122 files changed, 2095 insertions, 1198 deletions
diff --git a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
index b7fa3b97986d..a339dbb15493 100644
--- a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
@@ -44,13 +44,19 @@ Hip05 Example (note that Hip06 is the same except compatible):
        };
 HiSilicon Hip06/Hip07 PCIe host bridge DT (almost-ECAM) description.
+Some BIOSes place the host controller in a mode where it is ECAM
+compliant for all devices other than the root complex. In such cases,
+the host controller should be described as below.
 The properties and their meanings are identical to those described in
 host-generic-pci.txt except as listed below.
 Properties of the host controller node that differ from
 host-generic-pci.txt:
- compatible     : Must be "hisilicon,pcie-almost-ecam"
+- compatible     : Must be "hisilicon,hip06-pcie-ecam", or
+                   "hisilicon,hip07-pcie-ecam"
 - reg            : Two entries: First the ECAM configuration space for any
                   other bus underneath the root bus. Second, the base
@@ -59,7 +65,7 @@ host-generic-pci.txt:
 Example:
        pcie0: pcie@a0090000 {
-                compatible = "hisilicon,pcie-almost-ecam";
+                compatible = "hisilicon,hip06-pcie-ecam";
                reg = <0 0xb0000000 0 0x2000000>,  /*  ECAM configuration space */
                      <0 0xa0090000 0 0x10000>; /* host bridge registers */
                bus-range = <0  31>;
diff --git a/Documentation/devicetree/bindings/power/power_domain.txt b/Documentation/devicetree/bindings/power/power_domain.txt
index 723e1ad937da..940707d095cc 100644
--- a/Documentation/devicetree/bindings/power/power_domain.txt
+++ b/Documentation/devicetree/bindings/power/power_domain.txt
@@ -31,7 +31,9 @@ Optional properties:
 - domain-idle-states : A phandle of an idle-state that shall be soaked into a
                generic domain power state. The idle state definitions are
-                compatible with domain-idle-state specified in [1].
+                compatible with domain-idle-state specified in [1]. phandles
+                that are not compatible with domain-idle-state will be
+                ignored.
  The domain-idle-state property reflects the idle state of this PM domain and
  not the idle states of the devices or sub-domains in the PM domain. Devices
  and sub-domains have their own idle-states independent of the parent
diff --git a/Documentation/devicetree/bindings/power/rockchip-io-domain.txt b/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
index d23dc002a87e..d3a5a93a65cd 100644
--- a/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
+++ b/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
@@ -33,6 +33,7 @@ Required properties:
 - compatible: should be one of:
  - "rockchip,rk3188-io-voltage-domain" for rk3188
  - "rockchip,rk3288-io-voltage-domain" for rk3288
+  - "rockchip,rk3328-io-voltage-domain" for rk3328
  - "rockchip,rk3368-io-voltage-domain" for rk3368
  - "rockchip,rk3368-pmu-io-voltage-domain" for rk3368 pmu-domains
  - "rockchip,rk3399-io-voltage-domain" for rk3399
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 64546eb9a16a..ee69d7532172 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -478,15 +478,23 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h:
    - set the power.last_busy field to the current time
  void pm_runtime_use_autosuspend(struct device *dev);
-    - set the power.use_autosuspend flag, enabling autosuspend delays
+    - set the power.use_autosuspend flag, enabling autosuspend delays; call
+      pm_runtime_get_sync if the flag was previously cleared and
+      power.autosuspend_delay is negative
  void pm_runtime_dont_use_autosuspend(struct device *dev);
-    - clear the power.use_autosuspend flag, disabling autosuspend delays
+    - clear the power.use_autosuspend flag, disabling autosuspend delays;
+      decrement the device's usage counter if the flag was previously set and
+      power.autosuspend_delay is negative; call pm_runtime_idle
  void pm_runtime_set_autosuspend_delay(struct device *dev, int delay);
    - set the power.autosuspend_delay value to 'delay' (expressed in
      milliseconds); if 'delay' is negative then runtime suspends are
-      prevented
+      prevented; if power.use_autosuspend is set, pm_runtime_get_sync may be
+      called or the device's usage counter may be decremented and
+      pm_runtime_idle called depending on if power.autosuspend_delay is
+      changed to or from a negative value; if power.use_autosuspend is clear,
+      pm_runtime_idle is called
  unsigned long pm_runtime_autosuspend_expiration(struct device *dev);
    - calculate the time when the current autosuspend delay period will expire,
@@ -836,9 +844,8 @@ of the non-autosuspend counterparts:
        Instead of: pm_runtime_put_sync   use: pm_runtime_put_sync_autosuspend.
 Drivers may also continue to use the non-autosuspend helper functions; they
-will behave normally, not taking the autosuspend delay into account.
+will behave normally, which means sometimes taking the autosuspend delay into
-Similarly, if the power.use_autosuspend field isn't set then the autosuspend
+account (see pm_runtime_idle).
-helper functions will behave just like the non-autosuspend counterparts.
 Under some circumstances a driver or subsystem may want to prevent a device
 from autosuspending immediately, even though the usage counter is zero and the
diff --git a/MAINTAINERS b/MAINTAINERS
index 676c139bc883..56a92ec7d3f7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2585,12 +2585,26 @@ F:	include/uapi/linux/if_bonding.h
 BPF (Safe dynamic programs and tools)
 M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
 L:      netdev@vger.kernel.org
 L:      linux-kernel@vger.kernel.org
 S:      Supported
+F:      arch/x86/net/bpf_jit*
+F:      Documentation/networking/filter.txt
+F:      include/linux/bpf*
+F:      include/linux/filter.h
+F:      include/uapi/linux/bpf*
+F:      include/uapi/linux/filter.h
 F:      kernel/bpf/
-F:      tools/testing/selftests/bpf/
+F:      kernel/trace/bpf_trace.c
 F:      lib/test_bpf.c
+F:      net/bpf/
+F:      net/core/filter.c
+F:      net/sched/act_bpf.c
+F:      net/sched/cls_bpf.c
+F:      samples/bpf/
+F:      tools/net/bpf*
+F:      tools/testing/selftests/bpf/
 BROADCOM B44 10/100 ETHERNET DRIVER
 M:      Michael Chan <michael.chan@broadcom.com>
@@ -3449,6 +3463,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
 T:      git git://git.linaro.org/people/vireshk/linux.git (For ARM Updates)
 B:      https://bugzilla.kernel.org
 F:      Documentation/cpu-freq/
+F:      Documentation/devicetree/bindings/cpufreq/
 F:      drivers/cpufreq/
 F:      include/linux/cpufreq.h
 F:      tools/testing/selftests/cpufreq/
@@ -8761,6 +8776,7 @@ W:	http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+B:      mailto:netdev@vger.kernel.org
 S:      Maintained
 F:      net/
 F:      include/net/
@@ -12464,7 +12480,6 @@ F:	drivers/clk/ti/
 F:      include/linux/clk/ti.h
 TI ETHERNET SWITCH DRIVER (CPSW)
-M:      Mugunthan V N <mugunthanvnm@ti.com>
 R:      Grygorii Strashko <grygorii.strashko@ti.com>
 L:      linux-omap@vger.kernel.org
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index 5039b9148d15..779302695453 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Fearless Coyote
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 162e1eb5373d..6c5affe2d0f5 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -1189,11 +1189,6 @@
                        status = "disabled";
                };
-                cpufreq-cooling {
-                        compatible = "stericsson,db8500-cpufreq-cooling";
-                        status = "disabled";
-                };
                mcde@a0350000 {
                        compatible = "stericsson,mcde";
                        reg = <0xa0350000 0x1000>, /* MCDE */
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 8442727f28d2..cbd4f4af8108 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -39,10 +39,10 @@
 #define get_user __get_user
 #if !defined(CONFIG_64BIT)
-#define LDD_USER(ptr)           __get_user_asm64(ptr)
+#define LDD_USER(val, ptr)      __get_user_asm64(val, ptr)
 #define STD_USER(x, ptr)        __put_user_asm64(x, ptr)
 #else
-#define LDD_USER(ptr)           __get_user_asm("ldd", ptr)
+#define LDD_USER(val, ptr)      __get_user_asm(val, "ldd", ptr)
 #define STD_USER(x, ptr)        __put_user_asm("std", x, ptr)
 #endif
@@ -97,63 +97,87 @@ struct exception_data {
                " mtsp %0,%%sr2\n\t"            \
                : : "r"(get_fs()) : )
-#define __get_user(x, ptr)                               \
+#define __get_user_internal(val, ptr)                   \
-({                                                       \
+({                                                      \
-        register long __gu_err __asm__ ("r8") = 0;       \
+        register long __gu_err __asm__ ("r8") = 0;      \
-        register long __gu_val;                          \
+                                                        \
-                                                         \
+        switch (sizeof(*(ptr))) {                       \
-        load_sr2();                                      \
+        case 1: __get_user_asm(val, "ldb", ptr); break; \
-        switch (sizeof(*(ptr))) {                        \
+        case 2: __get_user_asm(val, "ldh", ptr); break; \
-            case 1: __get_user_asm("ldb", ptr); break;   \
+        case 4: __get_user_asm(val, "ldw", ptr); break; \
-            case 2: __get_user_asm("ldh", ptr); break;   \
+        case 8: LDD_USER(val, ptr); break;              \
-            case 4: __get_user_asm("ldw", ptr); break;   \
+        default: BUILD_BUG();                           \
-            case 8: LDD_USER(ptr);  break;               \
+        }                                               \
-            default: BUILD_BUG(); break;                 \
+                                                        \
-        }                                                \
+        __gu_err;                                       \
-                                                         \
-        (x) = (__force __typeof__(*(ptr))) __gu_val;     \
-        __gu_err;                                        \
 })
-#define __get_user_asm(ldx, ptr)                        \
+#define __get_user(val, ptr)                            \
+({                                                      \
+        load_sr2();                                     \
+        __get_user_internal(val, ptr);                  \
+})
+#define __get_user_asm(val, ldx, ptr)                   \
+{                                                       \
+        register long __gu_val;                         \
+                                                        \
        __asm__("1: " ldx " 0(%%sr2,%2),%0\n"           \
                "9:\n"                                  \
                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
                : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err));
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = (__force __typeof__(*(ptr))) __gu_val;  \
+}
 #if !defined(CONFIG_64BIT)
-#define __get_user_asm64(ptr)                           \
+#define __get_user_asm64(val, ptr)                      \
+{                                                       \
+        union {                                         \
+                unsigned long long      l;              \
+                __typeof__(*(ptr))      t;              \
+        } __gu_tmp;                                     \
+                                                        \
        __asm__("   copy %%r0,%R0\n"                    \
                "1: ldw 0(%%sr2,%2),%0\n"               \
                "2: ldw 4(%%sr2,%2),%R0\n"              \
                "9:\n"                                  \
                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b) \
-                : "=r"(__gu_val), "=r"(__gu_err)        \
+                : "=&r"(__gu_tmp.l), "=r"(__gu_err)     \
-                : "r"(ptr), "1"(__gu_err));
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = __gu_tmp.t;                             \
+}
 #endif /* !defined(CONFIG_64BIT) */
-#define __put_user(x, ptr)                                      \
+#define __put_user_internal(x, ptr)                             \
 ({                                                              \
        register long __pu_err __asm__ ("r8") = 0;              \
        __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);       \
                                                                \
-        load_sr2();                                             \
        switch (sizeof(*(ptr))) {                               \
-            case 1: __put_user_asm("stb", __x, ptr); break;     \
+        case 1: __put_user_asm("stb", __x, ptr); break;         \
-            case 2: __put_user_asm("sth", __x, ptr); break;     \
+        case 2: __put_user_asm("sth", __x, ptr); break;         \
-            case 4: __put_user_asm("stw", __x, ptr); break;     \
+        case 4: __put_user_asm("stw", __x, ptr); break;         \
-            case 8: STD_USER(__x, ptr); break;                  \
+        case 8: STD_USER(__x, ptr); break;                      \
-            default: BUILD_BUG(); break;                        \
+        default: BUILD_BUG();                                   \
-        }                                                       \
+        }                                                       \
                                                                \
        __pu_err;                                               \
 })
+#define __put_user(x, ptr)                                      \
+({                                                              \
+        load_sr2();                                             \
+        __put_user_internal(x, ptr);                            \
+})
 /*
 * The "__put_user/kernel_asm()" macros tell gcc they read from memory
 * instead of writing. This is because they do not write to any memory
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 14752eee3d0c..ed3beadd2cc5 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -236,9 +236,9 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
        mtctr   reg;                                                    \
        bctr
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
+#define BRANCH_LINK_TO_FAR(label)                                       \
-        __LOAD_FAR_HANDLER(reg, label);                                 \
+        __LOAD_FAR_HANDLER(r12, label);                                 \
-        mtctr   reg;                                                    \
+        mtctr   r12;                                                    \
        bctrl
 /*
@@ -265,7 +265,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
 #define BRANCH_TO_COMMON(reg, label)                                    \
        b       label
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
+#define BRANCH_LINK_TO_FAR(label)                                       \
        bl      label
 #define BRANCH_TO_KVM(reg, label)                                       \
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6432d4bf08c8..767ef6d68c9e 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -689,7 +689,7 @@ resume_kernel:
        addi    r8,r1,INT_FRAME_SIZE    /* Get the kprobed function entry */
-        lwz     r3,GPR1(r1)
+        ld      r3,GPR1(r1)
        subi    r3,r3,INT_FRAME_SIZE    /* dst: Allocate a trampoline exception frame */
        mr      r4,r1                   /* src:  current exception frame */
        mr      r1,r3                   /* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel:
        addi    r6,r6,8
        bdnz    2b
-        /* Do real store operation to complete stwu */
+        /* Do real store operation to complete stdu */
-        lwz     r5,GPR1(r1)
+        ld      r5,GPR1(r1)
        std     r8,0(r5)
        /* Clear _TIF_EMULATE_STACK_STORE flag */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 857bf7c5b946..6353019966e6 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -982,7 +982,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
        EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
        EXCEPTION_PROLOG_COMMON_3(0xe60)
        addi    r3,r1,STACK_FRAME_OVERHEAD
-        BRANCH_LINK_TO_FAR(r4, hmi_exception_realmode)
+        BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
        /* Windup the stack. */
        /* Move original HSRR0 and HSRR1 into the respective regs */
        ld      r9,_MSR(r1)
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 93e37b12e882..ecec682bb516 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1051,6 +1051,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 {
        if (!MACHINE_HAS_NX)
                pte_val(entry) &= ~_PAGE_NOEXEC;
+        if (pte_present(entry))
+                pte_val(entry) &= ~_PAGE_UNUSED;
        if (mm_has_pgste(mm))
                ptep_set_pte_at(mm, addr, ptep, entry);
        else
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 68ac5c7cd982..a59deaef21e5 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -43,7 +43,7 @@ config SPARC
        select ARCH_HAS_SG_CHAIN
        select CPU_NO_EFFICIENT_FFS
        select HAVE_ARCH_HARDENED_USERCOPY
-        select PROVE_LOCKING_SMALL if PROVE_LOCKING
+        select LOCKDEP_SMALL if LOCKDEP
        select ARCH_WANT_RELAX_ORDER
 config SPARC32
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index ee5273ad918d..7c29d38e6b99 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -461,6 +461,22 @@ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
        pgd_t *pgd;
        unsigned long next;
+        addr &= PMD_MASK;
+        if (addr < floor) {
+                addr += PMD_SIZE;
+                if (!addr)
+                        return;
+        }
+        if (ceiling) {
+                ceiling &= PMD_MASK;
+                if (!ceiling)
+                        return;
+        }
+        if (end - 1 > ceiling - 1)
+                end -= PMD_SIZE;
+        if (addr > end - 1)
+                return;
        pgd = pgd_offset(tlb->mm, addr);
        do {
                next = pgd_addr_end(addr, end);
diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
index 1e5a50c11d3c..217cd4449bc9 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
@@ -85,7 +85,7 @@ void mce_gen_pool_process(struct work_struct *__unused)
        head = llist_reverse_order(head);
        llist_for_each_entry_safe(node, tmp, head, llnode) {
                mce = &node->mce;
-                atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
+                blocking_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
                gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node));
        }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index 903043e6a62b..19592ba1a320 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -13,7 +13,7 @@ enum severity_level {
        MCE_PANIC_SEVERITY,
 };
-extern struct atomic_notifier_head x86_mce_decoder_chain;
+extern struct blocking_notifier_head x86_mce_decoder_chain;
 #define ATTR_LEN                16
 #define INITIAL_CHECK_INTERVAL  5 * 60 /* 5 minutes */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5accfbdee3f0..af44ebeb593f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -123,7 +123,7 @@ static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
 * CPU/chipset specific EDAC code can register a notifier call here to print
 * MCE errors in a human-readable form.
 */
-ATOMIC_NOTIFIER_HEAD(x86_mce_decoder_chain);
+BLOCKING_NOTIFIER_HEAD(x86_mce_decoder_chain);
 /* Do initial initialization of a struct mce */
 void mce_setup(struct mce *m)
@@ -220,7 +220,7 @@ void mce_register_decode_chain(struct notifier_block *nb)
        WARN_ON(nb->priority > MCE_PRIO_LOWEST && nb->priority < MCE_PRIO_EDAC);
-        atomic_notifier_chain_register(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_register(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_register_decode_chain);
@@ -228,7 +228,7 @@ void mce_unregister_decode_chain(struct notifier_block *nb)
 {
        atomic_dec(&num_notifiers);
-        atomic_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_unregister_decode_chain);
@@ -321,18 +321,7 @@ static void __print_mce(struct mce *m)
 static void print_mce(struct mce *m)
 {
-        int ret = 0;
        __print_mce(m);
-        /*
-         * Print out human-readable details about the MCE error,
-         * (if the CPU has an implementation for that)
-         */
-        ret = atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, m);
-        if (ret == NOTIFY_STOP)
-                return;
        pr_emerg_ratelimited(HW_ERR "Run the above through 'mcelog --ascii'\n");
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 572966f49596..c7836a1ded97 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2928,8 +2928,17 @@ bool blk_mq_poll(struct request_queue *q, blk_qc_t cookie)
        hctx = q->queue_hw_ctx[blk_qc_t_to_queue_num(cookie)];
        if (!blk_qc_t_is_internal(cookie))
                rq = blk_mq_tag_to_rq(hctx->tags, blk_qc_t_to_tag(cookie));
-        else
+        else {
                rq = blk_mq_tag_to_rq(hctx->sched_tags, blk_qc_t_to_tag(cookie));
+                /*
+                 * With scheduling, if the request has completed, we'll
+                 * get a NULL return here, as we clear the sched tag when
+                 * that happens. The request still remains valid, like always,
+                 * so we should be safe with just the NULL check.
+                 */
+                if (!rq)
+                        return false;
+        }
        return __blk_mq_poll(hctx, rq);
 }
diff --git a/block/elevator.c b/block/elevator.c
index dbeecf7be719..4d9084a14c10 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -1098,12 +1098,20 @@ int elevator_change(struct request_queue *q, const char *name)
 }
 EXPORT_SYMBOL(elevator_change);
+static inline bool elv_support_iosched(struct request_queue *q)
+{
+        if (q->mq_ops && q->tag_set && (q->tag_set->flags &
+                                BLK_MQ_F_NO_SCHED))
+                return false;
+        return true;
+}
 ssize_t elv_iosched_store(struct request_queue *q, const char *name,
                          size_t count)
 {
        int ret;
-        if (!(q->mq_ops || q->request_fn))
+        if (!(q->mq_ops || q->request_fn) || !elv_support_iosched(q))
                return count;
        ret = __elevator_change(q, name);
@@ -1135,7 +1143,7 @@ ssize_t elv_iosched_show(struct request_queue *q, char *name)
                        len += sprintf(name+len, "[%s] ", elv->elevator_name);
                        continue;
                }
-                if (__e->uses_mq && q->mq_ops)
+                if (__e->uses_mq && q->mq_ops && elv_support_iosched(q))
                        len += sprintf(name+len, "%s ", __e->elevator_name);
                else if (!__e->uses_mq && !q->mq_ops)
                        len += sprintf(name+len, "%s ", __e->elevator_name);
diff --git a/crypto/ahash.c b/crypto/ahash.c
index e58c4970c22b..826cd7ab4d4a 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -32,6 +32,7 @@ struct ahash_request_priv {
        crypto_completion_t complete;
        void *data;
        u8 *result;
+        u32 flags;
        void *ubuf[] CRYPTO_MINALIGN_ATTR;
 };
@@ -253,6 +254,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
        priv->result = req->result;
        priv->complete = req->base.complete;
        priv->data = req->base.data;
+        priv->flags = req->base.flags;
        /*
         * WARNING: We do not backup req->priv here! The req->priv
         *          is for internal use of the Crypto API and the
@@ -267,38 +270,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
        return 0;
 }
-static void ahash_restore_req(struct ahash_request *req)
+static void ahash_restore_req(struct ahash_request *req, int err)
 {
        struct ahash_request_priv *priv = req->priv;
+        if (!err)
+                memcpy(priv->result, req->result,
+                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
        /* Restore the original crypto request. */
        req->result = priv->result;
-        req->base.complete = priv->complete;
-        req->base.data = priv->data;
+        ahash_request_set_callback(req, priv->flags,
+                                   priv->complete, priv->data);
        req->priv = NULL;
        /* Free the req->priv.priv from the ADJUSTED request. */
        kzfree(priv);
 }
-static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
+static void ahash_notify_einprogress(struct ahash_request *req)
 {
        struct ahash_request_priv *priv = req->priv;
+        struct crypto_async_request oreq;
-        if (err == -EINPROGRESS)
+        oreq.data = priv->data;
-                return;
-        if (!err)
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-        ahash_restore_req(req);
+        priv->complete(&oreq, -EINPROGRESS);
 }
 static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
 {
        struct ahash_request *areq = req->data;
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
        /*
         * Restore the original request, see ahash_op_unaligned() for what
         * goes where.
@@ -309,7 +318,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
         */
        /* First copy req->result into req->priv.result */
-        ahash_op_unaligned_finish(areq, err);
+        ahash_restore_req(areq, err);
        /* Complete the ORIGINAL request. */
        areq->base.complete(&areq->base, err);
@@ -325,7 +334,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
                return err;
        err = op(req);
-        ahash_op_unaligned_finish(req, err);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
+        ahash_restore_req(req, err);
        return err;
 }
@@ -360,25 +374,14 @@ int crypto_ahash_digest(struct ahash_request *req)
 }
 EXPORT_SYMBOL_GPL(crypto_ahash_digest);
-static void ahash_def_finup_finish2(struct ahash_request *req, int err)
+static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
 {
-        struct ahash_request_priv *priv = req->priv;
+        struct ahash_request *areq = req->data;
        if (err == -EINPROGRESS)
                return;
-        if (!err)
+        ahash_restore_req(areq, err);
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-        ahash_restore_req(req);
-}
-static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
-{
-        struct ahash_request *areq = req->data;
-        ahash_def_finup_finish2(areq, err);
        areq->base.complete(&areq->base, err);
 }
@@ -389,11 +392,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
                goto out;
        req->base.complete = ahash_def_finup_done2;
-        req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
        err = crypto_ahash_reqtfm(req)->final(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
 out:
-        ahash_def_finup_finish2(req, err);
+        ahash_restore_req(req, err);
        return err;
 }
@@ -401,7 +408,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
 {
        struct ahash_request *areq = req->data;
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
+        areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
        err = ahash_def_finup_finish1(areq, err);
+        if (areq->priv)
+                return;
        areq->base.complete(&areq->base, err);
 }
@@ -416,6 +432,11 @@ static int ahash_def_finup(struct ahash_request *req)
                return err;
        err = tfm->update(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
        return ahash_def_finup_finish1(req, err);
 }
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 5a8053758657..ef59d9926ee9 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -40,6 +40,7 @@ struct aead_async_req {
        struct aead_async_rsgl first_rsgl;
        struct list_head list;
        struct kiocb *iocb;
+        struct sock *sk;
        unsigned int tsgls;
        char iv[];
 };
@@ -379,12 +380,10 @@ unlock:
 static void aead_async_cb(struct crypto_async_request *_req, int err)
 {
-        struct sock *sk = _req->data;
+        struct aead_request *req = _req->data;
-        struct alg_sock *ask = alg_sk(sk);
+        struct crypto_aead *tfm = crypto_aead_reqtfm(req);
-        struct aead_ctx *ctx = ask->private;
-        struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
-        struct aead_request *req = aead_request_cast(_req);
        struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
+        struct sock *sk = areq->sk;
        struct scatterlist *sg = areq->tsgl;
        struct aead_async_rsgl *rsgl;
        struct kiocb *iocb = areq->iocb;
@@ -447,11 +446,12 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
        memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
        INIT_LIST_HEAD(&areq->list);
        areq->iocb = msg->msg_iocb;
+        areq->sk = sk;
        memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
        aead_request_set_tfm(req, tfm);
        aead_request_set_ad(req, ctx->aead_assoclen);
        aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                  aead_async_cb, sk);
+                                  aead_async_cb, req);
        used -= ctx->aead_assoclen;
        /* take over all tx sgls from ctx */
diff --git a/crypto/lrw.c b/crypto/lrw.c
index 3ea095adafd9..a8bfae4451bf 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -345,6 +345,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
        struct rctx *rctx;
        rctx = skcipher_request_ctx(req);
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
        subreq = &rctx->subreq;
        subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -352,6 +359,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
        if (rctx->left)
                return;
+out:
        skcipher_request_complete(req, err);
 }
@@ -389,6 +397,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
        struct rctx *rctx;
        rctx = skcipher_request_ctx(req);
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
        subreq = &rctx->subreq;
        subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -396,6 +411,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
        if (rctx->left)
                return;
+out:
        skcipher_request_complete(req, err);
 }
diff --git a/crypto/xts.c b/crypto/xts.c
index c976bfac29da..89ace5ebc2da 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -286,6 +286,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
        struct rctx *rctx;
        rctx = skcipher_request_ctx(req);
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
        subreq = &rctx->subreq;
        subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -293,6 +300,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
        if (rctx->left)
                return;
+out:
        skcipher_request_complete(req, err);
 }
@@ -330,6 +338,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
        struct rctx *rctx;
        rctx = skcipher_request_ctx(req);
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
        subreq = &rctx->subreq;
        subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -337,6 +352,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
        if (rctx->left)
                return;
+out:
        skcipher_request_complete(req, err);
 }
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fcd4ce6f78d5..1c2b846c5776 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -200,6 +200,7 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
                return -EINVAL;
        /* The state of the list is 'on' IFF all resources are 'on'. */
+        cur_state = 0;
        list_for_each_entry(entry, list, node) {
                struct acpi_power_resource *resource = entry->resource;
                acpi_handle handle = resource->device.handle;
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index e697dec9d25b..ad196427b4f2 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -121,7 +121,9 @@ static const struct genpd_lock_ops genpd_spin_ops = {
 #define genpd_lock_interruptible(p)     p->lock_ops->lock_interruptible(p)
 #define genpd_unlock(p)                 p->lock_ops->unlock(p)
+#define genpd_status_on(genpd)          (genpd->status == GPD_STATE_ACTIVE)
 #define genpd_is_irq_safe(genpd)        (genpd->flags & GENPD_FLAG_IRQ_SAFE)
+#define genpd_is_always_on(genpd)       (genpd->flags & GENPD_FLAG_ALWAYS_ON)
 static inline bool irq_safe_dev_in_no_sleep_domain(struct device *dev,
                struct generic_pm_domain *genpd)
@@ -130,8 +132,12 @@ static inline bool irq_safe_dev_in_no_sleep_domain(struct device *dev,
        ret = pm_runtime_is_irq_safe(dev) && !genpd_is_irq_safe(genpd);
-        /* Warn once if IRQ safe dev in no sleep domain */
+        /*
-        if (ret)
+         * Warn once if an IRQ safe device is attached to a no sleep domain, as
+         * to indicate a suboptimal configuration for PM. For an always on
+         * domain this isn't case, thus don't warn.
+         */
+        if (ret && !genpd_is_always_on(genpd))
                dev_warn_once(dev, "PM domain %s will not be powered off\n",
                                genpd->name);
@@ -296,11 +302,15 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
         * (1) The domain is already in the "power off" state.
         * (2) System suspend is in progress.
         */
-        if (genpd->status == GPD_STATE_POWER_OFF
+        if (!genpd_status_on(genpd) || genpd->prepared_count > 0)
-            || genpd->prepared_count > 0)
                return 0;
-        if (atomic_read(&genpd->sd_count) > 0)
+        /*
+         * Abort power off for the PM domain in the following situations:
+         * (1) The domain is configured as always on.
+         * (2) When the domain has a subdomain being powered on.
+         */
+        if (genpd_is_always_on(genpd) || atomic_read(&genpd->sd_count) > 0)
                return -EBUSY;
        list_for_each_entry(pdd, &genpd->dev_list, list_node) {
@@ -373,7 +383,7 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth)
        struct gpd_link *link;
        int ret = 0;
-        if (genpd->status == GPD_STATE_ACTIVE)
+        if (genpd_status_on(genpd))
                return 0;
        /*
@@ -752,7 +762,7 @@ static void genpd_sync_power_off(struct generic_pm_domain *genpd, bool use_lock,
 {
        struct gpd_link *link;
-        if (genpd->status == GPD_STATE_POWER_OFF)
+        if (!genpd_status_on(genpd) || genpd_is_always_on(genpd))
                return;
        if (genpd->suspended_count != genpd->device_count
@@ -761,7 +771,8 @@ static void genpd_sync_power_off(struct generic_pm_domain *genpd, bool use_lock,
        /* Choose the deepest state when suspending */
        genpd->state_idx = genpd->state_count - 1;
-        _genpd_power_off(genpd, false);
+        if (_genpd_power_off(genpd, false))
+                return;
        genpd->status = GPD_STATE_POWER_OFF;
@@ -793,7 +804,7 @@ static void genpd_sync_power_on(struct generic_pm_domain *genpd, bool use_lock,
 {
        struct gpd_link *link;
-        if (genpd->status == GPD_STATE_ACTIVE)
+        if (genpd_status_on(genpd))
                return;
        list_for_each_entry(link, &genpd->slave_links, slave_node) {
@@ -1329,8 +1340,7 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd,
        genpd_lock(subdomain);
        genpd_lock_nested(genpd, SINGLE_DEPTH_NESTING);
-        if (genpd->status == GPD_STATE_POWER_OFF
+        if (!genpd_status_on(genpd) && genpd_status_on(subdomain)) {
-            &&  subdomain->status != GPD_STATE_POWER_OFF) {
                ret = -EINVAL;
                goto out;
        }
@@ -1346,7 +1356,7 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd,
        list_add_tail(&link->master_node, &genpd->master_links);
        link->slave = subdomain;
        list_add_tail(&link->slave_node, &subdomain->slave_links);
-        if (subdomain->status != GPD_STATE_POWER_OFF)
+        if (genpd_status_on(subdomain))
                genpd_sd_counter_inc(genpd);
 out:
@@ -1406,7 +1416,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
                list_del(&link->master_node);
                list_del(&link->slave_node);
                kfree(link);
-                if (subdomain->status != GPD_STATE_POWER_OFF)
+                if (genpd_status_on(subdomain))
                        genpd_sd_counter_dec(genpd);
                ret = 0;
@@ -1492,6 +1502,10 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
                genpd->dev_ops.start = pm_clk_resume;
        }
+        /* Always-on domains must be powered on at initialization. */
+        if (genpd_is_always_on(genpd) && !genpd_status_on(genpd))
+                return -EINVAL;
        /* Use only one "off" state if there were no states declared */
        if (genpd->state_count == 0) {
                ret = genpd_set_default_power_state(genpd);
@@ -1700,12 +1714,12 @@ int of_genpd_add_provider_simple(struct device_node *np,
        mutex_lock(&gpd_list_lock);
-        if (pm_genpd_present(genpd))
+        if (pm_genpd_present(genpd)) {
                ret = genpd_add_provider(np, genpd_xlate_simple, genpd);
+                if (!ret) {
-        if (!ret) {
+                        genpd->provider = &np->fwnode;
-                genpd->provider = &np->fwnode;
+                        genpd->has_provider = true;
-                genpd->has_provider = true;
+                }
        }
        mutex_unlock(&gpd_list_lock);
@@ -2079,11 +2093,6 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
        int err;
        u32 residency;
        u32 entry_latency, exit_latency;
-        const struct of_device_id *match_id;
-        match_id = of_match_node(idle_state_match, state_node);
-        if (!match_id)
-                return -EINVAL;
        err = of_property_read_u32(state_node, "entry-latency-us",
                                                &entry_latency);
@@ -2132,6 +2141,7 @@ int of_genpd_parse_idle_states(struct device_node *dn,
        int err, ret;
        int count;
        struct of_phandle_iterator it;
+        const struct of_device_id *match_id;
        count = of_count_phandle_with_args(dn, "domain-idle-states", NULL);
        if (count <= 0)
@@ -2144,6 +2154,9 @@ int of_genpd_parse_idle_states(struct device_node *dn,
        /* Loop over the phandles until all the requested entry is found */
        of_for_each_phandle(&it, err, dn, "domain-idle-states", NULL, 0) {
                np = it.node;
+                match_id = of_match_node(idle_state_match, np);
+                if (!match_id)
+                        continue;
                ret = genpd_parse_state(&st[i++], np);
                if (ret) {
                        pr_err
@@ -2155,8 +2168,11 @@ int of_genpd_parse_idle_states(struct device_node *dn,
                }
        }
-        *n = count;
+        *n = i;
-        *states = st;
+        if (!i)
+                kfree(st);
+        else
+                *states = st;
        return 0;
 }
@@ -2221,7 +2237,7 @@ static int pm_genpd_summary_one(struct seq_file *s,
        if (WARN_ON(genpd->status >= ARRAY_SIZE(status_lookup)))
                goto exit;
-        if (genpd->status == GPD_STATE_POWER_OFF)
+        if (!genpd_status_on(genpd))
                snprintf(state, sizeof(state), "%s-%u",
                         status_lookup[genpd->status], genpd->state_idx);
        else
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index f96ab717534c..1d1dc11aa5fa 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3969,7 +3969,7 @@ static int mtip_block_initialize(struct driver_data *dd)
        dd->tags.reserved_tags = 1;
        dd->tags.cmd_size = sizeof(struct mtip_cmd);
        dd->tags.numa_node = dd->numa_node;
-        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE;
+        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_NO_SCHED;
        dd->tags.driver_data = dd;
        dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS;
diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index ab609a76706f..cf9449b3dbd9 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -429,6 +429,13 @@ static const struct clk_div_table pll_divp_table[] = {
        { 0, 2 }, { 1, 4 }, { 2, 6 }, { 3, 8 }, { 0 }
 };
+static const struct clk_div_table pll_divq_table[] = {
+        { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 },
+        { 8, 8 }, { 9, 9 }, { 10, 10 }, { 11, 11 }, { 12, 12 }, { 13, 13 },
+        { 14, 14 }, { 15, 15 },
+        { 0 }
+};
 static const struct clk_div_table pll_divr_table[] = {
        { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 }, { 0 }
 };
@@ -496,9 +503,9 @@ struct stm32f4_div_data {
 #define MAX_PLL_DIV 3
 static const struct stm32f4_div_data  div_data[MAX_PLL_DIV] = {
-        { 16, 2, 0,                     pll_divp_table  },
+        { 16, 2, 0, pll_divp_table },
-        { 24, 4, CLK_DIVIDER_ONE_BASED, NULL            },
+        { 24, 4, 0, pll_divq_table },
-        { 28, 3, 0,                     pll_divr_table  },
+        { 28, 3, 0, pll_divr_table },
 };
 struct stm32f4_pll_data {
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index 72109d2cf41b..1c2357301017 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -1,6 +1,7 @@
 config SUNXI_CCU
        bool "Clock support for Allwinner SoCs"
        depends on ARCH_SUNXI || COMPILE_TEST
+        select RESET_CONTROLLER
        default ARCH_SUNXI
 if SUNXI_CCU
@@ -135,6 +136,7 @@ config SUN8I_V3S_CCU
 config SUN9I_A80_CCU
        bool "Support for the Allwinner A80 CCU"
        select SUNXI_CCU_DIV
+        select SUNXI_CCU_MULT
        select SUNXI_CCU_GATE
        select SUNXI_CCU_NKMP
        select SUNXI_CCU_NM
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index a7b3c08ed0e2..2c69b631967a 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -752,6 +752,13 @@ static const struct sunxi_ccu_desc sun8i_a33_ccu_desc = {
        .num_resets     = ARRAY_SIZE(sun8i_a33_ccu_resets),
 };
+static struct ccu_pll_nb sun8i_a33_pll_cpu_nb = {
+        .common = &pll_cpux_clk.common,
+        /* copy from pll_cpux_clk */
+        .enable = BIT(31),
+        .lock   = BIT(28),
+};
 static struct ccu_mux_nb sun8i_a33_cpu_nb = {
        .common         = &cpux_clk.common,
        .cm             = &cpux_clk.mux,
@@ -783,6 +790,10 @@ static void __init sun8i_a33_ccu_setup(struct device_node *node)
        sunxi_ccu_probe(node, reg, &sun8i_a33_ccu_desc);
+        /* Gate then ungate PLL CPU after any rate changes */
+        ccu_pll_notifier_register(&sun8i_a33_pll_cpu_nb);
+        /* Reparent CPU during PLL CPU rate changes */
        ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
                                  &sun8i_a33_cpu_nb);
 }
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index 8a47bafd7890..9d8724715a43 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -14,11 +14,13 @@
 * GNU General Public License for more details.
 */
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/iopoll.h>
 #include <linux/slab.h>
 #include "ccu_common.h"
+#include "ccu_gate.h"
 #include "ccu_reset.h"
 static DEFINE_SPINLOCK(ccu_lock);
@@ -39,6 +41,53 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
        WARN_ON(readl_relaxed_poll_timeout(addr, reg, reg & lock, 100, 70000));
 }
+/*
+ * This clock notifier is called when the frequency of a PLL clock is
+ * changed. In common PLL designs, changes to the dividers take effect
+ * almost immediately, while changes to the multipliers (implemented
+ * as dividers in the feedback loop) take a few cycles to work into
+ * the feedback loop for the PLL to stablize.
+ *
+ * Sometimes when the PLL clock rate is changed, the decrease in the
+ * divider is too much for the decrease in the multiplier to catch up.
+ * The PLL clock rate will spike, and in some cases, might lock up
+ * completely.
+ *
+ * This notifier callback will gate and then ungate the clock,
+ * effectively resetting it, so it proceeds to work. Care must be
+ * taken to reparent consumers to other temporary clocks during the
+ * rate change, and that this notifier callback must be the first
+ * to be registered.
+ */
+static int ccu_pll_notifier_cb(struct notifier_block *nb,
+                               unsigned long event, void *data)
+{
+        struct ccu_pll_nb *pll = to_ccu_pll_nb(nb);
+        int ret = 0;
+        if (event != POST_RATE_CHANGE)
+                goto out;
+        ccu_gate_helper_disable(pll->common, pll->enable);
+        ret = ccu_gate_helper_enable(pll->common, pll->enable);
+        if (ret)
+                goto out;
+        ccu_helper_wait_for_lock(pll->common, pll->lock);
+out:
+        return notifier_from_errno(ret);
+}
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb)
+{
+        pll_nb->clk_nb.notifier_call = ccu_pll_notifier_cb;
+        return clk_notifier_register(pll_nb->common->hw.clk,
+                                     &pll_nb->clk_nb);
+}
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                    const struct sunxi_ccu_desc *desc)
 {
diff --git a/drivers/clk/sunxi-ng/ccu_common.h b/drivers/clk/sunxi-ng/ccu_common.h
index 73d81dc58fc5..d6fdd7a789aa 100644
--- a/drivers/clk/sunxi-ng/ccu_common.h
+++ b/drivers/clk/sunxi-ng/ccu_common.h
@@ -83,6 +83,18 @@ struct sunxi_ccu_desc {
 void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock);
+struct ccu_pll_nb {
+        struct notifier_block   clk_nb;
+        struct ccu_common       *common;
+        u32     enable;
+        u32     lock;
+};
+#define to_ccu_pll_nb(_nb) container_of(_nb, struct ccu_pll_nb, clk_nb)
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb);
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                    const struct sunxi_ccu_desc *desc);
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 74fa5c5904d3..74ed7e9a7f27 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -247,6 +247,12 @@ config ARM_TEGRA124_CPUFREQ
        help
          This adds the CPUFreq driver support for Tegra124 SOCs.
+config ARM_TEGRA186_CPUFREQ
+        tristate "Tegra186 CPUFreq support"
+        depends on ARCH_TEGRA && TEGRA_BPMP
+        help
+          This adds the CPUFreq driver support for Tegra186 SOCs.
 config ARM_TI_CPUFREQ
        bool "Texas Instruments CPUFreq support"
        depends on ARCH_OMAP2PLUS
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index 9f5a8045f36d..b7e78f063c4f 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -77,6 +77,7 @@ obj-$(CONFIG_ARM_SPEAR_CPUFREQ)		+= spear-cpufreq.o
 obj-$(CONFIG_ARM_STI_CPUFREQ)           += sti-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA20_CPUFREQ)       += tegra20-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA124_CPUFREQ)      += tegra124-cpufreq.o
+obj-$(CONFIG_ARM_TEGRA186_CPUFREQ)      += tegra186-cpufreq.o
 obj-$(CONFIG_ARM_TI_CPUFREQ)            += ti-cpufreq.o
 obj-$(CONFIG_ARM_VEXPRESS_SPC_CPUFREQ)  += vexpress-spc-cpufreq.o
 obj-$(CONFIG_ACPI_CPPC_CPUFREQ) += cppc_cpufreq.o
diff --git a/drivers/cpufreq/dbx500-cpufreq.c b/drivers/cpufreq/dbx500-cpufreq.c
index 5c3ec1dd4921..3575b82210ba 100644
--- a/drivers/cpufreq/dbx500-cpufreq.c
+++ b/drivers/cpufreq/dbx500-cpufreq.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/cpufreq.h>
+#include <linux/cpu_cooling.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
@@ -18,6 +19,7 @@
 static struct cpufreq_frequency_table *freq_table;
 static struct clk *armss_clk;
+static struct thermal_cooling_device *cdev;
 static int dbx500_cpufreq_target(struct cpufreq_policy *policy,
                                unsigned int index)
@@ -32,6 +34,22 @@ static int dbx500_cpufreq_init(struct cpufreq_policy *policy)
        return cpufreq_generic_init(policy, freq_table, 20 * 1000);
 }
+static int dbx500_cpufreq_exit(struct cpufreq_policy *policy)
+{
+        if (!IS_ERR(cdev))
+                cpufreq_cooling_unregister(cdev);
+        return 0;
+}
+static void dbx500_cpufreq_ready(struct cpufreq_policy *policy)
+{
+        cdev = cpufreq_cooling_register(policy->cpus);
+        if (IS_ERR(cdev))
+                pr_err("Failed to register cooling device %ld\n", PTR_ERR(cdev));
+        else
+                pr_info("Cooling device registered: %s\n", cdev->type);
+}
 static struct cpufreq_driver dbx500_cpufreq_driver = {
        .flags  = CPUFREQ_STICKY | CPUFREQ_CONST_LOOPS |
                        CPUFREQ_NEED_INITIAL_FREQ_CHECK,
@@ -39,6 +57,8 @@ static struct cpufreq_driver dbx500_cpufreq_driver = {
        .target_index = dbx500_cpufreq_target,
        .get    = cpufreq_generic_get,
        .init   = dbx500_cpufreq_init,
+        .exit  = dbx500_cpufreq_exit,
+        .ready  = dbx500_cpufreq_ready,
        .name   = "DBX500",
        .attr   = cpufreq_generic_attr,
 };
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 7719b02e04f5..9c13f097fd8c 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -161,8 +161,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
 static int imx6q_cpufreq_init(struct cpufreq_policy *policy)
 {
+        int ret;
        policy->clk = arm_clk;
-        return cpufreq_generic_init(policy, freq_table, transition_latency);
+        ret = cpufreq_generic_init(policy, freq_table, transition_latency);
+        policy->suspend_freq = policy->max;
+        return ret;
 }
 static struct cpufreq_driver imx6q_cpufreq_driver = {
@@ -173,6 +178,7 @@ static struct cpufreq_driver imx6q_cpufreq_driver = {
        .init = imx6q_cpufreq_init,
        .name = "imx6q-cpufreq",
        .attr = cpufreq_generic_attr,
+        .suspend = cpufreq_generic_suspend,
 };
 static int imx6q_cpufreq_probe(struct platform_device *pdev)
@@ -222,6 +228,13 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
        arm_reg = regulator_get(cpu_dev, "arm");
        pu_reg = regulator_get_optional(cpu_dev, "pu");
        soc_reg = regulator_get(cpu_dev, "soc");
+        if (PTR_ERR(arm_reg) == -EPROBE_DEFER ||
+                        PTR_ERR(soc_reg) == -EPROBE_DEFER ||
+                        PTR_ERR(pu_reg) == -EPROBE_DEFER) {
+                ret = -EPROBE_DEFER;
+                dev_dbg(cpu_dev, "regulators not ready, defer\n");
+                goto put_reg;
+        }
        if (IS_ERR(arm_reg) || IS_ERR(soc_reg)) {
                dev_err(cpu_dev, "failed to get regulators\n");
                ret = -ENOENT;
@@ -255,7 +268,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
        if (ret) {
                dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
-                goto put_reg;
+                goto out_free_opp;
        }
        /* Make imx6_soc_volt array's size same as arm opp number */
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 283491f742d3..b7de5bd76a31 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -37,7 +37,11 @@
 #include <asm/cpufeature.h>
 #include <asm/intel-family.h>
+#define INTEL_PSTATE_DEFAULT_SAMPLING_INTERVAL  (10 * NSEC_PER_MSEC)
+#define INTEL_PSTATE_HWP_SAMPLING_INTERVAL      (50 * NSEC_PER_MSEC)
 #define INTEL_CPUFREQ_TRANSITION_LATENCY        20000
+#define INTEL_CPUFREQ_TRANSITION_DELAY          500
 #ifdef CONFIG_ACPI
 #include <acpi/processor.h>
@@ -74,6 +78,11 @@ static inline int ceiling_fp(int32_t x)
        return ret;
 }
+static inline int32_t percent_fp(int percent)
+{
+        return div_fp(percent, 100);
+}
 static inline u64 mul_ext_fp(u64 x, u64 y)
 {
        return (x * y) >> EXT_FRAC_BITS;
@@ -186,45 +195,22 @@ struct _pid {
 };
 /**
- * struct perf_limits - Store user and policy limits
+ * struct global_params - Global parameters, mostly tunable via sysfs.
- * @no_turbo:           User requested turbo state from intel_pstate sysfs
+ * @no_turbo:           Whether or not to use turbo P-states.
- * @turbo_disabled:     Platform turbo status either from msr
+ * @turbo_disabled:     Whethet or not turbo P-states are available at all,
- *                      MSR_IA32_MISC_ENABLE or when maximum available pstate
+ *                      based on the MSR_IA32_MISC_ENABLE value and whether or
- *                      matches the maximum turbo pstate
+ *                      not the maximum reported turbo P-state is different from
- * @max_perf_pct:       Effective maximum performance limit in percentage, this
+ *                      the maximum reported non-turbo one.
- *                      is minimum of either limits enforced by cpufreq policy
+ * @min_perf_pct:       Minimum capacity limit in percent of the maximum turbo
- *                      or limits from user set limits via intel_pstate sysfs
+ *                      P-state capacity.
- * @min_perf_pct:       Effective minimum performance limit in percentage, this
+ * @max_perf_pct:       Maximum capacity limit in percent of the maximum turbo
- *                      is maximum of either limits enforced by cpufreq policy
+ *                      P-state capacity.
- *                      or limits from user set limits via intel_pstate sysfs
- * @max_perf:           This is a scaled value between 0 to 255 for max_perf_pct
- *                      This value is used to limit max pstate
- * @min_perf:           This is a scaled value between 0 to 255 for min_perf_pct
- *                      This value is used to limit min pstate
- * @max_policy_pct:     The maximum performance in percentage enforced by
- *                      cpufreq setpolicy interface
- * @max_sysfs_pct:      The maximum performance in percentage enforced by
- *                      intel pstate sysfs interface, unused when per cpu
- *                      controls are enforced
- * @min_policy_pct:     The minimum performance in percentage enforced by
- *                      cpufreq setpolicy interface
- * @min_sysfs_pct:      The minimum performance in percentage enforced by
- *                      intel pstate sysfs interface, unused when per cpu
- *                      controls are enforced
- *
- * Storage for user and policy defined limits.
 */
-struct perf_limits {
+struct global_params {
-        int no_turbo;
+        bool no_turbo;
-        int turbo_disabled;
+        bool turbo_disabled;
        int max_perf_pct;
        int min_perf_pct;
-        int32_t max_perf;
-        int32_t min_perf;
-        int max_policy_pct;
-        int max_sysfs_pct;
-        int min_policy_pct;
-        int min_sysfs_pct;
 };
 /**
@@ -245,9 +231,10 @@ struct perf_limits {
 * @prev_cummulative_iowait: IO Wait time difference from last and
 *                      current sample
 * @sample:             Storage for storing last Sample data
- * @perf_limits:        Pointer to perf_limit unique to this CPU
+ * @min_perf:           Minimum capacity limit as a fraction of the maximum
- *                      Not all field in the structure are applicable
+ *                      turbo P-state capacity.
- *                      when per cpu controls are enforced
+ * @max_perf:           Maximum capacity limit as a fraction of the maximum
+ *                      turbo P-state capacity.
 * @acpi_perf_data:     Stores ACPI perf information read from _PSS
 * @valid_pss_table:    Set to true for valid ACPI _PSS entries found
 * @epp_powersave:      Last saved HWP energy performance preference
@@ -279,7 +266,8 @@ struct cpudata {
        u64     prev_tsc;
        u64     prev_cummulative_iowait;
        struct sample sample;
-        struct perf_limits *perf_limits;
+        int32_t min_perf;
+        int32_t max_perf;
 #ifdef CONFIG_ACPI
        struct acpi_processor_performance acpi_perf_data;
        bool valid_pss_table;
@@ -324,7 +312,7 @@ struct pstate_adjust_policy {
 * @get_scaling:        Callback to get frequency scaling factor
 * @get_val:            Callback to convert P state to actual MSR write value
 * @get_vid:            Callback to get VID data for Atom platforms
- * @get_target_pstate:  Callback to a function to calculate next P state to use
+ * @update_util:        Active mode utilization update callback.
 *
 * Core and Atom CPU models have different way to get P State limits. This
 * structure is used to store those callbacks.
@@ -337,43 +325,31 @@ struct pstate_funcs {
        int (*get_scaling)(void);
        u64 (*get_val)(struct cpudata*, int pstate);
        void (*get_vid)(struct cpudata *);
-        int32_t (*get_target_pstate)(struct cpudata *);
+        void (*update_util)(struct update_util_data *data, u64 time,
+                            unsigned int flags);
 };
-/**
+static struct pstate_funcs pstate_funcs __read_mostly;
- * struct cpu_defaults- Per CPU model default config data
+static struct pstate_adjust_policy pid_params __read_mostly = {
- * @pid_policy: PID config data
+        .sample_rate_ms = 10,
- * @funcs:              Callback function data
+        .sample_rate_ns = 10 * NSEC_PER_MSEC,
- */
+        .deadband = 0,
-struct cpu_defaults {
+        .setpoint = 97,
-        struct pstate_adjust_policy pid_policy;
+        .p_gain_pct = 20,
-        struct pstate_funcs funcs;
+        .d_gain_pct = 0,
+        .i_gain_pct = 0,
 };
-static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu);
-static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu);
-static struct pstate_adjust_policy pid_params __read_mostly;
-static struct pstate_funcs pstate_funcs __read_mostly;
 static int hwp_active __read_mostly;
 static bool per_cpu_limits __read_mostly;
-static bool driver_registered __read_mostly;
+static struct cpufreq_driver *intel_pstate_driver __read_mostly;
 #ifdef CONFIG_ACPI
 static bool acpi_ppc;
 #endif
-static struct perf_limits global;
+static struct global_params global;
-static void intel_pstate_init_limits(struct perf_limits *limits)
-{
-        memset(limits, 0, sizeof(*limits));
-        limits->max_perf_pct = 100;
-        limits->max_perf = int_ext_tofp(1);
-        limits->max_policy_pct = 100;
-        limits->max_sysfs_pct = 100;
-}
 static DEFINE_MUTEX(intel_pstate_driver_lock);
 static DEFINE_MUTEX(intel_pstate_limits_lock);
@@ -530,29 +506,6 @@ static inline void intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
 }
 #endif
-static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
-                             int deadband, int integral) {
-        pid->setpoint = int_tofp(setpoint);
-        pid->deadband  = int_tofp(deadband);
-        pid->integral  = int_tofp(integral);
-        pid->last_err  = int_tofp(setpoint) - int_tofp(busy);
-}
-static inline void pid_p_gain_set(struct _pid *pid, int percent)
-{
-        pid->p_gain = div_fp(percent, 100);
-}
-static inline void pid_i_gain_set(struct _pid *pid, int percent)
-{
-        pid->i_gain = div_fp(percent, 100);
-}
-static inline void pid_d_gain_set(struct _pid *pid, int percent)
-{
-        pid->d_gain = div_fp(percent, 100);
-}
 static signed int pid_calc(struct _pid *pid, int32_t busy)
 {
        signed int result;
@@ -590,23 +543,17 @@ static signed int pid_calc(struct _pid *pid, int32_t busy)
        return (signed int)fp_toint(result);
 }
-static inline void intel_pstate_busy_pid_reset(struct cpudata *cpu)
+static inline void intel_pstate_pid_reset(struct cpudata *cpu)
-{
-        pid_p_gain_set(&cpu->pid, pid_params.p_gain_pct);
-        pid_d_gain_set(&cpu->pid, pid_params.d_gain_pct);
-        pid_i_gain_set(&cpu->pid, pid_params.i_gain_pct);
-        pid_reset(&cpu->pid, pid_params.setpoint, 100, pid_params.deadband, 0);
-}
-static inline void intel_pstate_reset_all_pid(void)
 {
-        unsigned int cpu;
+        struct _pid *pid = &cpu->pid;
-        for_each_online_cpu(cpu) {
+        pid->p_gain = percent_fp(pid_params.p_gain_pct);
-                if (all_cpu_data[cpu])
+        pid->d_gain = percent_fp(pid_params.d_gain_pct);
-                        intel_pstate_busy_pid_reset(all_cpu_data[cpu]);
+        pid->i_gain = percent_fp(pid_params.i_gain_pct);
-        }
+        pid->setpoint = int_tofp(pid_params.setpoint);
+        pid->last_err  = pid->setpoint - int_tofp(100);
+        pid->deadband  = int_tofp(pid_params.deadband);
+        pid->integral  = 0;
 }
 static inline void update_turbo_state(void)
@@ -621,6 +568,14 @@ static inline void update_turbo_state(void)
                 cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
 }
+static int min_perf_pct_min(void)
+{
+        struct cpudata *cpu = all_cpu_data[0];
+        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
+                            cpu->pstate.turbo_pstate);
+}
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
 {
        u64 epb;
@@ -838,96 +793,80 @@ static struct freq_attr *hwp_cpufreq_attrs[] = {
        NULL,
 };
-static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
+static void intel_pstate_hwp_set(unsigned int cpu)
 {
-        int min, hw_min, max, hw_max, cpu;
+        struct cpudata *cpu_data = all_cpu_data[cpu];
-        struct perf_limits *perf_limits = &global;
+        int min, hw_min, max, hw_max;
        u64 value, cap;
+        s16 epp;
-        for_each_cpu(cpu, policy->cpus) {
+        rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
-                struct cpudata *cpu_data = all_cpu_data[cpu];
+        hw_min = HWP_LOWEST_PERF(cap);
-                s16 epp;
+        if (global.no_turbo)
+                hw_max = HWP_GUARANTEED_PERF(cap);
-                if (per_cpu_limits)
+        else
-                        perf_limits = all_cpu_data[cpu]->perf_limits;
+                hw_max = HWP_HIGHEST_PERF(cap);
-                rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
-                hw_min = HWP_LOWEST_PERF(cap);
-                if (global.no_turbo)
-                        hw_max = HWP_GUARANTEED_PERF(cap);
-                else
-                        hw_max = HWP_HIGHEST_PERF(cap);
-                max = fp_ext_toint(hw_max * perf_limits->max_perf);
-                if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE)
-                        min = max;
-                else
-                        min = fp_ext_toint(hw_max * perf_limits->min_perf);
-                rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
+        max = fp_ext_toint(hw_max * cpu_data->max_perf);
+        if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE)
+                min = max;
+        else
+                min = fp_ext_toint(hw_max * cpu_data->min_perf);
-                value &= ~HWP_MIN_PERF(~0L);
+        rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
-                value |= HWP_MIN_PERF(min);
-                value &= ~HWP_MAX_PERF(~0L);
+        value &= ~HWP_MIN_PERF(~0L);
-                value |= HWP_MAX_PERF(max);
+        value |= HWP_MIN_PERF(min);
-                if (cpu_data->epp_policy == cpu_data->policy)
+        value &= ~HWP_MAX_PERF(~0L);
-                        goto skip_epp;
+        value |= HWP_MAX_PERF(max);
-                cpu_data->epp_policy = cpu_data->policy;
+        if (cpu_data->epp_policy == cpu_data->policy)
+                goto skip_epp;
-                if (cpu_data->epp_saved >= 0) {
+        cpu_data->epp_policy = cpu_data->policy;
-                        epp = cpu_data->epp_saved;
-                        cpu_data->epp_saved = -EINVAL;
-                        goto update_epp;
-                }
-                if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE) {
+        if (cpu_data->epp_saved >= 0) {
-                        epp = intel_pstate_get_epp(cpu_data, value);
+                epp = cpu_data->epp_saved;
-                        cpu_data->epp_powersave = epp;
+                cpu_data->epp_saved = -EINVAL;
-                        /* If EPP read was failed, then don't try to write */
+                goto update_epp;
-                        if (epp < 0)
+        }
-                                goto skip_epp;
+        if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE) {
+                epp = intel_pstate_get_epp(cpu_data, value);
+                cpu_data->epp_powersave = epp;
+                /* If EPP read was failed, then don't try to write */
+                if (epp < 0)
+                        goto skip_epp;
-                        epp = 0;
+                epp = 0;
-                } else {
+        } else {
-                        /* skip setting EPP, when saved value is invalid */
+                /* skip setting EPP, when saved value is invalid */
-                        if (cpu_data->epp_powersave < 0)
+                if (cpu_data->epp_powersave < 0)
-                                goto skip_epp;
+                        goto skip_epp;
-                        /*
+                /*
-                         * No need to restore EPP when it is not zero. This
+                 * No need to restore EPP when it is not zero. This
-                         * means:
+                 * means:
-                         *  - Policy is not changed
+                 *  - Policy is not changed
-                         *  - user has manually changed
+                 *  - user has manually changed
-                         *  - Error reading EPB
+                 *  - Error reading EPB
-                         */
+                 */
-                        epp = intel_pstate_get_epp(cpu_data, value);
+                epp = intel_pstate_get_epp(cpu_data, value);
-                        if (epp)
+                if (epp)
-                                goto skip_epp;
+                        goto skip_epp;
-                        epp = cpu_data->epp_powersave;
+                epp = cpu_data->epp_powersave;
-                }
+        }
 update_epp:
-                if (static_cpu_has(X86_FEATURE_HWP_EPP)) {
+        if (static_cpu_has(X86_FEATURE_HWP_EPP)) {
-                        value &= ~GENMASK_ULL(31, 24);
+                value &= ~GENMASK_ULL(31, 24);
-                        value |= (u64)epp << 24;
+                value |= (u64)epp << 24;
-                } else {
+        } else {
-                        intel_pstate_set_epb(cpu, epp);
+                intel_pstate_set_epb(cpu, epp);
-                }
-skip_epp:
-                wrmsrl_on_cpu(cpu, MSR_HWP_REQUEST, value);
        }
-}
+skip_epp:
+        wrmsrl_on_cpu(cpu, MSR_HWP_REQUEST, value);
-static int intel_pstate_hwp_set_policy(struct cpufreq_policy *policy)
-{
-        if (hwp_active)
-                intel_pstate_hwp_set(policy);
-        return 0;
 }
 static int intel_pstate_hwp_save_state(struct cpufreq_policy *policy)
@@ -944,20 +883,17 @@ static int intel_pstate_hwp_save_state(struct cpufreq_policy *policy)
 static int intel_pstate_resume(struct cpufreq_policy *policy)
 {
-        int ret;
        if (!hwp_active)
                return 0;
        mutex_lock(&intel_pstate_limits_lock);
        all_cpu_data[policy->cpu]->epp_policy = 0;
+        intel_pstate_hwp_set(policy->cpu);
-        ret = intel_pstate_hwp_set_policy(policy);
        mutex_unlock(&intel_pstate_limits_lock);
-        return ret;
+        return 0;
 }
 static void intel_pstate_update_policies(void)
@@ -971,9 +907,14 @@ static void intel_pstate_update_policies(void)
 /************************** debugfs begin ************************/
 static int pid_param_set(void *data, u64 val)
 {
+        unsigned int cpu;
        *(u32 *)data = val;
        pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
-        intel_pstate_reset_all_pid();
+        for_each_possible_cpu(cpu)
+                if (all_cpu_data[cpu])
+                        intel_pstate_pid_reset(all_cpu_data[cpu]);
        return 0;
 }
@@ -1084,7 +1025,7 @@ static ssize_t show_turbo_pct(struct kobject *kobj,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
@@ -1109,7 +1050,7 @@ static ssize_t show_num_pstates(struct kobject *kobj,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
@@ -1129,7 +1070,7 @@ static ssize_t show_no_turbo(struct kobject *kobj,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
@@ -1157,7 +1098,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
@@ -1174,6 +1115,15 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
        global.no_turbo = clamp_t(int, input, 0, 1);
+        if (global.no_turbo) {
+                struct cpudata *cpu = all_cpu_data[0];
+                int pct = cpu->pstate.max_pstate * 100 / cpu->pstate.turbo_pstate;
+                /* Squash the global minimum into the permitted range. */
+                if (global.min_perf_pct > pct)
+                        global.min_perf_pct = pct;
+        }
        mutex_unlock(&intel_pstate_limits_lock);
        intel_pstate_update_policies();
@@ -1195,18 +1145,14 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
        mutex_lock(&intel_pstate_limits_lock);
-        global.max_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.max_perf_pct = clamp_t(int, input, global.min_perf_pct, 100);
-        global.max_perf_pct = min(global.max_policy_pct, global.max_sysfs_pct);
-        global.max_perf_pct = max(global.min_policy_pct, global.max_perf_pct);
-        global.max_perf_pct = max(global.min_perf_pct, global.max_perf_pct);
-        global.max_perf = percent_ext_fp(global.max_perf_pct);
        mutex_unlock(&intel_pstate_limits_lock);
@@ -1229,18 +1175,15 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
        mutex_lock(&intel_pstate_driver_lock);
-        if (!driver_registered) {
+        if (!intel_pstate_driver) {
                mutex_unlock(&intel_pstate_driver_lock);
                return -EAGAIN;
        }
        mutex_lock(&intel_pstate_limits_lock);
-        global.min_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.min_perf_pct = clamp_t(int, input,
-        global.min_perf_pct = max(global.min_policy_pct, global.min_sysfs_pct);
+                                      min_perf_pct_min(), global.max_perf_pct);
-        global.min_perf_pct = min(global.max_policy_pct, global.min_perf_pct);
-        global.min_perf_pct = min(global.max_perf_pct, global.min_perf_pct);
-        global.min_perf = percent_ext_fp(global.min_perf_pct);
        mutex_unlock(&intel_pstate_limits_lock);
@@ -1554,132 +1497,10 @@ static int knl_get_turbo_pstate(void)
        return ret;
 }
-static struct cpu_defaults core_params = {
+static int intel_pstate_get_base_pstate(struct cpudata *cpu)
-        .pid_policy = {
-                .sample_rate_ms = 10,
-                .deadband = 0,
-                .setpoint = 97,
-                .p_gain_pct = 20,
-                .d_gain_pct = 0,
-                .i_gain_pct = 0,
-        },
-        .funcs = {
-                .get_max = core_get_max_pstate,
-                .get_max_physical = core_get_max_pstate_physical,
-                .get_min = core_get_min_pstate,
-                .get_turbo = core_get_turbo_pstate,
-                .get_scaling = core_get_scaling,
-                .get_val = core_get_val,
-                .get_target_pstate = get_target_pstate_use_performance,
-        },
-};
-static const struct cpu_defaults silvermont_params = {
-        .pid_policy = {
-                .sample_rate_ms = 10,
-                .deadband = 0,
-                .setpoint = 60,
-                .p_gain_pct = 14,
-                .d_gain_pct = 0,
-                .i_gain_pct = 4,
-        },
-        .funcs = {
-                .get_max = atom_get_max_pstate,
-                .get_max_physical = atom_get_max_pstate,
-                .get_min = atom_get_min_pstate,
-                .get_turbo = atom_get_turbo_pstate,
-                .get_val = atom_get_val,
-                .get_scaling = silvermont_get_scaling,
-                .get_vid = atom_get_vid,
-                .get_target_pstate = get_target_pstate_use_cpu_load,
-        },
-};
-static const struct cpu_defaults airmont_params = {
-        .pid_policy = {
-                .sample_rate_ms = 10,
-                .deadband = 0,
-                .setpoint = 60,
-                .p_gain_pct = 14,
-                .d_gain_pct = 0,
-                .i_gain_pct = 4,
-        },
-        .funcs = {
-                .get_max = atom_get_max_pstate,
-                .get_max_physical = atom_get_max_pstate,
-                .get_min = atom_get_min_pstate,
-                .get_turbo = atom_get_turbo_pstate,
-                .get_val = atom_get_val,
-                .get_scaling = airmont_get_scaling,
-                .get_vid = atom_get_vid,
-                .get_target_pstate = get_target_pstate_use_cpu_load,
-        },
-};
-static const struct cpu_defaults knl_params = {
-        .pid_policy = {
-                .sample_rate_ms = 10,
-                .deadband = 0,
-                .setpoint = 97,
-                .p_gain_pct = 20,
-                .d_gain_pct = 0,
-                .i_gain_pct = 0,
-        },
-        .funcs = {
-                .get_max = core_get_max_pstate,
-                .get_max_physical = core_get_max_pstate_physical,
-                .get_min = core_get_min_pstate,
-                .get_turbo = knl_get_turbo_pstate,
-                .get_scaling = core_get_scaling,
-                .get_val = core_get_val,
-                .get_target_pstate = get_target_pstate_use_performance,
-        },
-};
-static const struct cpu_defaults bxt_params = {
-        .pid_policy = {
-                .sample_rate_ms = 10,
-                .deadband = 0,
-                .setpoint = 60,
-                .p_gain_pct = 14,
-                .d_gain_pct = 0,
-                .i_gain_pct = 4,
-        },
-        .funcs = {
-                .get_max = core_get_max_pstate,
-                .get_max_physical = core_get_max_pstate_physical,
-                .get_min = core_get_min_pstate,
-                .get_turbo = core_get_turbo_pstate,
-                .get_scaling = core_get_scaling,
-                .get_val = core_get_val,
-                .get_target_pstate = get_target_pstate_use_cpu_load,
-        },
-};
-static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 {
-        int max_perf = cpu->pstate.turbo_pstate;
+        return global.no_turbo || global.turbo_disabled ?
-        int max_perf_adj;
+                        cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
-        int min_perf;
-        struct perf_limits *perf_limits = &global;
-        if (global.no_turbo || global.turbo_disabled)
-                max_perf = cpu->pstate.max_pstate;
-        if (per_cpu_limits)
-                perf_limits = cpu->perf_limits;
-        /*
-         * performance can be limited by user through sysfs, by cpufreq
-         * policy, or by cpu specific default values determined through
-         * experimentation.
-         */
-        max_perf_adj = fp_ext_toint(max_perf * perf_limits->max_perf);
-        *max = clamp_t(int, max_perf_adj,
-                        cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
-        min_perf = fp_ext_toint(max_perf * perf_limits->min_perf);
-        *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
 }
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
@@ -1702,11 +1523,13 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu)
 static void intel_pstate_max_within_limits(struct cpudata *cpu)
 {
-        int min_pstate, max_pstate;
+        int pstate;
        update_turbo_state();
-        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        pstate = intel_pstate_get_base_pstate(cpu);
-        intel_pstate_set_pstate(cpu, max_pstate);
+        pstate = max(cpu->pstate.min_pstate,
+                     fp_ext_toint(pstate * cpu->max_perf));
+        intel_pstate_set_pstate(cpu, pstate);
 }
 static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
@@ -1767,7 +1590,11 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
         * that sample.time will always be reset before setting the utilization
         * update hook and make the caller skip the sample then.
         */
-        return !!cpu->last_sample_time;
+        if (cpu->last_sample_time) {
+                intel_pstate_calc_avg_perf(cpu);
+                return true;
+        }
+        return false;
 }
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
@@ -1788,6 +1615,9 @@ static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu)
        int32_t busy_frac, boost;
        int target, avg_pstate;
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE)
+                return cpu->pstate.turbo_pstate;
        busy_frac = div_fp(sample->mperf, sample->tsc);
        boost = cpu->iowait_boost;
@@ -1824,6 +1654,9 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu)
        int32_t perf_scaled, max_pstate, current_pstate, sample_ratio;
        u64 duration_ns;
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE)
+                return cpu->pstate.turbo_pstate;
        /*
         * perf_scaled is the ratio of the average P-state during the last
         * sampling period to the P-state requested last time (in percent).
@@ -1858,11 +1691,13 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu)
 static int intel_pstate_prepare_request(struct cpudata *cpu, int pstate)
 {
-        int max_perf, min_perf;
+        int max_pstate = intel_pstate_get_base_pstate(cpu);
+        int min_pstate;
-        intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
+        min_pstate = max(cpu->pstate.min_pstate,
-        pstate = clamp_t(int, pstate, min_perf, max_perf);
+                         fp_ext_toint(max_pstate * cpu->min_perf));
-        return pstate;
+        max_pstate = max(min_pstate, fp_ext_toint(max_pstate * cpu->max_perf));
+        return clamp_t(int, pstate, min_pstate, max_pstate);
 }
 static void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
@@ -1874,16 +1709,11 @@ static void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
        wrmsrl(MSR_IA32_PERF_CTL, pstate_funcs.get_val(cpu, pstate));
 }
-static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
+static void intel_pstate_adjust_pstate(struct cpudata *cpu, int target_pstate)
 {
-        int from, target_pstate;
+        int from = cpu->pstate.current_pstate;
        struct sample *sample;
-        from = cpu->pstate.current_pstate;
-        target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ?
-                cpu->pstate.turbo_pstate : pstate_funcs.get_target_pstate(cpu);
        update_turbo_state();
        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
@@ -1902,76 +1732,155 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
                fp_toint(cpu->iowait_boost * 100));
 }
+static void intel_pstate_update_util_hwp(struct update_util_data *data,
+                                         u64 time, unsigned int flags)
+{
+        struct cpudata *cpu = container_of(data, struct cpudata, update_util);
+        u64 delta_ns = time - cpu->sample.time;
+        if ((s64)delta_ns >= INTEL_PSTATE_HWP_SAMPLING_INTERVAL)
+                intel_pstate_sample(cpu, time);
+}
+static void intel_pstate_update_util_pid(struct update_util_data *data,
+                                         u64 time, unsigned int flags)
+{
+        struct cpudata *cpu = container_of(data, struct cpudata, update_util);
+        u64 delta_ns = time - cpu->sample.time;
+        if ((s64)delta_ns < pid_params.sample_rate_ns)
+                return;
+        if (intel_pstate_sample(cpu, time)) {
+                int target_pstate;
+                target_pstate = get_target_pstate_use_performance(cpu);
+                intel_pstate_adjust_pstate(cpu, target_pstate);
+        }
+}
 static void intel_pstate_update_util(struct update_util_data *data, u64 time,
                                     unsigned int flags)
 {
        struct cpudata *cpu = container_of(data, struct cpudata, update_util);
        u64 delta_ns;
-        if (pstate_funcs.get_target_pstate == get_target_pstate_use_cpu_load) {
+        if (flags & SCHED_CPUFREQ_IOWAIT) {
-                if (flags & SCHED_CPUFREQ_IOWAIT) {
+                cpu->iowait_boost = int_tofp(1);
-                        cpu->iowait_boost = int_tofp(1);
+        } else if (cpu->iowait_boost) {
-                } else if (cpu->iowait_boost) {
+                /* Clear iowait_boost if the CPU may have been idle. */
-                        /* Clear iowait_boost if the CPU may have been idle. */
+                delta_ns = time - cpu->last_update;
-                        delta_ns = time - cpu->last_update;
+                if (delta_ns > TICK_NSEC)
-                        if (delta_ns > TICK_NSEC)
+                        cpu->iowait_boost = 0;
-                                cpu->iowait_boost = 0;
-                }
-                cpu->last_update = time;
        }
+        cpu->last_update = time;
        delta_ns = time - cpu->sample.time;
-        if ((s64)delta_ns >= pid_params.sample_rate_ns) {
+        if ((s64)delta_ns < INTEL_PSTATE_DEFAULT_SAMPLING_INTERVAL)
-                bool sample_taken = intel_pstate_sample(cpu, time);
+                return;
-                if (sample_taken) {
+        if (intel_pstate_sample(cpu, time)) {
-                        intel_pstate_calc_avg_perf(cpu);
+                int target_pstate;
-                        if (!hwp_active)
-                                intel_pstate_adjust_busy_pstate(cpu);
+                target_pstate = get_target_pstate_use_cpu_load(cpu);
-                }
+                intel_pstate_adjust_pstate(cpu, target_pstate);
        }
 }
+static struct pstate_funcs core_funcs = {
+        .get_max = core_get_max_pstate,
+        .get_max_physical = core_get_max_pstate_physical,
+        .get_min = core_get_min_pstate,
+        .get_turbo = core_get_turbo_pstate,
+        .get_scaling = core_get_scaling,
+        .get_val = core_get_val,
+        .update_util = intel_pstate_update_util_pid,
+};
+static const struct pstate_funcs silvermont_funcs = {
+        .get_max = atom_get_max_pstate,
+        .get_max_physical = atom_get_max_pstate,
+        .get_min = atom_get_min_pstate,
+        .get_turbo = atom_get_turbo_pstate,
+        .get_val = atom_get_val,
+        .get_scaling = silvermont_get_scaling,
+        .get_vid = atom_get_vid,
+        .update_util = intel_pstate_update_util,
+};
+static const struct pstate_funcs airmont_funcs = {
+        .get_max = atom_get_max_pstate,
+        .get_max_physical = atom_get_max_pstate,
+        .get_min = atom_get_min_pstate,
+        .get_turbo = atom_get_turbo_pstate,
+        .get_val = atom_get_val,
+        .get_scaling = airmont_get_scaling,
+        .get_vid = atom_get_vid,
+        .update_util = intel_pstate_update_util,
+};
+static const struct pstate_funcs knl_funcs = {
+        .get_max = core_get_max_pstate,
+        .get_max_physical = core_get_max_pstate_physical,
+        .get_min = core_get_min_pstate,
+        .get_turbo = knl_get_turbo_pstate,
+        .get_scaling = core_get_scaling,
+        .get_val = core_get_val,
+        .update_util = intel_pstate_update_util_pid,
+};
+static const struct pstate_funcs bxt_funcs = {
+        .get_max = core_get_max_pstate,
+        .get_max_physical = core_get_max_pstate_physical,
+        .get_min = core_get_min_pstate,
+        .get_turbo = core_get_turbo_pstate,
+        .get_scaling = core_get_scaling,
+        .get_val = core_get_val,
+        .update_util = intel_pstate_update_util,
+};
 #define ICPU(model, policy) \
        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\
                        (unsigned long)&policy }
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
-        ICPU(INTEL_FAM6_SANDYBRIDGE,            core_params),
+        ICPU(INTEL_FAM6_SANDYBRIDGE,            core_funcs),
-        ICPU(INTEL_FAM6_SANDYBRIDGE_X,          core_params),
+        ICPU(INTEL_FAM6_SANDYBRIDGE_X,          core_funcs),
-        ICPU(INTEL_FAM6_ATOM_SILVERMONT1,       silvermont_params),
+        ICPU(INTEL_FAM6_ATOM_SILVERMONT1,       silvermont_funcs),
-        ICPU(INTEL_FAM6_IVYBRIDGE,              core_params),
+        ICPU(INTEL_FAM6_IVYBRIDGE,              core_funcs),
-        ICPU(INTEL_FAM6_HASWELL_CORE,           core_params),
+        ICPU(INTEL_FAM6_HASWELL_CORE,           core_funcs),
-        ICPU(INTEL_FAM6_BROADWELL_CORE,         core_params),
+        ICPU(INTEL_FAM6_BROADWELL_CORE,         core_funcs),
-        ICPU(INTEL_FAM6_IVYBRIDGE_X,            core_params),
+        ICPU(INTEL_FAM6_IVYBRIDGE_X,            core_funcs),
-        ICPU(INTEL_FAM6_HASWELL_X,              core_params),
+        ICPU(INTEL_FAM6_HASWELL_X,              core_funcs),
-        ICPU(INTEL_FAM6_HASWELL_ULT,            core_params),
+        ICPU(INTEL_FAM6_HASWELL_ULT,            core_funcs),
-        ICPU(INTEL_FAM6_HASWELL_GT3E,           core_params),
+        ICPU(INTEL_FAM6_HASWELL_GT3E,           core_funcs),
-        ICPU(INTEL_FAM6_BROADWELL_GT3E,         core_params),
+        ICPU(INTEL_FAM6_BROADWELL_GT3E,         core_funcs),
-        ICPU(INTEL_FAM6_ATOM_AIRMONT,           airmont_params),
+        ICPU(INTEL_FAM6_ATOM_AIRMONT,           airmont_funcs),
-        ICPU(INTEL_FAM6_SKYLAKE_MOBILE,         core_params),
+        ICPU(INTEL_FAM6_SKYLAKE_MOBILE,         core_funcs),
-        ICPU(INTEL_FAM6_BROADWELL_X,            core_params),
+        ICPU(INTEL_FAM6_BROADWELL_X,            core_funcs),
-        ICPU(INTEL_FAM6_SKYLAKE_DESKTOP,        core_params),
+        ICPU(INTEL_FAM6_SKYLAKE_DESKTOP,        core_funcs),
-        ICPU(INTEL_FAM6_BROADWELL_XEON_D,       core_params),
+        ICPU(INTEL_FAM6_BROADWELL_XEON_D,       core_funcs),
-        ICPU(INTEL_FAM6_XEON_PHI_KNL,           knl_params),
+        ICPU(INTEL_FAM6_XEON_PHI_KNL,           knl_funcs),
-        ICPU(INTEL_FAM6_XEON_PHI_KNM,           knl_params),
+        ICPU(INTEL_FAM6_XEON_PHI_KNM,           knl_funcs),
-        ICPU(INTEL_FAM6_ATOM_GOLDMONT,          bxt_params),
+        ICPU(INTEL_FAM6_ATOM_GOLDMONT,          bxt_funcs),
+        ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE,       bxt_funcs),
        {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids);
 static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
-        ICPU(INTEL_FAM6_BROADWELL_XEON_D, core_params),
+        ICPU(INTEL_FAM6_BROADWELL_XEON_D, core_funcs),
-        ICPU(INTEL_FAM6_BROADWELL_X, core_params),
+        ICPU(INTEL_FAM6_BROADWELL_X, core_funcs),
-        ICPU(INTEL_FAM6_SKYLAKE_X, core_params),
+        ICPU(INTEL_FAM6_SKYLAKE_X, core_funcs),
        {}
 };
 static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
-        ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
+        ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_funcs),
        {}
 };
+static bool pid_in_use(void);
 static int intel_pstate_init_cpu(unsigned int cpunum)
 {
        struct cpudata *cpu;
@@ -1979,18 +1888,11 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
        if (!cpu) {
-                unsigned int size = sizeof(struct cpudata);
+                cpu = kzalloc(sizeof(*cpu), GFP_KERNEL);
-                if (per_cpu_limits)
-                        size += sizeof(struct perf_limits);
-                cpu = kzalloc(size, GFP_KERNEL);
                if (!cpu)
                        return -ENOMEM;
                all_cpu_data[cpunum] = cpu;
-                if (per_cpu_limits)
-                        cpu->perf_limits = (struct perf_limits *)(cpu + 1);
                cpu->epp_default = -EINVAL;
                cpu->epp_powersave = -EINVAL;
@@ -2009,14 +1911,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
                        intel_pstate_disable_ee(cpunum);
                intel_pstate_hwp_enable(cpu);
-                pid_params.sample_rate_ms = 50;
+        } else if (pid_in_use()) {
-                pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
+                intel_pstate_pid_reset(cpu);
        }
        intel_pstate_get_cpu_pstates(cpu);
-        intel_pstate_busy_pid_reset(cpu);
        pr_debug("controlling: cpu %d\n", cpunum);
        return 0;
@@ -2039,7 +1939,7 @@ static void intel_pstate_set_update_util_hook(unsigned int cpu_num)
        /* Prevent intel_pstate_update_util() from using stale data. */
        cpu->sample.time = 0;
        cpufreq_add_update_util_hook(cpu_num, &cpu->update_util,
-                                     intel_pstate_update_util);
+                                     pstate_funcs.update_util);
        cpu->update_util_set = true;
 }
@@ -2055,46 +1955,68 @@ static void intel_pstate_clear_update_util_hook(unsigned int cpu)
        synchronize_sched();
 }
+static int intel_pstate_get_max_freq(struct cpudata *cpu)
+{
+        return global.turbo_disabled || global.no_turbo ?
+                        cpu->pstate.max_freq : cpu->pstate.turbo_freq;
+}
 static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
-                                            struct perf_limits *limits)
+                                            struct cpudata *cpu)
 {
+        int max_freq = intel_pstate_get_max_freq(cpu);
        int32_t max_policy_perf, min_policy_perf;
-        max_policy_perf = div_ext_fp(policy->max, policy->cpuinfo.max_freq);
+        max_policy_perf = div_ext_fp(policy->max, max_freq);
        max_policy_perf = clamp_t(int32_t, max_policy_perf, 0, int_ext_tofp(1));
        if (policy->max == policy->min) {
                min_policy_perf = max_policy_perf;
        } else {
-                min_policy_perf = div_ext_fp(policy->min,
+                min_policy_perf = div_ext_fp(policy->min, max_freq);
-                                             policy->cpuinfo.max_freq);
                min_policy_perf = clamp_t(int32_t, min_policy_perf,
                                          0, max_policy_perf);
        }
        /* Normalize user input to [min_perf, max_perf] */
-        limits->min_perf = max(min_policy_perf,
+        if (per_cpu_limits) {
-                               percent_ext_fp(limits->min_sysfs_pct));
+                cpu->min_perf = min_policy_perf;
-        limits->min_perf = min(limits->min_perf, max_policy_perf);
+                cpu->max_perf = max_policy_perf;
-        limits->max_perf = min(max_policy_perf,
+        } else {
-                               percent_ext_fp(limits->max_sysfs_pct));
+                int32_t global_min, global_max;
-        limits->max_perf = max(min_policy_perf, limits->max_perf);
+                /* Global limits are in percent of the maximum turbo P-state. */
+                global_max = percent_ext_fp(global.max_perf_pct);
+                global_min = percent_ext_fp(global.min_perf_pct);
+                if (max_freq != cpu->pstate.turbo_freq) {
+                        int32_t turbo_factor;
+                        turbo_factor = div_ext_fp(cpu->pstate.turbo_pstate,
+                                                  cpu->pstate.max_pstate);
+                        global_min = mul_ext_fp(global_min, turbo_factor);
+                        global_max = mul_ext_fp(global_max, turbo_factor);
+                }
+                global_min = clamp_t(int32_t, global_min, 0, global_max);
+                cpu->min_perf = max(min_policy_perf, global_min);
+                cpu->min_perf = min(cpu->min_perf, max_policy_perf);
+                cpu->max_perf = min(max_policy_perf, global_max);
+                cpu->max_perf = max(min_policy_perf, cpu->max_perf);
-        /* Make sure min_perf <= max_perf */
+                /* Make sure min_perf <= max_perf */
-        limits->min_perf = min(limits->min_perf, limits->max_perf);
+                cpu->min_perf = min(cpu->min_perf, cpu->max_perf);
+        }
-        limits->max_perf = round_up(limits->max_perf, EXT_FRAC_BITS);
+        cpu->max_perf = round_up(cpu->max_perf, EXT_FRAC_BITS);
-        limits->min_perf = round_up(limits->min_perf, EXT_FRAC_BITS);
+        cpu->min_perf = round_up(cpu->min_perf, EXT_FRAC_BITS);
-        limits->max_perf_pct = fp_ext_toint(limits->max_perf * 100);
-        limits->min_perf_pct = fp_ext_toint(limits->min_perf * 100);
        pr_debug("cpu:%d max_perf_pct:%d min_perf_pct:%d\n", policy->cpu,
-                 limits->max_perf_pct, limits->min_perf_pct);
+                 fp_ext_toint(cpu->max_perf * 100),
+                 fp_ext_toint(cpu->min_perf * 100));
 }
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
        struct cpudata *cpu;
-        struct perf_limits *perf_limits = &global;
        if (!policy->cpuinfo.max_freq)
                return -ENODEV;
@@ -2105,19 +2027,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        cpu = all_cpu_data[policy->cpu];
        cpu->policy = policy->policy;
-        if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
-            policy->max < policy->cpuinfo.max_freq &&
-            policy->max > cpu->pstate.max_pstate * cpu->pstate.scaling) {
-                pr_debug("policy->max > max non turbo frequency\n");
-                policy->max = policy->cpuinfo.max_freq;
-        }
-        if (per_cpu_limits)
-                perf_limits = cpu->perf_limits;
        mutex_lock(&intel_pstate_limits_lock);
-        intel_pstate_update_perf_limits(policy, perf_limits);
+        intel_pstate_update_perf_limits(policy, cpu);
        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                /*
@@ -2130,38 +2042,38 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        intel_pstate_set_update_util_hook(policy->cpu);
-        intel_pstate_hwp_set_policy(policy);
+        if (hwp_active)
+                intel_pstate_hwp_set(policy->cpu);
        mutex_unlock(&intel_pstate_limits_lock);
        return 0;
 }
+static void intel_pstate_adjust_policy_max(struct cpufreq_policy *policy,
+                                         struct cpudata *cpu)
+{
+        if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
+            policy->max < policy->cpuinfo.max_freq &&
+            policy->max > cpu->pstate.max_freq) {
+                pr_debug("policy->max > max non turbo frequency\n");
+                policy->max = policy->cpuinfo.max_freq;
+        }
+}
 static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
 {
        struct cpudata *cpu = all_cpu_data[policy->cpu];
        update_turbo_state();
-        policy->cpuinfo.max_freq = global.turbo_disabled || global.no_turbo ?
+        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                        cpu->pstate.max_freq :
+                                     intel_pstate_get_max_freq(cpu));
-                                        cpu->pstate.turbo_freq;
-        cpufreq_verify_within_cpu_limits(policy);
        if (policy->policy != CPUFREQ_POLICY_POWERSAVE &&
            policy->policy != CPUFREQ_POLICY_PERFORMANCE)
                return -EINVAL;
-        /* When per-CPU limits are used, sysfs limits are not used */
+        intel_pstate_adjust_policy_max(policy, cpu);
-        if (!per_cpu_limits) {
-                unsigned int max_freq, min_freq;
-                max_freq = policy->cpuinfo.max_freq *
-                                        global.max_sysfs_pct / 100;
-                min_freq = policy->cpuinfo.max_freq *
-                                        global.min_sysfs_pct / 100;
-                cpufreq_verify_within_limits(policy, min_freq, max_freq);
-        }
        return 0;
 }
@@ -2202,8 +2114,8 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
        cpu = all_cpu_data[policy->cpu];
-        if (per_cpu_limits)
+        cpu->max_perf = int_ext_tofp(1);
-                intel_pstate_init_limits(cpu->perf_limits);
+        cpu->min_perf = 0;
        policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling;
        policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
@@ -2257,10 +2169,12 @@ static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
        struct cpudata *cpu = all_cpu_data[policy->cpu];
        update_turbo_state();
-        policy->cpuinfo.max_freq = global.no_turbo || global.turbo_disabled ?
+        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                        cpu->pstate.max_freq : cpu->pstate.turbo_freq;
+                                     intel_pstate_get_max_freq(cpu));
-        cpufreq_verify_within_cpu_limits(policy);
+        intel_pstate_adjust_policy_max(policy, cpu);
+        intel_pstate_update_perf_limits(policy, cpu);
        return 0;
 }
@@ -2324,6 +2238,7 @@ static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
                return ret;
        policy->cpuinfo.transition_latency = INTEL_CPUFREQ_TRANSITION_LATENCY;
+        policy->transition_delay_us = INTEL_CPUFREQ_TRANSITION_DELAY;
        /* This reflects the intel_pstate_get_cpu_pstates() setting. */
        policy->cur = policy->cpuinfo.min_freq;
@@ -2341,7 +2256,13 @@ static struct cpufreq_driver intel_cpufreq = {
        .name           = "intel_cpufreq",
 };
-static struct cpufreq_driver *intel_pstate_driver = &intel_pstate;
+static struct cpufreq_driver *default_driver = &intel_pstate;
+static bool pid_in_use(void)
+{
+        return intel_pstate_driver == &intel_pstate &&
+                pstate_funcs.update_util == intel_pstate_update_util_pid;
+}
 static void intel_pstate_driver_cleanup(void)
 {
@@ -2358,26 +2279,26 @@ static void intel_pstate_driver_cleanup(void)
                }
        }
        put_online_cpus();
+        intel_pstate_driver = NULL;
 }
-static int intel_pstate_register_driver(void)
+static int intel_pstate_register_driver(struct cpufreq_driver *driver)
 {
        int ret;
-        intel_pstate_init_limits(&global);
+        memset(&global, 0, sizeof(global));
+        global.max_perf_pct = 100;
+        intel_pstate_driver = driver;
        ret = cpufreq_register_driver(intel_pstate_driver);
        if (ret) {
                intel_pstate_driver_cleanup();
                return ret;
        }
-        mutex_lock(&intel_pstate_limits_lock);
+        global.min_perf_pct = min_perf_pct_min();
-        driver_registered = true;
-        mutex_unlock(&intel_pstate_limits_lock);
-        if (intel_pstate_driver == &intel_pstate && !hwp_active &&
+        if (pid_in_use())
-            pstate_funcs.get_target_pstate != get_target_pstate_use_cpu_load)
                intel_pstate_debug_expose_params();
        return 0;
@@ -2388,14 +2309,9 @@ static int intel_pstate_unregister_driver(void)
        if (hwp_active)
                return -EBUSY;
-        if (intel_pstate_driver == &intel_pstate && !hwp_active &&
+        if (pid_in_use())
-            pstate_funcs.get_target_pstate != get_target_pstate_use_cpu_load)
                intel_pstate_debug_hide_params();
-        mutex_lock(&intel_pstate_limits_lock);
-        driver_registered = false;
-        mutex_unlock(&intel_pstate_limits_lock);
        cpufreq_unregister_driver(intel_pstate_driver);
        intel_pstate_driver_cleanup();
@@ -2404,7 +2320,7 @@ static int intel_pstate_unregister_driver(void)
 static ssize_t intel_pstate_show_status(char *buf)
 {
-        if (!driver_registered)
+        if (!intel_pstate_driver)
                return sprintf(buf, "off\n");
        return sprintf(buf, "%s\n", intel_pstate_driver == &intel_pstate ?
@@ -2416,11 +2332,11 @@ static int intel_pstate_update_status(const char *buf, size_t size)
        int ret;
        if (size == 3 && !strncmp(buf, "off", size))
-                return driver_registered ?
+                return intel_pstate_driver ?
                        intel_pstate_unregister_driver() : -EINVAL;
        if (size == 6 && !strncmp(buf, "active", size)) {
-                if (driver_registered) {
+                if (intel_pstate_driver) {
                        if (intel_pstate_driver == &intel_pstate)
                                return 0;
@@ -2429,13 +2345,12 @@ static int intel_pstate_update_status(const char *buf, size_t size)
                                return ret;
                }
-                intel_pstate_driver = &intel_pstate;
+                return intel_pstate_register_driver(&intel_pstate);
-                return intel_pstate_register_driver();
        }
        if (size == 7 && !strncmp(buf, "passive", size)) {
-                if (driver_registered) {
+                if (intel_pstate_driver) {
-                        if (intel_pstate_driver != &intel_pstate)
+                        if (intel_pstate_driver == &intel_cpufreq)
                                return 0;
                        ret = intel_pstate_unregister_driver();
@@ -2443,8 +2358,7 @@ static int intel_pstate_update_status(const char *buf, size_t size)
                                return ret;
                }
-                intel_pstate_driver = &intel_cpufreq;
+                return intel_pstate_register_driver(&intel_cpufreq);
-                return intel_pstate_register_driver();
        }
        return -EINVAL;
@@ -2465,23 +2379,17 @@ static int __init intel_pstate_msrs_not_valid(void)
        return 0;
 }
-static void __init copy_pid_params(struct pstate_adjust_policy *policy)
-{
-        pid_params.sample_rate_ms = policy->sample_rate_ms;
-        pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
-        pid_params.p_gain_pct = policy->p_gain_pct;
-        pid_params.i_gain_pct = policy->i_gain_pct;
-        pid_params.d_gain_pct = policy->d_gain_pct;
-        pid_params.deadband = policy->deadband;
-        pid_params.setpoint = policy->setpoint;
-}
 #ifdef CONFIG_ACPI
 static void intel_pstate_use_acpi_profile(void)
 {
-        if (acpi_gbl_FADT.preferred_profile == PM_MOBILE)
+        switch (acpi_gbl_FADT.preferred_profile) {
-                pstate_funcs.get_target_pstate =
+        case PM_MOBILE:
-                                get_target_pstate_use_cpu_load;
+        case PM_TABLET:
+        case PM_APPLIANCE_PC:
+        case PM_DESKTOP:
+        case PM_WORKSTATION:
+                pstate_funcs.update_util = intel_pstate_update_util;
+        }
 }
 #else
 static void intel_pstate_use_acpi_profile(void)
@@ -2498,7 +2406,7 @@ static void __init copy_cpu_funcs(struct pstate_funcs *funcs)
        pstate_funcs.get_scaling = funcs->get_scaling;
        pstate_funcs.get_val   = funcs->get_val;
        pstate_funcs.get_vid   = funcs->get_vid;
-        pstate_funcs.get_target_pstate = funcs->get_target_pstate;
+        pstate_funcs.update_util = funcs->update_util;
        intel_pstate_use_acpi_profile();
 }
@@ -2637,28 +2545,30 @@ static const struct x86_cpu_id hwp_support_ids[] __initconst = {
 static int __init intel_pstate_init(void)
 {
-        const struct x86_cpu_id *id;
+        int rc;
-        struct cpu_defaults *cpu_def;
-        int rc = 0;
        if (no_load)
                return -ENODEV;
-        if (x86_match_cpu(hwp_support_ids) && !no_hwp) {
+        if (x86_match_cpu(hwp_support_ids)) {
-                copy_cpu_funcs(&core_params.funcs);
+                copy_cpu_funcs(&core_funcs);
-                hwp_active++;
+                if (no_hwp) {
-                intel_pstate.attr = hwp_cpufreq_attrs;
+                        pstate_funcs.update_util = intel_pstate_update_util;
-                goto hwp_cpu_matched;
+                } else {
-        }
+                        hwp_active++;
+                        intel_pstate.attr = hwp_cpufreq_attrs;
-        id = x86_match_cpu(intel_pstate_cpu_ids);
+                        pstate_funcs.update_util = intel_pstate_update_util_hwp;
-        if (!id)
+                        goto hwp_cpu_matched;
-                return -ENODEV;
+                }
+        } else {
+                const struct x86_cpu_id *id;
-        cpu_def = (struct cpu_defaults *)id->driver_data;
+                id = x86_match_cpu(intel_pstate_cpu_ids);
+                if (!id)
+                        return -ENODEV;
-        copy_pid_params(&cpu_def->pid_policy);
+                copy_cpu_funcs((struct pstate_funcs *)id->driver_data);
-        copy_cpu_funcs(&cpu_def->funcs);
+        }
        if (intel_pstate_msrs_not_valid())
                return -ENODEV;
@@ -2685,7 +2595,7 @@ hwp_cpu_matched:
        intel_pstate_sysfs_expose_params();
        mutex_lock(&intel_pstate_driver_lock);
-        rc = intel_pstate_register_driver();
+        rc = intel_pstate_register_driver(default_driver);
        mutex_unlock(&intel_pstate_driver_lock);
        if (rc)
                return rc;
@@ -2706,7 +2616,7 @@ static int __init intel_pstate_setup(char *str)
                no_load = 1;
        } else if (!strcmp(str, "passive")) {
                pr_info("Passive mode enabled\n");
-                intel_pstate_driver = &intel_cpufreq;
+                default_driver = &intel_cpufreq;
                no_hwp = 1;
        }
        if (!strcmp(str, "no_hwp")) {
diff --git a/drivers/cpufreq/mt8173-cpufreq.c b/drivers/cpufreq/mt8173-cpufreq.c
index ab25b1235a5e..fd1886faf33a 100644
--- a/drivers/cpufreq/mt8173-cpufreq.c
+++ b/drivers/cpufreq/mt8173-cpufreq.c
@@ -573,14 +573,33 @@ static struct platform_driver mt8173_cpufreq_platdrv = {
        .probe          = mt8173_cpufreq_probe,
 };
-static int mt8173_cpufreq_driver_init(void)
+/* List of machines supported by this driver */
+static const struct of_device_id mt8173_cpufreq_machines[] __initconst = {
+        { .compatible = "mediatek,mt817x", },
+        { .compatible = "mediatek,mt8173", },
+        { .compatible = "mediatek,mt8176", },
+        { }
+};
+static int __init mt8173_cpufreq_driver_init(void)
 {
+        struct device_node *np;
+        const struct of_device_id *match;
        struct platform_device *pdev;
        int err;
-        if (!of_machine_is_compatible("mediatek,mt8173"))
+        np = of_find_node_by_path("/");
+        if (!np)
                return -ENODEV;
+        match = of_match_node(mt8173_cpufreq_machines, np);
+        of_node_put(np);
+        if (!match) {
+                pr_warn("Machine is not compatible with mt8173-cpufreq\n");
+                return -ENODEV;
+        }
        err = platform_driver_register(&mt8173_cpufreq_platdrv);
        if (err)
                return err;
diff --git a/drivers/cpufreq/qoriq-cpufreq.c b/drivers/cpufreq/qoriq-cpufreq.c
index bfec1bcd3835..e2ea433a5f9c 100644
--- a/drivers/cpufreq/qoriq-cpufreq.c
+++ b/drivers/cpufreq/qoriq-cpufreq.c
@@ -52,17 +52,27 @@ static u32 get_bus_freq(void)
 {
        struct device_node *soc;
        u32 sysfreq;
+        struct clk *pltclk;
+        int ret;
+        /* get platform freq by searching bus-frequency property */
        soc = of_find_node_by_type(NULL, "soc");
-        if (!soc)
+        if (soc) {
-                return 0;
+                ret = of_property_read_u32(soc, "bus-frequency", &sysfreq);
+                of_node_put(soc);
-        if (of_property_read_u32(soc, "bus-frequency", &sysfreq))
+                if (!ret)
-                sysfreq = 0;
+                        return sysfreq;
+        }
-        of_node_put(soc);
+        /* get platform freq by its clock name */
+        pltclk = clk_get(NULL, "cg-pll0-div1");
+        if (IS_ERR(pltclk)) {
+                pr_err("%s: can't get bus frequency %ld\n",
+                       __func__, PTR_ERR(pltclk));
+                return PTR_ERR(pltclk);
+        }
-        return sysfreq;
+        return clk_get_rate(pltclk);
 }
 static struct clk *cpu_to_clk(int cpu)
diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
new file mode 100644
index 000000000000..fe7875311d62
--- /dev/null
+++ b/drivers/cpufreq/tegra186-cpufreq.c
@@ -0,0 +1,275 @@
+/*
+ * Copyright (c) 2017, NVIDIA CORPORATION. All rights reserved
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+#include <linux/cpufreq.h>
+#include <linux/dma-mapping.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <soc/tegra/bpmp.h>
+#include <soc/tegra/bpmp-abi.h>
+#define EDVD_CORE_VOLT_FREQ(core)               (0x20 + (core) * 0x4)
+#define EDVD_CORE_VOLT_FREQ_F_SHIFT             0
+#define EDVD_CORE_VOLT_FREQ_V_SHIFT             16
+struct tegra186_cpufreq_cluster_info {
+        unsigned long offset;
+        int cpus[4];
+        unsigned int bpmp_cluster_id;
+};
+#define NO_CPU -1
+static const struct tegra186_cpufreq_cluster_info tegra186_clusters[] = {
+        /* Denver cluster */
+        {
+                .offset = SZ_64K * 7,
+                .cpus = { 1, 2, NO_CPU, NO_CPU },
+                .bpmp_cluster_id = 0,
+        },
+        /* A57 cluster */
+        {
+                .offset = SZ_64K * 6,
+                .cpus = { 0, 3, 4, 5 },
+                .bpmp_cluster_id = 1,
+        },
+};
+struct tegra186_cpufreq_cluster {
+        const struct tegra186_cpufreq_cluster_info *info;
+        struct cpufreq_frequency_table *table;
+};
+struct tegra186_cpufreq_data {
+        void __iomem *regs;
+        size_t num_clusters;
+        struct tegra186_cpufreq_cluster *clusters;
+};
+static int tegra186_cpufreq_init(struct cpufreq_policy *policy)
+{
+        struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+        unsigned int i;
+        for (i = 0; i < data->num_clusters; i++) {
+                struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+                const struct tegra186_cpufreq_cluster_info *info =
+                        cluster->info;
+                int core;
+                for (core = 0; core < ARRAY_SIZE(info->cpus); core++) {
+                        if (info->cpus[core] == policy->cpu)
+                                break;
+                }
+                if (core == ARRAY_SIZE(info->cpus))
+                        continue;
+                policy->driver_data =
+                        data->regs + info->offset + EDVD_CORE_VOLT_FREQ(core);
+                cpufreq_table_validate_and_show(policy, cluster->table);
+        }
+        policy->cpuinfo.transition_latency = 300 * 1000;
+        return 0;
+}
+static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+                                       unsigned int index)
+{
+        struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+        void __iomem *edvd_reg = policy->driver_data;
+        u32 edvd_val = tbl->driver_data;
+        writel(edvd_val, edvd_reg);
+        return 0;
+}
+static struct cpufreq_driver tegra186_cpufreq_driver = {
+        .name = "tegra186",
+        .flags = CPUFREQ_STICKY | CPUFREQ_HAVE_GOVERNOR_PER_POLICY,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = tegra186_cpufreq_set_target,
+        .init = tegra186_cpufreq_init,
+        .attr = cpufreq_generic_attr,
+};
+static struct cpufreq_frequency_table *init_vhint_table(
+        struct platform_device *pdev, struct tegra_bpmp *bpmp,
+        unsigned int cluster_id)
+{
+        struct cpufreq_frequency_table *table;
+        struct mrq_cpu_vhint_request req;
+        struct tegra_bpmp_message msg;
+        struct cpu_vhint_data *data;
+        int err, i, j, num_rates = 0;
+        dma_addr_t phys;
+        void *virt;
+        virt = dma_alloc_coherent(bpmp->dev, sizeof(*data), &phys,
+                                  GFP_KERNEL | GFP_DMA32);
+        if (!virt)
+                return ERR_PTR(-ENOMEM);
+        data = (struct cpu_vhint_data *)virt;
+        memset(&req, 0, sizeof(req));
+        req.addr = phys;
+        req.cluster_id = cluster_id;
+        memset(&msg, 0, sizeof(msg));
+        msg.mrq = MRQ_CPU_VHINT;
+        msg.tx.data = &req;
+        msg.tx.size = sizeof(req);
+        err = tegra_bpmp_transfer(bpmp, &msg);
+        if (err) {
+                table = ERR_PTR(err);
+                goto free;
+        }
+        for (i = data->vfloor; i <= data->vceil; i++) {
+                u16 ndiv = data->ndiv[i];
+                if (ndiv < data->ndiv_min || ndiv > data->ndiv_max)
+                        continue;
+                /* Only store lowest voltage index for each rate */
+                if (i > 0 && ndiv == data->ndiv[i - 1])
+                        continue;
+                num_rates++;
+        }
+        table = devm_kcalloc(&pdev->dev, num_rates + 1, sizeof(*table),
+                             GFP_KERNEL);
+        if (!table) {
+                table = ERR_PTR(-ENOMEM);
+                goto free;
+        }
+        for (i = data->vfloor, j = 0; i <= data->vceil; i++) {
+                struct cpufreq_frequency_table *point;
+                u16 ndiv = data->ndiv[i];
+                u32 edvd_val = 0;
+                if (ndiv < data->ndiv_min || ndiv > data->ndiv_max)
+                        continue;
+                /* Only store lowest voltage index for each rate */
+                if (i > 0 && ndiv == data->ndiv[i - 1])
+                        continue;
+                edvd_val |= i << EDVD_CORE_VOLT_FREQ_V_SHIFT;
+                edvd_val |= ndiv << EDVD_CORE_VOLT_FREQ_F_SHIFT;
+                point = &table[j++];
+                point->driver_data = edvd_val;
+                point->frequency = data->ref_clk_hz * ndiv / data->pdiv /
+                        data->mdiv / 1000;
+        }
+        table[j].frequency = CPUFREQ_TABLE_END;
+free:
+        dma_free_coherent(bpmp->dev, sizeof(*data), virt, phys);
+        return table;
+}
+static int tegra186_cpufreq_probe(struct platform_device *pdev)
+{
+        struct tegra186_cpufreq_data *data;
+        struct tegra_bpmp *bpmp;
+        struct resource *res;
+        unsigned int i = 0, err;
+        data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        data->clusters = devm_kcalloc(&pdev->dev, ARRAY_SIZE(tegra186_clusters),
+                                      sizeof(*data->clusters), GFP_KERNEL);
+        if (!data->clusters)
+                return -ENOMEM;
+        data->num_clusters = ARRAY_SIZE(tegra186_clusters);
+        bpmp = tegra_bpmp_get(&pdev->dev);
+        if (IS_ERR(bpmp))
+                return PTR_ERR(bpmp);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        data->regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(data->regs)) {
+                err = PTR_ERR(data->regs);
+                goto put_bpmp;
+        }
+        for (i = 0; i < data->num_clusters; i++) {
+                struct tegra186_cpufreq_cluster *cluster = &data->clusters[i];
+                cluster->info = &tegra186_clusters[i];
+                cluster->table = init_vhint_table(
+                        pdev, bpmp, cluster->info->bpmp_cluster_id);
+                if (IS_ERR(cluster->table)) {
+                        err = PTR_ERR(cluster->table);
+                        goto put_bpmp;
+                }
+        }
+        tegra_bpmp_put(bpmp);
+        tegra186_cpufreq_driver.driver_data = data;
+        err = cpufreq_register_driver(&tegra186_cpufreq_driver);
+        if (err)
+                return err;
+        return 0;
+put_bpmp:
+        tegra_bpmp_put(bpmp);
+        return err;
+}
+static int tegra186_cpufreq_remove(struct platform_device *pdev)
+{
+        cpufreq_unregister_driver(&tegra186_cpufreq_driver);
+        return 0;
+}
+static const struct of_device_id tegra186_cpufreq_of_match[] = {
+        { .compatible = "nvidia,tegra186-ccplex-cluster", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, tegra186_cpufreq_of_match);
+static struct platform_driver tegra186_cpufreq_platform_driver = {
+        .driver = {
+                .name = "tegra186-cpufreq",
+                .of_match_table = tegra186_cpufreq_of_match,
+        },
+        .probe = tegra186_cpufreq_probe,
+        .remove = tegra186_cpufreq_remove,
+};
+module_platform_driver(tegra186_cpufreq_platform_driver);
+MODULE_AUTHOR("Mikko Perttunen <mperttunen@nvidia.com>");
+MODULE_DESCRIPTION("NVIDIA Tegra186 cpufreq driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/cpuidle/cpuidle-cps.c b/drivers/cpuidle/cpuidle-cps.c
index 926ba9871c62..12b9145913de 100644
--- a/drivers/cpuidle/cpuidle-cps.c
+++ b/drivers/cpuidle/cpuidle-cps.c
@@ -118,7 +118,7 @@ static void __init cps_cpuidle_unregister(void)
 static int __init cps_cpuidle_init(void)
 {
-        int err, cpu, core, i;
+        int err, cpu, i;
        struct cpuidle_device *device;
        /* Detect supported states */
@@ -160,7 +160,6 @@ static int __init cps_cpuidle_init(void)
        }
        for_each_possible_cpu(cpu) {
-                core = cpu_data[cpu].core;
                device = &per_cpu(cpuidle_dev, cpu);
                device->cpu = cpu;
 #ifdef CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index cda8f62d555b..12409a519cc5 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -56,10 +56,9 @@ static int snooze_loop(struct cpuidle_device *dev,
        snooze_exit_time = get_tb() + snooze_timeout;
        ppc64_runlatch_off();
+        HMT_very_low();
        while (!need_resched()) {
-                HMT_low();
+                if (likely(snooze_timeout_en) && get_tb() > snooze_exit_time)
-                HMT_very_low();
-                if (snooze_timeout_en && get_tb() > snooze_exit_time)
                        break;
        }
@@ -215,11 +214,25 @@ static inline void add_powernv_state(int index, const char *name,
        stop_psscr_table[index].mask = psscr_mask;
 }
+/*
+ * Returns 0 if prop1_len == prop2_len. Else returns -1
+ */
+static inline int validate_dt_prop_sizes(const char *prop1, int prop1_len,
+                                         const char *prop2, int prop2_len)
+{
+        if (prop1_len == prop2_len)
+                return 0;
+        pr_warn("cpuidle-powernv: array sizes don't match for %s and %s\n",
+                prop1, prop2);
+        return -1;
+}
 static int powernv_add_idle_states(void)
 {
        struct device_node *power_mgt;
        int nr_idle_states = 1; /* Snooze */
-        int dt_idle_states;
+        int dt_idle_states, count;
        u32 latency_ns[CPUIDLE_STATE_MAX];
        u32 residency_ns[CPUIDLE_STATE_MAX];
        u32 flags[CPUIDLE_STATE_MAX];
@@ -244,6 +257,21 @@ static int powernv_add_idle_states(void)
                goto out;
        }
+        count = of_property_count_u32_elems(power_mgt,
+                                            "ibm,cpu-idle-state-latencies-ns");
+        if (validate_dt_prop_sizes("ibm,cpu-idle-state-flags", dt_idle_states,
+                                   "ibm,cpu-idle-state-latencies-ns",
+                                   count) != 0)
+                goto out;
+        count = of_property_count_strings(power_mgt,
+                                          "ibm,cpu-idle-state-names");
+        if (validate_dt_prop_sizes("ibm,cpu-idle-state-flags", dt_idle_states,
+                                   "ibm,cpu-idle-state-names",
+                                   count) != 0)
+                goto out;
        /*
         * Since snooze is used as first idle state, max idle states allowed is
         * CPUIDLE_STATE_MAX -1
@@ -278,6 +306,22 @@ static int powernv_add_idle_states(void)
        has_stop_states = (flags[0] &
                           (OPAL_PM_STOP_INST_FAST | OPAL_PM_STOP_INST_DEEP));
        if (has_stop_states) {
+                count = of_property_count_u64_elems(power_mgt,
+                                                    "ibm,cpu-idle-state-psscr");
+                if (validate_dt_prop_sizes("ibm,cpu-idle-state-flags",
+                                           dt_idle_states,
+                                           "ibm,cpu-idle-state-psscr",
+                                           count) != 0)
+                        goto out;
+                count = of_property_count_u64_elems(power_mgt,
+                                                    "ibm,cpu-idle-state-psscr-mask");
+                if (validate_dt_prop_sizes("ibm,cpu-idle-state-flags",
+                                           dt_idle_states,
+                                           "ibm,cpu-idle-state-psscr-mask",
+                                           count) != 0)
+                        goto out;
                if (of_property_read_u64_array(power_mgt,
                    "ibm,cpu-idle-state-psscr", psscr_val, dt_idle_states)) {
                        pr_warn("cpuidle-powernv: missing ibm,cpu-idle-state-psscr in DT\n");
@@ -292,8 +336,21 @@ static int powernv_add_idle_states(void)
                }
        }
-        rc = of_property_read_u32_array(power_mgt,
+        count = of_property_count_u32_elems(power_mgt,
-                "ibm,cpu-idle-state-residency-ns", residency_ns, dt_idle_states);
+                                            "ibm,cpu-idle-state-residency-ns");
+        if (count < 0) {
+                rc = count;
+        } else if (validate_dt_prop_sizes("ibm,cpu-idle-state-flags",
+                                          dt_idle_states,
+                                          "ibm,cpu-idle-state-residency-ns",
+                                          count) != 0) {
+                goto out;
+        } else {
+                rc = of_property_read_u32_array(power_mgt,
+                                                "ibm,cpu-idle-state-residency-ns",
+                                                residency_ns, dt_idle_states);
+        }
        for (i = 0; i < dt_idle_states; i++) {
                unsigned int exit_latency, target_residency;
diff --git a/drivers/devfreq/governor.h b/drivers/devfreq/governor.h
index 71576b8bdfef..a4f2fa1091e4 100644
--- a/drivers/devfreq/governor.h
+++ b/drivers/devfreq/governor.h
@@ -25,6 +25,35 @@
 #define DEVFREQ_GOV_SUSPEND                     0x4
 #define DEVFREQ_GOV_RESUME                      0x5
+/**
+ * struct devfreq_governor - Devfreq policy governor
+ * @node:               list node - contains registered devfreq governors
+ * @name:               Governor's name
+ * @immutable:          Immutable flag for governor. If the value is 1,
+ *                      this govenror is never changeable to other governor.
+ * @get_target_freq:    Returns desired operating frequency for the device.
+ *                      Basically, get_target_freq will run
+ *                      devfreq_dev_profile.get_dev_status() to get the
+ *                      status of the device (load = busy_time / total_time).
+ *                      If no_central_polling is set, this callback is called
+ *                      only with update_devfreq() notified by OPP.
+ * @event_handler:      Callback for devfreq core framework to notify events
+ *                      to governors. Events include per device governor
+ *                      init and exit, opp changes out of devfreq, suspend
+ *                      and resume of per device devfreq during device idle.
+ *
+ * Note that the callbacks are called with devfreq->lock locked by devfreq.
+ */
+struct devfreq_governor {
+        struct list_head node;
+        const char name[DEVFREQ_NAME_LEN];
+        const unsigned int immutable;
+        int (*get_target_freq)(struct devfreq *this, unsigned long *freq);
+        int (*event_handler)(struct devfreq *devfreq,
+                                unsigned int event, void *data);
+};
 /* Caution: devfreq->lock must be locked before calling update_devfreq */
 extern int update_devfreq(struct devfreq *devfreq);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 94250c293be2..c68ac65db7ff 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2006,7 +2006,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                return;
        case HID_DG_TOOLSERIALNUMBER:
                wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= value;
+                wacom_wac->serial[0] |= (__u32)value;
                return;
        case WACOM_HID_WD_SENSE:
                wacom_wac->hid_data.sense_state = value;
@@ -2176,6 +2176,16 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
                wacom_wac->hid_data.cc_index = field->index;
                wacom_wac->hid_data.cc_value_index = usage->usage_index;
                break;
+        case HID_DG_CONTACTID:
+                if ((field->logical_maximum - field->logical_minimum) < touch_max) {
+                        /*
+                         * The HID descriptor for G11 sensors leaves logical
+                         * maximum set to '1' despite it being a multitouch
+                         * device. Override to a sensible number.
+                         */
+                        field->logical_maximum = 255;
+                }
+                break;
        }
 }
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index efc8ec342351..e73d968023f7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,6 +1118,7 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
 * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
 * Avatar AVIU-145A2       0x361f00        ?               clickpad
 * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
 * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
 * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
 * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
@@ -1524,6 +1525,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                },
        },
        {
+                /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E547"),
+                },
+        },
+        {
                /* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index e992a7f8a16f..2b32b88949ba 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -267,7 +267,7 @@ static void sdio_release_func(struct device *dev)
        sdio_free_func_cis(func);
        kfree(func->info);
+        kfree(func->tmpbuf);
        kfree(func);
 }
@@ -282,6 +282,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
        if (!func)
                return ERR_PTR(-ENOMEM);
+        /*
+         * allocate buffer separately to make sure it's properly aligned for
+         * DMA usage (incl. 64 bit DMA)
+         */
+        func->tmpbuf = kmalloc(4, GFP_KERNEL);
+        if (!func->tmpbuf) {
+                kfree(func);
+                return ERR_PTR(-ENOMEM);
+        }
        func->card = card;
        device_initialize(&func->dev);
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index a9ac0b457313..8718432751c5 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -22,6 +22,7 @@
 #include <linux/ioport.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/stat.h>
@@ -1621,10 +1622,16 @@ static void dw_mci_init_card(struct mmc_host *mmc, struct mmc_card *card)
                if (card->type == MMC_TYPE_SDIO ||
                    card->type == MMC_TYPE_SD_COMBO) {
-                        set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (!test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_get_noresume(mmc->parent);
+                                set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                        clk_en_a = clk_en_a_old & ~clken_low_pwr;
                } else {
-                        clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_put_noidle(mmc->parent);
+                                clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                        clk_en_a = clk_en_a_old | clken_low_pwr;
                }
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 7123ef96ed18..445fc47dc3e7 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -830,6 +830,7 @@ static int esdhc_change_pinstate(struct sdhci_host *host,
        switch (uhs) {
        case MMC_TIMING_UHS_SDR50:
+        case MMC_TIMING_UHS_DDR50:
                pinctrl = imx_data->pins_100mhz;
                break;
        case MMC_TIMING_UHS_SDR104:
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 0134ba32a057..39712560b4c1 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -148,11 +148,11 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                        return err;
        }
-        if (bytes == 0) {
+        err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
-                err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
+        if (err)
-                if (err)
+                return err;
-                        return err;
+        if (bytes == 0) {
                err = clear_update_marker(ubi, vol, 0);
                if (err)
                        return err;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 64a1095e4d14..a0ca68ce3fbb 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -134,6 +134,7 @@ static void set_max_bgx_per_node(struct pci_dev *pdev)
        pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &sdevid);
        switch (sdevid) {
        case PCI_SUBSYS_DEVID_81XX_BGX:
+        case PCI_SUBSYS_DEVID_81XX_RGX:
                max_bgx_per_node = MAX_BGX_PER_CN81XX;
                break;
        case PCI_SUBSYS_DEVID_83XX_BGX:
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index c5080f2cead5..6b7fe6fdd13b 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -16,6 +16,7 @@
 /* Subsystem device IDs */
 #define PCI_SUBSYS_DEVID_88XX_BGX               0xA126
 #define PCI_SUBSYS_DEVID_81XX_BGX               0xA226
+#define PCI_SUBSYS_DEVID_81XX_RGX               0xA254
 #define PCI_SUBSYS_DEVID_83XX_BGX               0xA326
 #define    MAX_BGX_THUNDER                      8 /* Max 2 nodes, 4 per node */
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 9e757684816d..93949139e62c 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -613,7 +613,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
        struct mtk_mac *mac = netdev_priv(dev);
        struct mtk_eth *eth = mac->hw;
        struct mtk_tx_dma *itxd, *txd;
-        struct mtk_tx_buf *tx_buf;
+        struct mtk_tx_buf *itx_buf, *tx_buf;
        dma_addr_t mapped_addr;
        unsigned int nr_frags;
        int i, n_desc = 1;
@@ -627,8 +627,8 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
        fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
        txd4 |= fport;
-        tx_buf = mtk_desc_to_tx_buf(ring, itxd);
+        itx_buf = mtk_desc_to_tx_buf(ring, itxd);
-        memset(tx_buf, 0, sizeof(*tx_buf));
+        memset(itx_buf, 0, sizeof(*itx_buf));
        if (gso)
                txd4 |= TX_DMA_TSO;
@@ -647,9 +647,11 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                return -ENOMEM;
        WRITE_ONCE(itxd->txd1, mapped_addr);
-        tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+        itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
-        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
+        itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
-        dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));
+                          MTK_TX_FLAGS_FPORT1;
+        dma_unmap_addr_set(itx_buf, dma_addr0, mapped_addr);
+        dma_unmap_len_set(itx_buf, dma_len0, skb_headlen(skb));
        /* TX SG offload */
        txd = itxd;
@@ -685,11 +687,13 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                                               last_frag * TX_DMA_LS0));
                        WRITE_ONCE(txd->txd4, fport);
-                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                        tx_buf = mtk_desc_to_tx_buf(ring, txd);
                        memset(tx_buf, 0, sizeof(*tx_buf));
+                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                        tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+                        tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+                                         MTK_TX_FLAGS_FPORT1;
                        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
                        dma_unmap_len_set(tx_buf, dma_len0, frag_map_size);
                        frag_size -= frag_map_size;
@@ -698,7 +702,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
        }
        /* store skb to cleanup */
-        tx_buf->skb = skb;
+        itx_buf->skb = skb;
        WRITE_ONCE(itxd->txd4, txd4);
        WRITE_ONCE(itxd->txd3, (TX_DMA_SWC | TX_DMA_PLEN0(skb_headlen(skb)) |
@@ -1012,17 +1016,16 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
        while ((cpu != dma) && budget) {
                u32 next_cpu = desc->txd2;
-                int mac;
+                int mac = 0;
                desc = mtk_qdma_phys_to_virt(ring, desc->txd2);
                if ((desc->txd3 & TX_DMA_OWNER_CPU) == 0)
                        break;
-                mac = (desc->txd4 >> TX_DMA_FPORT_SHIFT) &
-                       TX_DMA_FPORT_MASK;
-                mac--;
                tx_buf = mtk_desc_to_tx_buf(ring, desc);
+                if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+                        mac = 1;
                skb = tx_buf->skb;
                if (!skb) {
                        condition = 1;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index 99b1c8e9f16f..08285a96ff70 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -406,12 +406,18 @@ struct mtk_hw_stats {
        struct u64_stats_sync   syncp;
 };
-/* PDMA descriptor can point at 1-2 segments. This enum allows us to track how
- * memory was allocated so that it can be freed properly
- */
 enum mtk_tx_flags {
+        /* PDMA descriptor can point at 1-2 segments. This enum allows us to
+         * track how memory was allocated so that it can be freed properly.
+         */
        MTK_TX_FLAGS_SINGLE0    = 0x01,
        MTK_TX_FLAGS_PAGE0      = 0x02,
+        /* MTK_TX_FLAGS_FPORTx allows tracking which port the transmitted
+         * SKB out instead of looking up through hardware TX descriptor.
+         */
+        MTK_TX_FLAGS_FPORT0     = 0x04,
+        MTK_TX_FLAGS_FPORT1     = 0x08,
 };
 /* This enum allows us to identify how the clock is defined on the array of the
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 5bd36a4a8fcd..a6e2bbe629bd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -583,6 +583,13 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
                   p_params->ets_cbs,
                   p_ets->pri_tc_tbl[0], p_params->max_ets_tc);
+        if (p_params->ets_enabled && !p_params->max_ets_tc) {
+                p_params->max_ets_tc = QED_MAX_PFC_PRIORITIES;
+                DP_VERBOSE(p_hwfn, QED_MSG_DCB,
+                           "ETS params: max_ets_tc is forced to %d\n",
+                p_params->max_ets_tc);
+        }
        /* 8 bit tsa and bw data corresponding to each of the 8 TC's are
         * encoded in a type u32 array of size 2.
         */
@@ -1001,6 +1008,8 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
        u8 pfc_map = 0;
        int i;
+        *pfc &= ~DCBX_PFC_ERROR_MASK;
        if (p_params->pfc.willing)
                *pfc |= DCBX_PFC_WILLING_MASK;
        else
@@ -1255,7 +1264,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
        struct qed_dcbx_get *dcbx_info;
-        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
        if (!dcbx_info)
                return NULL;
@@ -2073,6 +2082,8 @@ static int qed_dcbnl_ieee_setpfc(struct qed_dev *cdev, struct ieee_pfc *pfc)
        for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++)
                dcbx_set.config.params.pfc.prio[i] = !!(pfc->pfc_en & BIT(i));
+        dcbx_set.config.params.pfc.max_tc = pfc->pfc_cap;
        ptt = qed_ptt_acquire(hwfn);
        if (!ptt)
                return -EINVAL;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 54248775f227..f68c4db656ed 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1127,12 +1127,70 @@ static struct mdiobb_ops bb_ops = {
        .get_mdio_data = sh_get_mdio,
 };
+/* free Tx skb function */
+static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        struct sh_eth_txdesc *txdesc;
+        int free_num = 0;
+        int entry;
+        bool sent;
+        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
+                entry = mdp->dirty_tx % mdp->num_tx_ring;
+                txdesc = &mdp->tx_ring[entry];
+                sent = !(txdesc->status & cpu_to_le32(TD_TACT));
+                if (sent_only && !sent)
+                        break;
+                /* TACT bit must be checked before all the following reads */
+                dma_rmb();
+                netif_info(mdp, tx_done, ndev,
+                           "tx entry %d status 0x%08x\n",
+                           entry, le32_to_cpu(txdesc->status));
+                /* Free the original skb. */
+                if (mdp->tx_skbuff[entry]) {
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
+                                         le32_to_cpu(txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
+                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
+                        mdp->tx_skbuff[entry] = NULL;
+                        free_num++;
+                }
+                txdesc->status = cpu_to_le32(TD_TFP);
+                if (entry >= mdp->num_tx_ring - 1)
+                        txdesc->status |= cpu_to_le32(TD_TDLE);
+                if (sent) {
+                        ndev->stats.tx_packets++;
+                        ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
+                }
+        }
+        return free_num;
+}
 /* free skb and descriptor buffer */
 static void sh_eth_ring_free(struct net_device *ndev)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
        int ringsize, i;
+        if (mdp->rx_ring) {
+                for (i = 0; i < mdp->num_rx_ring; i++) {
+                        if (mdp->rx_skbuff[i]) {
+                                struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
+                                dma_unmap_single(&ndev->dev,
+                                                 le32_to_cpu(rxdesc->addr),
+                                                 ALIGN(mdp->rx_buf_sz, 32),
+                                                 DMA_FROM_DEVICE);
+                        }
+                }
+                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
+                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
+                                  mdp->rx_desc_dma);
+                mdp->rx_ring = NULL;
+        }
        /* Free Rx skb ringbuffer */
        if (mdp->rx_skbuff) {
                for (i = 0; i < mdp->num_rx_ring; i++)
@@ -1141,27 +1199,18 @@ static void sh_eth_ring_free(struct net_device *ndev)
        kfree(mdp->rx_skbuff);
        mdp->rx_skbuff = NULL;
-        /* Free Tx skb ringbuffer */
-        if (mdp->tx_skbuff) {
-                for (i = 0; i < mdp->num_tx_ring; i++)
-                        dev_kfree_skb(mdp->tx_skbuff[i]);
-        }
-        kfree(mdp->tx_skbuff);
-        mdp->tx_skbuff = NULL;
-        if (mdp->rx_ring) {
-                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
-                                  mdp->rx_desc_dma);
-                mdp->rx_ring = NULL;
-        }
        if (mdp->tx_ring) {
+                sh_eth_tx_free(ndev, false);
                ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
                dma_free_coherent(NULL, ringsize, mdp->tx_ring,
                                  mdp->tx_desc_dma);
                mdp->tx_ring = NULL;
        }
+        /* Free Tx skb ringbuffer */
+        kfree(mdp->tx_skbuff);
+        mdp->tx_skbuff = NULL;
 }
 /* format skb and descriptor buffer */
@@ -1409,43 +1458,6 @@ static void sh_eth_dev_exit(struct net_device *ndev)
        update_mac_address(ndev);
 }
-/* free Tx skb function */
-static int sh_eth_txfree(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        struct sh_eth_txdesc *txdesc;
-        int free_num = 0;
-        int entry;
-        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
-                entry = mdp->dirty_tx % mdp->num_tx_ring;
-                txdesc = &mdp->tx_ring[entry];
-                if (txdesc->status & cpu_to_le32(TD_TACT))
-                        break;
-                /* TACT bit must be checked before all the following reads */
-                dma_rmb();
-                netif_info(mdp, tx_done, ndev,
-                           "tx entry %d status 0x%08x\n",
-                           entry, le32_to_cpu(txdesc->status));
-                /* Free the original skb. */
-                if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
-                                         le32_to_cpu(txdesc->len) >> 16,
-                                         DMA_TO_DEVICE);
-                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
-                        mdp->tx_skbuff[entry] = NULL;
-                        free_num++;
-                }
-                txdesc->status = cpu_to_le32(TD_TFP);
-                if (entry >= mdp->num_tx_ring - 1)
-                        txdesc->status |= cpu_to_le32(TD_TDLE);
-                ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
-        }
-        return free_num;
-}
 /* Packet receive function */
 static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 {
@@ -1690,7 +1702,7 @@ static void sh_eth_error(struct net_device *ndev, u32 intr_status)
                           intr_status, mdp->cur_tx, mdp->dirty_tx,
                           (u32)ndev->state, edtrr);
                /* dirty buffer free */
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
                /* SH7712 BUG */
                if (edtrr ^ sh_eth_get_edtrr_trns(mdp)) {
@@ -1751,7 +1763,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                /* Clear Tx interrupts */
                sh_eth_write(ndev, intr_status & cd->tx_check, EESR);
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
                netif_wake_queue(ndev);
        }
@@ -2412,7 +2424,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        spin_lock_irqsave(&mdp->lock, flags);
        if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) {
-                if (!sh_eth_txfree(ndev)) {
+                if (!sh_eth_tx_free(ndev, true)) {
                        netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n");
                        netif_stop_queue(ndev);
                        spin_unlock_irqrestore(&mdp->lock, flags);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 50d28261b6b9..b9cb697b2818 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1371,6 +1371,13 @@ static unsigned int efx_wanted_parallelism(struct efx_nic *efx)
                free_cpumask_var(thread_mask);
        }
+        if (count > EFX_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EFX_MAX_RX_QUEUES);
+                count = EFX_MAX_RX_QUEUES;
+        }
        /* If RSS is requested for the PF *and* VFs then we can't write RSS
         * table entries that are inaccessible to VFs
         */
diff --git a/drivers/net/ethernet/sfc/falcon/efx.c b/drivers/net/ethernet/sfc/falcon/efx.c
index f5e5cd1659a1..29614da91cbf 100644
--- a/drivers/net/ethernet/sfc/falcon/efx.c
+++ b/drivers/net/ethernet/sfc/falcon/efx.c
@@ -1354,6 +1354,13 @@ static unsigned int ef4_wanted_parallelism(struct ef4_nic *efx)
                free_cpumask_var(thread_mask);
        }
+        if (count > EF4_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EF4_MAX_RX_QUEUES);
+                count = EF4_MAX_RX_QUEUES;
+        }
        return count;
 }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index e2460a57e4b1..ed0d10f54f26 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1438,8 +1438,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
                skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                skb_queue_tail(&dp83640->rx_queue, skb);
                schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT);
-        } else {
-                netif_rx_ni(skb);
        }
        return true;
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6742070ca676..1326d99771c1 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -798,9 +798,6 @@ static struct phy_driver ksphy_driver[] = {
        .read_status    = genphy_read_status,
        .ack_interrupt  = kszphy_ack_interrupt,
        .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
 }, {
@@ -940,9 +937,6 @@ static struct phy_driver ksphy_driver[] = {
        .read_status    = genphy_read_status,
        .ack_interrupt  = kszphy_ack_interrupt,
        .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
 }, {
@@ -952,6 +946,7 @@ static struct phy_driver ksphy_driver[] = {
        .features       = PHY_GBIT_FEATURES,
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
        .config_init    = ksz9021_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
@@ -971,6 +966,7 @@ static struct phy_driver ksphy_driver[] = {
        .features       = PHY_GBIT_FEATURES,
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
        .config_init    = ksz9031_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = ksz9031_read_status,
@@ -989,9 +985,6 @@ static struct phy_driver ksphy_driver[] = {
        .config_init    = kszphy_config_init,
        .config_aneg    = ksz8873mll_config_aneg,
        .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
 }, {
@@ -1003,9 +996,6 @@ static struct phy_driver ksphy_driver[] = {
        .config_init    = kszphy_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
 }, {
@@ -1017,9 +1007,6 @@ static struct phy_driver ksphy_driver[] = {
        .config_init    = kszphy_config_init,
        .config_aneg    = ksz8873mll_config_aneg,
        .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
 } };
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index 8a40202c0a17..c4f1c363e24b 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        tx_overhead = 0x40;
        len = skb->len;
-        if (skb_headroom(skb) < tx_overhead) {
+        if (skb_cow_head(skb, tx_overhead)) {
-                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        __skb_push(skb, tx_overhead);
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index e221bfcee76b..947bea81d924 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 {
        int len = skb->len;
-        if (skb_headroom(skb) < 2) {
+        if (skb_cow_head(skb, 2)) {
-                struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        skb_push(skb, 2);
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 876f02f4945e..2a2c3edb6bad 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
        }
        /* We now decide whether we can put our special header into the sk_buff */
-        if (skb_cloned(skb) || skb_headroom(skb) < 2) {
+        if (skb_cow_head(skb, 2)) {
-                /* no such luck - we make our own */
+                kaweth->stats.tx_errors++;
-                struct sk_buff *copied_skb;
+                netif_start_queue(net);
-                copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
+                spin_unlock_irq(&kaweth->device_lock);
-                dev_kfree_skb_irq(skb);
+                dev_kfree_skb_any(skb);
-                skb = copied_skb;
+                return NETDEV_TX_OK;
-                if (!copied_skb) {
-                        kaweth->stats.tx_errors++;
-                        netif_start_queue(net);
-                        spin_unlock_irq(&kaweth->device_lock);
-                        return NETDEV_TX_OK;
-                }
        }
        private_header = (__le16 *)__skb_push(skb, 2);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 9889a70ff4f6..636f48f19d1e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2607,14 +2607,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
 {
        u32 tx_cmd_a, tx_cmd_b;
-        if (skb_headroom(skb) < TX_OVERHEAD) {
+        if (skb_cow_head(skb, TX_OVERHEAD)) {
-                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        if (lan78xx_linearize(skb) < 0)
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 0b17b40d7a4f..190de9a90f73 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2203,13 +2203,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
        u32 tx_cmd_a, tx_cmd_b;
-        if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+        if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
-                struct sk_buff *skb2 =
-                        skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 831aa33d078a..5f19fb0f025d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2001,13 +2001,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
        /* We do not advertise SG, so skbs should be already linearized */
        BUG_ON(skb_shinfo(skb)->nr_frags);
-        if (skb_headroom(skb) < overhead) {
+        /* Make writable and expand header space by overhead if required */
-                struct sk_buff *skb2 = skb_copy_expand(skb,
+        if (skb_cow_head(skb, overhead)) {
-                        overhead, 0, flags);
+                /* Must deallocate here as returning NULL to indicate error
+                 * means the skb won't be deallocated in the caller.
+                 */
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        if (csum) {
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 4a1e9c489f1f..aadfe1d1c37e 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        len = skb->len;
-        if (skb_headroom(skb) < SR_TX_OVERHEAD) {
+        if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
-                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
                dev_kfree_skb_any(skb);
-                skb = skb2;
+                return NULL;
-                if (!skb)
-                        return NULL;
        }
        __skb_push(skb, SR_TX_OVERHEAD);
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index d6988db1930d..7d909c8183e9 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1128,7 +1128,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
                goto nla_put_failure;
        /* rule only needs to appear once */
-        nlh->nlmsg_flags &= NLM_F_EXCL;
+        nlh->nlmsg_flags |= NLM_F_EXCL;
        frh = nlmsg_data(nlh);
        memset(frh, 0, sizeof(*frh));
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9583a5f58a1d..eeb409c287b8 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1316,6 +1316,14 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                                table->entries[state] = target;
                        /*
+                         * Don't allow transitions to the deepest state
+                         * if it's quirked off.
+                         */
+                        if (state == ctrl->npss &&
+                            (ctrl->quirks & NVME_QUIRK_NO_DEEPEST_PS))
+                                continue;
+                        /*
                         * Is this state a useful non-operational state for
                         * higher-power states to autonomously transition to?
                         */
@@ -1387,16 +1395,15 @@ struct nvme_core_quirk_entry {
 };
 static const struct nvme_core_quirk_entry core_quirks[] = {
-        /*
-         * Seen on a Samsung "SM951 NVMe SAMSUNG 256GB": using APST causes
-         * the controller to go out to lunch.  It dies when the watchdog
-         * timer reads CSTS and gets 0xffffffff.
-         */
        {
-                .vid = 0x144d,
+                /*
-                .fr = "BXW75D0Q",
+                 * This Toshiba device seems to die using any APST states.  See:
+                 * https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678184/comments/11
+                 */
+                .vid = 0x1179,
+                .mn = "THNSF5256GPUK TOSHIBA",
                .quirks = NVME_QUIRK_NO_APST,
-        },
+        }
 };
 /* match is null-terminated but idstr is space-padded. */
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 2aa20e3e5675..ab2d6ec7eb5c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -83,6 +83,11 @@ enum nvme_quirks {
         * APST should not be used.
         */
        NVME_QUIRK_NO_APST                      = (1 << 4),
+        /*
+         * The deepest sleep state should not be used.
+         */
+        NVME_QUIRK_NO_DEEPEST_PS                = (1 << 5),
 };
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 26a5fd05fe88..5d309535abbd 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -19,6 +19,7 @@
 #include <linux/blk-mq-pci.h>
 #include <linux/cpu.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/genhd.h>
@@ -1943,10 +1944,31 @@ static int nvme_dev_map(struct nvme_dev *dev)
        return -ENODEV;
 }
+static unsigned long check_dell_samsung_bug(struct pci_dev *pdev)
+{
+        if (pdev->vendor == 0x144d && pdev->device == 0xa802) {
+                /*
+                 * Several Samsung devices seem to drop off the PCIe bus
+                 * randomly when APST is on and uses the deepest sleep state.
+                 * This has been observed on a Samsung "SM951 NVMe SAMSUNG
+                 * 256GB", a "PM951 NVMe SAMSUNG 512GB", and a "Samsung SSD
+                 * 950 PRO 256GB", but it seems to be restricted to two Dell
+                 * laptops.
+                 */
+                if (dmi_match(DMI_SYS_VENDOR, "Dell Inc.") &&
+                    (dmi_match(DMI_PRODUCT_NAME, "XPS 15 9550") ||
+                     dmi_match(DMI_PRODUCT_NAME, "Precision 5510")))
+                        return NVME_QUIRK_NO_DEEPEST_PS;
+        }
+        return 0;
+}
 static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
        int node, result = -ENOMEM;
        struct nvme_dev *dev;
+        unsigned long quirks = id->driver_data;
        node = dev_to_node(&pdev->dev);
        if (node == NUMA_NO_NODE)
@@ -1978,8 +2000,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (result)
                goto put_pci;
+        quirks |= check_dell_samsung_bug(pdev);
        result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
-                        id->driver_data);
+                        quirks);
        if (result)
                goto release_pools;
diff --git a/drivers/pci/dwc/pcie-hisi.c b/drivers/pci/dwc/pcie-hisi.c
index fd66a3199db7..cf9d6a9d9fd4 100644
--- a/drivers/pci/dwc/pcie-hisi.c
+++ b/drivers/pci/dwc/pcie-hisi.c
@@ -380,9 +380,13 @@ struct pci_ecam_ops hisi_pcie_platform_ops = {
 static const struct of_device_id hisi_pcie_almost_ecam_of_match[] = {
        {
-                .compatible = "hisilicon,pcie-almost-ecam",
+                .compatible =  "hisilicon,hip06-pcie-ecam",
                .data       = (void *) &hisi_pcie_platform_ops,
        },
+        {
+                .compatible =  "hisilicon,hip07-pcie-ecam",
+                .data       = (void *) &hisi_pcie_platform_ops,
+        },
        {},
 };
diff --git a/drivers/power/avs/rockchip-io-domain.c b/drivers/power/avs/rockchip-io-domain.c
index 56bce1908be2..85812521b6ba 100644
--- a/drivers/power/avs/rockchip-io-domain.c
+++ b/drivers/power/avs/rockchip-io-domain.c
@@ -43,6 +43,10 @@
 #define RK3288_SOC_CON2_FLASH0          BIT(7)
 #define RK3288_SOC_FLASH_SUPPLY_NUM     2
+#define RK3328_SOC_CON4                 0x410
+#define RK3328_SOC_CON4_VCCIO2          BIT(7)
+#define RK3328_SOC_VCCIO2_SUPPLY_NUM    1
 #define RK3368_SOC_CON15                0x43c
 #define RK3368_SOC_CON15_FLASH0         BIT(14)
 #define RK3368_SOC_FLASH_SUPPLY_NUM     2
@@ -166,6 +170,25 @@ static void rk3288_iodomain_init(struct rockchip_iodomain *iod)
                dev_warn(iod->dev, "couldn't update flash0 ctrl\n");
 }
+static void rk3328_iodomain_init(struct rockchip_iodomain *iod)
+{
+        int ret;
+        u32 val;
+        /* if no vccio2 supply we should leave things alone */
+        if (!iod->supplies[RK3328_SOC_VCCIO2_SUPPLY_NUM].reg)
+                return;
+        /*
+         * set vccio2 iodomain to also use this framework
+         * instead of a special gpio.
+         */
+        val = RK3328_SOC_CON4_VCCIO2 | (RK3328_SOC_CON4_VCCIO2 << 16);
+        ret = regmap_write(iod->grf, RK3328_SOC_CON4, val);
+        if (ret < 0)
+                dev_warn(iod->dev, "couldn't update vccio2 vsel ctrl\n");
+}
 static void rk3368_iodomain_init(struct rockchip_iodomain *iod)
 {
        int ret;
@@ -247,6 +270,20 @@ static const struct rockchip_iodomain_soc_data soc_data_rk3288 = {
        .init = rk3288_iodomain_init,
 };
+static const struct rockchip_iodomain_soc_data soc_data_rk3328 = {
+        .grf_offset = 0x410,
+        .supply_names = {
+                "vccio1",
+                "vccio2",
+                "vccio3",
+                "vccio4",
+                "vccio5",
+                "vccio6",
+                "pmuio",
+        },
+        .init = rk3328_iodomain_init,
+};
 static const struct rockchip_iodomain_soc_data soc_data_rk3368 = {
        .grf_offset = 0x900,
        .supply_names = {
@@ -312,6 +349,10 @@ static const struct of_device_id rockchip_iodomain_match[] = {
                .data = (void *)&soc_data_rk3288
        },
        {
+                .compatible = "rockchip,rk3328-io-voltage-domain",
+                .data = (void *)&soc_data_rk3328
+        },
+        {
                .compatible = "rockchip,rk3368-io-voltage-domain",
                .data = (void *)&soc_data_rk3368
        },
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 776b34396144..0a16cf4bed39 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -291,18 +291,6 @@ config ARMADA_THERMAL
          Enable this option if you want to have support for thermal management
          controller present in Armada 370 and Armada XP SoC.
-config DB8500_CPUFREQ_COOLING
-        tristate "DB8500 cpufreq cooling"
-        depends on ARCH_U8500 || COMPILE_TEST
-        depends on HAS_IOMEM
-        depends on CPU_THERMAL
-        default y
-        help
-          Adds DB8500 cpufreq cooling devices, and these cooling devices can be
-          bound to thermal zone trip points. When a trip point reached, the
-          bound cpufreq cooling device turns active to set CPU frequency low to
-          cool down the CPU.
 config INTEL_POWERCLAMP
        tristate "Intel PowerClamp idle injection driver"
        depends on THERMAL
diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile
index 7adae2029355..c2372f10dae5 100644
--- a/drivers/thermal/Makefile
+++ b/drivers/thermal/Makefile
@@ -41,7 +41,6 @@ obj-$(CONFIG_TANGO_THERMAL)	+= tango_thermal.o
 obj-$(CONFIG_IMX_THERMAL)       += imx_thermal.o
 obj-$(CONFIG_MAX77620_THERMAL)  += max77620_thermal.o
 obj-$(CONFIG_QORIQ_THERMAL)     += qoriq_thermal.o
-obj-$(CONFIG_DB8500_CPUFREQ_COOLING)    += db8500_cpufreq_cooling.o
 obj-$(CONFIG_INTEL_POWERCLAMP)  += intel_powerclamp.o
 obj-$(CONFIG_X86_PKG_TEMP_THERMAL)      += x86_pkg_temp_thermal.o
 obj-$(CONFIG_INTEL_SOC_DTS_IOSF_CORE)   += intel_soc_dts_iosf.o
diff --git a/drivers/thermal/db8500_cpufreq_cooling.c b/drivers/thermal/db8500_cpufreq_cooling.c
deleted file mode 100644
index e58bd0b658b5..000000000000
--- a/drivers/thermal/db8500_cpufreq_cooling.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * db8500_cpufreq_cooling.c - DB8500 cpufreq works as cooling device.
- *
- * Copyright (C) 2012 ST-Ericsson
- * Copyright (C) 2012 Linaro Ltd.
- *
- * Author: Hongbo Zhang <hongbo.zhang@linaro.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-#include <linux/cpu_cooling.h>
-#include <linux/err.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/platform_device.h>
-#include <linux/slab.h>
-static int db8500_cpufreq_cooling_probe(struct platform_device *pdev)
-{
-        struct thermal_cooling_device *cdev;
-        cdev = cpufreq_cooling_register(cpu_present_mask);
-        if (IS_ERR(cdev)) {
-                int ret = PTR_ERR(cdev);
-                if (ret != -EPROBE_DEFER)
-                        dev_err(&pdev->dev,
-                                "Failed to register cooling device %d\n",
-                                ret);
-                                
-                return ret;
-        }
-        platform_set_drvdata(pdev, cdev);
-        dev_info(&pdev->dev, "Cooling device registered: %s\n", cdev->type);
-        return 0;
-}
-static int db8500_cpufreq_cooling_remove(struct platform_device *pdev)
-{
-        struct thermal_cooling_device *cdev = platform_get_drvdata(pdev);
-        cpufreq_cooling_unregister(cdev);
-        return 0;
-}
-static int db8500_cpufreq_cooling_suspend(struct platform_device *pdev,
-                pm_message_t state)
-{
-        return -ENOSYS;
-}
-static int db8500_cpufreq_cooling_resume(struct platform_device *pdev)
-{
-        return -ENOSYS;
-}
-#ifdef CONFIG_OF
-static const struct of_device_id db8500_cpufreq_cooling_match[] = {
-        { .compatible = "stericsson,db8500-cpufreq-cooling" },
-        {},
-};
-MODULE_DEVICE_TABLE(of, db8500_cpufreq_cooling_match);
-#endif
-static struct platform_driver db8500_cpufreq_cooling_driver = {
-        .driver = {
-                .name = "db8500-cpufreq-cooling",
-                .of_match_table = of_match_ptr(db8500_cpufreq_cooling_match),
-        },
-        .probe = db8500_cpufreq_cooling_probe,
-        .suspend = db8500_cpufreq_cooling_suspend,
-        .resume = db8500_cpufreq_cooling_resume,
-        .remove = db8500_cpufreq_cooling_remove,
-};
-static int __init db8500_cpufreq_cooling_init(void)
-{
-        return platform_driver_register(&db8500_cpufreq_cooling_driver);
-}
-static void __exit db8500_cpufreq_cooling_exit(void)
-{
-        platform_driver_unregister(&db8500_cpufreq_cooling_driver);
-}
-/* Should be later than db8500_cpufreq_register */
-late_initcall(db8500_cpufreq_cooling_init);
-module_exit(db8500_cpufreq_cooling_exit);
-MODULE_AUTHOR("Hongbo Zhang <hongbo.zhang@stericsson.com>");
-MODULE_DESCRIPTION("DB8500 cpufreq cooling driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index d7efcb632f7d..002f1ce22bd0 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -297,14 +297,15 @@ static int pwm_backlight_probe(struct platform_device *pdev)
        }
        /*
-         * If the GPIO is configured as input, change the direction to output
+         * If the GPIO is not known to be already configured as output, that
-         * and set the GPIO as active.
+         * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL,
+         * change the direction to output and set the GPIO as active.
         * Do not force the GPIO to active when it was already output as it
         * could cause backlight flickering or we would enable the backlight too
         * early. Leave the decision of the initial backlight state for later.
         */
        if (pb->enable_gpio &&
-            gpiod_get_direction(pb->enable_gpio) == GPIOF_DIR_IN)
+            gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT)
                gpiod_direction_output(pb->enable_gpio, 1);
        pb->power_supply = devm_regulator_get(&pdev->dev, "power");
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index cc93ba4da9b5..27bc360c7ffd 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1015,6 +1015,15 @@ cifs_dir_needs_close(struct cifsFileInfo *cfile)
        return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle;
 }
+static bool
+cifs_can_echo(struct TCP_Server_Info *server)
+{
+        if (server->tcpStatus == CifsGood)
+                return true;
+        return false;
+}
 struct smb_version_operations smb1_operations = {
        .send_cancel = send_nt_cancel,
        .compare_fids = cifs_compare_fids,
@@ -1049,6 +1058,7 @@ struct smb_version_operations smb1_operations = {
        .get_dfs_refer = CIFSGetDFSRefer,
        .qfs_tcon = cifs_qfs_tcon,
        .is_path_accessible = cifs_is_path_accessible,
+        .can_echo = cifs_can_echo,
        .query_path_info = cifs_query_path_info,
        .query_file_info = cifs_query_file_info,
        .get_srv_inum = cifs_get_srv_inum,
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index cbeeda1e94a2..d86031b6ad79 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2489,7 +2489,7 @@ bool nfsd4_spo_must_allow(struct svc_rqst *rqstp)
 int nfsd4_max_reply(struct svc_rqst *rqstp, struct nfsd4_op *op)
 {
-        if (op->opnum == OP_ILLEGAL)
+        if (op->opnum == OP_ILLEGAL || op->status == nfserr_notsupp)
                return op_encode_hdr_size * sizeof(__be32);
        BUG_ON(OPDESC(op)->op_rsize_bop == NULL);
diff --git a/fs/nsfs.c b/fs/nsfs.c
index 1656843e87d2..323f492e0822 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -91,6 +91,7 @@ slow:
                return ERR_PTR(-ENOMEM);
        }
        d_instantiate(dentry, inode);
+        dentry->d_flags |= DCACHE_RCUACCESS;
        dentry->d_fsdata = (void *)ns->ops;
        d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
        if (d) {
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 1e712a364680..718b749fa11a 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -32,6 +32,7 @@
 #include <linux/math64.h>
 #include <linux/uaccess.h>
 #include <linux/random.h>
+#include <linux/ctype.h>
 #include "ubifs.h"
 static DEFINE_SPINLOCK(dbg_lock);
@@ -286,8 +287,10 @@ void ubifs_dump_inode(struct ubifs_info *c, const struct inode *inode)
                        break;
                }
-                pr_err("\t%d: %s (%s)\n",
+                pr_err("\t%d: inode %llu, type %s, len %d\n",
-                       count++, dent->name, get_dent_type(dent->type));
+                       count++, (unsigned long long) le64_to_cpu(dent->inum),
+                       get_dent_type(dent->type),
+                       le16_to_cpu(dent->nlen));
                fname_name(&nm) = dent->name;
                fname_len(&nm) = le16_to_cpu(dent->nlen);
@@ -464,7 +467,8 @@ void ubifs_dump_node(const struct ubifs_info *c, const void *node)
                        pr_err("(bad name length, not printing, bad or corrupted node)");
                else {
                        for (i = 0; i < nlen && dent->name[i]; i++)
-                                pr_cont("%c", dent->name[i]);
+                                pr_cont("%c", isprint(dent->name[i]) ?
+                                        dent->name[i] : '?');
                }
                pr_cont("\n");
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 30825d882aa9..b777bddaa1dd 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -606,8 +606,8 @@ static int ubifs_readdir(struct file *file, struct dir_context *ctx)
        }
        while (1) {
-                dbg_gen("feed '%s', ino %llu, new f_pos %#x",
+                dbg_gen("ino %llu, new f_pos %#x",
-                        dent->name, (unsigned long long)le64_to_cpu(dent->inum),
+                        (unsigned long long)le64_to_cpu(dent->inum),
                        key_hash_flash(c, &dent->key));
                ubifs_assert(le64_to_cpu(dent->ch.sqnum) >
                             ubifs_inode(dir)->creat_sqnum);
@@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
                goto out_fname;
        lock_2_inodes(dir, inode);
+        /* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
+        if (inode->i_nlink == 0)
+                ubifs_delete_orphan(c, inode->i_ino);
        inc_nlink(inode);
        ihold(inode);
        inode->i_ctime = ubifs_current_time(inode);
@@ -768,6 +773,8 @@ out_cancel:
        dir->i_size -= sz_change;
        dir_ui->ui_size = dir->i_size;
        drop_nlink(inode);
+        if (inode->i_nlink == 0)
+                ubifs_add_orphan(c, inode->i_ino);
        unlock_2_inodes(dir, inode);
        ubifs_release_budget(c, &req);
        iput(inode);
@@ -1068,8 +1075,10 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry,
        }
        err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
-        if (err)
+        if (err) {
+                kfree(dev);
                goto out_budg;
+        }
        sz_change = CALC_DENT_SIZE(fname_len(&nm));
@@ -1316,9 +1325,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
        unsigned int uninitialized_var(saved_nlink);
        struct fscrypt_name old_nm, new_nm;
-        if (flags & ~RENAME_NOREPLACE)
-                return -EINVAL;
        /*
         * Budget request settings: deletion direntry, new direntry, removing
         * the old inode, and changing old and new parent directory inodes.
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 1d4f365d8f03..f6d9af3efa45 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
        return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
 }
+static inline void ahash_request_complete(struct ahash_request *req, int err)
+{
+        req->base.complete(&req->base, err);
+}
+static inline u32 ahash_request_flags(struct ahash_request *req)
+{
+        return req->base.flags;
+}
 static inline struct crypto_ahash *crypto_spawn_ahash(
        struct crypto_ahash_spawn *spawn)
 {
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 87165f06a307..a5ce0bbeadb5 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -120,6 +120,13 @@ struct cpufreq_policy {
        bool                    fast_switch_possible;
        bool                    fast_switch_enabled;
+        /*
+         * Preferred average time interval between consecutive invocations of
+         * the driver to set the frequency for this policy.  To be set by the
+         * scaling driver (0, which is the default, means no preference).
+         */
+        unsigned int            transition_delay_us;
         /* Cached frequency lookup from cpufreq_driver_resolve_freq. */
        unsigned int cached_target_freq;
        int cached_resolved_idx;
diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
index e0acb0e5243b..6c220e4ebb6b 100644
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -27,6 +27,7 @@
 #define DEVFREQ_POSTCHANGE              (1)
 struct devfreq;
+struct devfreq_governor;
 /**
 * struct devfreq_dev_status - Data given from devfreq user device to
@@ -101,35 +102,6 @@ struct devfreq_dev_profile {
 };
 /**
- * struct devfreq_governor - Devfreq policy governor
- * @node:               list node - contains registered devfreq governors
- * @name:               Governor's name
- * @immutable:          Immutable flag for governor. If the value is 1,
- *                      this govenror is never changeable to other governor.
- * @get_target_freq:    Returns desired operating frequency for the device.
- *                      Basically, get_target_freq will run
- *                      devfreq_dev_profile.get_dev_status() to get the
- *                      status of the device (load = busy_time / total_time).
- *                      If no_central_polling is set, this callback is called
- *                      only with update_devfreq() notified by OPP.
- * @event_handler:      Callback for devfreq core framework to notify events
- *                      to governors. Events include per device governor
- *                      init and exit, opp changes out of devfreq, suspend
- *                      and resume of per device devfreq during device idle.
- *
- * Note that the callbacks are called with devfreq->lock locked by devfreq.
- */
-struct devfreq_governor {
-        struct list_head node;
-        const char name[DEVFREQ_NAME_LEN];
-        const unsigned int immutable;
-        int (*get_target_freq)(struct devfreq *this, unsigned long *freq);
-        int (*event_handler)(struct devfreq *devfreq,
-                                unsigned int event, void *data);
-};
-/**
 * struct devfreq - Device devfreq structure
 * @node:       list node - contains the devices with devfreq that have been
 *              registered.
diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
index aab032a6ae61..97ca105347a6 100644
--- a/include/linux/mmc/sdio_func.h
+++ b/include/linux/mmc/sdio_func.h
@@ -53,7 +53,7 @@ struct sdio_func {
        unsigned int            state;          /* function state */
 #define SDIO_STATE_PRESENT      (1<<0)          /* present in sysfs */
-        u8                      tmpbuf[4];      /* DMA:able scratch buffer */
+        u8                      *tmpbuf;        /* DMA:able scratch buffer */
        unsigned                num_info;       /* number of info strings */
        const char              **info;         /* info strings */
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 5339ed5bd6f9..9b6abe632587 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -20,6 +20,7 @@
 /* Defines used for the flags field in the struct generic_pm_domain */
 #define GENPD_FLAG_PM_CLK       (1U << 0) /* PM domain uses PM clk */
 #define GENPD_FLAG_IRQ_SAFE     (1U << 1) /* PM domain operates in atomic */
+#define GENPD_FLAG_ALWAYS_ON    (1U << 2) /* PM domain is always powered on */
 enum gpd_status {
        GPD_STATE_ACTIVE = 0,   /* PM domain is active */
diff --git a/include/linux/tick.h b/include/linux/tick.h
index a04fea19676f..fe01e68bf520 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -117,6 +117,7 @@ extern void tick_nohz_idle_enter(void);
 extern void tick_nohz_idle_exit(void);
 extern void tick_nohz_irq_exit(void);
 extern ktime_t tick_nohz_get_sleep_length(void);
+extern unsigned long tick_nohz_get_idle_calls(void);
 extern u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time);
 extern u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time);
 #else /* !CONFIG_NO_HZ_COMMON */
diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h
index 85bbb1799df3..d496c02e14bc 100644
--- a/include/uapi/linux/ipv6_route.h
+++ b/include/uapi/linux/ipv6_route.h
@@ -35,7 +35,7 @@
 #define RTF_PREF(pref)  ((pref) << 27)
 #define RTF_PREF_MASK   0x18000000
-#define RTF_PCPU        0x40000000
+#define RTF_PCPU        0x40000000      /* read-only: can not be set by user */
 #define RTF_LOCAL       0x80000000
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7af0dcc5d755..821f9e807de5 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -617,6 +617,14 @@ static void fixup_bpf_calls(struct bpf_prog *prog)
                        if (insn->imm == BPF_FUNC_xdp_adjust_head)
                                prog->xdp_adjust_head = 1;
                        if (insn->imm == BPF_FUNC_tail_call) {
+                                /* If we tail call into other programs, we
+                                 * cannot make any assumptions since they
+                                 * can be replaced dynamically during runtime
+                                 * in the program array.
+                                 */
+                                prog->cb_access = 1;
+                                prog->xdp_adjust_head = 1;
                                /* mark bpf_tail_call as different opcode
                                 * to avoid conditional branch in
                                 * interpeter for every normal call
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index d052947fe785..e2d356dd7581 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -98,7 +98,7 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
                int ncpus, v, vecs_to_assign, vecs_per_node;
                /* Spread the vectors per node */
-                vecs_per_node = (affv - curvec) / nodes;
+                vecs_per_node = (affv - (curvec - affd->pre_vectors)) / nodes;
                /* Get the cpus on this node which are in the mask */
                cpumask_and(nmsk, cpu_online_mask, cpumask_of_node(n));
diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h
index c2b88490d857..c08fbd2f5ba9 100644
--- a/kernel/locking/lockdep_internals.h
+++ b/kernel/locking/lockdep_internals.h
@@ -46,13 +46,13 @@ enum {
                (LOCKF_USED_IN_HARDIRQ_READ | LOCKF_USED_IN_SOFTIRQ_READ)
 /*
- * CONFIG_PROVE_LOCKING_SMALL is defined for sparc. Sparc requires .text,
+ * CONFIG_LOCKDEP_SMALL is defined for sparc. Sparc requires .text,
 * .data and .bss to fit in required 32MB limit for the kernel. With
- * PROVE_LOCKING we could go over this limit and cause system boot-up problems.
+ * CONFIG_LOCKDEP we could go over this limit and cause system boot-up problems.
 * So, reduce the static allocations for lockdeps related structures so that
 * everything fits in current required size limit.
 */
-#ifdef CONFIG_PROVE_LOCKING_SMALL
+#ifdef CONFIG_LOCKDEP_SMALL
 /*
 * MAX_LOCKDEP_ENTRIES is the maximum number of lock dependencies
 * we track.
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 54c577578da6..76877a62b5fa 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -61,6 +61,11 @@ struct sugov_cpu {
        unsigned long util;
        unsigned long max;
        unsigned int flags;
+        /* The field below is for single-CPU policies only. */
+#ifdef CONFIG_NO_HZ_COMMON
+        unsigned long saved_idle_calls;
+#endif
 };
 static DEFINE_PER_CPU(struct sugov_cpu, sugov_cpu);
@@ -93,22 +98,23 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
 {
        struct cpufreq_policy *policy = sg_policy->policy;
+        if (sg_policy->next_freq == next_freq)
+                return;
+        if (sg_policy->next_freq > next_freq)
+                next_freq = (sg_policy->next_freq + next_freq) >> 1;
+        sg_policy->next_freq = next_freq;
        sg_policy->last_freq_update_time = time;
        if (policy->fast_switch_enabled) {
-                if (sg_policy->next_freq == next_freq) {
-                        trace_cpu_frequency(policy->cur, smp_processor_id());
-                        return;
-                }
-                sg_policy->next_freq = next_freq;
                next_freq = cpufreq_driver_fast_switch(policy, next_freq);
                if (next_freq == CPUFREQ_ENTRY_INVALID)
                        return;
                policy->cur = next_freq;
                trace_cpu_frequency(next_freq, smp_processor_id());
-        } else if (sg_policy->next_freq != next_freq) {
+        } else {
-                sg_policy->next_freq = next_freq;
                sg_policy->work_in_progress = true;
                irq_work_queue(&sg_policy->irq_work);
        }
@@ -192,6 +198,19 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, unsigned long *util,
        sg_cpu->iowait_boost >>= 1;
 }
+#ifdef CONFIG_NO_HZ_COMMON
+static bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu)
+{
+        unsigned long idle_calls = tick_nohz_get_idle_calls();
+        bool ret = idle_calls == sg_cpu->saved_idle_calls;
+        sg_cpu->saved_idle_calls = idle_calls;
+        return ret;
+}
+#else
+static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
+#endif /* CONFIG_NO_HZ_COMMON */
 static void sugov_update_single(struct update_util_data *hook, u64 time,
                                unsigned int flags)
 {
@@ -200,6 +219,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
        struct cpufreq_policy *policy = sg_policy->policy;
        unsigned long util, max;
        unsigned int next_f;
+        bool busy;
        sugov_set_iowait_boost(sg_cpu, time, flags);
        sg_cpu->last_update = time;
@@ -207,40 +227,37 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
        if (!sugov_should_update_freq(sg_policy, time))
                return;
+        busy = sugov_cpu_is_busy(sg_cpu);
        if (flags & SCHED_CPUFREQ_RT_DL) {
                next_f = policy->cpuinfo.max_freq;
        } else {
                sugov_get_util(&util, &max);
                sugov_iowait_boost(sg_cpu, &util, &max);
                next_f = get_next_freq(sg_policy, util, max);
+                /*
+                 * Do not reduce the frequency if the CPU has not been idle
+                 * recently, as the reduction is likely to be premature then.
+                 */
+                if (busy && next_f < sg_policy->next_freq)
+                        next_f = sg_policy->next_freq;
        }
        sugov_update_commit(sg_policy, time, next_f);
 }
-static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu,
+static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
-                                           unsigned long util, unsigned long max,
-                                           unsigned int flags)
 {
        struct sugov_policy *sg_policy = sg_cpu->sg_policy;
        struct cpufreq_policy *policy = sg_policy->policy;
-        unsigned int max_f = policy->cpuinfo.max_freq;
        u64 last_freq_update_time = sg_policy->last_freq_update_time;
+        unsigned long util = 0, max = 1;
        unsigned int j;
-        if (flags & SCHED_CPUFREQ_RT_DL)
-                return max_f;
-        sugov_iowait_boost(sg_cpu, &util, &max);
        for_each_cpu(j, policy->cpus) {
-                struct sugov_cpu *j_sg_cpu;
+                struct sugov_cpu *j_sg_cpu = &per_cpu(sugov_cpu, j);
                unsigned long j_util, j_max;
                s64 delta_ns;
-                if (j == smp_processor_id())
-                        continue;
-                j_sg_cpu = &per_cpu(sugov_cpu, j);
                /*
                 * If the CPU utilization was last updated before the previous
                 * frequency update and the time elapsed between the last update
@@ -254,7 +271,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu,
                        continue;
                }
                if (j_sg_cpu->flags & SCHED_CPUFREQ_RT_DL)
-                        return max_f;
+                        return policy->cpuinfo.max_freq;
                j_util = j_sg_cpu->util;
                j_max = j_sg_cpu->max;
@@ -289,7 +306,11 @@ static void sugov_update_shared(struct update_util_data *hook, u64 time,
        sg_cpu->last_update = time;
        if (sugov_should_update_freq(sg_policy, time)) {
-                next_f = sugov_next_freq_shared(sg_cpu, util, max, flags);
+                if (flags & SCHED_CPUFREQ_RT_DL)
+                        next_f = sg_policy->policy->cpuinfo.max_freq;
+                else
+                        next_f = sugov_next_freq_shared(sg_cpu);
                sugov_update_commit(sg_policy, time, next_f);
        }
@@ -473,7 +494,6 @@ static int sugov_init(struct cpufreq_policy *policy)
 {
        struct sugov_policy *sg_policy;
        struct sugov_tunables *tunables;
-        unsigned int lat;
        int ret = 0;
        /* State should be equivalent to EXIT */
@@ -512,10 +532,16 @@ static int sugov_init(struct cpufreq_policy *policy)
                goto stop_kthread;
        }
-        tunables->rate_limit_us = LATENCY_MULTIPLIER;
+        if (policy->transition_delay_us) {
-        lat = policy->cpuinfo.transition_latency / NSEC_PER_USEC;
+                tunables->rate_limit_us = policy->transition_delay_us;
-        if (lat)
+        } else {
-                tunables->rate_limit_us *= lat;
+                unsigned int lat;
+                tunables->rate_limit_us = LATENCY_MULTIPLIER;
+                lat = policy->cpuinfo.transition_latency / NSEC_PER_USEC;
+                if (lat)
+                        tunables->rate_limit_us *= lat;
+        }
        policy->governor_data = sg_policy;
        sg_policy->tunables = tunables;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 7fe53be86077..64c97fc130c4 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -993,6 +993,18 @@ ktime_t tick_nohz_get_sleep_length(void)
        return ts->sleep_length;
 }
+/**
+ * tick_nohz_get_idle_calls - return the current idle calls counter value
+ *
+ * Called from the schedutil frequency scaling governor in scheduler context.
+ */
+unsigned long tick_nohz_get_idle_calls(void)
+{
+        struct tick_sched *ts = this_cpu_ptr(&tick_cpu_sched);
+        return ts->idle_calls;
+}
 static void tick_nohz_account_idle_ticks(struct tick_sched *ts)
 {
 #ifndef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 27bb2e61276e..dd3e91d68dc7 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5566,6 +5566,15 @@ static void clear_ftrace_pids(struct trace_array *tr)
        trace_free_pid_list(pid_list);
 }
+void ftrace_clear_pids(struct trace_array *tr)
+{
+        mutex_lock(&ftrace_lock);
+        clear_ftrace_pids(tr);
+        mutex_unlock(&ftrace_lock);
+}
 static void ftrace_pid_reset(struct trace_array *tr)
 {
        mutex_lock(&ftrace_lock);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 54e7a90db848..ca47a4fa2986 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3405,11 +3405,23 @@ EXPORT_SYMBOL_GPL(ring_buffer_iter_reset);
 int ring_buffer_iter_empty(struct ring_buffer_iter *iter)
 {
        struct ring_buffer_per_cpu *cpu_buffer;
+        struct buffer_page *reader;
+        struct buffer_page *head_page;
+        struct buffer_page *commit_page;
+        unsigned commit;
        cpu_buffer = iter->cpu_buffer;
-        return iter->head_page == cpu_buffer->commit_page &&
+        /* Remember, trace recording is off when iterator is in use */
-                iter->head == rb_commit_index(cpu_buffer);
+        reader = cpu_buffer->reader_page;
+        head_page = cpu_buffer->head_page;
+        commit_page = cpu_buffer->commit_page;
+        commit = rb_page_commit(commit_page);
+        return ((iter->head_page == commit_page && iter->head == commit) ||
+                (iter->head_page == reader && commit_page == head_page &&
+                 head_page->read == commit &&
+                 iter->head == rb_page_commit(cpu_buffer->reader_page)));
 }
 EXPORT_SYMBOL_GPL(ring_buffer_iter_empty);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index f35109514a01..0ad75e9698f6 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6733,11 +6733,13 @@ ftrace_trace_snapshot_callback(struct ftrace_hash *hash,
                return ret;
 out_reg:
-        ret = register_ftrace_function_probe(glob, ops, count);
+        ret = alloc_snapshot(&global_trace);
+        if (ret < 0)
+                goto out;
-        if (ret >= 0)
+        ret = register_ftrace_function_probe(glob, ops, count);
-                alloc_snapshot(&global_trace);
+ out:
        return ret < 0 ? ret : 0;
 }
@@ -7402,6 +7404,7 @@ static int instance_rmdir(const char *name)
        tracing_set_nop(tr);
        event_trace_del_tracer(tr);
+        ftrace_clear_pids(tr);
        ftrace_destroy_function_files(tr);
        tracefs_remove_recursive(tr->dir);
        free_trace_buffers(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index ae1cce91fead..d19d52d600d6 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -896,6 +896,7 @@ int using_ftrace_ops_list_func(void);
 void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d_tracer);
 void ftrace_init_tracefs_toplevel(struct trace_array *tr,
                                  struct dentry *d_tracer);
+void ftrace_clear_pids(struct trace_array *tr);
 #else
 static inline int ftrace_trace_task(struct trace_array *tr)
 {
@@ -914,6 +915,7 @@ ftrace_init_global_array_ops(struct trace_array *tr) { }
 static inline void ftrace_reset_array_ops(struct trace_array *tr) { }
 static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d) { }
 static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
+static inline void ftrace_clear_pids(struct trace_array *tr) { }
 /* ftace_func_t type is not defined, use macro instead of static inline */
 #define ftrace_init_array_ops(tr, func) do { } while (0)
 #endif /* CONFIG_FUNCTION_TRACER */
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 97d62c2da6c2..fa16c0f82d6e 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1103,9 +1103,6 @@ config PROVE_LOCKING
         For more details, see Documentation/locking/lockdep-design.txt.
-config PROVE_LOCKING_SMALL
-        bool
 config LOCKDEP
        bool
        depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
@@ -1114,6 +1111,9 @@ config LOCKDEP
        select KALLSYMS
        select KALLSYMS_ALL
+config LOCKDEP_SMALL
+        bool
 config LOCK_STAT
        bool "Lock usage statistics"
        depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
diff --git a/mm/migrate.c b/mm/migrate.c
index ed97c2c14fa8..738f1d5f8350 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -184,9 +184,9 @@ void putback_movable_pages(struct list_head *l)
                        unlock_page(page);
                        put_page(page);
                } else {
-                        putback_lru_page(page);
                        dec_node_page_state(page, NR_ISOLATED_ANON +
                                        page_is_file_cache(page));
+                        putback_lru_page(page);
                }
        }
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index f3d603cef2c0..07efbc3a8656 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1090,10 +1090,10 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 {
        int migratetype = 0;
        int batch_free = 0;
-        unsigned long nr_scanned, flags;
+        unsigned long nr_scanned;
        bool isolated_pageblocks;
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
        isolated_pageblocks = has_isolate_pageblock(zone);
        nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
        if (nr_scanned)
@@ -1142,7 +1142,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                        trace_mm_page_pcpu_drain(page, 0, mt);
                } while (--count && --batch_free && !list_empty(list));
        }
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 static void free_one_page(struct zone *zone,
@@ -1150,9 +1150,8 @@ static void free_one_page(struct zone *zone,
                                unsigned int order,
                                int migratetype)
 {
-        unsigned long nr_scanned, flags;
+        unsigned long nr_scanned;
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
-        __count_vm_events(PGFREE, 1 << order);
        nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
        if (nr_scanned)
                __mod_node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED, -nr_scanned);
@@ -1162,7 +1161,7 @@ static void free_one_page(struct zone *zone,
                migratetype = get_pfnblock_migratetype(page, pfn);
        }
        __free_one_page(page, pfn, zone, order, migratetype);
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 static void __meminit __init_single_page(struct page *page, unsigned long pfn,
@@ -1240,6 +1239,7 @@ void __meminit reserve_bootmem_region(phys_addr_t start, phys_addr_t end)
 static void __free_pages_ok(struct page *page, unsigned int order)
 {
+        unsigned long flags;
        int migratetype;
        unsigned long pfn = page_to_pfn(page);
@@ -1247,7 +1247,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
                return;
        migratetype = get_pfnblock_migratetype(page, pfn);
+        local_irq_save(flags);
+        __count_vm_events(PGFREE, 1 << order);
        free_one_page(page_zone(page), page, pfn, order, migratetype);
+        local_irq_restore(flags);
 }
 static void __init __free_pages_boot_core(struct page *page, unsigned int order)
@@ -2219,9 +2222,8 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
                        int migratetype, bool cold)
 {
        int i, alloced = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
        for (i = 0; i < count; ++i) {
                struct page *page = __rmqueue(zone, order, migratetype);
                if (unlikely(page == NULL))
@@ -2257,7 +2259,7 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
         * pages added to the pcp list.
         */
        __mod_zone_page_state(zone, NR_FREE_PAGES, -(i << order));
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
        return alloced;
 }
@@ -2485,20 +2487,17 @@ void free_hot_cold_page(struct page *page, bool cold)
 {
        struct zone *zone = page_zone(page);
        struct per_cpu_pages *pcp;
+        unsigned long flags;
        unsigned long pfn = page_to_pfn(page);
        int migratetype;
-        if (in_interrupt()) {
-                __free_pages_ok(page, 0);
-                return;
-        }
        if (!free_pcp_prepare(page))
                return;
        migratetype = get_pfnblock_migratetype(page, pfn);
        set_pcppage_migratetype(page, migratetype);
-        preempt_disable();
+        local_irq_save(flags);
+        __count_vm_event(PGFREE);
        /*
         * We only track unmovable, reclaimable and movable on pcp lists.
@@ -2515,7 +2514,6 @@ void free_hot_cold_page(struct page *page, bool cold)
                migratetype = MIGRATE_MOVABLE;
        }
-        __count_vm_event(PGFREE);
        pcp = &this_cpu_ptr(zone->pageset)->pcp;
        if (!cold)
                list_add(&page->lru, &pcp->lists[migratetype]);
@@ -2529,7 +2527,7 @@ void free_hot_cold_page(struct page *page, bool cold)
        }
 out:
-        preempt_enable();
+        local_irq_restore(flags);
 }
 /*
@@ -2654,8 +2652,6 @@ static struct page *__rmqueue_pcplist(struct zone *zone, int migratetype,
 {
        struct page *page;
-        VM_BUG_ON(in_interrupt());
        do {
                if (list_empty(list)) {
                        pcp->count += rmqueue_bulk(zone, 0,
@@ -2686,8 +2682,9 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
        struct list_head *list;
        bool cold = ((gfp_flags & __GFP_COLD) != 0);
        struct page *page;
+        unsigned long flags;
-        preempt_disable();
+        local_irq_save(flags);
        pcp = &this_cpu_ptr(zone->pageset)->pcp;
        list = &pcp->lists[migratetype];
        page = __rmqueue_pcplist(zone,  migratetype, cold, pcp, list);
@@ -2695,7 +2692,7 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
                __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order);
                zone_statistics(preferred_zone, zone);
        }
-        preempt_enable();
+        local_irq_restore(flags);
        return page;
 }
@@ -2711,7 +2708,7 @@ struct page *rmqueue(struct zone *preferred_zone,
        unsigned long flags;
        struct page *page;
-        if (likely(order == 0) && !in_interrupt()) {
+        if (likely(order == 0)) {
                page = rmqueue_pcplist(preferred_zone, zone, order,
                                gfp_flags, migratetype);
                goto out;
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 809025ed97ea..5a4f5c5a31e8 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1768,8 +1768,7 @@ void __init init_mm_internals(void)
 {
        int ret __maybe_unused;
-        mm_percpu_wq = alloc_workqueue("mm_percpu_wq",
+        mm_percpu_wq = alloc_workqueue("mm_percpu_wq", WQ_MEM_RECLAIM, 0);
-                                       WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
 #ifdef CONFIG_SMP
        ret = cpuhp_setup_state_nocalls(CPUHP_MM_VMSTAT_DEAD, "mm/vmstat:dead",
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9424673009c1..29be2466970c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -105,15 +105,21 @@ static void queue_process(struct work_struct *work)
        while ((skb = skb_dequeue(&npinfo->txq))) {
                struct net_device *dev = skb->dev;
                struct netdev_queue *txq;
+                unsigned int q_index;
                if (!netif_device_present(dev) || !netif_running(dev)) {
                        kfree_skb(skb);
                        continue;
                }
-                txq = skb_get_tx_queue(dev, skb);
                local_irq_save(flags);
+                /* check if skb->queue_mapping is still valid */
+                q_index = skb_get_queue_mapping(skb);
+                if (unlikely(q_index >= dev->real_num_tx_queues)) {
+                        q_index = q_index % dev->real_num_tx_queues;
+                        skb_set_queue_mapping(skb, q_index);
+                }
+                txq = netdev_get_tx_queue(dev, q_index);
                HARD_TX_LOCK(dev, txq, smp_processor_id());
                if (netif_xmit_frozen_or_stopped(txq) ||
                    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9f781092fda9..f86bf69cfb8d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3082,22 +3082,32 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
        if (sg && csum && (mss != GSO_BY_FRAGS))  {
                if (!(features & NETIF_F_GSO_PARTIAL)) {
                        struct sk_buff *iter;
+                        unsigned int frag_len;
                        if (!list_skb ||
                            !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
                                goto normal;
-                        /* Split the buffer at the frag_list pointer.
+                        /* If we get here then all the required
-                         * This is based on the assumption that all
+                         * GSO features except frag_list are supported.
-                         * buffers in the chain excluding the last
+                         * Try to split the SKB to multiple GSO SKBs
-                         * containing the same amount of data.
+                         * with no frag_list.
+                         * Currently we can do that only when the buffers don't
+                         * have a linear part and all the buffers except
+                         * the last are of the same length.
                         */
+                        frag_len = list_skb->len;
                        skb_walk_frags(head_skb, iter) {
+                                if (frag_len != iter->len && iter->next)
+                                        goto normal;
                                if (skb_headlen(iter))
                                        goto normal;
                                len -= iter->len;
                        }
+                        if (len != frag_len)
+                                goto normal;
                }
                /* GSO partial only requires that we trim off any excess that
@@ -3807,6 +3817,7 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
        serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
        serr->ee.ee_info = tstype;
        serr->opt_stats = opt_stats;
+        serr->header.h4.iif = skb->dev ? skb->dev->ifindex : 0;
        if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
                serr->ee.ee_data = skb_shinfo(skb)->tskey;
                if (sk->sk_protocol == IPPROTO_TCP &&
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ebd953bc5607..1d46d05efb0f 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -488,16 +488,15 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk,
                return false;
        /* Support IP_PKTINFO on tstamp packets if requested, to correlate
-         * timestamp with egress dev. Not possible for packets without dev
+         * timestamp with egress dev. Not possible for packets without iif
         * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
         */
-        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
+        info = PKTINFO_SKB_CB(skb);
-            (!skb->dev))
+        if (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG) ||
+            !info->ipi_ifindex)
                return false;
-        info = PKTINFO_SKB_CB(skb);
        info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
-        info->ipi_ifindex = skb->dev->ifindex;
        return true;
 }
@@ -591,6 +590,7 @@ static bool setsockopt_needs_rtnl(int optname)
        case MCAST_LEAVE_GROUP:
        case MCAST_LEAVE_SOURCE_GROUP:
        case MCAST_UNBLOCK_SOURCE:
+        case IP_ROUTER_ALERT:
                return true;
        }
        return false;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index c0317c940bcd..b036e85e093b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1278,7 +1278,7 @@ static void mrtsock_destruct(struct sock *sk)
        struct net *net = sock_net(sk);
        struct mr_table *mrt;
-        rtnl_lock();
+        ASSERT_RTNL();
        ipmr_for_each_table(mrt, net) {
                if (sk == rtnl_dereference(mrt->mroute_sk)) {
                        IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
@@ -1289,7 +1289,6 @@ static void mrtsock_destruct(struct sock *sk)
                        mroute_clean_tables(mrt, false);
                }
        }
-        rtnl_unlock();
 }
 /* Socket options and virtual interface manipulation. The whole
@@ -1353,13 +1352,8 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
                if (sk != rcu_access_pointer(mrt->mroute_sk)) {
                        ret = -EACCES;
                } else {
-                        /* We need to unlock here because mrtsock_destruct takes
-                         * care of rtnl itself and we can't change that due to
-                         * the IP_ROUTER_ALERT setsockopt which runs without it.
-                         */
-                        rtnl_unlock();
                        ret = ip_ra_control(sk, 0, NULL);
-                        goto out;
+                        goto out_unlock;
                }
                break;
        case MRT_ADD_VIF:
@@ -1470,7 +1464,6 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
        }
 out_unlock:
        rtnl_unlock();
-out:
        return ret;
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 8119e1f66e03..9d943974de2b 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -682,7 +682,9 @@ static void raw_close(struct sock *sk, long timeout)
        /*
         * Raw sockets may have direct kernel references. Kill them.
         */
+        rtnl_lock();
        ip_ra_control(sk, 0, NULL);
+        rtnl_unlock();
        sk_common_release(sk);
 }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index eec27f87efac..e011122ebd43 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -405,9 +405,6 @@ static inline bool ipv6_datagram_support_addr(struct sock_exterr_skb *serr)
 * At one point, excluding local errors was a quick test to identify icmp/icmp6
 * errors. This is no longer true, but the test remained, so the v6 stack,
 * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
- *
- * Timestamp code paths do not initialize the fields expected by cmsg:
- * the PKTINFO fields in skb->cb[]. Fill those in here.
 */
 static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
                                      struct sock_exterr_skb *serr)
@@ -419,14 +416,9 @@ static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
        if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
                return false;
-        if (!skb->dev)
+        if (!IP6CB(skb)->iif)
                return false;
-        if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = skb->dev->ifindex;
-        else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
        return true;
 }
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 275cac628a95..25192a3b0cd7 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -388,7 +388,6 @@ looped_back:
                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                  ((&hdr->segments_left) -
                                   skb_network_header(skb)));
-                kfree_skb(skb);
                return -1;
        }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aacfb4bce153..c45b12b4431c 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -122,11 +122,14 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                        max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
        /*
         * RFC4291 2.5.3
+         * The loopback address must not be used as the source address in IPv6
+         * packets that are sent outside of a single node. [..]
         * A packet received on an interface with a destination address
         * of loopback must be dropped.
         */
-        if (!(dev->flags & IFF_LOOPBACK) &&
+        if ((ipv6_addr_loopback(&hdr->saddr) ||
-            ipv6_addr_loopback(&hdr->daddr))
+             ipv6_addr_loopback(&hdr->daddr)) &&
+             !(dev->flags & IFF_LOOPBACK))
                goto err;
        /* RFC4291 Errata ID: 3480
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 6ba6c900ebcf..bf34d0950752 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -774,7 +774,8 @@ failure:
 *      Delete a VIF entry
 */
-static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
+                       struct list_head *head)
 {
        struct mif_device *v;
        struct net_device *dev;
@@ -820,7 +821,7 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
                                             dev->ifindex, &in6_dev->cnf);
        }
-        if (v->flags & MIFF_REGISTER)
+        if ((v->flags & MIFF_REGISTER) && !notify)
                unregister_netdevice_queue(dev, head);
        dev_put(dev);
@@ -1331,7 +1332,6 @@ static int ip6mr_device_event(struct notifier_block *this,
        struct mr6_table *mrt;
        struct mif_device *v;
        int ct;
-        LIST_HEAD(list);
        if (event != NETDEV_UNREGISTER)
                return NOTIFY_DONE;
@@ -1340,10 +1340,9 @@ static int ip6mr_device_event(struct notifier_block *this,
                v = &mrt->vif6_table[0];
                for (ct = 0; ct < mrt->maxvif; ct++, v++) {
                        if (v->dev == dev)
-                                mif6_delete(mrt, ct, &list);
+                                mif6_delete(mrt, ct, 1, NULL);
                }
        }
-        unregister_netdevice_many(&list);
        return NOTIFY_DONE;
 }
@@ -1552,7 +1551,7 @@ static void mroute_clean_tables(struct mr6_table *mrt, bool all)
        for (i = 0; i < mrt->maxvif; i++) {
                if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
                        continue;
-                mif6_delete(mrt, i, &list);
+                mif6_delete(mrt, i, 0, &list);
        }
        unregister_netdevice_many(&list);
@@ -1707,7 +1706,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                        return -EFAULT;
                rtnl_lock();
-                ret = mif6_delete(mrt, mifi, NULL);
+                ret = mif6_delete(mrt, mifi, 0, NULL);
                rtnl_unlock();
                return ret;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9db1418993f2..fb174b590fd3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1854,6 +1854,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
        int addr_type;
        int err = -EINVAL;
+        /* RTF_PCPU is an internal flag; can not be set by userspace */
+        if (cfg->fc_flags & RTF_PCPU)
+                goto out;
        if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
                goto out;
 #ifndef CONFIG_IPV6_SUBTREES
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index a855eb325b03..5f44ffed2576 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -53,6 +53,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
                struct sr6_tlv *tlv;
                unsigned int tlv_len;
+                if (trailing < sizeof(*tlv))
+                        return false;
                tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset);
                tlv_len = sizeof(*tlv) + tlv->len;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c6252ed42c1d..be8cecc65002 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -63,8 +63,13 @@ struct pfkey_sock {
                } u;
                struct sk_buff  *skb;
        } dump;
+        struct mutex dump_lock;
 };
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+                               xfrm_address_t *saddr, xfrm_address_t *daddr,
+                               u16 *family);
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
        return (struct pfkey_sock *)sk;
@@ -139,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
 {
        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
        struct sock *sk;
+        struct pfkey_sock *pfk;
        int err;
        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
@@ -153,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
        if (sk == NULL)
                goto out;
+        pfk = pfkey_sk(sk);
+        mutex_init(&pfk->dump_lock);
        sock->ops = &pfkey_ops;
        sock_init_data(sock, sk);
@@ -281,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
        struct sadb_msg *hdr;
        int rc;
+        mutex_lock(&pfk->dump_lock);
+        if (!pfk->dump.dump) {
+                rc = 0;
+                goto out;
+        }
        rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
+        if (rc == -ENOBUFS) {
-                return 0;
+                rc = 0;
+                goto out;
+        }
        if (pfk->dump.skb) {
-                if (!pfkey_can_dump(&pfk->sk))
+                if (!pfkey_can_dump(&pfk->sk)) {
-                        return 0;
+                        rc = 0;
+                        goto out;
+                }
                hdr = (struct sadb_msg *) pfk->dump.skb->data;
                hdr->sadb_msg_seq = 0;
@@ -298,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
        }
        pfkey_terminate_dump(pfk);
+out:
+        mutex_unlock(&pfk->dump_lock);
        return rc;
 }
@@ -1793,19 +1815,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
        struct xfrm_address_filter *filter = NULL;
        struct pfkey_sock *pfk = pfkey_sk(sk);
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                return -EBUSY;
+        }
        proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-        if (proto == 0)
+        if (proto == 0) {
+                mutex_unlock(&pfk->dump_lock);
                return -EINVAL;
+        }
        if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
                struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
                filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-                if (filter == NULL)
+                if (filter == NULL) {
+                        mutex_unlock(&pfk->dump_lock);
                        return -ENOMEM;
+                }
                memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
                       sizeof(xfrm_address_t));
@@ -1821,6 +1850,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
        pfk->dump.dump = pfkey_dump_sa;
        pfk->dump.done = pfkey_dump_sa_done;
        xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
+        mutex_unlock(&pfk->dump_lock);
        return pfkey_do_dump(pfk);
 }
@@ -1913,19 +1943,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
        /* addresses present only in tunnel mode */
        if (t->mode == XFRM_MODE_TUNNEL) {
-                u8 *sa = (u8 *) (rq + 1);
+                int err;
-                int family, socklen;
-                family = pfkey_sockaddr_extract((struct sockaddr *)sa,
+                err = parse_sockaddr_pair(
-                                                &t->saddr);
+                        (struct sockaddr *)(rq + 1),
-                if (!family)
+                        rq->sadb_x_ipsecrequest_len - sizeof(*rq),
-                        return -EINVAL;
+                        &t->saddr, &t->id.daddr, &t->encap_family);
+                if (err)
-                socklen = pfkey_sockaddr_len(family);
+                        return err;
-                if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
-                                           &t->id.daddr) != family)
-                        return -EINVAL;
-                t->encap_family = family;
        } else
                t->encap_family = xp->family;
@@ -1945,7 +1970,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
        if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
                return -EINVAL;
-        while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+        while (len >= sizeof(*rq)) {
+                if (len < rq->sadb_x_ipsecrequest_len ||
+                    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+                        return -EINVAL;
                if ((err = parse_ipsecrequest(xp, rq)) < 0)
                        return err;
                len -= rq->sadb_x_ipsecrequest_len;
@@ -2408,7 +2437,6 @@ out:
        return err;
 }
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
        return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2420,7 +2448,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
 {
        int af, socklen;
-        if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+        if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
                return -EINVAL;
        af = pfkey_sockaddr_extract(sa, saddr);
@@ -2436,6 +2464,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
        return 0;
 }
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
                                    struct xfrm_migrate *m)
 {
@@ -2443,13 +2472,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
        struct sadb_x_ipsecrequest *rq2;
        int mode;
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
+        if (len < sizeof(*rq1) ||
-            len < rq1->sadb_x_ipsecrequest_len)
+            len < rq1->sadb_x_ipsecrequest_len ||
+            rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
                return -EINVAL;
        /* old endoints */
        err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-                                  rq1->sadb_x_ipsecrequest_len,
+                                  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
                                  &m->old_saddr, &m->old_daddr,
                                  &m->old_family);
        if (err)
@@ -2458,13 +2488,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
        rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
        len -= rq1->sadb_x_ipsecrequest_len;
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
+        if (len <= sizeof(*rq2) ||
-            len < rq2->sadb_x_ipsecrequest_len)
+            len < rq2->sadb_x_ipsecrequest_len ||
+            rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
                return -EINVAL;
        /* new endpoints */
        err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-                                  rq2->sadb_x_ipsecrequest_len,
+                                  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
                                  &m->new_saddr, &m->new_daddr,
                                  &m->new_family);
        if (err)
@@ -2679,14 +2710,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb
 {
        struct pfkey_sock *pfk = pfkey_sk(sk);
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                return -EBUSY;
+        }
        pfk->dump.msg_version = hdr->sadb_msg_version;
        pfk->dump.msg_portid = hdr->sadb_msg_pid;
        pfk->dump.dump = pfkey_dump_sp;
        pfk->dump.done = pfkey_dump_sp_done;
        xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
+        mutex_unlock(&pfk->dump_lock);
        return pfkey_do_dump(pfk);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e48724a6725e..4d7543d1a62c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -208,6 +208,51 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
        return len;
 }
+static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
+                                         struct sk_buff *skb,
+                                         int rtap_vendor_space)
+{
+        struct {
+                struct ieee80211_hdr_3addr hdr;
+                u8 category;
+                u8 action_code;
+        } __packed action;
+        if (!sdata)
+                return;
+        BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
+        if (skb->len < rtap_vendor_space + sizeof(action) +
+                       VHT_MUMIMO_GROUPS_DATA_LEN)
+                return;
+        if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
+                return;
+        skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
+        if (!ieee80211_is_action(action.hdr.frame_control))
+                return;
+        if (action.category != WLAN_CATEGORY_VHT)
+                return;
+        if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
+                return;
+        if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
+                return;
+        skb = skb_copy(skb, GFP_ATOMIC);
+        if (!skb)
+                return;
+        skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
 /*
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
@@ -515,7 +560,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
        struct net_device *prev_dev = NULL;
        int present_fcs_len = 0;
        unsigned int rtap_vendor_space = 0;
-        struct ieee80211_mgmt *mgmt;
        struct ieee80211_sub_if_data *monitor_sdata =
                rcu_dereference(local->monitor_sdata);
@@ -553,6 +597,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                return remove_monitor_info(local, origskb, rtap_vendor_space);
        }
+        ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
        /* room for the radiotap header based on driver features */
        rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
        needed_headroom = rt_hdrlen - rtap_vendor_space;
@@ -618,23 +664,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                ieee80211_rx_stats(sdata->dev, skb->len);
        }
-        mgmt = (void *)skb->data;
-        if (monitor_sdata &&
-            skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + VHT_MUMIMO_GROUPS_DATA_LEN &&
-            ieee80211_is_action(mgmt->frame_control) &&
-            mgmt->u.action.category == WLAN_CATEGORY_VHT &&
-            mgmt->u.action.u.vht_group_notif.action_code == WLAN_VHT_ACTION_GROUPID_MGMT &&
-            is_valid_ether_addr(monitor_sdata->u.mntr.mu_follow_addr) &&
-            ether_addr_equal(mgmt->da, monitor_sdata->u.mntr.mu_follow_addr)) {
-                struct sk_buff *mu_skb = skb_copy(skb, GFP_ATOMIC);
-                if (mu_skb) {
-                        mu_skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
-                        skb_queue_tail(&monitor_sdata->skb_queue, mu_skb);
-                        ieee80211_queue_work(&local->hw, &monitor_sdata->work);
-                }
-        }
        if (prev_dev) {
                skb->dev = prev_dev;
                netif_receive_skb(skb);
@@ -3610,6 +3639,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
                            !ether_addr_equal(bssid, hdr->addr1))
                                return false;
                }
+                /*
+                 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
+                 * the BSSID - we've checked that already but may have accepted
+                 * the wildcard (ff:ff:ff:ff:ff:ff).
+                 *
+                 * It also says:
+                 *      The BSSID of the Data frame is determined as follows:
+                 *      a) If the STA is contained within an AP or is associated
+                 *         with an AP, the BSSID is the address currently in use
+                 *         by the STA contained in the AP.
+                 *
+                 * So we should not accept data frames with an address that's
+                 * multicast.
+                 *
+                 * Accepting it also opens a security problem because stations
+                 * could encrypt it with the GTK and inject traffic that way.
+                 */
+                if (ieee80211_is_data(hdr->frame_control) && multicast)
+                        return false;
                return true;
        case NL80211_IFTYPE_WDS:
                if (bssid || !ieee80211_is_data(hdr->frame_control))
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index ae5ac175b2be..9da7368b0140 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -658,7 +658,9 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
        }
        if (plen != len) {
-                skb_pad(skb, plen - len);
+                rc = skb_pad(skb, plen - len);
+                if (rc)
+                        goto out_node;
                skb_put(skb, plen - len);
        }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index b70aa57319ea..e05b924618a0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -529,20 +529,20 @@ errout:
        return err;
 }
-static int nla_memdup_cookie(struct tc_action *a, struct nlattr **tb)
+static struct tc_cookie *nla_memdup_cookie(struct nlattr **tb)
 {
-        a->act_cookie = kzalloc(sizeof(*a->act_cookie), GFP_KERNEL);
+        struct tc_cookie *c = kzalloc(sizeof(*c), GFP_KERNEL);
-        if (!a->act_cookie)
+        if (!c)
-                return -ENOMEM;
+                return NULL;
-        a->act_cookie->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
+        c->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
-        if (!a->act_cookie->data) {
+        if (!c->data) {
-                kfree(a->act_cookie);
+                kfree(c);
-                return -ENOMEM;
+                return NULL;
        }
-        a->act_cookie->len = nla_len(tb[TCA_ACT_COOKIE]);
+        c->len = nla_len(tb[TCA_ACT_COOKIE]);
-        return 0;
+        return c;
 }
 struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
@@ -551,6 +551,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 {
        struct tc_action *a;
        struct tc_action_ops *a_o;
+        struct tc_cookie *cookie = NULL;
        char act_name[IFNAMSIZ];
        struct nlattr *tb[TCA_ACT_MAX + 1];
        struct nlattr *kind;
@@ -566,6 +567,18 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
                        goto err_out;
                if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ)
                        goto err_out;
+                if (tb[TCA_ACT_COOKIE]) {
+                        int cklen = nla_len(tb[TCA_ACT_COOKIE]);
+                        if (cklen > TC_COOKIE_MAX_SIZE)
+                                goto err_out;
+                        cookie = nla_memdup_cookie(tb);
+                        if (!cookie) {
+                                err = -ENOMEM;
+                                goto err_out;
+                        }
+                }
        } else {
                err = -EINVAL;
                if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ)
@@ -604,20 +617,12 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
        if (err < 0)
                goto err_mod;
-        if (tb[TCA_ACT_COOKIE]) {
+        if (name == NULL && tb[TCA_ACT_COOKIE]) {
-                int cklen = nla_len(tb[TCA_ACT_COOKIE]);
+                if (a->act_cookie) {
+                        kfree(a->act_cookie->data);
-                if (cklen > TC_COOKIE_MAX_SIZE) {
+                        kfree(a->act_cookie);
-                        err = -EINVAL;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
-                }
-                if (nla_memdup_cookie(a, tb) < 0) {
-                        err = -ENOMEM;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
                }
+                a->act_cookie = cookie;
        }
        /* module count goes up only when brand new policy is created
@@ -632,6 +637,10 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 err_mod:
        module_put(a_o->owner);
 err_out:
+        if (cookie) {
+                kfree(cookie->data);
+                kfree(cookie);
+        }
        return ERR_PTR(err);
 }
diff --git a/security/keys/gc.c b/security/keys/gc.c
index addf060399e0..9cb4fe4478a1 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -46,7 +46,7 @@ static unsigned long key_gc_flags;
 * immediately unlinked.
 */
 struct key_type key_type_dead = {
-        .name = "dead",
+        .name = ".dead",
 };
 /*
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 52c34532c785..4ad3212adebe 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -273,7 +273,8 @@ error:
 * Create and join an anonymous session keyring or join a named session
 * keyring, creating it if necessary.  A named session keyring must have Search
 * permission for it to be joined.  Session keyrings without this permit will
- * be skipped over.
+ * be skipped over.  It is not permitted for userspace to create or join
+ * keyrings whose name begin with a dot.
 *
 * If successful, the ID of the joined session keyring will be returned.
 */
@@ -290,12 +291,16 @@ long keyctl_join_session_keyring(const char __user *_name)
                        ret = PTR_ERR(name);
                        goto error;
                }
+                ret = -EPERM;
+                if (name[0] == '.')
+                        goto error_name;
        }
        /* join the session */
        ret = join_session_keyring(name);
+error_name:
        kfree(name);
 error:
        return ret;
 }
@@ -1253,8 +1258,8 @@ error:
 * Read or set the default keyring in which request_key() will cache keys and
 * return the old setting.
 *
- * If a process keyring is specified then this will be created if it doesn't
+ * If a thread or process keyring is specified then it will be created if it
- * yet exist.  The old setting will be returned if successful.
+ * doesn't yet exist.  The old setting will be returned if successful.
 */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
@@ -1279,11 +1284,8 @@ long keyctl_set_reqkey_keyring(int reqkey_defl)
        case KEY_REQKEY_DEFL_PROCESS_KEYRING:
                ret = install_process_keyring_to_cred(new);
-                if (ret < 0) {
+                if (ret < 0)
-                        if (ret != -EEXIST)
+                        goto error;
-                                goto error;
-                        ret = 0;
-                }
                goto set;
        case KEY_REQKEY_DEFL_DEFAULT:
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index b6fdd22205b1..9139b18fc863 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -128,13 +128,18 @@ error:
 }
 /*
- * Install a fresh thread keyring directly to new credentials.  This keyring is
+ * Install a thread keyring to the given credentials struct if it didn't have
- * allowed to overrun the quota.
+ * one already.  This is allowed to overrun the quota.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
 */
 int install_thread_keyring_to_cred(struct cred *new)
 {
        struct key *keyring;
+        if (new->thread_keyring)
+                return 0;
        keyring = keyring_alloc("_tid", new->uid, new->gid, new,
                                KEY_POS_ALL | KEY_USR_VIEW,
                                KEY_ALLOC_QUOTA_OVERRUN,
@@ -147,7 +152,9 @@ int install_thread_keyring_to_cred(struct cred *new)
 }
 /*
- * Install a fresh thread keyring, discarding the old one.
+ * Install a thread keyring to the current task if it didn't have one already.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
 */
 static int install_thread_keyring(void)
 {
@@ -158,8 +165,6 @@ static int install_thread_keyring(void)
        if (!new)
                return -ENOMEM;
-        BUG_ON(new->thread_keyring);
        ret = install_thread_keyring_to_cred(new);
        if (ret < 0) {
                abort_creds(new);
@@ -170,17 +175,17 @@ static int install_thread_keyring(void)
 }
 /*
- * Install a process keyring directly to a credentials struct.
+ * Install a process keyring to the given credentials struct if it didn't have
+ * one already.  This is allowed to overrun the quota.
 *
- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
+ * Return: 0 if a process keyring is now present; -errno on failure.
- * and other value on any other error
 */
 int install_process_keyring_to_cred(struct cred *new)
 {
        struct key *keyring;
        if (new->process_keyring)
-                return -EEXIST;
+                return 0;
        keyring = keyring_alloc("_pid", new->uid, new->gid, new,
                                KEY_POS_ALL | KEY_USR_VIEW,
@@ -194,11 +199,9 @@ int install_process_keyring_to_cred(struct cred *new)
 }
 /*
- * Make sure a process keyring is installed for the current process.  The
+ * Install a process keyring to the current task if it didn't have one already.
- * existing process keyring is not replaced.
 *
- * Returns 0 if there is a process keyring by the end of this function, some
+ * Return: 0 if a process keyring is now present; -errno on failure.
- * error otherwise.
 */
 static int install_process_keyring(void)
 {
@@ -212,14 +215,18 @@ static int install_process_keyring(void)
        ret = install_process_keyring_to_cred(new);
        if (ret < 0) {
                abort_creds(new);
-                return ret != -EEXIST ? ret : 0;
+                return ret;
        }
        return commit_creds(new);
 }
 /*
- * Install a session keyring directly to a credentials struct.
+ * Install the given keyring as the session keyring of the given credentials
+ * struct, replacing the existing one if any.  If the given keyring is NULL,
+ * then install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
 */
 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 {
@@ -254,8 +261,11 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 }
 /*
- * Install a session keyring, discarding the old one.  If a keyring is not
+ * Install the given keyring as the session keyring of the current task,
- * supplied, an empty one is invented.
+ * replacing the existing one if any.  If the given keyring is NULL, then
+ * install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
 */
 static int install_session_keyring(struct key *keyring)
 {
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index a0aa2009b0e0..20f1871874df 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -282,7 +282,7 @@ static void test_arraymap_percpu(int task, void *data)
 {
        unsigned int nr_cpus = bpf_num_possible_cpus();
        int key, next_key, fd, i;
-        long values[nr_cpus];
+        long long values[nr_cpus];
        fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
                            sizeof(values[0]), 2, 0);
@@ -340,7 +340,7 @@ static void test_arraymap_percpu_many_keys(void)
         * allocator more than anything else
         */
        unsigned int nr_keys = 2000;
-        long values[nr_cpus];
+        long long values[nr_cpus];
        int key, fd, i;
        fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
new file mode 100644
index 000000000000..bab5ff7c607e
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
@@ -0,0 +1,117 @@
+#!/bin/sh
+# description: ftrace - function pid filters
+# Make sure that function pid matching filter works.
+# Also test it on an instance directory
+if ! grep -q function available_tracers; then
+    echo "no function tracer configured"
+    exit_unsupported
+fi
+if [ ! -f set_ftrace_pid ]; then
+    echo "set_ftrace_pid not found? Is function tracer not set?"
+    exit_unsupported
+fi
+if [ ! -f set_ftrace_filter ]; then
+    echo "set_ftrace_filter not found? Is function tracer not set?"
+    exit_unsupported
+fi
+do_function_fork=1
+if [ ! -f options/function-fork ]; then
+    do_function_fork=0
+    echo "no option for function-fork found. Option will not be tested."
+fi
+read PID _ < /proc/self/stat
+if [ $do_function_fork -eq 1 ]; then
+    # default value of function-fork option
+    orig_value=`grep function-fork trace_options`
+fi
+do_reset() {
+    reset_tracer
+    clear_trace
+    enable_tracing
+    echo > set_ftrace_filter
+    echo > set_ftrace_pid
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+    echo $orig_value > trace_options
+}
+fail() { # msg
+    do_reset
+    echo $1
+    exit $FAIL
+}
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
+}
+do_test() {
+    disable_tracing
+    echo do_execve* > set_ftrace_filter
+    echo *do_fork >> set_ftrace_filter
+    echo $PID > set_ftrace_pid
+    echo function > current_tracer
+    if [ $do_function_fork -eq 1 ]; then
+        # don't allow children to be traced
+        echo nofunction-fork > trace_options
+    fi
+    enable_tracing
+    yield
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+    # count_other should be 0
+    if [ $count_pid -eq 0 -o $count_other -ne 0 ]; then
+        fail "PID filtering not working?"
+    fi
+    disable_tracing
+    clear_trace
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+    # allow children to be traced
+    echo function-fork > trace_options
+    enable_tracing
+    yield
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+    # count_other should NOT be 0
+    if [ $count_pid -eq 0 -o $count_other -eq 0 ]; then
+        fail "PID filtering not following fork?"
+    fi
+}
+do_test
+mkdir instances/foo
+cd instances/foo
+do_test
+cd ../../
+rmdir instances/foo
+do_reset
+exit 0
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 412459369686..e62bb354820c 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -75,7 +75,7 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
 {
        int fd, val;
-        fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP));
+        fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP));
        if (fd < 0) {
                perror("socket packet");
                exit(1);
@@ -95,6 +95,24 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
        return fd;
 }
+static void sock_fanout_set_cbpf(int fd)
+{
+        struct sock_filter bpf_filter[] = {
+                BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 80),           /* ldb [80] */
+                BPF_STMT(BPF_RET+BPF_A, 0),                   /* ret A */
+        };
+        struct sock_fprog bpf_prog;
+        bpf_prog.filter = bpf_filter;
+        bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
+        if (setsockopt(fd, SOL_PACKET, PACKET_FANOUT_DATA, &bpf_prog,
+                       sizeof(bpf_prog))) {
+                perror("fanout data cbpf");
+                exit(1);
+        }
+}
 static void sock_fanout_set_ebpf(int fd)
 {
        const int len_off = __builtin_offsetof(struct __sk_buff, len);
@@ -270,7 +288,7 @@ static int test_datapath(uint16_t typeflags, int port_off,
                exit(1);
        }
        if (type == PACKET_FANOUT_CBPF)
-                sock_setfilter(fds[0], SOL_PACKET, PACKET_FANOUT_DATA);
+                sock_fanout_set_cbpf(fds[0]);
        else if (type == PACKET_FANOUT_EBPF)
                sock_fanout_set_ebpf(fds[0]);
diff --git a/tools/testing/selftests/net/psock_lib.h b/tools/testing/selftests/net/psock_lib.h
index a77da88bf946..7d990d6c861b 100644
--- a/tools/testing/selftests/net/psock_lib.h
+++ b/tools/testing/selftests/net/psock_lib.h
@@ -38,7 +38,7 @@
 # define __maybe_unused         __attribute__ ((__unused__))
 #endif
-static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
+static __maybe_unused void pair_udp_setfilter(int fd)
 {
        /* the filter below checks for all of the following conditions that
         * are based on the contents of create_payload()
@@ -76,23 +76,16 @@ static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
        };
        struct sock_fprog bpf_prog;
-        if (lvl == SOL_PACKET && optnum == PACKET_FANOUT_DATA)
-                bpf_filter[5].code = 0x16;   /* RET A                         */
        bpf_prog.filter = bpf_filter;
        bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
-        if (setsockopt(fd, lvl, optnum, &bpf_prog,
+        if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &bpf_prog,
                       sizeof(bpf_prog))) {
                perror("setsockopt SO_ATTACH_FILTER");
                exit(1);
        }
 }
-static __maybe_unused void pair_udp_setfilter(int fd)
-{
-        sock_setfilter(fd, SOL_SOCKET, SO_ATTACH_FILTER);
-}
 static __maybe_unused void pair_udp_open(int fds[], uint16_t port)
 {
        struct sockaddr_in saddr, daddr;