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE3_PROT)
                        buf[4] = 0x4;
        }
+        /* logical unit supports type 1 and type 3 protection */
+        if ((dev->transport->get_device_type(dev) == TYPE_DISK) &&
+            (sess->sup_prot_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS)) &&
+            (dev->dev_attrib.pi_prot_type || cmd->se_sess->sess_prot_type)) {
+                buf[4] |= (0x3 << 3);
+        }
        /* Set HEADSUP, ORDSUP, SIMPSUP */
        buf[5] = 0x07;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c9c27f69e101..ee8bfacf2071 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1108,19 +1108,29 @@ static void eraser(unsigned char c, struct tty_struct *tty)
 *      Locking: ctrl_lock
 */
-static void isig(int sig, struct tty_struct *tty)
+static void __isig(int sig, struct tty_struct *tty)
 {
-        struct n_tty_data *ldata = tty->disc_data;
        struct pid *tty_pgrp = tty_get_pgrp(tty);
        if (tty_pgrp) {
                kill_pgrp(tty_pgrp, sig, 1);
                put_pid(tty_pgrp);
        }
+}
-        if (!L_NOFLSH(tty)) {
+static void isig(int sig, struct tty_struct *tty)
+{
+        struct n_tty_data *ldata = tty->disc_data;
+        if (L_NOFLSH(tty)) {
+                /* signal only */
+                __isig(sig, tty);
+        } else { /* signal and flush */
                up_read(&tty->termios_rwsem);
                down_write(&tty->termios_rwsem);
+                __isig(sig, tty);
                /* clear echo buffer */
                mutex_lock(&ldata->output_lock);
                ldata->echo_head = ldata->echo_tail = 0;
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 76e65b714471..15b4079a335e 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1185,7 +1185,7 @@ config SERIAL_SC16IS7XX_CORE
 config SERIAL_SC16IS7XX
        tristate "SC16IS7xx serial support"
        select SERIAL_CORE
-        depends on I2C || SPI_MASTER
+        depends on (SPI_MASTER && !I2C) || I2C
        help
          This selects support for SC16IS7xx serial ports.
          Supported ICs are SC16IS740, SC16IS741, SC16IS750, SC16IS752,
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 50cf5b10ceed..fd27e986b1dd 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2310,8 +2310,8 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
        void __iomem *base;
        base = devm_ioremap_resource(dev, mmiobase);
-        if (!base)
+        if (IS_ERR(base))
-                return -ENOMEM;
+                return PTR_ERR(base);
        index = pl011_probe_dt_alias(index, dev);
diff --git a/drivers/tty/serial/etraxfs-uart.c b/drivers/tty/serial/etraxfs-uart.c
index a57301a6fe42..679709f51fd4 100644
--- a/drivers/tty/serial/etraxfs-uart.c
+++ b/drivers/tty/serial/etraxfs-uart.c
@@ -950,7 +950,7 @@ static int etraxfs_uart_remove(struct platform_device *pdev)
        port = platform_get_drvdata(pdev);
        uart_remove_one_port(&etraxfs_uart_driver, port);
-        etraxfs_uart_ports[pdev->id] = NULL;
+        etraxfs_uart_ports[port->line] = NULL;
        return 0;
 }
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 2c90dc31bfaa..54fdc7866ea1 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1121,11 +1121,6 @@ static int imx_startup(struct uart_port *port)
        writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
-        /* Can we enable the DMA support? */
-        if (is_imx6q_uart(sport) && !uart_console(port) &&
-            !sport->dma_is_inited)
-                imx_uart_dma_init(sport);
        spin_lock_irqsave(&sport->port.lock, flags);
        /* Reset fifo's and state machines */
        i = 100;
@@ -1143,9 +1138,6 @@ static int imx_startup(struct uart_port *port)
        writel(USR1_RTSD, sport->port.membase + USR1);
        writel(USR2_ORE, sport->port.membase + USR2);
-        if (sport->dma_is_inited && !sport->dma_is_enabled)
-                imx_enable_dma(sport);
        temp = readl(sport->port.membase + UCR1);
        temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
@@ -1316,6 +1308,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
                        } else {
                                ucr2 |= UCR2_CTSC;
                        }
+                        /* Can we enable the DMA support? */
+                        if (is_imx6q_uart(sport) && !uart_console(port)
+                                && !sport->dma_is_inited)
+                                imx_uart_dma_init(sport);
                } else {
                        termios->c_cflag &= ~CRTSCTS;
                }
@@ -1432,6 +1429,8 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
        if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
                imx_enable_ms(&sport->port);
+        if (sport->dma_is_inited && !sport->dma_is_enabled)
+                imx_enable_dma(sport);
        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 9e6576004a42..5ccc698cbbfa 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -354,6 +354,26 @@ static void sc16is7xx_port_write(struct uart_port *port, u8 reg, u8 val)
                     (reg << SC16IS7XX_REG_SHIFT) | port->line, val);
 }
+static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen)
+{
+        struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+        u8 addr = (SC16IS7XX_RHR_REG << SC16IS7XX_REG_SHIFT) | port->line;
+        regcache_cache_bypass(s->regmap, true);
+        regmap_raw_read(s->regmap, addr, s->buf, rxlen);
+        regcache_cache_bypass(s->regmap, false);
+}
+static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send)
+{
+        struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+        u8 addr = (SC16IS7XX_THR_REG << SC16IS7XX_REG_SHIFT) | port->line;
+        regcache_cache_bypass(s->regmap, true);
+        regmap_raw_write(s->regmap, addr, s->buf, to_send);
+        regcache_cache_bypass(s->regmap, false);
+}
 static void sc16is7xx_port_update(struct uart_port *port, u8 reg,
                                  u8 mask, u8 val)
 {
@@ -508,10 +528,7 @@ static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
                        s->buf[0] = sc16is7xx_port_read(port, SC16IS7XX_RHR_REG);
                        bytes_read = 1;
                } else {
-                        regcache_cache_bypass(s->regmap, true);
+                        sc16is7xx_fifo_read(port, rxlen);
-                        regmap_raw_read(s->regmap, SC16IS7XX_RHR_REG,
-                                        s->buf, rxlen);
-                        regcache_cache_bypass(s->regmap, false);
                        bytes_read = rxlen;
                }
@@ -591,9 +608,8 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
                        s->buf[i] = xmit->buf[xmit->tail];
                        xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
                }
-                regcache_cache_bypass(s->regmap, true);
-                regmap_raw_write(s->regmap, SC16IS7XX_THR_REG, s->buf, to_send);
+                sc16is7xx_fifo_write(port, to_send);
-                regcache_cache_bypass(s->regmap, false);
        }
        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 7ae1592f7ec9..f36852067f20 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1418,7 +1418,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
        mutex_lock(&port->mutex);
        uart_shutdown(tty, state);
        tty_port_tty_set(port, NULL);
-        tty->closing = 0;
        spin_lock_irqsave(&port->lock, flags);
        if (port->blocked_open) {
@@ -1444,6 +1444,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
        mutex_unlock(&port->mutex);
        tty_ldisc_flush(tty);
+        tty->closing = 0;
 }
 static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index ea27804d87af..381a2b13682c 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -356,6 +356,7 @@ int paste_selection(struct tty_struct *tty)
                        schedule();
                        continue;
                }
+                __set_current_state(TASK_RUNNING);
                count = sel_buffer_lth - pasted;
                count = tty_ldisc_receive_buf(ld, sel_buffer + pasted, NULL,
                                              count);
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 8fe52989b380..4462d167900c 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -742,6 +742,8 @@ static void visual_init(struct vc_data *vc, int num, int init)
        __module_get(vc->vc_sw->owner);
        vc->vc_num = num;
        vc->vc_display_fg = &master_display_fg;
+        if (vc->vc_uni_pagedir_loc)
+                con_free_unimap(vc);
        vc->vc_uni_pagedir_loc = &vc->vc_uni_pagedir;
        vc->vc_uni_pagedir = NULL;
        vc->vc_hi_font_mask = 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 519a77ba214c..b30e7423549b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1944,6 +1944,7 @@ static void __exit acm_exit(void)
        usb_deregister(&acm_driver);
        tty_unregister_driver(acm_tty_driver);
        put_tty_driver(acm_tty_driver);
+        idr_destroy(&acm_minors);
 }
 module_init(acm_init);
diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index 0e6f968e93fe..01c0c0477a9e 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -242,7 +242,7 @@ static int __init ulpi_init(void)
 {
        return bus_register(&ulpi_bus);
 }
-module_init(ulpi_init);
+subsys_initcall(ulpi_init);
 static void __exit ulpi_exit(void)
 {
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index be5b2074f906..cbcd0920fb51 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_hcd *hcd)
                                dev_name(&usb_dev->dev), retval);
                return (retval < 0) ? retval : -EMSGSIZE;
        }
-        if (usb_dev->speed == USB_SPEED_SUPER) {
+        if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
                retval = usb_get_bos_descriptor(usb_dev);
-                if (retval < 0) {
+                if (!retval) {
+                        usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+                } else if (usb_dev->speed == USB_SPEED_SUPER) {
                        mutex_unlock(&usb_bus_list_lock);
                        dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
                                        dev_name(&usb_dev->dev), retval);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 43cb2f2e3b43..73dfa194160b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
        return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
-static int usb_device_supports_lpm(struct usb_device *udev)
+int usb_device_supports_lpm(struct usb_device *udev)
 {
        /* USB 2.1 (and greater) devices indicate LPM support through
         * their USB 2.0 Extended Capabilities BOS descriptor.
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 7eb1e26798e5..457255a3306a 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -65,6 +65,7 @@ extern int  usb_hub_init(void);
 extern void usb_hub_cleanup(void);
 extern int usb_major_init(void);
 extern void usb_major_cleanup(void);
+extern int usb_device_supports_lpm(struct usb_device *udev);
 #ifdef  CONFIG_PM
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index e5b546f1152e..c3cc1a78d1e2 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -72,17 +72,7 @@ static int dwc2_backup_host_registers(struct dwc2_hsotg *hsotg)
        dev_dbg(hsotg->dev, "%s\n", __func__);
        /* Backup Host regs */
-        hr = hsotg->hr_backup;
+        hr = &hsotg->hr_backup;
-        if (!hr) {
-                hr = devm_kzalloc(hsotg->dev, sizeof(*hr), GFP_KERNEL);
-                if (!hr) {
-                        dev_err(hsotg->dev, "%s: can't allocate host regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-                hsotg->hr_backup = hr;
-        }
        hr->hcfg = readl(hsotg->regs + HCFG);
        hr->haintmsk = readl(hsotg->regs + HAINTMSK);
        for (i = 0; i < hsotg->core_params->host_channels; ++i)
@@ -90,6 +80,7 @@ static int dwc2_backup_host_registers(struct dwc2_hsotg *hsotg)
        hr->hprt0 = readl(hsotg->regs + HPRT0);
        hr->hfir = readl(hsotg->regs + HFIR);
+        hr->valid = true;
        return 0;
 }
@@ -109,12 +100,13 @@ static int dwc2_restore_host_registers(struct dwc2_hsotg *hsotg)
        dev_dbg(hsotg->dev, "%s\n", __func__);
        /* Restore host regs */
-        hr = hsotg->hr_backup;
+        hr = &hsotg->hr_backup;
-        if (!hr) {
+        if (!hr->valid) {
                dev_err(hsotg->dev, "%s: no host registers to restore\n",
                                __func__);
                return -EINVAL;
        }
+        hr->valid = false;
        writel(hr->hcfg, hsotg->regs + HCFG);
        writel(hr->haintmsk, hsotg->regs + HAINTMSK);
@@ -152,17 +144,7 @@ static int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg)
        dev_dbg(hsotg->dev, "%s\n", __func__);
        /* Backup dev regs */
-        dr = hsotg->dr_backup;
+        dr = &hsotg->dr_backup;
-        if (!dr) {
-                dr = devm_kzalloc(hsotg->dev, sizeof(*dr), GFP_KERNEL);
-                if (!dr) {
-                        dev_err(hsotg->dev, "%s: can't allocate device regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-                hsotg->dr_backup = dr;
-        }
        dr->dcfg = readl(hsotg->regs + DCFG);
        dr->dctl = readl(hsotg->regs + DCTL);
@@ -195,7 +177,7 @@ static int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg)
                dr->doeptsiz[i] = readl(hsotg->regs + DOEPTSIZ(i));
                dr->doepdma[i] = readl(hsotg->regs + DOEPDMA(i));
        }
+        dr->valid = true;
        return 0;
 }
@@ -215,12 +197,13 @@ static int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg)
        dev_dbg(hsotg->dev, "%s\n", __func__);
        /* Restore dev regs */
-        dr = hsotg->dr_backup;
+        dr = &hsotg->dr_backup;
-        if (!dr) {
+        if (!dr->valid) {
                dev_err(hsotg->dev, "%s: no device registers to restore\n",
                                __func__);
                return -EINVAL;
        }
+        dr->valid = false;
        writel(dr->dcfg, hsotg->regs + DCFG);
        writel(dr->dctl, hsotg->regs + DCTL);
@@ -268,17 +251,7 @@ static int dwc2_backup_global_registers(struct dwc2_hsotg *hsotg)
        int i;
        /* Backup global regs */
-        gr = hsotg->gr_backup;
+        gr = &hsotg->gr_backup;
-        if (!gr) {
-                gr = devm_kzalloc(hsotg->dev, sizeof(*gr), GFP_KERNEL);
-                if (!gr) {
-                        dev_err(hsotg->dev, "%s: can't allocate global regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-                hsotg->gr_backup = gr;
-        }
        gr->gotgctl = readl(hsotg->regs + GOTGCTL);
        gr->gintmsk = readl(hsotg->regs + GINTMSK);
@@ -291,6 +264,7 @@ static int dwc2_backup_global_registers(struct dwc2_hsotg *hsotg)
        for (i = 0; i < MAX_EPS_CHANNELS; i++)
                gr->dtxfsiz[i] = readl(hsotg->regs + DPTXFSIZN(i));
+        gr->valid = true;
        return 0;
 }
@@ -309,12 +283,13 @@ static int dwc2_restore_global_registers(struct dwc2_hsotg *hsotg)
        dev_dbg(hsotg->dev, "%s\n", __func__);
        /* Restore global regs */
-        gr = hsotg->gr_backup;
+        gr = &hsotg->gr_backup;
-        if (!gr) {
+        if (!gr->valid) {
                dev_err(hsotg->dev, "%s: no global registers to restore\n",
                                __func__);
                return -EINVAL;
        }
+        gr->valid = false;
        writel(0xffffffff, hsotg->regs + GINTSTS);
        writel(gr->gotgctl, hsotg->regs + GOTGCTL);
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 53b8de03f102..0ed87620941b 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -492,6 +492,7 @@ struct dwc2_gregs_backup {
        u32 gdfifocfg;
        u32 dtxfsiz[MAX_EPS_CHANNELS];
        u32 gpwrdn;
+        bool valid;
 };
 /**
@@ -521,6 +522,7 @@ struct dwc2_dregs_backup {
        u32 doepctl[MAX_EPS_CHANNELS];
        u32 doeptsiz[MAX_EPS_CHANNELS];
        u32 doepdma[MAX_EPS_CHANNELS];
+        bool valid;
 };
 /**
@@ -538,6 +540,7 @@ struct dwc2_hregs_backup {
        u32 hcintmsk[MAX_EPS_CHANNELS];
        u32 hprt0;
        u32 hfir;
+        bool valid;
 };
 /**
@@ -705,9 +708,9 @@ struct dwc2_hsotg {
        struct work_struct wf_otg;
        struct timer_list wkp_timer;
        enum dwc2_lx_state lx_state;
-        struct dwc2_gregs_backup *gr_backup;
+        struct dwc2_gregs_backup gr_backup;
-        struct dwc2_dregs_backup *dr_backup;
+        struct dwc2_dregs_backup dr_backup;
-        struct dwc2_hregs_backup *hr_backup;
+        struct dwc2_hregs_backup hr_backup;
        struct dentry *debug_root;
        struct debugfs_regset32 *regset;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index b10377c65064..f845c41fe9e5 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -359,10 +359,9 @@ void dwc2_hcd_stop(struct dwc2_hsotg *hsotg)
 /* Caller must hold driver lock */
 static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
-                                struct dwc2_hcd_urb *urb, void **ep_handle,
+                                struct dwc2_hcd_urb *urb, struct dwc2_qh *qh,
-                                gfp_t mem_flags)
+                                struct dwc2_qtd *qtd)
 {
-        struct dwc2_qtd *qtd;
        u32 intr_mask;
        int retval;
        int dev_speed;
@@ -386,18 +385,15 @@ static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
                        return -ENODEV;
        }
-        qtd = kzalloc(sizeof(*qtd), mem_flags);
        if (!qtd)
-                return -ENOMEM;
+                return -EINVAL;
        dwc2_hcd_qtd_init(qtd, urb);
-        retval = dwc2_hcd_qtd_add(hsotg, qtd, (struct dwc2_qh **)ep_handle,
+        retval = dwc2_hcd_qtd_add(hsotg, qtd, qh);
-                                  mem_flags);
        if (retval) {
                dev_err(hsotg->dev,
                        "DWC OTG HCD URB Enqueue failed adding QTD. Error status %d\n",
                        retval);
-                kfree(qtd);
                return retval;
        }
@@ -2445,6 +2441,9 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
        u32 tflags = 0;
        void *buf;
        unsigned long flags;
+        struct dwc2_qh *qh;
+        bool qh_allocated = false;
+        struct dwc2_qtd *qtd;
        if (dbg_urb(urb)) {
                dev_vdbg(hsotg->dev, "DWC OTG HCD URB Enqueue\n");
@@ -2523,15 +2522,32 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                                                 urb->iso_frame_desc[i].length);
        urb->hcpriv = dwc2_urb;
+        qh = (struct dwc2_qh *) ep->hcpriv;
+        /* Create QH for the endpoint if it doesn't exist */
+        if (!qh) {
+                qh = dwc2_hcd_qh_create(hsotg, dwc2_urb, mem_flags);
+                if (!qh) {
+                        retval = -ENOMEM;
+                        goto fail0;
+                }
+                ep->hcpriv = qh;
+                qh_allocated = true;
+        }
+        qtd = kzalloc(sizeof(*qtd), mem_flags);
+        if (!qtd) {
+                retval = -ENOMEM;
+                goto fail1;
+        }
        spin_lock_irqsave(&hsotg->lock, flags);
        retval = usb_hcd_link_urb_to_ep(hcd, urb);
        if (retval)
-                goto fail1;
+                goto fail2;
-        retval = dwc2_hcd_urb_enqueue(hsotg, dwc2_urb, &ep->hcpriv, mem_flags);
+        retval = dwc2_hcd_urb_enqueue(hsotg, dwc2_urb, qh, qtd);
        if (retval)
-                goto fail2;
+                goto fail3;
        if (alloc_bandwidth) {
                dwc2_allocate_bus_bandwidth(hcd,
@@ -2543,12 +2559,25 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
        return 0;
-fail2:
+fail3:
        dwc2_urb->priv = NULL;
        usb_hcd_unlink_urb_from_ep(hcd, urb);
-fail1:
+fail2:
        spin_unlock_irqrestore(&hsotg->lock, flags);
        urb->hcpriv = NULL;
+        kfree(qtd);
+fail1:
+        if (qh_allocated) {
+                struct dwc2_qtd *qtd2, *qtd2_tmp;
+                ep->hcpriv = NULL;
+                dwc2_hcd_qh_unlink(hsotg, qh);
+                /* Free each QTD in the QH's QTD list */
+                list_for_each_entry_safe(qtd2, qtd2_tmp, &qh->qtd_list,
+                                                         qtd_list_entry)
+                        dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh);
+                dwc2_hcd_qh_free(hsotg, qh);
+        }
 fail0:
        kfree(dwc2_urb);
diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
index 7b5841c40033..fc1054965552 100644
--- a/drivers/usb/dwc2/hcd.h
+++ b/drivers/usb/dwc2/hcd.h
@@ -463,6 +463,9 @@ extern void dwc2_hcd_queue_transactions(struct dwc2_hsotg *hsotg,
 /* Schedule Queue Functions */
 /* Implemented in hcd_queue.c */
 extern void dwc2_hcd_init_usecs(struct dwc2_hsotg *hsotg);
+extern struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
+                                          struct dwc2_hcd_urb *urb,
+                                          gfp_t mem_flags);
 extern void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
 extern int dwc2_hcd_qh_add(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
 extern void dwc2_hcd_qh_unlink(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
@@ -471,7 +474,7 @@ extern void dwc2_hcd_qh_deactivate(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
 extern void dwc2_hcd_qtd_init(struct dwc2_qtd *qtd, struct dwc2_hcd_urb *urb);
 extern int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
-                            struct dwc2_qh **qh, gfp_t mem_flags);
+                            struct dwc2_qh *qh);
 /* Unlinks and frees a QTD */
 static inline void dwc2_hcd_qtd_unlink_and_free(struct dwc2_hsotg *hsotg,
diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
index 9b5c36256627..3ad63d392e13 100644
--- a/drivers/usb/dwc2/hcd_queue.c
+++ b/drivers/usb/dwc2/hcd_queue.c
@@ -191,7 +191,7 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
 *
 * Return: Pointer to the newly allocated QH, or NULL on error
 */
-static struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
+struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
                                          struct dwc2_hcd_urb *urb,
                                          gfp_t mem_flags)
 {
@@ -767,57 +767,32 @@ void dwc2_hcd_qtd_init(struct dwc2_qtd *qtd, struct dwc2_hcd_urb *urb)
 *
 * @hsotg:        The DWC HCD structure
 * @qtd:          The QTD to add
- * @qh:           Out parameter to return queue head
+ * @qh:           Queue head to add qtd to
- * @atomic_alloc: Flag to do atomic alloc if needed
 *
 * Return: 0 if successful, negative error code otherwise
 *
- * Finds the correct QH to place the QTD into. If it does not find a QH, it
+ * If the QH to which the QTD is added is not currently scheduled, it is placed
- * will create a new QH. If the QH to which the QTD is added is not currently
+ * into the proper schedule based on its EP type.
- * scheduled, it is placed into the proper schedule based on its EP type.
 */
 int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
-                     struct dwc2_qh **qh, gfp_t mem_flags)
+                     struct dwc2_qh *qh)
 {
-        struct dwc2_hcd_urb *urb = qtd->urb;
-        int allocated = 0;
        int retval;
-        /*
+        if (unlikely(!qh)) {
-         * Get the QH which holds the QTD-list to insert to. Create QH if it
+                dev_err(hsotg->dev, "%s: Invalid QH\n", __func__);
-         * doesn't exist.
+                retval = -EINVAL;
-         */
+                goto fail;
-        if (*qh == NULL) {
-                *qh = dwc2_hcd_qh_create(hsotg, urb, mem_flags);
-                if (*qh == NULL)
-                        return -ENOMEM;
-                allocated = 1;
        }
-        retval = dwc2_hcd_qh_add(hsotg, *qh);
+        retval = dwc2_hcd_qh_add(hsotg, qh);
        if (retval)
                goto fail;
-        qtd->qh = *qh;
+        qtd->qh = qh;
-        list_add_tail(&qtd->qtd_list_entry, &(*qh)->qtd_list);
+        list_add_tail(&qtd->qtd_list_entry, &qh->qtd_list);
        return 0;
 fail:
-        if (allocated) {
-                struct dwc2_qtd *qtd2, *qtd2_tmp;
-                struct dwc2_qh *qh_tmp = *qh;
-                *qh = NULL;
-                dwc2_hcd_qh_unlink(hsotg, qh_tmp);
-                /* Free each QTD in the QH's QTD list */
-                list_for_each_entry_safe(qtd2, qtd2_tmp, &qh_tmp->qtd_list,
-                                         qtd_list_entry)
-                        dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh_tmp);
-                dwc2_hcd_qh_free(hsotg, qh_tmp);
-        }
        return retval;
 }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 5c110d8e293b..ff5773c66b84 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -446,10 +446,12 @@ static int dwc3_phy_setup(struct dwc3 *dwc)
        /* Select the HS PHY interface */
        switch (DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3)) {
        case DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI:
-                if (!strncmp(dwc->hsphy_interface, "utmi", 4)) {
+                if (dwc->hsphy_interface &&
+                                !strncmp(dwc->hsphy_interface, "utmi", 4)) {
                        reg &= ~DWC3_GUSB2PHYCFG_ULPI_UTMI;
                        break;
-                } else if (!strncmp(dwc->hsphy_interface, "ulpi", 4)) {
+                } else if (dwc->hsphy_interface &&
+                                !strncmp(dwc->hsphy_interface, "ulpi", 4)) {
                        reg |= DWC3_GUSB2PHYCFG_ULPI_UTMI;
                        dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
                } else {
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 2ef3c8d6a9db..69e769c35cf5 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
                dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
                ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
                break;
+        case USB_REQ_SET_INTERFACE:
+                dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
+                dwc->start_config_issued = false;
+                /* Fall through */
        default:
                dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
                ret = dwc3_ep0_delegate_req(dwc, ctrl);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 4e3447bbd097..58b4657fc721 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1758,10 +1758,13 @@ unknown:
                 * take such requests too, if that's ever needed:  to work
                 * in config 0, etc.
                 */
-                list_for_each_entry(f, &cdev->config->functions, list)
+                if (cdev->config) {
-                        if (f->req_match && f->req_match(f, ctrl))
+                        list_for_each_entry(f, &cdev->config->functions, list)
-                                goto try_fun_setup;
+                                if (f->req_match && f->req_match(f, ctrl))
-                f = NULL;
+                                        goto try_fun_setup;
+                        f = NULL;
+                }
                switch (ctrl->bRequestType & USB_RECIP_MASK) {
                case USB_RECIP_INTERFACE:
                        if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 0495c94a23d7..289e20119fea 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -571,7 +571,7 @@ static struct config_group *function_make(
        if (IS_ERR(fi))
                return ERR_CAST(fi);
-        ret = config_item_set_name(&fi->group.cg_item, name);
+        ret = config_item_set_name(&fi->group.cg_item, "%s", name);
        if (ret) {
                usb_put_function_instance(fi);
                return ERR_PTR(ret);
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 45b8c8b338df..6e7be91e6097 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
        kiocb->private = p;
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
        res = ffs_epfile_io(kiocb->ki_filp, p);
        if (res == -EIOCBQUEUED)
@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
        kiocb->private = p;
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
        res = ffs_epfile_io(kiocb->ki_filp, p);
        if (res == -EIOCBQUEUED)
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d2259c663996..f936268d26c6 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
                return -EINVAL;
        }
-        curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
+        curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
        if (unlikely(!curlun))
                return -ENOMEM;
@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
        common->luns = curlun;
        common->nluns = nluns;
-        pr_info("Number of LUNs=%d\n", common->nluns);
        return 0;
 }
 EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
        struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
        struct fsg_common *common = opts->common;
        struct fsg_dev *fsg;
+        unsigned nluns, i;
        fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
        if (unlikely(!fsg))
                return ERR_PTR(-ENOMEM);
        mutex_lock(&opts->lock);
+        if (!opts->refcnt) {
+                for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
+                        if (common->luns[i])
+                                nluns = i + 1;
+                if (!nluns)
+                        pr_warn("No LUNS defined, continuing anyway\n");
+                else
+                        common->nluns = nluns;
+                pr_info("Number of LUNs=%u\n", common->nluns);
+        }
        opts->refcnt++;
        mutex_unlock(&opts->lock);
        fsg->function.name      = FSG_DRIVER_DESC;
        fsg->function.bind      = fsg_bind;
        fsg->function.unbind    = fsg_unbind;
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 6316aa5b1c49..ad50a67c1465 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1145,7 +1145,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
        if (opts->id && !midi->id) {
                status = -ENOMEM;
                mutex_unlock(&opts->lock);
-                goto kstrdup_fail;
+                goto setup_fail;
        }
        midi->in_ports = opts->in_ports;
        midi->out_ports = opts->out_ports;
@@ -1164,8 +1164,6 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
        return &midi->func;
-kstrdup_fail:
-        f_midi_unregister_card(midi);
 setup_fail:
        for (--i; i >= 0; i--)
                kfree(midi->in_port[i]);
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index e547ea7f56b1..1137e3384218 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1171,7 +1171,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
                          udc_name, fotg210);
        if (ret < 0) {
                pr_err("request_irq error (%d)\n", ret);
-                goto err_irq;
+                goto err_req;
        }
        ret = usb_add_gadget_udc(&pdev->dev, &fotg210->gadget);
@@ -1183,7 +1183,6 @@ static int fotg210_udc_probe(struct platform_device *pdev)
        return 0;
 err_add_udc:
-err_irq:
        free_irq(ires->start, fotg210);
 err_req:
diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
index d32160d6463f..5da37c957b53 100644
--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        udc->phy_regs = ioremap(r->start, resource_size(r));
+        udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
        if (udc->phy_regs == NULL) {
                dev_err(&pdev->dev, "failed to map phy I/O memory\n");
                return -EBUSY;
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index d69c35558f68..362ee8af5fce 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -60,13 +60,15 @@ static DEFINE_MUTEX(udc_lock);
 int usb_gadget_map_request(struct usb_gadget *gadget,
                struct usb_request *req, int is_in)
 {
+        struct device *dev = gadget->dev.parent;
        if (req->length == 0)
                return 0;
        if (req->num_sgs) {
                int     mapped;
-                mapped = dma_map_sg(&gadget->dev, req->sg, req->num_sgs,
+                mapped = dma_map_sg(dev, req->sg, req->num_sgs,
                                is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                if (mapped == 0) {
                        dev_err(&gadget->dev, "failed to map SGs\n");
@@ -75,11 +77,11 @@ int usb_gadget_map_request(struct usb_gadget *gadget,
                req->num_mapped_sgs = mapped;
        } else {
-                req->dma = dma_map_single(&gadget->dev, req->buf, req->length,
+                req->dma = dma_map_single(dev, req->buf, req->length,
                                is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-                if (dma_mapping_error(&gadget->dev, req->dma)) {
+                if (dma_mapping_error(dev, req->dma)) {
-                        dev_err(&gadget->dev, "failed to map buffer\n");
+                        dev_err(dev, "failed to map buffer\n");
                        return -EFAULT;
                }
        }
@@ -95,12 +97,12 @@ void usb_gadget_unmap_request(struct usb_gadget *gadget,
                return;
        if (req->num_mapped_sgs) {
-                dma_unmap_sg(&gadget->dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(gadget->dev.parent, req->sg, req->num_mapped_sgs,
                                is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                req->num_mapped_sgs = 0;
        } else {
-                dma_unmap_single(&gadget->dev, req->dma, req->length,
+                dma_unmap_single(gadget->dev.parent, req->dma, req->length,
                                is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
        }
 }
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index f7d561ed3c23..d029bbe9eb36 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -981,10 +981,6 @@ rescan_all:
                int                     completed, modified;
                __hc32                  *prev;
-                /* Is this ED already invisible to the hardware? */
-                if (ed->state == ED_IDLE)
-                        goto ed_idle;
                /* only take off EDs that the HC isn't using, accounting for
                 * frame counter wraps and EDs with partially retired TDs
                 */
@@ -1012,12 +1008,10 @@ skip_ed:
                }
                /* ED's now officially unlinked, hc doesn't see */
-                ed->state = ED_IDLE;
                ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
                ed->hwNextED = 0;
                wmb();
                ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
-ed_idle:
                /* reentrancy:  if we drop the schedule lock, someone might
                 * have modified this list.  normally it's just prepending
@@ -1088,6 +1082,7 @@ rescan_this:
                if (list_empty(&ed->td_list)) {
                        *last = ed->ed_next;
                        ed->ed_next = NULL;
+                        ed->state = ED_IDLE;
                        list_del(&ed->in_use_list);
                } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                        *last = ed->ed_next;
diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index e9a6eec39142..cfcfadfc94fc 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -58,7 +58,7 @@
 #define CCR_PM_CKRNEN    0x0002
 #define CCR_PM_USBPW1    0x0004
 #define CCR_PM_USBPW2    0x0008
-#define CCR_PM_USBPW3    0x0008
+#define CCR_PM_USBPW3    0x0010
 #define CCR_PM_PMEE      0x0100
 #define CCR_PM_PMES      0x8000
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index e75c565feb53..78241b5550df 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
        u32 pls = status_reg & PORT_PLS_MASK;
        /* resume state is a xHCI internal state.
-         * Do not report it to usb core.
+         * Do not report it to usb core, instead, pretend to be U3,
+         * thus usb core knows it's not ready for transfer
         */
-        if (pls == XDEV_RESUME)
+        if (pls == XDEV_RESUME) {
+                *status |= USB_SS_PORT_LS_U3;
                return;
+        }
        /* When the CAS bit is set then warm reset
         * should be performed on port
@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                status |= USB_PORT_STAT_C_RESET << 16;
        /* USB3.0 only */
        if (hcd->speed == HCD_USB3) {
-                if ((raw_port_status & PORT_PLC))
+                /* Port link change with port in resume state should not be
+                 * reported to usbcore, as this is an internal state to be
+                 * handled by xhci driver. Reporting PLC to usbcore may
+                 * cause usbcore clearing PLC first and port change event
+                 * irq won't be generated.
+                 */
+                if ((raw_port_status & PORT_PLC) &&
+                        (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
                        status |= USB_PORT_STAT_C_LINK_STATE << 16;
                if ((raw_port_status & PORT_WRC))
                        status |= USB_PORT_STAT_C_BH_RESET << 16;
@@ -1120,10 +1130,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
        spin_lock_irqsave(&xhci->lock, flags);
        if (hcd->self.root_hub->do_remote_wakeup) {
-                if (bus_state->resuming_ports) {
+                if (bus_state->resuming_ports ||        /* USB2 */
+                    bus_state->port_remote_wakeup) {    /* USB3 */
                        spin_unlock_irqrestore(&xhci->lock, flags);
-                        xhci_dbg(xhci, "suspend failed because "
+                        xhci_dbg(xhci, "suspend failed because a port is resuming\n");
-                                                "a port is resuming\n");
                        return -EBUSY;
                }
        }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index f8336408ef07..3e442f77a2b9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                /* Attempt to use the ring cache */
                if (virt_dev->num_rings_cached == 0)
                        return -ENOMEM;
+                virt_dev->num_rings_cached--;
                virt_dev->eps[ep_index].new_ring =
                        virt_dev->ring_cache[virt_dev->num_rings_cached];
                virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-                virt_dev->num_rings_cached--;
                xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
                                        1, type);
        }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4a4cb1d91ac8..5590eac2b22d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -23,10 +23,15 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/acpi.h>
 #include "xhci.h"
 #include "xhci-trace.h"
+#define PORT2_SSIC_CONFIG_REG2  0x883c
+#define PROG_DONE               (1 << 30)
+#define SSIC_PORT_UNUSED        (1 << 31)
 /* Device for a quirk */
 #define PCI_VENDOR_ID_FRESCO_LOGIC      0x1b73
 #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK  0x1000
@@ -176,20 +181,63 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 }
 /*
+ * In some Intel xHCI controllers, in order to get D3 working,
+ * through a vendor specific SSIC CONFIG register at offset 0x883c,
+ * SSIC PORT need to be marked as "unused" before putting xHCI
+ * into D3. After D3 exit, the SSIC port need to be marked as "used".
+ * Without this change, xHCI might not enter D3 state.
 * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
 * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
 */
-static void xhci_pme_quirk(struct xhci_hcd *xhci)
+static void xhci_pme_quirk(struct usb_hcd *hcd, bool suspend)
 {
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
        u32 val;
        void __iomem *reg;
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
+                reg = (void __iomem *) xhci->cap_regs + PORT2_SSIC_CONFIG_REG2;
+                /* Notify SSIC that SSIC profile programming is not done */
+                val = readl(reg) & ~PROG_DONE;
+                writel(val, reg);
+                /* Mark SSIC port as unused(suspend) or used(resume) */
+                val = readl(reg);
+                if (suspend)
+                        val |= SSIC_PORT_UNUSED;
+                else
+                        val &= ~SSIC_PORT_UNUSED;
+                writel(val, reg);
+                /* Notify SSIC that SSIC profile programming is done */
+                val = readl(reg) | PROG_DONE;
+                writel(val, reg);
+                readl(reg);
+        }
        reg = (void __iomem *) xhci->cap_regs + 0x80a4;
        val = readl(reg);
        writel(val | BIT(28), reg);
        readl(reg);
 }
+#ifdef CONFIG_ACPI
+static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
+{
+        static const u8 intel_dsm_uuid[] = {
+                0xb7, 0x0c, 0x34, 0xac, 0x01, 0xe9, 0xbf, 0x45,
+                0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
+        };
+        acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+}
+#else
+        static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
+#endif /* CONFIG_ACPI */
 /* called during probe() after chip reset completes */
 static int xhci_pci_setup(struct usb_hcd *hcd)
 {
@@ -263,6 +311,9 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                        HCC_MAX_PSA(xhci->hcc_params) >= 4)
                xhci->shared_hcd->can_do_streams = 1;
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_acpi_rtd3_enable(dev);
        /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
        pm_runtime_put_noidle(&dev->dev);
@@ -307,7 +358,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
                pdev->no_d3cold = true;
        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
-                xhci_pme_quirk(xhci);
+                xhci_pme_quirk(hcd, true);
        return xhci_suspend(xhci, do_wakeup);
 }
@@ -340,7 +391,7 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
                usb_enable_intel_xhci_ports(pdev);
        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
-                xhci_pme_quirk(xhci);
+                xhci_pme_quirk(hcd, false);
        retval = xhci_resume(xhci, hibernated);
        return retval;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 94416ff70810..6a8fc52aed58 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
                usb_hcd_resume_root_hub(hcd);
        }
+        if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
+                bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
        if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
                xhci_dbg(xhci, "port resume event for port %d\n", port_id);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7da0d6043d33..526ebc0c7e72 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
                        return -EINVAL;
        }
+        if (virt_dev->tt_info)
+                old_active_eps = virt_dev->tt_info->active_eps;
        if (virt_dev->udev != udev) {
                /* If the virt_dev and the udev does not match, this virt_dev
                 * may belong to another udev.
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 31e46cc55807..ed2ebf647c38 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -285,6 +285,7 @@ struct xhci_op_regs {
 #define XDEV_U0         (0x0 << 5)
 #define XDEV_U2         (0x2 << 5)
 #define XDEV_U3         (0x3 << 5)
+#define XDEV_INACTIVE   (0x6 << 5)
 #define XDEV_RESUME     (0xf << 5)
 /* true: port has power (see HCC_PPC) */
 #define PORT_POWER      (1 << 9)
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 30842bc195f5..92d5f718659b 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -275,9 +275,7 @@ static int musb_has_gadget(struct musb *musb)
 #ifdef CONFIG_USB_MUSB_HOST
        return 1;
 #else
-        if (musb->port_mode == MUSB_PORT_MODE_HOST)
+        return musb->port_mode == MUSB_PORT_MODE_HOST;
-                return 1;
-        return musb->g.dev.driver != NULL;
 #endif
 }
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 8f7cb068d29b..3fcc0483a081 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(struct mxs_phy *mxs_phy)
 {
        unsigned int vbus_value;
+        if (!mxs_phy->regmap_anatop)
+                return false;
        if (mxs_phy->port_id == 0)
                regmap_read(mxs_phy->regmap_anatop,
                        ANADIG_USB1_VBUS_DET_STAT,
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index ffd739e31bfc..eac7ccaa3c85 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
        { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
        { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
+        { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
        { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
        { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
        { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 4f70df33975a..78b4f64c6b00 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -121,26 +121,26 @@ static DEFINE_SPINLOCK(release_lock);
 static const unsigned int dummy; /* for clarity in register access fns */
 enum mos_regs {
-        THR,              /* serial port regs */
+        MOS7720_THR,              /* serial port regs */
-        RHR,
+        MOS7720_RHR,
-        IER,
+        MOS7720_IER,
-        FCR,
+        MOS7720_FCR,
-        ISR,
+        MOS7720_ISR,
-        LCR,
+        MOS7720_LCR,
-        MCR,
+        MOS7720_MCR,
-        LSR,
+        MOS7720_LSR,
-        MSR,
+        MOS7720_MSR,
-        SPR,
+        MOS7720_SPR,
-        DLL,
+        MOS7720_DLL,
-        DLM,
+        MOS7720_DLM,
-        DPR,              /* parallel port regs */
+        MOS7720_DPR,              /* parallel port regs */
-        DSR,
+        MOS7720_DSR,
-        DCR,
+        MOS7720_DCR,
-        ECR,
+        MOS7720_ECR,
-        SP1_REG,          /* device control regs */
+        MOS7720_SP1_REG,          /* device control regs */
-        SP2_REG,          /* serial port 2 (7720 only) */
+        MOS7720_SP2_REG,          /* serial port 2 (7720 only) */
-        PP_REG,
+        MOS7720_PP_REG,
-        SP_CONTROL_REG,
+        MOS7720_SP_CONTROL_REG,
 };
 /*
@@ -150,26 +150,26 @@ enum mos_regs {
 static inline __u16 get_reg_index(enum mos_regs reg)
 {
        static const __u16 mos7715_index_lookup_table[] = {
-                0x00,           /* THR */
+                0x00,           /* MOS7720_THR */
-                0x00,           /* RHR */
+                0x00,           /* MOS7720_RHR */
-                0x01,           /* IER */
+                0x01,           /* MOS7720_IER */
-                0x02,           /* FCR */
+                0x02,           /* MOS7720_FCR */
-                0x02,           /* ISR */
+                0x02,           /* MOS7720_ISR */
-                0x03,           /* LCR */
+                0x03,           /* MOS7720_LCR */
-                0x04,           /* MCR */
+                0x04,           /* MOS7720_MCR */
-                0x05,           /* LSR */
+                0x05,           /* MOS7720_LSR */
-                0x06,           /* MSR */
+                0x06,           /* MOS7720_MSR */
-                0x07,           /* SPR */
+                0x07,           /* MOS7720_SPR */
-                0x00,           /* DLL */
+                0x00,           /* MOS7720_DLL */
-                0x01,           /* DLM */
+                0x01,           /* MOS7720_DLM */
-                0x00,           /* DPR */
+                0x00,           /* MOS7720_DPR */
-                0x01,           /* DSR */
+                0x01,           /* MOS7720_DSR */
-                0x02,           /* DCR */
+                0x02,           /* MOS7720_DCR */
-                0x0a,           /* ECR */
+                0x0a,           /* MOS7720_ECR */
-                0x01,           /* SP1_REG */
+                0x01,           /* MOS7720_SP1_REG */
-                0x02,           /* SP2_REG (7720 only) */
+                0x02,           /* MOS7720_SP2_REG (7720 only) */
-                0x04,           /* PP_REG (7715 only) */
+                0x04,           /* MOS7720_PP_REG (7715 only) */
-                0x08,           /* SP_CONTROL_REG */
+                0x08,           /* MOS7720_SP_CONTROL_REG */
        };
        return mos7715_index_lookup_table[reg];
 }
@@ -181,10 +181,10 @@ static inline __u16 get_reg_index(enum mos_regs reg)
 static inline __u16 get_reg_value(enum mos_regs reg,
                                  unsigned int serial_portnum)
 {
-        if (reg >= SP1_REG)           /* control reg */
+        if (reg >= MOS7720_SP1_REG)     /* control reg */
                return 0x0000;
-        else if (reg >= DPR)          /* parallel port reg (7715 only) */
+        else if (reg >= MOS7720_DPR)    /* parallel port reg (7715 only) */
                return 0x0100;
        else                          /* serial port reg */
@@ -252,7 +252,8 @@ static inline int mos7715_change_mode(struct mos7715_parport *mos_parport,
                                      enum mos7715_pp_modes mode)
 {
        mos_parport->shadowECR = mode;
-        write_mos_reg(mos_parport->serial, dummy, ECR, mos_parport->shadowECR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_ECR,
+                      mos_parport->shadowECR);
        return 0;
 }
@@ -486,7 +487,7 @@ static void parport_mos7715_write_data(struct parport *pp, unsigned char d)
        if (parport_prologue(pp) < 0)
                return;
        mos7715_change_mode(mos_parport, SPP);
-        write_mos_reg(mos_parport->serial, dummy, DPR, (__u8)d);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DPR, (__u8)d);
        parport_epilogue(pp);
 }
@@ -497,7 +498,7 @@ static unsigned char parport_mos7715_read_data(struct parport *pp)
        if (parport_prologue(pp) < 0)
                return 0;
-        read_mos_reg(mos_parport->serial, dummy, DPR, &d);
+        read_mos_reg(mos_parport->serial, dummy, MOS7720_DPR, &d);
        parport_epilogue(pp);
        return d;
 }
@@ -510,7 +511,7 @@ static void parport_mos7715_write_control(struct parport *pp, unsigned char d)
        if (parport_prologue(pp) < 0)
                return;
        data = ((__u8)d & 0x0f) | (mos_parport->shadowDCR & 0xf0);
-        write_mos_reg(mos_parport->serial, dummy, DCR, data);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR, data);
        mos_parport->shadowDCR = data;
        parport_epilogue(pp);
 }
@@ -543,7 +544,8 @@ static unsigned char parport_mos7715_frob_control(struct parport *pp,
        if (parport_prologue(pp) < 0)
                return 0;
        mos_parport->shadowDCR = (mos_parport->shadowDCR & (~mask)) ^ val;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
        dcr = mos_parport->shadowDCR & 0x0f;
        parport_epilogue(pp);
        return dcr;
@@ -581,7 +583,8 @@ static void parport_mos7715_data_forward(struct parport *pp)
                return;
        mos7715_change_mode(mos_parport, PS2);
        mos_parport->shadowDCR &=  ~0x20;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
        parport_epilogue(pp);
 }
@@ -593,7 +596,8 @@ static void parport_mos7715_data_reverse(struct parport *pp)
                return;
        mos7715_change_mode(mos_parport, PS2);
        mos_parport->shadowDCR |= 0x20;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
        parport_epilogue(pp);
 }
@@ -633,8 +637,10 @@ static void parport_mos7715_restore_state(struct parport *pp,
                spin_unlock(&release_lock);
                return;
        }
-        write_parport_reg_nonblock(mos_parport, DCR, mos_parport->shadowDCR);
+        write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
-        write_parport_reg_nonblock(mos_parport, ECR, mos_parport->shadowECR);
+                                   mos_parport->shadowDCR);
+        write_parport_reg_nonblock(mos_parport, MOS7720_ECR,
+                                   mos_parport->shadowECR);
        spin_unlock(&release_lock);
 }
@@ -714,14 +720,16 @@ static int mos7715_parport_init(struct usb_serial *serial)
        init_completion(&mos_parport->syncmsg_compl);
        /* cycle parallel port reset bit */
-        write_mos_reg(mos_parport->serial, dummy, PP_REG, (__u8)0x80);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_PP_REG, (__u8)0x80);
-        write_mos_reg(mos_parport->serial, dummy, PP_REG, (__u8)0x00);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_PP_REG, (__u8)0x00);
        /* initialize device registers */
        mos_parport->shadowDCR = DCR_INIT_VAL;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
        mos_parport->shadowECR = ECR_INIT_VAL;
-        write_mos_reg(mos_parport->serial, dummy, ECR, mos_parport->shadowECR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_ECR,
+                      mos_parport->shadowECR);
        /* register with parport core */
        mos_parport->pp = parport_register_port(0, PARPORT_IRQ_NONE,
@@ -1033,45 +1041,49 @@ static int mos7720_open(struct tty_struct *tty, struct usb_serial_port *port)
         /* Initialize MCS7720 -- Write Init values to corresponding Registers
          *
          * Register Index
-          * 0 : THR/RHR
+          * 0 : MOS7720_THR/MOS7720_RHR
-          * 1 : IER
+          * 1 : MOS7720_IER
-          * 2 : FCR
+          * 2 : MOS7720_FCR
-          * 3 : LCR
+          * 3 : MOS7720_LCR
-          * 4 : MCR
+          * 4 : MOS7720_MCR
-          * 5 : LSR
+          * 5 : MOS7720_LSR
-          * 6 : MSR
+          * 6 : MOS7720_MSR
-          * 7 : SPR
+          * 7 : MOS7720_SPR
          *
          * 0x08 : SP1/2 Control Reg
          */
        port_number = port->port_number;
-        read_mos_reg(serial, port_number, LSR, &data);
+        read_mos_reg(serial, port_number, MOS7720_LSR, &data);
        dev_dbg(&port->dev, "SS::%p LSR:%x\n", mos7720_port, data);
-        write_mos_reg(serial, dummy, SP1_REG, 0x02);
+        write_mos_reg(serial, dummy, MOS7720_SP1_REG, 0x02);
-        write_mos_reg(serial, dummy, SP2_REG, 0x02);
+        write_mos_reg(serial, dummy, MOS7720_SP2_REG, 0x02);
-        write_mos_reg(serial, port_number, IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
        mos7720_port->shadowLCR = 0x03;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
        mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
-        write_mos_reg(serial, port_number, SP_CONTROL_REG, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_SP_CONTROL_REG, 0x00);
-        read_mos_reg(serial, dummy, SP_CONTROL_REG, &data);
+        read_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, &data);
        data = data | (port->port_number + 1);
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, data);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, data);
        mos7720_port->shadowLCR = 0x83;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
-        write_mos_reg(serial, port_number, THR, 0x0c);
+                      mos7720_port->shadowLCR);
-        write_mos_reg(serial, port_number, IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_THR, 0x0c);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
        mos7720_port->shadowLCR = 0x03;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
-        write_mos_reg(serial, port_number, IER, 0x0c);
+                      mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
        response = usb_submit_urb(port->read_urb, GFP_KERNEL);
        if (response)
@@ -1144,8 +1156,8 @@ static void mos7720_close(struct usb_serial_port *port)
        usb_kill_urb(port->write_urb);
        usb_kill_urb(port->read_urb);
-        write_mos_reg(serial, port->port_number, MCR, 0x00);
+        write_mos_reg(serial, port->port_number, MOS7720_MCR, 0x00);
-        write_mos_reg(serial, port->port_number, IER, 0x00);
+        write_mos_reg(serial, port->port_number, MOS7720_IER, 0x00);
        mos7720_port->open = 0;
 }
@@ -1169,7 +1181,8 @@ static void mos7720_break(struct tty_struct *tty, int break_state)
                data = mos7720_port->shadowLCR & ~UART_LCR_SBC;
        mos7720_port->shadowLCR  = data;
-        write_mos_reg(serial, port->port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port->port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
 }
 /*
@@ -1297,7 +1310,7 @@ static void mos7720_throttle(struct tty_struct *tty)
        /* if we are implementing RTS/CTS, toggle that line */
        if (tty->termios.c_cflag & CRTSCTS) {
                mos7720_port->shadowMCR &= ~UART_MCR_RTS;
-                write_mos_reg(port->serial, port->port_number, MCR,
+                write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                              mos7720_port->shadowMCR);
        }
 }
@@ -1327,7 +1340,7 @@ static void mos7720_unthrottle(struct tty_struct *tty)
        /* if we are implementing RTS/CTS, toggle that line */
        if (tty->termios.c_cflag & CRTSCTS) {
                mos7720_port->shadowMCR |= UART_MCR_RTS;
-                write_mos_reg(port->serial, port->port_number, MCR,
+                write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                              mos7720_port->shadowMCR);
        }
 }
@@ -1352,35 +1365,39 @@ static int set_higher_rates(struct moschip_port *mos7720_port,
        dev_dbg(&port->dev, "Sending Setting Commands ..........\n");
        port_number = port->port_number;
-        write_mos_reg(serial, port_number, IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
        mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x00);
+                      mos7720_port->shadowMCR);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, 0x00);
        /***********************************************
         *              Set for higher rates           *
         ***********************************************/
        /* writing baud rate verbatum into uart clock field clearly not right */
        if (port_number == 0)
-                sp_reg = SP1_REG;
+                sp_reg = MOS7720_SP1_REG;
        else
-                sp_reg = SP2_REG;
+                sp_reg = MOS7720_SP2_REG;
        write_mos_reg(serial, dummy, sp_reg, baud * 0x10);
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x03);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, 0x03);
        mos7720_port->shadowMCR = 0x2b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
        /***********************************************
         *              Set DLL/DLM
         ***********************************************/
        mos7720_port->shadowLCR = mos7720_port->shadowLCR | UART_LCR_DLAB;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
-        write_mos_reg(serial, port_number, DLL, 0x01);
+                      mos7720_port->shadowLCR);
-        write_mos_reg(serial, port_number, DLM, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_DLL, 0x01);
+        write_mos_reg(serial, port_number, MOS7720_DLM, 0x00);
        mos7720_port->shadowLCR = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
        return 0;
 }
@@ -1488,15 +1505,16 @@ static int send_cmd_write_baud_rate(struct moschip_port *mos7720_port,
        /* Enable access to divisor latch */
        mos7720_port->shadowLCR = mos7720_port->shadowLCR | UART_LCR_DLAB;
-        write_mos_reg(serial, number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, number, MOS7720_LCR, mos7720_port->shadowLCR);
        /* Write the divisor */
-        write_mos_reg(serial, number, DLL, (__u8)(divisor & 0xff));
+        write_mos_reg(serial, number, MOS7720_DLL, (__u8)(divisor & 0xff));
-        write_mos_reg(serial, number, DLM, (__u8)((divisor & 0xff00) >> 8));
+        write_mos_reg(serial, number, MOS7720_DLM,
+                      (__u8)((divisor & 0xff00) >> 8));
        /* Disable access to divisor latch */
        mos7720_port->shadowLCR = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
-        write_mos_reg(serial, number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, number, MOS7720_LCR, mos7720_port->shadowLCR);
        return status;
 }
@@ -1600,14 +1618,16 @@ static void change_port_settings(struct tty_struct *tty,
        /* Disable Interrupts */
-        write_mos_reg(serial, port_number, IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
        /* Send the updated LCR value to the mos7720 */
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
        mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
        /* set up the MCR register and send it to the mos7720 */
        mos7720_port->shadowMCR = UART_MCR_OUT2;
@@ -1619,14 +1639,17 @@ static void change_port_settings(struct tty_struct *tty,
                /* To set hardware flow control to the specified *
                 * serial port, in SP1/2_CONTROL_REG             */
                if (port_number)
-                        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x01);
+                        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG,
+                                      0x01);
                else
-                        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x02);
+                        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG,
+                                      0x02);
        } else
                mos7720_port->shadowMCR &= ~(UART_MCR_XONANY);
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
        /* Determine divisor based on baud rate */
        baud = tty_get_baud_rate(tty);
@@ -1639,7 +1662,7 @@ static void change_port_settings(struct tty_struct *tty,
        if (baud >= 230400) {
                set_higher_rates(mos7720_port, baud);
                /* Enable Interrupts */
-                write_mos_reg(serial, port_number, IER, 0x0c);
+                write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
                return;
        }
@@ -1650,7 +1673,7 @@ static void change_port_settings(struct tty_struct *tty,
        if (cflag & CBAUD)
                tty_encode_baud_rate(tty, baud, baud);
        /* Enable Interrupts */
-        write_mos_reg(serial, port_number, IER, 0x0c);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
        if (port->read_urb->status != -EINPROGRESS) {
                status = usb_submit_urb(port->read_urb, GFP_KERNEL);
@@ -1725,7 +1748,7 @@ static int get_lsr_info(struct tty_struct *tty,
        count = mos7720_chars_in_buffer(tty);
        if (count == 0) {
-                read_mos_reg(port->serial, port_number, LSR, &data);
+                read_mos_reg(port->serial, port_number, MOS7720_LSR, &data);
                if ((data & (UART_LSR_TEMT | UART_LSR_THRE))
                                        == (UART_LSR_TEMT | UART_LSR_THRE)) {
                        dev_dbg(&port->dev, "%s -- Empty\n", __func__);
@@ -1782,7 +1805,7 @@ static int mos7720_tiocmset(struct tty_struct *tty,
                mcr &= ~UART_MCR_LOOP;
        mos7720_port->shadowMCR = mcr;
-        write_mos_reg(port->serial, port->port_number, MCR,
+        write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                      mos7720_port->shadowMCR);
        return 0;
@@ -1827,7 +1850,7 @@ static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
        }
        mos7720_port->shadowMCR = mcr;
-        write_mos_reg(port->serial, port->port_number, MCR,
+        write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                      mos7720_port->shadowMCR);
        return 0;
@@ -1942,7 +1965,7 @@ static int mos7720_startup(struct usb_serial *serial)
        }
 #endif
        /* LSR For Port 1 */
-        read_mos_reg(serial, 0, LSR, &data);
+        read_mos_reg(serial, 0, MOS7720_LSR, &data);
        dev_dbg(&dev->dev, "LSR:%x\n", data);
        return 0;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f0c0c53359ad..19b85ee98a72 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1765,6 +1765,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
        { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
        { } /* Terminating entry */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 529066bbc7e8..46f1f13b41f1 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
        tty_unregister_driver(usb_serial_tty_driver);
        put_tty_driver(usb_serial_tty_driver);
        bus_unregister(&usb_serial_bus_type);
+        idr_destroy(&serial_minors);
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index caf188800c67..6b2479123de7 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_READ_DISC_INFO ),
+/* Reported by Oliver Neukum <oneukum@suse.com>
+ * This device morphes spontaneously into another device if the access
+ * pattern of Windows isn't followed. Thus writable media would be dirty
+ * if the initial instance is used. So the device is limited to its
+ * virtual CD.
+ * And yes, the concept that BCD goes up to 9 is not heeded */
+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
+                "ZTE,Incorporated",
+                "ZTE WCDMA Technologies MSM",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_SINGLE_LUN ),
 /* Reported by Sven Geggus <sven-usbst@geggus.net>
 * This encrypted pen drive returns bogus data for the initial READ(10).
 */
@@ -2074,6 +2086,17 @@ UNUSUAL_DEV(  0x1b1c, 0x1ab5, 0x0200, 0x0200,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_INITIAL_READ10 ),
+/* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These are mini projectors using USB for both power and video data transport
+ * The usb-storage interface is a virtual windows driver CD, which the gm12u320
+ * driver automatically converts into framebuffer & kms dri device nodes.
+ */
+UNUSUAL_DEV( 0x1de1, 0xc102, 0x0000, 0xffff,
+                "Grain-media Technology Corp.",
+                "USB3.0 Device GM12U320",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_DEVICE ),
 /* Patch by Richard Schütz <r.schtz@t-online.de>
 * This external hard drive enclosure uses a JMicron chip which
 * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 2fb29dfeffbd..563c510f285c 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -689,6 +689,23 @@ struct vfio_device *vfio_device_get_from_dev(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(vfio_device_get_from_dev);
+static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group,
+                                                     char *buf)
+{
+        struct vfio_device *device;
+        mutex_lock(&group->device_lock);
+        list_for_each_entry(device, &group->device_list, group_next) {
+                if (!strcmp(dev_name(device->dev), buf)) {
+                        vfio_device_get(device);
+                        break;
+                }
+        }
+        mutex_unlock(&group->device_lock);
+        return device;
+}
 /*
 * Caller must hold a reference to the vfio_device
 */
@@ -1198,53 +1215,53 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
 {
        struct vfio_device *device;
        struct file *filep;
-        int ret = -ENODEV;
+        int ret;
        if (0 == atomic_read(&group->container_users) ||
            !group->container->iommu_driver || !vfio_group_viable(group))
                return -EINVAL;
-        mutex_lock(&group->device_lock);
+        device = vfio_device_get_from_name(group, buf);
-        list_for_each_entry(device, &group->device_list, group_next) {
+        if (!device)
-                if (strcmp(dev_name(device->dev), buf))
+                return -ENODEV;
-                        continue;
-                ret = device->ops->open(device->device_data);
+        ret = device->ops->open(device->device_data);
-                if (ret)
+        if (ret) {
-                        break;
+                vfio_device_put(device);
-                /*
+                return ret;
-                 * We can't use anon_inode_getfd() because we need to modify
+        }
-                 * the f_mode flags directly to allow more than just ioctls
-                 */
-                ret = get_unused_fd_flags(O_CLOEXEC);
-                if (ret < 0) {
-                        device->ops->release(device->device_data);
-                        break;
-                }
-                filep = anon_inode_getfile("[vfio-device]", &vfio_device_fops,
+        /*
-                                           device, O_RDWR);
+         * We can't use anon_inode_getfd() because we need to modify
-                if (IS_ERR(filep)) {
+         * the f_mode flags directly to allow more than just ioctls
-                        put_unused_fd(ret);
+         */
-                        ret = PTR_ERR(filep);
+        ret = get_unused_fd_flags(O_CLOEXEC);
-                        device->ops->release(device->device_data);
+        if (ret < 0) {
-                        break;
+                device->ops->release(device->device_data);
-                }
+                vfio_device_put(device);
+                return ret;
+        }
-                /*
+        filep = anon_inode_getfile("[vfio-device]", &vfio_device_fops,
-                 * TODO: add an anon_inode interface to do this.
+                                   device, O_RDWR);
-                 * Appears to be missing by lack of need rather than
+        if (IS_ERR(filep)) {
-                 * explicitly prevented.  Now there's need.
+                put_unused_fd(ret);
-                 */
+                ret = PTR_ERR(filep);
-                filep->f_mode |= (FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
+                device->ops->release(device->device_data);
+                vfio_device_put(device);
+                return ret;
+        }
+        /*
+         * TODO: add an anon_inode interface to do this.
+         * Appears to be missing by lack of need rather than
+         * explicitly prevented.  Now there's need.
+         */
+        filep->f_mode |= (FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
-                vfio_device_get(device);
+        atomic_inc(&group->container_users);
-                atomic_inc(&group->container_users);
-                fd_install(ret, filep);
+        fd_install(ret, filep);
-                break;
-        }
-        mutex_unlock(&group->device_lock);
        return ret;
 }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 9e8e004bb1c3..eec2f11809ff 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -22,14 +22,20 @@
 #include <linux/file.h>
 #include <linux/highmem.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/kthread.h>
 #include <linux/cgroup.h>
 #include <linux/module.h>
+#include <linux/sort.h>
 #include "vhost.h"
+static ushort max_mem_regions = 64;
+module_param(max_mem_regions, ushort, 0444);
+MODULE_PARM_DESC(max_mem_regions,
+        "Maximum number of memory regions in memory map. (default: 64)");
 enum {
-        VHOST_MEMORY_MAX_NREGIONS = 64,
        VHOST_MEMORY_F_LOG = 0x1,
 };
@@ -543,7 +549,7 @@ void vhost_dev_cleanup(struct vhost_dev *dev, bool locked)
                fput(dev->log_file);
        dev->log_file = NULL;
        /* No one will access memory at this point */
-        kfree(dev->memory);
+        kvfree(dev->memory);
        dev->memory = NULL;
        WARN_ON(!list_empty(&dev->work_list));
        if (dev->worker) {
@@ -663,6 +669,25 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq)
 }
 EXPORT_SYMBOL_GPL(vhost_vq_access_ok);
+static int vhost_memory_reg_sort_cmp(const void *p1, const void *p2)
+{
+        const struct vhost_memory_region *r1 = p1, *r2 = p2;
+        if (r1->guest_phys_addr < r2->guest_phys_addr)
+                return 1;
+        if (r1->guest_phys_addr > r2->guest_phys_addr)
+                return -1;
+        return 0;
+}
+static void *vhost_kvzalloc(unsigned long size)
+{
+        void *n = kzalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+        if (!n)
+                n = vzalloc(size);
+        return n;
+}
 static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
 {
        struct vhost_memory mem, *newmem, *oldmem;
@@ -673,21 +698,23 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                return -EFAULT;
        if (mem.padding)
                return -EOPNOTSUPP;
-        if (mem.nregions > VHOST_MEMORY_MAX_NREGIONS)
+        if (mem.nregions > max_mem_regions)
                return -E2BIG;
-        newmem = kmalloc(size + mem.nregions * sizeof *m->regions, GFP_KERNEL);
+        newmem = vhost_kvzalloc(size + mem.nregions * sizeof(*m->regions));
        if (!newmem)
                return -ENOMEM;
        memcpy(newmem, &mem, size);
        if (copy_from_user(newmem->regions, m->regions,
                           mem.nregions * sizeof *m->regions)) {
-                kfree(newmem);
+                kvfree(newmem);
                return -EFAULT;
        }
+        sort(newmem->regions, newmem->nregions, sizeof(*newmem->regions),
+                vhost_memory_reg_sort_cmp, NULL);
        if (!memory_access_ok(d, newmem, 0)) {
-                kfree(newmem);
+                kvfree(newmem);
                return -EFAULT;
        }
        oldmem = d->memory;
@@ -699,7 +726,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                d->vqs[i]->memory = newmem;
                mutex_unlock(&d->vqs[i]->mutex);
        }
-        kfree(oldmem);
+        kvfree(oldmem);
        return 0;
 }
@@ -965,6 +992,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
                }
                if (eventfp != d->log_file) {
                        filep = d->log_file;
+                        d->log_file = eventfp;
                        ctx = d->log_ctx;
                        d->log_ctx = eventfp ?
                                eventfd_ctx_fileget(eventfp) : NULL;
@@ -992,17 +1020,22 @@ EXPORT_SYMBOL_GPL(vhost_dev_ioctl);
 static const struct vhost_memory_region *find_region(struct vhost_memory *mem,
                                                     __u64 addr, __u32 len)
 {
-        struct vhost_memory_region *reg;
+        const struct vhost_memory_region *reg;
-        int i;
+        int start = 0, end = mem->nregions;
-        /* linear search is not brilliant, but we really have on the order of 6
+        while (start < end) {
-         * regions in practice */
+                int slot = start + (end - start) / 2;
-        for (i = 0; i < mem->nregions; ++i) {
+                reg = mem->regions + slot;
-                reg = mem->regions + i;
+                if (addr >= reg->guest_phys_addr)
-                if (reg->guest_phys_addr <= addr &&
+                        end = slot;
-                    reg->guest_phys_addr + reg->memory_size - 1 >= addr)
+                else
-                        return reg;
+                        start = slot + 1;
        }
+        reg = mem->regions + start;
+        if (addr >= reg->guest_phys_addr &&
+                reg->guest_phys_addr + reg->memory_size > addr)
+                return reg;
        return NULL;
 }
diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
index c1b03f4235b9..4e7fec36f5c3 100644
--- a/drivers/watchdog/sp805_wdt.c
+++ b/drivers/watchdog/sp805_wdt.c
@@ -4,7 +4,7 @@
 * Watchdog driver for ARM SP805 watchdog module
 *
 * Copyright (C) 2010 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2 or later. This program is licensed "as is" without any
@@ -303,6 +303,6 @@ static struct amba_driver sp805_wdt_driver = {
 module_amba_driver(sp805_wdt_driver);
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ARM SP805 Watchdog Driver");
 MODULE_LICENSE("GPL");
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 1c2bd1723e40..171312d51799 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2296,9 +2296,22 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
 static inline struct btrfs_delayed_ref_node *
 select_delayed_ref(struct btrfs_delayed_ref_head *head)
 {
+        struct btrfs_delayed_ref_node *ref;
        if (list_empty(&head->ref_list))
                return NULL;
+        /*
+         * Select a delayed ref of type BTRFS_ADD_DELAYED_REF first.
+         * This is to prevent a ref count from going down to zero, which deletes
+         * the extent item from the extent tree, when there still are references
+         * to add, which would fail because they would not find the extent item.
+         */
+        list_for_each_entry(ref, &head->ref_list, list) {
+                if (ref->action == BTRFS_ADD_DELAYED_REF)
+                        return ref;
+        }
        return list_entry(head->ref_list.next, struct btrfs_delayed_ref_node,
                          list);
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b33c0cf02668..e33dff356460 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4209,7 +4209,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
        u64 extent_num_bytes = 0;
        u64 extent_offset = 0;
        u64 item_end = 0;
-        u64 last_size = (u64)-1;
+        u64 last_size = new_size;
        u32 found_type = (u8)-1;
        int found_extent;
        int del_item;
@@ -4493,8 +4493,7 @@ out:
                        btrfs_abort_transaction(trans, root, ret);
        }
 error:
-        if (last_size != (u64)-1 &&
+        if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
-            root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
                btrfs_ordered_update_i_size(inode, last_size, NULL);
        btrfs_free_path(path);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5d91776e12a2..0770c91586ca 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3090,7 +3090,7 @@ out_unlock:
 static long btrfs_ioctl_file_extent_same(struct file *file,
                        struct btrfs_ioctl_same_args __user *argp)
 {
-        struct btrfs_ioctl_same_args *same;
+        struct btrfs_ioctl_same_args *same = NULL;
        struct btrfs_ioctl_same_extent_info *info;
        struct inode *src = file_inode(file);
        u64 off;
@@ -3120,6 +3120,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
        if (IS_ERR(same)) {
                ret = PTR_ERR(same);
+                same = NULL;
                goto out;
        }
@@ -3190,6 +3191,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
 out:
        mnt_drop_write_file(file);
+        kfree(same);
        return ret;
 }
@@ -3586,6 +3588,20 @@ process_slot:
                                u64 trim = 0;
                                u64 aligned_end = 0;
+                                /*
+                                 * Don't copy an inline extent into an offset
+                                 * greater than zero. Having an inline extent
+                                 * at such an offset results in chaos as btrfs
+                                 * isn't prepared for such cases. Just skip
+                                 * this case for the same reasons as commented
+                                 * at btrfs_ioctl_clone().
+                                 */
+                                if (last_dest_end > 0) {
+                                        ret = -EOPNOTSUPP;
+                                        btrfs_end_transaction(trans, root);
+                                        goto out;
+                                }
                                if (off > key.offset) {
                                        skip = off - key.offset;
                                        new_key.offset += skip;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index c0f18e7266b6..51e0f0d0053e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -761,7 +761,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
        if (!list_empty(&trans->ordered)) {
                spin_lock(&info->trans_lock);
-                list_splice(&trans->ordered, &cur_trans->pending_ordered);
+                list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
                spin_unlock(&info->trans_lock);
        }
@@ -1866,7 +1866,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
        }
        spin_lock(&root->fs_info->trans_lock);
-        list_splice(&trans->ordered, &cur_trans->pending_ordered);
+        list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
        if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
                spin_unlock(&root->fs_info->trans_lock);
                atomic_inc(&cur_trans->use_count);
diff --git a/fs/configfs/item.c b/fs/configfs/item.c
index 4d6a30e76168..b863a09cd2f1 100644
--- a/fs/configfs/item.c
+++ b/fs/configfs/item.c
@@ -115,7 +115,7 @@ void config_item_init_type_name(struct config_item *item,
                                const char *name,
                                struct config_item_type *type)
 {
-        config_item_set_name(item, name);
+        config_item_set_name(item, "%s", name);
        item->ci_type = type;
        config_item_init(item);
 }
@@ -124,7 +124,7 @@ EXPORT_SYMBOL(config_item_init_type_name);
 void config_group_init_type_name(struct config_group *group, const char *name,
                         struct config_item_type *type)
 {
-        config_item_set_name(&group->cg_item, name);
+        config_item_set_name(&group->cg_item, "%s", name);
        group->cg_item.ci_type = type;
        config_group_init(group);
 }
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 9bedfa8dd3a5..f71e19a9dd3c 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2072,8 +2072,6 @@ static int f2fs_set_data_page_dirty(struct page *page)
                return 1;
        }
-        mark_inode_dirty(inode);
        if (!PageDirty(page)) {
                __set_page_dirty_nobuffers(page);
                update_dirty_page(inode, page);
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index ada2a3dd701a..b0f38c3b37f4 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1331,12 +1331,13 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)
        if (ret)
                return ret;
-        if (f2fs_is_atomic_file(inode))
+        if (f2fs_is_atomic_file(inode)) {
+                clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
                commit_inmem_pages(inode, false);
+        }
        ret = f2fs_sync_file(filp, 0, LONG_MAX, 0);
        mnt_drop_write_file(filp);
-        clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
        return ret;
 }
@@ -1387,8 +1388,8 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)
        f2fs_balance_fs(F2FS_I_SB(inode));
        if (f2fs_is_atomic_file(inode)) {
-                commit_inmem_pages(inode, false);
                clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
+                commit_inmem_pages(inode, false);
        }
        if (f2fs_is_volatile_file(inode))
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index e1e73617d13b..22fb5ef37966 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -556,27 +556,39 @@ static void move_encrypted_block(struct inode *inode, block_t bidx)
        if (!fio.encrypted_page)
                goto put_out;
-        f2fs_submit_page_bio(&fio);
+        err = f2fs_submit_page_bio(&fio);
+        if (err)
+                goto put_page_out;
+        /* write page */
+        lock_page(fio.encrypted_page);
+        if (unlikely(!PageUptodate(fio.encrypted_page)))
+                goto put_page_out;
+        if (unlikely(fio.encrypted_page->mapping != META_MAPPING(fio.sbi)))
+                goto put_page_out;
+        set_page_dirty(fio.encrypted_page);
+        f2fs_wait_on_page_writeback(fio.encrypted_page, META);
+        if (clear_page_dirty_for_io(fio.encrypted_page))
+                dec_page_count(fio.sbi, F2FS_DIRTY_META);
+        set_page_writeback(fio.encrypted_page);
        /* allocate block address */
        f2fs_wait_on_page_writeback(dn.node_page, NODE);
        allocate_data_block(fio.sbi, NULL, fio.blk_addr,
                                        &fio.blk_addr, &sum, CURSEG_COLD_DATA);
-        dn.data_blkaddr = fio.blk_addr;
-        /* write page */
-        lock_page(fio.encrypted_page);
-        set_page_writeback(fio.encrypted_page);
        fio.rw = WRITE_SYNC;
        f2fs_submit_page_mbio(&fio);
+        dn.data_blkaddr = fio.blk_addr;
        set_data_blkaddr(&dn);
        f2fs_update_extent_cache(&dn);
        set_inode_flag(F2FS_I(inode), FI_APPEND_WRITE);
        if (page->index == 0)
                set_inode_flag(F2FS_I(inode), FI_FIRST_BLOCK_WRITTEN);
+put_page_out:
        f2fs_put_page(fio.encrypted_page, 1);
 put_out:
        f2fs_put_dnode(&dn);
@@ -605,8 +617,8 @@ static void move_data_page(struct inode *inode, block_t bidx, int gc_type)
                        .page = page,
                        .encrypted_page = NULL,
                };
+                set_page_dirty(page);
                f2fs_wait_on_page_writeback(page, DATA);
                if (clear_page_dirty_for_io(page))
                        inode_dec_dirty_pages(inode);
                set_cold_data(page);
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 38e75fb1e488..a13ffcc32992 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -141,6 +141,8 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
        kunmap_atomic(dst_addr);
        SetPageUptodate(page);
 no_update:
+        set_page_dirty(page);
        /* clear dirty state */
        dirty = clear_page_dirty_for_io(page);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 1eb343768781..61b97f9cb9f6 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -257,6 +257,7 @@ void commit_inmem_pages(struct inode *inode, bool abort)
                if (!abort) {
                        lock_page(cur->page);
                        if (cur->page->mapping == inode->i_mapping) {
+                                set_page_dirty(cur->page);
                                f2fs_wait_on_page_writeback(cur->page, DATA);
                                if (clear_page_dirty_for_io(cur->page))
                                        inode_dec_dirty_pages(inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index f0520bcf2094..518c6294bf6c 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -702,6 +702,7 @@ void wbc_account_io(struct writeback_control *wbc, struct page *page,
        else
                wbc->wb_tcand_bytes -= min(bytes, wbc->wb_tcand_bytes);
 }
+EXPORT_SYMBOL_GPL(wbc_account_io);
 /**
 * inode_congested - test whether an inode is congested
diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index e98d39d75cf4..b9dc23cd04f2 100644
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -76,7 +76,7 @@ static int jfs_open(struct inode *inode, struct file *file)
                if (ji->active_ag == -1) {
                        struct jfs_sb_info *jfs_sb = JFS_SBI(inode->i_sb);
                        ji->active_ag = BLKTOAG(addressPXD(&ji->ixpxd), jfs_sb);
-                        atomic_inc( &jfs_sb->bmap->db_active[ji->active_ag]);
+                        atomic_inc(&jfs_sb->bmap->db_active[ji->active_ag]);
                }
                spin_unlock_irq(&ji->ag_lock);
        }
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 6f1cb2b5ee28..41aa3ca6a6a4 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -134,11 +134,11 @@ int jfs_write_inode(struct inode *inode, struct writeback_control *wbc)
         * It has been committed since the last change, but was still
         * on the dirty inode list.
         */
-         if (!test_cflag(COMMIT_Dirty, inode)) {
+        if (!test_cflag(COMMIT_Dirty, inode)) {
                /* Make sure committed changes hit the disk */
                jfs_flush_journal(JFS_SBI(inode->i_sb)->log, wait);
                return 0;
-         }
+        }
        if (jfs_commit_inode(inode, wait)) {
                jfs_err("jfs_write_inode: jfs_commit_inode failed!");
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index e33be921aa41..a5ac97b9a933 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1160,7 +1160,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                rc = dtModify(tid, new_dir, &new_dname, &ino,
                              old_ip->i_ino, JFS_RENAME);
                if (rc)
-                        goto out4;
+                        goto out_tx;
                drop_nlink(new_ip);
                if (S_ISDIR(new_ip->i_mode)) {
                        drop_nlink(new_ip);
@@ -1185,7 +1185,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                        if ((new_size = commitZeroLink(tid, new_ip)) < 0) {
                                txAbort(tid, 1);        /* Marks FS Dirty */
                                rc = new_size;
-                                goto out4;
+                                goto out_tx;
                        }
                        tblk = tid_to_tblock(tid);
                        tblk->xflag |= COMMIT_DELETE;
@@ -1203,7 +1203,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                if (rc) {
                        jfs_err("jfs_rename didn't expect dtSearch to fail "
                                "w/rc = %d", rc);
-                        goto out4;
+                        goto out_tx;
                }
                ino = old_ip->i_ino;
@@ -1211,7 +1211,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                if (rc) {
                        if (rc == -EIO)
                                jfs_err("jfs_rename: dtInsert returned -EIO");
-                        goto out4;
+                        goto out_tx;
                }
                if (S_ISDIR(old_ip->i_mode))
                        inc_nlink(new_dir);
@@ -1226,7 +1226,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                jfs_err("jfs_rename did not expect dtDelete to return rc = %d",
                        rc);
                txAbort(tid, 1);        /* Marks Filesystem dirty */
-                goto out4;
+                goto out_tx;
        }
        if (S_ISDIR(old_ip->i_mode)) {
                drop_nlink(old_dir);
@@ -1285,7 +1285,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        rc = txCommit(tid, ipcount, iplist, commit_flag);
-      out4:
+      out_tx:
        txEnd(tid);
        if (new_ip)
                mutex_unlock(&JFS_IP(new_ip)->commit_mutex);
@@ -1308,13 +1308,6 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        }
        if (new_ip && (new_ip->i_nlink == 0))
                set_cflag(COMMIT_Nolink, new_ip);
-      out3:
-        free_UCSname(&new_dname);
-      out2:
-        free_UCSname(&old_dname);
-      out1:
-        if (new_ip && !S_ISDIR(new_ip->i_mode))
-                IWRITE_UNLOCK(new_ip);
        /*
         * Truncating the directory index table is not guaranteed.  It
         * may need to be done iteratively
@@ -1325,7 +1318,13 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                clear_cflag(COMMIT_Stale, old_dir);
        }
+        if (new_ip && !S_ISDIR(new_ip->i_mode))
+                IWRITE_UNLOCK(new_ip);
+      out3:
+        free_UCSname(&new_dname);
+      out2:
+        free_UCSname(&old_dname);
+      out1:
        jfs_info("jfs_rename: returning %d", rc);
        return rc;
 }
diff --git a/fs/locks.c b/fs/locks.c
index 653faabb07f4..d3d558ba4da7 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -862,12 +862,11 @@ static int posix_locks_deadlock(struct file_lock *caller_fl,
 * whether or not a lock was successfully freed by testing the return
 * value for -ENOENT.
 */
-static int flock_lock_file(struct file *filp, struct file_lock *request)
+static int flock_lock_inode(struct inode *inode, struct file_lock *request)
 {
        struct file_lock *new_fl = NULL;
        struct file_lock *fl;
        struct file_lock_context *ctx;
-        struct inode *inode = file_inode(filp);
        int error = 0;
        bool found = false;
        LIST_HEAD(dispose);
@@ -890,7 +889,7 @@ static int flock_lock_file(struct file *filp, struct file_lock *request)
                goto find_conflict;
        list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
-                if (filp != fl->fl_file)
+                if (request->fl_file != fl->fl_file)
                        continue;
                if (request->fl_type == fl->fl_type)
                        goto out;
@@ -1164,20 +1163,19 @@ int posix_lock_file(struct file *filp, struct file_lock *fl,
 EXPORT_SYMBOL(posix_lock_file);
 /**
- * posix_lock_file_wait - Apply a POSIX-style lock to a file
+ * posix_lock_inode_wait - Apply a POSIX-style lock to a file
- * @filp: The file to apply the lock to
+ * @inode: inode of file to which lock request should be applied
 * @fl: The lock to be applied
 *
- * Add a POSIX style lock to a file.
+ * Variant of posix_lock_file_wait that does not take a filp, and so can be
- * We merge adjacent & overlapping locks whenever possible.
+ * used after the filp has already been torn down.
- * POSIX locks are sorted by owner task, then by starting address
 */
-int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+int posix_lock_inode_wait(struct inode *inode, struct file_lock *fl)
 {
        int error;
        might_sleep ();
        for (;;) {
-                error = posix_lock_file(filp, fl, NULL);
+                error = __posix_lock_file(inode, fl, NULL);
                if (error != FILE_LOCK_DEFERRED)
                        break;
                error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
@@ -1189,7 +1187,7 @@ int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
        }
        return error;
 }
-EXPORT_SYMBOL(posix_lock_file_wait);
+EXPORT_SYMBOL(posix_lock_inode_wait);
 /**
 * locks_mandatory_locked - Check for an active lock
@@ -1851,18 +1849,18 @@ int fcntl_setlease(unsigned int fd, struct file *filp, long arg)
 }
 /**
- * flock_lock_file_wait - Apply a FLOCK-style lock to a file
+ * flock_lock_inode_wait - Apply a FLOCK-style lock to a file
- * @filp: The file to apply the lock to
+ * @inode: inode of the file to apply to
 * @fl: The lock to be applied
 *
- * Add a FLOCK style lock to a file.
+ * Apply a FLOCK style lock request to an inode.
 */
-int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
+int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl)
 {
        int error;
        might_sleep();
        for (;;) {
-                error = flock_lock_file(filp, fl);
+                error = flock_lock_inode(inode, fl);
                if (error != FILE_LOCK_DEFERRED)
                        break;
                error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
@@ -1874,8 +1872,7 @@ int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
        }
        return error;
 }
+EXPORT_SYMBOL(flock_lock_inode_wait);
-EXPORT_SYMBOL(flock_lock_file_wait);
 /**
 *      sys_flock: - flock() system call.
@@ -2401,7 +2398,8 @@ locks_remove_flock(struct file *filp)
                .fl_type = F_UNLCK,
                .fl_end = OFFSET_MAX,
        };
-        struct file_lock_context *flctx = file_inode(filp)->i_flctx;
+        struct inode *inode = file_inode(filp);
+        struct file_lock_context *flctx = inode->i_flctx;
        if (list_empty(&flctx->flc_flock))
                return;
@@ -2409,7 +2407,7 @@ locks_remove_flock(struct file *filp)
        if (filp->f_op->flock)
                filp->f_op->flock(filp, F_SETLKW, &fl);
        else
-                flock_lock_file(filp, &fl);
+                flock_lock_inode(inode, &fl);
        if (fl.fl_ops && fl.fl_ops->fl_release_private)
                fl.fl_ops->fl_release_private(&fl);
diff --git a/fs/namespace.c b/fs/namespace.c
index c7cb8a526c05..2b8aa15fd6df 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1361,6 +1361,36 @@ enum umount_tree_flags {
        UMOUNT_PROPAGATE = 2,
        UMOUNT_CONNECTED = 4,
 };
+static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
+{
+        /* Leaving mounts connected is only valid for lazy umounts */
+        if (how & UMOUNT_SYNC)
+                return true;
+        /* A mount without a parent has nothing to be connected to */
+        if (!mnt_has_parent(mnt))
+                return true;
+        /* Because the reference counting rules change when mounts are
+         * unmounted and connected, umounted mounts may not be
+         * connected to mounted mounts.
+         */
+        if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
+                return true;
+        /* Has it been requested that the mount remain connected? */
+        if (how & UMOUNT_CONNECTED)
+                return false;
+        /* Is the mount locked such that it needs to remain connected? */
+        if (IS_MNT_LOCKED(mnt))
+                return false;
+        /* By default disconnect the mount */
+        return true;
+}
 /*
 * mount_lock must be held
 * namespace_sem must be held for write
@@ -1398,10 +1428,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
                if (how & UMOUNT_SYNC)
                        p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
-                disconnect = !(((how & UMOUNT_CONNECTED) &&
+                disconnect = disconnect_mount(p, how);
-                                mnt_has_parent(p) &&
-                                (p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
-                               IS_MNT_LOCKED_AND_LAZY(p));
                pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
                                 disconnect ? &unmounted : NULL);
@@ -1538,11 +1565,8 @@ void __detach_mounts(struct dentry *dentry)
        while (!hlist_empty(&mp->m_list)) {
                mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
                if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
-                        struct mount *p, *tmp;
+                        hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
-                        list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
+                        umount_mnt(mnt);
-                                hlist_add_head(&p->mnt_umount.s_list, &unmounted);
-                                umount_mnt(p);
-                        }
                }
                else umount_tree(mnt, UMOUNT_CONNECTED);
        }
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index ecebb406cc1a..4a90c9bb3135 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -775,7 +775,7 @@ static int nfs_init_server(struct nfs_server *server,
        server->options = data->options;
        server->caps |= NFS_CAP_HARDLINKS|NFS_CAP_SYMLINKS|NFS_CAP_FILEID|
                NFS_CAP_MODE|NFS_CAP_NLINK|NFS_CAP_OWNER|NFS_CAP_OWNER_GROUP|
-                NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME|NFS_CAP_CHANGE_ATTR;
+                NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME;
        if (data->rsize)
                server->rsize = nfs_block_size(data->rsize, NULL);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index c12951b9551e..b3289d701eea 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1852,7 +1852,7 @@ ff_layout_mirror_prepare_stats(struct nfs42_layoutstat_args *args,
        struct nfs42_layoutstat_devinfo *devinfo;
        int i;
-        for (i = 0; i <= FF_LAYOUT_MIRROR_COUNT(pls); i++) {
+        for (i = 0; i < FF_LAYOUT_MIRROR_COUNT(pls); i++) {
                if (*dev_count >= dev_limit)
                        break;
                mirror = FF_LAYOUT_COMP(pls, i);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index b77b328a06d7..0adc7d245b3d 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -442,8 +442,9 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
                        inode->i_version = fattr->change_attr;
-                else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
+                else
-                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
+                                | NFS_INO_REVAL_PAGECACHE);
                if (fattr->valid & NFS_ATTR_FATTR_SIZE)
                        inode->i_size = nfs_size_to_loff_t(fattr->size);
                else
@@ -1244,9 +1245,11 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
        if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
                cur_size = i_size_read(inode);
                new_isize = nfs_size_to_loff_t(fattr->size);
-                if (cur_size != new_isize && nfsi->nrequests == 0)
+                if (cur_size != new_isize)
                        invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
        }
+        if (nfsi->nrequests != 0)
+                invalid &= ~NFS_INO_REVAL_PAGECACHE;
        /* Have any file permissions changed? */
        if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
@@ -1684,13 +1687,12 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                        invalid |= NFS_INO_INVALID_ATTR
                                | NFS_INO_INVALID_DATA
                                | NFS_INO_INVALID_ACCESS
-                                | NFS_INO_INVALID_ACL
+                                | NFS_INO_INVALID_ACL;
-                                | NFS_INO_REVAL_PAGECACHE;
                        if (S_ISDIR(inode->i_mode))
                                nfs_force_lookup_revalidate(inode);
                        inode->i_version = fattr->change_attr;
                }
-        } else if (server->caps & NFS_CAP_CHANGE_ATTR)
+        } else
                nfsi->cache_validity |= save_cache_validity;
        if (fattr->valid & NFS_ATTR_FATTR_MTIME) {
@@ -1717,7 +1719,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                        if ((nfsi->nrequests == 0) || new_isize > cur_isize) {
                                i_size_write(inode, new_isize);
                                invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
-                                invalid &= ~NFS_INO_REVAL_PAGECACHE;
                        }
                        dprintk("NFS: isize change on server for file %s/%ld "
                                        "(%Ld to %Ld)\n",
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 7e3c4604bea8..9b372b845f6a 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -296,6 +296,22 @@ extern struct rpc_procinfo nfs4_procedures[];
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
 extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
+static inline struct nfs4_label *
+nfs4_label_copy(struct nfs4_label *dst, struct nfs4_label *src)
+{
+        if (!dst || !src)
+                return NULL;
+        if (src->len > NFS4_MAXLABELLEN)
+                return NULL;
+        dst->lfs = src->lfs;
+        dst->pi = src->pi;
+        dst->len = src->len;
+        memcpy(dst->label, src->label, src->len);
+        return dst;
+}
 static inline void nfs4_label_free(struct nfs4_label *label)
 {
        if (label) {
@@ -316,6 +332,11 @@ static inline void nfs4_label_free(void *label) {}
 static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
 {
 }
+static inline struct nfs4_label *
+nfs4_label_copy(struct nfs4_label *dst, struct nfs4_label *src)
+{
+        return NULL;
+}
 #endif /* CONFIG_NFS_V4_SECURITY_LABEL */
 /* proc.c */
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index f486b80f927a..d731bbf974aa 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -135,7 +135,7 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len)
        return err;
 }
-loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
+static loff_t _nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
 {
        struct inode *inode = file_inode(filep);
        struct nfs42_seek_args args = {
@@ -171,6 +171,23 @@ loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
        return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
 }
+loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
+{
+        struct nfs_server *server = NFS_SERVER(file_inode(filep));
+        struct nfs4_exception exception = { };
+        int err;
+        do {
+                err = _nfs42_proc_llseek(filep, offset, whence);
+                if (err == -ENOTSUPP)
+                        return -EOPNOTSUPP;
+                err = nfs4_handle_exception(server, err, &exception);
+        } while (exception.retry);
+        return err;
+}
 static void
 nfs42_layoutstat_prepare(struct rpc_task *task, void *calldata)
 {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6f228b5af819..3acb1eb72930 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -467,7 +467,10 @@ static void do_renew_lease(struct nfs_client *clp, unsigned long timestamp)
 static void renew_lease(const struct nfs_server *server, unsigned long timestamp)
 {
-        do_renew_lease(server->nfs_client, timestamp);
+        struct nfs_client *clp = server->nfs_client;
+        if (!nfs4_has_session(clp))
+                do_renew_lease(clp, timestamp);
 }
 struct nfs4_call_sync_data {
@@ -616,8 +619,7 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
                clp = session->clp;
                do_renew_lease(clp, res->sr_timestamp);
                /* Check sequence flags */
-                if (res->sr_status_flags != 0)
+                nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
-                        nfs4_schedule_lease_recovery(clp);
                nfs41_update_target_slotid(slot->table, slot, res);
                break;
        case 1:
@@ -910,6 +912,7 @@ struct nfs4_opendata {
        struct nfs_open_confirmres c_res;
        struct nfs4_string owner_name;
        struct nfs4_string group_name;
+        struct nfs4_label *a_label;
        struct nfs_fattr f_attr;
        struct nfs4_label *f_label;
        struct dentry *dir;
@@ -1013,6 +1016,10 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
        if (IS_ERR(p->f_label))
                goto err_free_p;
+        p->a_label = nfs4_label_alloc(server, gfp_mask);
+        if (IS_ERR(p->a_label))
+                goto err_free_f;
        alloc_seqid = server->nfs_client->cl_mvops->alloc_seqid;
        p->o_arg.seqid = alloc_seqid(&sp->so_seqid, gfp_mask);
        if (IS_ERR(p->o_arg.seqid))
@@ -1041,7 +1048,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
        p->o_arg.server = server;
        p->o_arg.bitmask = nfs4_bitmask(server, label);
        p->o_arg.open_bitmap = &nfs4_fattr_bitmap[0];
-        p->o_arg.label = label;
+        p->o_arg.label = nfs4_label_copy(p->a_label, label);
        p->o_arg.claim = nfs4_map_atomic_open_claim(server, claim);
        switch (p->o_arg.claim) {
        case NFS4_OPEN_CLAIM_NULL:
@@ -1074,6 +1081,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
        return p;
 err_free_label:
+        nfs4_label_free(p->a_label);
+err_free_f:
        nfs4_label_free(p->f_label);
 err_free_p:
        kfree(p);
@@ -1093,6 +1102,7 @@ static void nfs4_opendata_free(struct kref *kref)
                nfs4_put_open_state(p->state);
        nfs4_put_state_owner(p->owner);
+        nfs4_label_free(p->a_label);
        nfs4_label_free(p->f_label);
        dput(p->dir);
@@ -1198,12 +1208,15 @@ static bool nfs_need_update_open_stateid(struct nfs4_state *state,
 static void nfs_resync_open_stateid_locked(struct nfs4_state *state)
 {
+        if (!(state->n_wronly || state->n_rdonly || state->n_rdwr))
+                return;
        if (state->n_wronly)
                set_bit(NFS_O_WRONLY_STATE, &state->flags);
        if (state->n_rdonly)
                set_bit(NFS_O_RDONLY_STATE, &state->flags);
        if (state->n_rdwr)
                set_bit(NFS_O_RDWR_STATE, &state->flags);
+        set_bit(NFS_OPEN_STATE, &state->flags);
 }
 static void nfs_clear_open_stateid_locked(struct nfs4_state *state,
@@ -5439,15 +5452,15 @@ static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *
        return err;
 }
-static int do_vfs_lock(struct file *file, struct file_lock *fl)
+static int do_vfs_lock(struct inode *inode, struct file_lock *fl)
 {
        int res = 0;
        switch (fl->fl_flags & (FL_POSIX|FL_FLOCK)) {
                case FL_POSIX:
-                        res = posix_lock_file_wait(file, fl);
+                        res = posix_lock_inode_wait(inode, fl);
                        break;
                case FL_FLOCK:
-                        res = flock_lock_file_wait(file, fl);
+                        res = flock_lock_inode_wait(inode, fl);
                        break;
                default:
                        BUG();
@@ -5484,7 +5497,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
        atomic_inc(&lsp->ls_count);
        /* Ensure we don't close file until we're done freeing locks! */
        p->ctx = get_nfs_open_context(ctx);
-        get_file(fl->fl_file);
        memcpy(&p->fl, fl, sizeof(p->fl));
        p->server = NFS_SERVER(inode);
        return p;
@@ -5496,7 +5508,6 @@ static void nfs4_locku_release_calldata(void *data)
        nfs_free_seqid(calldata->arg.seqid);
        nfs4_put_lock_state(calldata->lsp);
        put_nfs_open_context(calldata->ctx);
-        fput(calldata->fl.fl_file);
        kfree(calldata);
 }
@@ -5509,7 +5520,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
        switch (task->tk_status) {
                case 0:
                        renew_lease(calldata->server, calldata->timestamp);
-                        do_vfs_lock(calldata->fl.fl_file, &calldata->fl);
+                        do_vfs_lock(calldata->lsp->ls_state->inode, &calldata->fl);
                        if (nfs4_update_lock_stateid(calldata->lsp,
                                        &calldata->res.stateid))
                                break;
@@ -5617,7 +5628,7 @@ static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *
        mutex_lock(&sp->so_delegreturn_mutex);
        /* Exclude nfs4_reclaim_open_stateid() - note nesting! */
        down_read(&nfsi->rwsem);
-        if (do_vfs_lock(request->fl_file, request) == -ENOENT) {
+        if (do_vfs_lock(inode, request) == -ENOENT) {
                up_read(&nfsi->rwsem);
                mutex_unlock(&sp->so_delegreturn_mutex);
                goto out;
@@ -5758,7 +5769,7 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
                                data->timestamp);
                if (data->arg.new_lock) {
                        data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
-                        if (do_vfs_lock(data->fl.fl_file, &data->fl) < 0) {
+                        if (do_vfs_lock(lsp->ls_state->inode, &data->fl) < 0) {
                                rpc_restart_call_prepare(task);
                                break;
                        }
@@ -6000,7 +6011,7 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
        if (status != 0)
                goto out;
        request->fl_flags |= FL_ACCESS;
-        status = do_vfs_lock(request->fl_file, request);
+        status = do_vfs_lock(state->inode, request);
        if (status < 0)
                goto out;
        down_read(&nfsi->rwsem);
@@ -6008,7 +6019,7 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
                /* Yes: cache locks! */
                /* ...but avoid races with delegation recall... */
                request->fl_flags = fl_flags & ~FL_SLEEP;
-                status = do_vfs_lock(request->fl_file, request);
+                status = do_vfs_lock(state->inode, request);
                up_read(&nfsi->rwsem);
                goto out;
        }
@@ -7573,13 +7584,8 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
                goto out;
        }
        ret = rpc_wait_for_completion_task(task);
-        if (!ret) {
+        if (!ret)
-                struct nfs4_sequence_res *res = task->tk_msg.rpc_resp;
-                if (task->tk_status == 0)
-                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
                ret = task->tk_status;
-        }
        rpc_put_task(task);
 out:
        dprintk("<-- %s status=%d\n", __func__, ret);
@@ -7967,16 +7973,17 @@ static void nfs4_layoutreturn_release(void *calldata)
 {
        struct nfs4_layoutreturn *lrp = calldata;
        struct pnfs_layout_hdr *lo = lrp->args.layout;
+        LIST_HEAD(freeme);
        dprintk("--> %s\n", __func__);
        spin_lock(&lo->plh_inode->i_lock);
        if (lrp->res.lrs_present)
                pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
+        pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range);
        pnfs_clear_layoutreturn_waitbit(lo);
-        clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE, &lo->plh_flags);
-        rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
        lo->plh_block_lgets--;
        spin_unlock(&lo->plh_inode->i_lock);
+        pnfs_free_lseg_list(&freeme);
        pnfs_put_layout_hdr(lrp->args.layout);
        nfs_iput_and_deactive(lrp->inode);
        kfree(calldata);
@@ -8590,7 +8597,6 @@ static const struct nfs4_minor_version_ops nfs_v4_0_minor_ops = {
        .minor_version = 0,
        .init_caps = NFS_CAP_READDIRPLUS
                | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                | NFS_CAP_POSIX_LOCK,
        .init_client = nfs40_init_client,
        .shutdown_client = nfs40_shutdown_client,
@@ -8616,7 +8622,6 @@ static const struct nfs4_minor_version_ops nfs_v4_1_minor_ops = {
        .minor_version = 1,
        .init_caps = NFS_CAP_READDIRPLUS
                | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                | NFS_CAP_POSIX_LOCK
                | NFS_CAP_STATEID_NFSV41
                | NFS_CAP_ATOMIC_OPEN_V1,
@@ -8639,7 +8644,6 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
        .minor_version = 2,
        .init_caps = NFS_CAP_READDIRPLUS
                | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                | NFS_CAP_POSIX_LOCK
                | NFS_CAP_STATEID_NFSV41
                | NFS_CAP_ATOMIC_OPEN_V1
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 605840dc89cf..f2e2ad894461 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2191,25 +2191,35 @@ static void nfs41_handle_server_reboot(struct nfs_client *clp)
        }
 }
-static void nfs41_handle_state_revoked(struct nfs_client *clp)
+static void nfs41_handle_all_state_revoked(struct nfs_client *clp)
 {
        nfs4_reset_all_state(clp);
        dprintk("%s: state revoked on server %s\n", __func__, clp->cl_hostname);
 }
+static void nfs41_handle_some_state_revoked(struct nfs_client *clp)
+{
+        nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_nograce);
+        nfs4_schedule_state_manager(clp);
+        dprintk("%s: state revoked on server %s\n", __func__, clp->cl_hostname);
+}
 static void nfs41_handle_recallable_state_revoked(struct nfs_client *clp)
 {
-        /* This will need to handle layouts too */
+        /* FIXME: For now, we destroy all layouts. */
-        nfs_expire_all_delegations(clp);
+        pnfs_destroy_all_layouts(clp);
+        /* FIXME: For now, we test all delegations+open state+locks. */
+        nfs41_handle_some_state_revoked(clp);
        dprintk("%s: Recallable state revoked on server %s!\n", __func__,
                        clp->cl_hostname);
 }
 static void nfs41_handle_backchannel_fault(struct nfs_client *clp)
 {
-        nfs_expire_all_delegations(clp);
+        set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
-        if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
+        nfs4_schedule_state_manager(clp);
-                nfs4_schedule_state_manager(clp);
        dprintk("%s: server %s declared a backchannel fault\n", __func__,
                        clp->cl_hostname);
 }
@@ -2231,10 +2241,11 @@ void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
        if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
                nfs41_handle_server_reboot(clp);
-        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
+        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED))
-                            SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
+                nfs41_handle_all_state_revoked(clp);
+        if (flags & (SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                            SEQ4_STATUS_ADMIN_STATE_REVOKED))
-                nfs41_handle_state_revoked(clp);
+                nfs41_handle_some_state_revoked(clp);
        if (flags & SEQ4_STATUS_LEASE_MOVED)
                nfs4_schedule_lease_moved_recovery(clp);
        if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 1da68d3b1eda..4984bbe55ff1 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1100,8 +1100,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                mirror->pg_base = 0;
                mirror->pg_recoalesce = 0;
-                desc->pg_moreio = 0;
                while (!list_empty(&head)) {
                        struct nfs_page *req;
@@ -1109,8 +1107,11 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                        nfs_list_remove_request(req);
                        if (__nfs_pageio_add_request(desc, req))
                                continue;
-                        if (desc->pg_error < 0)
+                        if (desc->pg_error < 0) {
+                                list_splice_tail(&head, &mirror->pg_list);
+                                mirror->pg_recoalesce = 1;
                                return 0;
+                        }
                        break;
                }
        } while (mirror->pg_recoalesce);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 0ba9a02c9566..70bf706b1090 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -352,7 +352,7 @@ pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
 {
        struct pnfs_layout_segment *s;
-        if (!test_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
+        if (!test_and_clear_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
                return false;
        list_for_each_entry(s, &lo->plh_segs, pls_list)
@@ -362,6 +362,18 @@ pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
        return true;
 }
+static bool
+pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo)
+{
+        if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return false;
+        lo->plh_return_iomode = 0;
+        lo->plh_block_lgets++;
+        pnfs_get_layout_hdr(lo);
+        clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE, &lo->plh_flags);
+        return true;
+}
 static void pnfs_layoutreturn_before_put_lseg(struct pnfs_layout_segment *lseg,
                struct pnfs_layout_hdr *lo, struct inode *inode)
 {
@@ -372,17 +384,16 @@ static void pnfs_layoutreturn_before_put_lseg(struct pnfs_layout_segment *lseg,
        if (pnfs_layout_need_return(lo, lseg)) {
                nfs4_stateid stateid;
                enum pnfs_iomode iomode;
+                bool send;
                stateid = lo->plh_stateid;
                iomode = lo->plh_return_iomode;
-                /* decreased in pnfs_send_layoutreturn() */
+                send = pnfs_prepare_layoutreturn(lo);
-                lo->plh_block_lgets++;
-                lo->plh_return_iomode = 0;
                spin_unlock(&inode->i_lock);
-                pnfs_get_layout_hdr(lo);
+                if (send) {
+                        /* Send an async layoutreturn so we dont deadlock */
-                /* Send an async layoutreturn so we dont deadlock */
+                        pnfs_send_layoutreturn(lo, stateid, iomode, false);
-                pnfs_send_layoutreturn(lo, stateid, iomode, false);
+                }
        } else
                spin_unlock(&inode->i_lock);
 }
@@ -411,6 +422,10 @@ pnfs_put_lseg(struct pnfs_layout_segment *lseg)
                pnfs_layoutreturn_before_put_lseg(lseg, lo, inode);
        if (atomic_dec_and_lock(&lseg->pls_refcount, &inode->i_lock)) {
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags)) {
+                        spin_unlock(&inode->i_lock);
+                        return;
+                }
                pnfs_get_layout_hdr(lo);
                pnfs_layout_remove_lseg(lo, lseg);
                spin_unlock(&inode->i_lock);
@@ -451,6 +466,8 @@ pnfs_put_lseg_locked(struct pnfs_layout_segment *lseg)
                test_bit(NFS_LSEG_VALID, &lseg->pls_flags));
        if (atomic_dec_and_test(&lseg->pls_refcount)) {
                struct pnfs_layout_hdr *lo = lseg->pls_layout;
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags))
+                        return;
                pnfs_get_layout_hdr(lo);
                pnfs_layout_remove_lseg(lo, lseg);
                pnfs_free_lseg_async(lseg);
@@ -924,6 +941,7 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
        clear_bit_unlock(NFS_LAYOUT_RETURN, &lo->plh_flags);
        smp_mb__after_atomic();
        wake_up_bit(&lo->plh_flags, NFS_LAYOUT_RETURN);
+        rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 static int
@@ -978,6 +996,7 @@ _pnfs_return_layout(struct inode *ino)
        LIST_HEAD(tmp_list);
        nfs4_stateid stateid;
        int status = 0, empty;
+        bool send;
        dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino);
@@ -1007,17 +1026,18 @@ _pnfs_return_layout(struct inode *ino)
        /* Don't send a LAYOUTRETURN if list was initially empty */
        if (empty) {
                spin_unlock(&ino->i_lock);
-                pnfs_put_layout_hdr(lo);
                dprintk("NFS: %s no layout segments to return\n", __func__);
-                goto out;
+                goto out_put_layout_hdr;
        }
        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-        lo->plh_block_lgets++;
+        send = pnfs_prepare_layoutreturn(lo);
        spin_unlock(&ino->i_lock);
        pnfs_free_lseg_list(&tmp_list);
+        if (send)
-        status = pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, true);
+                status = pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, true);
+out_put_layout_hdr:
+        pnfs_put_layout_hdr(lo);
 out:
        dprintk("<-- %s status: %d\n", __func__, status);
        return status;
@@ -1097,13 +1117,9 @@ bool pnfs_roc(struct inode *ino)
 out_noroc:
        if (lo) {
                stateid = lo->plh_stateid;
-                layoutreturn =
+                if (test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
-                        test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                                           &lo->plh_flags))
-                                           &lo->plh_flags);
+                        layoutreturn = pnfs_prepare_layoutreturn(lo);
-                if (layoutreturn) {
-                        lo->plh_block_lgets++;
-                        pnfs_get_layout_hdr(lo);
-                }
        }
        spin_unlock(&ino->i_lock);
        if (layoutreturn) {
@@ -1146,15 +1162,18 @@ bool pnfs_roc_drain(struct inode *ino, u32 *barrier, struct rpc_task *task)
        struct pnfs_layout_segment *lseg;
        nfs4_stateid stateid;
        u32 current_seqid;
-        bool found = false, layoutreturn = false;
+        bool layoutreturn = false;
        spin_lock(&ino->i_lock);
-        list_for_each_entry(lseg, &nfsi->layout->plh_segs, pls_list)
+        list_for_each_entry(lseg, &nfsi->layout->plh_segs, pls_list) {
-                if (test_bit(NFS_LSEG_ROC, &lseg->pls_flags)) {
+                if (!test_bit(NFS_LSEG_ROC, &lseg->pls_flags))
-                        rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+                        continue;
-                        found = true;
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags))
-                        goto out;
+                        continue;
-                }
+                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+                spin_unlock(&ino->i_lock);
+                return true;
+        }
        lo = nfsi->layout;
        current_seqid = be32_to_cpu(lo->plh_stateid.seqid);
@@ -1162,23 +1181,19 @@ bool pnfs_roc_drain(struct inode *ino, u32 *barrier, struct rpc_task *task)
         * a barrier, we choose the worst-case barrier.
         */
        *barrier = current_seqid + atomic_read(&lo->plh_outstanding);
-out:
+        stateid = lo->plh_stateid;
-        if (!found) {
+        if (test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
-                stateid = lo->plh_stateid;
+                                           &lo->plh_flags))
-                layoutreturn =
+                layoutreturn = pnfs_prepare_layoutreturn(lo);
-                        test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+        if (test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
-                                           &lo->plh_flags);
+                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
-                if (layoutreturn) {
-                        lo->plh_block_lgets++;
-                        pnfs_get_layout_hdr(lo);
-                }
-        }
        spin_unlock(&ino->i_lock);
        if (layoutreturn) {
-                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
                pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, false);
+                return true;
        }
-        return found;
+        return false;
 }
 /*
@@ -1695,7 +1710,6 @@ void pnfs_error_mark_layout_for_return(struct inode *inode,
        spin_lock(&inode->i_lock);
        /* set failure bit so that pnfs path will be retried later */
        pnfs_layout_set_fail_bit(lo, iomode);
-        set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
        if (lo->plh_return_iomode == 0)
                lo->plh_return_iomode = range.iomode;
        else if (lo->plh_return_iomode != range.iomode)
@@ -2207,13 +2221,12 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
        if (ld->prepare_layoutcommit) {
                status = ld->prepare_layoutcommit(&data->args);
                if (status) {
+                        put_rpccred(data->cred);
                        spin_lock(&inode->i_lock);
                        set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags);
                        if (end_pos > nfsi->layout->plh_lwb)
                                nfsi->layout->plh_lwb = end_pos;
-                        spin_unlock(&inode->i_lock);
+                        goto out_unlock;
-                        put_rpccred(data->cred);
-                        goto clear_layoutcommitting;
                }
        }
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 65869ca9c851..75a35a1afa79 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1379,24 +1379,27 @@ static void nfs_writeback_check_extend(struct nfs_pgio_header *hdr,
 {
        struct nfs_pgio_args *argp = &hdr->args;
        struct nfs_pgio_res *resp = &hdr->res;
+        u64 size = argp->offset + resp->count;
        if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
+                fattr->size = size;
+        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode)) {
+                fattr->valid &= ~NFS_ATTR_FATTR_SIZE;
                return;
-        if (argp->offset + resp->count != fattr->size)
+        }
-                return;
+        if (size != fattr->size)
-        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode))
                return;
        /* Set attribute barrier */
        nfs_fattr_set_barrier(fattr);
+        /* ...and update size */
+        fattr->valid |= NFS_ATTR_FATTR_SIZE;
 }
 void nfs_writeback_update_inode(struct nfs_pgio_header *hdr)
 {
-        struct nfs_fattr *fattr = hdr->res.fattr;
+        struct nfs_fattr *fattr = &hdr->fattr;
        struct inode *inode = hdr->inode;
-        if (fattr == NULL)
-                return;
        spin_lock(&inode->i_lock);
        nfs_writeback_check_extend(hdr, fattr);
        nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
diff --git a/fs/pnode.h b/fs/pnode.h
index 7114ce6e6b9e..0fcdbe7ca648 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -20,8 +20,6 @@
 #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
 #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
 #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
-#define IS_MNT_LOCKED_AND_LAZY(m) \
-        (((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
 #define CL_EXPIRE               0x01
 #define CL_SLAVE                0x02
diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
index d751fcb637bb..1ade1206bb89 100644
--- a/fs/proc/Kconfig
+++ b/fs/proc/Kconfig
@@ -75,3 +75,9 @@ config PROC_PAGE_MONITOR
 config PROC_CHILDREN
        bool "Include /proc/<pid>/task/<tid>/children file"
        default n
+        help
+          Provides a fast way to retrieve first level children pids of a task. See
+          <file:Documentation/filesystems/proc.txt> for more information.
+          Say Y if you are running any user-space software which takes benefit from
+          this interface. For example, rkt is such a piece of software.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 87782e874b6a..aa50d1ac28fc 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -243,6 +243,11 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
        len1 = arg_end - arg_start;
        len2 = env_end - env_start;
+        /* Empty ARGV. */
+        if (len1 == 0) {
+                rv = 0;
+                goto out_free_page;
+        }
        /*
         * Inherently racy -- command line shares address space
         * with code and data.
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 91a4e6426321..92e6726f6e37 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -92,7 +92,7 @@ static size_t get_kcore_size(int *nphdr, size_t *elf_buflen)
                             roundup(sizeof(CORE_STR), 4)) +
                        roundup(sizeof(struct elf_prstatus), 4) +
                        roundup(sizeof(struct elf_prpsinfo), 4) +
-                        roundup(sizeof(struct task_struct), 4);
+                        roundup(arch_task_struct_size, 4);
        *elf_buflen = PAGE_ALIGN(*elf_buflen);
        return size + *elf_buflen;
 }
@@ -415,7 +415,7 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
        /* set up the task structure */
        notes[2].name   = CORE_STR;
        notes[2].type   = NT_TASKSTRUCT;
-        notes[2].datasz = sizeof(struct task_struct);
+        notes[2].datasz = arch_task_struct_size;
        notes[2].data   = current;
        nhdr->p_filesz  += notesize(&notes[2]);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 6afac3d561ac..8d0b3ade0ff0 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1652,17 +1652,9 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                       iinfo->i_ext.i_data, inode->i_sb->s_blocksize -
                                        sizeof(struct unallocSpaceEntry));
                use->descTag.tagIdent = cpu_to_le16(TAG_IDENT_USE);
-                use->descTag.tagLocation =
+                crclen = sizeof(struct unallocSpaceEntry);
-                                cpu_to_le32(iinfo->i_location.logicalBlockNum);
-                crclen = sizeof(struct unallocSpaceEntry) +
-                                iinfo->i_lenAlloc - sizeof(struct tag);
-                use->descTag.descCRCLength = cpu_to_le16(crclen);
-                use->descTag.descCRC = cpu_to_le16(crc_itu_t(0, (char *)use +
-                                                           sizeof(struct tag),
-                                                           crclen));
-                use->descTag.tagChecksum = udf_tag_checksum(&use->descTag);
-                goto out;
+                goto finish;
        }
        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_UID_FORGET))
@@ -1782,6 +1774,8 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                efe->descTag.tagIdent = cpu_to_le16(TAG_IDENT_EFE);
                crclen = sizeof(struct extendedFileEntry);
        }
+finish:
        if (iinfo->i_strat4096) {
                fe->icbTag.strategyType = cpu_to_le16(4096);
                fe->icbTag.strategyParameter = cpu_to_le16(1);
@@ -1791,7 +1785,9 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                fe->icbTag.numEntries = cpu_to_le16(1);
        }
-        if (S_ISDIR(inode->i_mode))
+        if (iinfo->i_use)
+                fe->icbTag.fileType = ICBTAG_FILE_TYPE_USE;
+        else if (S_ISDIR(inode->i_mode))
                fe->icbTag.fileType = ICBTAG_FILE_TYPE_DIRECTORY;
        else if (S_ISREG(inode->i_mode))
                fe->icbTag.fileType = ICBTAG_FILE_TYPE_REGULAR;
@@ -1828,7 +1824,6 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                                                  crclen));
        fe->descTag.tagChecksum = udf_tag_checksum(&fe->descTag);
-out:
        set_buffer_uptodate(bh);
        unlock_buffer(bh);
diff --git a/include/asm-generic/mm-arch-hooks.h b/include/asm-generic/mm-arch-hooks.h
new file mode 100644
index 000000000000..5ff0e5193f85
--- /dev/null
+++ b/include/asm-generic/mm-arch-hooks.h
@@ -0,0 +1,16 @@
+/*
+ * Architecture specific mm hooks
+ */
+#ifndef _ASM_GENERIC_MM_ARCH_HOOKS_H
+#define _ASM_GENERIC_MM_ARCH_HOOKS_H
+/*
+ * This file should be included through arch/../include/asm/Kbuild for
+ * the architecture which doesn't need specific mm hooks.
+ *
+ * In that case, the generic hooks defined in include/linux/mm-arch-hooks.h
+ * are used.
+ */
+#endif /* _ASM_GENERIC_MM_ARCH_HOOKS_H */
diff --git a/include/linux/amba/sp810.h b/include/linux/amba/sp810.h
index c7df89f99115..58fe9e8b6fd7 100644
--- a/include/linux/amba/sp810.h
+++ b/include/linux/amba/sp810.h
@@ -2,7 +2,7 @@
 * ARM PrimeXsys System Controller SP810 header file
 *
 * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/include/linux/ata.h b/include/linux/ata.h
index fed36418dd1c..6c78956aa470 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -45,6 +45,7 @@ enum {
        ATA_SECT_SIZE           = 512,
        ATA_MAX_SECTORS_128     = 128,
        ATA_MAX_SECTORS         = 256,
+        ATA_MAX_SECTORS_1024    = 1024,
        ATA_MAX_SECTORS_LBA48   = 65535,/* TODO: 65536? */
        ATA_MAX_SECTORS_TAPE    = 65535,
diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
index 58cfab80dd70..1b62d768c7df 100644
--- a/include/linux/blk-cgroup.h
+++ b/include/linux/blk-cgroup.h
@@ -47,6 +47,7 @@ struct blkcg {
        struct blkcg_policy_data        *pd[BLKCG_MAX_POLS];
+        struct list_head                all_blkcgs_node;
 #ifdef CONFIG_CGROUP_WRITEBACK
        struct list_head                cgwb_list;
 #endif
@@ -88,18 +89,12 @@ struct blkg_policy_data {
 * Policies that need to keep per-blkcg data which is independent
 * from any request_queue associated to it must specify its size
 * with the cpd_size field of the blkcg_policy structure and
- * embed a blkcg_policy_data in it. blkcg core allocates
+ * embed a blkcg_policy_data in it.  cpd_init() is invoked to let
- * policy-specific per-blkcg structures lazily the first time
+ * each policy handle per-blkcg data.
- * they are actually needed, so it handles them together with
- * blkgs. cpd_init() is invoked to let each policy handle
- * per-blkcg data.
 */
 struct blkcg_policy_data {
        /* the policy id this per-policy data belongs to */
        int                             plid;
-        /* used during policy activation */
-        struct list_head                alloc_node;
 };
 /* association between a blk cgroup and a request queue */
diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index b6a52a4b457a..51bb6532785c 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -27,10 +27,12 @@
 /**
 * struct can_skb_priv - private additional data inside CAN sk_buffs
 * @ifindex:    ifindex of the first interface the CAN frame appeared on
+ * @skbcnt:     atomic counter to have an unique id together with skb pointer
 * @cf:         align to the following CAN frame at skb->data
 */
 struct can_skb_priv {
        int ifindex;
+        int skbcnt;
        struct can_frame cf[0];
 };
diff --git a/include/linux/clkdev.h b/include/linux/clkdev.h
index a240b18e86fa..08bffcc466de 100644
--- a/include/linux/clkdev.h
+++ b/include/linux/clkdev.h
@@ -33,18 +33,19 @@ struct clk_lookup {
        }
 struct clk_lookup *clkdev_alloc(struct clk *clk, const char *con_id,
-        const char *dev_fmt, ...);
+        const char *dev_fmt, ...) __printf(3, 4);
 void clkdev_add(struct clk_lookup *cl);
 void clkdev_drop(struct clk_lookup *cl);
 struct clk_lookup *clkdev_create(struct clk *clk, const char *con_id,
-        const char *dev_fmt, ...);
+        const char *dev_fmt, ...) __printf(3, 4);
 void clkdev_add_table(struct clk_lookup *, size_t);
 int clk_add_alias(const char *, const char *, const char *, struct device *);
-int clk_register_clkdev(struct clk *, const char *, const char *, ...);
+int clk_register_clkdev(struct clk *, const char *, const char *, ...)
+        __printf(3, 4);
 int clk_register_clkdevs(struct clk *, struct clk_lookup *, size_t);
 #ifdef CONFIG_COMMON_CLK
diff --git a/include/linux/compat.h b/include/linux/compat.h
index ab25814690bc..a76c9172b2eb 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -424,7 +424,7 @@ asmlinkage long compat_sys_settimeofday(struct compat_timeval __user *tv,
 asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp);
-extern int compat_printk(const char *fmt, ...);
+extern __printf(1, 2) int compat_printk(const char *fmt, ...);
 extern void sigset_from_compat(sigset_t *set, const compat_sigset_t *compat);
 extern void sigset_to_compat(compat_sigset_t *compat, const sigset_t *set);
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index c9e5c57e4edf..63a36e89d0eb 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -64,7 +64,8 @@ struct config_item {
        struct dentry           *ci_dentry;
 };
-extern int config_item_set_name(struct config_item *, const char *, ...);
+extern __printf(2, 3)
+int config_item_set_name(struct config_item *, const char *, ...);
 static inline char *config_item_name(struct config_item * item)
 {
diff --git a/include/linux/cper.h b/include/linux/cper.h
index 76abba4b238e..dcacb1a72e26 100644
--- a/include/linux/cper.h
+++ b/include/linux/cper.h
@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
        __u64   mm_reg_addr;
 };
-/* Memory Error Section */
+/* Old Memory Error Section UEFI 2.1, 2.2 */
+struct cper_sec_mem_err_old {
+        __u64   validation_bits;
+        __u64   error_status;
+        __u64   physical_addr;
+        __u64   physical_addr_mask;
+        __u16   node;
+        __u16   card;
+        __u16   module;
+        __u16   bank;
+        __u16   device;
+        __u16   row;
+        __u16   column;
+        __u16   bit_pos;
+        __u64   requestor_id;
+        __u64   responder_id;
+        __u64   target_id;
+        __u8    error_type;
+};
+/* Memory Error Section UEFI >= 2.3 */
 struct cper_sec_mem_err {
        __u64   validation_bits;
        __u64   error_status;
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index c0fb6b1b4712..23c30bdcca86 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -40,9 +40,10 @@ extern void cpu_remove_dev_attr(struct device_attribute *attr);
 extern int cpu_add_dev_attr_group(struct attribute_group *attrs);
 extern void cpu_remove_dev_attr_group(struct attribute_group *attrs);
-extern struct device *cpu_device_create(struct device *parent, void *drvdata,
+extern __printf(4, 5)
-                                        const struct attribute_group **groups,
+struct device *cpu_device_create(struct device *parent, void *drvdata,
-                                        const char *fmt, ...);
+                                 const struct attribute_group **groups,
+                                 const char *fmt, ...);
 #ifdef CONFIG_HOTPLUG_CPU
 extern void unregister_cpu(struct cpu *cpu);
 extern ssize_t arch_cpu_probe(const char *, size_t);
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 29ad97c34fd5..bde1e567b3a9 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -62,6 +62,7 @@ struct cpufreq_policy {
        /* CPUs sharing clock, require sw coordination */
        cpumask_var_t           cpus;   /* Online CPUs only */
        cpumask_var_t           related_cpus; /* Online + Offline CPUs */
+        cpumask_var_t           real_cpus; /* Related and present */
        unsigned int            shared_type; /* ACPI: ANY or ALL affected CPUs
                                                should set cpufreq */
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d2d50249b7b2..d67ae119cf4e 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -327,7 +327,8 @@ static inline unsigned d_count(const struct dentry *dentry)
 /*
 * helper function for dentry_operations.d_dname() members
 */
-extern char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
+extern __printf(4, 5)
+char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
 extern char *simple_dname(struct dentry *, char *, int);
 extern char *__d_path(const struct path *, const struct path *, char *, int);
diff --git a/include/linux/device.h b/include/linux/device.h
index 5a31bf3a4024..a2b4ea70a946 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -637,8 +637,9 @@ extern int devres_release_group(struct device *dev, void *id);
 /* managed devm_k.alloc/kfree for device drivers */
 extern void *devm_kmalloc(struct device *dev, size_t size, gfp_t gfp);
-extern char *devm_kvasprintf(struct device *dev, gfp_t gfp, const char *fmt,
+extern __printf(3, 0)
-                             va_list ap);
+char *devm_kvasprintf(struct device *dev, gfp_t gfp, const char *fmt,
+                      va_list ap);
 extern __printf(3, 4)
 char *devm_kasprintf(struct device *dev, gfp_t gfp, const char *fmt, ...);
 static inline void *devm_kzalloc(struct device *dev, size_t size, gfp_t gfp)
@@ -1011,12 +1012,10 @@ extern int __must_check device_reprobe(struct device *dev);
 /*
 * Easy functions for dynamically creating devices on the fly
 */
-extern struct device *device_create_vargs(struct class *cls,
+extern __printf(5, 0)
-                                          struct device *parent,
+struct device *device_create_vargs(struct class *cls, struct device *parent,
-                                          dev_t devt,
+                                   dev_t devt, void *drvdata,
-                                          void *drvdata,
+                                   const char *fmt, va_list vargs);
-                                          const char *fmt,
-                                          va_list vargs);
 extern __printf(5, 6)
 struct device *device_create(struct class *cls, struct device *parent,
                             dev_t devt, void *drvdata,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a0653e560c26..cc008c338f5a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1046,12 +1046,12 @@ extern void locks_remove_file(struct file *);
 extern void locks_release_private(struct file_lock *);
 extern void posix_test_lock(struct file *, struct file_lock *);
 extern int posix_lock_file(struct file *, struct file_lock *, struct file_lock *);
-extern int posix_lock_file_wait(struct file *, struct file_lock *);
+extern int posix_lock_inode_wait(struct inode *, struct file_lock *);
 extern int posix_unblock_lock(struct file_lock *);
 extern int vfs_test_lock(struct file *, struct file_lock *);
 extern int vfs_lock_file(struct file *, unsigned int, struct file_lock *, struct file_lock *);
 extern int vfs_cancel_lock(struct file *filp, struct file_lock *fl);
-extern int flock_lock_file_wait(struct file *filp, struct file_lock *fl);
+extern int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl);
 extern int __break_lease(struct inode *inode, unsigned int flags, unsigned int type);
 extern void lease_get_mtime(struct inode *, struct timespec *time);
 extern int generic_setlease(struct file *, long, struct file_lock **, void **priv);
@@ -1137,7 +1137,8 @@ static inline int posix_lock_file(struct file *filp, struct file_lock *fl,
        return -ENOLCK;
 }
-static inline int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+static inline int posix_lock_inode_wait(struct inode *inode,
+                                        struct file_lock *fl)
 {
        return -ENOLCK;
 }
@@ -1163,8 +1164,8 @@ static inline int vfs_cancel_lock(struct file *filp, struct file_lock *fl)
        return 0;
 }
-static inline int flock_lock_file_wait(struct file *filp,
+static inline int flock_lock_inode_wait(struct inode *inode,
-                                       struct file_lock *request)
+                                        struct file_lock *request)
 {
        return -ENOLCK;
 }
@@ -1202,6 +1203,20 @@ static inline void show_fd_locks(struct seq_file *f,
                        struct file *filp, struct files_struct *files) {}
 #endif /* !CONFIG_FILE_LOCKING */
+static inline struct inode *file_inode(const struct file *f)
+{
+        return f->f_inode;
+}
+static inline int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+{
+        return posix_lock_inode_wait(file_inode(filp), fl);
+}
+static inline int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
+{
+        return flock_lock_inode_wait(file_inode(filp), fl);
+}
 struct fasync_struct {
        spinlock_t              fa_lock;
@@ -2011,11 +2026,6 @@ extern void ihold(struct inode * inode);
 extern void iput(struct inode *);
 extern int generic_update_time(struct inode *, struct timespec *, int);
-static inline struct inode *file_inode(const struct file *f)
-{
-        return f->f_inode;
-}
 /* /sys/fs */
 extern struct kobject *fs_kobj;
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 1da602982cf9..6cd8c0ee4b6f 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
 *            SAVE_REGS. If another ops with this flag set is already registered
 *            for any of the functions that this ops will be registered for, then
 *            this ops will fail to register or set_filter_ip.
+ * PID     - Is affected by set_ftrace_pid (allows filtering on those pids)
 */
 enum {
        FTRACE_OPS_FL_ENABLED                   = 1 << 0,
@@ -132,6 +133,7 @@ enum {
        FTRACE_OPS_FL_MODIFYING                 = 1 << 11,
        FTRACE_OPS_FL_ALLOC_TRAMP               = 1 << 12,
        FTRACE_OPS_FL_IPMODIFY                  = 1 << 13,
+        FTRACE_OPS_FL_PID                       = 1 << 14,
 };
 #ifdef CONFIG_DYNAMIC_FTRACE
@@ -159,6 +161,7 @@ struct ftrace_ops {
        struct ftrace_ops               *next;
        unsigned long                   flags;
        void                            *private;
+        ftrace_func_t                   saved_func;
        int __percpu                    *disabled;
 #ifdef CONFIG_DYNAMIC_FTRACE
        int                             nr_trampolines;
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index cc7ec129b329..c8393cd4d44f 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -45,7 +45,7 @@ struct seq_file;
 * @base: identifies the first GPIO number handled by this chip;
 *      or, if negative during registration, requests dynamic ID allocation.
 *      DEPRECATION: providing anything non-negative and nailing the base
- *      base offset of GPIO chips is deprecated. Please pass -1 as base to
+ *      offset of GPIO chips is deprecated. Please pass -1 as base to
 *      let gpiolib select the chip base in all possible cases. We want to
 *      get rid of the static GPIO number space in the long run.
 * @ngpio: the number of GPIOs handled by this controller; the last GPIO
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 0042bf330b99..c02b5ce6c5cd 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -230,6 +230,7 @@ struct hid_sensor_common {
        struct platform_device *pdev;
        unsigned usage_id;
        atomic_t data_ready;
+        atomic_t user_requested_state;
        struct iio_trigger *trigger;
        struct hid_sensor_hub_attribute_info poll;
        struct hid_sensor_hub_attribute_info report_state;
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 205026175c42..d891f949466a 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -460,15 +460,14 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
        return &mm->page_table_lock;
 }
-static inline bool hugepages_supported(void)
+#ifndef hugepages_supported
-{
+/*
-        /*
+ * Some platform decide whether they support huge pages at boot
-         * Some platform decide whether they support huge pages at boot
+ * time. Some of them, such as powerpc, set HPAGE_SHIFT to 0
-         * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when
+ * when there is no such support
-         * there is no such support
+ */
-         */
+#define hugepages_supported() (HPAGE_SHIFT != 0)
-        return HPAGE_SHIFT != 0;
+#endif
-}
 #else   /* CONFIG_HUGETLB_PAGE */
 struct hstate {};
diff --git a/include/linux/init.h b/include/linux/init.h
index 7c68c36d3fd8..b449f378f995 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -282,68 +282,8 @@ void __init parse_early_param(void);
 void __init parse_early_options(char *cmdline);
 #endif /* __ASSEMBLY__ */
-/**
- * module_init() - driver initialization entry point
- * @x: function to be run at kernel boot time or module insertion
- * 
- * module_init() will either be called during do_initcalls() (if
- * builtin) or at module insertion time (if a module).  There can only
- * be one per module.
- */
-#define module_init(x)  __initcall(x);
-/**
- * module_exit() - driver exit entry point
- * @x: function to be run when driver is removed
- * 
- * module_exit() will wrap the driver clean-up code
- * with cleanup_module() when used with rmmod when
- * the driver is a module.  If the driver is statically
- * compiled into the kernel, module_exit() has no effect.
- * There can only be one per module.
- */
-#define module_exit(x)  __exitcall(x);
 #else /* MODULE */
-/*
- * In most cases loadable modules do not need custom
- * initcall levels. There are still some valid cases where
- * a driver may be needed early if built in, and does not
- * matter when built as a loadable module. Like bus
- * snooping debug drivers.
- */
-#define early_initcall(fn)              module_init(fn)
-#define core_initcall(fn)               module_init(fn)
-#define core_initcall_sync(fn)          module_init(fn)
-#define postcore_initcall(fn)           module_init(fn)
-#define postcore_initcall_sync(fn)      module_init(fn)
-#define arch_initcall(fn)               module_init(fn)
-#define subsys_initcall(fn)             module_init(fn)
-#define subsys_initcall_sync(fn)        module_init(fn)
-#define fs_initcall(fn)                 module_init(fn)
-#define fs_initcall_sync(fn)            module_init(fn)
-#define rootfs_initcall(fn)             module_init(fn)
-#define device_initcall(fn)             module_init(fn)
-#define device_initcall_sync(fn)        module_init(fn)
-#define late_initcall(fn)               module_init(fn)
-#define late_initcall_sync(fn)          module_init(fn)
-#define console_initcall(fn)            module_init(fn)
-#define security_initcall(fn)           module_init(fn)
-/* Each module must use one module_init(). */
-#define module_init(initfn)                                     \
-        static inline initcall_t __inittest(void)               \
-        { return initfn; }                                      \
-        int init_module(void) __attribute__((alias(#initfn)));
-/* This is only required if you want to be unloadable. */
-#define module_exit(exitfn)                                     \
-        static inline exitcall_t __exittest(void)               \
-        { return exitfn; }                                      \
-        void cleanup_module(void) __attribute__((alias(#exitfn)));
 #define __setup_param(str, unique_id, fn)       /* nothing */
 #define __setup(str, func)                      /* nothing */
 #endif
@@ -351,24 +291,6 @@ void __init parse_early_options(char *cmdline);
 /* Data marked not to be saved by software suspend */
 #define __nosavedata __section(.data..nosave)
-/* This means "can be init if no module support, otherwise module load
-   may call it." */
-#ifdef CONFIG_MODULES
-#define __init_or_module
-#define __initdata_or_module
-#define __initconst_or_module
-#define __INIT_OR_MODULE        .text
-#define __INITDATA_OR_MODULE    .data
-#define __INITRODATA_OR_MODULE  .section ".rodata","a",%progbits
-#else
-#define __init_or_module __init
-#define __initdata_or_module __initdata
-#define __initconst_or_module __initconst
-#define __INIT_OR_MODULE __INIT
-#define __INITDATA_OR_MODULE __INITDATA
-#define __INITRODATA_OR_MODULE __INITRODATA
-#endif /*CONFIG_MODULES*/
 #ifdef MODULE
 #define __exit_p(x) x
 #else
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index dc767f7c3704..f9c1b6d0f2e4 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -258,7 +258,7 @@ extern int iommu_domain_set_attr(struct iommu_domain *domain, enum iommu_attr,
                                 void *data);
 struct device *iommu_device_create(struct device *parent, void *drvdata,
                                   const struct attribute_group **groups,
-                                   const char *fmt, ...);
+                                   const char *fmt, ...) __printf(4, 5);
 void iommu_device_destroy(struct device *dev);
 int iommu_device_link(struct device *dev, struct device *link);
 void iommu_device_unlink(struct device *dev, struct device *link);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 5f0be58640ea..5582410727cb 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -411,7 +411,8 @@ extern __printf(3, 0)
 int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
 extern __printf(2, 3)
 char *kasprintf(gfp_t gfp, const char *fmt, ...);
-extern char *kvasprintf(gfp_t gfp, const char *fmt, va_list args);
+extern __printf(2, 0)
+char *kvasprintf(gfp_t gfp, const char *fmt, va_list args);
 extern __scanf(2, 3)
 int sscanf(const char *, const char *, ...);
@@ -679,10 +680,10 @@ do {									\
                __ftrace_vprintk(_THIS_IP_, fmt, vargs);                \
 } while (0)
-extern int
+extern __printf(2, 0) int
 __ftrace_vbprintk(unsigned long ip, const char *fmt, va_list ap);
-extern int
+extern __printf(2, 0) int
 __ftrace_vprintk(unsigned long ip, const char *fmt, va_list ap);
 extern void ftrace_dump(enum ftrace_dump_mode oops_dump_mode);
@@ -702,7 +703,7 @@ int trace_printk(const char *fmt, ...)
 {
        return 0;
 }
-static inline int
+static __printf(1, 0) inline int
 ftrace_vprintk(const char *fmt, va_list ap)
 {
        return 0;
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 2d61b909f414..637f67002c5a 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -80,8 +80,9 @@ struct kobject {
 extern __printf(2, 3)
 int kobject_set_name(struct kobject *kobj, const char *name, ...);
-extern int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
+extern __printf(2, 0)
-                                  va_list vargs);
+int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
+                           va_list vargs);
 static inline const char *kobject_name(const struct kobject *kobj)
 {
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 9564fd78c547..05e99b8ef465 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -734,6 +734,24 @@ static inline bool kvm_arch_has_noncoherent_dma(struct kvm *kvm)
        return false;
 }
 #endif
+#ifdef __KVM_HAVE_ARCH_ASSIGNED_DEVICE
+void kvm_arch_start_assignment(struct kvm *kvm);
+void kvm_arch_end_assignment(struct kvm *kvm);
+bool kvm_arch_has_assigned_device(struct kvm *kvm);
+#else
+static inline void kvm_arch_start_assignment(struct kvm *kvm)
+{
+}
+static inline void kvm_arch_end_assignment(struct kvm *kvm)
+{
+}
+static inline bool kvm_arch_has_assigned_device(struct kvm *kvm)
+{
+        return false;
+}
+#endif
 static inline wait_queue_head_t *kvm_arch_vcpu_wq(struct kvm_vcpu *vcpu)
 {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 36ce37bcc963..c9cfbcdb8d14 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -431,6 +431,8 @@ enum {
        ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),  /* some WDs have broken LPM */
        ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
        ATA_HORKAGE_NO_NCQ_LOG  = (1 << 23),    /* don't use NCQ for log read */
+        ATA_HORKAGE_NOTRIM      = (1 << 24),    /* don't use TRIM */
+        ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),   /* Limit max sects to 1024 */
         /* DMA mask for user DMA control: User visible values; DO NOT
            renumber */
diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
index c5d52780d6a0..3ba327af055c 100644
--- a/include/linux/mmiotrace.h
+++ b/include/linux/mmiotrace.h
@@ -106,6 +106,6 @@ extern void enable_mmiotrace(void);
 extern void disable_mmiotrace(void);
 extern void mmio_trace_rw(struct mmiotrace_rw *rw);
 extern void mmio_trace_mapping(struct mmiotrace_map *map);
-extern int mmio_trace_printk(const char *fmt, va_list args);
+extern __printf(1, 0) int mmio_trace_printk(const char *fmt, va_list args);
 #endif /* _LINUX_MMIOTRACE_H */
diff --git a/include/linux/module.h b/include/linux/module.h
index d67b1932cc59..3a19c79918e0 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -11,6 +11,7 @@
 #include <linux/compiler.h>
 #include <linux/cache.h>
 #include <linux/kmod.h>
+#include <linux/init.h>
 #include <linux/elf.h>
 #include <linux/stringify.h>
 #include <linux/kobject.h>
@@ -71,6 +72,89 @@ extern struct module_attribute module_uevent;
 extern int init_module(void);
 extern void cleanup_module(void);
+#ifndef MODULE
+/**
+ * module_init() - driver initialization entry point
+ * @x: function to be run at kernel boot time or module insertion
+ *
+ * module_init() will either be called during do_initcalls() (if
+ * builtin) or at module insertion time (if a module).  There can only
+ * be one per module.
+ */
+#define module_init(x)  __initcall(x);
+/**
+ * module_exit() - driver exit entry point
+ * @x: function to be run when driver is removed
+ *
+ * module_exit() will wrap the driver clean-up code
+ * with cleanup_module() when used with rmmod when
+ * the driver is a module.  If the driver is statically
+ * compiled into the kernel, module_exit() has no effect.
+ * There can only be one per module.
+ */
+#define module_exit(x)  __exitcall(x);
+#else /* MODULE */
+/*
+ * In most cases loadable modules do not need custom
+ * initcall levels. There are still some valid cases where
+ * a driver may be needed early if built in, and does not
+ * matter when built as a loadable module. Like bus
+ * snooping debug drivers.
+ */
+#define early_initcall(fn)              module_init(fn)
+#define core_initcall(fn)               module_init(fn)
+#define core_initcall_sync(fn)          module_init(fn)
+#define postcore_initcall(fn)           module_init(fn)
+#define postcore_initcall_sync(fn)      module_init(fn)
+#define arch_initcall(fn)               module_init(fn)
+#define subsys_initcall(fn)             module_init(fn)
+#define subsys_initcall_sync(fn)        module_init(fn)
+#define fs_initcall(fn)                 module_init(fn)
+#define fs_initcall_sync(fn)            module_init(fn)
+#define rootfs_initcall(fn)             module_init(fn)
+#define device_initcall(fn)             module_init(fn)
+#define device_initcall_sync(fn)        module_init(fn)
+#define late_initcall(fn)               module_init(fn)
+#define late_initcall_sync(fn)          module_init(fn)
+#define console_initcall(fn)            module_init(fn)
+#define security_initcall(fn)           module_init(fn)
+/* Each module must use one module_init(). */
+#define module_init(initfn)                                     \
+        static inline initcall_t __inittest(void)               \
+        { return initfn; }                                      \
+        int init_module(void) __attribute__((alias(#initfn)));
+/* This is only required if you want to be unloadable. */
+#define module_exit(exitfn)                                     \
+        static inline exitcall_t __exittest(void)               \
+        { return exitfn; }                                      \
+        void cleanup_module(void) __attribute__((alias(#exitfn)));
+#endif
+/* This means "can be init if no module support, otherwise module load
+   may call it." */
+#ifdef CONFIG_MODULES
+#define __init_or_module
+#define __initdata_or_module
+#define __initconst_or_module
+#define __INIT_OR_MODULE        .text
+#define __INITDATA_OR_MODULE    .data
+#define __INITRODATA_OR_MODULE  .section ".rodata","a",%progbits
+#else
+#define __init_or_module __init
+#define __initdata_or_module __initdata
+#define __initconst_or_module __initconst
+#define __INIT_OR_MODULE __INIT
+#define __INITDATA_OR_MODULE __INITDATA
+#define __INITRODATA_OR_MODULE __INITRODATA
+#endif /*CONFIG_MODULES*/
 /* Archs provide a method of finding the correct exception table. */
 struct exception_table_entry;
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index f25e2bdd188c..272f42952f34 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -178,17 +178,17 @@ typedef enum {
 /* Chip may not exist, so silence any errors in scan */
 #define NAND_SCAN_SILENT_NODEV  0x00040000
 /*
- * This option could be defined by controller drivers to protect against
- * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
- */
-#define NAND_USE_BOUNCE_BUFFER  0x00080000
-/*
 * Autodetect nand buswidth with readid/onfi.
 * This suppose the driver will configure the hardware in 8 bits mode
 * when calling nand_scan_ident, and update its configuration
 * before calling nand_scan_tail.
 */
 #define NAND_BUSWIDTH_AUTO      0x00080000
+/*
+ * This option could be defined by controller drivers to protect against
+ * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
+ */
+#define NAND_USE_BOUNCE_BUFFER  0x00100000
 /* Options set by nand scan */
 /* Nand scan has allocated controller struct */
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index f91b5ade30c9..874b77228fb9 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -292,9 +292,12 @@ static inline void nfs_mark_for_revalidate(struct inode *inode)
        struct nfs_inode *nfsi = NFS_I(inode);
        spin_lock(&inode->i_lock);
-        nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS;
+        nfsi->cache_validity |= NFS_INO_INVALID_ATTR |
+                                NFS_INO_REVAL_PAGECACHE |
+                                NFS_INO_INVALID_ACCESS |
+                                NFS_INO_INVALID_ACL;
        if (S_ISDIR(inode->i_mode))
-                nfsi->cache_validity |= NFS_INO_REVAL_PAGECACHE|NFS_INO_INVALID_DATA;
+                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
        spin_unlock(&inode->i_lock);
 }
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index a2ea1491d3df..20bc8e51b161 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -220,7 +220,7 @@ struct nfs_server {
 #define NFS_CAP_SYMLINKS        (1U << 2)
 #define NFS_CAP_ACLS            (1U << 3)
 #define NFS_CAP_ATOMIC_OPEN     (1U << 4)
-#define NFS_CAP_CHANGE_ATTR     (1U << 5)
+/* #define NFS_CAP_CHANGE_ATTR  (1U << 5) */
 #define NFS_CAP_FILEID          (1U << 6)
 #define NFS_CAP_MODE            (1U << 7)
 #define NFS_CAP_NLINK           (1U << 8)
diff --git a/include/linux/of_device.h b/include/linux/of_device.h
index 4c508549833a..cc7dd687a89d 100644
--- a/include/linux/of_device.h
+++ b/include/linux/of_device.h
@@ -59,7 +59,7 @@ void of_dma_configure(struct device *dev, struct device_node *np);
 #else /* CONFIG_OF */
 static inline int of_driver_match_device(struct device *dev,
-                                         struct device_driver *drv)
+                                         const struct device_driver *drv)
 {
        return 0;
 }
diff --git a/include/linux/page_owner.h b/include/linux/page_owner.h
index b48c3471c254..cacaabea8a09 100644
--- a/include/linux/page_owner.h
+++ b/include/linux/page_owner.h
@@ -8,6 +8,7 @@ extern struct page_ext_operations page_owner_ops;
 extern void __reset_page_owner(struct page *page, unsigned int order);
 extern void __set_page_owner(struct page *page,
                        unsigned int order, gfp_t gfp_mask);
+extern gfp_t __get_page_owner_gfp(struct page *page);
 static inline void reset_page_owner(struct page *page, unsigned int order)
 {
@@ -25,6 +26,14 @@ static inline void set_page_owner(struct page *page,
        __set_page_owner(page, order, gfp_mask);
 }
+static inline gfp_t get_page_owner_gfp(struct page *page)
+{
+        if (likely(!page_owner_inited))
+                return 0;
+        return __get_page_owner_gfp(page);
+}
 #else
 static inline void reset_page_owner(struct page *page, unsigned int order)
 {
@@ -33,6 +42,10 @@ static inline void set_page_owner(struct page *page,
                        unsigned int order, gfp_t gfp_mask)
 {
 }
+static inline gfp_t get_page_owner_gfp(struct page *page)
+{
+        return 0;
+}
 #endif /* CONFIG_PAGE_OWNER */
 #endif /* __LINUX_PAGE_OWNER_H */
diff --git a/include/linux/pata_arasan_cf_data.h b/include/linux/pata_arasan_cf_data.h
index 3cc21c9cc1e8..9fade5dd2e86 100644
--- a/include/linux/pata_arasan_cf_data.h
+++ b/include/linux/pata_arasan_cf_data.h
@@ -4,7 +4,7 @@
 * Arasan Compact Flash host controller platform data header file
 *
 * Copyright (C) 2011 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/include/linux/platform_data/mmc-esdhc-imx.h b/include/linux/platform_data/mmc-esdhc-imx.h
index 75f70f6ac137..e1571efa3f2b 100644
--- a/include/linux/platform_data/mmc-esdhc-imx.h
+++ b/include/linux/platform_data/mmc-esdhc-imx.h
@@ -43,7 +43,6 @@ struct esdhc_platform_data {
        enum wp_types wp_type;
        enum cd_types cd_type;
        int max_bus_width;
-        unsigned int f_max;
        bool support_vsel;
        unsigned int delay_line;
 };
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 58b1fec40d37..a6298b27ac99 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -122,7 +122,7 @@ static inline __printf(1, 2) __cold
 void early_printk(const char *s, ...) { }
 #endif
-typedef int(*printk_func_t)(const char *fmt, va_list args);
+typedef __printf(1, 0) int (*printk_func_t)(const char *fmt, va_list args);
 #ifdef CONFIG_PRINTK
 asmlinkage __printf(5, 0)
@@ -166,7 +166,7 @@ char *log_buf_addr_get(void);
 u32 log_buf_len_get(void);
 void log_buf_kexec_setup(void);
 void __init setup_log_buf(int early);
-void dump_stack_set_arch_desc(const char *fmt, ...);
+__printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...);
 void dump_stack_print_info(const char *log_lvl);
 void show_regs_print_info(const char *log_lvl);
 #else
@@ -217,7 +217,7 @@ static inline void setup_log_buf(int early)
 {
 }
-static inline void dump_stack_set_arch_desc(const char *fmt, ...)
+static inline __printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...)
 {
 }
diff --git a/include/linux/sched.h b/include/linux/sched.h
index ae21f1591615..04b5ada460b4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1522,8 +1522,6 @@ struct task_struct {
 /* hung task detection */
        unsigned long last_switch_count;
 #endif
-/* CPU-specific state of this task */
-        struct thread_struct thread;
 /* filesystem information */
        struct fs_struct *fs;
 /* open file information */
@@ -1778,8 +1776,22 @@ struct task_struct {
        unsigned long   task_state_change;
 #endif
        int pagefault_disabled;
+/* CPU-specific state of this task */
+        struct thread_struct thread;
+/*
+ * WARNING: on x86, 'thread_struct' contains a variable-sized
+ * structure.  It *MUST* be at the end of 'task_struct'.
+ *
+ * Do not put anything below here!
+ */
 };
+#ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
+extern int arch_task_struct_size __read_mostly;
+#else
+# define arch_task_struct_size (sizeof(struct task_struct))
+#endif
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 7c9b484735c5..1f6526c76ee8 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -80,6 +80,9 @@
 #define CDC_NCM_TIMER_INTERVAL_MIN              5UL
 #define CDC_NCM_TIMER_INTERVAL_MAX              (U32_MAX / NSEC_PER_USEC)
+/* Driver flags */
+#define CDC_NCM_FLAG_NDP_TO_END 0x02            /* NDP is placed at end of frame */
 #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
                                       (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
 #define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
@@ -103,9 +106,11 @@ struct cdc_ncm_ctx {
        spinlock_t mtx;
        atomic_t stop;
+        int drvflags;
        u32 timer_interval;
        u32 max_ndp_size;
+        struct usb_cdc_ncm_ndp16 *delayed_ndp16;
        u32 tx_timer_pending;
        u32 tx_curr_frame_num;
@@ -133,7 +138,7 @@ struct cdc_ncm_ctx {
 };
 u8 cdc_ncm_select_altsetting(struct usb_interface *intf);
-int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
+int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags);
 void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
 struct sk_buff *cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign);
 int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a741678f24a2..883fe1e7c5a1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4868,6 +4868,23 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
                             struct cfg80211_chan_def *chandef,
                             enum nl80211_iftype iftype);
+/**
+ * cfg80211_reg_can_beacon_relax - check if beaconing is allowed with relaxation
+ * @wiphy: the wiphy
+ * @chandef: the channel definition
+ * @iftype: interface type
+ *
+ * Return: %true if there is no secondary channel or the secondary channel(s)
+ * can be used for beaconing (i.e. is not a radar channel etc.). This version
+ * also checks if IR-relaxation conditions apply, to allow beaconing under
+ * more permissive conditions.
+ *
+ * Requires the RTNL to be held.
+ */
+bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+                                   struct cfg80211_chan_def *chandef,
+                                   enum nl80211_iftype iftype);
 /*
 * cfg80211_ch_switch_notify - update wdev channel and notify userspace
 * @dev: the device which switched channels
diff --git a/include/net/ip.h b/include/net/ip.h
index 0750a186ea63..d5fe9f2ab699 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -161,6 +161,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk)
 }
 /* datagram.c */
+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 void ip4_datagram_release_cb(struct sock *sk);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 986fddb08579..b0f898e3b2e7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1745,6 +1745,7 @@ struct ib_device {
        char                         node_desc[64];
        __be64                       node_guid;
        u32                          local_dma_lkey;
+        u16                          is_switch:1;
        u8                           node_type;
        u8                           phys_port_cnt;
@@ -1824,6 +1825,20 @@ enum rdma_link_layer rdma_port_get_link_layer(struct ib_device *device,
                                               u8 port_num);
 /**
+ * rdma_cap_ib_switch - Check if the device is IB switch
+ * @device: Device to check
+ *
+ * Device driver is responsible for setting is_switch bit on
+ * in ib_device structure at init time.
+ *
+ * Return: true if the device is IB switch.
+ */
+static inline bool rdma_cap_ib_switch(const struct ib_device *device)
+{
+        return device->is_switch;
+}
+/**
 * rdma_start_port - Return the first valid port number for the device
 * specified
 *
@@ -1833,7 +1848,7 @@ enum rdma_link_layer rdma_port_get_link_layer(struct ib_device *device,
 */
 static inline u8 rdma_start_port(const struct ib_device *device)
 {
-        return (device->node_type == RDMA_NODE_IB_SWITCH) ? 0 : 1;
+        return rdma_cap_ib_switch(device) ? 0 : 1;
 }
 /**
@@ -1846,8 +1861,7 @@ static inline u8 rdma_start_port(const struct ib_device *device)
 */
 static inline u8 rdma_end_port(const struct ib_device *device)
 {
-        return (device->node_type == RDMA_NODE_IB_SWITCH) ?
+        return rdma_cap_ib_switch(device) ? 0 : device->phys_port_cnt;
-                0 : device->phys_port_cnt;
 }
 static inline bool rdma_protocol_ib(const struct ib_device *device, u8 port_num)
diff --git a/include/scsi/scsi_transport_srp.h b/include/scsi/scsi_transport_srp.h
index cdb05dd1d440..d40d3ef25707 100644
--- a/include/scsi/scsi_transport_srp.h
+++ b/include/scsi/scsi_transport_srp.h
@@ -119,6 +119,7 @@ extern struct srp_rport *srp_rport_add(struct Scsi_Host *,
 extern void srp_rport_del(struct srp_rport *);
 extern int srp_tmo_valid(int reconnect_delay, int fast_io_fail_tmo,
                         int dev_loss_tmo);
+int srp_parse_tmo(int *tmo, const char *buf);
 extern int srp_reconnect_rport(struct srp_rport *rport);
 extern void srp_start_tl_fail_timers(struct srp_rport *rport);
 extern void srp_remove_host(struct Scsi_Host *);
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 34117b8b72e4..0aedbb2c10e0 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -595,6 +595,7 @@ struct iscsi_conn {
        int                     bitmap_id;
        int                     rx_thread_active;
        struct task_struct      *rx_thread;
+        struct completion       rx_login_comp;
        int                     tx_thread_active;
        struct task_struct      *tx_thread;
        /* list_head for session connection list */
diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
index b6fce900a833..d708a53b8fb1 100644
--- a/include/uapi/drm/amdgpu_drm.h
+++ b/include/uapi/drm/amdgpu_drm.h
@@ -614,6 +614,8 @@ struct drm_amdgpu_info_device {
        uint32_t vram_type;
        /** video memory bit width*/
        uint32_t vram_bit_width;
+        /* vce harvesting instance */
+        uint32_t vce_harvest_config;
 };
 struct drm_amdgpu_info_hw_ip {
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index 6e1a2ed116cb..db809b722985 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -1070,6 +1070,14 @@ struct drm_i915_reg_read {
        __u64 offset;
        __u64 val; /* Return value */
 };
+/* Known registers:
+ *
+ * Render engine timestamp - 0x2358 + 64bit - gen7+
+ * - Note this register returns an invalid value if using the default
+ *   single instruction 8byte read, in order to workaround that use
+ *   offset (0x2538 | 1) instead.
+ *
+ */
 struct drm_i915_reset_stats {
        __u32 ctx_id;
diff --git a/include/uapi/linux/netconf.h b/include/uapi/linux/netconf.h
index 669a1f0b1d97..23cbd34e4ac7 100644
--- a/include/uapi/linux/netconf.h
+++ b/include/uapi/linux/netconf.h
@@ -15,6 +15,7 @@ enum {
        NETCONFA_RP_FILTER,
        NETCONFA_MC_FORWARDING,
        NETCONFA_PROXY_NEIGH,
+        NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
        __NETCONFA_MAX
 };
 #define NETCONFA_MAX    (__NETCONFA_MAX - 1)
diff --git a/include/uapi/linux/virtio_net.h b/include/uapi/linux/virtio_net.h
index 7bbee79ca293..ec32293a00db 100644
--- a/include/uapi/linux/virtio_net.h
+++ b/include/uapi/linux/virtio_net.h
@@ -34,6 +34,7 @@
 /* The feature bitmap for virtio net */
 #define VIRTIO_NET_F_CSUM       0       /* Host handles pkts w/ partial csum */
 #define VIRTIO_NET_F_GUEST_CSUM 1       /* Guest handles pkts w/ partial csum */
+#define VIRTIO_NET_F_CTRL_GUEST_OFFLOADS 2 /* Dynamic offload configuration. */
 #define VIRTIO_NET_F_MAC        5       /* Host has given MAC address. */
 #define VIRTIO_NET_F_GUEST_TSO4 7       /* Guest can handle TSOv4 in. */
 #define VIRTIO_NET_F_GUEST_TSO6 8       /* Guest can handle TSOv6 in. */
@@ -226,4 +227,19 @@ struct virtio_net_ctrl_mq {
 #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN        1
 #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX        0x8000
+/*
+ * Control network offloads
+ *
+ * Reconfigures the network offloads that Guest can handle.
+ *
+ * Available with the VIRTIO_NET_F_CTRL_GUEST_OFFLOADS feature bit.
+ *
+ * Command data format matches the feature bit mask exactly.
+ *
+ * See VIRTIO_NET_F_GUEST_* for the list of offloads
+ * that can be enabled/disabled.
+ */
+#define VIRTIO_NET_CTRL_GUEST_OFFLOADS   5
+#define VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET        0
 #endif /* _LINUX_VIRTIO_NET_H */
diff --git a/include/uapi/linux/virtio_pci.h b/include/uapi/linux/virtio_pci.h
index 75301468359f..90007a1abcab 100644
--- a/include/uapi/linux/virtio_pci.h
+++ b/include/uapi/linux/virtio_pci.h
@@ -157,6 +157,12 @@ struct virtio_pci_common_cfg {
        __le32 queue_used_hi;           /* read-write */
 };
+/* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
+struct virtio_pci_cfg_cap {
+        struct virtio_pci_cap cap;
+        __u8 pci_cfg_data[4]; /* Data for BAR access. */
+};
 /* Macro versions of offsets for the Old Timers! */
 #define VIRTIO_PCI_CAP_VNDR             0
 #define VIRTIO_PCI_CAP_NEXT             1
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 915980ac68df..c07295969b7e 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -31,6 +31,9 @@
 * SUCH DAMAGE.
 *
 * Copyright Rusty Russell IBM Corporation 2007. */
+#ifndef __KERNEL__
+#include <stdint.h>
+#endif
 #include <linux/types.h>
 #include <linux/virtio_types.h>
@@ -143,7 +146,7 @@ static inline void vring_init(struct vring *vr, unsigned int num, void *p,
        vr->num = num;
        vr->desc = p;
        vr->avail = p + num*sizeof(struct vring_desc);
-        vr->used = (void *)(((unsigned long)&vr->avail->ring[num] + sizeof(__virtio16)
+        vr->used = (void *)(((uintptr_t)&vr->avail->ring[num] + sizeof(__virtio16)
                + align-1) & ~(align - 1));
 }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 6a374544d495..5644ec5582b9 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -527,18 +527,9 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen)
                goto out_notify;
        }
-        /*
-         * Some architectures have to walk the irq descriptors to
-         * setup the vector space for the cpu which comes online.
-         * Prevent irq alloc/free across the bringup.
-         */
-        irq_lock_sparse();
        /* Arch-specific enabling code. */
        ret = __cpu_up(cpu, idle);
-        irq_unlock_sparse();
        if (ret != 0)
                goto out_notify;
        BUG_ON(!cpu_online(cpu));
diff --git a/kernel/fork.c b/kernel/fork.c
index 1bfefc6f96a4..dbd9b8d7b7cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -287,6 +287,11 @@ static void set_max_threads(unsigned int max_threads_suggested)
        max_threads = clamp_t(u64, threads, MIN_THREADS, MAX_THREADS);
 }
+#ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
+/* Initialized by the architecture: */
+int arch_task_struct_size __read_mostly;
+#endif
 void __init fork_init(void)
 {
 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
@@ -295,7 +300,7 @@ void __init fork_init(void)
 #endif
        /* create a slab on which task_structs can be allocated */
        task_struct_cachep =
-                kmem_cache_create("task_struct", sizeof(struct task_struct),
+                kmem_cache_create("task_struct", arch_task_struct_size,
                        ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
 #endif
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 9065107f083e..7a5237a1bce5 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
                    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
 #ifdef CONFIG_HARDIRQS_SW_RESEND
                        /*
-                         * If the interrupt has a parent irq and runs
+                         * If the interrupt is running in the thread
-                         * in the thread context of the parent irq,
+                         * context of the parent irq we need to be
-                         * retrigger the parent.
+                         * careful, because we cannot trigger it
+                         * directly.
                         */
-                        if (desc->parent_irq &&
+                        if (irq_settings_is_nested_thread(desc)) {
-                            irq_settings_is_nested_thread(desc))
+                                /*
+                                 * If the parent_irq is valid, we
+                                 * retrigger the parent, otherwise we
+                                 * do nothing.
+                                 */
+                                if (!desc->parent_irq)
+                                        return;
                                irq = desc->parent_irq;
+                        }
                        /* Set it pending and activate the softirq: */
                        set_bit(irq, irqs_resend);
                        tasklet_schedule(&resend_tasklet);
diff --git a/kernel/resource.c b/kernel/resource.c
index 90552aab5f2d..fed052a1bc9f 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -504,13 +504,13 @@ int region_is_ram(resource_size_t start, unsigned long size)
 {
        struct resource *p;
        resource_size_t end = start + size - 1;
-        int flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+        unsigned long flags = IORESOURCE_MEM | IORESOURCE_BUSY;
        const char *name = "System RAM";
        int ret = -1;
        read_lock(&resource_lock);
        for (p = iomem_resource.child; p ; p = p->sibling) {
-                if (end < p->start)
+                if (p->end < start)
                        continue;
                if (p->start <= start && end <= p->end) {
@@ -521,7 +521,7 @@ int region_is_ram(resource_size_t start, unsigned long size)
                                ret = 1;
                        break;
                }
-                if (p->end < start)
+                if (end < p->start)
                        break;  /* not found */
        }
        read_unlock(&resource_lock);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 65c8f3ebdc3c..d113c3ba8bc4 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3683,7 +3683,7 @@ static void throttle_cfs_rq(struct cfs_rq *cfs_rq)
        cfs_rq->throttled = 1;
        cfs_rq->throttled_clock = rq_clock(rq);
        raw_spin_lock(&cfs_b->lock);
-        empty = list_empty(&cfs_rq->throttled_list);
+        empty = list_empty(&cfs_b->throttled_cfs_rq);
        /*
         * Add to the _head_ of the list, so that an already-started
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 52b9e199b5ac..f6aae7977824 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -839,7 +839,6 @@ out:
        raw_spin_unlock(&tick_broadcast_lock);
        return ret;
 }
-EXPORT_SYMBOL_GPL(tick_broadcast_oneshot_control);
 /*
 * Reset the one shot broadcast for a cpu
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 55e13efff1ab..f8bf47571dda 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -363,6 +363,7 @@ int tick_broadcast_oneshot_control(enum tick_broadcast_state state)
        return __tick_broadcast_oneshot_control(state);
 }
+EXPORT_SYMBOL_GPL(tick_broadcast_oneshot_control);
 #ifdef CONFIG_HOTPLUG_CPU
 /*
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 02bece4a99ea..eb11011b5292 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -98,6 +98,13 @@ struct ftrace_pid {
        struct pid *pid;
 };
+static bool ftrace_pids_enabled(void)
+{
+        return !list_empty(&ftrace_pids);
+}
+static void ftrace_update_trampoline(struct ftrace_ops *ops);
 /*
 * ftrace_disabled is set when an anomaly is discovered.
 * ftrace_disabled is much stronger than ftrace_enabled.
@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
 static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
 static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
 ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
-ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
 static struct ftrace_ops global_ops;
 static struct ftrace_ops control_ops;
@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
        if (!test_tsk_trace_trace(current))
                return;
-        ftrace_pid_function(ip, parent_ip, op, regs);
+        op->saved_func(ip, parent_ip, op, regs);
-}
-static void set_ftrace_pid_function(ftrace_func_t func)
-{
-        /* do not set ftrace_pid_function to itself! */
-        if (func != ftrace_pid_func)
-                ftrace_pid_function = func;
 }
 /**
@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
 void clear_ftrace_function(void)
 {
        ftrace_trace_function = ftrace_stub;
-        ftrace_pid_function = ftrace_stub;
 }
 static void control_ops_disable_all(struct ftrace_ops *ops)
@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
        } else
                add_ftrace_ops(&ftrace_ops_list, ops);
+        /* Always save the function, and reset at unregistering */
+        ops->saved_func = ops->func;
+        if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
+                ops->func = ftrace_pid_func;
        ftrace_update_trampoline(ops);
        if (ftrace_enabled)
@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
        if (ftrace_enabled)
                update_ftrace_function();
+        ops->func = ops->saved_func;
        return 0;
 }
 static void ftrace_update_pid_func(void)
 {
+        bool enabled = ftrace_pids_enabled();
+        struct ftrace_ops *op;
        /* Only do something if we are tracing something */
        if (ftrace_trace_function == ftrace_stub)
                return;
+        do_for_each_ftrace_op(op, ftrace_ops_list) {
+                if (op->flags & FTRACE_OPS_FL_PID) {
+                        op->func = enabled ? ftrace_pid_func :
+                                op->saved_func;
+                        ftrace_update_trampoline(op);
+                }
+        } while_for_each_ftrace_op(op);
        update_ftrace_function();
 }
@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
        .local_hash.filter_hash         = EMPTY_HASH,
        INIT_OPS_HASH(global_ops)
        .flags                          = FTRACE_OPS_FL_RECURSION_SAFE |
-                                          FTRACE_OPS_FL_INITIALIZED,
+                                          FTRACE_OPS_FL_INITIALIZED |
+                                          FTRACE_OPS_FL_PID,
 };
 /*
@@ -5023,7 +5041,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
 static struct ftrace_ops global_ops = {
        .func                   = ftrace_stub,
-        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
+        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE |
+                                  FTRACE_OPS_FL_INITIALIZED |
+                                  FTRACE_OPS_FL_PID,
 };
 static int __init ftrace_nodyn_init(void)
@@ -5080,11 +5100,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
                if (WARN_ON(tr->ops->func != ftrace_stub))
                        printk("ftrace ops had %pS for function\n",
                               tr->ops->func);
-                /* Only the top level instance does pid tracing */
-                if (!list_empty(&ftrace_pids)) {
-                        set_ftrace_pid_function(func);
-                        func = ftrace_pid_func;
-                }
        }
        tr->ops->func = func;
        tr->ops->private = tr;
@@ -5371,7 +5386,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
 {
        mutex_lock(&ftrace_lock);
-        if (list_empty(&ftrace_pids) && (!*pos))
+        if (!ftrace_pids_enabled() && (!*pos))
                return (void *) 1;
        return seq_list_start(&ftrace_pids, *pos);
@@ -5610,6 +5625,7 @@ static struct ftrace_ops graph_ops = {
        .func                   = ftrace_stub,
        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE |
                                   FTRACE_OPS_FL_INITIALIZED |
+                                   FTRACE_OPS_FL_PID |
                                   FTRACE_OPS_FL_STUB,
 #ifdef FTRACE_GRAPH_TRAMP_ADDR
        .trampoline             = FTRACE_GRAPH_TRAMP_ADDR,
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index f060716b02ae..74bde81601a9 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -444,6 +444,7 @@ enum {
        TRACE_CONTROL_BIT,
+        TRACE_BRANCH_BIT,
 /*
 * Abuse of the trace_recursion.
 * As we need a way to maintain state if we are tracing the function
diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
index a87b43f49eb4..e2e12ad3186f 100644
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        struct trace_branch *entry;
        struct ring_buffer *buffer;
        unsigned long flags;
-        int cpu, pc;
+        int pc;
        const char *p;
+        if (current->trace_recursion & TRACE_BRANCH_BIT)
+                return;
        /*
         * I would love to save just the ftrace_likely_data pointer, but
         * this code can also be used by modules. Ugly things can happen
@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
        if (unlikely(!tr))
                return;
-        local_irq_save(flags);
+        raw_local_irq_save(flags);
-        cpu = raw_smp_processor_id();
+        current->trace_recursion |= TRACE_BRANCH_BIT;
-        data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+        data = this_cpu_ptr(tr->trace_buffer.data);
-        if (atomic_inc_return(&data->disabled) != 1)
+        if (atomic_read(&data->disabled))
                goto out;
        pc = preempt_count();
@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
                __buffer_unlock_commit(buffer, event);
 out:
-        atomic_dec(&data->disabled);
+        current->trace_recursion &= ~TRACE_BRANCH_BIT;
-        local_irq_restore(flags);
+        raw_local_irq_restore(flags);
 }
 static inline
diff --git a/lib/decompress.c b/lib/decompress.c
index 528ff932d8e4..62696dff5730 100644
--- a/lib/decompress.c
+++ b/lib/decompress.c
@@ -59,8 +59,11 @@ decompress_fn __init decompress_method(const unsigned char *inbuf, long len,
 {
        const struct compress_format *cf;
-        if (len < 2)
+        if (len < 2) {
+                if (name)
+                        *name = NULL;
                return NULL;    /* Need at least this much... */
+        }
        pr_debug("Compressed data magic: %#.2x %#.2x\n", inbuf[0], inbuf[1]);
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index ae4b65e17e64..dace71fe41f7 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *page)
        unsigned long flags;
        phys_addr_t cln;
+        if (dma_debug_disabled())
+                return;
        if (!page)
                return;
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 7ea09699855d..8d74c20d8595 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -11,6 +11,7 @@
 #include <linux/ctype.h>
 #include <linux/kernel.h>
 #include <linux/export.h>
+#include <asm/unaligned.h>
 const char hex_asc[] = "0123456789abcdef";
 EXPORT_SYMBOL(hex_asc);
@@ -139,7 +140,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                for (j = 0; j < ngroups; j++) {
                        ret = snprintf(linebuf + lx, linebuflen - lx,
                                       "%s%16.16llx", j ? " " : "",
-                                       (unsigned long long)*(ptr8 + j));
+                                       get_unaligned(ptr8 + j));
                        if (ret >= linebuflen - lx)
                                goto overflow1;
                        lx += ret;
@@ -150,7 +151,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                for (j = 0; j < ngroups; j++) {
                        ret = snprintf(linebuf + lx, linebuflen - lx,
                                       "%s%8.8x", j ? " " : "",
-                                       *(ptr4 + j));
+                                       get_unaligned(ptr4 + j));
                        if (ret >= linebuflen - lx)
                                goto overflow1;
                        lx += ret;
@@ -161,7 +162,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                for (j = 0; j < ngroups; j++) {
                        ret = snprintf(linebuf + lx, linebuflen - lx,
                                       "%s%4.4x", j ? " " : "",
-                                       *(ptr2 + j));
+                                       get_unaligned(ptr2 + j));
                        if (ret >= linebuflen - lx)
                                goto overflow1;
                        lx += ret;
diff --git a/lib/kobject.c b/lib/kobject.c
index 2e3bd01964a9..3e3a5c3cb330 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -337,8 +337,9 @@ error:
 }
 EXPORT_SYMBOL(kobject_init);
-static int kobject_add_varg(struct kobject *kobj, struct kobject *parent,
+static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
-                            const char *fmt, va_list vargs)
+                                           struct kobject *parent,
+                                           const char *fmt, va_list vargs)
 {
        int retval;
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index a60a6d335a91..cc0c69710dcf 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -610,6 +610,8 @@ next:
                iter->skip = 0;
        }
+        iter->p = NULL;
        /* Ensure we see any new tables. */
        smp_rmb();
@@ -620,8 +622,6 @@ next:
                return ERR_PTR(-EAGAIN);
        }
-        iter->p = NULL;
        return NULL;
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_next);
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 7621ee34daa0..f8e4b60db167 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -39,7 +39,7 @@ static int cma_used_get(void *data, u64 *val)
        mutex_lock(&cma->lock);
        /* pages counter is smaller than sizeof(int) */
-        used = bitmap_weight(cma->bitmap, (int)cma->count);
+        used = bitmap_weight(cma->bitmap, (int)cma_bitmap_maxno(cma));
        mutex_unlock(&cma->lock);
        *val = (u64)used << cma->order_per_bit;
@@ -52,13 +52,14 @@ static int cma_maxchunk_get(void *data, u64 *val)
        struct cma *cma = data;
        unsigned long maxchunk = 0;
        unsigned long start, end = 0;
+        unsigned long bitmap_maxno = cma_bitmap_maxno(cma);
        mutex_lock(&cma->lock);
        for (;;) {
-                start = find_next_zero_bit(cma->bitmap, cma->count, end);
+                start = find_next_zero_bit(cma->bitmap, bitmap_maxno, end);
                if (start >= cma->count)
                        break;
-                end = find_next_bit(cma->bitmap, cma->count, start);
+                end = find_next_bit(cma->bitmap, bitmap_maxno, start);
                maxchunk = max(end - start, maxchunk);
        }
        mutex_unlock(&cma->lock);
@@ -170,10 +171,10 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
        tmp = debugfs_create_dir(name, cma_debugfs_root);
-        debugfs_create_file("alloc", S_IWUSR, cma_debugfs_root, cma,
+        debugfs_create_file("alloc", S_IWUSR, tmp, cma,
                                &cma_alloc_fops);
-        debugfs_create_file("free", S_IWUSR, cma_debugfs_root, cma,
+        debugfs_create_file("free", S_IWUSR, tmp, cma,
                                &cma_free_fops);
        debugfs_create_file("base_pfn", S_IRUGO, tmp,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 506eac8b38af..ef19f22b2b7d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -246,9 +246,7 @@ static inline void reset_deferred_meminit(pg_data_t *pgdat)
 /* Returns true if the struct page for the pfn is uninitialised */
 static inline bool __meminit early_page_uninitialised(unsigned long pfn)
 {
-        int nid = early_pfn_to_nid(pfn);
+        if (pfn >= NODE_DATA(early_pfn_to_nid(pfn))->first_deferred_pfn)
-        if (pfn >= NODE_DATA(nid)->first_deferred_pfn)
                return true;
        return false;
@@ -1950,6 +1948,7 @@ void free_hot_cold_page_list(struct list_head *list, bool cold)
 void split_page(struct page *page, unsigned int order)
 {
        int i;
+        gfp_t gfp_mask;
        VM_BUG_ON_PAGE(PageCompound(page), page);
        VM_BUG_ON_PAGE(!page_count(page), page);
@@ -1963,10 +1962,11 @@ void split_page(struct page *page, unsigned int order)
                split_page(virt_to_page(page[0].shadow), order);
 #endif
-        set_page_owner(page, 0, 0);
+        gfp_mask = get_page_owner_gfp(page);
+        set_page_owner(page, 0, gfp_mask);
        for (i = 1; i < (1 << order); i++) {
                set_page_refcounted(page + i);
-                set_page_owner(page + i, 0, 0);
+                set_page_owner(page + i, 0, gfp_mask);
        }
 }
 EXPORT_SYMBOL_GPL(split_page);
@@ -1996,6 +1996,8 @@ int __isolate_free_page(struct page *page, unsigned int order)
        zone->free_area[order].nr_free--;
        rmv_page_order(page);
+        set_page_owner(page, order, __GFP_MOVABLE);
        /* Set the pageblock if the isolated page is at least a pageblock */
        if (order >= pageblock_order - 1) {
                struct page *endpage = page + (1 << order) - 1;
@@ -2007,7 +2009,7 @@ int __isolate_free_page(struct page *page, unsigned int order)
                }
        }
-        set_page_owner(page, order, 0);
        return 1UL << order;
 }
diff --git a/mm/page_owner.c b/mm/page_owner.c
index bd5f842b56d2..983c3a10fa07 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -76,6 +76,13 @@ void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask)
        __set_bit(PAGE_EXT_OWNER, &page_ext->flags);
 }
+gfp_t __get_page_owner_gfp(struct page *page)
+{
+        struct page_ext *page_ext = lookup_page_ext(page);
+        return page_ext->gfp_mask;
+}
 static ssize_t
 print_page_owner(char __user *buf, size_t count, unsigned long pfn,
                struct page *page, struct page_ext *page_ext)
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9dd49ca67dbc..6e70ddb158b4 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -704,6 +704,7 @@ static void p9_virtio_remove(struct virtio_device *vdev)
        mutex_unlock(&virtio_9p_lock);
+        vdev->config->reset(vdev);
        vdev->config->del_vqs(vdev);
        sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 1997538a5d23..3b78e8473a01 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,6 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
        ax25_clear_queues(ax25);
+        ax25_stop_heartbeat(ax25);
        ax25_stop_t1timer(ax25);
        ax25_stop_t2timer(ax25);
        ax25_stop_t3timer(ax25);
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index e97572b5d2cc..0ff6e1bbca91 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb)
        } else {
                skb_push(skb, ETH_HLEN);
                br_drop_fake_rtable(skb);
+                skb_sender_cpu_clear(skb);
                dev_queue_xmit(skb);
        }
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index e29ad70b3000..1198a3dbad95 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -323,6 +323,7 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
        struct net_bridge_port_group *p;
        struct net_bridge_port_group __rcu **pp;
        struct net_bridge_mdb_htable *mdb;
+        unsigned long now = jiffies;
        int err;
        mdb = mlock_dereference(br->mdb, br);
@@ -347,8 +348,9 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
        if (unlikely(!p))
                return -ENOMEM;
        rcu_assign_pointer(*pp, p);
+        if (state == MDB_TEMPORARY)
+                mod_timer(&p->timer, now + br->multicast_membership_interval);
-        br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
        return 0;
 }
@@ -371,6 +373,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
        if (!p || p->br != br || p->state == BR_STATE_DISABLED)
                return -EINVAL;
+        memset(&ip, 0, sizeof(ip));
        ip.proto = entry->addr.proto;
        if (ip.proto == htons(ETH_P_IP))
                ip.u.ip4 = entry->addr.u.ip4;
@@ -417,20 +420,14 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
        if (!netif_running(br->dev) || br->multicast_disabled)
                return -EINVAL;
+        memset(&ip, 0, sizeof(ip));
        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP)) {
+        if (ip.proto == htons(ETH_P_IP))
-                if (timer_pending(&br->ip4_other_query.timer))
-                        return -EBUSY;
                ip.u.ip4 = entry->addr.u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
+        else
-                if (timer_pending(&br->ip6_other_query.timer))
-                        return -EBUSY;
                ip.u.ip6 = entry->addr.u.ip6;
 #endif
-        }
        spin_lock_bh(&br->multicast_lock);
        mdb = mlock_dereference(br->mdb, br);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 742a6c27d7a2..79db489cdade 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -39,6 +39,16 @@ static void br_multicast_start_querier(struct net_bridge *br,
                                       struct bridge_mcast_own_query *query);
 static void br_multicast_add_router(struct net_bridge *br,
                                    struct net_bridge_port *port);
+static void br_ip4_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         __be32 group,
+                                         __u16 vid);
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         const struct in6_addr *group,
+                                         __u16 vid);
+#endif
 unsigned int br_mdb_rehash_seq;
 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -1010,9 +1020,15 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                        continue;
                }
-                err = br_ip4_multicast_add_group(br, port, group, vid);
+                if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
-                if (err)
+                     type == IGMPV3_MODE_IS_INCLUDE) &&
-                        break;
+                    ntohs(grec->grec_nsrcs) == 0) {
+                        br_ip4_multicast_leave_group(br, port, group, vid);
+                } else {
+                        err = br_ip4_multicast_add_group(br, port, group, vid);
+                        if (err)
+                                break;
+                }
        }
        return err;
@@ -1071,10 +1087,17 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                        continue;
                }
-                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
+                if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
-                                                 vid);
+                     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
-                if (err)
+                    ntohs(*nsrcs) == 0) {
-                        break;
+                        br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
+                                                     vid);
+                } else {
+                        err = br_ip6_multicast_add_group(br, port,
+                                                         &grec->grec_mca, vid);
+                        if (!err)
+                                break;
+                }
        }
        return err;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index d89f4fac0bc5..c8b9bcfe997e 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -111,7 +111,7 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
 /* largest possible L2 header, see br_nf_dev_queue_xmit() */
 #define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
-#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) || IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 struct brnf_frag_data {
        char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
        u8 encap_size;
@@ -694,6 +694,7 @@ static int br_nf_push_frag_xmit(struct sock *sk, struct sk_buff *skb)
 }
 #endif
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
 static int br_nf_ip_fragment(struct sock *sk, struct sk_buff *skb,
                             int (*output)(struct sock *, struct sk_buff *))
 {
@@ -712,6 +713,7 @@ static int br_nf_ip_fragment(struct sock *sk, struct sk_buff *skb,
        return ip_do_fragment(sk, skb, output);
 }
+#endif
 static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
 {
@@ -742,7 +744,7 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
                struct brnf_frag_data *data;
                if (br_validate_ipv4(skb))
-                        return NF_DROP;
+                        goto drop;
                IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
@@ -767,7 +769,7 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
                struct brnf_frag_data *data;
                if (br_validate_ipv6(skb))
-                        return NF_DROP;
+                        goto drop;
                IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
@@ -782,12 +784,16 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
                if (v6ops)
                        return v6ops->fragment(sk, skb, br_nf_push_frag_xmit);
-                else
-                        return -EMSGSIZE;
+                kfree_skb(skb);
+                return -EMSGSIZE;
        }
 #endif
        nf_bridge_info_free(skb);
        return br_dev_queue_push_xmit(sk, skb);
+ drop:
+        kfree_skb(skb);
+        return 0;
 }
 /* PF_BRIDGE/POST_ROUTING ********************************************/
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 6d12d2675c80..13b7d1e3d185 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -104,7 +104,7 @@ int br_validate_ipv6(struct sk_buff *skb)
 {
        const struct ipv6hdr *hdr;
        struct net_device *dev = skb->dev;
-        struct inet6_dev *idev = in6_dev_get(skb->dev);
+        struct inet6_dev *idev = __in6_dev_get(skb->dev);
        u32 pkt_len;
        u8 ip6h_len = sizeof(struct ipv6hdr);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 6b67ed3831de..364bdc98bd9b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -457,6 +457,8 @@ static int br_afspec(struct net_bridge *br,
                if (nla_len(attr) != sizeof(struct bridge_vlan_info))
                        return -EINVAL;
                vinfo = nla_data(attr);
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
+                        return -EINVAL;
                if (vinfo->flags & BRIDGE_VLAN_INFO_RANGE_BEGIN) {
                        if (vinfo_start)
                                return -EINVAL;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 3cc71b9f5517..cc858919108e 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -121,12 +121,13 @@ static void caif_flow_ctrl(struct sock *sk, int mode)
 * Copied from sock.c:sock_queue_rcv_skb(), but changed so packets are
 * not dropped, but CAIF is sending flow off instead.
 */
-static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static void caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
        int err;
        unsigned long flags;
        struct sk_buff_head *list = &sk->sk_receive_queue;
        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        bool queued = false;
        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
                (unsigned int)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
@@ -139,7 +140,8 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        err = sk_filter(sk, skb);
        if (err)
-                return err;
+                goto out;
        if (!sk_rmem_schedule(sk, skb, skb->truesize) && rx_flow_is_on(cf_sk)) {
                set_rx_flow_off(cf_sk);
                net_dbg_ratelimited("sending flow OFF due to rmem_schedule\n");
@@ -147,21 +149,16 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        }
        skb->dev = NULL;
        skb_set_owner_r(skb, sk);
-        /* Cache the SKB length before we tack it onto the receive
-         * queue. Once it is added it no longer belongs to us and
-         * may be freed by other threads of control pulling packets
-         * from the queue.
-         */
        spin_lock_irqsave(&list->lock, flags);
-        if (!sock_flag(sk, SOCK_DEAD))
+        queued = !sock_flag(sk, SOCK_DEAD);
+        if (queued)
                __skb_queue_tail(list, skb);
        spin_unlock_irqrestore(&list->lock, flags);
+out:
-        if (!sock_flag(sk, SOCK_DEAD))
+        if (queued)
                sk->sk_data_ready(sk);
        else
                kfree_skb(skb);
-        return 0;
 }
 /* Packet Receive Callback function called from CAIF Stack */
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7933e62a7318..166d436196c1 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -89,6 +89,8 @@ struct timer_list can_stattimer;   /* timer for statistics update */
 struct s_stats    can_stats;       /* packet statistics */
 struct s_pstats   can_pstats;      /* receive list statistics */
+static atomic_t skbcounter = ATOMIC_INIT(0);
 /*
 * af_can socket functions
 */
@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int loop)
                return err;
        }
-        if (newskb) {
+        if (newskb)
-                if (!(newskb->tstamp.tv64))
-                        __net_timestamp(newskb);
                netif_rx_ni(newskb);
-        }
        /* update statistics */
        can_stats.tx_frames++;
@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
        can_stats.rx_frames++;
        can_stats.rx_frames_delta++;
+        /* create non-zero unique skb identifier together with *skb */
+        while (!(can_skb_prv(skb)->skbcnt))
+                can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
        rcu_read_lock();
        /* deliver the packet to sockets listening on all devices */
diff --git a/net/can/bcm.c b/net/can/bcm.c
index b523453585be..a1ba6875c2a2 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op)
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
        }
        can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        skb->dev = dev;
        can_skb_set_owner(skb, sk);
        err = can_send(skb, 1); /* send with loopback */
diff --git a/net/can/raw.c b/net/can/raw.c
index 31b9748cbb4e..2e67b1423cd3 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
 */
 struct uniqframe {
-        ktime_t tstamp;
+        int skbcnt;
        const struct sk_buff *skb;
        unsigned int join_rx_count;
 };
@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
        /* eliminate multiple filter matches for the same skb */
        if (this_cpu_ptr(ro->uniq)->skb == oskb &&
-            ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
+            this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
                if (ro->join_filters) {
                        this_cpu_inc(ro->uniq->join_rx_count);
                        /* drop frame until all enabled filters matched */
@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
                }
        } else {
                this_cpu_ptr(ro->uniq)->skb = oskb;
-                this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
+                this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
                this_cpu_ptr(ro->uniq)->join_rx_count = 1;
                /* drop first frame to check all enabled filters? */
                if (ro->join_filters && ro->count > 1)
@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
        err = memcpy_from_msg(skb_put(skb, size), msg, size);
        if (err < 0)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b80fb91bb3f7..4967262b2707 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,6 +131,35 @@ out_noerr:
        goto out;
 }
+static int skb_set_peeked(struct sk_buff *skb)
+{
+        struct sk_buff *nskb;
+        if (skb->peeked)
+                return 0;
+        /* We have to unshare an skb before modifying it. */
+        if (!skb_shared(skb))
+                goto done;
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (!nskb)
+                return -ENOMEM;
+        skb->prev->next = nskb;
+        skb->next->prev = nskb;
+        nskb->prev = skb->prev;
+        nskb->next = skb->next;
+        consume_skb(skb);
+        skb = nskb;
+done:
+        skb->peeked = 1;
+        return 0;
+}
 /**
 *      __skb_recv_datagram - Receive a datagram skbuff
 *      @sk: socket
@@ -165,7 +194,9 @@ out_noerr:
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                    int *peeked, int *off, int *err)
 {
+        struct sk_buff_head *queue = &sk->sk_receive_queue;
        struct sk_buff *skb, *last;
+        unsigned long cpu_flags;
        long timeo;
        /*
         * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                 * Look at current nfs client by the way...
                 * However, this function was correct in any case. 8)
                 */
-                unsigned long cpu_flags;
-                struct sk_buff_head *queue = &sk->sk_receive_queue;
                int _off = *off;
                last = (struct sk_buff *)queue;
@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                        _off -= skb->len;
                                        continue;
                                }
-                                skb->peeked = 1;
+                                error = skb_set_peeked(skb);
+                                if (error)
+                                        goto unlock_err;
                                atomic_inc(&skb->users);
                        } else
                                __skb_unlink(skb, queue);
@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
        return NULL;
+unlock_err:
+        spin_unlock_irqrestore(&queue->lock, cpu_flags);
 no_packet:
        *err = error;
        return NULL;
@@ -622,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
                    !skb->csum_complete_sw)
                        netdev_rx_csum_fault(skb->dev);
        }
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb))
+                skb->csum_valid = !sum;
        return sum;
 }
 EXPORT_SYMBOL(__skb_checksum_complete_head);
@@ -642,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
                        netdev_rx_csum_fault(skb->dev);
        }
-        /* Save full packet checksum */
+        if (!skb_shared(skb)) {
-        skb->csum = csum;
+                /* Save full packet checksum */
-        skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum = csum;
-        skb->csum_complete_sw = 1;
+                skb->ip_summed = CHECKSUM_COMPLETE;
-        skb->csum_valid = !sum;
+                skb->csum_complete_sw = 1;
+                skb->csum_valid = !sum;
+        }
        return sum;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 6778a9999d52..a8e4dd430285 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -677,10 +677,6 @@ int dev_get_iflink(const struct net_device *dev)
        if (dev->netdev_ops && dev->netdev_ops->ndo_get_iflink)
                return dev->netdev_ops->ndo_get_iflink(dev);
-        /* If dev->rtnl_link_ops is set, it's a virtual interface. */
-        if (dev->rtnl_link_ops)
-                return 0;
        return dev->ifindex;
 }
 EXPORT_SYMBOL(dev_get_iflink);
@@ -3452,6 +3448,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
        local_irq_save(flags);
        rps_lock(sd);
+        if (!netif_running(skb->dev))
+                goto drop;
        qlen = skb_queue_len(&sd->input_pkt_queue);
        if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) {
                if (qlen) {
@@ -3473,6 +3471,7 @@ enqueue:
                goto enqueue;
        }
+drop:
        sd->dropped++;
        rps_unlock(sd);
@@ -3775,8 +3774,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
        pt_prev = NULL;
-        rcu_read_lock();
 another_round:
        skb->skb_iif = skb->dev->ifindex;
@@ -3786,7 +3783,7 @@ another_round:
            skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
                skb = skb_vlan_untag(skb);
                if (unlikely(!skb))
-                        goto unlock;
+                        goto out;
        }
 #ifdef CONFIG_NET_CLS_ACT
@@ -3816,10 +3813,10 @@ skip_taps:
        if (static_key_false(&ingress_needed)) {
                skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
                if (!skb)
-                        goto unlock;
+                        goto out;
                if (nf_ingress(skb, &pt_prev, &ret, orig_dev) < 0)
-                        goto unlock;
+                        goto out;
        }
 #endif
 #ifdef CONFIG_NET_CLS_ACT
@@ -3837,7 +3834,7 @@ ncls:
                if (vlan_do_receive(&skb))
                        goto another_round;
                else if (unlikely(!skb))
-                        goto unlock;
+                        goto out;
        }
        rx_handler = rcu_dereference(skb->dev->rx_handler);
@@ -3849,7 +3846,7 @@ ncls:
                switch (rx_handler(&skb)) {
                case RX_HANDLER_CONSUMED:
                        ret = NET_RX_SUCCESS;
-                        goto unlock;
+                        goto out;
                case RX_HANDLER_ANOTHER:
                        goto another_round;
                case RX_HANDLER_EXACT:
@@ -3903,8 +3900,7 @@ drop:
                ret = NET_RX_DROP;
        }
-unlock:
+out:
-        rcu_read_unlock();
        return ret;
 }
@@ -3935,29 +3931,30 @@ static int __netif_receive_skb(struct sk_buff *skb)
 static int netif_receive_skb_internal(struct sk_buff *skb)
 {
+        int ret;
        net_timestamp_check(netdev_tstamp_prequeue, skb);
        if (skb_defer_rx_timestamp(skb))
                return NET_RX_SUCCESS;
+        rcu_read_lock();
 #ifdef CONFIG_RPS
        if (static_key_false(&rps_needed)) {
                struct rps_dev_flow voidflow, *rflow = &voidflow;
-                int cpu, ret;
+                int cpu = get_rps_cpu(skb->dev, skb, &rflow);
-                rcu_read_lock();
-                cpu = get_rps_cpu(skb->dev, skb, &rflow);
                if (cpu >= 0) {
                        ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
                        rcu_read_unlock();
                        return ret;
                }
-                rcu_read_unlock();
        }
 #endif
-        return __netif_receive_skb(skb);
+        ret = __netif_receive_skb(skb);
+        rcu_read_unlock();
+        return ret;
 }
 /**
@@ -4502,8 +4499,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
                struct sk_buff *skb;
                while ((skb = __skb_dequeue(&sd->process_queue))) {
+                        rcu_read_lock();
                        local_irq_enable();
                        __netif_receive_skb(skb);
+                        rcu_read_unlock();
                        local_irq_disable();
                        input_queue_head_incr(sd);
                        if (++work >= quota) {
@@ -6139,6 +6138,7 @@ static void rollback_registered_many(struct list_head *head)
                unlist_netdevice(dev);
                dev->reg_state = NETREG_UNREGISTERING;
+                on_each_cpu(flush_backlog, dev, 1);
        }
        synchronize_net();
@@ -6409,7 +6409,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
        struct netdev_queue *tx;
        size_t sz = count * sizeof(*tx);
-        BUG_ON(count < 1 || count > 0xffff);
+        if (count < 1 || count > 0xffff)
+                return -EINVAL;
        tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
        if (!tx) {
@@ -6773,8 +6774,6 @@ void netdev_run_todo(void)
                dev->reg_state = NETREG_UNREGISTERED;
-                on_each_cpu(flush_backlog, dev, 1);
                netdev_wait_allrefs(dev);
                /* paranoia */
diff --git a/net/core/dst.c b/net/core/dst.c
index e956ce6d1378..002144bea935 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -284,7 +284,9 @@ void dst_release(struct dst_entry *dst)
                int newrefcnt;
                newrefcnt = atomic_dec_return(&dst->__refcnt);
-                WARN_ON(newrefcnt < 0);
+                if (unlikely(newrefcnt < 0))
+                        net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
+                                             __func__, dst, newrefcnt);
                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
                        call_rcu(&dst->rcu_head, dst_destroy_rcu);
        }
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 9dfb88a933e7..92d886f4adcb 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -66,7 +66,7 @@
   NOTES.
-   * avbps is scaled by 2^5, avpps is scaled by 2^10.
+   * avbps and avpps are scaled by 2^5.
   * both values are reported as 32 bit unsigned values. bps can
     overflow for fast links : max speed being 34360Mbit/sec
   * Minimal interval is HZ/4=250msec (it is the greatest common divisor
@@ -85,10 +85,10 @@ struct gen_estimator
        struct gnet_stats_rate_est64    *rate_est;
        spinlock_t              *stats_lock;
        int                     ewma_log;
+        u32                     last_packets;
+        unsigned long           avpps;
        u64                     last_bytes;
        u64                     avbps;
-        u32                     last_packets;
-        u32                     avpps;
        struct rcu_head         e_rcu;
        struct rb_node          node;
        struct gnet_stats_basic_cpu __percpu *cpu_bstats;
@@ -118,8 +118,8 @@ static void est_timer(unsigned long arg)
        rcu_read_lock();
        list_for_each_entry_rcu(e, &elist[idx].list, list) {
                struct gnet_stats_basic_packed b = {0};
+                unsigned long rate;
                u64 brate;
-                u32 rate;
                spin_lock(e->stats_lock);
                read_lock(&est_lock);
@@ -133,10 +133,11 @@ static void est_timer(unsigned long arg)
                e->avbps += (brate >> e->ewma_log) - (e->avbps >> e->ewma_log);
                e->rate_est->bps = (e->avbps+0xF)>>5;
-                rate = (b.packets - e->last_packets)<<(12 - idx);
+                rate = b.packets - e->last_packets;
+                rate <<= (7 - idx);
                e->last_packets = b.packets;
                e->avpps += (rate >> e->ewma_log) - (e->avpps >> e->ewma_log);
-                e->rate_est->pps = (e->avpps+0x1FF)>>10;
+                e->rate_est->pps = (e->avpps + 0xF) >> 5;
 skip:
                read_unlock(&est_lock);
                spin_unlock(e->stats_lock);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 05badbb58865..1ebdf1c0d118 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3571,13 +3571,6 @@ static int pktgen_thread_worker(void *arg)
        pr_debug("%s removing thread\n", t->tsk->comm);
        pktgen_rem_thread(t);
-        /* Wait for kthread_stop */
-        while (!kthread_should_stop()) {
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule();
-        }
-        __set_current_state(TASK_RUNNING);
        return 0;
 }
@@ -3769,6 +3762,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn)
        }
        t->net = pn;
+        get_task_struct(p);
        wake_up_process(p);
        wait_for_completion(&t->start_done);
@@ -3891,6 +3885,7 @@ static void __net_exit pg_net_exit(struct net *net)
                t = list_entry(q, struct pktgen_thread, th_list);
                list_del(&t->th_list);
                kthread_stop(t->tsk);
+                put_task_struct(t->tsk);
                kfree(t);
        }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 01ced4a889e0..dc004b1e1f85 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1328,10 +1328,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
        [IFLA_INFO_SLAVE_DATA]  = { .type = NLA_NESTED },
 };
-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
-        [IFLA_VF_INFO]          = { .type = NLA_NESTED },
-};
 static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
        [IFLA_VF_MAC]           = { .len = sizeof(struct ifla_vf_mac) },
        [IFLA_VF_VLAN]          = { .len = sizeof(struct ifla_vf_vlan) },
@@ -1488,96 +1484,98 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
        return 0;
 }
-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 {
-        int rem, err = -EINVAL;
-        struct nlattr *vf;
        const struct net_device_ops *ops = dev->netdev_ops;
+        int err = -EINVAL;
-        nla_for_each_nested(vf, attr, rem) {
+        if (tb[IFLA_VF_MAC]) {
-                switch (nla_type(vf)) {
+                struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
-                case IFLA_VF_MAC: {
-                        struct ifla_vf_mac *ivm;
-                        ivm = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_mac)
-                                err = ops->ndo_set_vf_mac(dev, ivm->vf,
-                                                          ivm->mac);
-                        break;
-                }
-                case IFLA_VF_VLAN: {
-                        struct ifla_vf_vlan *ivv;
-                        ivv = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_vlan)
-                                err = ops->ndo_set_vf_vlan(dev, ivv->vf,
-                                                           ivv->vlan,
-                                                           ivv->qos);
-                        break;
-                }
-                case IFLA_VF_TX_RATE: {
-                        struct ifla_vf_tx_rate *ivt;
-                        struct ifla_vf_info ivf;
-                        ivt = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_get_vf_config)
-                                err = ops->ndo_get_vf_config(dev, ivt->vf,
-                                                             &ivf);
-                        if (err)
-                                break;
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_rate)
-                                err = ops->ndo_set_vf_rate(dev, ivt->vf,
-                                                           ivf.min_tx_rate,
-                                                           ivt->rate);
-                        break;
-                }
-                case IFLA_VF_RATE: {
-                        struct ifla_vf_rate *ivt;
-                        ivt = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_rate)
-                                err = ops->ndo_set_vf_rate(dev, ivt->vf,
-                                                           ivt->min_tx_rate,
-                                                           ivt->max_tx_rate);
-                        break;
-                }
-                case IFLA_VF_SPOOFCHK: {
-                        struct ifla_vf_spoofchk *ivs;
-                        ivs = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_spoofchk)
-                                err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
-                                                               ivs->setting);
-                        break;
-                }
-                case IFLA_VF_LINK_STATE: {
-                        struct ifla_vf_link_state *ivl;
-                        ivl = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_link_state)
-                                err = ops->ndo_set_vf_link_state(dev, ivl->vf,
-                                                                 ivl->link_state);
-                        break;
-                }
-                case IFLA_VF_RSS_QUERY_EN: {
-                        struct ifla_vf_rss_query_en *ivrssq_en;
-                        ivrssq_en = nla_data(vf);
+                err = -EOPNOTSUPP;
-                        err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_mac)
-                        if (ops->ndo_set_vf_rss_query_en)
+                        err = ops->ndo_set_vf_mac(dev, ivm->vf,
-                                err = ops->ndo_set_vf_rss_query_en(dev,
+                                                  ivm->mac);
-                                                            ivrssq_en->vf,
+                if (err < 0)
-                                                            ivrssq_en->setting);
+                        return err;
-                        break;
+        }
-                }
-                default:
+        if (tb[IFLA_VF_VLAN]) {
-                        err = -EINVAL;
+                struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
-                        break;
-                }
+                err = -EOPNOTSUPP;
-                if (err)
+                if (ops->ndo_set_vf_vlan)
-                        break;
+                        err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
+                                                   ivv->qos);
+                if (err < 0)
+                        return err;
+        }
+        if (tb[IFLA_VF_TX_RATE]) {
+                struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+                struct ifla_vf_info ivf;
+                err = -EOPNOTSUPP;
+                if (ops->ndo_get_vf_config)
+                        err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
+                if (err < 0)
+                        return err;
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_rate)
+                        err = ops->ndo_set_vf_rate(dev, ivt->vf,
+                                                   ivf.min_tx_rate,
+                                                   ivt->rate);
+                if (err < 0)
+                        return err;
+        }
+        if (tb[IFLA_VF_RATE]) {
+                struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_rate)
+                        err = ops->ndo_set_vf_rate(dev, ivt->vf,
+                                                   ivt->min_tx_rate,
+                                                   ivt->max_tx_rate);
+                if (err < 0)
+                        return err;
+        }
+        if (tb[IFLA_VF_SPOOFCHK]) {
+                struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_spoofchk)
+                        err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+                                                       ivs->setting);
+                if (err < 0)
+                        return err;
        }
+        if (tb[IFLA_VF_LINK_STATE]) {
+                struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_link_state)
+                        err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+                                                         ivl->link_state);
+                if (err < 0)
+                        return err;
+        }
+        if (tb[IFLA_VF_RSS_QUERY_EN]) {
+                struct ifla_vf_rss_query_en *ivrssq_en;
+                err = -EOPNOTSUPP;
+                ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
+                if (ops->ndo_set_vf_rss_query_en)
+                        err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
+                                                           ivrssq_en->setting);
+                if (err < 0)
+                        return err;
+        }
        return err;
 }
@@ -1773,14 +1771,21 @@ static int do_setlink(const struct sk_buff *skb,
        }
        if (tb[IFLA_VFINFO_LIST]) {
+                struct nlattr *vfinfo[IFLA_VF_MAX + 1];
                struct nlattr *attr;
                int rem;
                nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
-                        if (nla_type(attr) != IFLA_VF_INFO) {
+                        if (nla_type(attr) != IFLA_VF_INFO ||
+                            nla_len(attr) < NLA_HDRLEN) {
                                err = -EINVAL;
                                goto errout;
                        }
-                        err = do_setvfinfo(dev, attr);
+                        err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr,
+                                               ifla_vf_policy);
+                        if (err < 0)
+                                goto errout;
+                        err = do_setvfinfo(dev, vfinfo);
                        if (err < 0)
                                goto errout;
                        status |= DO_SETLINK_NOTIFY;
@@ -1799,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb,
                        goto errout;
                nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
-                        if (nla_type(attr) != IFLA_VF_PORT)
+                        if (nla_type(attr) != IFLA_VF_PORT ||
-                                continue;
+                            nla_len(attr) < NLA_HDRLEN) {
-                        err = nla_parse_nested(port, IFLA_PORT_MAX,
+                                err = -EINVAL;
-                                attr, ifla_port_policy);
+                                goto errout;
+                        }
+                        err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
+                                               ifla_port_policy);
                        if (err < 0)
                                goto errout;
                        if (!port[IFLA_PORT_VF]) {
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 392e29a0227d..b445d492c115 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -630,7 +630,7 @@ static int dsa_of_probe(struct device *dev)
                        continue;
                cd->sw_addr = be32_to_cpup(sw_addr);
-                if (cd->sw_addr > PHY_MAX_ADDR)
+                if (cd->sw_addr >= PHY_MAX_ADDR)
                        continue;
                if (!of_property_read_u32(child, "eeprom-length", &eeprom_len))
@@ -642,6 +642,8 @@ static int dsa_of_probe(struct device *dev)
                                continue;
                        port_index = be32_to_cpup(port_reg);
+                        if (port_index >= DSA_MAX_PORTS)
+                                break;
                        port_name = of_get_property(port, "label", NULL);
                        if (!port_name)
@@ -666,8 +668,6 @@ static int dsa_of_probe(struct device *dev)
                                        goto out_free_chip;
                        }
-                        if (port_index == DSA_MAX_PORTS)
-                                break;
                }
        }
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 90c0e8386116..574fad9cca05 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -20,7 +20,7 @@
 #include <net/route.h>
 #include <net/tcp_states.h>
-int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
        struct inet_sock *inet = inet_sk(sk);
        struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        sk_dst_reset(sk);
-        lock_sock(sk);
        oif = sk->sk_bound_dev_if;
        saddr = inet->inet_saddr;
        if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        sk_dst_set(sk, &rt->dst);
        err = 0;
 out:
-        release_sock(sk);
        return err;
 }
+EXPORT_SYMBOL(__ip4_datagram_connect);
+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+        lock_sock(sk);
+        res = __ip4_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL(ip4_datagram_connect);
 /* Because UDP xmit path can manipulate sk_dst_cache without holding
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 7498716e8f54..e813196c91c7 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1740,6 +1740,8 @@ static int inet_netconf_msgsize_devconf(int type)
                size += nla_total_size(4);
        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
                size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
+                size += nla_total_size(4);
        return size;
 }
@@ -1780,6 +1782,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
            nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
                        IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
                goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
+            nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
+                        IPV4_DEVCONF(*devconf, IGNORE_ROUTES_WITH_LINKDOWN)) < 0)
+                goto nla_put_failure;
        nlmsg_end(skb, nlh);
        return 0;
@@ -1819,6 +1825,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
        [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
+        [NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]  = { .len = sizeof(int) },
 };
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -2048,6 +2055,12 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                        inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
                                                    ifindex, cnf);
                }
+                if (i == IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
+                                                    ifindex, cnf);
+                }
        }
        return ret;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 9bc26677058e..c3b1f3a0f4cf 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -152,8 +152,8 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                                       inet6_sk(sk)->tclass) < 0)
                                goto errout;
-                if (ipv6_only_sock(sk) &&
+                if (((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
-                    nla_put_u8(skb, INET_DIAG_SKV6ONLY, 1))
+                    nla_put_u8(skb, INET_DIAG_SKV6ONLY, ipv6_only_sock(sk)))
                        goto errout;
        }
 #endif
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 5f9b063bbe8a..0cb9165421d4 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -624,22 +624,21 @@ EXPORT_SYMBOL_GPL(inet_hashinfo_init);
 int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo)
 {
+        unsigned int locksz = sizeof(spinlock_t);
        unsigned int i, nblocks = 1;
-        if (sizeof(spinlock_t) != 0) {
+        if (locksz != 0) {
                /* allocate 2 cache lines or at least one spinlock per cpu */
-                nblocks = max_t(unsigned int,
+                nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U);
-                                2 * L1_CACHE_BYTES / sizeof(spinlock_t),
-                                1);
                nblocks = roundup_pow_of_two(nblocks * num_possible_cpus());
                /* no more locks than number of hash buckets */
                nblocks = min(nblocks, hashinfo->ehash_mask + 1);
-                hashinfo->ehash_locks = kmalloc_array(nblocks, sizeof(spinlock_t),
+                hashinfo->ehash_locks = kmalloc_array(nblocks, locksz,
                                                      GFP_KERNEL | __GFP_NOWARN);
                if (!hashinfo->ehash_locks)
-                        hashinfo->ehash_locks = vmalloc(nblocks * sizeof(spinlock_t));
+                        hashinfo->ehash_locks = vmalloc(nblocks * locksz);
                if (!hashinfo->ehash_locks)
                        return -ENOMEM;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a50dc6d408d1..31f71b15cfba 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -351,7 +351,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
        ihl = ip_hdrlen(skb);
        /* Determine the position of this fragment. */
-        end = offset + skb->len - ihl;
+        end = offset + skb->len - skb_network_offset(skb) - ihl;
        err = -EINVAL;
        /* Is this the final fragment? */
@@ -381,7 +381,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                goto err;
        err = -ENOMEM;
-        if (!pskb_pull(skb, ihl))
+        if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
                goto err;
        err = pskb_trim_rcsum(skb, end - offset);
@@ -641,6 +641,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                iph->frag_off = 0;
        }
+        ip_send_check(iph);
        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
        qp->q.fragments = NULL;
        qp->q.fragments_tail = NULL;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 4c2c3ba4ba65..626d9e56a6bd 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -586,7 +586,8 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
 EXPORT_SYMBOL(ip_tunnel_encap);
 static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
-                            struct rtable *rt, __be16 df)
+                            struct rtable *rt, __be16 df,
+                            const struct iphdr *inner_iph)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
@@ -603,7 +604,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
        if (skb->protocol == htons(ETH_P_IP)) {
                if (!skb_is_gso(skb) &&
-                    (df & htons(IP_DF)) && mtu < pkt_size) {
+                    (inner_iph->frag_off & htons(IP_DF)) &&
+                    mtu < pkt_size) {
                        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
                        return -E2BIG;
@@ -737,7 +739,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                goto tx_error;
        }
-        if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
+        if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
                ip_rt_put(rt);
                goto tx_error;
        }
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 95c9b6eece25..92305a1a021a 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -254,9 +254,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
        unsigned int verdict = NF_DROP;
        const struct arphdr *arp;
-        struct arpt_entry *e, *back;
+        struct arpt_entry *e, **jumpstack;
        const char *indev, *outdev;
        const void *table_base;
+        unsigned int cpu, stackidx = 0;
        const struct xt_table_info *private;
        struct xt_action_param acpar;
        unsigned int addend;
@@ -270,15 +271,16 @@ unsigned int arpt_do_table(struct sk_buff *skb,
        local_bh_disable();
        addend = xt_write_recseq_begin();
        private = table->private;
+        cpu     = smp_processor_id();
        /*
         * Ensure we load private-> members after we've fetched the base
         * pointer.
         */
        smp_read_barrier_depends();
        table_base = private->entries;
+        jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
        e = get_entry(table_base, private->hook_entry[hook]);
-        back = get_entry(table_base, private->underflow[hook]);
        acpar.in      = state->in;
        acpar.out     = state->out;
@@ -312,18 +314,23 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                                        verdict = (unsigned int)(-v) - 1;
                                        break;
                                }
-                                e = back;
+                                if (stackidx == 0) {
-                                back = get_entry(table_base, back->comefrom);
+                                        e = get_entry(table_base,
+                                                      private->underflow[hook]);
+                                } else {
+                                        e = jumpstack[--stackidx];
+                                        e = arpt_next_entry(e);
+                                }
                                continue;
                        }
                        if (table_base + v
                            != arpt_next_entry(e)) {
-                                /* Save old back ptr in next entry */
-                                struct arpt_entry *next = arpt_next_entry(e);
-                                next->comefrom = (void *)back - table_base;
-                                /* set back pointer to next entry */
+                                if (stackidx >= private->stacksize) {
-                                back = next;
+                                        verdict = NF_DROP;
+                                        break;
+                                }
+                                jumpstack[stackidx++] = e;
                        }
                        e = get_entry(table_base, v);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 684f095d196e..728f5b3d3c64 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1917,14 +1917,13 @@ void tcp_enter_loss(struct sock *sk)
        const struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
-        bool new_recovery = false;
+        bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
        bool is_reneg;                  /* is receiver reneging on SACKs? */
        /* Reduce ssthresh if it has not yet been made inside this window. */
        if (icsk->icsk_ca_state <= TCP_CA_Disorder ||
            !after(tp->high_seq, tp->snd_una) ||
            (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) {
-                new_recovery = true;
                tp->prior_ssthresh = tcp_current_ssthresh(sk);
                tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
                tcp_ca_event(sk, CA_EVENT_LOSS);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 62d908e64eeb..b10a88986a98 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a)
        return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
 }
-int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
        struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
        struct inet_sock        *inet = inet_sk(sk);
@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (usin->sin6_family == AF_INET) {
                if (__ipv6_only_sock(sk))
                        return -EAFNOSUPPORT;
-                err = ip4_datagram_connect(sk, uaddr, addr_len);
+                err = __ip4_datagram_connect(sk, uaddr, addr_len);
                goto ipv4_connected;
        }
@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                sin.sin_addr.s_addr = daddr->s6_addr32[3];
                sin.sin_port = usin->sin6_port;
-                err = ip4_datagram_connect(sk,
+                err = __ip4_datagram_connect(sk,
-                                           (struct sockaddr *) &sin,
+                                             (struct sockaddr *) &sin,
-                                           sizeof(sin));
+                                             sizeof(sin));
 ipv4_connected:
                if (err)
@@ -204,6 +204,16 @@ out:
        fl6_sock_release(flowlabel);
        return err;
 }
+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+        lock_sock(sk);
+        res = __ip6_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr,
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index f2e464eba5ef..57990c929cd8 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -331,10 +331,10 @@ int ip6_mc_input(struct sk_buff *skb)
                                if (offset < 0)
                                        goto out;
-                                if (!ipv6_is_mld(skb, nexthdr, offset))
+                                if (ipv6_is_mld(skb, nexthdr, offset))
-                                        goto out;
+                                        deliver = true;
-                                deliver = true;
+                                goto out;
                        }
                        /* unknown RA - process it normally */
                }
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index e893cd18612f..08b62047c67f 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -292,8 +292,6 @@ static struct packet_offload ipv6_packet_offload __read_mostly = {
 static const struct net_offload sit_offload = {
        .callbacks = {
                .gso_segment    = ipv6_gso_segment,
-                .gro_receive    = ipv6_gro_receive,
-                .gro_complete   = ipv6_gro_complete,
        },
 };
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1a1122a6bbf5..6090969937f8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -369,10 +369,7 @@ static void ip6_dst_destroy(struct dst_entry *dst)
        struct inet6_dev *idev;
        dst_destroy_metrics_generic(dst);
+        free_percpu(rt->rt6i_pcpu);
-        if (rt->rt6i_pcpu)
-                free_percpu(rt->rt6i_pcpu);
        rt6_uncached_list_del(rt);
        idev = rt->rt6i_idev;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 29236e832e44..c09c0131bfa2 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
        debugfs_remove_recursive(sdata->vif.debugfs_dir);
        sdata->vif.debugfs_dir = NULL;
+        sdata->debugfs.subdir_stations = NULL;
 }
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ed1edac14372..553ac6dd4867 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1863,10 +1863,6 @@ void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
        ieee80211_teardown_sdata(sdata);
 }
-/*
- * Remove all interfaces, may only be called at hardware unregistration
- * time because it doesn't do RCU-safe list removals.
- */
 void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
        struct ieee80211_sub_if_data *sdata, *tmp;
@@ -1875,14 +1871,21 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
        ASSERT_RTNL();
-        /*
+        /* Before destroying the interfaces, make sure they're all stopped so
-         * Close all AP_VLAN interfaces first, as otherwise they
+         * that the hardware is stopped. Otherwise, the driver might still be
-         * might be closed while the AP interface they belong to
+         * iterating the interfaces during the shutdown, e.g. from a worker
-         * is closed, causing unregister_netdevice_many() to crash.
+         * or from RX processing or similar, and if it does so (using atomic
+         * iteration) while we're manipulating the list, the iteration will
+         * crash.
+         *
+         * After this, the hardware should be stopped and the driver should
+         * have stopped all of its activities, so that we can do RCU-unaware
+         * manipulations of the interface list below.
         */
-        list_for_each_entry(sdata, &local->interfaces, list)
+        cfg80211_shutdown_all_interfaces(local->hw.wiphy);
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        dev_close(sdata->dev);
+        WARN(local->open_count, "%s: open count remains %d\n",
+             wiphy_name(local->hw.wiphy), local->open_count);
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 5438d13e2f00..3b59099413fb 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
                        /* AID */
                        pos = skb_put(skb, 2);
-                        put_unaligned_le16(plid, pos + 2);
+                        put_unaligned_le16(plid, pos);
                }
                if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                    ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                                                WLAN_SP_MESH_PEERING_CONFIRM) {
                baseaddr += 4;
                baselen += 4;
+                if (baselen > len)
+                        return;
        }
        ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
        mesh_process_plink_frame(sdata, mgmt, &elems);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 06b60980c62c..b676b9fa707b 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -76,6 +76,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                continue;
                        ieee80211_mgd_quiesce(sdata);
+                        /* If suspended during TX in progress, and wowlan
+                         * is enabled (connection will be active) there
+                         * can be a race where the driver is put out
+                         * of power-save due to TX and during suspend
+                         * dynamic_ps_timer is cancelled and TX packet
+                         * is flushed, leaving the driver in ACTIVE even
+                         * after resuming until dynamic_ps_timer puts
+                         * driver back in DOZE.
+                         */
+                        if (sdata->u.mgd.associated &&
+                            sdata->u.mgd.powersave &&
+                             !(local->hw.conf.flags & IEEE80211_CONF_PS)) {
+                                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                                ieee80211_hw_config(local,
+                                                    IEEE80211_CONF_CHANGE_PS);
+                        }
                }
                err = drv_suspend(local, wowlan);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index ad31b2dab4f5..8db6e2994bbc 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -60,6 +60,7 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_channel *ch;
        struct cfg80211_chan_def chandef;
        int i, subband_start;
+        struct wiphy *wiphy = sdata->local->hw.wiphy;
        for (i = start; i <= end; i += spacing) {
                if (!ch_cnt)
@@ -70,9 +71,8 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
                        /* we will be active on the channel */
                        cfg80211_chandef_create(&chandef, ch,
                                                NL80211_CHAN_NO_HT);
-                        if (cfg80211_reg_can_beacon(sdata->local->hw.wiphy,
+                        if (cfg80211_reg_can_beacon_relax(wiphy, &chandef,
-                                                    &chandef,
+                                                          sdata->wdev.iftype)) {
-                                                    sdata->wdev.iftype)) {
                                ch_cnt++;
                                /*
                                 * check if the next channel is also part of
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8410bb3bf5e8..b8233505bf9f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1117,7 +1117,9 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                        queued = true;
                        info->control.vif = &tx->sdata->vif;
                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
+                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS |
+                                        IEEE80211_TX_CTL_NO_PS_BUFFER |
+                                        IEEE80211_TX_STATUS_EOSP;
                        __skb_queue_tail(&tid_tx->pending, skb);
                        if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
                                purge_skb = __skb_dequeue(&tid_tx->pending);
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index cd60d397fe05..8a8b2abc35ff 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -213,7 +213,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
        if (verdict == NF_ACCEPT) {
        next_hook:
-                verdict = nf_iterate(&nf_hooks[entry->state.pf][entry->state.hook],
+                verdict = nf_iterate(entry->state.hook_list,
                                     skb, &entry->state, &elem);
        }
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 8b117c90ecd7..0c0e8ecf02ab 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -269,6 +269,12 @@ static void nfnl_err_deliver(struct list_head *err_list, struct sk_buff *skb)
        }
 }
+enum {
+        NFNL_BATCH_FAILURE      = (1 << 0),
+        NFNL_BATCH_DONE         = (1 << 1),
+        NFNL_BATCH_REPLAY       = (1 << 2),
+};
 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
                                u_int16_t subsys_id)
 {
@@ -276,13 +282,15 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
        struct net *net = sock_net(skb->sk);
        const struct nfnetlink_subsystem *ss;
        const struct nfnl_callback *nc;
-        bool success = true, done = false;
        static LIST_HEAD(err_list);
+        u32 status;
        int err;
        if (subsys_id >= NFNL_SUBSYS_COUNT)
                return netlink_ack(skb, nlh, -EINVAL);
 replay:
+        status = 0;
        skb = netlink_skb_clone(oskb, GFP_KERNEL);
        if (!skb)
                return netlink_ack(oskb, nlh, -ENOMEM);
@@ -336,10 +344,10 @@ replay:
                if (type == NFNL_MSG_BATCH_BEGIN) {
                        /* Malformed: Batch begin twice */
                        nfnl_err_reset(&err_list);
-                        success = false;
+                        status |= NFNL_BATCH_FAILURE;
                        goto done;
                } else if (type == NFNL_MSG_BATCH_END) {
-                        done = true;
+                        status |= NFNL_BATCH_DONE;
                        goto done;
                } else if (type < NLMSG_MIN_TYPE) {
                        err = -EINVAL;
@@ -382,11 +390,8 @@ replay:
                         * original skb.
                         */
                        if (err == -EAGAIN) {
-                                nfnl_err_reset(&err_list);
+                                status |= NFNL_BATCH_REPLAY;
-                                ss->abort(oskb);
+                                goto next;
-                                nfnl_unlock(subsys_id);
-                                kfree_skb(skb);
-                                goto replay;
                        }
                }
 ack:
@@ -402,7 +407,7 @@ ack:
                                 */
                                nfnl_err_reset(&err_list);
                                netlink_ack(skb, nlmsg_hdr(oskb), -ENOMEM);
-                                success = false;
+                                status |= NFNL_BATCH_FAILURE;
                                goto done;
                        }
                        /* We don't stop processing the batch on errors, thus,
@@ -410,19 +415,26 @@ ack:
                         * triggers.
                         */
                        if (err)
-                                success = false;
+                                status |= NFNL_BATCH_FAILURE;
                }
+next:
                msglen = NLMSG_ALIGN(nlh->nlmsg_len);
                if (msglen > skb->len)
                        msglen = skb->len;
                skb_pull(skb, msglen);
        }
 done:
-        if (success && done)
+        if (status & NFNL_BATCH_REPLAY) {
+                ss->abort(oskb);
+                nfnl_err_reset(&err_list);
+                nfnl_unlock(subsys_id);
+                kfree_skb(skb);
+                goto replay;
+        } else if (status == NFNL_BATCH_DONE) {
                ss->commit(oskb);
-        else
+        } else {
                ss->abort(oskb);
+        }
        nfnl_err_deliver(&err_list, oskb);
        nfnl_unlock(subsys_id);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index dea925388a5b..d8e2e3918ce2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -158,7 +158,7 @@ static int __netlink_remove_tap(struct netlink_tap *nt)
 out:
        spin_unlock(&netlink_tap_lock);
-        if (found && nt->module)
+        if (found)
                module_put(nt->module);
        return found ? 0 : -ENODEV;
@@ -357,25 +357,52 @@ err1:
        return NULL;
 }
+static void
+__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
+                   unsigned int order)
+{
+        struct netlink_sock *nlk = nlk_sk(sk);
+        struct sk_buff_head *queue;
+        struct netlink_ring *ring;
+        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+        spin_lock_bh(&queue->lock);
+        ring->frame_max         = req->nm_frame_nr - 1;
+        ring->head              = 0;
+        ring->frame_size        = req->nm_frame_size;
+        ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
+        swap(ring->pg_vec_len, req->nm_block_nr);
+        swap(ring->pg_vec_order, order);
+        swap(ring->pg_vec, pg_vec);
+        __skb_queue_purge(queue);
+        spin_unlock_bh(&queue->lock);
+        WARN_ON(atomic_read(&nlk->mapped));
+        if (pg_vec)
+                free_pg_vec(pg_vec, order, req->nm_block_nr);
+}
 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
-                            bool closing, bool tx_ring)
+                            bool tx_ring)
 {
        struct netlink_sock *nlk = nlk_sk(sk);
        struct netlink_ring *ring;
-        struct sk_buff_head *queue;
        void **pg_vec = NULL;
        unsigned int order = 0;
-        int err;
        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
-        if (!closing) {
+        if (atomic_read(&nlk->mapped))
-                if (atomic_read(&nlk->mapped))
+                return -EBUSY;
-                        return -EBUSY;
+        if (atomic_read(&ring->pending))
-                if (atomic_read(&ring->pending))
+                return -EBUSY;
-                        return -EBUSY;
-        }
        if (req->nm_block_nr) {
                if (ring->pg_vec != NULL)
@@ -407,31 +434,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
                        return -EINVAL;
        }
-        err = -EBUSY;
        mutex_lock(&nlk->pg_vec_lock);
-        if (closing || atomic_read(&nlk->mapped) == 0) {
+        if (atomic_read(&nlk->mapped) == 0) {
-                err = 0;
+                __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
-                spin_lock_bh(&queue->lock);
+                mutex_unlock(&nlk->pg_vec_lock);
+                return 0;
-                ring->frame_max         = req->nm_frame_nr - 1;
-                ring->head              = 0;
-                ring->frame_size        = req->nm_frame_size;
-                ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
-                swap(ring->pg_vec_len, req->nm_block_nr);
-                swap(ring->pg_vec_order, order);
-                swap(ring->pg_vec, pg_vec);
-                __skb_queue_purge(queue);
-                spin_unlock_bh(&queue->lock);
-                WARN_ON(atomic_read(&nlk->mapped));
        }
        mutex_unlock(&nlk->pg_vec_lock);
        if (pg_vec)
                free_pg_vec(pg_vec, order, req->nm_block_nr);
-        return err;
+        return -EBUSY;
 }
 static void netlink_mm_open(struct vm_area_struct *vma)
@@ -900,10 +915,10 @@ static void netlink_sock_destruct(struct sock *sk)
                memset(&req, 0, sizeof(req));
                if (nlk->rx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, false);
+                        __netlink_set_ring(sk, &req, false, NULL, 0);
                memset(&req, 0, sizeof(req));
                if (nlk->tx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, true);
+                        __netlink_set_ring(sk, &req, true, NULL, 0);
        }
 #endif /* CONFIG_NETLINK_MMAP */
@@ -2223,7 +2238,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                        return -EINVAL;
                if (copy_from_user(&req, optval, sizeof(req)))
                        return -EFAULT;
-                err = netlink_set_ring(sk, &req, false,
+                err = netlink_set_ring(sk, &req,
                                       optname == NETLINK_TX_RING);
                break;
        }
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 4613df8c8290..65523948fb95 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -752,7 +752,7 @@ int ovs_flow_init(void)
        BUILD_BUG_ON(sizeof(struct sw_flow_key) % sizeof(long));
        flow_cache = kmem_cache_create("sw_flow", sizeof(struct sw_flow)
-                                       + (num_possible_nodes()
+                                       + (nr_node_ids
                                          * sizeof(struct flow_stats *)),
                                       0, 0, NULL);
        if (flow_cache == NULL)
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 273b8bff6ba4..657ba9f5d308 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
        }
        ibmr = rds_ib_alloc_fmr(rds_ibdev);
-        if (IS_ERR(ibmr))
+        if (IS_ERR(ibmr)) {
+                rds_ib_dev_put(rds_ibdev);
                return ibmr;
+        }
        ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
        if (ret == 0)
diff --git a/net/rds/transport.c b/net/rds/transport.c
index 8b4a6cd2c3a7..83498e1c75b8 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -73,7 +73,7 @@ EXPORT_SYMBOL_GPL(rds_trans_unregister);
 void rds_trans_put(struct rds_transport *trans)
 {
-        if (trans && trans->t_owner)
+        if (trans)
                module_put(trans->t_owner);
 }
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 1d56903fd4c7..1df78289e248 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -339,6 +339,9 @@ static void tcf_bpf_cleanup(struct tc_action *act, int bind)
                bpf_prog_put(prog->filter);
        else
                bpf_prog_destroy(prog->filter);
+        kfree(prog->bpf_ops);
+        kfree(prog->bpf_name);
 }
 static struct tc_action_ops act_bpf_ops __read_mostly = {
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index c79ecfd36e0f..e5168f8b9640 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -378,7 +378,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                goto errout;
        if (oldprog) {
-                list_replace_rcu(&prog->link, &oldprog->link);
+                list_replace_rcu(&oldprog->link, &prog->link);
                tcf_unbind_filter(tp, &oldprog->res);
                call_rcu(&oldprog->rcu, __cls_bpf_delete_prog);
        } else {
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 76bc3a20ffdb..bb2a0f529c1f 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -425,6 +425,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
        if (!fnew)
                goto err2;
+        tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
        fold = (struct flow_filter *)*arg;
        if (fold) {
                err = -EINVAL;
@@ -486,7 +488,6 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                fnew->mask  = ~0U;
                fnew->tp = tp;
                get_random_bytes(&fnew->hashrnd, 4);
-                tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
        }
        fnew->perturb_timer.function = flow_perturbation;
@@ -526,7 +527,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
        if (*arg == 0)
                list_add_tail_rcu(&fnew->list, &head->filters);
        else
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
        *arg = (unsigned long)fnew;
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9d37ccd95062..2f3d03f99487 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -499,7 +499,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
        *arg = (unsigned long) fnew;
        if (fold) {
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
                tcf_unbind_filter(tp, &fold->res);
                call_rcu(&fold->rcu, fl_destroy_filter);
        } else {
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index d75993f89fac..21ca33c9f036 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -155,14 +155,23 @@ static unsigned int fq_codel_drop(struct Qdisc *sch)
        skb = dequeue_head(flow);
        len = qdisc_pkt_len(skb);
        q->backlogs[idx] -= len;
-        kfree_skb(skb);
        sch->q.qlen--;
        qdisc_qstats_drop(sch);
        qdisc_qstats_backlog_dec(sch, skb);
+        kfree_skb(skb);
        flow->dropped++;
        return idx;
 }
+static unsigned int fq_codel_qdisc_drop(struct Qdisc *sch)
+{
+        unsigned int prev_backlog;
+        prev_backlog = sch->qstats.backlog;
+        fq_codel_drop(sch);
+        return prev_backlog - sch->qstats.backlog;
+}
 static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
        struct fq_codel_sched_data *q = qdisc_priv(sch);
@@ -604,7 +613,7 @@ static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
        .enqueue        =       fq_codel_enqueue,
        .dequeue        =       fq_codel_dequeue,
        .peek           =       qdisc_peek_dequeued,
-        .drop           =       fq_codel_drop,
+        .drop           =       fq_codel_qdisc_drop,
        .init           =       fq_codel_init,
        .reset          =       fq_codel_reset,
        .destroy        =       fq_codel_destroy,
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 7d1492663360..52f75a5473e1 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -306,10 +306,10 @@ drop:
                len = qdisc_pkt_len(skb);
                slot->backlog -= len;
                sfq_dec(q, x);
-                kfree_skb(skb);
                sch->q.qlen--;
                qdisc_qstats_drop(sch);
                qdisc_qstats_backlog_dec(sch, skb);
+                kfree_skb(skb);
                return len;
        }
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 9825ff0f91d6..6255d141133b 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -240,8 +240,8 @@ static struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt, __be32 xid)
                req = xprt_alloc_bc_req(xprt, GFP_ATOMIC);
                if (!req)
                        goto not_found;
-                /* Note: this 'free' request adds it to xprt->bc_pa_list */
+                list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
-                xprt_free_bc_request(req);
+                xprt->bc_alloc_count++;
        }
        req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
                                rq_bc_pa_list);
@@ -336,7 +336,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
        spin_lock(&xprt->bc_pa_lock);
        list_del(&req->rq_bc_pa_list);
-        xprt->bc_alloc_count--;
+        xprt_dec_alloc_count(xprt, 1);
        spin_unlock(&xprt->bc_pa_lock);
        req->rq_private_buf.len = copied;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index cbc6af923dd1..23608eb0ded2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1902,6 +1902,7 @@ call_transmit_status(struct rpc_task *task)
        switch (task->tk_status) {
        case -EAGAIN:
+        case -ENOBUFS:
                break;
        default:
                dprint_status(task);
@@ -1928,7 +1929,6 @@ call_transmit_status(struct rpc_task *task)
        case -ECONNABORTED:
        case -EADDRINUSE:
        case -ENOTCONN:
-        case -ENOBUFS:
        case -EPIPE:
                rpc_task_force_reencode(task);
        }
@@ -2057,12 +2057,13 @@ call_status(struct rpc_task *task)
        case -ECONNABORTED:
                rpc_force_rebind(clnt);
        case -EADDRINUSE:
-        case -ENOBUFS:
                rpc_delay(task, 3*HZ);
        case -EPIPE:
        case -ENOTCONN:
                task->tk_action = call_bind;
                break;
+        case -ENOBUFS:
+                rpc_delay(task, HZ>>2);
        case -EAGAIN:
                task->tk_action = call_transmit;
                break;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e193c2b5476b..0030376327b7 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -527,6 +527,10 @@ static int xs_local_send_request(struct rpc_task *task)
                              true, &sent);
        dprintk("RPC:       %s(%u) = %d\n",
                        __func__, xdr->len - req->rq_bytes_sent, status);
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
        if (likely(sent > 0) || status == 0) {
                req->rq_bytes_sent += sent;
                req->rq_xmit_bytes_sent += sent;
@@ -539,6 +543,7 @@ static int xs_local_send_request(struct rpc_task *task)
        switch (status) {
        case -ENOBUFS:
+                break;
        case -EAGAIN:
                status = xs_nospace(task);
                break;
@@ -589,6 +594,9 @@ static int xs_udp_send_request(struct rpc_task *task)
        if (status == -EPERM)
                goto process_status;
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
        if (sent > 0 || status == 0) {
                req->rq_xmit_bytes_sent += sent;
                if (sent >= req->rq_slen)
@@ -669,9 +677,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
                dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
                                xdr->len - req->rq_bytes_sent, status);
-                if (unlikely(sent == 0 && status < 0))
-                        break;
                /* If we've sent the entire packet, immediately
                 * reset the count of bytes sent. */
                req->rq_bytes_sent += sent;
@@ -681,18 +686,21 @@ static int xs_tcp_send_request(struct rpc_task *task)
                        return 0;
                }
-                if (sent != 0)
+                if (status < 0)
-                        continue;
+                        break;
-                status = -EAGAIN;
+                if (sent == 0) {
-                break;
+                        status = -EAGAIN;
+                        break;
+                }
        }
+        if (status == -EAGAIN && sk_stream_is_writeable(transport->inet))
+                status = -ENOBUFS;
        switch (status) {
        case -ENOTSOCK:
                status = -ENOTCONN;
                /* Should we call xs_close() here? */
                break;
-        case -ENOBUFS:
        case -EAGAIN:
                status = xs_nospace(task);
                break;
@@ -703,6 +711,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
        case -ECONNREFUSED:
        case -ENOTCONN:
        case -EADDRINUSE:
+        case -ENOBUFS:
        case -EPIPE:
                clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
        }
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 84f77a054025..9f2add3cba26 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -171,8 +171,10 @@ int switchdev_port_attr_set(struct net_device *dev, struct switchdev_attr *attr)
                 * released.
                 */
-                attr->trans = SWITCHDEV_TRANS_ABORT;
+                if (err != -EOPNOTSUPP) {
-                __switchdev_port_attr_set(dev, attr);
+                        attr->trans = SWITCHDEV_TRANS_ABORT;
+                        __switchdev_port_attr_set(dev, attr);
+                }
                return err;
        }
@@ -249,8 +251,10 @@ int switchdev_port_obj_add(struct net_device *dev, struct switchdev_obj *obj)
                 * released.
                 */
-                obj->trans = SWITCHDEV_TRANS_ABORT;
+                if (err != -EOPNOTSUPP) {
-                __switchdev_port_obj_add(dev, obj);
+                        obj->trans = SWITCHDEV_TRANS_ABORT;
+                        __switchdev_port_obj_add(dev, obj);
+                }
                return err;
        }
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 46b6ed534ef2..3a7567f690f3 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2007,6 +2007,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1);
        if (res)
                goto exit;
+        security_sk_clone(sock->sk, new_sock->sk);
        new_sk = new_sock->sk;
        new_tsock = tipc_sk(new_sk);
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 915b328b9ac5..59cabc9bce69 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -797,23 +797,18 @@ static bool cfg80211_ir_permissive_chan(struct wiphy *wiphy,
        return false;
 }
-bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+static bool _cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                             struct cfg80211_chan_def *chandef,
+                                     struct cfg80211_chan_def *chandef,
-                             enum nl80211_iftype iftype)
+                                     enum nl80211_iftype iftype,
+                                     bool check_no_ir)
 {
        bool res;
        u32 prohibited_flags = IEEE80211_CHAN_DISABLED |
                               IEEE80211_CHAN_RADAR;
-        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype);
+        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
-        /*
+        if (check_no_ir)
-         * Under certain conditions suggested by some regulatory bodies a
-         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
-         * only if such relaxations are not enabled and the conditions are not
-         * met.
-         */
-        if (!cfg80211_ir_permissive_chan(wiphy, iftype, chandef->chan))
                prohibited_flags |= IEEE80211_CHAN_NO_IR;
        if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 &&
@@ -827,8 +822,36 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
        trace_cfg80211_return_bool(res);
        return res;
 }
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                             struct cfg80211_chan_def *chandef,
+                             enum nl80211_iftype iftype)
+{
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, true);
+}
 EXPORT_SYMBOL(cfg80211_reg_can_beacon);
+bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+                                   struct cfg80211_chan_def *chandef,
+                                   enum nl80211_iftype iftype)
+{
+        bool check_no_ir;
+        ASSERT_RTNL();
+        /*
+         * Under certain conditions suggested by some regulatory bodies a
+         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
+         * only if such relaxations are not enabled and the conditions are not
+         * met.
+         */
+        check_no_ir = !cfg80211_ir_permissive_chan(wiphy, iftype,
+                                                   chandef->chan);
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
+}
+EXPORT_SYMBOL(cfg80211_reg_can_beacon_relax);
 int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
                                 struct cfg80211_chan_def *chandef)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c264effd00a6..76b41578a838 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2003,7 +2003,8 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
        switch (iftype) {
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_P2P_GO:
-                if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
+                if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                                   iftype)) {
                        result = -EINVAL;
                        break;
                }
@@ -3403,8 +3404,8 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
        } else if (!nl80211_get_ap_channel(rdev, &params))
                return -EINVAL;
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+                                           wdev->iftype))
                return -EINVAL;
        if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
@@ -6492,8 +6493,8 @@ skip_beacons:
        if (err)
                return err;
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+                                           wdev->iftype))
                return -EINVAL;
        err = cfg80211_chandef_dfs_required(wdev->wiphy,
@@ -10170,7 +10171,8 @@ static int nl80211_tdls_channel_switch(struct sk_buff *skb,
                return -EINVAL;
        /* we will be active on the TDLS link */
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                           wdev->iftype))
                return -EINVAL;
        /* don't allow switching to DFS channels */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index d359e0610198..aa2d75482017 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -544,15 +544,15 @@ static int call_crda(const char *alpha2)
        reg_regdb_query(alpha2);
        if (reg_crda_timeouts > REG_MAX_CRDA_TIMEOUTS) {
-                pr_info("Exceeded CRDA call max attempts. Not calling CRDA\n");
+                pr_debug("Exceeded CRDA call max attempts. Not calling CRDA\n");
                return -EINVAL;
        }
        if (!is_world_regdom((char *) alpha2))
-                pr_info("Calling CRDA for country: %c%c\n",
+                pr_debug("Calling CRDA for country: %c%c\n",
                        alpha2[0], alpha2[1]);
        else
-                pr_info("Calling CRDA to update world regulatory domain\n");
+                pr_debug("Calling CRDA to update world regulatory domain\n");
        return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
 }
@@ -1589,7 +1589,7 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_P2P_GO:
        case NL80211_IFTYPE_ADHOC:
-                return cfg80211_reg_can_beacon(wiphy, &chandef, iftype);
+                return cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_P2P_CLIENT:
                return cfg80211_chandef_usable(wiphy, &chandef,
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index af3617c9879e..a808279a432a 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2358,20 +2358,23 @@ TRACE_EVENT(cfg80211_cqm_rssi_notify,
 TRACE_EVENT(cfg80211_reg_can_beacon,
        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
-                 enum nl80211_iftype iftype),
+                 enum nl80211_iftype iftype, bool check_no_ir),
-        TP_ARGS(wiphy, chandef, iftype),
+        TP_ARGS(wiphy, chandef, iftype, check_no_ir),
        TP_STRUCT__entry(
                WIPHY_ENTRY
                CHAN_DEF_ENTRY
                __field(enum nl80211_iftype, iftype)
+                __field(bool, check_no_ir)
        ),
        TP_fast_assign(
                WIPHY_ASSIGN;
                CHAN_DEF_ASSIGN(chandef);
                __entry->iftype = iftype;
+                __entry->check_no_ir = check_no_ir;
        ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d",
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d check_no_ir=%s",
-                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype)
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype,
+                  BOOL_TO_STR(__entry->check_no_ir))
 );
 TRACE_EVENT(cfg80211_chandef_dfs_required,
diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
index 8965d1bb8811..125d6402f64f 100644
--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -168,7 +168,10 @@
 *
 *      For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
 *            Use __get_dynamic_array_len(foo) to get the length of the array
- *            saved.
+ *            saved. Note, __get_dynamic_array_len() returns the total allocated
+ *            length of the dynamic array; __print_array() expects the second
+ *            parameter to be the number of elements. To get that, the array length
+ *            needs to be divided by the element size.
 *
 *      For __string(foo, bar) use __get_str(foo)
 *
@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
 *    This prints out the array that is defined by __array in a nice format.
 */
                  __print_array(__get_dynamic_array(list),
-                                __get_dynamic_array_len(list),
+                                __get_dynamic_array_len(list) / sizeof(int),
                                sizeof(int)),
                  __get_str(str), __get_bitmask(cpus))
 );
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 90e1edc8dd42..d5c8e9a3a73c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2599,7 +2599,7 @@ sub process {
 # if LONG_LINE is ignored, the other 2 types are also ignored
 #
-                if ($length > $max_line_length) {
+                if ($line =~ /^\+/ && $length > $max_line_length) {
                        my $msg_type = "LONG_LINE";
                        # Check the allowed long line types first
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index e72548b5897e..d33437007ad2 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
        if (index_key->type == &key_type_keyring)
                up_write(&keyring_serialise_link_sem);
-        if (edit && !edit->dead_leaf) {
+        if (edit) {
-                key_payload_reserve(keyring,
+                if (!edit->dead_leaf) {
-                                    keyring->datalen - KEYQUOTA_LINK_BYTES);
+                        key_payload_reserve(keyring,
+                                keyring->datalen - KEYQUOTA_LINK_BYTES);
+                }
                assoc_array_cancel_edit(edit);
        }
        up_write(&keyring->sem);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index d126c03361ae..75888dd38a7f 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
 void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
 {
        if (substream->pcm->nonatomic) {
-                down_read(&snd_pcm_link_rwsem);
+                down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
                mutex_lock(&substream->self_group.mutex);
        } else {
                read_lock(&snd_pcm_link_rwlock);
diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
index 442500e06b7c..5676b849379d 100644
--- a/sound/hda/hdac_i915.c
+++ b/sound/hda/hdac_i915.c
@@ -56,8 +56,11 @@ int snd_hdac_display_power(struct hdac_bus *bus, bool enable)
                enable ? "enable" : "disable");
        if (enable) {
-                if (!bus->i915_power_refcount++)
+                if (!bus->i915_power_refcount++) {
                        acomp->ops->get_power(acomp->dev);
+                        snd_hdac_set_codec_wakeup(bus, true);
+                        snd_hdac_set_codec_wakeup(bus, false);
+                }
        } else {
                WARN_ON(!bus->i915_power_refcount);
                if (!--bus->i915_power_refcount)
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index ac0db1679f09..b077bb644434 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -5175,7 +5175,7 @@ static int alt_playback_pcm_open(struct hda_pcm_stream *hinfo,
        int err = 0;
        mutex_lock(&spec->pcm_mutex);
-        if (!spec->indep_hp_enabled)
+        if (spec->indep_hp && !spec->indep_hp_enabled)
                err = -EBUSY;
        else
                spec->active_streams |= 1 << STREAM_INDEP_HP;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 745535d1840a..735bdcb04ce8 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -979,14 +979,16 @@ static int azx_runtime_resume(struct device *dev)
        if (!azx_has_pm_runtime(chip))
                return 0;
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
-                && hda->need_i915_power) {
+                bus = azx_bus(chip);
-                bus =  azx_bus(chip);
+                if (hda->need_i915_power) {
-                snd_hdac_display_power(bus, true);
+                        snd_hdac_display_power(bus, true);
-                haswell_set_bclk(hda);
+                        haswell_set_bclk(hda);
-                /* toggle codec wakeup bit for STATESTS read */
+                } else {
-                snd_hdac_set_codec_wakeup(bus, true);
+                        /* toggle codec wakeup bit for STATESTS read */
-                snd_hdac_set_codec_wakeup(bus, false);
+                        snd_hdac_set_codec_wakeup(bus, true);
+                        snd_hdac_set_codec_wakeup(bus, false);
+                }
        }
        /* Read STATESTS before controller reset */
@@ -2182,6 +2184,8 @@ static const struct pci_device_id azx_ids[] = {
        /* ATI HDMI */
        { PCI_DEVICE(0x1002, 0x1308),
          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0x157a),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
        { PCI_DEVICE(0x1002, 0x793b),
          .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
        { PCI_DEVICE(0x1002, 0x7919),
@@ -2236,8 +2240,14 @@ static const struct pci_device_id azx_ids[] = {
          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
        { PCI_DEVICE(0x1002, 0xaab0),
          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaac0),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
        { PCI_DEVICE(0x1002, 0xaac8),
          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaad8),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaae8),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
        /* VIA VT8251/VT8237A */
        { PCI_DEVICE(0x1106, 0x3288),
          .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 2f2433845d04..a97db5fc8a15 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3512,6 +3512,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",   .patch = patch_nvhdmi },
+{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
@@ -3527,6 +3528,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x80862807, .name = "Haswell HDMI",     .patch = patch_generic_hdmi },
 { .id = 0x80862808, .name = "Broadwell HDMI",   .patch = patch_generic_hdmi },
 { .id = 0x80862809, .name = "Skylake HDMI",     .patch = patch_generic_hdmi },
+{ .id = 0x8086280a, .name = "Broxton HDMI",     .patch = patch_generic_hdmi },
 { .id = 0x80862880, .name = "CedarTrail HDMI",  .patch = patch_generic_hdmi },
 { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi },
 { .id = 0x80862883, .name = "Braswell HDMI",    .patch = patch_generic_hdmi },
@@ -3575,6 +3577,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
 MODULE_ALIAS("snd-hda-codec-id:10de0072");
+MODULE_ALIAS("snd-hda-codec-id:10de007d");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
@@ -3591,6 +3594,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862806");
 MODULE_ALIAS("snd-hda-codec-id:80862807");
 MODULE_ALIAS("snd-hda-codec-id:80862808");
 MODULE_ALIAS("snd-hda-codec-id:80862809");
+MODULE_ALIAS("snd-hda-codec-id:8086280a");
 MODULE_ALIAS("snd-hda-codec-id:80862880");
 MODULE_ALIAS("snd-hda-codec-id:80862882");
 MODULE_ALIAS("snd-hda-codec-id:80862883");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b3b44681d3cf..742fc626f9e1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4441,6 +4441,55 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
        }
 }
+/* Hook to update amp GPIO4 for automute */
+static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+                                          struct hda_jack_callback *jack)
+{
+        struct alc_spec *spec = codec->spec;
+        snd_hda_gen_hp_automute(codec, jack);
+        /* mute_led_polarity is set to 0, so we pass inverted value here */
+        alc_update_gpio_led(codec, 0x10, !spec->gen.hp_jack_present);
+}
+/* Manage GPIOs for HP EliteBook Folio 9480m.
+ *
+ * GPIO4 is the headphone amplifier power control
+ * GPIO3 is the audio output mute indicator LED
+ */
+static void alc280_fixup_hp_9480m(struct hda_codec *codec,
+                                  const struct hda_fixup *fix,
+                                  int action)
+{
+        struct alc_spec *spec = codec->spec;
+        static const struct hda_verb gpio_init[] = {
+                { 0x01, AC_VERB_SET_GPIO_MASK, 0x18 },
+                { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x18 },
+                {}
+        };
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                /* Set the hooks to turn the headphone amp on/off
+                 * as needed
+                 */
+                spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
+                spec->gen.hp_automute_hook = alc280_hp_gpio4_automute_hook;
+                /* The GPIOs are currently off */
+                spec->gpio_led = 0;
+                /* GPIO3 is connected to the output mute LED,
+                 * high is on, low is off
+                 */
+                spec->mute_led_polarity = 0;
+                spec->gpio_mute_led_mask = 0x08;
+                /* Initialize GPIO configuration */
+                snd_hda_add_verbs(codec, gpio_init);
+        }
+}
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
@@ -4521,6 +4570,7 @@ enum {
        ALC286_FIXUP_HP_GPIO_LED,
        ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
        ALC280_FIXUP_HP_DOCK_PINS,
+        ALC280_FIXUP_HP_9480M,
        ALC288_FIXUP_DELL_HEADSET_MODE,
        ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
        ALC288_FIXUP_DELL_XPS_13_GPIO6,
@@ -5011,7 +5061,7 @@ static const struct hda_fixup alc269_fixups[] = {
                        { 0x14, 0x90170110 },
                        { 0x17, 0x40000008 },
                        { 0x18, 0x411111f0 },
-                        { 0x19, 0x411111f0 },
+                        { 0x19, 0x01a1913c },
                        { 0x1a, 0x411111f0 },
                        { 0x1b, 0x411111f0 },
                        { 0x1d, 0x40f89b2d },
@@ -5043,6 +5093,10 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC280_FIXUP_HP_GPIO4
        },
+        [ALC280_FIXUP_HP_9480M] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc280_fixup_hp_9480m,
+        },
        [ALC288_FIXUP_DELL_HEADSET_MODE] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_headset_mode_dell_alc288,
@@ -5161,6 +5215,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
        SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
        SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
        SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
        SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
        /* ALC290 */
@@ -5375,8 +5430,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {0x15, 0x0221401f}, \
        {0x1a, 0x411111f0}, \
        {0x1b, 0x411111f0}, \
-        {0x1d, 0x40700001}, \
+        {0x1d, 0x40700001}
-        {0x1e, 0x411111f0}
 #define ALC298_STANDARD_PINS \
        {0x18, 0x411111f0}, \
@@ -5408,6 +5462,17 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x1d, 0x40700001},
                {0x21, 0x02211030}),
        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x14, 0x90170130},
+                {0x17, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x01014020},
+                {0x1d, 0x4054c029},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0221103f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                {0x12, 0x90a60160},
                {0x14, 0x90170120},
                {0x17, 0x90170140},
@@ -5635,35 +5700,48 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x13, 0x411111f0},
                {0x16, 0x01014020},
                {0x18, 0x411111f0},
-                {0x19, 0x01a19030}),
+                {0x19, 0x01a19030},
+                {0x1e, 0x411111f0}),
        SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
                ALC292_STANDARD_PINS,
                {0x12, 0x90a60140},
                {0x13, 0x411111f0},
                {0x16, 0x01014020},
                {0x18, 0x02a19031},
-                {0x19, 0x01a1903e}),
+                {0x19, 0x01a1903e},
+                {0x1e, 0x411111f0}),
        SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
                ALC292_STANDARD_PINS,
                {0x12, 0x90a60140},
                {0x13, 0x411111f0},
                {0x16, 0x411111f0},
                {0x18, 0x411111f0},
-                {0x19, 0x411111f0}),
+                {0x19, 0x411111f0},
+                {0x1e, 0x411111f0}),
        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
                ALC292_STANDARD_PINS,
                {0x12, 0x40000000},
                {0x13, 0x90a60140},
                {0x16, 0x21014020},
                {0x18, 0x411111f0},
-                {0x19, 0x21a19030}),
+                {0x19, 0x21a19030},
+                {0x1e, 0x411111f0}),
        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
                ALC292_STANDARD_PINS,
                {0x12, 0x40000000},
                {0x13, 0x90a60140},
                {0x16, 0x411111f0},
                {0x18, 0x411111f0},
-                {0x19, 0x411111f0}),
+                {0x19, 0x411111f0},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC292_STANDARD_PINS,
+                {0x12, 0x40000000},
+                {0x13, 0x90a60140},
+                {0x16, 0x21014020},
+                {0x18, 0x411111f0},
+                {0x19, 0x21a19030},
+                {0x1e, 0x411111ff}),
        SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
                ALC298_STANDARD_PINS,
                {0x12, 0x90a60130},
diff --git a/sound/sparc/amd7930.c b/sound/sparc/amd7930.c
index 1b1a89e80d13..784ceb85b2d9 100644
--- a/sound/sparc/amd7930.c
+++ b/sound/sparc/amd7930.c
@@ -956,6 +956,7 @@ static int snd_amd7930_create(struct snd_card *card,
        if (!amd->regs) {
                snd_printk(KERN_ERR
                           "amd7930-%d: Unable to map chip registers.\n", dev);
+                kfree(amd);
                return -EIO;
        }
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 8461d6bf992f..204cc074adb9 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
        int ret = 0;
        spin_lock_irqsave(&pstr->lock, flags);
-        if (!test_and_set_bit(type, &pstr->running)) {
+        if (!test_and_set_bit(type, &pstr->running) &&
-                if (pstr->active_urbs || pstr->unlink_urbs) {
+            !(pstr->active_urbs || pstr->unlink_urbs)) {
-                        ret = -EBUSY;
-                        goto error;
-                }
                pstr->count = 0;
                /* Submit all currently available URBs */
                if (direction == SNDRV_PCM_STREAM_PLAYBACK)
@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
                else
                        ret = line6_submit_audio_in_all_urbs(line6pcm);
        }
- error:
        if (ret < 0)
                clear_bit(type, &pstr->running);
        spin_unlock_irqrestore(&pstr->lock, flags);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 2f6d3e9a1bcd..e4756651a52c 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2512,6 +2512,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
        }
 },
+/* Steinberg devices */
+{
+        /* Steinberg MI2 */
+        USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = & (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = &(const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
+{
+        /* Steinberg MI4 */
+        USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = & (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = &(const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* TerraTec devices */
 {
        USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/tools/lib/api/Makefile b/tools/lib/api/Makefile
index 8bd960658463..fe1b02c2c95b 100644
--- a/tools/lib/api/Makefile
+++ b/tools/lib/api/Makefile
@@ -36,7 +36,7 @@ $(LIBFILE): $(API_IN)
 clean:
        $(call QUIET_CLEAN, libapi) $(RM) $(LIBFILE); \
-        find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o | xargs $(RM)
+        find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o -or -name \*.o.cmd -or -name \*.o.d | xargs $(RM)
 FORCE:
diff --git a/tools/lib/hweight.c b/tools/lib/hweight.c
new file mode 100644
index 000000000000..0b859b884339
--- /dev/null
+++ b/tools/lib/hweight.c
@@ -0,0 +1,62 @@
+#include <linux/bitops.h>
+#include <asm/types.h>
+/**
+ * hweightN - returns the hamming weight of a N-bit word
+ * @x: the word to weigh
+ *
+ * The Hamming Weight of a number is the total number of bits set in it.
+ */
+unsigned int __sw_hweight32(unsigned int w)
+{
+#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+        w -= (w >> 1) & 0x55555555;
+        w =  (w & 0x33333333) + ((w >> 2) & 0x33333333);
+        w =  (w + (w >> 4)) & 0x0f0f0f0f;
+        return (w * 0x01010101) >> 24;
+#else
+        unsigned int res = w - ((w >> 1) & 0x55555555);
+        res = (res & 0x33333333) + ((res >> 2) & 0x33333333);
+        res = (res + (res >> 4)) & 0x0F0F0F0F;
+        res = res + (res >> 8);
+        return (res + (res >> 16)) & 0x000000FF;
+#endif
+}
+unsigned int __sw_hweight16(unsigned int w)
+{
+        unsigned int res = w - ((w >> 1) & 0x5555);
+        res = (res & 0x3333) + ((res >> 2) & 0x3333);
+        res = (res + (res >> 4)) & 0x0F0F;
+        return (res + (res >> 8)) & 0x00FF;
+}
+unsigned int __sw_hweight8(unsigned int w)
+{
+        unsigned int res = w - ((w >> 1) & 0x55);
+        res = (res & 0x33) + ((res >> 2) & 0x33);
+        return (res + (res >> 4)) & 0x0F;
+}
+unsigned long __sw_hweight64(__u64 w)
+{
+#if BITS_PER_LONG == 32
+        return __sw_hweight32((unsigned int)(w >> 32)) +
+               __sw_hweight32((unsigned int)w);
+#elif BITS_PER_LONG == 64
+#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+        w -= (w >> 1) & 0x5555555555555555ul;
+        w =  (w & 0x3333333333333333ul) + ((w >> 2) & 0x3333333333333333ul);
+        w =  (w + (w >> 4)) & 0x0f0f0f0f0f0f0f0ful;
+        return (w * 0x0101010101010101ul) >> 56;
+#else
+        __u64 res = w - ((w >> 1) & 0x5555555555555555ul);
+        res = (res & 0x3333333333333333ul) + ((res >> 2) & 0x3333333333333333ul);
+        res = (res + (res >> 4)) & 0x0F0F0F0F0F0F0F0Ful;
+        res = res + (res >> 8);
+        res = res + (res >> 16);
+        return (res + (res >> 32)) & 0x00000000000000FFul;
+#endif
+#endif
+}
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index 6daaff652aff..7851df1490e0 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -268,7 +268,7 @@ install: install_lib
 clean:
        $(call QUIET_CLEAN, libtraceevent) \
-                $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d \
+                $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d .*.cmd \
                $(RM) TRACEEVENT-CFLAGS tags TAGS
 PHONY += force plugins
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 09dc0aabb515..d01a0aad5a01 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -18,6 +18,7 @@ tools/arch/x86/include/asm/atomic.h
 tools/arch/x86/include/asm/rmwcc.h
 tools/lib/traceevent
 tools/lib/api
+tools/lib/hweight.c
 tools/lib/rbtree.c
 tools/lib/symbol/kallsyms.c
 tools/lib/symbol/kallsyms.h
@@ -57,7 +58,6 @@ include/linux/perf_event.h
 include/linux/list.h
 include/linux/hash.h
 include/linux/stringify.h
-lib/hweight.c
 include/linux/swab.h
 arch/*/include/asm/unistd*.h
 arch/*/include/uapi/asm/unistd*.h
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 7a4b549214e3..bba34636b733 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -109,9 +109,22 @@ $(OUTPUT)PERF-VERSION-FILE: ../../.git/HEAD
        $(Q)$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
        $(Q)touch $(OUTPUT)PERF-VERSION-FILE
-CC = $(CROSS_COMPILE)gcc
+# Makefiles suck: This macro sets a default value of $(2) for the
-LD ?= $(CROSS_COMPILE)ld
+# variable named by $(1), unless the variable has been set by
-AR = $(CROSS_COMPILE)ar
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+# Allow setting CC and AR and LD, or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
 PKG_CONFIG = $(CROSS_COMPILE)pkg-config
 RM      = rm -f
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 37e301a32f43..d99d850e1444 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -343,7 +343,7 @@ static int read_counter(struct perf_evsel *counter)
        return 0;
 }
-static void read_counters(bool close)
+static void read_counters(bool close_counters)
 {
        struct perf_evsel *counter;
@@ -354,7 +354,7 @@ static void read_counters(bool close)
                if (process_counter(counter))
                        pr_warning("failed to process counter %s\n", counter->name);
-                if (close) {
+                if (close_counters) {
                        perf_evsel__close_fd(counter, perf_evsel__nr_cpus(counter),
                                             thread_map__nr(evsel_list->threads));
                }
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 7629bef2fd79..fa67613976a8 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -48,7 +48,7 @@ static struct rb_node *hists__filter_entries(struct rb_node *nd,
 static bool hist_browser__has_filter(struct hist_browser *hb)
 {
-        return hists__has_filter(hb->hists) || hb->min_pcnt;
+        return hists__has_filter(hb->hists) || hb->min_pcnt || symbol_conf.has_filter;
 }
 static int hist_browser__get_folding(struct hist_browser *browser)
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index 601d11440596..d2d318c59b37 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -143,6 +143,6 @@ $(OUTPUT)util/rbtree.o: ../lib/rbtree.c FORCE
        $(call rule_mkdir)
        $(call if_changed_dep,cc_o_c)
-$(OUTPUT)util/hweight.o: ../../lib/hweight.c FORCE
+$(OUTPUT)util/hweight.o: ../lib/hweight.c FORCE
        $(call rule_mkdir)
        $(call if_changed_dep,cc_o_c)
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 7e7405c9b936..83d9dd96fe08 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -53,11 +53,6 @@ int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
 {
        struct perf_event_mmap_page *pc = userpg;
-#if BITS_PER_LONG != 64 && !defined(HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT)
-        pr_err("Cannot use AUX area tracing mmaps\n");
-        return -1;
-#endif
        WARN_ONCE(mm->base, "Uninitialized auxtrace_mmap\n");
        mm->userpg = userpg;
@@ -73,6 +68,11 @@ int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
                return 0;
        }
+#if BITS_PER_LONG != 64 && !defined(HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT)
+        pr_err("Cannot use AUX area tracing mmaps\n");
+        return -1;
+#endif
        pc->aux_offset = mp->offset;
        pc->aux_size = mp->len;
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index e23ded40c79e..0766d98c5da5 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -10,7 +10,7 @@ util/ctype.c
 util/evlist.c
 util/evsel.c
 util/cpumap.c
-../../lib/hweight.c
+../lib/hweight.c
 util/thread_map.c
 util/util.c
 util/xyarray.c
@@ -19,5 +19,5 @@ util/rblist.c
 util/stat.c
 util/strlist.c
 util/trace-event.c
-../../lib/rbtree.c
+../lib/rbtree.c
 util/string.c
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 48b588c6951a..60f11414bb5c 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1911,6 +1911,8 @@ int setup_list(struct strlist **list, const char *list_str,
                pr_err("problems parsing %s list\n", list_name);
                return -1;
        }
+        symbol_conf.has_filter = true;
        return 0;
 }
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index bef47ead1d9b..b98ce51af142 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -105,7 +105,8 @@ struct symbol_conf {
                        demangle_kernel,
                        filter_relative,
                        show_hist_headers,
-                        branch_callstack;
+                        branch_callstack,
+                        has_filter;
        const char      *vmlinux_name,
                        *kallsyms_name,
                        *source_prefix,
diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
index da7646d767fe..292ae2c90e06 100644
--- a/tools/perf/util/thread_map.c
+++ b/tools/perf/util/thread_map.c
@@ -136,8 +136,7 @@ struct thread_map *thread_map__new_by_uid(uid_t uid)
                if (grow) {
                        struct thread_map *tmp;
-                        tmp = realloc(threads, (sizeof(*threads) +
+                        tmp = thread_map__realloc(threads, max_threads);
-                                                max_threads * sizeof(pid_t)));
                        if (tmp == NULL)
                                goto out_free_namelist;
diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
index 4b89118f158d..44d440da15dc 100644
--- a/tools/perf/util/vdso.c
+++ b/tools/perf/util/vdso.c
@@ -236,18 +236,16 @@ static struct dso *__machine__findnew_compat(struct machine *machine,
        const char *file_name;
        struct dso *dso;
-        pthread_rwlock_wrlock(&machine->dsos.lock);
        dso = __dsos__find(&machine->dsos, vdso_file->dso_name, true);
        if (dso)
-                goto out_unlock;
+                goto out;
        file_name = vdso__get_compat_file(vdso_file);
        if (!file_name)
-                goto out_unlock;
+                goto out;
        dso = __machine__addnew_vdso(machine, vdso_file->dso_name, file_name);
-out_unlock:
+out:
-        pthread_rwlock_unlock(&machine->dsos.lock);
        return dso;
 }
diff --git a/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c b/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
index 7f0c756993af..3d7dc6afc3f8 100644
--- a/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
+++ b/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
@@ -191,7 +191,7 @@ int main(int argc, char *argv[])
                if (res > 0) {
                        atomic_set(&requeued, 1);
                        break;
-                } else if (res > 0) {
+                } else if (res < 0) {
                        error("FUTEX_CMP_REQUEUE_PI failed\n", errno);
                        ret = RET_ERROR;
                        break;
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 620e37f741b8..1dd087da6f31 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -155,6 +155,8 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
                list_add_tail(&kvg->node, &kv->group_list);
                kvg->vfio_group = vfio_group;
+                kvm_arch_start_assignment(dev->kvm);
                mutex_unlock(&kv->lock);
                kvm_vfio_update_coherency(dev);
@@ -190,6 +192,8 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
                        break;
                }
+                kvm_arch_end_assignment(dev->kvm);
                mutex_unlock(&kv->lock);
                kvm_vfio_group_put_external_user(vfio_group);
@@ -239,6 +243,7 @@ static void kvm_vfio_destroy(struct kvm_device *dev)
                kvm_vfio_group_put_external_user(kvg->vfio_group);
                list_del(&kvg->node);
                kfree(kvg);
+                kvm_arch_end_assignment(dev->kvm);
        }
        kvm_vfio_update_coherency(dev);